Team IT Security - 📰 Alle Kategorien

The agent security gap: 54% of enterprises have already had an AI agent incident, and most still let agents share credentials

Thu, 23 Jul 2026 19:19:41 +0200

Across 107 enterprises, AI agents are being given real access to systems and data while the controls meant to contain them lag behind. More than half have already had a confirmed agent security incident or a near-miss; only about a third give every agent its own scoped identity, and most agents still share credentials; and only three in ten isolate their highest-risk agents. The security stack is overwhelmingly borrowed from the model providers and hyperscalers rather than purpose-built for agents, spending remains a thin slice of the security budget, and enterprises are evenly split on whether their defenses are keeping pace with AI-enabled attackers. The result is an agent security gap — autonomous agents proliferating faster than the identity, isolation, and enforcement controls needed to hold them.

This wave of VentureBeat Pulse Research examines how enterprises secure their AI agents: what tooling they run, how they manage agent identity and isolation, what has already gone wrong, how much they spend, and whether they believe their defenses are keeping pace with AI-enabled attackers.

The central finding is an agent security gap — the distance between the autonomy enterprises are granting their agents and the controls in place to contain them. More than half of organizations (54%) have already experienced a confirmed agent security incident (18%) or a near-miss caught before harm (36%). The structural weakness beneath those numbers is identity: only about a third (32%) give every agent its own scoped, managed identity, while the rest report that some agents share credentials or that agents mostly run on shared API keys and human or service-account credentials. When agents share credentials, a single compromised or over-permissioned agent carries a wide blast radius — and only three in ten enterprises (30%) isolate their highest-risk agents in sandboxes to bound that radius.

What makes the gap notable is how comfortable enterprises are inside it. The security stack is overwhelmingly provider-native — OpenAI’s guardrails (51%), Google’s and Microsoft’s cloud controls, and Anthropic’s managed-agent controls dominate, while the dedicated agent-security specialists barely register — and satisfaction with that borrowed stack is high, averaging 4.2 out of 5. Yet spending remains a thin slice of the security budget, only a third of enterprises believe their AI defenses are ahead of AI-enabled attackers, and a clear majority plan to change tooling within the year. Enterprises are satisfied with controls they are simultaneously preparing to replace.

Methodology

VentureBeat fielded this survey as part of its ongoing Pulse Research series, this instrument focused on enterprise agent security — the tooling, identity, isolation, and enforcement controls organizations use to secure autonomous AI agents. Responses are filtered to organizations with more than 100 employees (n=107; the survey’s smallest size band, 1–100 employees, is excluded), drawn from a single June 2026 wave. Because this is one wave rather than a pooled multi-month sample, the report reads cross-sectionally and does not infer month-over-month trends. Several questions were multiple-select, so those shares can sum to more than 100%.

By role the sample is senior and buyer-credible: 45% are final decision-makers for AI purchases and another 30% recommenders or influencers. Managers (43%), individual contributors (24%), VPs and directors (15%), and the C-suite (11%) make up the seniority mix. By organization size the sample is mid-market-weighted: 251–1,000 (42%) and 101–250 (25%) employees lead, with 1,001–5,000 (19%), 5,001–10,000 (8%), and 10,001+ (7%) above them. Technology/Software is the largest industry at 23%, followed by Manufacturing (15%), Retail/E-commerce (14%), and Healthcare/Life Sciences (13%).

At 107 respondents the sample is large enough to read directionally but should be treated as a directional signal rather than a precise measurement; it is self-selected and is not a probability sample. It skews toward the mid-market, so it is best read as the view from organizations actively standing up agent security rather than from the largest operators.

Satisfaction ratings are computed on the respondents who answered each rating question; the overall satisfaction score reflects 82 of the 107 qualified respondents.

Finding 1: The incidents are already here

More than half have had an agent security incident or near-miss

We asked whether organizations had experienced an agent security incident — a confirmed breach, or a near-miss caught before harm. Most that run agents in production had.

This is the report’s defining number. More than half of organizations (54%) have already had an agent security event — 18% a confirmed incident and 36% a near-miss caught before it caused harm. Only 42% report nothing, and a small remainder either run no agents in production or don’t track such events. That so many report near-misses rather than only confirmed incidents is telling: enterprises are catching problems, but they are catching them close to the edge. The controls examined in the rest of this report — identity, isolation, enforcement — are what determine whether the next near-miss stays a near-miss.

Exposure scales with company size, but containment does not. The incident-or-near-miss rate rises from 49% in the mid-market (companies with 101-1,000 employees) to 63% at larger enterprises (above 1,000 employees), while sandbox isolation of high-risk agents falls from 35% to 20%, and satisfaction with security tooling drops from 4.36 to 3.97. The organizations running the most agents across the most systems carry the most incidents and the least of the one control that bounds an incident's blast radius.

Finding 2: The identity gap

Only a third give every agent its own scoped identity

We asked how enterprises manage the identity of their AI agents — whether each agent has its own credentials, or agents share them. Full per-agent identity is the exception.

Rolled together, the overlapping answers show 69% of enterprises (74 of 107) with credential sharing somewhere in the agent fleet. Identity is the structural weakness beneath the incidents. Only about a third of enterprises (32%) give every agent its own scoped, managed identity — the precondition for least-privilege access and clean attribution. Nearly half (48%) say some agents have scoped identities but many still share credentials, and another 32% say agents mostly run on shared API keys or borrowed human and service-account credentials. (Respondents could describe more than one pattern across their agent fleet, so these overlap.)

The consequence is direct: when agents share credentials, an over-permissioned or compromised agent can act with far more reach than intended, and forensics after an incident cannot cleanly tell which agent did what. The non-human identity problem — giving every agent its own governed identity — is the single largest unfinished piece of enterprise agent security.

Moreover, a company’s agent credential posture is correlated with incidents. Organizations with credential sharing anywhere in the fleet were hit — with an incident or a near-miss in the past twelve months — at 63.5% (47 of 74). Organizations where every agent carries its own scoped identity were hit at 40.9% (9 of 22). The fully-scoped group is small, so for now the relationship is an association rather than proven causation, and the gap is concentrated in the mid-market — but within a single survey, a twenty-three point difference in incident rate suggests significance.

Finding 3: Observe and enforce, but rarely isolate

Only three in 10 sandbox their highest-risk agents

We asked what an organization’s agent security posture looks like in practice — whether they observe, enforce, isolate, or some combination. The control that bounds damage is the least common.

Monitoring and enforcement are reasonably common; containment is not. Roughly half of enterprises observe agent activity (47%) or enforce scoped permissions at runtime (49%), but only 30% isolate their highest-risk agents in sandboxes that bound the blast radius when the other controls fail. That ordering is backwards from a defense-in-depth standpoint: observation tells you what happened, enforcement tries to prevent it, but isolation is what limits the damage when prevention fails — and it is the control enterprises have adopted least. Combined with the identity gap in Finding 2, the picture is of agents that are watched and permissioned but rarely boxed in, which is precisely the configuration in which a single failure propagates.

Finding 4: Security runs on borrowed, provider-native controls

Guardrails from OpenAI, Google and Microsoft dominate; specialists barely register

We asked which agent security tooling enterprises use, and which is their primary layer. The answer favors the model providers and hyperscalers over the dedicated security vendors.

Enterprises are securing agents with tools that came bundled with their models and clouds. OpenAI’s guardrails lead at 51%, followed by Google’s and Microsoft’s cloud-native controls and Anthropic’s managed-agent controls — and when asked to name their single primary security layer, 82% name one of these provider-native offerings. The purpose-built agent-security category — Palo Alto’s Prisma AIRS, CrowdStrike, Cisco AI Defense, Zenity, HiddenLayer, Check Point’s Lakera, Okta for AI Agents, non-human identity platforms — barely registers, each in the low single digits, and only 5% run no dedicated tooling at all. As with retrieval and evaluation elsewhere in this series, the provider bundle is winning the default: enterprises reach first for the guardrails their platform ships, and the independent security layer that would address the identity and isolation gaps has not yet been adopted at scale.

The provider-default pattern is consistent across both Q2 survey waves. In April–May (n=110), usage was led by the same names — OpenAI's controls at 26%, Azure at 15%, AWS at 14%, Google at 12% — with every dedicated agent-security specialist at 3% or below and one in ten using no dedicated tooling at all. The common finding from the two surveys: Enterprises are defaulting to the solutions provided by the platform they’re using, and the specialist category vendors have yet to become big players here.

(A note on reading these shares. As described in the methodology section, the respondent sample is self-selected and skews mid-market, and the usage question counted every vendor or approach a respondent has in place — so the figures measure presence in the security stack rather than spending or exclusivity. Individual vendor percentages therefore carry all the usual sample caveats. The structural pattern, however, held across both Q2 waves on two differently worded questions: provider-native and hyperscaler controls lead, and dedicated agent-security specialists remain in low single digits. Read the individual shares loosely and the pattern with confidence.)

Finding 5: And enterprises are comfortable with it

Satisfaction is high, even as incidents mount and identity lags

We asked how satisfied enterprises are with their current agent security tooling. The comfort is notably out of step with the exposure documented above.

Satisfaction with agent security tooling is high — 4.2 out of 5 overall, and 4.1 for value for money — among the most positive readings in this series. That is the striking part: enterprises are highly satisfied with a stack that is mostly borrowed provider guardrails, even though more than half have already had an incident or near-miss and only a third give their agents scoped identities. The comfort appears to rest on the convenience and low friction of provider-native controls rather than on demonstrated containment. It is a false comfort in the making — the same enterprises expressing satisfaction are, as Finding 8 shows, a clear majority planning to change tooling within the year, which suggests the confidence is thinner than the score implies.

Finding 6: Budgets haven’t caught up

Most spend under a tenth of the security budget on agents

We asked what share of the security budget enterprises allocate to securing AI agents. For a fast-emerging risk, the allocation is modest.

Spending on agent security is still a thin slice. The most common allocation is 6–10% of the security budget (46%), and a third of enterprises (34%) spend 5% or less; only a quarter (24%) devote more than a tenth. Given the incident rate in Finding 1 and the identity and isolation gaps in Findings 2 and 3, the budget looks like a lagging indicator — the risk has arrived faster than the funding to address it. The enterprises spending more than a tenth of their security budget on agents are a distinct minority, and they are likely the ones building the scoped-identity and isolation controls the rest have not.

Finding 7: The arms race is even, at best

Only a third think their AI defenses are ahead of AI-enabled attackers

We asked how enterprises assess the balance between their AI-enabled defenses and AI-enabled attackers. Confidence is far from settled.

Enterprises are split on whether they are winning. Only about a third (35%) believe their AI-enabled defenses are ahead of AI-enabled attackers; the rest are less sure — 32% call it roughly even, 21% think attackers are ahead, and another 21% say it is too early to tell. Taken together, a clear majority (53%) rate the balance as even or tilted toward the attacker. That uncertainty sits uneasily beside the high satisfaction of Finding 5: enterprises are content with their tooling yet unconvinced it is winning the contest it exists to win. In a domain where the offense is also compounding with AI, an even race is not a comfortable place to be.

Finding 8: A security reshuffle is coming

Nearly six in 10 plan to adopt or switch tooling within a year

We asked whether enterprises plan to adopt a new, additional, or replacement agent security solution, and which they are considering. Few intend to stand pat.

The security stack is not settled. While 41% have no plans to change, a clear majority (59%) intend to adopt a new, additional, or replacement agent security solution within twelve months, and 29% within the next quarter — a strong signal that, high satisfaction notwithstanding, enterprises know the current stack is provisional. Incidents are what start the buying cycle.

Among organizations that have been hit, 42.1% plan to adopt, add, or replace agent security tooling within the next ninety days, against 14.0% of organizations with no incident — and after a confirmed incident it becomes majority behavior, at 52.6%. Getting hit also changes the threat assessment: 33.3% of hit organizations say AI-armed attackers are ahead of their defenses, against 8.0% of the unhit. Experience, in this data, is the strongest predictor of both urgency and pessimism.

The consideration set still leans provider-native (OpenAI 34%, Google 30%, Anthropic 29%, Azure 25%), but the dedicated security vendors — Cloudflare, Cisco, Palo Alto, Okta, Check Point’s Lakera — draw early interest in the mid-to-high single digits, more than their current footprint.

What the shopping does not yet include is the identity layer specifically. Twelve percent of the respondents include an agent-identity product — Okta for AI Agents, Microsoft Entra Agent ID, or a non-human identity platform — anywhere in their consideration set, and among the credential-sharing organizations that have already had an incident, identity consideration is essentially unchanged, at roughly one in ten. The control most directly implicated by the incident data is the one largely missing from the purchase plans. Whether this wave hardens the provider-native default or finally opens the door to purpose-built agent security — the identity and isolation controls the incidents call for — is the question this series will keep tracking.

The bottom line: A security gap that autonomy will test first

Organizations with more than 100 employees are giving AI agents real reach into systems and data while securing them with controls built for something else. More than half have already had an incident or near-miss; only a third give every agent its own scoped identity, and most still share credentials; only three in ten isolate their highest-risk agents; and the stack doing this work is overwhelmingly borrowed from the model providers and hyperscalers rather than purpose-built for agents.

The uncomfortable pairing is confidence with exposure: satisfaction with the current tooling is among the highest in this series, yet spending is a thin slice of the security budget, only a third believe their defenses are ahead of AI-enabled attackers, and a clear majority are already planning to replace what they have. At 107 respondents in a single wave this is a directional read, skewed toward the mid-market — but the direction is clear: agent adoption is running ahead of agent security, and the controls that matter most when something fails — scoped identity and isolation — are the ones enterprises have built least. The agent security gap is not a coverage problem that a provider guardrail will close on its own; it is a problem of identity, isolation, and enforcement built for autonomous software. The open question for later waves is whether enterprises close it deliberately — or whether a confirmed incident closes it for them.

Based on survey responses from 107 qualified enterprise respondents (100+ employees), drawn from a single June 2026 wave. This is a directional read, not a precise measurement — the sample is self-selected and skews mid-market, so it's best read as the view from organizations actively standing up agent security rather than from the largest operators. Respondents are senior and buyer-credible (45% final decision-makers, 30% recommenders/influencers), spanning managers through the C-suite, and drawn primarily from Technology/Software, Manufacturing, Retail/E-commerce, and Healthcare/Life Sciences.

Agentic coding is everywhere

Wed, 22 Jul 2026 11:04:58 +0200

I use a very cool and relatively new web framework called Astro. The keen insight that the Astro team had was that most websites are made up of static content, so they made it really easy to add content to a website. To add a blog post to my personal website, all I have to do is create a Markdown file with some front matter, deploy it, and the blog post automatically appears. If I need to reach deeper for more dynamic functionality, I can easily do that with TypeScript, React, or almost any other framework. It’s really cool.

And these days, I really don’t write any code. Claude Code does most (all?) of the work. Since Astro is an open-source project and has excellent documentation, Claude knows all about how Astro works. It has no trouble at all managing my site and making the improvements I ask for.

And that got me thinking, how does Astro get built? Is the Astro team building with agentic coding? Astro itself has many dependencies, including big projects like Vite and Node. And of course, Vite and Node have dependencies, too. Are those dependencies being developed by hand, or are those development teams also using AI agents to code?

My curiosity got the best of me, and I asked Claude to dig deeper. It turns out that the Astro repository has an AGENTS.md file, and some of the commits even have commit message trailers indicating that they were at least co-authored by Claude and GitHub Copilot. Further down, there is a .agents/skills directory with skills covering development, merging, triage, and more. I poked around for a look, and someone has done a great job building agentic support.

Now my interest is really piqued, and further investigation reveals quite a bit of interesting stuff. About a year ago, documentation started appearing about how to build Astro sites with coding agents. Around that same time, the docs team released an MCP server that gives developers coding agents deeper, easier access to the Astro documentation.

And there are small steps in the Astro codebase that indicate it is “agentic ready.” For instance, the command-line development server can tell when it is being started by an agent, and the application itself can tell if it is being driven by an agent. Small things, but steps in the direction of embracing Astro developers who use coding agents.

Okay, that was a fun spelunking trip. But so what?

The “so what” is that code is going to be commoditized. As an Astro developer I am using AI agents pretty much all of the time. The Astro development team is starting to use AI agents more and more. The folks building the Astro dependencies are using AI agents. Shoot, the people building Claude Code and the agents themselves are “eating their own dogfood” and using their own tools to build the next frontier model. Before we know it, it will be turtles all the way down.

No one says “who generated that electricity?” or “who wove the fabric in that shirt?” any more. And it won’t be long before no one says “Who wrote the code for that app?” because it won’t matter. Just as we don’t look at the assembly code written by our compilers, we’ll stop looking at the “regular” code written by our agents. I’m not even sure anyone is writing assembly code anymore. Soon we’ll be saying that about TypeScript, Python, and C++.

Tools, um MCP-Server abzusichern

Wed, 22 Jul 2026 06:10:24 +0200

width="1024" height="576" sizes="auto, (max-width: 1024px) 100vw, 1024px">

Unabhängig davon, welche MCP-Server Unternehmen wofür einsetzen – “Unsicherheiten” sollten dabei außenvorbleiben.

Gorodenkoff | shutterstock.com

Model Context Protocol (MCP) verbindet KI-Agenten mit Datenquellen und erfreut sich im Unternehmensumfeld wachsender Beliebtheit. Allerdings ist auch MCP nicht frei von Sicherheitslücken, wie entsprechende Entdeckungen, etwa beim SaaS-Anbieter Asana oder dem IT-Riesen Atlassian gezeigt haben. Inzwischen hat sich jedoch einiges in Sachen MCP-Sicherheit getan. Einerseits wurden mit Blick auf das Kernprotokoll etliche Fortschritte erzielt. Beispielsweise in Form von Support für OAuth sowie für Authentifizierungs-Server von Drittanbietern und Identity-Management-Systeme. Darüber hinaus wurde inzwischen auch eine offizielle MCP Registry geschaffen, die einen Überblick über sichere, öffentlich verfügbare MCP-Server bietet.

Dennoch bestehen weiterhin Sicherheitslücken, die sich für diverse Cyberschandtaten ausnutzen lassen – Prompt Injection, Tool Poisoning, Token-Diebstahl, Server-übergreifende Attacken oder manipulierte Messages sind nur einige von vielen Beispielen. Mit anderen Worten: Unternehmen, die sich beim Aufbau von Agentic-AI-Systemen einen Wettbewerbsvorteil verschaffen wollen, müssen erhebliche Anstrengungen unternehmen, um zu gewährleisten, dass sensible Daten nicht nach außen dringen. Glücklicherweise gibt es diverse Tools, die dabei Unterstützung versprechen.

In diesem Artikel lesen Sie:

was Security-Tools für MCP leisten sollten, und
welche Angebote in diesem Bereich interessant sind.

Das sollten MCP-Sicherheitslösungen können

Die Gefahr von Datenlecks, Prompt Injections und weiteren Sicherheitsbedrohungen besteht unabhängig davon, ob Unternehmen:

ihre eigenen KI-Agenten mit MCP-Servern von Drittanbietern,
ihre eigenen MCP-Server mit Drittanbieter-Agenten, oder
ihre eigenen Server mit den eigenen Agenten verbinden.

Soll heißen: Unternehmen müssen in jedem Fall Autorisierungen und Berechtigungen überprüfen, detaillierte Zugriffskontrollen implementieren und alles protokollieren. Daraus ergeben sich auch die Anforderungen für MCP-Sicherheitslösungen. Diese sollten bieten:

MCP-Servererkennung. Für Mitarbeiter eines Unternehmens ist es einfach, MCP-Server herunterzuladen und zu nutzen. Mit Scan-Services für MCP-Server können Unternehmen sämtliche Instanzen von Schatten-MCP-Servern in ihrer Umgebung finden.
Laufzeitschutz. KI-Agenten kommunizieren mit MCP-Servern in natürlicher Sprache. MCP-Sicherheits-Tools sollten deshalb in der Lage sein, diese Kommunikation auf Sicherheitsprobleme wie Prompt Injections hin zu überwachen.
Authentifizierungs- und Zugriffskontrollen. Das MCP-Protokoll unterstützt inzwischen OAuth, aber das ist nur ein erster Schritt. Für zusätzliche Sicherheit empfehlen sich Tools mit integrierten Kontroll-Frameworks für Zero Trust und Least Privilege.
Logging und Observability. Tools und Plattformen sollten zudem die Möglichkeit bieten, MCP-Protokolle zu sammeln, Sicherheitsteams über Richtlinienverstöße zu informieren, Compliance-Daten zu erfassen oder Protokolle in die bestehende Sicherheitsinfrastruktur einzuspeisen.

MCP-Security-Angebote

Im Folgenden haben wir die Anbieter von MCP-Security-Tools in drei Kategorien aufgeteilt. Diese Aufstellung erhebt keinen Anspruch auf Vollständigkeit.

Hyperscaler

Für Unternehmen, die sich vollständig auf eine bestimmte Cloud-Plattform verlassen, bieten die MCP-Tools des jeweiligen Hyperscalers einen einfachen Einstieg.

Amazon Web Services (AWS) hat Mitte 2025 seine eigene agentenbasierte KI-Plattform eingeführt. Amazon Bedrock AgentCore umfasst ein Gateway, das mehrere Protokolle unterstützt (darunter auch MCP), ein Identity-Management-System sowie Observability.
Microsoft bietet einen grundlegenden Azure-MCP-Server an, inklusive Support für Azure Key Vault. Darüber hinaus unterstützen auch Azure AI Foundry Agent Service und Azure API Management das Model Context Protocol. Zudem bietet Microsoft mit dem Agent Framework auch ein Open-Source-Entwicklungskit, das sowohl MCP als auch Agent2Agent unterstützt und beispielsweise Schutz vor Prompt Injections verspricht.
Google Cloud kündigte Anfang 2025 seine MCP Toolbox für Datenbanken an – inklusive integrierter Authentifizierung und Observability. Außerdem hat der Hyperscaler auch eine Referenzarchitektur veröffentlicht, um MCP-Server auf seiner Cloud-Plattform abzusichern.

Große Plattformanbieter

Der IT-Dienstleister Cloudflare hat mit MCP Server Portals ein Tool veröffentlicht, mit dem Unternehmen MCP-Verbindungen zentralisiert absichern und überwachen können. Die Funktion ist Bestandteil der Cloudflare-One-Plattform.
Palo Alto Networks hat mit Blick auf MCP-Sicherheit mehrere Eisen im Feuer. Mit Prisma AIRS hat das Unternehmen einen eigenen, intermediären MCP-Server veröffentlicht. Dieser sitzt zwischen den KI-Agenten und dem eigentlichen MCP-Server und erkennt schadhafte Inhalte und Daten. Das Tool MCP Security ist hingegen Bestandteil von Cortex Cloud WAAS und überprüft die MCP-Kommunikation an der Netzwerkgrenze auf bösartige Aktivitäten.
SentinelOne gewährt mit seiner Singularity Platform ebenfalls Einblick in die MCP-Interaktionskette und bietet zum Beispiel Warnmeldungen und automatisierte Incident Response für MCP-Server auf lokaler oder Remote-Ebene.
Die Plattform von Acuvity (seit Februar 2026 Teil von Proofpoint) verspricht, MCP-Server umfassend abzusichern. Dafür sorgt laut dem Anbieter eine Kombination aus Least-Privilege-Execution, unveränderlichen Laufzeiten, kontinuierlichen Schwachstellenscans, Authentifizierung und Bedrohungserkennung.
Daneben hat auch Broadcom MCP-Sicherheitsfunktionen für VMware Cloud Foundation angekündigt, die künftig mehr Sicherheit für agentenbasierte Workflows gewährleisten sollen.

Startups

Das API-Security-Startup Akto hat eine MCP-Security-Plattform im Angebot. Sie umfasst ein Discovery Tool, um MCP-Server in Unternehmensumgebungen zu identifizieren, Security-Testing-Werkzeuge sowie Monitoring- und Threat-Detection-Funktionen.
Invariant Labs bietet mit MCP-Scan ein quelloffenes Tool, das die statische Analyse und Echtzeitüberwachung von MCP-Servern ermöglicht. Mit Guardrails hat das Startup auch ein kommerzielles Produkt im Angebot. Dabei handelt es sich um einen Proxy. Der zwischen KI-Agenten und MCP-Servern sitzt und vor Security-Risiken schützen soll. Das Tool befähigt Anwender außerdem dazu, Richtlinien aufzusetzen.
Highflame (vormals Javelin) addressiert ebenfalls das Thema MCP-Sicherheit. Etwa mit Funktionen wie MCP-Server auf Risiken zu scannen oder Datenanfragen zu überprüfen.
Lasso Security stellt ein Open-Source-MCP-Gateway zur Verfügung, das die Konfiguration und das Lebenszyklusmanagement von MCP-Servern ermöglicht und Messages um sensible Informationen bereinigt.

(fm)

Dieser Artikel ist im Original bei unser Schwesterpublikation CSOonline.com erschienen.

Siemens RUGGEDCOM APE1808 with Palo Alto Networks Virtual NGFW

Tue, 21 Jul 2026 19:45:27 +0200

View CSAF

Summary

Palo Alto Networks has published [1] information on vulnerabilities in PAN-OS. This advisory lists the related Siemens Industrial products affected by these vulnerabilities. Customers are advised to consult and implement the workarounds provided in Palo Alto Networks' upstream security notifications. [1] https://security.paloaltonetworks.com/

The following versions of Siemens RUGGEDCOM APE1808 with Palo Alto Networks Virtual NGFW are affected:

RUGGEDCOM APE1808 vers:all/*

CVSS	Vendor	Equipment	Vulnerabilities
v3 7.2	Siemens	Siemens RUGGEDCOM APE1808 with Palo Alto Networks Virtual NGFW	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), Missing Authorization, Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Background

Critical Infrastructure Sectors: Critical Manufacturing
Countries/Areas Deployed: Worldwide
Company Headquarters Location: Germany

Vulnerabilities

Expand All +

CVE-2026-0266

A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS® software enables a malicious authenticated administrator to store a JavaScript payload using the web interface. This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW and Prisma® Access are not affected by this vulnerability.

View CVE Details

Affected Products

Siemens RUGGEDCOM APE1808 with Palo Alto Networks Virtual NGFW

Vendor:
Siemens

Product Version:
RUGGEDCOM APE1808 with Palo Alto Networks Virtual NGFW

Product Status:
known_affected

Remediations

Vendor fix
Contact customer support to receive patch and update information

Relevant CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Metrics

CVSS Version	Base Score	Base Severity	Vector String
3.1	2.4	LOW	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N

CVE-2026-0272

A privilege escalation vulnerability in Palo Alto Networks PAN-OS® software allows an authenticated administrator with access to the Command Line Interface (CLI) to perform actions on the device with root privileges. The security risk posed by this issue is significantly minimized when CLI access is restricted to a limited group of administrators and by restricting access to the management interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW, and Prisma® Access are not impacted by this vulnerability.

View CVE Details

Affected Products

Siemens RUGGEDCOM APE1808 with Palo Alto Networks Virtual NGFW

Vendor:
Siemens

Product Version:
RUGGEDCOM APE1808 with Palo Alto Networks Virtual NGFW

Product Status:
known_affected

Remediations

Vendor fix
Contact customer support to receive patch and update information

Relevant CWE: CWE-862 Missing Authorization

Metrics

CVSS Version	Base Score	Base Severity	Vector String
3.1	6.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

CVE-2026-0273

A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and run arbitrary commands as a root user. To be able to exploit this issue, the user must have access to the PAN-OS CLI or Web UI. The security risk posed by this issue is significantly minimized when CLI access is restricted to a limited group of administrators and by restricting access to the management web interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW and Prisma® Access are not affected by this vulnerability.

View CVE Details

Affected Products

Siemens RUGGEDCOM APE1808 with Palo Alto Networks Virtual NGFW

Vendor:
Siemens

Product Version:
RUGGEDCOM APE1808 with Palo Alto Networks Virtual NGFW

Product Status:
known_affected

Remediations

Vendor fix
Contact customer support to receive patch and update information

Relevant CWE: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Metrics

CVSS Version	Base Score	Base Severity	Vector String
3.1	7.2	HIGH	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Acknowledgments

Siemens ProductCERT reported these vulnerabilities to CISA.

General Recommendations

As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity

Additional Resources

For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories

Terms of Use

The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.

Legal Notice and Terms of Use

This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).

Recommended Practices

CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.

Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.

Locate control system networks and remote devices behind firewalls and isolate them from business networks.

When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

Advisory Conversion Disclaimer

This ICSA is a verbatim republication of Siemens ProductCERT SSA-104023 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided "as-is" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Siemens ProductCERT directly for any questions regarding this advisory.

Revision History

Initial Release Date: 2026-07-14

Date	Revision	Summary
2026-07-14	1	Publication Date
2026-07-21	2	Initial CISA Republication of Siemens ProductCERT SSA-104023 advisory

Legal Notice and Terms of Use

CVE-2026-0277 | Palo Alto Prisma Access Agent Certificate Validation channel accessible

Sat, 18 Jul 2026 07:35:56 +0200

A vulnerability, which was classified as critical, was found in Palo Alto Prisma Access Agent. This affects an unknown part of the component Certificate Validation. Executing a manipulation can lead to channel accessible by non-endpoint. This vulnerability is tracked as CVE-2026-0277. The attack can be launched remotely. No exploit exists.

CVE-2026-0243 | Palo Alto Prisma SD-WAN ION up to 25.3.2 unchecked input for loop condition

Fri, 17 Jul 2026 14:53:50 +0200

A vulnerability identified as critical has been detected in Palo Alto Prisma SD-WAN ION up to 5.5.x/6.0.x/24.3.5/25.1.7/25.3.2. Affected by this vulnerability is an unknown functionality. This manipulation causes unchecked input for loop condition. This vulnerability is registered as CVE-2026-0243. The attack requires access to the local network. No exploit is available. You should upgrade the affected component.

CVE-2026-0248 | Palo Alto Prisma Access Agent up to 26.2.0 on Android/Chrome certificate validation

Fri, 17 Jul 2026 13:55:22 +0200

A vulnerability, which was classified as problematic, was found in Palo Alto Prisma Access Agent up to 26.2.0 on Android/Chrome. This issue affects some unknown processing. The manipulation results in improper certificate validation. This vulnerability was named CVE-2026-0248. The attack may be performed from remote. There is no available exploit. You should upgrade the affected component.

CVE-2026-0247 | Palo Alto Prisma Access Agent up to 26.2.0 DLP Endpoint missing authentication

Fri, 17 Jul 2026 12:21:41 +0200

A vulnerability was found in Palo Alto Prisma Access Agent up to 26.2.0. It has been declared as critical. This affects an unknown function of the component DLP Endpoint. Executing a manipulation can lead to missing authentication. This vulnerability is tracked as CVE-2026-0247. The attack is restricted to local execution. No exploit exists. It is recommended to upgrade the affected component.

CVE-2026-0244 | Palo Alto Prisma SD-WAN ION up to 5.5.x/6.0.x/6.4.3-b7/6.5.3-b14 certificate validation

Fri, 17 Jul 2026 12:21:40 +0200

A vulnerability was found in Palo Alto Prisma SD-WAN ION up to 5.5.x/6.0.x/6.4.3-b7/6.5.3-b14. It has been rated as problematic. This impacts an unknown function. The manipulation leads to improper certificate validation. This vulnerability is listed as CVE-2026-0244. The attack may be initiated remotely. There is no available exploit. Upgrading the affected component is advised.

CVE-2026-0245 | Palo Alto Prisma Access Agent up to 26.2.0 Configuration Data information disclosure

Fri, 17 Jul 2026 12:21:39 +0200

A vulnerability was found in Palo Alto Prisma Access Agent up to 26.2.0 and classified as problematic. The affected element is an unknown function of the component Configuration Data Handler. Such manipulation leads to information disclosure. This vulnerability is referenced as CVE-2026-0245. The attack can only be performed from a local environment. No exploit is available. It is suggested to upgrade the affected component.

CVE-2026-0246 | Palo Alto Prisma Access Agent up to 26.2.0 on Windows authorization

Fri, 17 Jul 2026 12:21:37 +0200

A vulnerability, which was classified as critical, has been found in Palo Alto Prisma Access Agent up to 26.2.0 on Windows. This vulnerability affects unknown code. The manipulation leads to missing authorization. This vulnerability is uniquely identified as CVE-2026-0246. Local access is required to approach this attack. No exploit exists. It is advisable to upgrade the affected component.

The agent security gap: 54% of enterprises have already had an AI agent incident, and most still let agents share credentials

Thu, 16 Jul 2026 21:47:26 +0200

Methodology

Satisfaction ratings are computed on the respondents who answered each rating question; the overall satisfaction score reflects 82 of the 107 qualified respondents.

Finding 1: The incidents are already here

More than half have had an agent security incident or near-miss

We asked whether organizations had experienced an agent security incident — a confirmed breach, or a near-miss caught before harm. Most that run agents in production had.

Finding 2: The identity gap

Only a third give every agent its own scoped identity

We asked how enterprises manage the identity of their AI agents — whether each agent has its own credentials, or agents share them. Full per-agent identity is the exception.

Finding 3: Observe and enforce, but rarely isolate

Only three in 10 sandbox their highest-risk agents

We asked what an organization’s agent security posture looks like in practice — whether they observe, enforce, isolate, or some combination. The control that bounds damage is the least common.

Finding 4: Security runs on borrowed, provider-native controls

Guardrails from OpenAI, Google and Microsoft dominate; specialists barely register

We asked which agent security tooling enterprises use, and which is their primary layer. The answer favors the model providers and hyperscalers over the dedicated security vendors.

Finding 5: And enterprises are comfortable with it

Satisfaction is high, even as incidents mount and identity lags

We asked how satisfied enterprises are with their current agent security tooling. The comfort is notably out of step with the exposure documented above.

Finding 6: Budgets haven’t caught up

Most spend under a tenth of the security budget on agents

We asked what share of the security budget enterprises allocate to securing AI agents. For a fast-emerging risk, the allocation is modest.

Finding 7: The arms race is even, at best

Only a third think their AI defenses are ahead of AI-enabled attackers

We asked how enterprises assess the balance between their AI-enabled defenses and AI-enabled attackers. Confidence is far from settled.

Finding 8: A security reshuffle is coming

Nearly six in 10 plan to adopt or switch tooling within a year

We asked whether enterprises plan to adopt a new, additional, or replacement agent security solution, and which they are considering. Few intend to stand pat.

The bottom line: A security gap that autonomy will test first

Announcing the General Availability of Prisma AIRS AI Gateway

Thu, 16 Jul 2026 17:23:42 +0200

Every modern enterprise is moving from an organization run by software to one orchestrated by AI, creating a tension between velocity and control. To resolve this tension, organizations require a unified architecture. … The post Announcing the General Availability of…

The post Announcing the General Availability of Prisma AIRS AI Gateway appeared first on IT Security News.

Top 10 Best Firewall as a Service (FWaaS) Providers – 2026

Thu, 16 Jul 2026 17:08:23 +0200

The firewall is leaving the rack: firewall-as-a-service delivers inspection, intrusion prevention, and policy from the cloud, so every user, branch, and cloud workload gets identical protection without appliances to size, patch, or refresh. Zscaler is our top FWaaS pick for 2026 on the strength of the industry’s largest dedicated security cloud, with Palo Alto Networks Prisma Access delivering the […]

The post Top 10 Best Firewall as a Service (FWaaS) Providers – 2026 appeared first on Cyber Security News.

Meet Blume: An Open-Source, Zero-Config Documentation Framework That Ships AI-Ready Docs From a Markdown Folder

Tue, 14 Jul 2026 10:19:26 +0200

Developer Hayden Bleasel has released Blume, an open-source, MIT-licensed documentation framework. It reads a folder of Markdown or MDX and generates a hidden Astro project, shipping static, AI-ready docs with local search, 30+ MDX components, llms.txt, and a built-in MCP server.

The post Meet Blume: An Open-Source, Zero-Config Documentation Framework That Ships AI-Ready Docs From a Markdown Folder appeared first on MarkTechPost.

Get started with Angular: Introducing the modern reactive workflow

Mon, 13 Jul 2026 17:04:25 +0200

Angular is a cohesive, all-in-one reactive framework for web development. It is one of the larger reactive frameworks, focused on being a single architectural system that handles all your web development needs under one idiom. While Angular was long criticized for being heavyweight as compared to React, many of those issues were addressed in Angular 19. Modern Angular is built around the Signals API and minimal formality, while still delivering a one-stop-shop that includes dependency injection and integrated routing.

Angular is popular with the enterprise because of its stable, curated nature, but it is becoming more attractive to the wider developer community thanks to its more community engaged development philosophy. That, along with its recent technical evolution, make Angular one of the most interesting projects to watch right now.

Why choose Angular?

Choosing a JavaScript development framework sometimes feels like a philosophical debate, but it should be a practical decision. Angular is unique because it is strongly opinionated. It doesn’t just give you a view layer; it provides a complete toolkit for building web applications.

Like other reactive frameworks, Angular is built around its reactive engine, which lets you bind state (variables) to the view. But if that’s all you needed, one of the smaller, more focused frameworks would be more than enough. What Angular has that some of these other frameworks don’t is its ability to use data binding to automatically synchronize data from your user interface (UI) with your JavaScript objects. Angular also leverages dependency injection and inversion of control to help structure your application and make it easier to test. And it contains more advanced features like server-side rendering (SSR) and static-site generation (SSG) within itself, rather than requiring you to engage a meta-framework for either style of development.

While Angular might not be your top choice for every occasion, it’s an excellent option for larger projects that require features you won’t get with a more lightweight framework.

Also see: Catching up with Angular 19.

Getting started with Angular

With those concepts in mind, let’s set up Angular in your development environment. After that, we can run through developing a web application with Angular. To start, make sure you have Node and NPM installed. From the command line, enter:

$ node -v
$ npm -v

Next, you can use the Angular CLI to launch a new app:

$ ng new iw-ng

You can use the defaults in your responses to the interactive prompts shown here:

Matthew Tyson

We now have a basic project layout in the new directory, which you can import into an IDE (such as VS Code) or edit directly.

Looking at the project layout, you might notice it is fairly lean, a break from Angular projects of the past. The most important parts are:

src/main.ts: This is the main entry point. In older versions of Angular, this file had to bootstrap a module, which then bootstrapped a component. Now, it avoids any verbose syntax, calling bootstrapApplication with your root component directly.
src/index.html: The main HTML page that hosts your application. This is the standard index.html that serves all root requests in a web page and contains the tag where your Angular component will render. It is the “body” that the “spirit” of your code animates.
src/app/app.ts: The root component of your application. This single file defines the view logic and the component metadata. In the new “standalone” world, it manages its own imports, meaning you can see exactly what dependencies it uses right at the top of the file. (This is the root element that appears in src/index.html.)
src/app/app.config.ts: This file is new in modern Angular and replaces the old AppModule providers array. It is where you configure global services, like the router or HTTP client.
angular.json: The configuration file for the CLI itself. It tells the build tools how to process your code, though you will rarely need to touch this file manually anymore.

Here is the basic flow of how the engine renders these components:

The arrival (HTML): The browser receives index.html. The tag is there, but it’s empty.
The unpacking (JavaScript): The browser sees the tags at the bottom of the HTML and downloads the JavaScript bundles (your compiled code) from src/app/app.ts.
The assembly (Bootstrap): The browser runs that JavaScript. The code “wakes up,” finds the tag in the DOM, and dynamically inserts your title, buttons, and lists.

This flow will be different if you are using server-side rendering (SSR), but we’ll leave that option aside for now. Now that you’ve seen the basic architecture, let’s get into the code.

Developing your first web app in Angular

If you open src/app/app.ts (more info here) the component definition looks like this:

import { Component, signal } from '@angular/core';
import { RouterOutlet } from '@angular/router';

@Component({
  selector: 'app-root',
  imports: [RouterOutlet],
  templateUrl: './app.html',
  styleUrl: './app.css'
})
export class App {
  protected readonly title = signal('iw-ng');
}

Before we dissect the code, let’s run the app and see what it produces:

$ ng serve

You should see a page like this one at localhost:4200:

Matthew Tyson

Returning to the src/app.ts component, notice that there are three main parts of the definition: the class, the metadata, and the view. Let’s unpack these separately.

The class (export class App)

Export class App is vanilla TypeScript that holds your component’s data and logic. In our example, title = signal(‘iw-ng’) defines a piece of reactive state. Unlike older versions of Angular where data was just a plain property, here we use a signal. Signals are wrappers around values that notify the template precisely when they change, enabling fine-grained performance.

The metadata (@Component)

The @Component decorator tells Angular it is dealing with a component, not just a generic class. There are several elements involved in the decorator’s communication with the engine:

selector: 'app-root': Defines the custom HTML tag associated with any given component. Angular finds in your index.html and renders the component there.
imports: In the new Angular era, dependencies are explicit. You list exactly what a component needs (like RouterOutlet or other components) here, rather than hiding them in a separate module file.
templateUrl: Points to the external HTML file that defines the view.

The view (the template)

This is the visual part of the component, defined in app.html. It combines standard HTML with Angular’s template syntax. (JSX handles this part for React-based apps.)

We can modify src/app/app.html to see how these three elements work together. To start, delete the default content and add the following:

Hello, {{ title() }}

The double curly braces {{ }} are called interpolation. Notice the parentheses in title(). We are reading the “title” signal value by calling its function. If you were to update that signal programmatically (e.g., this.title.set('New Value')), the text on the screen would update instantly.

Angular’s built-in control flow

Old-school Angular required “structural directives” like *ngIf and *ngFor logic control. These were powerful but required importing CommonModule and learning a specific micro-syntax. Modern Angular uses a built-in control flow that looks like standard JavaScript (similar to other Reactive platforms).

To see the new control flow in action, let’s add a list to our component. Update src/app/app.ts as follows, leaving the rest of the file the same:

export class App {
  protected readonly title = signal('iw-ng');
  protected readonly frameworks = signal(['Angular', 'React', 'Vue', 'Svelte']);
  protected showList = signal(true);

  toggleList() {
    this.showList.update(v => !v);
  }
}

While we’re at it, let’s also update src/app/app.html to render this new list (don’t worry about for now; it just tells Angular where to render the framing template):



@if (showList()) {
  
    @for (tech of frameworks(); track tech) {
      {{ tech }}
    }
  
} @else {
  List is hidden
}

The app will now display a list that can be toggled for visibility:

Matthew Tyson

This syntax is cleaner and easier to read than the old *ngFor loops:

@if conditionally renders the block if the signal’s value is true.
@for iterates over the array. The track keyword is required for performance (it tells Angular how to identify unique items in the list).
(click) is an event binding. It lets us run code (the toggleList method) when the user interacts with the button.

Services: Managing business logic in Angular

Components focus on the view (i.e., what you see). For the business logic that backs the application functionality, we use services.

A service is just a class that can be “injected” into a component that needs it. This is Angular’s famous dependency injection system. It allows you to write logic once and reuse it anywhere. It’s a slightly different way of thinking about how an application is wired together, but it gives you real organizational benefits over time.

To generate a service, you can use the CLI:

$ ng generate service frameworks

This command creates a src/app/hero.ts file. In modern Angular, we define services using the @Injectable decorator. Currently, the src/app/hero.ts file just has this:

import { Injectable } from '@angular/core';

@Injectable({
  providedIn: 'root',
})
export class Frameworks {
  
}

Open the file and add a simple method to return our data:

import { Injectable } from '@angular/core';

@Injectable({
  providedIn: 'root', // Available everywhere in the app
})
export class Frameworks {
  getList() {
    return ['Angular', 'React', 'Vue', 'Svelte'];
  }
}

The providedIn: 'root' metadata is important, it tells Angular to create a single, shared instance of this service for the entire application (you might recognize this as an instance of the singleton pattern).

Using the service

In the past, we had to list dependencies in the constructor. Modern Angular offers a cleaner way: the inject() function. Subsequently, we can refactor our src/app/app.ts to get its data from the service instead of hardcoding it:

import { Component, inject, signal } from '@angular/core';
import { RouterOutlet } from '@angular/router';
import { Frameworks } from './frameworks'; // Import the service

@Component({
  selector: 'app-root',
  imports: [RouterOutlet],
  templateUrl: './app.html',
  styleUrl: './app.css'
})
export class App {
  private frameworksService = inject(Frameworks); // Dependency Injection
  
  protected readonly title = signal('iw-ng');
  
  // Initialize signal with data directly from the service
  protected readonly frameworks = signal(this.frameworksService.getList());
  protected showList = signal(true);

  toggleList() {
    this.showList.update(v => !v);
  }
}

Dependency injection is a powerful pattern. The component doesn’t need to know where the list came from (it could be coming from an API, a database, or a hard-coded array); it just asks the service for what it needs. This pattern adds a bit of extra work up front, but it delivers a more flexible, organized codebase as the app grows in size and complexity.

Routers and routes

Once your application grows beyond a single view, you need a way to navigate between different screens. In Angular, we use the built-in router for this purpose. In our example project, src/app/app.routes.ts is the dedicated home for the router config. Let’s follow the steps for creating a new route.

First, we define the route. When you open src/app/app.routes.ts, you will see an exported routes array. This array contains the available routes for your app. Each string name resolves to a component that handles rendering that route. In effect, this is the map of your application’s landscape.

In a real application, you’d often have “framing template” material in the root of the app (like the navbar) and then the routes fill in the body content. (Remember that by default, Angular is designed for single-page apps, where navigation does reload the screen, but swaps content.)

For now, let’s just get a sense of how the router works. First, create a new component so we have a destination to travel to. In your terminal, run:

$ ng generate component details

This will generate a simple details component in the src/app/details directory.

Now we can update src/app/app.routes.ts to include this new path. We will also add a “default” path that redirects empty requests to the home view, ensuring the user always lands somewhere:

import { Routes } from '@angular/router';
import { App } from './app'; // Matches src/app/app.ts
import { Details } from './details/details'; // Matches src/app/details/details.ts

export const routes: Routes = [
  { path: '', redirectTo: '/home', pathMatch: 'full' },
  { path: 'home', component: App },
  { path: 'details', component: Details },
];

Now if you visit localhost:4200/home, you’ll get the message from the details component: “Details works!”

Next, we’ll use the routerLink directive to move between views without refreshing the page. In src/app/app.html, we create a navigation bar that sits permanently at the top of the page (the “stationary” element), while the router swaps the content below it (the “impermanent” element):


  Home | 
  Details

And with that, the application has a navigation flow. The user clicks, the URL updates, and the content transforms, all without the jarring flicker of a browser reload.

Parametrized routes

The last thing we’ll look at is handling route parameters, where the route accepts variables in the path. To manage this kind of dynamic data, you define a route with a variable, marked by a colon. Open src/app/app.routes.ts and add a dynamic path:

export const routes: Routes = [
  // ... existing routes
  { path: 'details/:id', component: Details }, 
];

The :id is a placeholder. Whether the URL is /details/42 or /details/108, this router will receive it because it matches the path. Inside the details component, we have access to this parameter (using the ActivatedRoute service or the new withComponentInputBinding). We can use that value to retrieve the data we need (like using it to recover a detail item from a database).

Conclusion

We have seen the core elements of modern Angular: Setting up the environment, building reactive components with signals, organizing logic with services, and tying it all together with interactive routing.

Deploying these pieces together is the basic work in Angular. Once you get comfortable with it, you have an extremely powerful platform at your fingertips. And, when you are ready to go deeper, there is a whole lot more to explore in Angular, including:

State management: Beyond signals, Angular has support for managing complex, application-wide state.
Forms: Angular has a robust system for handling user input.
Signals: We only scratched the surface of signals here. Signals offer a powerful, fine-grained way to manage state changes.
Build: You can learn more about producing production builds.
RxJS: Takes reactive programming to the next level.

CVE-2026-0278 | Palo Alto Prisma Access Agent Data Loss Prevention protection mechanism

Mon, 13 Jul 2026 06:38:51 +0200

A vulnerability was found in Palo Alto Prisma Access Agent and classified as problematic. This issue affects some unknown processing of the component Data Loss Prevention. The manipulation results in protection mechanism failure. This vulnerability is cataloged as CVE-2026-0278. The attack must be initiated from a local position. There is no exploit available.

Shared API keys expose AI agents at 69% of enterprises, new VentureBeat research finds

Thu, 09 Jul 2026 23:32:38 +0200

Share one API key across five AI agents, and a single compromised agent inherits the reach of all five. The attacker immediately benefits from the accumulated permissions of every workflow that the key touches. The forensic trail goes cold at the credential level because five agents on one account leave no record of which agent did what.

Sixty-nine percent of enterprises run agents with credential sharing somewhere in their deployments, according to VentureBeat’s June 2026 Pulse Research wave of 107 enterprises.

That one number explains the buying spree reshaping enterprise security this year. Palo Alto Networks, CrowdStrike, and Cisco have collectively bet more than $22 billion on it in the past year, targeting exactly the layer most enterprises in this survey haven't finished building.

Palo Alto Networks completed its acquisition of CyberArk on February 11 for $21.1 billion in total consideration at close — a deal it announced last July at roughly $25 billion and the largest in the company's history.

CrowdStrike closed its $740 million acquisition of runtime authorization platform SGNL and, by June 15, shipped the first product from the deal, Continuous Identity for AI Agents. CrowdStrike integrated SGNL in less than a year, delivering a product that validates every agent action in real time based on who owns it, who is calling it, and the device's risk posture.

Cisco announced its intent to acquire non-human identity specialist Astrix Security on May 4 for a reported $400 million.

For a security director, this survey reads as a board-level question, not a trend line. It also surfaces a finding no competitor’s data shows, one that exposes which companies are the most at risk.

The data below is the first look at VentureBeat’s Q2 Agentic Security report, drawn from 107 qualified respondents at organizations with more than 100 employees. The full report will be released to attendees at VB Transform, the event in Menlo Park next week (July 14-15) focusing on enterprise autonomous agents.

Forty-five percent are final decision-makers for AI purchases. The sample skews mid-market, so read the numbers as the view from organizations adopting agent security right now rather than from the largest enterprises.

More than half of respondents, 54%, have already had an agent security incident or near-incident. Eighteen percent confirmed an incident, and thirty-six percent caught a near-miss before a breach. Security teams are stopping most of these events at the last control point in the chain, but the rest of the data shows how thin that margin is.

Your agents are sharing credentials

Only 32% of enterprises give every AI agent its own scoped, managed identity. Nearly half (48%) report that some agents have scoped identities, while many still share credentials. Another 32% say agents mostly run on shared API keys or borrowed human and service-account credentials. The survey question allowed more than one selection, and 24 of the 107 respondents chose multiple options — which is why the three categories sum to 112%. Deduplicated by respondent, 74 organizations, or 69%, flagged credential sharing in at least one answer.

One number explains why the acquisitions target this layer. A shared credential converts a single compromised agent into many, and CyberArk's research puts machine identities at 82 for every human in organizations worldwide, with agents as the fastest-growing category of the ratio. Cisco made the same diagnosis when it bought Astrix, whose founders built the company around API keys, service accounts, and OAuth tokens. Cisco’s announcement calls those the credentials AI agents are now “using (and abusing)” to execute work at scale.

Adam Meyers, senior vice president of counter adversary operations at CrowdStrike, described the mechanism directly in an interview with VentureBeat. Some AI systems have their own identities, he said, and in other cases “people give their identity to the AI to take action on their behalf, and that also further kind of murkies the water and makes it very complex.” The murk is the point, because when the identity is shared, attribution dies with it.

Exposure scales with size, and containment does not

Forty-nine percent of enterprises enforce scoped permissions at runtime, and 47% monitor and log agent activity, which can help reduce security incidents. Only 30% sandbox their highest-risk agents, the one control that limits blast radius when the first two fail. Isolation is what keeps a single compromised agent from becoming a deployment-wide event. Enterprises have funded detection and resistance, but the containment layer barely exists.

The sharpest finding in the survey, and the one no vendor report captures, shows up when you split results by company size. The incident rate is 49% for companies with 101 to 1,000 employees, but it shoots up to 63% for companies with more than 1,000. Sandbox isolation moves the other way, falling from 35% to 20% at the larger companies.

The chart above shows the same finding at finer granularity: the 49%/63% split above is a binary cut at 1,000 employees, while the bars here break incident rate and isolation rate into four size bands. The red line measures incidents and near-misses, and the navy tracks the one control that contains damage after everything else fails. At organizations with 101 to 250 employees, the two sit 7 points apart, but above 5,000, the gap blows out to 60 points. That top band pools the survey's two largest size groups and holds only 15 respondents, so treat the number as directional. Larger enterprises run more agents across more systems, which drives incidents up while sandboxing, the engineering project that would contain them, goes unfunded. The enterprises with the most agents have the least isolation around them.

The deals target exactly those accounts. Palo Alto Networks, Cisco, and CrowdStrike sell to large enterprises first, where incident rates are highest and containment is the thinnest.

Guarded by whoever shipped the model

The model providers are the security layer. OpenAI's built-in guardrails lead at 51%. Google Cloud reaches 36%, Microsoft Azure's Purview and Copilot Studio DLP 35%, and Anthropic's managed-agent controls 29%. Eighty-two percent of respondents name a provider-native or hyperscaler control as their single primary agent security layer.

The purpose-built specialists are in single digits, with Palo Alto Networks' Prisma AIRS at 7%, CrowdStrike at 6%, and Okta for AI Agents at 4%. Zenity and the dedicated non-human identity platforms are at 3% each. Microsoft Entra Agent ID is the highest-penetration identity-specific control in the dataset at 13%, the only one from a hyperscaler, and it still falls outside the top four. Only 5% of enterprises run no dedicated agent tooling at all, and the rest have tooling that came pre-installed.

Bundled controls lead because they ship free and are enabled by default. Most filter prompts and outputs, but they do not give an agent its own identity or sandbox it. Hyperscalers sell identity-layer products, and Entra Agent ID is in the dataset at 13%, but adoption stays low. The two controls that reward incident data the most, scoped identity and isolation, are the two that the default stack does not include.

Prompt-and-output filters evaluate whether a call looks malicious. That is an intent problem, and intent cannot be solved at the language layer. CrowdStrike CTO Elia Zaitsev drew the line in an interview at RSAC 2026. "Observing actual kinetic actions is a structured, solvable problem," Zaitsev said. "Intent is not." CrowdStrike's Falcon sensor walks the process tree on an endpoint and tracks what agents did, not what agents appeared to intend. A scoped identity and an isolation boundary give that sensor something to track, while a shared credential on a bundled guardrail does not.

Cloud security went through the same cycle a decade ago, and Palo Alto Networks, CrowdStrike, and Wiz built multi-billion-dollar businesses on the gaps native cloud controls left open. Agent security is tracking the same path faster. A misconfigured storage bucket sat open until a human noticed. A misconfigured agent exploits its own over-permissioning on every run, and no human is watching when it does. Merritt Baer, chief security officer at Enkrypt AI and a former deputy CISO at AWS, told VentureBeat that the default layer is thinner than enterprises assume. "Enterprises believe they've 'approved' AI vendors, but what they've actually approved is an interface, not the underlying system," Baer said. "The real dependencies are one or two layers deeper, and those are the ones that fail under stress."

Comfortable, unconvinced, and already shopping

Here is the contradiction worth a keynote slide. Enterprises rate their agent security tooling 4.2 out of 5, with value for money at 4.1 and ease of implementation at 3.9. Those scores would make most SaaS vendors envious.

Only 35% believe their AI-enabled defenses are ahead of AI-enabled attackers, while thirty-two percent call it roughly even. Twenty-one percent say attackers lead, and another 21% say it is too early to tell, showing how enterprises trust their tooling more than they trust its outcomes.

Budgets confirm it. Forty-six percent allocate 6 to 10% of the security budget to agent security, and a full third spend 5% or less. Half the sample has already had an incident or near-miss, but the funding does not match the exposure.

Fifty-nine percent plan to adopt, add, or replace agent security tooling within 12 months, and twenty-nine percent plan to move this quarter. OpenAI leads forward interest at 34%, followed by Google at 30%, Anthropic at 29%, and Azure at 25%. The dedicated vendors draw more interest looking forward than their current single-digit footprint suggests. Satisfied customers do not reshuffle this fast unless they know the stack they're currently using is provisional.

Three moves for security directors

1. Inventory every agent’s credentials this quarter. Map which agents share credentials with other agents and which run on borrowed human or service-account identities. The goal is not one credential per agent. Agents that touch multiple systems need multiple scoped identities. The goal is zero shared credentials between agents and zero borrowed human identities. Thirteen percent of surveyed enterprises already run Microsoft Entra Agent ID. Okta for AI Agents and the non-human identity specialists sell equivalents. Shared and borrowed credentials are the first thing to eliminate.

2. Sandbox the riskiest agents first. Isolation is the least-adopted control at 30% and the only one that contains blast radius after prevention fails. Rank agents by the sensitivity of what they touch and isolate the top of the list. Above 1,000 employees, where isolation falls to 20%, this is the single highest-return move in the dataset. Sandboxing does not require replacing the agent or the platform. It requires a policy decision and an isolation layer.

3. Match the budget to the incident rate. A third of enterprises fund agent security at 5% or less of the security budget, even though more than half have already had an incident or near-miss. Nine percent allocate more than 25% today. The full report breaks out exposure and containment by company size, showing which bands carry the most risk and the least protection.

The board's question is simpler. If one of our AI agents was compromised this afternoon, which systems did it touch, and whose credentials was it holding? For the 69% of enterprises running agents on shared credentials, the answer is a shrug. The trail goes cold at the key.

The full Q2 Agentic Security report, with the complete vendor matrix, industry cuts, and the full dataset behind these charts, debuts July 14 and 15 at VB Transform, held at Hotel Nia in Menlo Park. The open question it leaves is whether enterprises close the agent security gap on their own terms, or whether a confirmed breach closes it for them.

CVE-2026-0280 | Palo Alto Cloud NGFW/PAN-OS/Prisma Access Dataplane improper authentication (EUVD-2026-42681)

Thu, 09 Jul 2026 22:54:22 +0200

A vulnerability marked as problematic has been reported in Palo Alto Cloud NGFW, PAN-OS and Prisma Access. Impacted is an unknown function of the component Dataplane. Performing a manipulation results in improper authentication. This vulnerability was named CVE-2026-0280. The attack may be initiated remotely. There is no available exploit.

CVE-2026-0284 | Palo Alto Cloud NGFW/PAN-OS/Prisma Access LSVPN xml injection (EUVD-2026-42677)

Thu, 09 Jul 2026 22:54:20 +0200

A vulnerability classified as critical has been found in Palo Alto Cloud NGFW, PAN-OS and Prisma Access. The impacted element is an unknown function of the component LSVPN. The manipulation leads to xml injection. This vulnerability is referenced as CVE-2026-0284. Remote exploitation of the attack is possible. No exploit is available.

LlamaIndex ‘legal-kb’: Agentic Retrieval over Index v2 with retrieve, find, read, and grep Tools

Sun, 05 Jul 2026 10:03:49 +0200

LlamaIndex’s legal-kb is a public reference app that gives agents filesystem-style access to a document knowledge base on Index v2. It exposes retrieve (hybrid semantic search), find, read, and grep as tools, with automatic per-file versioning and visual citations. The stack is TanStack Start, AI SDK 6 (ToolLoopAgent), Prisma, and WorkOS.

The post LlamaIndex ‘legal-kb’: Agentic Retrieval over Index v2 with retrieve, find, read, and grep Tools appeared first on MarkTechPost.

Diese versteckte App macht jedes Samsung Galaxy sofort besser

Sun, 05 Jul 2026 09:32:34 +0200

Samsung baut seit Jahren hervorragende Smartphones. Doch das volle Potenzial von One UI steckt nicht unbedingt in den Systemeinstellungen, sondern in einer App, die viele Galaxy-Nutzer nie installieren: Good Lock. Was die App alles kann, welche Module sich lohnen und wie Sie Good Lock einrichten, erfahren Sie hier.

Was ist Samsung Good Lock?

Good Lock ist ein offizieller Samsung-Dienst, der als Hub für eine Sammlung von Zusatzmodulen fungiert. Jedes dieser Module greift tief in einen bestimmten Bereich von One UI ein: den Sperrbildschirm, die Navigation, die Kamera, Benachrichtigungen, Multitasking und vieles mehr. Das Ergebnis ist ein Anpassungsgrad, der sonst nur Custom-ROMs vorbehalten war.

Die App ist vollständig kostenlos, wird direkt von Samsung entwickelt und ist damit so sicher wie One UI selbst. Mit One UI 8 im Jahr 2026 hat Samsung vier neue Module hinzugefügt und zahlreiche bestehende aktualisiert.

Für welche Galaxy-Geräte ist Good Lock verfügbar?

Good Lock läuft auf allen Samsung Galaxy-Geräten mit One UI 6 oder neuer. Konkret bedeutet das:

Galaxy S-Serie: S23, S23+, S23 Ultra und neuer (inkl. S26-Reihe)
Galaxy Z-Serie: Z Flip 5 und Z Fold 5 aufwärts
Galaxy A-Serie: Ausgewählte Modelle mit One UI 6+
Galaxy Tab: Tab S9 und neuer

Good Lock ist im Samsung Galaxy Store verfügbar und seit Ende 2025 alternativ auch über den Google Play Store, womit die frühere Beschränkung auf bestimmte Länder entfällt. Einzelne Module können jedoch weiterhin regional eingeschränkt sein.

Wichtig: Die einzelnen Module werden nicht automatisch installiert. Sie wählen selbst, welche Module Sie aktivieren möchten. Das spart Speicherplatz und hält das System übersichtlich.

Die besten aktuellen Angebote für das Samsung Galaxy S26

629,00 €

Jetzt ansehen

639,00 €

Jetzt ansehen

645,00 €

Jetzt ansehen

681,00 €

Jetzt ansehen

687,30 €

Jetzt ansehen

699,99 €

Jetzt ansehen

999,00 €

Jetzt ansehen

So installieren Sie Good Lock

Öffnen Sie den Galaxy Store auf Ihrem Samsung-Gerät (oder Google Play Store).
Suchen Sie nach “Good Lock“. Das Icon zeigt vier farbige, ineinandergreifende Puzzleteile.
Installieren und öffnen Sie die App.
Wählen Sie die gewünschten Module direkt in Good Lock aus und laden Sie sie per Tap herunter.

Tipp: Installieren Sie nicht alle Module auf einmal. Starten Sie mit zwei oder drei, die Ihrem konkreten Bedarf entsprechen.

Wie ist Good Lock aufgebaut?

Good Lock selbst ist nur die Schaltzentrale. Nach der Installation sehen Sie eine übersichtliche Oberfläche mit vier Bereichen:

Make up: Module zur optischen Anpassung, etwa Themes, Sperrbildschirm und Hintergrundbilder.
Life up: Module für Funktionen und Effizienz, zum Beispiel Navigation, Kamera, Multitasking und Audio.
Clock: Eigenständige Kategorie für Uhren-Module (zum Beispiel ClockFace für das Always-On-Display).
Extensions: Zusatzmodule, die quer durch die beiden Hauptkategorien “Make up” und “Life up” verfügbar sind.

Tippen Sie auf ein Modul, können Sie es direkt dort herunterladen und installieren, also ohne Umweg über den Galaxy Store. Insgesamt stehen aktuell mehr als 20 Module zur Verfügung.

PC-Welt

Die wichtigsten Module im Überblick

Theme Park

PC-Welt

Theme Park ist der Einstieg in die optische Personalisierung. Das Modul ermöglicht es, eigene Themes zu erstellen: Farben, Icon-Formen, Hintergrundbilder und Schriftarten lassen sich frei kombinieren. Vorhandene Icon-Packs aus dem Play Store können eingebunden und verwaltet werden.

Seit 2026 gibt es sogar einen KI-Theme-Generator. Sie beschreiben per Text, wie Ihr Theme aussehen soll, und die KI erstellt automatisch ein passendes Farbschema inklusive Icons und Hintergrundbild.

One Hand Operation+

Falls Sie, so wie ich, ein Galaxy S Ultra oder Z Fold besitzen, haben Sie bestimmt schon bemerkt: Einhändige Bedienung ist eine Herausforderung. One Hand Operation+ löst das Problem mit sechs konfigurierbaren Edge-Gesten (drei pro Seite). Jede Geste kann individuell belegt werden: Zurück, App-Übersicht, Screenshot, Taschenlampe, Benachrichtigungen und mehr.

Das Besondere daran ist, dass das Modul parallel zur normalen Navigationsleiste funktioniert und diese um zusätzliche Wischgesten ergänzt.

LockStar

PC-Welt

Der Sperrbildschirm ist das Erste, was Sie sehen, wenn Sie Ihr Smartphone in die Hand nehmen. One UI lässt ihn aber nur begrenzt anpassen. LockStar öffnet hier deutlich mehr Spielraum. Per WYSIWYG-Editor ziehen Sie Uhr, Datum, Widgets und App-Shortcuts frei auf dem Bildschirm hin und her, sowohl im Hoch- als auch im Querformat. Elemente, die Ihnen nicht gefallen, blenden Sie einfach aus.

Besonders nützlich: LockStar schaltet App-Widgets auf dem Sperrbildschirm frei, die Samsung standardmäßig nicht erlaubt. So sehen Sie etwa den Kalender, den Schrittzähler oder die Wettervorschau direkt auf dem gesperrten Display, ohne das Smartphone erst zu entsperren. Auch App-Shortcuts lassen sich frei platzieren. Ein Tipp auf das Kamera-Symbol startet die Kamera, ohne den Entsperrvorgang zu durchlaufen.

Neu im Jahr 2026 sind außerdem animierte Entsperreffekte. Die neue Animation Swirl dreht den Sperrbildschirm beim Entsperren herein, und weitere Stile wie Curtain, Ripple, Mosaic oder Wave sorgen dafür, dass selbst das Entsperren des Telefons ein kleines visuelles Erlebnis wird.

MultiStar

MultiStar erweitert die Multitasking-Funktionen erheblich. Jede App kann im geteilten Bildschirm oder als Popup-Fenster geöffnet werden (auch solche, die das offiziell nicht unterstützen). Neu seit 2026 sind App-Paare auf dem Homescreen, die zwei Apps gleichzeitig im Split-Screen starten.

Für Foldable-Nutzer unverzichtbar: MultiStar steuert, wie Apps beim Auf- und Zuklappen zwischen Cover- und Hauptbildschirm wechseln. Samsung DeX-Nutzer profitieren von Optionen wie höheren Auflösungen oder mehr als fünf gleichzeitigen Apps auf dem verbundenen Display.

RegiStar

PC-Welt

RegiStar ist das Modul für alle, denen die Standardbelegung von Tasten und Gesten nicht weit genug geht. Das bekannteste Feature ist die Backtap-Geste: Wenn Sie zweimal auf die Rückseite Ihres Smartphones tippen, öffnet sich eine frei wählbare App oder Funktion (etwa die Taschenlampe, ein Screenshot oder Expert RAW). Gerade wenn die Ein-/Aus-Taste bereits für Gemini oder die Kamera reserviert ist, schafft Backtap eine praktische dritte Steuermöglichkeit, die vollkommen unsichtbar bleibt.

Überdies lässt sich mit RegiStar auch die Seitentaste neu belegen: Doppeltippen und langes Drücken können unabhängig voneinander mit eigenen Aktionen verknüpft werden. Wer möchte, startet so per langem Druck direkt eine bestimmte App statt den Sprachassistenten.

Weniger bekannt, aber ebenso nützlich: Mit RegiStar können Sie das Einstellungsmenü von One UI umstrukturieren. Bereiche, die Sie nie benötigen, lassen sich ausblenden und häufig genutzte nach oben schieben. Die integrierte Einstellungshistorie protokolliert dabei alle kürzlich vorgenommenen Änderungen im System.

NavStar

Die Navigationsleiste sieht man täglich, doch anpassen lässt sie sich in One UI kaum. NavStar ändert das. Sofern Sie die klassische Tastennavigation nutzen, können Sie Layout, Reihenfolge und Farbe der Schaltflächen frei gestalten, den Hintergrund der Leiste einfärben und eine zusätzliche Schaltfläche einblenden, mit der sich die Leiste bei Bedarf auf Knopfdruck verstecken lässt.

Wenn Sie per Wischgesten navigieren, lassen sich die Empfindlichkeit und der Aktionsbereich für die linke und rechte Seite unabhängig voneinander einstellen. Das ist praktisch, wenn Sie etwa links mehr Spielraum für die Zurück-Geste möchten. Außerdem entscheiden Sie, ob der Strich am unteren Bildschirmrand sichtbar bleibt oder dezent ausblendet.

Camera Assistant

PC-Welt

Camera Assistant schaltet versteckte Kamerafunktionen frei. Auf der Galaxy S26-Reihe aktiviert das Modul den 24-Megapixel-Modus, der KI-Fusionsverarbeitung nutzt: schärfer als 12 MP, kleinere Dateien als 50 MP. Ein guter Sweetspot für den Alltag. Zu den weiteren Funktionen zählen unter anderem folgende:

Fokus-Peaking im Pro-Modus markiert scharf gestellte Bildbereiche farbig, was besonders bei manueller Fokussierung hilft.
Serienbilder mit Intervall ermöglichen zeitgesteuerte Aufnahmeserien, etwa für Zeitraffer-Vorbereitungen.
Auto-HDR aktiviert sich automatisch, wenn die Kamera starke Helligkeitsunterschiede erkennt
Automatisches Objektivwechseln lässt das Gerät je nach Motiv und Zoomstufe selbst das optimale Objektiv wählen.
Der Astro-Modus-Shortcut macht den Nachtfotografie-Modus direkt erreichbar.
Benutzerdefinierte Auflösungsvoreinstellungen erlauben es, bevorzugte Megapixel-Stufen dauerhaft zu speichern und schnell umzuschalten.

NotiStar

Benachrichtigungen verschwinden schnell – manchmal zu schnell. NotiStar löst dieses Problem mit einer vollständigen Benachrichtigungshistorie, die alle eingegangenen Mitteilungen speichert, bis Sie sie selbst löschen. Auch versehentlich weggewischte Benachrichtigungen lassen sich so jederzeit nachlesen.

Weiterhin bietet NotiStar eine personalisierte Filterfunktion: Sie legen fest, von welchen Apps Sie Benachrichtigungen sehen möchten und von welchen nicht. Noch präziser wird es mit Keyword-Filtern: So können Sie beispielsweise einstellen, dass Sie von einer bestimmten App nur dann benachrichtigt werden, wenn die Nachricht ein bestimmtes Wort enthält, etwa “Rechnung” oder “Termin”. Benachrichtigungen, die den Filter nicht erfüllen, werden verworfen oder nur in der Historie gespeichert, ohne dass sie Sie aktiv stören.

Auch für den Sperrbildschirm ist NotiStar praktisch. Dort greift es nämlich ebenfalls, sodass Sie genau steuern, was auf dem gesperrten Display sichtbar ist. Im Februar 2026 hat Samsung das Modul mit einer überarbeiteten Benachrichtigungsverwaltung aktualisiert, die die Übersicht über mehrere Apps hinweg nochmals verbessert.

Weitere empfehlenswerte Module

Home Up: Anpassung des Launchers wie Rastergröße, App-Drawer, Share-Menü bereinigen
Keys Cafe: Tastaturlayout, Tastatureffekte und Sounds
QuickStar: Statusleisten-Symbole hinzufügen oder entfernen, Quick-Settings direkt öffnen
Routines+: Erweiterte Bixby-Automationen mit Touch-Makros und App-basierten Auslösern
Wonderland: Lebendige Parallax-Hintergrundbilder mit Bewegungseffekten
ClockFace: Individuelle Uhr für Always-On-Display und Sperrbildschirm
Game Booster+: Gamepad-Touch-Mapping, AP-Taktbegrenzung, Game-Intro-Schnellvorlauf
Pentastic: S-Pen-Zeigerstile und Air-Command-Anpassungen (für S-Pen-Geräte)
Nice Catch: Systemprotokoll für Benachrichtigungen, Vibrationen und Einstellungsänderungen

Sollte das alles noch nicht ausreichen, finden Sie hier noch mehr Tipps, um Ihr Galaxy zu optimieren: Diese 11 versteckten Android-Funktionen sollten Sie sofort ausprobieren.

Und falls Sie ein Galaxy S26 besitzen: Die besten Tipps und Tricks für Samsung Galaxy S26.

Diese versteckte App macht jedes Samsung Galaxy sofort besser

Thu, 02 Jul 2026 07:48:05 +0200

Was ist Samsung Good Lock?

Für welche Galaxy-Geräte ist Good Lock verfügbar?

Good Lock läuft auf allen Samsung Galaxy-Geräten mit One UI 6 oder neuer. Konkret bedeutet das:

Galaxy S-Serie: S23, S23+, S23 Ultra und neuer (inkl. S26-Reihe)
Galaxy Z-Serie: Z Flip 5 und Z Fold 5 aufwärts
Galaxy A-Serie: Ausgewählte Modelle mit One UI 6+
Galaxy Tab: Tab S9 und neuer

Wichtig: Die einzelnen Module werden nicht automatisch installiert. Sie wählen selbst, welche Module Sie aktivieren möchten. Das spart Speicherplatz und hält das System übersichtlich.

Die besten aktuellen Angebote für das Samsung Galaxy S26

629,00 €

Jetzt ansehen

629,00 €

Jetzt ansehen

645,00 €

Jetzt ansehen

653,99 €

Jetzt ansehen

681,00 €

Jetzt ansehen

687,30 €

Jetzt ansehen

999,00 €

Jetzt ansehen

So installieren Sie Good Lock

Öffnen Sie den Galaxy Store auf Ihrem Samsung-Gerät (oder Google Play Store).
Suchen Sie nach “Good Lock“. Das Icon zeigt vier farbige, ineinandergreifende Puzzleteile.
Installieren und öffnen Sie die App.
Wählen Sie die gewünschten Module direkt in Good Lock aus und laden Sie sie per Tap herunter.

Tipp: Installieren Sie nicht alle Module auf einmal. Starten Sie mit zwei oder drei, die Ihrem konkreten Bedarf entsprechen.

Wie ist Good Lock aufgebaut?

Good Lock selbst ist nur die Schaltzentrale. Nach der Installation sehen Sie eine übersichtliche Oberfläche mit vier Bereichen:

Make up: Module zur optischen Anpassung, etwa Themes, Sperrbildschirm und Hintergrundbilder.
Life up: Module für Funktionen und Effizienz, zum Beispiel Navigation, Kamera, Multitasking und Audio.
Clock: Eigenständige Kategorie für Uhren-Module (zum Beispiel ClockFace für das Always-On-Display).
Extensions: Zusatzmodule, die quer durch die beiden Hauptkategorien “Make up” und “Life up” verfügbar sind.

Tippen Sie auf ein Modul, können Sie es direkt dort herunterladen und installieren, also ohne Umweg über den Galaxy Store. Insgesamt stehen aktuell mehr als 20 Module zur Verfügung.

PC-Welt

Die wichtigsten Module im Überblick

Theme Park

PC-Welt

One Hand Operation+

Das Besondere daran ist, dass das Modul parallel zur normalen Navigationsleiste funktioniert und diese um zusätzliche Wischgesten ergänzt.

LockStar

PC-Welt

MultiStar

RegiStar

PC-Welt

NavStar

Camera Assistant

PC-Welt

Fokus-Peaking im Pro-Modus markiert scharf gestellte Bildbereiche farbig, was besonders bei manueller Fokussierung hilft.
Serienbilder mit Intervall ermöglichen zeitgesteuerte Aufnahmeserien, etwa für Zeitraffer-Vorbereitungen.
Auto-HDR aktiviert sich automatisch, wenn die Kamera starke Helligkeitsunterschiede erkennt
Automatisches Objektivwechseln lässt das Gerät je nach Motiv und Zoomstufe selbst das optimale Objektiv wählen.
Der Astro-Modus-Shortcut macht den Nachtfotografie-Modus direkt erreichbar.
Benutzerdefinierte Auflösungsvoreinstellungen erlauben es, bevorzugte Megapixel-Stufen dauerhaft zu speichern und schnell umzuschalten.

NotiStar

Weitere empfehlenswerte Module

Home Up: Anpassung des Launchers wie Rastergröße, App-Drawer, Share-Menü bereinigen
Keys Cafe: Tastaturlayout, Tastatureffekte und Sounds
QuickStar: Statusleisten-Symbole hinzufügen oder entfernen, Quick-Settings direkt öffnen
Routines+: Erweiterte Bixby-Automationen mit Touch-Makros und App-basierten Auslösern
Wonderland: Lebendige Parallax-Hintergrundbilder mit Bewegungseffekten
ClockFace: Individuelle Uhr für Always-On-Display und Sperrbildschirm
Game Booster+: Gamepad-Touch-Mapping, AP-Taktbegrenzung, Game-Intro-Schnellvorlauf
Pentastic: S-Pen-Zeigerstile und Air-Command-Anpassungen (für S-Pen-Geräte)
Nice Catch: Systemprotokoll für Benachrichtigungen, Vibrationen und Einstellungsänderungen

Sollte das alles noch nicht ausreichen, finden Sie hier noch mehr Tipps, um Ihr Galaxy zu optimieren: Diese 11 versteckten Android-Funktionen sollten Sie sofort ausprobieren.

Und falls Sie ein Galaxy S26 besitzen: Die besten Tipps und Tricks für Samsung Galaxy S26.

Diese versteckte App macht jedes Samsung Galaxy sofort besser

Tue, 30 Jun 2026 15:32:21 +0200

Was ist Samsung Good Lock?

Für welche Galaxy-Geräte ist Good Lock verfügbar?

Good Lock läuft auf allen Samsung Galaxy-Geräten mit One UI 6 oder neuer. Konkret bedeutet das:

Galaxy S-Serie: S23, S23+, S23 Ultra und neuer (inkl. S26-Reihe)
Galaxy Z-Serie: Z Flip 5 und Z Fold 5 aufwärts
Galaxy A-Serie: Ausgewählte Modelle mit One UI 6+
Galaxy Tab: Tab S9 und neuer

Wichtig: Die einzelnen Module werden nicht automatisch installiert. Sie wählen selbst, welche Module Sie aktivieren möchten. Das spart Speicherplatz und hält das System übersichtlich.

Die besten aktuellen Angebote für das Samsung Galaxy S26

645,00 €

Jetzt ansehen

653,99 €

Jetzt ansehen

679,99 €

Jetzt ansehen

679,99 €

Jetzt ansehen

679,99 €

Jetzt ansehen

681,00 €

Jetzt ansehen

687,30 €

Jetzt ansehen

759,00 €

Jetzt ansehen

999,00 €

Jetzt ansehen

So installieren Sie Good Lock

Öffnen Sie den Galaxy Store auf Ihrem Samsung-Gerät (oder Google Play Store).
Suchen Sie nach “Good Lock“. Das Icon zeigt vier farbige, ineinandergreifende Puzzleteile.
Installieren und öffnen Sie die App.
Wählen Sie die gewünschten Module direkt in Good Lock aus und laden Sie sie per Tap herunter.

Tipp: Installieren Sie nicht alle Module auf einmal. Starten Sie mit zwei oder drei, die Ihrem konkreten Bedarf entsprechen.

Wie ist Good Lock aufgebaut?

Good Lock selbst ist nur die Schaltzentrale. Nach der Installation sehen Sie eine übersichtliche Oberfläche mit vier Bereichen:

Make up: Module zur optischen Anpassung, etwa Themes, Sperrbildschirm und Hintergrundbilder.
Life up: Module für Funktionen und Effizienz, zum Beispiel Navigation, Kamera, Multitasking und Audio.
Clock: Eigenständige Kategorie für Uhren-Module (zum Beispiel ClockFace für das Always-On-Display).
Extensions: Zusatzmodule, die quer durch die beiden Hauptkategorien “Make up” und “Life up” verfügbar sind.

Tippen Sie auf ein Modul, können Sie es direkt dort herunterladen und installieren, also ohne Umweg über den Galaxy Store. Insgesamt stehen aktuell mehr als 20 Module zur Verfügung.

PC-Welt

Die wichtigsten Module im Überblick

Theme Park

PC-Welt

One Hand Operation+

Das Besondere daran ist, dass das Modul parallel zur normalen Navigationsleiste funktioniert und diese um zusätzliche Wischgesten ergänzt.

LockStar

PC-Welt

MultiStar

RegiStar

PC-Welt

NavStar

Camera Assistant

PC-Welt

Fokus-Peaking im Pro-Modus markiert scharf gestellte Bildbereiche farbig, was besonders bei manueller Fokussierung hilft.
Serienbilder mit Intervall ermöglichen zeitgesteuerte Aufnahmeserien, etwa für Zeitraffer-Vorbereitungen.
Auto-HDR aktiviert sich automatisch, wenn die Kamera starke Helligkeitsunterschiede erkennt
Automatisches Objektivwechseln lässt das Gerät je nach Motiv und Zoomstufe selbst das optimale Objektiv wählen.
Der Astro-Modus-Shortcut macht den Nachtfotografie-Modus direkt erreichbar.
Benutzerdefinierte Auflösungsvoreinstellungen erlauben es, bevorzugte Megapixel-Stufen dauerhaft zu speichern und schnell umzuschalten.

NotiStar

Weitere empfehlenswerte Module

Home Up: Anpassung des Launchers wie Rastergröße, App-Drawer, Share-Menü bereinigen
Keys Cafe: Tastaturlayout, Tastatureffekte und Sounds
QuickStar: Statusleisten-Symbole hinzufügen oder entfernen, Quick-Settings direkt öffnen
Routines+: Erweiterte Bixby-Automationen mit Touch-Makros und App-basierten Auslösern
Wonderland: Lebendige Parallax-Hintergrundbilder mit Bewegungseffekten
ClockFace: Individuelle Uhr für Always-On-Display und Sperrbildschirm
Game Booster+: Gamepad-Touch-Mapping, AP-Taktbegrenzung, Game-Intro-Schnellvorlauf
Pentastic: S-Pen-Zeigerstile und Air-Command-Anpassungen (für S-Pen-Geräte)
Nice Catch: Systemprotokoll für Benachrichtigungen, Vibrationen und Einstellungsänderungen

Sollte das alles noch nicht ausreichen, finden Sie hier noch mehr Tipps, um Ihr Galaxy zu optimieren: Diese 11 versteckten Android-Funktionen sollten Sie sofort ausprobieren.

Und falls Sie ein Galaxy S26 besitzen: Die besten Tipps und Tricks für Samsung Galaxy S26.

Die größten Paradoxa der Softwareentwicklung

Mon, 29 Jun 2026 06:07:06 +0200

Paradoxe Erlebnisse sind für Softwareentwickler Alltag.

Rosemarie Mosteller | shutterstock.com

Vergleicht man den Bau von Brücken mit der Softwareentwicklung, zeigen sich bedeutende Unterschiede: Denn auch wenn keine Brücke – ähnlich wie ein Softwareprojekt – der anderen bis aufs „Haar“ gleicht, werden sie aus bekannten Materialien mit bekannten Eigenschaften geschaffen.

Im Gegensatz dazu beinhaltet der Softwareentwicklungsprozess wesentlich mehr „unknown Unknowns“. Was dazu führt, dass er jede Menge Paradoxa beinhaltet, mit denen Developer teilweise nur schwer umgehen können. Wichtig ist aber vor allem, sich ihre Existenz bewusst zu machen – nur so lassen sich die daraus entstehenden Fallstricke umgehen. Insbesondere, wenn es dabei um die folgenden vier Paradoxa geht.

1. Ohne Plan, aber mit Deadline

Zielführend einzuschätzen, wie lange ein Softwareprojekt dauern wird, ist wahrscheinlich die größte Herausforderung für Softwareentwickler überhaupt. Denn darüber lässt sich keine abschließende, verbindliche Aussage treffen. Sicher, man kann den ungefähren Aufwand schätzen – das geht im Regelfall allerdings daneben. Meistens wird der zeitliche Aufwand drastisch unterschätzt.

Wird die gesetzte Deadline dann verpasst, ärgern sich vor allem die Kunden. Sie stecken nicht in der Haut der Devs und durchblicken die Abläufe und möglichen Hindernisse (im Regelfall) nicht. Also sind sie frustriert, weil ihre Software nicht zum vereinbarten Zeitpunkt ausgeliefert wird.

Auch sämtliche Versuche, mit schicken, agilen Methoden wie Story Points oder Planing Poker zielführender vorhersagen zu wollen, wann ein Softwareprojekt abgeschlossen wird, bringen ~~nichts~~ wenig. Wir scheinen einfach nicht in der Lage, Hofstadters Gesetz (der Verzögerung) zu überwinden.

2. Mehr Mannstärke, mehr Verzug

Stellt ein Manager einer Fabrik fest, dass die monatliche Quote für abgefüllte Zahnpastatuben in Gefahr ist, setzt er mehr Arbeiter ein, um die Vorgabe zu erfüllen. Ähnlich verhält es sich beim Hausbau: Wenn Sie doppelt so viele Häuser wie im Vorjahr bauen wollen, hilft es in der Regel, die Vorleistungen – Arbeit und Material – zu verdoppeln.

Im Fall der Softwareentwicklung verhält sich das völlig anders, wie Frederick Brooks bereits 1975 in seinem Buch „Vom Mythos des Mann-Monats“ herausgearbeitet hat. Demnach hilft es wenig, verzögerte Softwareprojekte mit zusätzlicher Mannstärke retten zu wollen. Im Gegenteil: Gemäß dem Brooks’schen Gesetz verzögert das das Projekt nur noch zusätzlich. Schließlich können neu hinzukommende Teammitglieder nicht sofort zum Projekt beitragen. Sie benötigen Zeit, um sich in den Kontext komplexer Systeme einzuarbeiten, was oft auch zusätzliche Kommunikationsmaßnahmen nach sich zieht. Am Ende verzögert sich dann nicht nur alles noch weiter – es kostet auch mehr.

3. Mehr Skills, weniger Programmier-Tasks

Als Softwareentwickler umfassende Expertise aufzubauen und sämtliche erforderlichen Regeln und Feinheiten zu verinnerlichen, um wartbaren, sauberen Code zu schreiben, nimmt etliche Jahre in Anspruch. Dabei erscheint es auch relativ paradox, dass die Programmieraufgaben mit steigender Erfahrung eher weniger werden: Statt zu programmieren, sitzen leitende Entwickler vor allem in Design-Meetings, überprüfen den Code anderer und übernehmen weitere Führungsaufgaben.

Das heißt zwar nicht, dass Senior Developer einen kleineren Beitrag leisten. Schließlich sorgen sie in Führungspositionen dafür, dass zeitgemäß und zielführend gearbeitet wird und tragen so wesentlich zum Team- und Unternehmenserfolg bei. Aber am Ende schreiben sie dennoch weniger Code.

4. Bessere Tools, keine Zeitvorteile

Vergleicht man die Webentwicklung von heute mit performanten Tools wie React, Astro und Next.js mit dem Gebaren von vor 30 Jahren (Stichwort Common Gateway Interface), wird klar, dass wir uns seitdem um Lichtjahre weiterentwickelt haben. Doch obwohl unsere Tools immer besser und die Prozessoren immer schneller werden, scheinen sich Softwareprojekte insgesamt nicht zu beschleunigen. Das wirft Fragen auf:

Unsere Websites sehen zwar immer besser aus, aber sind wir wirklich produktiver?
Laufen unsere Websites schneller und verarbeiten sie Daten besser?

Natürlich abstrahieren die Frameworks und Bibliotheken von heute viele Komplexitäten. Sie führen aber auch zu neuen Problemen. Zum Beispiel langen Build-Pipelines, Konfigurationsalbträumen oder Abhängigkeitsproblemen. (fm)

Sie wollen weitere interessante Beiträge zu diversen Themen aus der IT-Welt lesen? Unsere kostenlosen Newsletter liefern Ihnen alles, was IT-Profis wissen sollten – direkt in Ihre Inbox!

CVE-2026-50146 | withastro up to 6.3.2 data-astro-template cross site scripting

Sat, 27 Jun 2026 17:39:04 +0200

A vulnerability was found in withastro astro up to 6.3.2. It has been rated as problematic. The affected element is an unknown function. The manipulation of the argument data-astro-template leads to basic cross site scripting. This vulnerability is referenced as CVE-2026-50146. Remote exploitation of the attack is possible. No exploit is available. Upgrading the affected component is advised.

Top 16 Gaming Headset Angebote zum Amazon Prime Day - Delamar

Thu, 25 Jun 2026 22:17:47 +0200

Wir haben 16 Deals bei Amazon händisch und redaktionell für dich ausgewählt. Die größte prozentuale Ersparnis bietet das Razer Barracuda X mit 45% Rabatt. Beim Logitech G Astro A50 LIGHTSPEED sparst Du sogar bis zu 140,99€.

IBM, Red Hat, Palo Alto team to secure open-source software

Wed, 24 Jun 2026 21:38:10 +0200

IBM, its RedHat subsidiary, and Palo Alto Networks are teaming up to help enterprises identify vulnerabilities in open-source software and deploy safeguards against threats, particularly those generated by AI.

The joint effort will rely on Palo Alto’s network-based virtual patching technology, which is found in its Prisma security software, and IBM/Red Hat’s Project Lightwell, a software remediation initiative designed to help enterprises secure open-source software. Vulnerability intelligence from both vendors will also contribute to threat detection and remediation, the companies stated.

Announced in May, Project Lighthouse is IBM and Red Hat’s $5 billion project to develop what IBM calls a “trusted enterprise clearinghouse combined with a global force of engineers to identify and fix vulnerabilities at scale.”

“The clearinghouse will serve as a security coordination layer, using advanced AI capabilities to validate and test fixes across an unprecedented volume of open source code,” IBM stated in May. “These capabilities will be offered through commercial subscriptions, allowing enterprises to integrate secure patches directly into their existing software supply chains with enterprise-grade validation and lifecycle management.”

Open-source software (OSS) underpins modern enterprise infrastructure, with more than 90% of Fortune 500 companies relying on OSS, IBM stated, citing a Worldmetric study.

IBM and Red Hat said they are working with a variety of early adopters on Project Lightwell, including Bank of America, BNY, Citi, Goldman Sachs, JPMorgan Chase, Mastercard, Morgan Stanley, RBC, State Street, Visa and Wells Fargo.

Key elements of the Palo Alto/IBM/Red Hat initiative include:

Vulnerability coverage: Protection across open-source software, commercial applications, operational technology environments, and connected devices.
Preemptive coverage: Organizations can receive virtual patch protections before official software patches become available, helping reduce exposure while remediation is underway.
Rapid protection: When a new vulnerability is discovered, network-level protections can be deployed the same day, with a long-term goal of reducing the time from validated discovery to protection.

The companies said they also plan to establish secure processes for sharing vulnerability information across participating software vendors, technology providers, and security teams. The idea is to accelerate protection development and provide anonymized telemetry on real-world exploitation attempts, the companies stated.

“AI has compressed the window between vulnerability discovery and exploit from weeks to minutes. Traditional patching cannot keep pace,” said Nikesh Arora, CEO and chairman of Palo Alto Networks, in a statement. “By collaborating with IBM and Red Hat, we are shifting the advantage back to defenders. This powerful combination allows us to neutralize threats in the network while providing uninterrupted business continuity for our global clients.”

IBM and Palo Alto have a long-running relationship of integrating security and enterprise-class networks. Recently, IBM and Palo Alto said they would combine to offer a service, Quantum-Safe Readiness, that would let enterprise customers identify cryptographic exposure, understand quantum-computing related risks, and accelerate their use of quantum-safe security technology.

In addition, the companies earlier this year said they would combine to offer a service designed to help enterprises discover, assess, and prioritize security and compliance risks for their artificial intelligence implementations in the cloud.

AI-SPM buyer’s guide: 14 tools to secure your AI infrastructure

Wed, 24 Jun 2026 09:09:48 +0200

Widespread enterprise adoption of AI has created a pressing need for security solutions — a tall order given that AI’s reach into organizational infrastructure and data is enormous and continues to grow.

Moreover, where an organization sits on the AI maturity curve impacts its security needs. Trail of Bits CEO Dan Guide describes the AI journey as a migration from AI-assisted, where AI tools are used on existing workflows; through AI-augmented, which uses new workflows based on AI; to the AI-native organization, where AI “becomes a core participant in the delivery and operations of a business.”

Those three stages require very different approaches to securing AI. They also present challenges for AI security vendors, whose platforms must fit in multiple places in a corporate network and interact with a broad spectrum of applications — especially as agentic AI expands. As analyst David Linthicum recently posted, “the conversation now has to shift from model fascination to operational discipline. The question is how those agents should be governed once they begin touching workflows that affect customers, employees, suppliers, compliance, and revenue.”

Making matters worse is that the average enterprise manages 37 agents, with more than half running without security oversight or logging, according to Microsoft’s 2026 Cyber Pulse report, which also found that, while 80% of Fortune 500 companies use active AI agents, only 10% have a clear strategy for managing them.

That lack of strategy also opens the door for attackers to abuse corporate AI systems for malicious purposes, as the recent exploit of Meta’s account recovery using chatbots demonstrated.

The trick to securing AI systems is in understanding how much protection is needed and where it should be applied in the expanding AI universe. While one could rent a well-meaning AI agent called Sentry for $7,400 per month to automate the daily work of a SOC analyst, many organizations rolling out AI across their business would be best served by considering AI security posture management (AI-SPM) tools.

Over the past two years, this emerging field has matured, with many security vendors incorporating or acquiring SPM features as part of their general security product portfolio.

Some vendors, such as SentinelOne and Concentric, don’t specifically sell AI-SPM per se, but offer an SPM tool that is part of a larger package of AI security services. Others offer AI-SPM in conjunction with their other SPM tools or CNAPP security offerings. Some vendors, such as Cyera and Palo Alto, offer multiple AI-SPM packaging alternatives with differing feature sets.

Choosing the right product requires careful examination of the roster of features and integrations each product offers to ensure that it doesn’t duplicate existing security tooling or worse, leave important coverage gaps.

Here we take a deeper look at the AI-SPM product category, with a breakdown of offerings from 14 of the leading vendors in this increasingly important security ecosystem.

AI security posture management explained

AI security posture management is an evolving cybersecurity discipline focused on ensuring the integrity and security of AI and machine learning systems. AI-SPM encompasses strategies, tools, and techniques for monitoring, assessing, and enhancing the security of AI models, data, pipelines, applications, and services, even as threats to those entities continually evolve.

In the past, security posture management tools were designed for two situations: to protect general cloud operations against misconfigurations and abuse, which is the province of cloud security posture management tools; and to protect against data leakage or malware infections, which is the province of data security posture management tools. With the rise of AI and large language models (LLMs), a third SPM product category is needed to check AI cloud services and their SDKs (like Hugging Face Transformers or Azure Open AI SDK) to prevent model abuses. This is because numerous studies have documented how AI training data can be the subject of an attack or how bad data can be injected into models to manipulate results, including creating malicious backdoors for attackers to use to enter your enterprise.

The latest reports about attacks on AI and AI abuse can help you better understand the scope of security challenges rapidly evolving today. MITRE continues to enhance its comprehensive database of adversary tactics — Adversarial Threat Landscape for Artificial-Intelligence Systems (ATLAS) — based on real-world attack observations. ATLAS currently spans 170 techniques and 57 case studies. MIT researchers also maintain a growing database of more than 1,700 AI-related risks that they have observed from various AI sources. Another great source of AI-related attack methods is from the Open Worldwide Application Security Project (OWASP), which maintains a Top 10 list of LLM exploits. Security managers should examine them before choosing any AI-SPM product. They should also consult Richard Stiennon’s Guardians of the Machine Age, the most comprehensive collection of general security vendors, listing more than 100 AI security vendors. The printed book offers a deeper dive into the specifics of these tools.

The AI-SPM vendor landscape is quickly evolving, as incumbent security vendors have made numerous acquisitions. Palo Alto Networks bought Protect.ai last year; Cato Networks acquired Aim.security; Orca acquired Opus for AI agentic security; SentinelOne acquired Prompt.Security; Varonis acquired a variety of companies, including Cyral, SlashNext, and AllTrue.ai; and Google acquired Wiz.

Why enterprises need AI-SPM

AI-SPMs have been designed to protect enterprise networks and applications from a range of threats to AI systems. Just like no modern business would assemble a network without an appropriate firewall, AI-SPMs “ensure that AI models stay explainable, fair, accountable, transparent and equitable,” Forrester analyst Andras Cser tells CSO. “Further good security hygiene dictates that AI infrastructure should not be allowed to be used as a steppingstone for hackers for lateral movement and data exfiltration, and should include policies to prevent and fix configuration drift.”

AI-SPM can also help organizations standardize on a series of AI policies, procedures, tools, and workflows that can boost their security. Guido’s talk — linked above — is chock full of suggestions on how Trail of Bits accomplished this.

Major AI-SPM trends and product features

All AI-SPM vendors make use of agentless configurations, accessing cloud-based models and leaving data on their existing platforms. This is both a security measure and to avoid moving the massive data repositories involved across the internet.

AI-SPM vendors also make use of AI-related mechanisms to classify and track these vast data collections and to protect them against potential abuse and attack. Many have integrated their AI-SPM solutions in one of three directions:

Bolting AI-SPM onto their existing cloud or data SPM platforms with rules, compliance checking, best practices, and protection policies that bridge all three types of security postures.
Stitching AI-SPM into their general AI security product that can be used to formulate AI-specific policies and perform AI-based red team and penetration testing in an effort to protect AI pipelines and workloads and uncover ways that shared AI services and platforms could be compromised.
Incorporating AI-SPM to help identify sensitive data referenced by an AI model and to examine training data exposed to a third-party or external application.

Some vendors, especially established security vendors such as CrowdStrike, Proofpoint, Palo Alto, Varonis, and Wiz, have hundreds of third-party integrations that cover the AI waterfront (such as AI assistants and model suppliers) and general IT security arena (such as development pipelines, data feeds, and tools such as SOAR and SIEM). All three types of integrations can provide better guiderails and limit an AI’s blast radius.

But AI-SPM is still evolving. Some vendors’ tools just perform a top-level inspection of one or two services from each of the big three cloud platforms’ AI services (Amazon, for example, has dozens of AI-related service offerings), whereas others (such as Palo Alto Networks, Cato, Cyera, Varonis, and Wiz) take a deeper dive, performing a more comprehensive examination of AI data from the AI vendors themselves and other model sources.

There are two open source efforts as well: Orca’s GOAT is a free learning platform that is based on the OWASP top 10 risks. Palo Alto’s Protect.ai has its collection of open-source tools on GitHub for scanning models and discovering AI interactions and automated red teaming called ProtectAI OSS. However, neither of these projects has been recently updated.

How to choose an AI-SPM tool

Here are several considerations when deciding on the best AI-SPM tool for your enterprise:

Does the vendor work with your existing security tool collection? This has two dimensions: integrating with other SPM products (such as data or cloud protection), and integrating with third-party tools such as SOARs, SIEMs, or DLP products. We have included some vendors that don’t have a specific AI-related SPM (such as Concentric and CrowdStrike) but have deeply embedded AI protection into their platforms.
How deep is the coverage across the cloud platform providers? The big three (AWS, Azure, and GCP) have many services that touch various aspects of AI, and some products only work with a few of them, or only connect with PaaS security “hubs.”
Does the vendor continuously scan your infrastructure looking for vulnerabilities? AI can be quickly adopted and is very dynamic, so discrete scans are less useful.
How important is having a tool that can help with AI red teaming? Understanding the dynamic nature of how AI operates means having a different approach to penetration testing, and this can be a very useful feature. Only a few vendors offer this feature (such as Concentric, Palo Alto Networks, and Varonis).

Leading AI-SPM vendors and products

We reached out to a range of leading AI-SPM security vendors to demonstrate their AI-related tools. Below are more details about each of the 14 we had the opportunity to preview. We have also summarized each vendor’s offerings in the features table, which also provides links, when available, to pricing and third-party integration details. Several vendors didn’t respond to our inquiries, including Baffle.io, Invicti, SecurityCompass, Tonic Security, and Zscaler.

Vendor	Product/URL	Entry-level pricing	Packaging	Integrations link	App runtime security	Continuous scanning?	MCP/Agent protection?	AI Red Teaming?
Arthur.ai	Arthur Platform	Free and paid versions	Single product	Deep PaaS coverage	Yes	Yes	Yes	No
Cato Networks	AI Security for End Users		SASE platform	Numerous	Yes	Yes	Yes	No
Concentric	No specific AI-SPM product	AWS $50,000/yr, varies	Part of its DSPM platform	Numerous	No	Yes	No	Yes
CrowdStrike	No specific AI-SPM product		Part of Falcon AI platform	Numerous	Yes	Yes	Yes	Separate service
Cyera	AI Guardian	AWS $50,000/yr	Sold in two bundles, see description	Numerous	Yes	Yes	Yes	No
Guardrail Technologies	Traffic Light for Code and AI	Free and monthly plans	Also sell AI Command Center	Some	Yes	Yes	No	No
Microsoft	Purview	$12.60/user/mo	Part of larger CSPM platform	Some	Yes	No	Yes	No
OneTrust	AI Governance	Subscriptions	Single product with SPM features	Some	Yes	Yes	No	No
Orca Security	AI-SPM	AWS $84,000/yr	Has other AI security tools	Numerous	Yes	Yes	Yes	No
Palo Alto Networks	Prisma AI Security		Sold in two bundles, see description	Numerous	Yes	Yes	Yes	Yes
Proofpoint	AI Access Security	AWS $96,000/yr	People Protection Platform	Numerous	Yes	Yes	Yes	No
SentinelOne	No specific AI SPM product	$80/yr/endpoint	Part of larger Singularity platform	Numerous	Yes	Yes	Yes	Yes
Varonis	Atlas	AWS $108,000/yr	Bundled with AI Inventory	Hundreds	Yes	Yes	Yes	Yes
Wiz/Google	AI App Protection Platform	AWS $38,000/yr	Variety of bundles available	Numerous	Yes	Yes	Yes	No

Arthur.ai

Arthur.ai’s platform is a single product that offers deep PaaS coverage with both AWS and Google Cloud Platform, although unlike other AI-SPMs it doesn’t offer a wide range of third-party integrations. It includes application runtime security protection. It also scans network traffic continuously and watches for agent activity, along with policy guardrails to protect against prompt injection and sensitive data leakage. It includes behavioral analytics and governance that catch abusive agentic activities. There are free and paid versions starting at $10,000 annual plans for smaller networks.

Cato Networks AI Security for End Users

Cato Networks AI Security for End Users is one of three separate AI security packages that work together with Cato’s SASE platform, the other two being protection for applications (both runtime and across the software development lifecycle) and for real-time agentic operations. The three AI packages are meant to be purchased together to provide audit trails showing what users are doing with their AI tools and to help understand and illustrate the risks. Cato’s tools can also prevent prompt injection and data leaks and find compliance blind spots. Its platform has a wide collection of third-party integrations, including CrowdStrike, Microsoft, and Splunk SIEMs, and various data sources such as Google’s Chronicle and Rapid7. Cato Networks did not reveal pricing.

Concentric AI and Data Security Governance

Concentric sells a DSPM platform labelled “AI and Data Security Governance.” There is no specific AI tool, although AI pervades its product in a variety of places, including scanning various models for prompt injection, automated remediation, and the discovery and classification of data flows. It offers a wide collection of third-party integrations. On the AWS Marketplace, it sells an entry-level version for $50,000 per year that covers up to 25TB of data, with higher fees for larger data collections.

CrowdStrike Falcon AI-SPM

CrowdStrike Falcon AI-SPM is not a separate product, but part of the overall Falcon Cloud security platform. It can correlate risk findings with other security services monitored by the full Falcon platform. It includes discovery of AI services and models across a variety of cloud platforms, including containers and virtual images, and can detect misconfigurations and dependencies with other software. It scans OpenAI, Amazon Bedrock, Amazon SageMaker, and Vertex AI models. Falcon has more than 250 integrations available to a wide collection of third-party security tools. You can request a free 15-day trial, but no further pricing information was disclosed.

Cyera AI Guardian

Cyera.io specializes in data file level classification. It packages its AI-SPM product in two separate bundles: either with its flagship DSPM product that has added what you might think of as AI-enriched data link protection as part of the default product’s features, or with a more complete set of security features called AI Guardian. Cyera also offers a specialized add-on module used for Microsoft Copilot data scanning that can detect data used by insiders, for example. Cyera’s AWS Marketplace pricing can be found here and starts at $50,000 per year.

Guardrail Technologies Traffic Light for Code and AI

Guardrail Technologies Traffic Light for Code and AI is designed to be a simple way to flag potential AI abuse by scanning AI-generated code and returning a red/yellow/green result to indicate potential for compromise. There is no remediation, but the tool integrates across the major AI vendors, including Anthropic, Azure Open AI, Hugging Face, and AWS Bedrock, and general security tools such as Wiz and Snyk. Guardrail has a custom AI security consulting business as well called AI Guardian. Very transparent pricing page and a 60-day free trial is available.

Microsoft Purview

Microsoft has bundled its various security posture tools into its Purview offering, which includes a series of AI-based Copilot apps, data SPM and classification tools, and data loss prevention extensions tuned to its various SaaS platforms such as 365, Azure, and Windows endpoints. This extends the AI security features that were originally part of its Defender for Cloud offerings. It has a limited number of third-party integrations. One-month free trials are available, and the entire suite is available for $12.60 per month per user. Microsoft has stepped up its involvement with AI with its Scout, a collection of autonomous AI agents built on top of OpenClaw. It is designed to work with its applications, using built-in security and privacy controls.

OneTrust AI Governance

OneTrust offers AI Governance, a platform that automates compliance and provides continuous monitoring of the AI landscape, across the software lifecycle starting with any AI usage at the beginning of any build. It can detect policy violations, and which AI agents are running. It offers a series of third-party integrations such as Amazon’s Bedrock and Sagemaker; Azure Foundry, ML Studio, and OpenAI; Databricks Unity Catalog and ML flow; and Google Vertex. Its subscription price is based on the number of admin users and number of AI inventory records, although no specifics were provided.

Orca AI-SPM

Orca Security’s AI-SPM is tightly integrated into the company’s security platform. It continues to expand its features, offering detections of more than 50 AI models, including training data and runtime threats, remediation, and support for Model Context Protocol to connect to other Orca-based telemetry. It continues to expand its nearly 100 integrations across SIEM and SOAR systems and various cloud providers’ services. For example, it works with AWS S3, SQS, SNS, CodeBuild, CloudTrail, and Security Hub. It comes with dozens of best-practice security rules that initially focused on compliance. It also alerts when sensitive data is detected inside models and when secrets are exposed. Orca’s overall security platform shows an AWS Marketplace annual pricing that ranges from $84,000 to $360,000, depending on the number of workloads scanned.

Palo Alto Networks AIRS AI Security

Palo Alto Networks has been busy acquiring point security vendors (Dig, ProtectAI, and an offer on Portkey) and incorporating their code into its two major product lines, Prisma and Cortex. You can purchase AI-SPM functionality in either Palo Alto product line, but they cover different aspects of the AI ecosystem. Cortex offers AI-SPM alongside the data and cloud SPMs integrated into the CNAPP suite. Prisma offers AI-SPM as part of a total AI security package called AIRS AI Security, which includes runtime protection, model scanning, and a more comprehensive platform. We focus on AIRS AI, which supports top-level scans of Amazon, Google Cloud, and Azure AI services to discover AI content and can classify and examine model data and secrets and comes with many built-in AI-related policies. Prisma has a long list of third-party integrations, including significant depth in AWS security services. That link will also take you to detailed instructions on how to set up these integrations. To complicate matters further, Palo Alto also sells a separate Prisma secure browser extension that works with these products to protect your endpoints, and that originated from technology it purchased from Talon Cyber Security in 2023. While pricing was not disclosed, our estimate is that AIRS will cost in the low six figures annually.

Proofpoint People Protection Platform

Proofpoint includes a general AI security product as part of its People Protection Platform that covers a wide range of protective services integrated across its other non-AI security tools. It provides runtime inspection of potential AI misconfigurations, as well as policies that include detection of agent, tools, and MCP connections, and it can generate forensic audits of AI interactions. Proofpoint’s general security platform starts at $96,000 annually on AWS Marketplace. It has several integrations with third-party services across the major cloud platform providers.

SentinelOne Singularity Platform

SentinelOne’s Singularity platform offers several AI protective features, including misconfiguration detection, attack path analysis, automated AI inventory and remediation, and integration with a variety of AI PaaS platforms such as Azure OpenAI, Google’s Vertex AI, and various AWS services. It is bundled within the company’s Cloud Native Security tool. Some of these features originated with Singularity’s purchase of Prompt.Security. Access to all the features requires purchasing the enterprise edition, which is offered with custom pricing, but lower feature tiers are available for $80 per year on this public pricing page. There are also numerous integrations with its Marketplace.

Varonis Atlas AI Security

Varonis Atlas AI Security is a multipurpose security platform that offers a variety of modules, including red team/penetration testing, compliance, and third-party risk management. Its AI-SPM module is combined with an AI inventory scanner and can be used to help development teams classify data used in the AI ecosystem, such as scanning for bad AI behavior, leveraging identities improperly, and examining data flows. Automated remediation processes are built into the tool as well. There are several hundred third-party integrations available for a wide collection of security tools, such as JFrog, Jira, Okta, and Salesforce. Varonis has two pricing components; one based on per user and per protected application and an additional price for resource consumption. Atlas is sold on the AWS Marketplace starting at $108,000 per year and free risk assessments are available to qualified customers.

Wiz/Google AI Application Protection Platform

Google has acquired Wiz but kept its operation independent. It has a multipurpose security platform that comes from a strong posture management (cloud and data) background. Its advanced version has been augmented with a comprehensive AI-related series of policies, detection algorithms, and pipeline, model, and data scanners. These are assembled into a separate AI dashboard page. It can also detect AI pipeline abuses, protect AI runtimes, identify and classify tools and agents, map dependencies graphically and suggest remediation steps. It also contains core AI-SPM features such as discovery, attack path analysis, and supply chains. Pricing for the Wiz Advanced bundle on AWS Marketplace is $38,000 annually.

What about AI-SPM pricing?

Pricing and packaging of AI-SPM tools vary widely. Many vendors offer free trials limited to differing periods (an option that is also available on the AWS Marketplace). We pointed out the open-source alternatives earlier, which is also a good way to see how the products work, but we wouldn’t recommend relying on these tools given their lack of recent updates. The only vendors that have (mostly) transparent pricing are Guardrail Technologies (with both free and monthly plans) and SentinelOne (with various annual plans starting at $80 per endpoint). Most of the vendors didn’t want to provide pricing directly but have published pricing on the AWS Marketplace, which can give you a rough indication that most start in the low six figures for annual contracts. For a typical situation with 1,000 users the total could be in the low six-figure range annually.

Der Amazon Prime Day ist gestartet – diese Tagesangebote lohnen sich

Tue, 23 Jun 2026 08:32:58 +0200

Seit heute Mitternacht läuft bei Amazon der Amazon Prime Day 2026. Prime-Mitglieder haben jetzt vier Tage lang Zeit, von Bestpreisen für bekannte Markenprodukte zu profitieren. Der Prime Day endet am Freitag, den 26. Juni.

Die besten Tagesangebote am Amazon Prime Day

Rabatte gelten ausschließlich für Prime-Mitglieder

Nur wer eine Amazon-Prime-Mitgliedschaft hat, kann auf die Tiefstpreise am Prime Day zugreifen. Aktuell kostet eine Prime-Mitgliedschaft 8,99 Euro pro Monat. Man kann die Kosten aber umgehen, indem man einen Gratis-Probemonat abschließt und dann rechtzeitig wieder kündigt: Prime-Abo jetzt kostenlos testen.

Die besten Angebote am 23. Juni

Unsere Redaktion empfielt täglich die besten Deals aus den Bereichen Computer, IT, Smartphones, Smart Home und Digital Lifestyle. Am ersten Prime-Day-Tag gibt es Jahresbestpreise für viele Apple-Produkte wie dem Macbook Neo oder dem iPad Air.

Amazon-eigene Geräte wie der smarte Echo-Lautsprecher oder der Fire TV-Stick sind heute bis zu 65 Prozent günstiger. Außerdem sind Laptops, Tablets und Zubehör im Angebot. Bei folgenden Angeboten sollten Sie schnell sein, bevor sie vergriffen sind:

📺 TVs, Streaming & Heimkino

Samsung Crystal UHD 4K TV 98 Zoll für 1.279 Euro
LG OLED TV 65 Zoll für 1.424 Euro
Xiaomi TV 65 Zoll für 369 Euro
Samsung Crystal TV 4K 43 Zoll für 245 Euro
Xiaomi TV F Pro 32 Zoll für 149 Euro
Epson 4K-PRO-UHD-Projektor für 1.180 Euro
Hisense 3.1 Kanal Soundbar für 114 Euro
Amazon Fire TV Cube für 109,99 Euro
Amazon Fire TV Stick 4K Max für 46,99 Euro
Amazon Fire TV Stick HD für 19,99 Euro

💻 Laptops, Tablets & Computer

📱 Smartphones, Smartwatches & Wearables

Google Pixel 10 Pro für 699 Euro
Google Pixel 10a für 449 Euro
Apple Watch Series 11 für 369 Euro
HUAWEI Watch D2 für 303 Euro
Sony kabellose NC-Kopfhörer für 349 Euro
Google Pixel Buds Pro 2 für 172 Euro

🎮 Gaming & VR

Meta Quest 3 512 GB für 527 Euro
Logitech G Astro A50 Gaming-Headset für 194,99 Euro
Intel Core Ultra 9 Desktop-Prozessor für 469 Euro

☕ Küche, Kaffee & Haushaltsgeräte

Kaffee

Philips Espresso Kaffeevollautomat für 424 Euro
De’Longhi Siebträgermaschine für 349,90 Euro
Ninja Luxe Premier Kaffeemaschine für 394,99 Euro

Küche

Ninja CREAMi Eismaschine für 299,98 Euro
Ninja CREAMi Deluxe Eismaschine für 199,98 Euro
Philips 7000 PastaMaker für 169 Euro
Tefal Jamie Oliver Pfannenset für 79,79 Euro

Heißluftfritteusen

Ninja MAX Dual Zone Heißluftfritteuse für 149 Euro
Ninja Heißluftfritteuse MAX PRO für 89,99 Euro

🏠 Smart Home & Amazon Geräte

Echo Dot für 29,99 Euro
Echo Dot Max für 64,99 Euro
Echo Spot für 49,99 Euro
Ring Innenkamera für 24,99 Euro
Philips Hue LED Lampen 3er Pack für 99,97 Euro
TP-Link Gigabit Netzwerk Switch für 13,99 Euro

🤖 Saugroboter & Staubsauger

ECOVACS DEEBOT T90 für 599 Euro
dreame L40 Ultra für 449 Euro
MOVA E50 Pro Ultra für 429 Euro
dreame H12 Nass- und Trockensauger für 178,99 Euro
Dyson V8 kabelloser Staubsauger für 279 Euro

🌡️ Klima, Luft & Wohnkomfort

Comfee Mobiles Klimagerät für 190,99 Euro
Levoit Standventilator für 109,98 Euro
Levoit Luftreiniger für 119,98 Euro

🌳 Garten & Outdoor

MOVA LiDAX 1200 Mähroboter für 894 Euro
Einhell Akku-Sense Rasenmäher für 141,99 Euro
Einhell City Akku-Rasenmäher für 99,99 Euro
Bosch Professional Akku Bohrhammer für 174,99 Euro

🛴 E-Mobility & Drohnen

Segway-Ninebot MAX G2 D E-Scooter für 569 Euro
Xiaomi E-Scooter 4 Lite für 379,99 Euro
DJI Mini 5 Pro Fly Drohne für 949 Euro

🖨️ Büro & Drucker

HP Color Laser MF-Drucker für 219,99 Euro

💾 Speicher & Datenträger

SanDisk Extreme PRO SSD 4 TB
Seagate Portable Drive SSD 5TB für 140 Euro

🔋 Sonstiges

AA-Alkali-Hochleistungsbatterien für 19,56 Euro
PHILIPS OneBlade elektrischer Rasierer für 34,99 Euro

Attraktive Preise auch für Amazon-Kunden ohne Prime

Auch für Amazon-Kunden ohne Prime-Abo gibt es derzeit einige Highlight-Angebote mit Jahresbestpreisen:

Viele weitere Deals finden Sie auf unserer Deals-Seite.

Empfehlung: Die besten Apple-Angebote zum Prime Day 2026

Was ist der Amazon Prime Day?

Der Amazon Prime Day ist eine jährlich stattfindende Rabattaktion von Amazon, die sich exklusiv an Prime-Mitglieder richtet. Während dieses Zeitraums bietet Amazon stark reduzierte Preise auf eine große Bandbreite von Produkten – von Technik über Haushaltswaren bis hin zu Kleidung. Andere Shops bieten den Prime Day nicht an.

Der Prime Day gehört zu den wichtigsten Online-Shopping-Events des Jahres. Vor allem für Amazon zahlt es sich aus: Jahr für Jahr werden neue Umsatzrekorde gebrochen. Wohl auch deshalb wurde die Dauer von 2 auf inzwischen 4 Tage verlängert. Waren es 2019 noch ca. 5 Milliarden US-Dollar Amazon-Einnahmen weltweit, so schätzt man den Prime Day von 2025 auf ca. 15,3 Milliarden US-Dollar.

So verpassen Sie keine Angebote am Prime Day

In diesem Beitrag werden wir regelmäßig über die besten Angebote während des Prime Day aus den Bereichen Technik, IT, Smartphones, Home Entertainment und Smart Home informieren. Sie können sich den Artikel als Favorit bookmarken, um ihn jederzeit aufrufen zu können.

Kostenloses Prime-Testabo abschließen

Wer noch kein Amazon-Prime-Kunde ist, für den lohnt es sich, jetzt einen kostenlosen Testmonat auszuprobieren. Denn so kann man ab sofort die exklusiven Prime-Preise erhalten. Wer rechtzeitig kündigt vor Ablauf des Testzeitraums, der zahlt noch nicht mal für das Prime-Abo.

Prime-Abo kostenlos testen

Angebotsseite bei Amazon checken

Sogenannte Blitzdeals sind nur für kurze Zeit und solange der Vorrat reicht, verfügbar. Deshalb lohnt es sich, regelmäßig die spezielle Amazon-Unterseite des Events zu besuchen:

Die besten Tagesangebote bei Amazon

Blitzangebote bei Amazon – nur kurz verfügbar

Rufus – Amazons KI-Einkaufsassistent

Sie können „Rufus“ aktivieren – Amazons KI-gestützten Einkaufsassistenten, der für Sie persönlich die besten Deals findet.
Mehr Infos zu Rufus: How to use Rufus to check price history, find deals, auto-buy items

Artikel auf persönliche Merkliste setzen

Suchen Sie nach Wunschartikeln, die Sie beobachten wollen. Am besten setzen Sie das jeweilige Produkt auf Ihre Merkliste (Button „Auf die Liste“ unterhalb der Preisangabe drücken). So haben Sie Ihre Produkte während des Prime Day besser im Blick und sehen auf Anhieb, falls der Preis gesenkt werden sollte.

Personalisierte Empfehlungen ansehen

Amazon stellt personalisierte Angebote bereit, die sich am individuellen Kundenverhalten orientieren. Filtern Sie dazu auf der Angebotsseite nach „Für dich“.

Zur Angebotsseite

Bestseller-Liste

Es empfiehlt sich, immer mal die Amazon Bestseller-Liste zu durchforsten. Hier werden die meistgekauften Artikel gezeigt. Das Ranking wird regelmäßig angepasst und bildet die tagesaktuelle Nachfrage nach Produkten ab. Spannend ist auch die Amazon-Kategorie „Aufsteiger des Tages“. Interessante Produkte am besten gleich auf die Merkliste setzen.

Mit PC-Welt keine Angebote verpassen

Abonnieren Sie unseren Schnäppchen-Newsletter. Alle empfehlenswerten Prime Day Angebote aus den Bereichen IT, Tech, Digital Lifestyle und Smarthome finden Sie kurz vor Start des Prime Day in unserer Webseiten-Rubrik zum Prime Day:

Die besten Deals am Prime Day – ausgewählt von der PC-Welt Redaktion

Empfehlung: Die besten Apple-Angebote am Prime Day 2026

Weitere Beiträge:

CVE-2026-54298 | withastro up to 6.4.5 spreadAttributes cross site scripting (EUVD-2026-38336)

Tue, 23 Jun 2026 04:38:45 +0200

A vulnerability was found in withastro astro up to 6.4.5. It has been classified as problematic. This issue affects the function spreadAttributes. Performing a manipulation results in cross site scripting. This vulnerability was named CVE-2026-54298. The attack may be initiated remotely. There is no available exploit. Upgrading the affected component is recommended.

CVE-2026-54299 | withastro up to 6.4.5 Host Header request.url input validation (EUVD-2026-38337)

Tue, 23 Jun 2026 03:25:11 +0200

A vulnerability classified as problematic has been found in withastro astro up to 6.4.5. This impacts the function request.url of the component Host Header Handler. Performing a manipulation results in improper input validation. This vulnerability is reported as CVE-2026-54299. The attack is possible to be carried out remotely. No exploit exists. It is recommended to upgrade the affected component.

Expanding Our Footprint: Local Cloud Availability for Prisma AIRS in Japan

Fri, 19 Jun 2026 10:37:14 +0200

Securing the Future of Japan’s AI Landscape The shift from static LLMs to autonomous agents has fundamentally changed the global threat surface. Frontier models like Anthropic’s Mythos can now autonomously discover hundreds … The post Expanding Our Footprint: Local Cloud…

The post Expanding Our Footprint: Local Cloud Availability for Prisma AIRS in Japan appeared first on IT Security News.

Security-Tools für KI-Infrastrukturen – ein Kaufratgeber

Fri, 19 Jun 2026 05:20:14 +0200

Tools, die die KI-Infrastruktur unter die Lupe nehmen, optimieren und absichern, liegen im Trend. Unser Ratgeber führt Sie zur richtigen AI-Security-Posture-Management-Lösung.

Julien Tromeur | shutterstock.com

Weil sich Generative-AI-Lösungen branchenübergreifend verbreiten, wächst das Sicherheitsbedürfnis der Anwender. Diesem gerecht zu werden, ist vor allem deshalb eine Challenge, weil die Technologie enormen Einfluss auf die IT-Infrastruktur und die Unternehmensdaten nimmt. Und weil kriminelle Cyberakteure längst erkannt haben, welches Potenzial für sie in diesem Umstand schlummert.

Gefragt sind deshalb neue, breit gefächerte Schutz- und Notfallmaßnahmen sowie Sicherheitssoftware, die spezifisch darauf ausgelegt ist, KI-Infrastrukturen abzusichern. Das hat längst diverse Cybersecurity-Anbieter dazu bewogen, entsprechende Lösungen zu entwickeln. Oder bestehende Produkte mit entsprechenden Features anzureichern. Dieses Wachstumssegment des Security-Markts läuft auch unter der Bezeichnung “AI Security Posture Management” – kurz AI-SPM.

In diesem Artikel erfahren Sie:

was Security-Lösungen ausmacht, die KI-Infrastrukturen absichern.
was AI-SPM-Tools leisten sollten und
welche Anbieter und Produkte in diesem Bereich wichtig sind.

CSPM, DSPM und AI-SPM

AI Security Posture Management fokussiert darauf, die Integrität und Sicherheit von KI- und ML-Systemen zu gewährleisten. Dabei umfasst AI-SPM Strategien, Tools und Techniken, um Daten, Pipelines, Applikationen und Services mit Blick auf ihre Sicherheitslage:

zu überwachen,
zu bewerten und
zu optimieren.

Bisher wurden Security Posture Management Tools für zwei separate Bereiche entwickelt:

Cloud Security Posture Management (CSPM-) Tools sollen den Cloud-Betrieb allgemein absichern, in erster Linie gegen Fehlkonfigurationen und Missbrauch.
Data Security Posture Management (DSPM-) Tools sollen vor Datenlecks und Malware-Infektionen schützen.

Das Aufkommen von künstlicher Intelligenz (KI) und Large Language Models (LLMs) hat Bedarf für eine dritte Produktkategorie geschaffen, die gemanagte KI-Cloud-Services und ihre SDKs (beispielsweise Hugging Face Transformer oder Azure Open AI) überwacht und KI-Modellmissbrauch verhindert – AI-SPM.

Dass das nötig war, unterstreichen diverse Research-Erkenntnisse, -Beiträge und weitere Ressourcen:

Eine Studie des API-Spezialisten Kong (Download gegen Daten) kommt zu dem Ergebnis, dass eine Mehrheit der Befragten Wege gefunden hat, Beschränkungen mit Blick auf die KI-Nutzung zu umgehen. Ein Viertel muss sich erst gar nicht mit so etwas wie Guidelines herumschlagen.
Die Non-Profit-Organisation MITRE stellt mit seiner Adversarial Threat Landscape for Artificial Intelligence Systems (ATLAS) eine umfassende Datenbank mit Angriffstaktiken zur Verfügung, die auf “in the wild”-Beobachtungen beruht.
Auch das MIT betreibt eine aktive Datenbank, die mehr als 1.700 Risiken in Zusammenhang mit KI-Systemen bereithält.
Eine weitere Quelle, um sich mit KI-bezogenen Angriffsmethoden auseinanderzusetzen, bietet das 2023 von OWASP veröffentlichte LLM-Exploit-Ranking (PDF). Die Non-Profit-Organisation hat zudem eine Checkliste für GenAI-Sicherheit veröffentlicht.

Sich mit diesen Quellen auseinanderzusetzen, empfiehlt sich, bevor Sie sich für ein Sicherheits-Tool oder -Feature aus dem Bereich AI-SPM entscheiden.

Was Security Posture Management für KI leisten sollte

Tools im Bereich AI Security Posture Management:

bieten im Regelfall agentenlose Konfigurationen,
greifen auf Cloud-basierte Modelle zu und
belassen Daten auf den vorhandenen Plattformen.

Letzteres dient sowohl der Sicherheit als auch dazu, die Verlagerung der damit verbundenen, massiven Datenbestände zu vermeiden. Darüber hinaus spielen bei Security-Tools für KI-Infrastrukturen natürlich auch KI-bezogene Funktionen eine Rolle. Zum Beispiel um große Datenmengen zu klassifizieren, zu tracken und gegen mögliche Missbrauchs- und Angriffsversuche abzusichern.

Einige Anbieter haben ihre bestehenden CSPM- oder DSPM-Lösungen um AI-SPM-Features erweitert – inklusive Compliance-Prüfverfahren, Best Practices und Richtlinien, die alle drei Security-Posture-Management-Arten abdecken. Andere offerieren umfassendere Lösungen, die eine Vielzahl KI-bezogener Sicherheitsmaßnahmen beinhalten. Zum Beispiel, um:

KI-Pipelines und Workloads schützen,
zu erkennen, wenn KI-Modelle sensible Daten referenzieren,
Trainingsdaten auf Manipulationen durch Dritte oder externe Applikationen zu überprüfen, und
KI-Services und -Plattformen abzusichern.

Wichtige AI-SPM-Anbieter

Im Folgenden haben wir die AI-SPM-Produkte und -Features neun verschiedener Anbieter für Sie zusammengefasst. Sämtliche Lösungen versprechen, Ihre KI-Infrastruktur abzusichern, verlassen sich dazu jedoch auf unterschiedliche Ansätze. Dabei ist zu beachten, dass es sich um einen Markt handelt, der im Wachstum begriffen ist. Die Produkte sind also noch nicht so umfassend ausgestaltet und integriert, wie sie sein könnten. Zudem arbeiten diverse weitere Sicherheitsanbieter aktiv an ähnlichen Offerings.

Cyera.io ist auf Datenklassifizierung spezialisiert und hat eine DSPM-Plattform im Angebot, die um AI-SPM-Features erweitert wird. Die Lösung verspricht beispielsweise Einblicke, auf welche Datenklassen und Data Stores Microsoft-Copilot-Nutzer zugreifen können.
LegitSecurity hat sich auf die Fahnen geschrieben, das “AI Visibility Gap” schließen zu wollen. Dazu untersucht die AI-SPM-Plattform KI-Modelle, Code Repositories, kryptografische Secrets und andere KI-bezogene Instanzen. Auf dieser Grundlage entstehen schließlich Risk Scores, um entsprechend priorisieren zu können. Mit dieser Lösung können Sie beispielsweise nachvollziehen, welche User Github Copilot auf der Basis von unsicheren KI-Modellen verwenden.
Microsoft stellt AI-Security-Posture-Management-Funktionen im Rahmen einer Preview für sein CSPM-Angebot zur Verfügung. Das fertige Produkt soll Ende 2024 zur Verfügung stehen und zum Einsatz kommen, um GenAI-Applikationen in Multi- oder Hybrid-Cloud-Szenarien abzusichern. Dazu wird zum Beispiel eine GenAI-Softwarestückliste (AI BOM) erfasst.
Orca Security verspricht mit seiner Mehrzweck-Sicherheitsplattform unter anderem eine “Ende-zu-Ende”-AI-SPM-Lösung. Diese scannt unter anderem mehr als 50 verschiedene KI-Modellquellen und schlägt Alarm, wenn sie dort – oder in Trainingsdaten-Repositories – sensible Informationen oder Geheimnisse entdeckt.
Palo Alto Networks hat Ende 2023 die Übernahme des DSPM-Spezialisten Dig Security abgeschlossen und diesen inzwischen vollständig integriert. Das Ergebnis heißt Prisma Cloud AI-SPM und ermöglicht zum Beispiel Top-Level-Scans der KI-Services von AWS, Google Cloud und Azure. Zudem hat der Sicherheitsanbieter Mitte 2025 auch den KI-Sicherheitsanbieter Protect AI übernommen.
Securiti.ai verspricht mit seinem Produkt “AI Security & Governance” Schutz für KI-Instanzen. Dieses ermöglicht zum Beispiel KI-Modellrisiken zu bewerten und zu klassifizieren, Compliance-Prüfungen vorzunehmen oder Kontrollmaßnahmen für Daten und KI-Systeme zu etablieren.
Varonis hat seine Sicherheitsplattform ebenfalls um “AI Security” erweitert. Das ermöglicht unter anderem, risikobehaftete KI-Fehlkonfigurationen zu erkennen und zu beheben, KI-generierte Inhalte mit Sensibilitäts-Labels zu versehen sowie KI-Workloads oder Datenflüsse zu erkennen, die sensible Informationen beinhalten. Für Microsoft Copilot steht ein eigenes (aufpreispflichtiges) Modul zur Verfügung – demnächst sollen weitere für Salesforce Einstein und Google Gemini folgen.
Wiz Security verfügt über einschlägige DSPM- und CSPM-Erfahrungswerte und hat auch eine dedizierte KI-SPM-Lösung im Angebot. Diese verspricht zum Beispiel umfassende Einblicke in KI-Pipelines sowie Detektions-Möglichkeiten für Angriffspfade oder Fehlkonfigurationen.

Dieser Artikel ist im Original bei unserer Schwesterpublikation CSOonline.com erschienen.

astro.config.mjs Supply Chain Attack via Blockchain C2

Thu, 18 Jun 2026 12:48:58 +0200

2026-06-12 • SafeDep • SafeDep • js.jadesnow
Open article on Malpedia

Twistlock: Prisma Cloud Container Security Overview and Analysis for 2026

Thu, 18 Jun 2026 00:20:32 +0200

Prisma Cloud delivers container security, compliance, and runtime protection for cloud-native environments in 2026. The post Twistlock: Prisma Cloud Container Security Overview and Analysis for 2026 appeared first on eSecurity Planet. This article has been indexed from eSecurity Planet Read…

The post Twistlock: Prisma Cloud Container Security Overview and Analysis for 2026 appeared first on IT Security News.

Twistlock: Prisma Cloud Container Security Overview and Analysis for 2026

Wed, 17 Jun 2026 23:53:11 +0200

Prisma Cloud delivers container security, compliance, and runtime protection for cloud-native environments in 2026.

The post Twistlock: Prisma Cloud Container Security Overview and Analysis for 2026 appeared first on eSecurity Planet.

Web Development Tools – 8 innovative Optionen

Tue, 16 Jun 2026 06:05:10 +0200

Neue Wege in Sachen Web Development beschreiten? Mit diesen acht Tools klappt das bestens.

dotshock | shutterstock.com

In der Webentwicklung gibt es keinen vorgegebenen Weg. In einer Sache sind sich jedoch alle einig: Es ist höchste Zeit für ein „Great Unbloating“: Das Web Development muss von schwerfälliger Komplexität befreit werden. Wie das funktionieren kann, zeigen die acht Tools, die wir Ihnen in diesem Beitrag vorstellen.

Diese zeichnet aus, dass sie sich (größtenteils) mit alternativen Ansätzen befassen, die das Bewährte in Frage stellen. Auch wenn Sie die hier vorgestellten Lösungen nicht direkt für Ihre Zwecke einsetzen können, lohnt es sich also dennoch, sie im Auge zu behalten.

1. Astro

Wenn man eine Gruppe klassischer Musiker mit Noten in einen Raum setzt und sie einfach spielen lässt, könnte das Ergebnis ein stimmiges Stück sein. Wahrscheinlich braucht es aber einen Dirigenten, der alles koordiniert. In Zusammenhang mit Frontend-Frameworks ist Astro genau das – ein Maestro.

Astro kümmert sich um die „Hydration“ des Frontends, also den Prozess, die Shell reaktiv zu machen. Beim konventionellen Server-Side Rendering (SSR) sendet der Server nicht nur den HTML-Code, sondern auch die riesige Framework-Runtime über das Netzwerk – nur um der Seite Event-Listener hinzuzufügen. Mit Astro ist es möglich, Komponenten in React, Svelte, Vue oder Solid zu schreiben – der Compiler des Tools entfernt dabei das gesamte JavaScript, bevor es den Browser erreicht. Astro liefert standardmäßig Zero JS aus und verlässt sich auf seine „Island Architecture“, um nur die spezifischen Komponenten zu hydrieren, die Interaktivität erfordern.

Da Astro die Interaktivität in separaten „Inseln“ isoliert, ist es im Vergleich zu einer monolithischen Single-Page-Anwendung grundsätzlich schwieriger, komplexe States (etwa eine komplexe Seitenleiste mit Filterfunktion, die mit einem separaten dynamischen Data Grid kommuniziert) zwischen diesen Inseln zu teilen. Wenn Sie eine hochgradig interaktive, Dashboard-lastige Applikation entwickeln, in der jede Komponente die andere beeinflusst, könnten sich die isolierten Inseln eher nach Zwangsjacke als nach Befreiung anfühlen.

Auch interessant: Qwik. Während Astro verschlankt, indem es den JavaScript-Code vollständig entfernt, setzt Qwik auf Verzögerung: Es liefert sofort HTML und serialisiert den Anwendungsstatus. Dabei wird nur der für eine bestimmte Interaktion erforderliche JavaScript-Code genau in der Millisekunde heruntergeladen und ausgeführt, in der der User auf die entsprechende Schaltfläche klickt.

2. Biome

Rust ersetzt nach und nach die zugrundeliegende Infrastruktur im JavaScript-Ökosystem. Das verleiht dem Biome-Tool seine Hardware-ähnliche Geschwindigkeit. Das Alleinstellungsmerkmal dieses Dev-Werkzeugs ist es allerdings, die weitläufige Webentwicklungs-Toolchain zu vereinheitlichen.

Wenn die .eslintrc– und .prettierrc-Dateien sowie die Dutzenden zugehörigen Plugins in Ihrem Projekt bereits zu einem dunklen, unzufriedenstellenden Sumpf verkommen sind, ist Biome der Ausweg: Das Tool besteht aus einer einzelnen Binary, die komplett verworrene Foramtierungs- und Linting-Ökosysteme substituiert – und damit einen Weg zu Codequalität eröffnet, der ganz ohne ein weit verzweigtes Netz von Abhängigkeiten auskommt.

Der wohl größte Nachteil von Biome ist dabei gleichzeitig auch das Feature, das das Tool so schlank macht: Die Erweiterbarkeit geht verloren.

Auch interessant: Rspack. Biome bereinigt das Linting, Rspack entschlackt den Build-Schritt. Auch dieses Tool basiert auf Rust für mehr Geschwindigkeit. Dabei nutzt es – etwa im Gegensatz zu Vite – den „bundled“ Dev-Modus.

3. Bun

Die meisten gut informierten JavaScript-Enthusiasten dürften längst mit Bun vertraut sein. Wenn Sie die faszinierende Kombination aus All-in-One-Lösung und atemberaubender Geschwindigkeit noch nicht selbst erlebt haben, wird es Zeit.

Wenn Sie an Node gewöhnt sind und Bun ausprobieren, werden Sie sehr wahrscheinlich sofort davon beeindruckt sein, wie schnell Befehle ausgeführt werden. Das Bun-Team hat zudem über mehrere Jahre hinweg umfangreiche Anstrengungen unternommen, um seine Engine eng an die APIs von Node anzupassen. Das macht Bun zu einer außergewöhnlichen technischen Errungenschaft, die jeder JavaScript-Entwickler zumindest explorieren sollte.

Obwohl Buns Zig-basierte Engine in vielerlei Hinsicht ein direkter Ersatz für Node ist: Sie ist nicht perfekt – insbesondere angesichts der gigantischen Anzahl von Node-Packages, die existieren. Deshalb bleibt Node auch die beste bewährte, konservative, Engine für serverseitiges JavaScript.

Auch interessant: Deno. Bun hat sich zwar zu Recht einen Ruf als innovatives Tool erarbeitet – allerdings wurde Deno still und leise um eine Reihe attraktiver Enterprise-Funktionen ergänzt – etwa eine integrierte Bereitstellungsplattform und das Frontend-Framework Deno Fresh.

4. HTMX

Wenn es um smarte Wege geht, das Web zu vereinfachen, könnte man HTMX durchaus als Paradebeispiel anführen. Das Projekt greift die Kernmechanismen moderner Web-Clients wie Ajax sowie partielle Aktualisierungen auf und wandelt diese in einfache HTML-Attribute um. Das hat zur Folge, dass der State ausschließlich auf dem Server gespeichert wird, der dafür zuständig ist, die HTMX-Fragmente zu senden.

Natürlich läuft das nicht ohne Kompromisse ab. Einer ist die extreme Abhängigkeit vom Netzwerk: Da es keine Client-seitige State Machine gibt, ist der Browser ohne Verbindung zum Server hilflos. Es sei denn, Sie wagen sich an Experimente mit einem „local-first“-Data Store. Kurz gesagt: Wenn Ihre App in den Anwendungsbereich von HTMX fällt, ist HTMX wahrscheinlich der direkteste „RESTful-Weg“, um diese zu erstellen.

Auch interessant: Hotwire. Als Tool-Sammlung, um Single-Page-Anwendungen unter Verwendung von HTML über das Netzwerk zu erstellen, verfügt Hotwire über großartige Funktionen wie Page Morphing. Getreu der klassischen „Free as in Speech“-Softwarekultur werden Ideen zwischen den Projektverantwortlichen von HTMX und Hotwire ausgetauscht.

5. PowerSync

Auch wenn die „Local-First“-Datenrevolution, für die PowerSync steht, einen ausgiebigen technischen Deepdive erfordert: Der Kernansatz besteht darin, die Art und Weise, wie Daten in der Webarchitektur fließen, grundlegend neu zu gestalten. Das sollte jeder Webentwickler im Blick behalten.

Normalerweise erstellen Entwickler Architekturen, die eine komplexe Middleware erfordern. Diese fungiert als Vermittler zwischen einem reaktiven Client und dem Data Store. Die radikale Alternative mit PowerSync: Der Broker wird komplett umgangen, indem eine SQLite-Wasm-Datenbank direkt in den Browser integriert wird. Die Benutzeroberfläche arbeitet dabei synchron mit lokalen Daten unter Verwendung von SQL, die Latenzzeit beträgt null. Der gefürchtete Ladekreisel wird damit vollständig eliminiert. Im Hintergrund gleicht PowerSync den lokalen Speicher automatisch mit der zentralen Postgres-Datenbank ab. Das Tool händelt die komplexen Synchronisierungs-Algorithmen und Netzwerkschwankungen und macht Ihre Anwendung damit effektiv „offline-first“ – per Default.

Der Haken ist dabei, dass ein „Local-First“-Entwicklungsansatz eine massive Umstellung erfordert: Sie müssen Data Slices (ähnlich einer View) definieren, die jeder Client-User vorhält. Die PowerSync-Engine übernimmt zwar auch hierbei den Großteil der Arbeit, aber Dinge wie Schemamigrationen und Konfliktlösungen (wenn zwei Benutzer denselben Datensatz offline bearbeiten) erfordern ein deutlich aufwendigeres Setup als eine Standard-REST-API.

Auch interessant: RxDB. Dieses Tool ist eine etwas andere Variante eines „Local-First“-Datenspeichers. Während PowerSync stark auf Postgres, SQLite und Hintergrund-Daemons setzt, bietet RxDB eine NoSQL-, „Offline-First“- und reaktive Datenbank. Diese behandelt Queries als „observable“ Streams und führt UI-Aktualisierungen genau in der Millisekunde durch, in der sich die lokalen Daten ändern.

6. RooCode

Der wesentliche Vorteil von RooCode ist, dass es sämtliche Ihrer KI-Anbieter koordinieren kann – und zwar kostenlos. Bei dem Tool handelt es sich um eine Erweiterung für Visual Studio Code, die einen „AI Manager Layer“ bereitstellt. Dieser schlägt eine Brücke zwischen den allgemeinen Fähigkeiten des LLM und den Code-spezifischen Strukturen auf Projektebene.

Dabei erreicht RooCode zwar nicht die Performanz von Tools wie Cursor oder Antigravity – ist aber durchaus in der Lage, die meisten kleinen bis mittelgroßen Requests zu bewältigen. Und das mit einem Minimum an unnötigem Overhead: RooCode hält Sie fern von proprietären Ökosystemen und ermöglicht auch, eigene API-Keys einzubinden – von Anthropic, OpenAI oder auch lokalen Modellen, die auf der eigenen Hardware laufen.

Die versteckten Kosten bestehen – wie bei jedem KI-Coding-Assistenten – darin, dass das Tool die Rolle des Entwicklers vom Code-Autor zum -Redakteur verschiebt.

Auch interessant: Antigravity. RooCode ist eine leichtgewichtige Erweiterung, die Ihre bestehende Umgebung aufwertet. Googles Antigravity ist hingegen ein maßgeschneiderter Editor, der von Grund auf mit Fokus auf KI entwickelt wurde und deshalb auch für Agentic-AI-Workflows konzipiert ist.

7. TanStack Query

Selbst wenn Client-seitiges State Management kein Problem mehr darstellt (siehe nächstes Tool), bleibt eine große Lücke bestehen: die Synchronisierung über die Servergrenze hinweg. An diesem Punkt kommt TanStack Query ins Spiel. Distributed Computing ist ein notorisch heikles Problem. Standardmäßige reaktive Modelle speichern den State sowohl auf dem Client als auch auf dem Server. Diese inhärente architektonische Reibung versucht TanStack Query abzumildern, indem es als intelligente asynchrone Schicht fungiert.

Anstatt eine Vielzahl manueller Fetches zu verwenden, die an useState-Aktualisierungen geknüpft sind (zusammen mit anfälligen isLoading-Flags und komplexer Logik zur State-Synchronisation), abstrahiert TanStack Query die aufwendige Arbeit, die mit API-Antworten, Hintergrundaktualisierungen und der Duplikatsbereinigung von Anfragen verbunden ist. Übrig bleiben einige wenige, elegante Hooks. Diese teilen TanStack Query mit, woher die Daten bezogen werden sollen. Dabei nutzt das Tool ein Muster namens „stale-while-revalidate“. Soll heißen: Daten werden im Frontend zwischengespeichert, wiederverwendet (wodurch Reload-Wartezeiten entfallen) und im Hintergrund mit dem aktuellen State synchronisiert.

Der Haken daran ist allerdings, dass TanStack Query Sie dazu zwingt, sich einem der hartnäckigsten Informatik-Probleme direkt zu stellen: der Cache-Invalidierung. Sie werden also Zeit damit verbringen, über „Query Keys“ zu sinnieren und damit, zu entscheiden, wann ein Datenelement als „veraltet“ gelten soll.

Auch interessant: SWR. Während TanStack Query ein absolutes Kraftpaket für komplexe Datenmanipulation ist, bleibt SWR ein Vorreiter des API-Minimalismus. Es tut genau das, was sein Name andeutet (stale-while-revalidate) – und das fast ohne lästige Konfiguration.

8. Zustand

Falls Sie noch nicht mit dem Albtraum des großangelegten State Managements in einer reaktiven App konfrontiert wurden, ein kleiner Spoiler: Das kann ziemlich unangenehm werden. Oder Sie nutzen Zustand und verzichten einfach auf den zeremoniellen Boilerplate-Code aus Reducern, Providern und unhandlichen Context-Wrappern. Ersetzt wird das durch einen winzigen, brutal simplen, globalen Speicher.

Anstatt Ihren gesamten Anwendungsbaum in einen massiven React-Context-Provider zu zwängen (was manchmal zu einer Kaskade überflüssiger Neu-Renderings im gesamten DOM führt), nutzt Zustand benutzerdefinierte Hooks, um den State direkt an die spezifischen Komponenten zu binden, die ihn benötigen. Dabei strebt das Tool danach, die Spezifität im reaktiven VDOM-Modell zu erreichen (anstatt sie à la Signals vollständig zu eliminieren). Sie definieren einen Store, rufen ihn auf – und die Reaktivität funktioniert einfach. Der Preis für diese Befreiung ist die Last der Disziplin: Zustand hindert Sie nicht daran, Ihren globalen Speicher in eine überfüllte Deponie zu verwandeln. Entwickler müssen Ihre eigenen Konventionen und Guardrails einziehen, um großangelegte Projekte überschaubar zu halten.

Auch interessant: Jotai. Wenn Zustand der schlank gehaltene globale Store ist, dann ist Jotai der schlank gehaltene, atomare Ansatz. Dieses Tool verwaltet den State „von unten nach oben“ und berechnet Änderungen mit chirurgischer Präzision – ohne dabei massive Neu-Renderings im gesamten Application Tree auszulösen. (fm)

Dieser Artikel ist im Original bei unserer Schwesterpublikation Infoworld.com erschienen.

CVE-2026-0268 | Palo Alto Prisma Access Agent up to 26.2.0 on Linux improper protection of alternate path

Mon, 15 Jun 2026 08:06:21 +0200

A vulnerability was found in Palo Alto Prisma Access Agent up to 26.2.0 on Linux. It has been declared as problematic. This affects an unknown function. Such manipulation leads to improper protection of alternate path. This vulnerability is traded as CVE-2026-0268. An attack has to be approached locally. There is no exploit available. It is recommended to upgrade the affected component.

CVE-2026-0269 | Palo Alto Cloud NGFW/PAN-OS/Panorama/Prisma Access unusual condition

Mon, 15 Jun 2026 08:06:20 +0200

A vulnerability, which was classified as critical, was found in Palo Alto Cloud NGFW, PAN-OS, Panorama and Prisma Access. Affected by this vulnerability is an unknown functionality. The manipulation results in improper check for unusual conditions. This vulnerability is known as CVE-2026-0269. Access to the local network is required for this attack. No exploit is available.

CVE-2026-0271 | Palo Alto Prisma Access Agent up to 26.2.0 on Linux permission assignment

Mon, 15 Jun 2026 08:06:19 +0200

A vulnerability categorized as critical has been discovered in Palo Alto Prisma Access Agent up to 26.2.0 on Linux. The affected element is an unknown function. The manipulation results in incorrect permission assignment. This vulnerability is identified as CVE-2026-0271. The attack is only possible with local access. There is not any exploit available. It is advisable to upgrade the affected component.

CVE-2026-0266 | Palo Alto Cloud NGFW/PAN-OS/Prisma Access Web Interface cross site scripting

Mon, 15 Jun 2026 08:06:17 +0200

A vulnerability was found in Palo Alto Cloud NGFW, PAN-OS and Prisma Access. It has been rated as problematic. This vulnerability affects unknown code of the component Web Interface. The manipulation leads to cross site scripting. This vulnerability is uniquely identified as CVE-2026-0266. The attack is possible to be carried out remotely. No exploit exists.

CVE-2026-0273 | Palo Alto Cloud NGFW/PAN-OS/Prisma Access Management Web Interface os command injection (EUVD-2026-36149)

Thu, 11 Jun 2026 08:58:26 +0200

A vulnerability, which was classified as critical, has been found in Palo Alto Cloud NGFW, PAN-OS and Prisma Access. Affected is an unknown function of the component Management Web Interface. The manipulation leads to os command injection. This vulnerability is traded as CVE-2026-0273. It is possible to initiate the attack remotely. There is no exploit available.

CVE-2026-0272 | Palo Alto Cloud NGFW/PAN-OS/Prisma Access Command Line Interface authorization (EUVD-2026-36148)

Thu, 11 Jun 2026 08:58:22 +0200

A vulnerability classified as problematic was found in Palo Alto Cloud NGFW, PAN-OS and Prisma Access. This impacts an unknown function of the component Command Line Interface. Executing a manipulation can lead to missing authorization. This vulnerability appears as CVE-2026-0272. The physical device can be targeted for the attack. There is no available exploit.

Anzeige: Kompaktes Fernglas mit BAK4-Prisma für nur 22,11 Euro bei Amazon

Tue, 09 Jun 2026 16:32:34 +0200

Ein kompaktes Fernglas von Aurosports mit zehnfacher Vergrößerung, 25-Millimeter-Objektiv und BAK4-Prisma gibt es bei Amazon zum Sparpreis. (Technik/Hardware)

Fußball-WM auf Großleinwand: Diese Beamer lohnen sich – Kaufberatung

Tue, 09 Jun 2026 15:41:57 +0200

Als Alternative zum Fernsehgerät wird der Projektor immer beliebter. Sein Vorteil: Er hinterlässt keine schwarze Fläche im Wohnzimmer, wenn er nicht in Gebrauch ist. Vielfach lässt er sich an der Decke montieren oder unauffällig im Regal unterbringen. In beiden Fällen ist er so völlig aus dem Blick oder bleibt dezent im Ambiente-Hintergrund, wenn Sie ihn nicht brauchen.

Vorbei sind auch die Zeiten, in denen ein Beamer unbedingt einen völlig abgedunkelten Heimkino-Raum vorausgesetzt hat, um seine Stärken komplett ausspielen zu können. Ideale Bedingungen schaden zwar auch heutzutage nicht. Allerdings sind aktuelle Projektoren viel heller und können so mit einem höheren Umgebungslicht weitaus besser umgehen. Damit empfehlen sie sich für Normalbedingungen in der Wohnung, aber auch für den Einsatz auf der Terrasse oder beim Campen.

Vermehrt nutzen Projektoren leistungsstarke LEDs oder Laserlicht anstelle von UHP-Lampen (Ultra High Pressure), auch als Hochdruck-Quecksilberlampen (HQL) bezeichnet. Die gasgefüllten Hochdrucklampen gibt es zwar noch, sie sind aber dank der EU-Verordnung 2017/852 über Quecksilber auf dem Rückzug. Denn seit Februar 2025 ist es nicht mehr erlaubt, Lampen mit weniger als 2.000 Lumen herzustellen oder zu importieren. Ab Februar 2027 folgt die nächste Stufe: Dann sind UHP-Lampen ab 2.000 Lumen mit einem EU-Herstellungs- und Importverbot belegt.

Beamer mit UHP-Lampe: Mehrkosten einrechnen

Derzeit finden sich nach wie vor noch Beamer mit UHP-Lampe auf dem Markt. Gerade in den Einstiegsmodellen mit Full-HD- und 4K-Auflösungen sitzt diese Lichtquelle teils noch im Inneren. Für ein Modell mit 1.920 × 1.080 Pixeln wie den Epson CO-FH01 zahlen Sie deshalb auch vergleichsweise günstige 360 bis 400 Euro.

Epson

Beim Hersteller selbst finden sich jedoch oft keine Ersatzlampen mehr im Programm. Sie müssen sie über andere Anbieter beziehen. Im Nachkauf können allein für die Ersatzlampe etwa 140 Euro fällig werden. Da das Angebot aufgrund des Verbots weiter sinken wird, sollten Sie gleichzeitig mit dem Beamer-Kauf für Lampennachschub sorgen und daher den Mehraufwand von Anfang an in Ihre Kalkulation aufnehmen.

Noch einen Punkt gilt es hier zu beachten: UHP-Lampen verlieren im Gebrauch kontinuierlich an Helligkeit. Eine Lampenlebensdauer wie beim genannten Epson-Modell von 6.000 Stunden bedeutet, dass die Lichtleistung in dieser Zeit um etwa 50 Prozent sinkt.

Das Gerät meldet, wenn der Lampenaustausch fällig wird. Sie können den Zeitraum verlängern, indem Sie den Beamer im Eco-Modus mit niedrigerer Helligkeit betreiben. Außerdem ist es beim Lampen-Projektor besonders wichtig, dass Sie ihn möglichst staubfrei halten. Verschmutzungen verkürzen die Lampen-Lebensdauer zusätzlich.

LEDs als Grundlage für kompakte Mini-Beamer

Starke LEDs als Lichtquelle haben bei Beamern wesentliche Vorteile: Auf diese Weise sind sehr kompakte Geräte möglich. Die Kategorie der Mini-Beamer konnte so überhaupt erst entstehen. Die Geräte liefern eine Bildhelligkeit von etwa 200 bis 600 Lumen. Das entspricht vergleichsweise niedrigen Werten, die sich in der Projektion schnell in einer etwas milchigen Darstellung niederschlagen.

Auch kommen sie meist nicht über den Videofarbraum REC709 oder sRGB hinaus. Das reicht für spontane Projektionen, bei denen es mehr auf den gemeinsamen Spaß als auf eine hohe Bildqualität ankommt.

Immerhin sind LED-Beamer vergleichsweise langlebig, was Sie an den Lebensdauer-Werten von 30.000 Stunden bei den Mini-Beamern erkennen. Es dauert damit sehr lange, bis die LEDs einen Helligkeitsverlust von 50 Prozent erleiden. Sollten Sie ein Gerät täglich vier Stunden verwenden, liegt der theoretische Wert bei 21 Jahren.

Bei einem Defekt können Sie den LED-Beamer jedoch entsorgen. Denn reparieren lassen sich die Licht-Einheiten nicht. Das ist bei Einstiegspreisen ab gut 200 Euro wie für den Xgimi Vibe One für rund 250 Euro eventuell aber verkraftbar.

Da Sie einen Mini-Beamer möglichst flexibel einsetzen wollen, spricht für das genannte Modell auch der integrierte Akku. Wichtig sind in dieser Beamer-Kategorie außerdem ein leichter Aufbau und smarte Betriebssysteme.

Über Letztere erreichen Sie Streaming-Apps wie Netflix oder Amazon Prime Video. Denselben Effekt haben Sie, wenn Sie das Smartphone auf den Beamer spiegeln können. Umfangreiche HDR-Unterstützung wie beim Samsung The Freestyle 2nd Gen ist nicht selbstverständlich und schlägt sich daher auch im Preis nieder – hier liegt er bei etwa 490 Euro.

Laserlicht und Mischformen fürs helle Wohnzimmer

Im heimischen Wohnzimmer muss der Beamer gut mit Umgebungslicht umgehen können, da sich der Raum oft nicht vollständig abdunkeln lässt. Hier kommen Hochleistungs-Laserdioden ins Spiel. Sie unterscheiden sich im Wesentlichen durch die Anzahl der Lasereinheiten: Bei RGB-Laserprojektoren wird das Licht direkt von roten, grünen und blauen Lasern erzeugt.

Ihre Stärken sind lange Haltbarkeit, gleichmäßige Leinwand-Ausleuchtung und satte Farben. Da sie den sehr großen Farbraum BT.2020 nahezu abdecken, kommen sie bei hochwertigen 4K-Beamern zum Einsatz. Im Gehäuse beansprucht RGB-Laser jedoch mehr Platz.

Gerade größere Beamer fürs Heimkino nutzen auch eine Kombination aus blauem Laser und gelbem Phosphor (Advanced Laser Phosphor Display, ALPD). Bei einem Beamer mit Dual-Laser kommt zum blauen Laser ein zweiter mit rotem Licht, der die warmen Farbtöne sichtbar verstärkt. Sitzt nur ein Laser im Gerät, sorgen Farbfilter für die Grundfarben.

Möglich sind auch hybride Lichtquellen aus LED und Laser – ein Beispiel finden Sie im LG Cinebeam HU710PW für rund 1.400 Euro. Blaue und rote LEDs werden mit einem blauen Laser kombiniert, der durch ein sogenanntes G-Rap-Element in grünes Licht gewandelt wird. Die Mischform ermöglicht eine vergleichsweise kompakte Beamer-Bauform bei hoher Lichtausbeute von 2.000 Lumen und besserer Farbdarstellung als bei einem reinen LED-Projektor.

Drei Verfahren zur Bilderzeugung: DLP, LCD, LCOS

Allein durch die Lichtquelle entsteht noch kein Bild auf der Leinwand. Dazu muss das farbige Licht auf bilderzeugende Chips fallen – in drei grundlegenden Verfahren:

Die aktuell günstigste Projektionstechnik ist DLP (Digital Light Processing). Deshalb und wegen ihrer Kompaktheit wird sie auch von der Mehrheit der erschwinglichen Heimkinoprojektoren eingesetzt. Hier sind alle Beamer mit Chips von Texas Instruments ausgestattet. Die zentrale Einheit ist das Digital Micromirroring Device (DMD), das aus Millionen winziger Kippspiegel besteht, die das Licht zum Objektiv lenken.

Beamer Discount

Jeder Einzelspiegel kann seine Position mehrere Tausend Mal pro Sekunde wechseln. Die Farben entstehen durch zugeschaltete Farbfilter – oft über ein Farbrad – oder direkt durch farbige Lichtquellen.

Die Teilbilder für RGB (Rot, Grün, Blau) treffen nacheinander auf die Leinwand. Deshalb können empfindliche Zuschauer an den Rändern Farbblitzer wahrnehmen (Regenbogeneffekt). Grundsätzlich ist die Projektion jedoch scharf mit kontrastreichen Bildern.

Bei LCD-Projektoren (Liquid Crystal Display) sitzen LC-Panels für jede Grundfarbe Rot, Grün und Blau, durch die das Licht gelenkt wird. Mithilfe von Spannung richten sich die Kristalle aus. Sie lassen das Licht entweder durch oder blockieren es.

Ein Prisma sorgt dafür, dass die Teilbilder übereinander auf die Leinwand fallen und so ein Bild ergeben. Sind die LCDs nicht ganz exakt ausgerichtet, können Bildfehler entstehen. Die Technik benötigt mehr Platz als DLP, ist gleichzeitig flexibler beim Aufstellen. Dafür sorgen Zoom und Lens Shift. Ohne Versetzen des Beamers lässt sich das Bild verschieben und verzerrungsfrei in die Leinwand einpassen.

LCOS (Liquid Crystal on Silicon) ist eine Verfeinerung der LCD-Projektion und kommt bei hochwertigen Heimkino-Beamern zum Einsatz. Anstelle von durchlässigen LC-Panels sitzen die Flüssigkristalle auf einem Silikon-Wafer. Trifft Licht auf die Schicht, entscheidet die Drehung der Kristalle, ob es reflektiert und damit hell zurückstrahlt oder absorbiert wird. So entstehen hervorragende Schwarzwerte.

Sony

Auch lassen sich mit LCOS besonders hohe Auflösungen und Helligkeitswerte erzielen, die bei der HDR-Darstellung (High Dynamic Range) wichtig sind. Die Technik nennt sich bei Sony SXRD (Silicon X-tal Reflective Display), ein Modellbeispiel findet sich im Sony Bravia Projector 7 (VPL-XW5100ES) für satte 7.000 Euro. Bei JVC nennt sie sich D-ILA (Direct Image Light Amplifier). Im Modellbeispiel des JVC DLA-NZ800 schraubt sich so die Auflösung sogar auf 8K, allerdings zu einem beeindruckenden Preis von etwa 16.000 Euro.

Auflösung: Der Trick mit dem Pixel Shift

Wer sich für einen Heimkino-Projektor interessiert, muss bei der Auflösung aufpassen und zwischen nativer und maximaler unterscheiden. Das gilt zwar nicht für Full-HD-Beamer, vielmehr aber für Auflösungen, die darüber liegen – etwa 4K. Denn außer in der Luxusklasse handelt es sich nicht um native 3.840 × 2.160 Pixel, sondern vielmehr um sogenanntes Pseudo-4K.

Dabei kommen Pixel-Shift-Verfahren zum Einsatz, die sich je nach Hersteller unterscheiden. Sie begegnen Ihnen als E-Shift, 4K Enhancement oder unter dem Kürzel XPR bei DLP-Beamern. Zugrunde liegt, dass mit den eingebauten Full-HD- oder 2K-Chips (2.048 × 1.080 Pixel) ein 4K-Bild erzeugt wird. Vereinfacht gesagt, werden die Bildpunkte sehr schnell – oft mit 120 Hertz oder mehr – horizontal und vertikal oder diagonal verschoben.

Der Beamer projiziert nicht nur ein Bild, sondern bis zu vier Bilder hintereinander. Die Teilbilder verschmelzen dank der Trägheit des Auges auf der Leinwand zu einem Gesamtbild mit 8,3 Millionen Pixeln.

Obwohl es sich nicht um natives 4K handelt, funktioniert der Eindruck der Pixelvervierfachung in der Regel gut. Das Beamer-Gehäuse lässt sich dadurch kompakter halten. Da jedoch die Pixel auf den Chips größer sind als bei nativem 4K, kann bei einem sehr nahen Sitzabstand ein Pixelraster zu sehen sein.

Acer

Alle Modelle im 4K-Einstieg verwenden Pixel-Shift-Verfahren, starten dafür aber preislich bei weniger als 1.000 Euro – wie etwa das Modell Acer H6815BD für etwa 750 Euro. Echte 4K-Beamer kosten ein Vielfaches. Der schon genannte Sony Bravia Projector 7 für rund 7.000 Euro steht dafür repräsentativ.

Projektionsverhältnis: Abstandsspielraum zur Leinwand

Am Projektionsverhältnis erkennen Sie, welche Bilddiagonale sich aus einem bestimmten Abstand zwischen Beamer und Leinwand erzielen lässt. Je kleiner es ausfällt, desto näher muss der Projektor zur Fläche platziert werden. Frontprojektoren benötigen grundsätzlich mehr Abstand als Ultrakurzdistanz-Beamer, die Hersteller wie Hisense auch als „Laser TV“ bezeichnen.

Optoma

Ein großzügiges Projektionsverhältnis finden Sie in den oberen Beamer-Klassen, zum Beispiel beim 4K-Modell Optoma UHZ3600 für etwa 2.200 Euro. Hier liegt es bei 1,4 bis 2,2:1. Damit erhöht sich die Flexibilität beim Aufstellen des Geräts, da Sie das Bild mit einem optischen Zoom verlustfrei anpassen können, ohne es zu bewegen.

JMGO

Feste Projektionsverhältnisse sind bei Mini-Beamern üblich – zum Beispiel 1,2:1. Hier übernimmt meist ein digitales Zoom das Verkleinern des Bildes, was zulasten der Bildqualität geht. Bei einem Ultrakurzdistanz-Beamer wie dem AWOL Vision LTV-3000 Pro für 2.300 Euro ist ebenfalls ein festes Projektionsverhältnis üblich – hier 0,25:1. Die Bildgröße lässt sich nur über den Abstand des Geräts zur Leinwand verändern.

Wichtige Helfer fürs Ausrichten und Anschließen

Bis die Projektion perfekt gelingt, dauert es meist eine gute Weile. Schneller geht’s mit Helfern: So unterstützt der Lens Shift, wenn der Beamer etwas versetzt zur Projektionsfläche stehen muss. Damit lässt sich das Objektiv im Gehäuse verschieben. Horizontaler Lens Shift kommt zum Einsatz, wenn etwa Köpfe von Betrachtern im Bild stören.

Vertikaler Lens Shift erleichtert das Justieren bei der Deckenmontage. Günstige Beamer bieten oft nur einen geringen Stellbereich. Teure Projektoren können das Objektiv oftmals sogar motorisch verschieben.

Mit der Trapezkorrektur (Keystone-Korrektur) erzeugen Sie ein genau rechtwinkliges Bild, auch wenn der Beamer nicht ganz gerade zur Projektionsfläche steht. Viele Beamer korrigieren das Bild automatisch. Die Funktion verringert zwar die Bildgröße, ist aber besonders bei Mini-Beamern für den Mobileinsatz praktisch.

Bei den Anschlüssen sollte Ihr Beamer mindestens einen HDMI-Eingang mitbringen. Das ist bei den vorgestellten Projektoren auch der Fall. Je größer die Gehäuse, desto höher ist die Anzahl an HDMI-Ports. Beachten Sie die Formen, denn besonders Mini-Beamer können den Port auch in Micro- oder Mini-Fassungen bieten – wie der Samsung The Freestyle.

Ähnlich wie bei Fernsehern haben Heimkino-Beamer mindestens einen HDMI-Anschluss, der mit ARC (Auto Return Channel) oder sogar eARC (Enhanced) gekennzeichnet ist. Darüber lässt sich der Beamer mit dem Soundsystem im Wohnzimmer verbinden. Das ist ratsam, denn die eingebauten Beamer-Lautsprecher sind in der Regel wenig heimkinotauglich.

Lesetipps

Dangbei MP1 Max im Test

Valerion Vision Master Pro 2

AWOL Vision LTV-3500 Pro im Test

Epson EH-TW7100 im Test

Yaber T2 Plus im Test

8 cutting-edge web development tools you don’t want to miss

Tue, 09 Jun 2026 11:03:29 +0200

There is no ordained path. The hope that we were converging on some kind of consensus in web development has been eradicated by recent, ingenious developments that point in almost every direction. Yet, if there is a central theme uniting these efforts, it is the desire to mitigate the layers of liturgical embellishment that have grown up around the reactive canon. How can we look at things differently to attain the power that we need, without the heavy intricacy?

Here are eight cutting-edge web development tools that point the way.

Front-end maestro

If you put a bunch of classical musicians in a room together with sheet music and let them run, you might get to a cohesive piece—but you probably want a conductor, a maestro who coordinates all of the parts. That is Astro for your front-end frameworks.

Astro addresses the “hydration” of the front end, that is to say, the process of making the shell reactive. In conventional server-side rendering (SSR), like Next.js or Nuxt, the server not only sends the HTML, but also sends the massive framework runtime down the wire, just to attach event listeners to the page. Astro allows you to write components in React, Svelte, Vue, or Solid, and its compiler strips away all of the JavaScript before it reaches the browser. Astro ships zero JS by default, relying on its islands architecture to hydrate only the specific components that demand interactivity.

Because Astro isolates interactivity into distinct islands, sharing complex state between those islands (e.g., a complex filtering sidebar communicating with a separate dynamic data grid) is fundamentally harder than it is in a monolithic single-page application. If you are building a highly interactive, dashboard-heavy app where every component affects every other component, Astro’s isolated islands might begin to feel more like a straitjacket than a liberation.

See also: Qwik. If Astro unbloats by stripping away the JavaScript entirely, Qwik unbloats by delaying it. Qwik delivers instant HTML and serializes the application state, downloading and executing only the JavaScript code required for a specific interaction at the exact millisecond the user clicks a button.

Biome: Lint like it’s 2026

Rust is gradually replacing the underlying infrastructure in the JavaScript ecosystem. But while Rust gives Biome its close-to-the-metal speed, Biome’s true calling card is its unification of the sprawling toolchain under a cohesive umbrella.

The .eslintrc and .prettierrc files and the dozen associated plugins can become a dark and unhappy bog in a project. Biome is the way out of the mire. It is a single, blazingly fast binary that replaces your entire tangled formatting and linting ecosystem, providing a path to code quality that doesn’t require a sprawling web of dependencies.

Probably the biggest drawback to Biome is that you lose the wide-open extensibility—which is exactly the same feature that makes Biome lean.

See also: Rspack. Biome cleans up the linting. Rspack unbloats the build step. Also built on Rust for speed, Rspack challenges the new “unbundled” esbuild-based dev mode championed by Vite and uses bundled dev mode.

Bun: Fast and integrated back-end JavaScript

Most cutting-edge JavaScript enthusiasts are already well-aware of Bun. For those who haven’t yet experienced Bun’s enthralling blend of one-stop shopping and blistering speed first-hand, it’s a virtually irrefutable must-try.

Fast is probably an understatement. If you are used to Node and you try out Bun, you will likely be immediately impressed with the speed at which commands execute. The Bun team has also made an extensive, multi-year effort to bring its engine into close compatibility with Node’s APIs. Overall, Bun is an extraordinary engineering effort that every JS developer should explore.

However, while Bun’s Zig-based engine is in most respects a drop-in for Node, it isn’t perfect, especially when considering the gargantuan landscape of Node packages out there. Node remains the conservative, happy-path engine for server-side JavaScript.

See also: Deno. Although Bun has justifiably earned a reputation for bleeding-edge innovation, Deno has quietly pressed ahead with an appealing set of enterprise features like an integrated deployment platform and a front-end framework (Deno Fresh).

The Bun curious also may want to check out my interview with Bun creator Jared Sumner.

HTMX: Ajax KISS

If we are talking about clever ways to de-complexify the web, HTMX could reasonably be considered the poster-child. It takes the core mechanisms of the modern web client, like Ajax and partial updates, and turns them into simple HTML attributes. That means the state lives exclusively on the server, which is responsible for sending HTMX fragments.

Of course, there are trade-offs. Perhaps most unavoidable is the extreme dependence on the network. Because there is no client-side state machine, the browser will be orphaned and helpless without a connection to the server. That is, unless you get experimental with a local-first datastore.

Long story short: if your app falls into the realm of HTMX’s ability, HTMX is likely to be the most direct RESTful way to build it. And HTMX can in fact handle quite a lot.

See also: Hotwire. A collection of tools for building single-page-style applications using HTML over the wire, Hotwire has great features like page morphing, which can diff HTML instead of cold-loading it, with a simple import. True to classic “free as in speech” software culture, the HTMX and Hotwire projects freely exchange ideas.

PowerSync: Data layer redo

Although the local-first data revolution that PowerSync represents implies a fairly serious engineering deep dive, its core proposal — to entirely reshape the way data moves in web architecture — is something a web developer needs to be aware of.

Usually, we create architectures that require a complex middleware to broker between a reactive client and the datastore. PowerSync proposes a radical alternative: bypass the middleman entirely by dropping a robust SQLite Wasm database directly into the browser.

The UI works on local data using familiar SQL, synchronously. Latency is zero. The dreaded loading spinner vanishes entirely. In the background, PowerSync automatically reconciles your local store with your central Postgres database. It handles the complex syncing algorithms and network drops, effectively making your application offline-first by default.

The catch, of course, is that local-first development forces a massive mental shift. You have to define data slices (similar to a view) that each client user holds. The PowerSync engine does most of the hard work, but things like schema migrations and conflict resolution (when two users edit the same record while offline) require a significantly steeper initial setup than a standard REST API.

See also: RxDB. RxDB is a slightly different flavor of local-first datastore. Whereas PowerSync relies heavily on Postgres, SQLite, and background daemons, RxDB provides a NoSQL, offline-first, reactive database that treats queries as observable streams, pushing UI updates the exact millisecond the local data changes.

RooCode: Use any AI you want

The beauty of RooCode lies in its ability to orchestrate whatever AI providers you have—for free. RooCode is an extension to Visual Studio Code that provides an AI manager layer. This layer bridges between the general abilities of the LLM and your code-specific, project-level structures.

RooCode is strong enough to be somewhat agentic in its capabilities. It doesn’t reach the powerhouse abilities of something like Cursor or Antigravity, but it is quite able to handle most small to medium-sized requests. And it does so with a minimum of unnecessary overhead. I find myself often using RooCode alongside my AI-assisted IDE to knock out lesser requirements, for less cost and without interrupting the flow of ongoing epics.

RooCode keeps you free of proprietary ecosystems. It allows you to plug in your own API keys—whether that is Claude, OpenAI, or even a local model running on your own hardware.

The hidden tax of any AI coding assistant, however, is that it fundamentally shifts your job description from “writer” to “editor.” The unbloating of keystrokes can paradoxically lead to massively bloated codebases if developers blindly accept AI-generated boilerplate without actively reviewing its architectural impact. It is incredibly easy to let an agent spin up 500 lines of complex React when 50 lines of plain JavaScript would have done.

See also: Antigravity. RooCode is a lightweight extension that supercharges your existing environment. Google’s Antigravity is a custom-built editor designed from the ground up around AI, geared for agentic development workflows.

TanStack Query: Syncing made simple(r)

Even when client-side state management is addressed (see Zustand below), there is still a big, gaping hole in the plot: syncing across the server boundary. That is where TanStack Query steps into the breach.

Distributed computing is a notoriously thorny problem, and in fact our standard reactive model walks right into these thorns by holding the same state in two different places: on the client and the server. Tanstack Query tries to make this inherent architectural friction as painless as possible by acting as an intelligent asynchronous layer.

Instead of using a bunch of manual fetches tied to useState updates, along with fragile isLoading flags and complex state synchronization logic, TanStack Query abstracts the heavy lifting of API responses, background updates, and request deduplication into a few elegant hooks. You tell TanStack Query where to get the data, and it uses a pattern known as “stale-while-revalidate,” which means it will cache and reuse data on the front end (eliminating reload waits) and sync to the latest state in the background.

The catch, however, is that cache invalidation remains one of the hardest problems in computer science—and TanStack Query forces you to face it head-on. You will spend time thinking about “query keys” and deciding when a piece of data should be considered “stale.” No free lunches in software.

See also: SWR. While TanStack Query is an absolute powerhouse for complex data manipulation, SWR remains a champion of API minimalism, doing exactly what its name implies (stale-while-revalidate) with almost zero configuration.

Zustand: Minimalist state

If you have yet to encounter the monstrosity of large-scale state management in a reactive app, then spoiler alert: it can be nasty. Zustand proposes to dispense with the ceremonial boilerplate of reducers, providers, and unwieldy context wrappers in favor of a tiny, brutally simple global store.

Instead of forcing your entire application tree into a massive React context provider (sometimes leading to cascades of superfluous re-renders across the DOM), Zustand uses custom hooks to tie state directly to the specific components that need it. Zustand strives to achieve the specificity in the VDOM reactive model (instead of eliminating it entirely a la Signals).

You define a store, you call it, and the reactivity just works. It is an expression of the KISS philosophy applied to front-end architecture, scraping away the intricacies of Flux-like patterns. The trade-off for this liberation is the burden of discipline. Because Zustand is unopinionated, it won’t stop you from turning your global store into a cluttered junk drawer. You’ll need to impose your own conventions and guardrails to keep a large-scale project manageable.

See also: Jotai. If Zustand is the unbloated global store, Jotai is the unbloated atomic approach. Jotai manages state from the bottom up, calculating changes with surgical precision without triggering massive re-renders across the application tree.

New directions in web development

The most remarkable thing about these eight tools is that they deal in large part with alternative approaches that challenge the familiar. Although you may not be able to adopt them immediately, you will want to keep an eye on them. They are key factors that will continue to influence the shape of web applications and how we build them.

CVE-2026-42349 | clerk javascript unusual condition (GHSA-w24r-5266-9c3c)

Thu, 04 Jun 2026 14:38:46 +0200

A vulnerability has been found in clerk javascript, shared, backend, nextjs, -react, react, vue, astro, nuxt, -expo, expo, react-router, tanstack-react-start, chrome-extension, fastify, express and hono and classified as critical. This impacts an unknown function. This manipulation causes improper check for unusual conditions. This vulnerability is handled as CVE-2026-42349. The attack can be initiated remotely. There is not any exploit available. The affected component should be upgraded.

Wöchentliches Security-Update: PAN-OS-Bypass, Gogs-RCE ohne Patch und KI-Phishing im Beschleunigungsmodus

Wed, 03 Jun 2026 20:37:09 +0200

LONDON (IT BOLTWISE) – In dieser Woche zeigt sich erneut, wie schnell aus einem „mittel-sicheren“ Fehler ein operativ verwertbarer Einfall werden kann: PAN-OS/Prisma-Access wird laut Warnungen aktiv für Authentifizierungs-Bypässe missbraucht, während bei Gogs ein kritischer Zero-Day bereits Remote Code Execution ermöglicht – ohne verfügbaren Patch. Gleichzeitig sinkt mit KI-gestütztem Social Engineering die Hürde für Phishing […]

... den vollständigen Artikel »Wöchentliches Security-Update: PAN-OS-Bypass, Gogs-RCE ohne Patch und KI-Phishing im Beschleunigungsmodus« lesen

Dieser Beitrag Wöchentliches Security-Update: PAN-OS-Bypass, Gogs-RCE ohne Patch und KI-Phishing im Beschleunigungsmodus erschien als erstes auf IT BOLTWISE x Artificial Intelligence.

From God of War to Until Dawn – seven reveals from last night’s PlayStation event

Wed, 03 Jun 2026 13:47:26 +0200

The PS5 era has been in some ways disappointing for Sony – on Tuesday, the company revealed a slate of games they hope will change that

• Don’t get Pushing Buttons delivered to your inbox? Sign up here

PlayStation’s future has looked a little uncertain these past few years. Although the PS5 has sold well and been very profitable, the brand is far from the runaway market leader it was in the PS2 days. Earlier this week, Game File dug into Sony’s most recent earnings reports to illustrate how PlayStation has been selling fewer and fewer of its own flagship games since a peak during the pandemic. About 54.1m copies of games either developed or published by Sony were sold in the 2018 financial year; in 2025, it sold 32.1m.

Sony has put out some great homegrown games since the PS5 was released in 2020, from Astro Bot to Ghost of Yōtei, but it has also had some expensive and very public failures and cancellations; PlayStation boss Jim Ryan, who retired in 2024, placed big bets on live-service games and only a few panned out (hello, Helldivers). Sony also seems to have rolled back on releasing its single-player PS5 games on PC after a polite interval of time, suggesting it wants to preserve what advantage and exclusivity it has.

CVE-2026-0257: PAN-OS GlobalProtect Auth-Bypass ist aktiv ausgenutzt

Mon, 01 Jun 2026 11:51:15 +0200

LONDON (IT BOLTWISE) – Palo Alto Networks warnt, dass CVE-2026-0257 in PAN-OS und Prisma Access bereits aktiv ausgenutzt wird. Die Schwachstelle erlaubt einen Authentifizierungs-Bypass im GlobalProtect-Portal und -Gateway und kann Angreifern das Einrichten nicht autorisierter VPN-Verbindungen ermöglichen. Nach Angaben von Rapid7 reichen die beobachteten Aktivitäten bis Ende April/Anfang Mai zurück, mit einer zweiten Welle Anfang […]

... den vollständigen Artikel »CVE-2026-0257: PAN-OS GlobalProtect Auth-Bypass ist aktiv ausgenutzt« lesen

Dieser Beitrag CVE-2026-0257: PAN-OS GlobalProtect Auth-Bypass ist aktiv ausgenutzt erschien als erstes auf IT BOLTWISE x Artificial Intelligence.

CVE-2025-0130 | Palo Alto Cloud NGFW/PAN-OS/Prisma Access Packet unusual condition

Mon, 01 Jun 2026 01:08:49 +0200

A vulnerability was found in Palo Alto Cloud NGFW, PAN-OS and Prisma Access and classified as critical. Affected by this issue is some unknown functionality of the component Packet Handler. Executing a manipulation can lead to improper check for unusual conditions. The identification of this vulnerability is CVE-2025-0130. The attack may be launched remotely. There is no exploit available.

Claude Mythos exposed a hard truth: Your enterprise patching process is way too slow

Sun, 31 May 2026 19:17:26 +0200

In 2024, researchers from the University of Illinois found that GPT-4, when provided with a common vulnerabilities and exposures (CVE) description, could autonomously exploit 87% of a curated 15-vulnerability one-day dataset. Without the description, it could only exploit 7%. This provided a “margin of safety” for the industry because while AI could exploit known vulnerabilities, it could not discover them.

However, on April 7, Anthropic announced that Claude Mythos Preview had closed that margin, with the model autonomously discovering thousands of zero-day vulnerabilities across major operating systems and browsers. Separately, Mythos scored 83.1% on the CyberGym vulnerability reproduction benchmark. In one campaign targeting OpenBSD across 1,000 scaffold runs, the total compute cost was less than $20,000.

Exploitation timelines are collapsing. Langflow’s CVE-2026-33017 (CVSS 9.8) was exploited 20 hours after disclosure with no public proof-of-concept. Marimo’s CVE-2026-39987 (CVSS 9.3) was hit in 9 hours and 41 minutes.

The defensive infrastructure most organizations rely on wasn’t designed for this. Rapid7’s 2026 threat landscape report states that the median time from CVE publication to CISA's known exploited vulnerabilities (KEV) listing is five days. Google’s M-Trends 2026 report found that exploitation is happening before a patch is even released. When the Langflow advisory was published, the first exploit arrived in 20 hours. When the Marimo advisory was published, it took under 10 hours.

The assumption that your patch window is safe because exploitation takes time is no longer true. Here are your building blocks.

Replace CVSS-only prioritization with a three-layer filter

Most vulnerability management programs still prioritize by CVSS score alone. CVSS quantifies a vulnerability’s “theoretical” severity without considering whether a vulnerability is being exploited in the wild or how quickly someone could weaponize it. A CVSS 8.8 vulnerability with a history of active exploitation (like Docker’s CVE-2026-34040) gets lower priority than a CVSS 9.8 vulnerability that may never be exploited in the wild.

A recent study validated against 28,377 real-world vulnerabilities offers a concrete replacement: A three-layer decision tree incorporating CISA KEV status, Exploit Prediction Scoring System (EPSS) scores, and CVSS, thus forming a singular prioritization filter.

Three-Layer Vulnerability Prioritization Filter

Layer	Data source	Threshold	Action	SLA
1. Active exploitation	CISA KEV catalog	Listed	Immediate patching	Hours
2. Predicted exploitation	EPSS via FIRST.org	Score ≥ 0.088	Escalate to Tier 0 pipeline	24 hours
3. Severity baseline	CVSS via NVD	Score ≥ 7.0	Typical remediation	Per policy

Validated result: 18x efficiency gain, 85.6% coverage of exploited vulnerabilities, ~95% reduction in urgent remediation workload. All three data sources are open and free.

The described integration is entirely automatable. It’s possible to build a script to query the CISA KEV API, the EPSS API from FIRST.org, and the NVD, and have that script run against your asset inventory for every published CVE. The human in this process should remain in the loop as an approver, but not as the trigger.

Close the agent authorization gap

Creating exploits quickly not only changes how patches are prioritized, but how controls are configured for all the agent-driven systems that now possess privileged credentials. Your authorization policies have not been assessed against the behavior of AI agents, and that is now a measurable risk. CVE-2026-34040 showed that Docker’s authorization plugin architecture silently bypasses every plugin when the request body exceeds 1MB. Common AuthZ plugins (OPA, Casbin, Prisma Cloud) are unaware of this type of bypass, which occurs in Docker’s middleware before the request reaches the plugin.

When Cyera demonstrated this vulnerability, they showed that an AI agent debugging infrastructure could infer the bypass path while completing a legitimate task, without any instruction to exploit anything.

The Internet Engineering Task Force (IETF) is working on authorization models for agents. The document draft-klrc-aiagent-auth-01, published in March by participants from AWS, Zscaler, Ping Identity, and OpenAI, proposes the use of the current Secure Production Identity Framework for Everyone (SPIFFE) and OAuth 2.0 for AI agents to obtain dynamically provisioned and short-lived credentials.

Separately, the IETF Agent Identity Protocol draft (draft-prakash-aip-00) reports that out of about 2,000 surveyed model context protocol (MCP) servers, none had authentication.

But these standards are months to years away from implementation. For now, security teams must proactively incorporate agent-level test scenarios for all authorization boundaries, such as oversized requests, burst frequency, and multi-step escalation of privileged requests.

Map your credential blast radius

In a survey conducted by CSA/Zenity and published on April 16, 53% of organizations said they had already seen cases where AI agents exceeded their intended permissions, and 47% experienced a security incident involving an agent.

When AI builder tools such as Flowise (CVE-2025-59528, CVSS 10.0), Langflow, or n8n become compromised, the blast radius extends far beyond the host. These tools contain API keys to frontier models, database credentials, vector store tokens, and OAuth tokens to business systems. A compromised AI builder host is not just a single-system breach. It is a credential harvest that unlocks authenticated access to every connected service.

Without credential dependency maps for each AI tool host, incident response for agent compromise is guesswork. For every instance, document each credential, the extent of its access, and the relevant credential rotation process. Also begin migrating static API keys to short-lived tokens where downstream services allow.

Five actions for this quarter

1. Deploy the three-layer KEV-EPSS-CVSS filter

Substitute CVSS-only prioritization according to the table above. Automate the collection of data from all three APIs as part of a scheduled script against your asset inventory. Desired outcome: 18 times more efficient, 85.6% coverage of exploited vulnerabilities, 95% reduction in urgent remediation workload.

2. Implement event-driven patching for Tier 0 services.

Determine which services fall under the critical exposure tier: Services exposed directly to internet users, AI builder hosts, and container orchestration control plane. Trigger event-driven patching on a CVE publication instead of waiting for the next maintenance window for this tier.

Goal: deploy patch to canary within four hours of a CVE being declared critical. Use the CISA KEV and EPSS feeds to trigger event-driven patching. In situations where it is impossible to meet the goal of four-hour patching because of legacy dependencies, change-freeze windows, or rollback risk, immediately apply compensating controls such as removing internet exposure to the vulnerable service, rotating credentials for the vulnerable service, disabling affected functionality of the service (if applicable), and identifying an exception owner for the exposure until a patch can be deployed.

It is not acceptable to allow unbounded exposures for extended periods while awaiting a maintenance window.

3. Test authorization boundaries at agent scale.

Create test cases for every API that AI agents may communicate with via AuthZ policies. Specifically, include test cases for requests exceeding 1MB, 5MB, and 10MB body sizes. This includes test cases for burst rate > 100 requests per second and test cases for unusual parameter combinations (privileged flags, host mounts, capability additions). Additionally, patch to Docker Engine 29.3.1 to fix CVE-2026-34040.

4. Credential blast radius mapping for all AI builder hosts.

Document each credential for each Langflow, Flowise, n8n, and custom AI pipeline instance. Classify each credential by its lifespan (static key vs. short-lived token). Identify what each credential can access. Set up alerts for anomalous IP or identity for any credential access.

5. Shadow AI discovery scan for this week.

According to CSA data, there is a greater than 50% chance that your agents have exceeded their expected boundaries. Check your Security Information and Event Management (SIEM) and network monitoring tools for communications to the default ports of the AI builder: Langflow 7860, Flowise 3000, and n8n 5678. Any unauthorized instances are an unmonitored attack surface.

The takeaway

AI agents are emerging, and the standards bodies are responding. The IETF has multiple drafts related to agent authentication and authorization. The Coalition for Secure AI has published its MCP Security taxonomy and Secure-by-Design principles.

But these standards move at standards-body speed, and the exploit window is now measured in hours. Organizations that implement the three-layer filter and event-driven patching this quarter will have a measurable reduction in exposure. Those who wait will be running calendar-based patch cycles against an adversary that operates in less than 20 hours.

Nik Kale is a principal engineer specializing in enterprise AI platforms and security

PAN-OS GlobalProtect Authentication Bypass Flaw Under Active Exploitation

Sat, 30 May 2026 09:51:40 +0200

A critical authentication bypass vulnerability in Palo Alto Networks PAN-OS and Prisma Access is now being actively exploited in the wild, prompting CISA to add CVE-2026-0257 to its Known Exploited Vulnerabilities (KEV) catalog on May 29, 2026. Palo Alto Networks published its security advisory on May 13, 2026, warning that CVE-2026-0257 allows a remote unauthenticated […]

The post PAN-OS GlobalProtect Authentication Bypass Flaw Under Active Exploitation appeared first on Cyber Security News.

PAN-OS GlobalProtect Authentication Bypass (CVE-2026-0257) Under Active Exploitation

Sat, 30 May 2026 09:37:31 +0200

Palo Alto Networks has warned that a recently disclosed medium-severity security flaw impacting PAN-OS and Prisma Access has come under active exploitation in the wild. The vulnerability, tracked as CVE-2026-0257 (CVSS score: 7.8), refers to a case of authentication bypass that could be exploited by bad actors to set up VPN connections. "Authentication bypass vulnerabilities in the

PAN-OS GlobalProtect Authentication Bypass (CVE-2026-0257) Under Active Exploitation

Sat, 30 May 2026 09:37:24 +0200

The post PAN-OS GlobalProtect Authentication Bypass (CVE-2026-0257) Under Active Exploitation appeared first on IT Security News.

Palo Alto PAN-OS Authentication Bypass Vulnerability Actively Exploited in the Wild

Sat, 30 May 2026 09:06:21 +0200

A critical authentication-bypass vulnerability affecting Palo Alto Networks PAN-OS and Prisma Access is being actively exploited by malicious actors. In response to mounting attacks, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-0257 to its Known Exploited Vulnerabilities (KEV) catalog on May 29, 2026. While the flaw carries a medium CVSSv4 score, security researchers at […]

The post Palo Alto PAN-OS Authentication Bypass Vulnerability Actively Exploited in the Wild appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Palo Alto PAN-OS Authentication Bypass Vulnerability Actively Exploited in the Wild

Sat, 30 May 2026 09:06:19 +0200

The post Palo Alto PAN-OS Authentication Bypass Vulnerability Actively Exploited in the Wild appeared first on IT Security News.

Palo Alto Networks PAN-OS Authentication Vulnerability Bypass Exploited in the Wild

Sat, 30 May 2026 06:07:43 +0200

Palo Alto Networks authentication bypass vulnerability, CVE-2026-0257, affecting PAN-OS and Prisma Access, is now being actively exploited in the wild, with CISA adding it to the Known Exploited Vulnerabilities (KEV) catalog on May 29, 2026. Palo Alto Networks published its…

The post Palo Alto Networks PAN-OS Authentication Vulnerability Bypass Exploited in the Wild appeared first on IT Security News.

Palo Alto Networks PAN-OS Authentication Vulnerability Bypass Exploited in the Wild

Sat, 30 May 2026 04:52:21 +0200

The post Palo Alto Networks PAN-OS Authentication Vulnerability Bypass Exploited in the Wild appeared first on Cyber Security News.

Rapid7 Observed Exploitation of PAN-OS GlobalProtect Authentication Bypass Vulnerability (CVE-2026-0257)

Sat, 30 May 2026 01:10:15 +0200

Overview

On May 13, 2026, Palo Alto Networks published a security advisory for CVE-2026-0257, a medium severity authentication bypass affecting PAN-OS and Prisma Access when a specific configuration is present. Successful exploitation of this vulnerability allows a remote unauthenticated attacker to successfully establish a VPN connection through the GlobalProtect gateway of an affected appliance.

Rapid7 MDR identified successful exploitation across numerous customers, however we did not observe any indication of successful lateral movement from the devices. The earliest date for observed exploitation was May 17, 2026. As of May 29, 2026, this vulnerability has been added to the CISA KEV.

While the assigned CVSSv4 score indicates a medium severity, due to the circumstances surrounding this vulnerability Rapid7 urges that organizations treat this as a critical vulnerability. An authentication bypass in an edge facing enterprise VPN appliance can have significant impact to affected organizations. As such, organizations running affected appliances are urged to upgrade to a vendor supplied patch on an urgent basis.

Observed Attacker Behavior

On 2026-05-18 01:51:37 UTC, Rapid7 MDR responded to a 'Suspicious VPN Authentication - Local Account Logon via Generic Non-Human Identity' alert. During the initial investigation, Rapid7 observed a suspicious cookie authentication to the local admin account across multiple customer environments from the same hosting provider, Vultr.

<14>May 18 01:51:37 palovpn-01 1,2026/05/18 01:51:37,010101010101,GLOBALPROTECT,0,2817,2026/05/18 01:51:37,vsys1,gateway-auth,login,Cookie,,admin,US,GP-CLIENT,104.207.144.154,0.0.0,0.0.0.0,0.0.0.0,aa:bb:cc:dd:ee:ff,,6.0.0,,Linux,"linux-64",1,,,"Auth latency: 78ms, profile: local_auth_profile",success,,0,,0,GP-Gateway,0101010101010101010,0x0,2026-05-18T01:51:37.264-05:00,,,,,,0,0,0,0,,palovpn-01,1,",

GlobalProtect Authentication Log

Rapid7 MDR analyzed the Palo Alto tech support files across the impacted customers and observed that Cloud Authentication Service (CAS) was disabled and the GlobalProtect portal or gateway had authentication override cookies enabled. Based on these findings, MDR analysts concluded that this was likely exploitation of CVE-2026-0257. Subsequent analysis by Rapid7 Labs confirmed this was accurate by validating a successful proof-of-concept.

Rapid7 MDR observed a second wave of exploitation on May 21st. Due to the consistent MAC address, Rapid7 believes both waves of exploitation are likely from the same threat actor (TA). However, the second wave of compromises originated from the hosting provider, Dromatics Systems. In this wave of exploitation, Rapid7 observed VPN IP assignment following the cookie authentication, granting them access to the internal network. At this time, Rapid7 is unable to confirm why VPN assignment occurred only for a subset of exploited customers. Across multiple customers, Rapid7 observed successful exploitation via authentication probes using forged cookies, but the appliance accepted the cookie without a full VPN session being established in 8 out of 10 impacted MDR customers.

<14>May 21 01:54:39 FW-PA-A 1,2026/05/21 01:54:38,010101010101,GLOBALPROTECT,0,2818,2026/05/21 01:54:38,vsys1,gateway-auth,login,Cookie,,admin,US,DESKTOP-GP01,146.19.216.125,0.0.0.0,0.0.0.0,0.0.0.0,aa:bb:cc:dd:ee:ff,,6.0.0,Windows,"Microsoft Windows 10 Pro , 64-bit",1,,,"Auth latency: 1019ms, profile: SAML-o365-GP",success,,0,,0,GlobalProtect_External_Gateway,0101010101010101010 ,0x8000000000000000,2026-05-21T01:54:39.142-05:00,,,,,,30,241,35,0,,FW-PA-A,1,,",

GlobalProtect Authentication Log

Technical Analysis

Per the vendor advisory, we know the issue lies in a feature called “authentication override”. This feature allows a GlobalProtect portal or gateway to issue cookies to an authenticated user. The authenticated user can then use an authentication override cookie in future communications to the GlobalProtect portal or gateway in lieu of re-authenticating via credentials, akin to a bearer token. This is not a feature that is enabled by default.

We also know from reading the vendor advisory that the vulnerability requires a certain configuration in how certificates are used to encrypt and decrypt these authentication override cookies. Specifically, the certificate used to encrypt and decrypt authentication override cookies must not be the same certificate used for the GlobalProtect portal or gateway’s HTTPS service. This is a significant clue to how the vulnerability works.

To explore what an authentication override cookie looks like and how they are created, we can look at the implementation in the /usr/local/bin/gpsvc binary which implements the GlobalProtect service (Our testing appliance was running PAN-OS 10.2.8 in a vulnerable configuration). Inspecting the main_DoAuthLogin function, we see that if a HTTP form value of either portal-userauthcookie or portal-prelogonuserauthcookie is present during a POST request to /ssl-vpn/login.esp, authentication will be performed by a call to main_AuthWithCookie. This function will take the incoming encrypted cookie value stored in either portal-userauthcookie or portal-prelogonuserauthcookie, decrypt it and extract the cookies user name, domain name, host id, client OS, remote address, and timestamp (as auth override cookies have a lifetime after which they will expire).

void __gostk main_AuthWithCookie(
        main_GpTask_0 *t,
        paloaltonetworks_com_libs_common_AuthProfile *authProfile,
        string authCookie,
        string key,
        string stage,
        uint32 cookieLifetime,
        uint32 eventId,
        uint32 netMask,
        bool checkSrcIp,
        main_authResult_0 *result,
        string defaultDescription)
{
// ...

  ts = 0;
  errorCode = 0;
  user = 0;
  domain = 0;
  hostId = 0;
  clientOs = 0;
  remoteAddr = 0;
  result->retCode = 0;
  startTime = time_Now();
  result->cookie_auth_status = -1;
  t->Variables.authMethod.len = 6;
if ( *(_DWORD *)&runtime_writeBarrier.enabled )
    runtime_gcWriteBarrier();
else
t->Variables.authMethod.str = (uint8 *)"Cookie";
  str = authProfile->AuthProfileName.str;
  t->Variables.authProfile.len = authProfile->AuthProfileName.len;
if ( *(_DWORD *)&runtime_writeBarrier.enabled )
    runtime_gcWriteBarrier();
else
t->Variables.authProfile.str = str;
  v27 = main_DecryptAppAuthCookie(t, authCookie, key, &user, &domain, &hostId, &clientOs, &remoteAddr, &ts);

If we look at the main_DecryptAppAuthCookie function we can begin to see the problem. The incoming encrypted cookie is base64 decoded and then decrypted using a private key. The decrypted content is then trusted implicitly, with no signature verification of any kind occurring after decryption.

error __gostk main_DecryptAppAuthCookie(
        main_GpTask_0 *t,
        string authCookie,
        string privateCert,
        string *user,
        string *domain,
        string *hostId,
        string *clientOs,
        string *remoteAddr,
        int64 *ts)
{
// ...

  if ( privateCert.len )
  {
    *(retval_95DD80 *)&text[48] = paloaltonetworks_com_libs_common_DecryptRsaPrivateWithBase64Std(
                                    privateCert,
                                    (string)0LL,
                                    authCookie);

The implication here is that anyone who knows the public key for the certificate used by the authentication override feature to encrypt and decrypt cookies, can successfully forge and encrypt an arbitrary authentication override cookie. The question then becomes, how does an attacker learn the correct public key to use in this attack?

This brings us back to the vendor's advisory where they state “do not reuse the portal or gateway certificate, and do not share this certificate with other features or users”.

If a GlobalProtect portal or gateway has reused the certificate for encrypting and decrypting cookies with another feature, such as the HTTPS service of the portal or gateway, then a remote unauthenticated attacker can discover the public key for that certificate. In doing so the attacker will be able to successfully forge and encrypt arbitrary authentication override cookies. As these forged cookies will be successfully decrypted server side, they will be trusted and an authentication bypass will be achieved. An attacker can use a valid forged authentication override cookie to login and establish a VPN connection.

In addition to Exposure Command and InsightVM customers being able to assess their exposure with authenticated checks, a publicly available proof-of-concept script to test if an appliance is vulnerable to CVE-2026-0257 has been developed by Rapid7 Labs. The script will retrieve all certificates in the chain for the HTTPS service of either a GlobalProtect portal or gateway. Each certificate in the chain is iterated over and an authentication override cookie is forged using each certificate's public key. This forged cookie is then tested against the GlobalProtect portal or gateway, and the script reports back if authentication was successful or not.

The usage of the script is shown below.

$ python3 forge_cookie.py --help
usage: forge_cookie.py [-h] --target TARGET [--port PORT] [--user USER] [--domain DOMAIN] [--host-id HOST_ID] [--client-os CLIENT_OS] [--client-ip CLIENT_IP] [--context {gateway,portal,both}] [--verbose]

Forge a GlobalProtect auth override cookie using the public key from TLS (CVE-2026-0257).

options:
  -h, --help            show this help message and exit
  --target TARGET       Target GP portal/gateway IP/hostname
  --port PORT           Target port (default: 443)
  --user USER           Username to forge cookie for (default: admin)
  --domain DOMAIN       Domain for cookie (default: empty)
  --host-id HOST_ID     Host ID for cookie (default: empty)
  --client-os CLIENT_OS
                        Client OS for cookie (default: Windows)
  --client-ip CLIENT_IP
                        Client IP in cookie (default: 0.0.0.0)
  --context {gateway,portal,both}
                        Context to test: gateway, portal, or both (default target)
  --verbose             Print full response

A successful invocation of the script against a vulnerable appliance is shown below. We can see the target's GlobalProtect gateway accepted a forged authentication override cookie using the second certificate in the chain.

$ python3 forge_cookie.py --target 192.168.86.99 --user haxor
[*] Retrieving certificate chain from 192.168.86.99:443 ...
  Found 2 certificate(s) in chain:
  [0] CN=192.168.86.99 (RSA 2048 bits, CA=False)
  [1] CN=GP-Lab-CA (RSA 2048 bits, CA=True)

[*] Forging cookie for user 'haxor', testing each key

  Trying [0] CN=192.168.86.99
  [-] Failure - Gateway did not accepted the forged cookie
  [-] Failure - Portal did not accepted the forged cookie

  Trying [1] CN=GP-Lab-CA
  [+] Success - Gateway accepted the forged cookie
  Cookie: ng9ygxlaclylNXeSHcakXZPK06Fno0svVirz6RhRtA5mDmOaZyg/KMxUuM5lRvm1Rn1Z6vqaWQQPvQOHzwJnyldOmhUKy+HDMgIYtJ/kk3ypMqmFE7BbmPxnSKxKcQQbNIcxgkrhCwuJKwybuq0aaPVNzN9BSWmh1QmZj7oLjTEo9ExAXrm951mqYhh3+MgBCScaYqP23WzrC+vzqJB74sHoMUuFWIF8/sMYDMpvENOoI4nXAFCaRYSruW9FQQy5VTzNifNWkrYcdzDCXKiP8v4G098/2QoBbVoyHBZwbgHGBsRU3ZeSgoHjrhjxyotIshKVssUs8CRpuG2HlZBM0Q==

We can observe the successful authentication via the management interface, as shown below. The two initial failures correspond to the first certificate being used which was the incorrect certificate.

Figure 1: PAN-OS Management Interface

Mitigation Guidance

According to the Palo Alto Networks advisory, the following product versions are affected by CVE-2026-0257:

Product	Affected	Unaffected
PAN-OS 12.1	< 12.1.4-h6 < 12.1.7	>= 12.1.4-h6 >= 12.1.7
PAN-OS 11.2	< 11.2.4-h17 < 11.2.7-h14 < 11.2.10-h7 < 11.2.12	>= 11.2.4-h17 >= 11.2.7-h14 >= 11.2.10-h7 >= 11.2.12
PAN-OS 11.1	< 11.1.4-h33 < 11.1.6-h32 < 11.1.7-h6 < 11.1.10-h25 < 11.1.13-h5 < 11.1.15	>= 11.1.4-h33 >= 11.1.6-h32 >= 11.1.7-h6 >= 11.1.10-h25 >= 11.1.13-h5 >= 11.1.15
PAN-OS 10.2	< 10.2.7-h34 < 10.2.10-h36 < 10.2.13-h21 < 10.2.16-h7 < 10.2.18-h6	>= 10.2.7-h34 >= 10.2.10-h36 >= 10.2.13-h21 >= 10.2.16-h7 >= 10.2.18-h6
Prisma Access 11.2.0	< 11.2.7-h13	>= 11.2.7-h13
Prisma Access 10.2.0	< 10.2.10-h36	>= 10.2.10-h36

Affected products must have the authentication override feature enabled in either the GlobalProtect portal or gateway, and must reuse the authentication override cookie encryption and decryption certificate with another feature in order to be vulnerable. As a mitigation, affected products should either disable the authentication override feature or generate a new certificate to use exclusively for the authentication override feature.

Please refer to the vendor advisory for the latest guidance.

Rapid7 Customers

Managed Detection Response (MDR)

The following detection rules are available for InsightIDR and Managed Detection Response (MDR) customers:

Suspicious Authentication - Palo Alto GlobalProtect Cookie Authentication to Local Admin Account
Threat Intel (Rapid7 MDR SOC/IR) - VPN Authentication via Spoofed MAC Address
Threat Intel (Rapid7 MDR SOC/IR) - Indicator of Compromise Observed
Suspicious VPN Authentication - Palo Alto GlobalProtect Login via Default Hostname
Suspicious VPN Authentication - Local Account Logon via Generic Non-Human Identity
Suspicious VPN Authentication - Local Account
Suspicious Authentication - Vultr
Suspicious Authentication - Dromatics Systems

Exposure Command, InsightVM, and Nexpose

Exposure Command, InsightVM, and Nexpose customers can assess exposure to CVE-2026-0257 using an authenticated check available since the May 15 content release.

Known Indicators of Compromise

Low-cost hosting providers; frequent origin of sustained threat campaigns.

Item	Description
104.207.144.154	Threat actor source IP
146.19.216.119	Threat actor source IP
146.19.216.120	Threat actor source IP
146.19.216.125	Threat actor source IP
DESKTOP-GP01	Machinename observed in the GlobalProtect logs alongside Windows authentications first observed on May 21, 2026
GP-CLIENT	Machinename observed in the GlobalProtect logs alongside Linux authentications first observed on May 17, 2026
aa:bb:cc:dd:ee:ff	Spoofed MAC address observed in both waves of successful exploitation

Updates

May 29, 2026: Initial publication.
May 29, 2026: Added CISA KEV addition.

Russian Cosmonauts Just Livestreamed an Entire 5-hour Spacewalk

Thu, 28 May 2026 18:02:43 +0200

A routine spacewalk provided some spectacular views and intriguing astro-babble.

Astro Forge: Ein möglicher Rückschlag für den Asteroidenbergbau

Thu, 28 May 2026 14:48:03 +0200

Der von dem Raumfahrt-Unternehmen Astro Forge anvisierte Asteroid dreht sich rasant und könnte eine Landung unmöglich machen. Ein Rückschlag für den Weltraumbergbau? (Weltraumbergbau, Raumfahrt)

DSPM buyer’s guide: Top 10 data security posture management tools

Wed, 27 May 2026 09:08:41 +0200

Data security posture management (DSPM) explained

Data security posture management (DSPM) tools help security teams examine their entire data environment to find shadow data, reducing the risk of data loss.

Tracking down sensitive data across both cloud and on-premises systems can be vexing. Each environment presents its own challenges. Given the dynamic and ephemeral nature of cloud computing, cloud data is easily created, deleted, or moved around. The cloud attack surface is equally dynamic, making protection all the more difficult. On-premises data can be elusive, particularly when shadow AI usage creates mission-critical data stores outside IT’s purview. To address this latter point, most DSPM vendors are incorporating their own AI routines (or offering a separate AI SPM product, as we outlined here).

But AI isn’t the only source of shadow data: for example, old data repositories left lurking on some cloud container or in-house server that has long been forgotten, not updated, or unaccounted for. The goal of DSPM products is to locate this shadow data and complement the more expansive cloud security posture management (CSPM) tools. But instead of focusing on protecting cloud infrastructures, DSPM tools focus exclusively on the role of data and how it is consumed by various cloud and on-premises services.

How the DSPM market is evolving

Over the past few years, DSPM tools have been developed to discover both known and unknown data, provide structure, and manage the security and privacy risks of potential data exposure. The market segment has seen a lot of mergers and acquisitions of late, including the following:

Tenable acquired Eureka Security and Vulcan Cyber, folding them into its CNAPP Cloud Security platform
Palo Alto Networks acquired Dig
Rubrik acquired Laminar Security
Proofpoint acquired Normalyze
IBM acquired Polar Security, folding it into Guardium
Veeam acquired Securiti
Varonis acquired a variety of companies, including Cyral, SlashNext, and AllTrue.ai to enhance its DSPM and other products
Thales acquired Imperva and created its CipherTrust DSPM
Google acquired Wiz

This activity shows how DSPM has become a hot commodity, as established security vendors are buying up niche vendors to expand how they identify and protect data.

According to Gartner, DSPM tools bridge “the gap between data discovery/classification and the eventual implementation of automated remediation controls.”

The research firm outlines five use cases for DSPM: data loss prevention (DLP), privacy and data governance, entitlement management, cloud posture management integration, and protecting AI-related workflows. DSPM has evolved to the point where “the products’ combined capabilities now bear only a slight resemblance to the capabilities of the vendors that pioneered DSPM, leading to uncertainty for customers as to what DSPM actually is,” Gartner says.

As a result, while all five use cases are key components of any DSPM strategy, not every DSPM tool will perform equally well — or even comprehensively — across the board.

Take DLP for example. It used to be the sole place where security tools would examine threats and try to combat risk from these threats. But as cloud estates have grown, and as AI training data exploded, enterprises need to move beyond plain-vanilla DLP and establish better ways to find evidence of an attack, stolen data, or AI-fueled phishing attempts.

Part of the problem is that, as Gartner reports, “traditional data security products have an insufficient view to discover previously unknown, undiscovered, or unidentified data repositories, and they fail to consistently discover sensitive data.” That is where integration into other security tools is essential — and why so many mergers and acquisitions have taken place to fill these gaps.

Another issue is that data usage can be messy: Many businesses have numerous data and application silos that don’t put data protection front and center. Moreover, organizations often lack consistent protections as their data spreads across clouds and applications — especially when it comes to finding its way into AI agents.

DSPM provides the locator function for these complex environments. Fixing the problems a DSPM tool finds is really the province of a various other security tools, such as security orchestration, automation, and response (SOAR); security information event management (SIEM); cloud-native application protection platforms (CNAPPs); and the like. Some DSPM vendors integrate or incorporate these “fix-it” tools with their products.

Overall, the DSPM market is experiencing a boom in interest, with the tools catching on quickly in the past few years. As late as 2022, Gartner found a miniscule market penetration of less than 1% across its clientele. More recently, the research firm found that DSPM’s growth over the past two years has outpaced every other cybersecurity category.

What to look for in data security posture management (DSPM) tools

DSPM tools require a significant amount of staffing resources to evaluate because they touch on so many aspects of your IT infrastructure. That’s a good thing, because you want these tools to seek out and find data no matter where it could be hiding.

Having a plan that prioritizes which data is most important to your organization will help focus your evaluation. It’s also important to document how each DSPM offering creates its data map and subsequent dashboards. You should also understand the specific cloud and on-premises services that are covered and which ones are on the vendor’s near-term product roadmap.

How each vendor describes where it goes looking for data is instructive. Every vendor supports some visibility into some of the cloud data repositories of Amazon Web Services, Google Cloud, and Microsoft Azure. But that doesn’t mean that they cover every service offered by each of the cloud providers that deals with data.

For example, AWS has its S3 storage, Relational Database Service, Redshift’s cloud data warehouse, Athena serverless SQL queries, and ElasticSearch managed data services, among several other places that operate on data. Veeam takes pains to delineate which services are covered in each cloud platform, but other DSPM providers are not as transparent. Varonis, meanwhile, uses a “universal data connector” that can seek out a wider range of structured data destinations, both cloud-based and on-premises. Some vendors acknowledge cloud services they don’t support. Be sure to note that this is a very dynamic situation as vendors are adding coverage areas continually as their customers demand them.

Tracking down data is just the beginning, however. Once found, the data must be cataloged, evaluated, and summarized in various dashboards. That could be tricky if done without tight security controls, which is why most DSPM vendors claim that “customer data always stays within the customer’s environment.” This typically means collecting metadata, rather than the data itself, using read-only access to the apps, services, and database structures. Vendors refer to this as “agentless” or “using API access.” This approach has the advantage of being able to scan huge volumes of data quickly to understand the nature of its usage and potential risk factors.

Once the data has been discovered and its metadata has been collected, the next step is to perform regular scans to see what changes have been made: Has data been copied to some dark corner of your cloud estate? Has someone just changed access rights to allow for greater or insecure access? These tools provide a single point of view across all the various cloud and on-premises data locations. The key word here is “regular.” Scans have default periods (such as daily or weekly) and can be activated when new data repositories are found.

How data is consumed in your production environment, including data pipelines, lakes, and warehouses, is another aspect to consider. This can involve creating data maps to classify this landscape as well as facilitating audits to enumerate who has access to which data resource and under what specific circumstances it was shared across your enterprise. Maps are not just pretty pictures but important visualizations that often show where shadow data was abandoned, for example.

On top of all these activities there is the entire field of data governance. DSPM products assign risks and apply consistent security policies to manage your entire data collection, and they work with other security tools to enforce these policies and remediate problems. Many of the vendors included below have begun offering continuous auditing as part of their DSPM governance package, which is a welcome development in this fast-changing world.

Each DSPM tool has several components, including agents and agentless collectors (useful for tracking on-premises data), a centralized management dashboard, scanners that detect and prioritize data collections, maps of data lineage and usage, and compliance assessments.

Most vendors offer their DSPM product in one or both wider contexts: to integrate with third-party security services (such as offered by Veeam and Wiz) or as part of their own security product portfolio with other add-on modules that include identity management, cloud management, detection and response, and log analysis tools (Palo Alto Networks, Varonis, and Wiz).

The specifics on these integrations are worth examining, as some vendors, such as Varonis, Wiz and Palo Alto Networks, have wider support than others. Understanding the scope, integration level, and what other protective features are included, and which are available at an extra cost will take some effort to figure out.

Products can be deployed as a complete SaaS cloud-based solution, run from on-premises servers or private virtual machines/containers, or in some combination.

Finally, there is the issue of pricing. All the products overviewed here are pricey. Few vendors were willing to share this information, indicating that prices are flexible and depend on numerous factors. Some vendors are now charging by the terabyte for DSPM, an interesting development that could result in higher usage costs. However, numerous vendors offer annual subscriptions on either or both the Amazon and Azure marketplaces, which typically start at $30,000 for the smallest of networks. Plan on spending at least $100,000 annually, with higher prices to analyze larger data collections.

Leading vendors for data security posture management (DSPM)

The market space of DSPM is evolving quickly. Based on our own research and research from Gartner, GigaOm, IDC, and other analyst firms, we’ve identified 10 DSPM tool providers worth investigating. We also contacted several other vendors for this article that did not respond to our inquiries, so they are not detailed here: BigID, Concentric, Flow Security, IBM, OneTrust, Rubrik, Symmetry Systems, and Theom.

Cyera DSPM Platform

Cyera’s DSPM Platform helps organizations discover, classify, and secure sensitive data across cloud, SaaS, AI, and on-premises environments. The platform — along with its DDR companion DataWatcher — enables enterprises to control what data AI applications and agents can access, govern how that data is used, and reduce exposure risk across data at rest, in motion, and in use. Cyera provides agentless visibility into structured, semi-structured, and unstructured data, highly actionable risk and access intelligence dashboards, and more than 500 built-in data classifiers. The platform integrates with numerous security and data ecosystem tools, including Netskope, Splunk, Tines, Wiz, Collibra, DataHub, and Secoda, and supports on-prem/hybrid deployments for customers requiring in-environment scanning and regional data residency controls. Pricing on AWS for its Cloud Platform starts at $50,000 per year.

Microsoft Purview DPSM

Microsoft Purview DPSM is part of a larger data protection effort that is in preview form and will be rolled out in June at the company’s Build conference. It consolidates separate data protection tools to provide a single place to monitor and enforce security policies, and create and monitor security objectives. Purview DPSM will integrate with DSPM tools from Cyera, BigID, and OneTrust, and it uses Copilot and other AI agents to identify and protect your data collections. It replaces older DSPM tools that are now labelled “classic” versions.

Palo Alto Networks Cortex Cloud DSPM

Palo Alto Networks’ Cortex Cloud DSPM integrates with hundreds of SIEM, workflow, and ticketing solutions, as well as XDR and single sign-on (SSO). It comes with more than 600 prebuilt data classifiers, but more importantly, it works closely with various AI tooling to automate detection and remediation threats. It supports Microsoft 365, Snowflake, other SaaS services, a wide range of cloud providers, and on-premises file shares.

Proofpoint DSPM

Proofpoint DSPM recently folded in the company’s Normalyze acquisition and added integration with Proofpoint’s DLP solution. The tool scans cloud, SaaS, and on-premises data sources. It uses AI tools to identify attack paths and classify high-value data and auto-remediates when identifying misconfigurations. It integrates out-of-the-box with APIs for SOAR, third-party ticketing, and notification and automation platforms, including Atlassian Jira, ServiceNow, Microsoft Purview, and Slack. It offers more than 300 data classifiers and protects AI workflows.

Sentra End-to-End Data Security Platform

Sentra End-to-End Data Security Platform provides both continuous compliance and a superset of DLP policies, offering deep support for most cloud computing services along with support for containers, virtual machines, and on-premises data sources. It has its own data detection and response (DDR) tool for near real-time detection and a series of actionable dashboards. There are lots of integrations with data management (Coralogix, DataDog, and DataHub), email, ITSM (Jira, PagerDuty, and ServiceNow), CNAPP (Wiz), collaboration (Atlan, Azure Boards, Monday.com, Slack, and Teams), IAM (Active Directory and Okta), incident response (Seemplicity), SIEM (Splunk), and on-premises file shares. It also has powerful data classifiers that leverage built-in AI features to provide metadata enrichment and context, along with automated risk mediation. Sentra has four pricing tiers on AWS, starting at $50,000 per year.

Tenable One Cloud Exposure

Tenable One Cloud Exposure combines DSPM with threat detection and integrates with data lakes and warehouses such as Atlas, Salesforce, ServiceNow, Snowflake, and Jira-based ticketing systems. The tool continuously scans, categorizes, and remediates data across on-premises, cloud, and SaaS platforms to correlate identity, workload context, and potential threats. It also can dynamically verify and protect data that is externally reachable. Tenable has expanded its protective envelope to cover additional data types (such as secrets) and cloud providers.

Thales CipherTrust DSPM

Thales CipherTrust DSPM ties together visibility and remediation of your data located across both cloud and on-premises environments. It builds on its Imperva acquisition and can classify both structured and unstructured data and can map and protect data flows and encryption keys and secrets across the entire enterprise.

Varonis DSPM

Varonis has been in the data security business for more than a decade and covers both on-premises and cloud data repositories. It provides several hundred integrations with SIEM (e.g., Splunk), SOAR (e.g., Palo Alto XSOAR), firewalls, VPNs, web proxies, DNS services, Active Directory, Entra ID, Microsoft Purview Information Protection, and Okta. The product includes a managed DDR service that uses behavioral detection models and automated remediation. Varonis has been on an acquisition binge to broaden its security platform to include better phishing, compliance testing, and AI protection. Varonis AWS pricing is $750 per TB per year.

Veeam DSPM

Since acquiring Securiti, Veeam has added a variety of breach and compliance management features to Veeam DSPM, as well as on-premises protection to complement its data backup tooling. Its tool supports data streaming technologies such as Confluent, Google PubSub, Kafka, and Kinesis. It comes with 350 content classifiers that support multiple languages along with more than a thousand predefined detection rules, including AI-based data sources and uses. It integrates with a wide collection of cloud-native security services, cloud access security brokers (CASBs), CNAPPs, CSPMs, cloud infrastructure entitlement management (CIEM) systems, DLP systems, intrusion detection systems (IDSes), Kubernetes security posture management (KSPM) systems, SIEM systems, and compliance tools. It is priced per terabyte, starting at $450 per TB per year for structured data and $1,000 per TB per year for unstructured data, with volume discounts available.

Wiz for DSPM

Wiz maintains a solid brand and product identity, despite being acquired by Google. It packages its products differently from most vendors, offering three products to protect code, cloud assets, and to defend against threats. All three are needed for a complete DSPM solution, which has been expanded to cover shadow data detection and AI-driven data classifiers. Wiz offers two licensing plans, but the full collection of DSPM features is available only on its more expensive Advanced plan. Wiz adds a lightweight agent called Runtime Sensor for detection and response. In addition to the usual cloud data sources, it also scans a variety of on-premises databases, such as MongoDB, MySQL, and PostgreSQL, as well as cloud versions, including Databricks. Wiz also integrates with more than 60 security products. Wiz’ AWS pricing starts at $38,000 per yr to protect 100 workloads.

NASA taps Blue Origin to deliver lunar rovers for Moon Base initiative

Wed, 27 May 2026 02:32:44 +0200

Blue Moon lander will carry Astrolab and Lunar Outpost moon buggies, while Firefly will drop off NASA's rocket-powered drones. Read More

CVE-2026-30117 | scalar astro 0.1.13 Proxy Endpoint scalar_url unrestricted upload

Sat, 23 May 2026 14:08:56 +0200

A vulnerability, which was classified as critical, has been found in scalar astro 0.1.13. The impacted element is an unknown function of the component Proxy Endpoint. Performing a manipulation of the argument scalar_url results in unrestricted upload. This vulnerability is identified as CVE-2026-30117. The attack can be initiated remotely. There is not any exploit available.

CVE-2026-30118 | scalar astro 0.1.13 Proxy Endpoint scalar_url server-side request forgery

Sat, 23 May 2026 14:08:55 +0200

A vulnerability identified as critical has been detected in scalar astro 0.1.13. The impacted element is an unknown function of the component Proxy Endpoint. This manipulation of the argument scalar_url causes server-side request forgery. This vulnerability appears as CVE-2026-30118. The attack may be initiated remotely. There is no available exploit.

RTL Nachtjournal Spezial: Cybercrime - Fass ohne Boden? im Stream - Prisma

Fri, 22 May 2026 17:21:35 +0200

RTL Nachtjournal Spezial: Cybercrime - Fass ohne Boden? Gespräch, Talk • Fr., 22.05. • 18 Min.

Das beste Zubehör für die Fritzbox: 10 Upgrades für maximalen Speed und Komfort

Wed, 20 May 2026 09:02:46 +0200

Die Fritzbox ist das Herzstück eines digitalen Zuhauses, ihr volles Potenzial lassen viele aber ungenutzt. Wer lediglich surft und telefoniert, verschenkt wertvolle Möglichkeiten in Sachen Reichweite, Stromersparnis und Komfort. Erst mit dem richtigen Zubehör wird die Box zur Schaltzentrale, die nicht nur Daten überträgt, sondern auch den Alltag spürbar erleichtert – von der automatisierten Heizungssteuerung bis zum blitzschnellen Datentransfer im ganzen Haus.

Wenn Sie bereits einen Router von Fritz (hier finden Sie unsere Bestenliste) im Einsatz haben, merken Sie mit dem richtigen Zubehör sofort: Wenn Hardware und Peripherie Hand in Hand gehen, wird aus einem einfachen Internet-Anschluss ein nahtloses Ökosystem. Für den Alltag heißt das: Mehr Speed, mehr Effizienz und spürbare Komfort-Upgrades.

In unserem Zubehör-Ratgeber zeigen wir Ihnen zehn essenzielle Upgrades, mit denen Sie Ihr Heimnetzwerk auf das nächste Level heben.

Tipp: Wenn Sie noch keine Fritzbox im Einsatz haben oder aktuell noch DSL nutzen, aber demnächst auf Glasfaser umsteigen möchten, dann lohnt sich ein Blick auf die Fritzbox 5690 Pro. Sie ist bereits für das neue Wi-Fi 7 gerüstet und spielt in Kombination mit unseren Zubehör-Tipps alle Asse aus.

Aktuell bester Preis: Fritzbox 5690 Pro

309,99 €

Jetzt ansehen

317,90 €

Jetzt ansehen

329,00 €

Jetzt ansehen

329,00 €

Jetzt ansehen

340,16 €

Jetzt ansehen

345,09 €

Jetzt ansehen

364,19 €

Jetzt ansehen

Fritzfon X6 (weiß oder schwarz)

AVM

Fritzfon X6 bei Amazon ansehen

Preis: rund 84 Euro

Technik:

Hochwertiges 2,4-Zoll-Farbdisplay
HD-Telefonie und Full-Duplex-Freisprechen
Bis zu 16 Stunden Gesprächszeit / 10 Tage Stand-by
Integrierte Steuerung für Smart-Home-Anwendungen
Unterstützung für E-Mails, Webradio, Podcasts und Babyfon-Funktion
Helligkeits- und Bewegungssensor für das Display
Regelmäßige Sicherheits-Updates per Tastendruck
Frei belegbare Favoritentaste für Schnellzugriff

Das Fritzfon X6 dient als direkte Schnittstelle zur Fritzbox und übernimmt Aufgaben, die weit über einfaches Telefonieren hinausgehen. Per Menü lassen sich WLAN-Schaltungen vornehmen, Smart-Home-Komponenten steuern oder die Wiedergabe des Mediaservers verwalten. Das Farbdisplay zeigt zudem Informationen wie Wetterdaten oder das Live-Bild einer kompatiblen Türsprechanlage an.

Durch die nahtlose Integration in das Fritz-System können Telefonbücher und Anrufbeantworter der Box direkt genutzt werden. Das vereinfacht die Einrichtung im Vergleich zu herkömmlichen DECT-Telefonen anderer Hersteller erheblich.

Asus Tri-Band Wi-Fi 7 USB-Adapter (ROG USB-BE92 BE6500)

Amazon/Asus

Asus Tri-Band Wi-Fi 7 USB-Adapter bei Amazon ansehen

Preis: 73 Euro

Technik:

Standard: Wi-Fi 7 (802.11be)
Frequenzbänder: Tri-Band (2,4 GHz, 5 GHz und 6 GHz)
Geschwindigkeit: Bis zu 6.500 Mbit/s Gesamtdatendurchsatz
Kanalbreite: 160 MHz im 6-GHz-Band
Funktionen: Multi-Link Operation (MLO) und 4K-QAM
Anschlüsse: Kompatibel mit USB-Typ-A und Typ-C
Sicherheit: Unterstützt das aktuelle WPA3-Protokoll
Extras: Unterstützung für OFDMA und MU-MIMO

Die ersten Fritzbox-Modelle mit Wi-Fi 7 sind bereits auf dem Markt, dieser USB-Adapter stellt dabei die notwendige Brücke zum PC oder Laptop her. Während viele integrierte WLAN-Karten noch auf älteren Standards funken, ermöglicht der Adapter die Nutzung des störungsarmen 6-GHz-Bandes. Besonders in dicht besiedelten Gebieten mit vielen konkurrierenden Funknetzen sorgt das für eine stabilere Verbindung und geringere Latenzen.

Durch die Unterstützung von USB-A- und USB-C-Anschlüssen lässt sich der Stick flexibel an verschiedenen Hardware-Generationen betreiben, um die hohen Bandbreiten moderner Glasfaser-Anschlüsse auch drahtlos am Endgerät zu empfangen.

Crucial X9 1 TB Externe SSD

Crucial

Crucial X9 1 TB Externe SSD bei Amazon ansehen

Preis: 140 Euro

Technik:

Kapazität: 1 TB (auch bis 4 TB erhältlich)
Schnittstelle: USB-C 3.2 (kompatibel mit USB-A via Adapter)
Geschwindigkeit: Bis zu 1.050 MB/s Leserate
Robustheit: Stoß-, vibrations- und sturzsicher bis 2 Meter Höhe
Dateisystem-Support: Windows Dateiversionsverlauf, Apple Time Machine
Abmessungen: Sehr kompaktes Gehäusedesign (Portable SSD)
Software: Kostenfreie Testzeiträume für Adobe Acrobat Pro und Mylio Photos+ bei Registrierung

Eine externe SSD wie die Crucial X9 erweitert Ihre Fritzbox um einen einfachen Netzwerkspeicher (Fritz NAS). Selbst bei Top-Modellen wie der 5690 Pro bremst die Prozessorleistung des Routers die enorme theoretische Geschwindigkeit der SSD (über 1.000 MB/s) zwar aus, dennoch ist die Kombination für den Alltag ideal: Der Datentransfer ist deutlich flotter als mit alten USB-Sticks, die SSD arbeitet lautlos und verbraucht wenig Energie. Es ist also eine geschickte Lösung, um Fotos oder Dokumente zentral im Heimnetz zu sichern und verfügbar zu machen.

Wichtig: Vor dem Kauf sollten Sie prüfen, ob Ihre Fritzbox über einen USB-3.0-Anschluss verfügt. Einsteiger-Modelle wie die Fritzbox 7510 bieten oft nur langsames USB 2.0, während Varianten ohne USB-Port gar nicht als Netzwerkspeicher genutzt werden können.

Fritz Smart Thermo 302

FRITZ!

Fritz Smart Thermo 302 bei Amazon ansehen

Preis: 69 Euro

Technik:

Display: Kontraststarkes und drehbares E-Paper-Display
Funkstandard: DECT ULE (Reichweite bis zu 40 Meter)
Funktionen: Fenster-auf-Erkennung, Frostschutz, Kalkschutz, Boost-Modus
Bedienung: Tasten am Gerät, App, PC oder Fritzfon
Montage: Kompatibel mit gängigen Ventilen (M30x1,5), Adapter inklusive
Extras: Gruppenschaltung, individuelle Heizprofile, Urlaubsmodus
Energie: Betrieb über zwei AA-Batterien

Der Fritz Smart Thermo 302 macht die Heizung zum Teil des Heimnetzes und ermöglicht eine zeitgesteuerte Regulierung der Raumtemperatur. Die Einrichtung erfolgt direkt über die Fritzbox, wobei für jeden Wochentag individuelle Heiz- und Absenkphasen festgelegt werden können. Ein klarer Vorteil gegenüber WLAN-Lösungen ist dabei der sparsame DECT-Funk, der lange Batterielaufzeiten ermöglicht.

Weil der Regler die Fenster-offen-Erkennung direkt integriert hat, regelt er die Temperatur bei plötzlichem Abfall automatisch herunter, um Energie zu sparen. Besonders komfortabel ist die Steuerung per Fritzfon oder eine Gruppenschaltung, bei der mehrere Heizkörper synchron auf eine Zieltemperatur eingestellt werden.

Fritz-Repeater 6000 (Wi-Fi 6)

FRITZ!

Fritz-Repeater 6000 (Wi-Fi 6) bei Amazon ansehen

Preis: 260 Euro

Technik:

Standard: Wi-Fi 6 (WLAN AX)
Funkeinheiten: Drei (Triband-Technologie)
Geschwindigkeit: Bis zu 6.000 MBit/s (2.400 + 2.400 + 1.200 MBit/s)
Anschlüsse: 1x 2,5-Gigabit-LAN, 1x Gigabit-LAN
Funktionen: WLAN Mesh, intelligente Bandauswahl, WPS-Einrichtung
Sicherheit: WPA3-Verschlüsselung integriert
Bauweise: Standgerät mit externem Netzteil

Der Fritz-Repeater 6000 ist das aktuell leistungsstärkste Modell im Fritz-Sortiment für Nutzer, die große Wohnflächen oder mehrere Etagen mit schnellem WLAN versorgen möchten (zumindest, bis der neue 6700 Pro in die Regale kommt). Dank seiner drei Funkeinheiten steht hier ein eigenes Band exklusiv für die Kommunikation zwischen Router und Repeater zur Verfügung – der sonst übliche Geschwindigkeitsverlust wird dadurch halbiert.

Auch der 2,5-Gigabit-LAN-Port ist vorteilhaft: Er ermöglicht es, den Repeater per Kabel als schnellen Zugangspunkt (LAN-Brücke) zu nutzen oder datenhungrige Geräte wie Spielekonsolen oder PCs stabil anzubinden. Im Zusammenspiel mit einer Fritzbox bildet er ein nahtloses Mesh-Netzwerk, bei dem mobile Endgeräte automatisch immer mit dem stärksten Zugangspunkt verbunden werden.

Fritz Smart Control 350 (magnetischer Tür-/Fensterkontakt)

FRITZ!

Fritz Smart Control 350 bei Amazon ansehen

Preis: 40 Euro

Technik:

Typ: Magnetischer Sensor (zweiteilig: Sensor und Magnet)
Funkstandard: DECT ULE
Erkennung: Geöffnet, geschlossen oder gekippt (je nach Montage)
Montage: Klebestreifen für Rahmen oder Flügel
Energie: Betrieb mit 2x AAA-Batterien
Reichweite: Bis zu 40 Meter im Haus
Kompatibilität: Alle Fritzbox-Modelle mit DECT-Basis

Mit dem Fritz Smart Control 350 verkauft Fritz einen dezenten Sensor, der den Status von Fenstern und Türen überwacht und diese Information an die Fritzbox weitergibt. Er dient als optimaler Partner für die smarten Heizkörperregler: Erkennt der Sensor ein offenes Fenster, kann die Heizung im jeweiligen Raum sofort automatisch heruntergeregelt werden. Das funktioniert effektiver als die rein temperaturbasierte Erkennung eines Thermostats.

Durch die kompakte Bauweise lässt sich der Magnet oft so im Rahmen montieren, dass er bei geschlossenem Fenster fast unsichtbar bleibt. Neben der Heizungssteuerung lassen sich auch einfache Sicherheits-Szenarien oder Push-Nachrichten aufs Smartphone einrichten, sobald eine Tür unbefugt geöffnet wird.

Fritz DECT 210

FRITZ!

Fritz DECT 210 bei Amazon ansehen

Preis: 42 Euro

Technik:

Typ: Intelligente Steckdose für den Außenbereich
Schutzart: Spritzwasserschutz nach IP44
Belastbarkeit: Schaltet Geräte bis zu 3.450 Watt
Funkstandard: DECT ULE (Reichweite bis zu 300 Meter im Freien)
Funktionen: Messung von Energieverbrauch, Temperatur und Leistung
Schaltmodi: Zeitplan, Sonnenauf-/untergang, Google-Kalender, Zufall
Bedienung: App, Fritzfon, PC oder direkt am Gerät

Smarte Funktionen im Garten, auf dem Balkon oder in der Garage: Die Fritz DECT 210 macht’s möglich. Dank des robusten Gehäuses inklusive Schutzklappe ist sie gegen Spritzwasser geschützt und hält auch wechselnden Temperaturen stand. Über die Fritzbox lässt sich die Steckdose schalten und als Energiemessgerät nutzen: Sie zeichnet den Stromverbrauch angeschlossener Geräte auf und wertet diesen in einer übersichtlichen Grafik aus.

Besonders praktisch für den Außenbereich ist die Astro-Funktion, die beispielsweise die Gartenbeleuchtung pünktlich zum Sonnenuntergang automatisch einschaltet, ohne dass man die Zeiten manuell nachjustieren muss.

Fritz DECT-Repeater 100

FRITZ!

Fritz DECT-Repeater 100 bei Amazon ansehen

Preis: 78 Euro

Technik:

Typ: Reichweitenverstärker für den DECT-Funk
Kapazität: Unterstützt bis zu drei Gespräche gleichzeitig
Funktionen: Überträgt HD-Telefonie, Internetradio und Podcasts
Sicherheit: Integrierte DECT-Verschlüsselung für abhörsichere Gespräche
Kompatibilität: Alle Fritzbox-Modelle mit DECT-Basis sowie GAP-Basistationen
Besonderheit: Integrierte Steckdose (kein Steckplatz geht verloren)
Einrichtung: Einfache Anmeldung per Tastendruck (WPS/DECT-Taste)

Mit dem Fritz DECT-Repeater 100 gibt es eine Lösung für Haushalte, in denen das Funksignal des Telefons nicht bis in die letzte Ecke oder über mehrere Etagen reicht. Im Gegensatz zu einfachen Verstärkern unterstützt dieses Gerät bei Verbindung mit einer Fritzbox den vollen Funktionsumfang: Auch weit entfernt von der Basis bleiben HD-Telefonie, RSS-Feeds oder der Empfang von E-Mails am Fritzfon stabil.

Ebenfalls praktisch: das Gerät verfügt über eine integrierte Steckdose, damit steht der Anschluss an der Wand weiterhin für andere Elektrogeräte bereit. Durch die Unterstützung von automatischem Handover merkt man den Wechsel zwischen Basis und Repeater während eines Telefonats gar nicht.

Fritz Smart Energy 250

FRITZ!

Fritz Smart Energy 250 bei Amazon ansehen

Preis: 70 Euro

Technik:

Typ: Intelligenter Stromsensor (Infrarot-Ausleseeinheit)
Schnittstelle: Magnetische Befestigung an der INFO-Schnittstelle
Funkstandard: DECT ULE
Stromversorgung: 2x AA-Batterien oder via USB-Anschluss
Kompatibilität: Für die meisten digitalen Stromzähler (Infrarot-Schnittstelle)
Auswertung: Fritz-App Smart Home, FritzOS oder Myfritz-Net
Features: Echtzeit-Verbrauchsdaten, historische Auswertung, Auslöser für Automationen

Wer sich mehr Transparenz beim Stromverbrauch im ganzen Haushalt wünscht, greift zum Fritz Smart Energy 250. Anstatt manuell und mühsam den Zählerstand zu notieren, liest dieser Sensor die Daten direkt am digitalen Stromzähler aus und überträgt sie per Funk an die Fritzbox. Dadurch lässt sich der aktuelle Stromverbrauch jederzeit per App kontrollieren. Versteckten Energiefressern kommen Sie so besonders schnell auf die Schliche.

Besonders interessant für Smart-Home-Nutzer: Die gemessenen Werte können als Auslöser für verschiedene Szenarien dienen – so lässt sich beispielsweise eine Benachrichtigung einrichten, wenn die Leistungsaufnahme einen bestimmten Wert überschreitet.

Fritz Powerline 1260

FRITZ!

Fritz Powerline 1260 bei Amazon ansehen

Preis: 105 Euro

Technik:

Typ: Powerline-Einzeladapter mit WLAN-Funktion
Geschwindigkeit (Stromnetz): Bis zu 1.200 MBit/s
WLAN: Dualband AC+N (bis zu 866 + 400 MBit/s)
Anschluss: 1x Gigabit-LAN-Port
Technologie: 2×2 MIMO (nutzt zwei Adernpaare im Stromnetz)
Sicherheit: WPA2-Verschlüsselung und ab Werk verschlüsselte Powerline-Verbindung
Mesh-Unterstützung: Automatische Übernahme der WLAN-Einstellungen der Fritzbox

Fritz Powerline 1260 ist der Problemlöser für Räume, in denen weder WLAN-Signale noch Netzwerkkabel ankommen. Weil Daten damit über die Stromleitung transportiert werden, lassen sich selbst massive Wände oder weite Strecken zum Keller oder Dachboden überbrücken. An der Zielsteckdose fungiert der Adapter gleichzeitig als LAN-Anschluss für Geräte wie Smart-TVs oder Spielekonsolen und als WLAN-Access-Point. Innerhalb eines Fritz-Heimnetzes integriert er sich nahtlos in das Mesh-System, sodass mobile Geräte ohne Verbindungsabbruch zwischen Router und Powerline-Adapter wechseln können.

Hinweis: Da es sich hier um einen Einzeladapter handelt, wird für den Aufbau eines Powerline-Netzwerks ein zweites Gegenstück (ein weiterer Powerline-Adapter) benötigt, das per LAN-Kabel mit der Fritzbox verbunden ist.

CVE-2026-4317 | Umami Software application 3.0.2 Request Parameter prisma.rawQuery/prisma.queryRawUnsafe sql injection

Wed, 20 May 2026 02:50:21 +0200

A vulnerability has been found in Umami Software application 3.0.2 and classified as critical. Affected by this vulnerability is an unknown functionality of the component Request Parameter Handler. This manipulation of the argument prisma.rawQuery/prisma.queryRawUnsafe causes sql injection. This vulnerability appears as CVE-2026-4317. The attack may be initiated remotely. There is no available exploit.

Das beste Zubehör für die Fritzbox: 10 Upgrades für maximalen Speed und Komfort

Tue, 19 May 2026 08:47:17 +0200

In unserem Zubehör-Ratgeber zeigen wir Ihnen zehn essenzielle Upgrades, mit denen Sie Ihr Heimnetzwerk auf das nächste Level heben.

Aktuell bester Preis: Fritzbox 5690 Pro

309,00 €

Jetzt ansehen

317,90 €

Jetzt ansehen

329,00 €

Jetzt ansehen

329,00 €

Jetzt ansehen

340,15 €

Jetzt ansehen

345,09 €

Jetzt ansehen

364,19 €

Jetzt ansehen

Fritzfon X6 (weiß oder schwarz)

AVM

Fritzfon X6 bei Amazon ansehen

Preis: rund 84 Euro

Technik:

Hochwertiges 2,4-Zoll-Farbdisplay
HD-Telefonie und Full-Duplex-Freisprechen
Bis zu 16 Stunden Gesprächszeit / 10 Tage Stand-by
Integrierte Steuerung für Smart-Home-Anwendungen
Unterstützung für E-Mails, Webradio, Podcasts und Babyfon-Funktion
Helligkeits- und Bewegungssensor für das Display
Regelmäßige Sicherheits-Updates per Tastendruck
Frei belegbare Favoritentaste für Schnellzugriff

Asus Tri-Band Wi-Fi 7 USB-Adapter (ROG USB-BE92 BE6500)

Amazon/Asus

Asus Tri-Band Wi-Fi 7 USB-Adapter bei Amazon ansehen

Preis: 73 Euro

Technik:

Standard: Wi-Fi 7 (802.11be)
Frequenzbänder: Tri-Band (2,4 GHz, 5 GHz und 6 GHz)
Geschwindigkeit: Bis zu 6.500 Mbit/s Gesamtdatendurchsatz
Kanalbreite: 160 MHz im 6-GHz-Band
Funktionen: Multi-Link Operation (MLO) und 4K-QAM
Anschlüsse: Kompatibel mit USB-Typ-A und Typ-C
Sicherheit: Unterstützt das aktuelle WPA3-Protokoll
Extras: Unterstützung für OFDMA und MU-MIMO

Crucial X9 1 TB Externe SSD

Crucial

Crucial X9 1 TB Externe SSD bei Amazon ansehen

Preis: 140 Euro

Technik:

Kapazität: 1 TB (auch bis 4 TB erhältlich)
Schnittstelle: USB-C 3.2 (kompatibel mit USB-A via Adapter)
Geschwindigkeit: Bis zu 1.050 MB/s Leserate
Robustheit: Stoß-, vibrations- und sturzsicher bis 2 Meter Höhe
Dateisystem-Support: Windows Dateiversionsverlauf, Apple Time Machine
Abmessungen: Sehr kompaktes Gehäusedesign (Portable SSD)
Software: Kostenfreie Testzeiträume für Adobe Acrobat Pro und Mylio Photos+ bei Registrierung

Fritz Smart Thermo 302

FRITZ!

Fritz Smart Thermo 302 bei Amazon ansehen

Preis: 69 Euro

Technik:

Display: Kontraststarkes und drehbares E-Paper-Display
Funkstandard: DECT ULE (Reichweite bis zu 40 Meter)
Funktionen: Fenster-auf-Erkennung, Frostschutz, Kalkschutz, Boost-Modus
Bedienung: Tasten am Gerät, App, PC oder Fritzfon
Montage: Kompatibel mit gängigen Ventilen (M30x1,5), Adapter inklusive
Extras: Gruppenschaltung, individuelle Heizprofile, Urlaubsmodus
Energie: Betrieb über zwei AA-Batterien

Fritz-Repeater 6000 (Wi-Fi 6)

FRITZ!

Fritz-Repeater 6000 (Wi-Fi 6) bei Amazon ansehen

Preis: 260 Euro

Technik:

Standard: Wi-Fi 6 (WLAN AX)
Funkeinheiten: Drei (Triband-Technologie)
Geschwindigkeit: Bis zu 6.000 MBit/s (2.400 + 2.400 + 1.200 MBit/s)
Anschlüsse: 1x 2,5-Gigabit-LAN, 1x Gigabit-LAN
Funktionen: WLAN Mesh, intelligente Bandauswahl, WPS-Einrichtung
Sicherheit: WPA3-Verschlüsselung integriert
Bauweise: Standgerät mit externem Netzteil

Fritz Smart Control 350 (magnetischer Tür-/Fensterkontakt)

FRITZ!

Fritz Smart Control 350 bei Amazon ansehen

Preis: 40 Euro

Technik:

Typ: Magnetischer Sensor (zweiteilig: Sensor und Magnet)
Funkstandard: DECT ULE
Erkennung: Geöffnet, geschlossen oder gekippt (je nach Montage)
Montage: Klebestreifen für Rahmen oder Flügel
Energie: Betrieb mit 2x AAA-Batterien
Reichweite: Bis zu 40 Meter im Haus
Kompatibilität: Alle Fritzbox-Modelle mit DECT-Basis

Fritz DECT 210

FRITZ!

Fritz DECT 210 bei Amazon ansehen

Preis: 42 Euro

Technik:

Typ: Intelligente Steckdose für den Außenbereich
Schutzart: Spritzwasserschutz nach IP44
Belastbarkeit: Schaltet Geräte bis zu 3.450 Watt
Funkstandard: DECT ULE (Reichweite bis zu 300 Meter im Freien)
Funktionen: Messung von Energieverbrauch, Temperatur und Leistung
Schaltmodi: Zeitplan, Sonnenauf-/untergang, Google-Kalender, Zufall
Bedienung: App, Fritzfon, PC oder direkt am Gerät

Fritz DECT-Repeater 100

FRITZ!

Fritz DECT-Repeater 100 bei Amazon ansehen

Preis: 78 Euro

Technik:

Typ: Reichweitenverstärker für den DECT-Funk
Kapazität: Unterstützt bis zu drei Gespräche gleichzeitig
Funktionen: Überträgt HD-Telefonie, Internetradio und Podcasts
Sicherheit: Integrierte DECT-Verschlüsselung für abhörsichere Gespräche
Kompatibilität: Alle Fritzbox-Modelle mit DECT-Basis sowie GAP-Basistationen
Besonderheit: Integrierte Steckdose (kein Steckplatz geht verloren)
Einrichtung: Einfache Anmeldung per Tastendruck (WPS/DECT-Taste)

Fritz Smart Energy 250

FRITZ!

Fritz Smart Energy 250 bei Amazon ansehen

Preis: 70 Euro

Technik:

Typ: Intelligenter Stromsensor (Infrarot-Ausleseeinheit)
Schnittstelle: Magnetische Befestigung an der INFO-Schnittstelle
Funkstandard: DECT ULE
Stromversorgung: 2x AA-Batterien oder via USB-Anschluss
Kompatibilität: Für die meisten digitalen Stromzähler (Infrarot-Schnittstelle)
Auswertung: Fritz-App Smart Home, FritzOS oder Myfritz-Net
Features: Echtzeit-Verbrauchsdaten, historische Auswertung, Auslöser für Automationen

Fritz Powerline 1260

FRITZ!

Fritz Powerline 1260 bei Amazon ansehen

Preis: 105 Euro

Technik:

Typ: Powerline-Einzeladapter mit WLAN-Funktion
Geschwindigkeit (Stromnetz): Bis zu 1.200 MBit/s
WLAN: Dualband AC+N (bis zu 866 + 400 MBit/s)
Anschluss: 1x Gigabit-LAN-Port
Technologie: 2×2 MIMO (nutzt zwei Adernpaare im Stromnetz)
Sicherheit: WPA2-Verschlüsselung und ab Werk verschlüsselte Powerline-Verbindung
Mesh-Unterstützung: Automatische Übernahme der WLAN-Einstellungen der Fritzbox

Sender verliert Fußball-WM-Lizenz wegen "hemmungsloser Piraterie"

Mon, 18 May 2026 16:08:35 +0200

Über 20 Jahre lang galt der Sender Astro in Malaysia als die feste Heimat für die Fußball-Weltmeisterschaft. Doch nun kapituliert der Pay-TV-Gigant vor der ausufernden Piraterie und überlässt die WM 2026 dem staatlichen Free-TV. (Weiter lesen)

Das beste Zubehör für die Fritzbox: 10 Upgrades für maximalen Speed und Komfort

Mon, 18 May 2026 10:40:31 +0200

In unserem Zubehör-Ratgeber zeigen wir Ihnen zehn essenzielle Upgrades, mit denen Sie Ihr Heimnetzwerk auf das nächste Level heben.

Aktuell bester Preis: Fritzbox 5690 Pro

309,00 €

Jetzt ansehen

309,00 €

Jetzt ansehen

317,90 €

Jetzt ansehen

329,00 €

Jetzt ansehen

329,00 €

Jetzt ansehen

329,30 €

Jetzt ansehen

343,99 €

Jetzt ansehen

345,09 €

Jetzt ansehen

Fritzfon X6 (weiß oder schwarz)

AVM

Fritzfon X6 bei Amazon ansehen

Preis: rund 84 Euro

Technik:

Hochwertiges 2,4-Zoll-Farbdisplay
HD-Telefonie und Full-Duplex-Freisprechen
Bis zu 16 Stunden Gesprächszeit / 10 Tage Stand-by
Integrierte Steuerung für Smart-Home-Anwendungen
Unterstützung für E-Mails, Webradio, Podcasts und Babyfon-Funktion
Helligkeits- und Bewegungssensor für das Display
Regelmäßige Sicherheits-Updates per Tastendruck
Frei belegbare Favoritentaste für Schnellzugriff

Asus Tri-Band Wi-Fi 7 USB-Adapter (ROG USB-BE92 BE6500)

Amazon/Asus

Asus Tri-Band Wi-Fi 7 USB-Adapter bei Amazon ansehen

Preis: 73 Euro

Technik:

Standard: Wi-Fi 7 (802.11be)
Frequenzbänder: Tri-Band (2,4 GHz, 5 GHz und 6 GHz)
Geschwindigkeit: Bis zu 6.500 Mbit/s Gesamtdatendurchsatz
Kanalbreite: 160 MHz im 6-GHz-Band
Funktionen: Multi-Link Operation (MLO) und 4K-QAM
Anschlüsse: Kompatibel mit USB-Typ-A und Typ-C
Sicherheit: Unterstützt das aktuelle WPA3-Protokoll
Extras: Unterstützung für OFDMA und MU-MIMO

Crucial X9 1 TB Externe SSD

Crucial

Crucial X9 1 TB Externe SSD bei Amazon ansehen

Preis: 140 Euro

Technik:

Kapazität: 1 TB (auch bis 4 TB erhältlich)
Schnittstelle: USB-C 3.2 (kompatibel mit USB-A via Adapter)
Geschwindigkeit: Bis zu 1.050 MB/s Leserate
Robustheit: Stoß-, vibrations- und sturzsicher bis 2 Meter Höhe
Dateisystem-Support: Windows Dateiversionsverlauf, Apple Time Machine
Abmessungen: Sehr kompaktes Gehäusedesign (Portable SSD)
Software: Kostenfreie Testzeiträume für Adobe Acrobat Pro und Mylio Photos+ bei Registrierung

Fritz Smart Thermo 302

FRITZ!

Fritz Smart Thermo 302 bei Amazon ansehen

Preis: 69 Euro

Technik:

Display: Kontraststarkes und drehbares E-Paper-Display
Funkstandard: DECT ULE (Reichweite bis zu 40 Meter)
Funktionen: Fenster-auf-Erkennung, Frostschutz, Kalkschutz, Boost-Modus
Bedienung: Tasten am Gerät, App, PC oder Fritzfon
Montage: Kompatibel mit gängigen Ventilen (M30x1,5), Adapter inklusive
Extras: Gruppenschaltung, individuelle Heizprofile, Urlaubsmodus
Energie: Betrieb über zwei AA-Batterien

Fritz-Repeater 6000 (Wi-Fi 6)

FRITZ!

Fritz-Repeater 6000 (Wi-Fi 6) bei Amazon ansehen

Preis: 260 Euro

Technik:

Standard: Wi-Fi 6 (WLAN AX)
Funkeinheiten: Drei (Triband-Technologie)
Geschwindigkeit: Bis zu 6.000 MBit/s (2.400 + 2.400 + 1.200 MBit/s)
Anschlüsse: 1x 2,5-Gigabit-LAN, 1x Gigabit-LAN
Funktionen: WLAN Mesh, intelligente Bandauswahl, WPS-Einrichtung
Sicherheit: WPA3-Verschlüsselung integriert
Bauweise: Standgerät mit externem Netzteil

Fritz Smart Control 350 (magnetischer Tür-/Fensterkontakt)

FRITZ!

Fritz Smart Control 350 bei Amazon ansehen

Preis: 40 Euro

Technik:

Typ: Magnetischer Sensor (zweiteilig: Sensor und Magnet)
Funkstandard: DECT ULE
Erkennung: Geöffnet, geschlossen oder gekippt (je nach Montage)
Montage: Klebestreifen für Rahmen oder Flügel
Energie: Betrieb mit 2x AAA-Batterien
Reichweite: Bis zu 40 Meter im Haus
Kompatibilität: Alle Fritzbox-Modelle mit DECT-Basis

Fritz DECT 210

FRITZ!

Fritz DECT 210 bei Amazon ansehen

Preis: 42 Euro

Technik:

Typ: Intelligente Steckdose für den Außenbereich
Schutzart: Spritzwasserschutz nach IP44
Belastbarkeit: Schaltet Geräte bis zu 3.450 Watt
Funkstandard: DECT ULE (Reichweite bis zu 300 Meter im Freien)
Funktionen: Messung von Energieverbrauch, Temperatur und Leistung
Schaltmodi: Zeitplan, Sonnenauf-/untergang, Google-Kalender, Zufall
Bedienung: App, Fritzfon, PC oder direkt am Gerät

Fritz DECT-Repeater 100

FRITZ!

Fritz DECT-Repeater 100 bei Amazon ansehen

Preis: 78 Euro

Technik:

Typ: Reichweitenverstärker für den DECT-Funk
Kapazität: Unterstützt bis zu drei Gespräche gleichzeitig
Funktionen: Überträgt HD-Telefonie, Internetradio und Podcasts
Sicherheit: Integrierte DECT-Verschlüsselung für abhörsichere Gespräche
Kompatibilität: Alle Fritzbox-Modelle mit DECT-Basis sowie GAP-Basistationen
Besonderheit: Integrierte Steckdose (kein Steckplatz geht verloren)
Einrichtung: Einfache Anmeldung per Tastendruck (WPS/DECT-Taste)

Fritz Smart Energy 250

FRITZ!

Fritz Smart Energy 250 bei Amazon ansehen

Preis: 70 Euro

Technik:

Typ: Intelligenter Stromsensor (Infrarot-Ausleseeinheit)
Schnittstelle: Magnetische Befestigung an der INFO-Schnittstelle
Funkstandard: DECT ULE
Stromversorgung: 2x AA-Batterien oder via USB-Anschluss
Kompatibilität: Für die meisten digitalen Stromzähler (Infrarot-Schnittstelle)
Auswertung: Fritz-App Smart Home, FritzOS oder Myfritz-Net
Features: Echtzeit-Verbrauchsdaten, historische Auswertung, Auslöser für Automationen

Fritz Powerline 1260

FRITZ!

Fritz Powerline 1260 bei Amazon ansehen

Preis: 105 Euro

Technik:

Typ: Powerline-Einzeladapter mit WLAN-Funktion
Geschwindigkeit (Stromnetz): Bis zu 1.200 MBit/s
WLAN: Dualband AC+N (bis zu 866 + 400 MBit/s)
Anschluss: 1x Gigabit-LAN-Port
Technologie: 2×2 MIMO (nutzt zwei Adernpaare im Stromnetz)
Sicherheit: WPA2-Verschlüsselung und ab Werk verschlüsselte Powerline-Verbindung
Mesh-Unterstützung: Automatische Übernahme der WLAN-Einstellungen der Fritzbox

CVE-2026-0265: Authentication Bypass in Palo Alto Networks PAN-OS

Thu, 14 May 2026 21:52:49 +0200

Overview

On May 13, 2026, Palo Alto Networks published a security advisory for CVE-2026-0265, a signature verification vulnerability that facilitates authentication bypass on PAN-OS, the operating system that most Palo Alto Networks firewalls run. This vulnerability allows a remote unauthenticated attacker with network access to bypass authentication when Cloud Authentication Service (CAS) is enabled and attached to a login interface; the vulnerable configuration is non-default but common. CVE-2026-0265 affects PAN-OS on PA-Series and VM-Series firewalls, as well as Panorama (virtual and M-Series) appliances. Cloud NGFW and Prisma Access are not affected.

Palo Alto Networks assigned CVE-2026-0265 a “High” 7.2 CVSS score. The advisory states that the vulnerability’s severity scoring depends on interface exposure; according to the vendor, risk is highest for unrestricted management interfaces equipped with CAS, while other login portals, such as GlobalProtect gateways, are lower risk. However, the researcher who reported the vulnerability, Harsh Jaiswal of HacktronAI, publicly disputed the vendor’s severity rating. Jaiswal stated on social media that the vulnerability advisory misrepresents the criticality of the bug and the affected components; according to the HacktronAI research team, they successfully exploited CVE-2026-0265 to bypass authentication controls on multiple corporations’ GlobalProtect portals and establish VPN access. Jaiswal stated that internet-facing components are affected, and HacktronAI plans to disclose full technical details the week of May 18.

As of May 14, Palo Alto Networks has not confirmed exploitation in-the-wild of CVE-2026-0265, and there is no public proof-of-concept exploit available. However, given the researcher's statements about the practical exploitability of this vulnerability and the pending disclosure of technical details, this will likely evolve. PAN-OS software has been a frequent target for threat actors; on May 6, 2026, the PAN-OS vulnerability CVE-2026-0300 was added to CISA's Known Exploited Vulnerabilities (KEV) catalog. Patches for many affected version streams were published on May 13, and the remaining patches are expected on May 28, 2026.

Mitigation guidance

Organizations running PA-Series or VM-Series firewalls, or Panorama (virtual and M-Series) appliances, with Cloud Authentication Service (CAS) enabled should upgrade to a fixed version on an emergency basis. Patches are partially available, with many version stream fixes published on May 13 and additional version stream coverage expected on May 28. The following table outlines the affected and fixed versions:

PAN-OS version	Affected	Fixed
12.1	< 12.1.4-h5 < 12.1.7	>= 12.1.4-h5 >= 12.1.7 (ETA: 05/28)
11.2	< 11.2.4-h17 < 11.2.7-h13 < 11.2.10-h6 < 11.2.12	>= 11.2.4-h17 (ETA: 05/28) >= 11.2.7-h13 >= 11.2.10-h6 >= 11.2.12 (ETA: 05/28)
11.1	< 11.1.4-h33 < 11.1.6-h32 < 11.1.7-h6 < 11.1.10-h25 < 11.1.13-h5 < 11.1.15	>= 11.1.4-h33 >= 11.1.6-h32 >= 11.1.7-h6 (ETA: 05/28) >= 11.1.10-h25 >= 11.1.13-h5 >= 11.1.15 (ETA: 05/28)
10.2	< 10.2.7-h34 < 10.2.10-h36 < 10.2.13-h21 < 10.2.16-h7 < 10.2.18-h6	>= 10.2.7-h34 (ETA: 05/28) >= 10.2.10-h36 >= 10.2.13-h21 (ETA: 05/28) >= 10.2.16-h7 (ETA: 05/28) >= 10.2.18-h6
Cloud NGFW	Not affected	N/A
Prisma Access	Not affected	N/A

Older unsupported PAN-OS versions should be upgraded to a supported fixed version.

To determine if an environment is vulnerable, the official advisory provides instructions to verify whether an authentication profile using CAS is enabled and attached to a login interface. Due to discrepancies in the information shared by the vendor and reporting researchers, Rapid7 advises patching instead of implementing workarounds, wherever possible.

For the latest official mitigation guidance, please refer to the vendor advisory.

Rapid7 customers

Exposure Command, InsightVM, and Nexpose customers can assess exposure to CVE-2026-0265 with authenticated checks expected to be available in the May 15th content release.

Updates

May 14, 2026: Initial publication.

CVE-2026-0236 | Palo Alto Prisma Browser prior 146.16.6.165 AppleScript Interface code injection (EUVD-2026-30089)

Thu, 14 May 2026 00:09:19 +0200

A vulnerability categorized as critical has been discovered in Palo Alto Prisma Browser. This impacts an unknown function of the component AppleScript Interface. Executing a manipulation can lead to code injection. This vulnerability appears as CVE-2026-0236. The attack requires local access. There is no available exploit. It is advisable to upgrade the affected component.

CVE-2026-0261 | Palo Alto Cloud NGFW/PAN-OS/Prisma Access Management Web Interface os command injection (EUVD-2026-30107)

Thu, 14 May 2026 00:09:18 +0200

A vulnerability categorized as critical has been discovered in Palo Alto Cloud NGFW, PAN-OS and Prisma Access. This issue affects some unknown processing of the component Management Web Interface. Such manipulation leads to os command injection. This vulnerability is documented as CVE-2026-0261. The attack needs to be performed locally. There is not any exploit available.

CVE-2026-0262 | Palo Alto Cloud NGFW/PAN-OS/Prisma Access unusual condition (EUVD-2026-30108)

Thu, 14 May 2026 00:09:10 +0200

A vulnerability identified as critical has been detected in Palo Alto Cloud NGFW, PAN-OS and Prisma Access. Impacted is an unknown function. Performing a manipulation results in improper check for unusual conditions. This vulnerability is reported as CVE-2026-0262. The attack is possible to be carried out remotely. No exploit exists.

CVE-2026-0263 | Palo Alto Cloud NGFW/PAN-OS/Prisma Access IKEv2 out-of-bounds write (EUVD-2026-30064)

Thu, 14 May 2026 00:09:09 +0200

A vulnerability identified as critical has been detected in Palo Alto Cloud NGFW, PAN-OS and Prisma Access. Affected is an unknown function of the component IKEv2 Handler. The manipulation leads to out-of-bounds write. This vulnerability is traded as CVE-2026-0263. It is possible to initiate the attack remotely. There is no exploit available.

CVE-2026-0264 | Palo Alto Cloud NGFW/PAN-OS/Prisma Access DNS Proxy/DNS Server heap-based overflow (EUVD-2026-30065)

Thu, 14 May 2026 00:09:08 +0200

A vulnerability labeled as critical has been found in Palo Alto Cloud NGFW, PAN-OS and Prisma Access. Affected by this vulnerability is an unknown functionality of the component DNS Proxy/DNS Server. The manipulation results in heap-based buffer overflow. This vulnerability is known as CVE-2026-0264. It is possible to launch the attack remotely. No exploit is available.

CVE-2026-0265 | Palo Alto Cloud NGFW/PAN-OS/Prisma Access Management Interface signature verification (EUVD-2026-30066)

Thu, 14 May 2026 00:09:06 +0200

A vulnerability marked as critical has been reported in Palo Alto Cloud NGFW, PAN-OS and Prisma Access. Affected by this issue is some unknown functionality of the component Management Interface. This manipulation causes improper verification of cryptographic signature. This vulnerability is handled as CVE-2026-0265. The attack can be initiated remotely. There is not any exploit available.

CVE-2026-0237 | Palo Alto Prisma Browser prior 146.16.6.165 improper protection of alternate path (EUVD-2026-30062)

Thu, 14 May 2026 00:09:05 +0200

A vulnerability classified as critical was found in Palo Alto Prisma Browser. The impacted element is an unknown function. The manipulation results in improper protection of alternate path. This vulnerability was named CVE-2026-0237. The attack needs to be approached locally. There is no available exploit. Upgrading the affected component is advised.

CVE-2026-0257 | Palo Alto Cloud NGFW/PAN-OS/Prisma Access GlobalProtect Portal cookie validation (EUVD-2026-30104)

Wed, 13 May 2026 23:36:05 +0200

A vulnerability described as critical has been identified in Palo Alto Cloud NGFW, PAN-OS and Prisma Access. This affects an unknown part of the component GlobalProtect Portal. Such manipulation leads to cookies without validation. This vulnerability is uniquely identified as CVE-2026-0257. The attack can be launched remotely. No exploit exists.

CVE-2026-0256 | Palo Alto Cloud NGFW/PAN-OS/Prisma Access Web Interface cross site scripting (EUVD-2026-30103)

Wed, 13 May 2026 23:36:03 +0200

A vulnerability described as problematic has been identified in Palo Alto Cloud NGFW, PAN-OS and Prisma Access. Impacted is an unknown function of the component Web Interface. Executing a manipulation can lead to cross site scripting. This vulnerability is handled as CVE-2026-0256. The attack can be executed remotely. There is not any exploit available.

CVE-2026-0235 | Palo Alto Prisma Browser prior 146.16.6.165 unusual condition (EUVD-2026-30087)

Wed, 13 May 2026 23:36:02 +0200

A vulnerability was found in Palo Alto Prisma Browser. It has been rated as problematic. This vulnerability affects unknown code. This manipulation causes improper check for unusual conditions. This vulnerability is registered as CVE-2026-0235. The attack needs to be launched locally. No exploit is available. Upgrading the affected component is advised.

CVE-2026-0258 | Palo Alto Cloud NGFW/PAN-OS/Prisma Access IKEv2 server-side request forgery (EUVD-2026-30105)

Wed, 13 May 2026 23:36:01 +0200

A vulnerability, which was classified as critical, has been found in Palo Alto Cloud NGFW, PAN-OS and Prisma Access. Impacted is an unknown function of the component IKEv2 Handler. The manipulation leads to server-side request forgery. This vulnerability is referenced as CVE-2026-0258. Remote exploitation of the attack is possible. No exploit is available.

RTL Mediathek: Barbara Salesch - Das Strafgericht im Stream - Prisma

Sat, 09 May 2026 17:26:48 +0200

Barbara Salesch - Das Strafgericht - Hacker-Angriff auf Taxi - Tragischer Crash mit schwangerem Fahrgast. Doku-Soap, Serie • Do., 23.04. • 43 Min ...

Proactive Preparation and Hardening Against Destructive Attacks: 2026 Edition

Fri, 08 May 2026 23:19:55 +0200

Written by: Matthew McWhirt, Bhavesh Dhake, Emilio Oropeza, Gautam Krishnan, Stuart Carrera, Greg Blaum, Michael Rudden

UPDATE (March 13): Added guidance around abuse or misuse of endpoint / MDM platforms.

Background

Threat actors leverage destructive malware to destroy data, eliminate evidence of malicious activity, or manipulate systems in a way that renders them inoperable. Destructive cyberattacks can be a powerful means to achieve strategic or tactical objectives; however, the risk of reprisal is likely to limit the frequency of use to very select incidents. Destructive cyberattacks can include destructive malware, wipers, or modified ransomware.

When conflict erupts, cyber attacks are an inexpensive and easily deployable weapon. It should come as no surprise that instability leads to increases in attacks. This blog post provides proactive recommendations for organizations to prioritize for protecting against a destructive attack within an environment. The recommendations include practical and scalable methods that can help protect organizations from not only destructive attacks, but potential incidents where a threat actor is attempting to perform reconnaissance, escalate privileges, laterally move, maintain access, and achieve their mission.

The detection opportunities outlined in this blog post are meant to act as supplementary monitoring to existing security tools. Organizations should leverage endpoint and network security tools as additional preventative and detective measures. These tools use a broad spectrum of detective capabilities, including signatures and heuristics, to detect malicious activity with a reasonable degree of fidelity. The custom detection opportunities referenced in this blog post are correlated to specific threat actor behavior and are meant to trigger anomalous activity that is identified by its divergence from normal patterns. Effective monitoring is dependent on a thorough understanding of an organization's unique environment and usage of pre-established baselines.

Organizational Resilience

While the core focus of this blog post is aligned to technical- and tactical-focused security controls, technical preparation and recovery are not the only strategies. Organizations that include crisis preparation and orchestration as key components of security governance can naturally adopt a "living" resilience posture. This includes:

Out-of-Band Incident Command and Communication: Establish a pre-validated, "out-of-band" communication platform that is completely decoupled from the corporate identity plane. This ensures that the key stakeholders and third-party support teams can coordinate and communicate securely, even if the primary communication platform is unavailable.
Defined Operational Contingency and Recovery Plans: Establish baseline operational requirements, including manual procedures for vital business functions to ensure continuity during restoration or rebuild efforts. Organizations must also develop prioritized application recovery sequences and map the essential dependencies needed to establish a secure foundation for recovery goals.
Pre-Establish Trusted Third-Party Vendor Relationships: Based on the range of technologies and platforms vital to business operations, develop predefined agreements with external partners to ensure access to specialists for legal / contractual requirements, incident response, remediation, recovery, and ransomware negotiations.
Practice and Refine the Recovery: Conduct exercises that validate the end-to-end restoration of mission-critical services using isolated, immutable backups and out-of-band communication channels, ensuring that recovery timelines (RTO) and data integrity (RPO) are tested, practiced, and current.

Google Security Operations

Google Security Operations (SecOps) customers have access to these broad category rules and more under the Mandiant Intel Emerging Threats, Mandiant Frontline Threats, Mandiant Hunting Rules, CDIR SCC Enhanced Data Destruction Alerts rule packs. The activity discussed in the blog post is detected in Google SecOps under the rule names:

BABYWIPER File Erasure
Secure Evidence Destruction And Cleanup Commands
CMD Launching Application Self Delete
Copy Binary From Downloads
Rundll32 Execution Of Dll Function Name Containing Special Character
Services Launching Cmd
System Process Execution Via Scheduled Task
Dllhost Masquerading
Backdoor Writing Dll To Disk For Injection
Multiple Exclusions Added To Windows Defender In Single Command
Path Exclusion Added to Windows Defender
Registry Change to CurrentControlSet Services
Powershell Set Content Value Of 0
Overwrite Disk Using DD Utility
Bcdedit Modifications Via Command
Disabling Crash Dump For Drive Wiping
Suspicious Wbadmin Commands
Fsutil File Zero Out

Recommendations Summary

Table 1 provides a high-level overview of guidance in this blog post.

Focus Area	Description
External-Facing Assets	Protect against the risk of threat actors exploiting an externally facing vector or leveraging existing technology for unauthorized remote access.
Critical Asset Protections	Protect specific high-value infrastructure and prepare for recovery from a destructive attack.
On-Premises Lateral Movement Protections	Protect against a threat actor with initial access into an environment from moving laterally to further expand their scope of access and persistence.
Credential Exposure and Account Protections	Protect against the exposure of privileged credentials to facilitate privilege escalation.
Preventing Destructive Actions in Kubernetes and CI/CD Pipelines	Protect the integrity and availability of Kubernetes environments and CI/CD pipelines.

Table 1: Overview of recommendations

1. External-Facing Assets

Identify, Enumerate, and Harden

To protect against a threat actor exploiting vulnerabilities or misconfigurations via an external-facing vector, organizations must determine the scope of applications and organization-managed services that are externally accessible. Externally accessible applications and services (including both on-premises and cloud) are often targeted by threat actors for initial access by exploiting known vulnerabilities, brute-forcing common or default credentials, or authenticating using valid credentials.

To proactively identify and validate external-facing applications and services, consider:

Leveraging a vulnerability scanning technology to identify assets and associated vulnerabilities.
Performing a focused vulnerability assessment or penetration test with the goal of identifying external-facing vectors that could be leveraged for authentication and access.
Verifying with technology vendors if the products leveraged by an organization for external-facing services require patches or updates to mitigate known vulnerabilities.

Any identified vulnerabilities should not only be patched and hardened, but the identified technology platforms should also be reviewed to ensure that evidence of suspicious activity or technology/device modifications have not already occurred.

The following table provides an overview of capabilities to proactively review and identify external-facing assets and resources within common cloud-based infrastructures.

Cloud Provider	Attack Surface Discovery Capability
Google Cloud	Security Command Center
Amazon Web Services	AWS Config / Inspector
Microsoft Azure	Defender External Attack Surface Management (Defender EASM)

Table 2: Overview of cloud provider attack surface discovery capabilities

Enforce Multi-Factor Authentication

External-facing assets that leverage single-factor authentication (SFA) are highly susceptible to brute-forcing attacks, password spraying, or unauthorized remote access using valid (stolen) credentials. External-facing applications and services that currently allow for SFA should be configured to support multi-factor authentication (MFA). Additionally, MFA should be leveraged for accessing not only on-premises external-facing managed infrastructure, but also for cloud-based resources (e.g., software-as-a-service [SaaS] such as Microsoft 365 [M365]).

When configuring multifactor authentication, the following methods are commonly considered (and ranked from most to least secure):

Fast IDentity Online 2 (FIDO2)/WebAuthn security keys or passkeys
Software/hardware Open Authentication (OAUTH) token
Authenticator application (e.g., Duo/Microsoft [MS] Authenticator/Okta Verify)
Time-based One Time Password (TOTP)
Push notification (least preferred option) using number matching when possible
Phone call
Short Message Service (SMS) verification
Email-based verification

Risks of Specific MFA Methods

Push Notifications

If an organization is leveraging push notifications for MFA (e.g., a notification that requires acceptance via an application or automated call to a mobile device), threat actors can exploit this type of MFA configuration for attempted access, as a user may inadvertently accept a push notification on their device without the context of where the authentication was initiated.

Phone/SMS Verification

If an organization is leveraging phone calls or SMS-based verification for MFA, these methods are not encrypted and are susceptible to potentially being intercepted by a threat actor. These methods are also vulnerable if a threat actor is able to transfer an employee's phone number to an attacker-controlled subscriber identification module (SIM) card. This would result in the MFA notifications being routed to the threat actor instead of the intended employee.

Email-Based Verification

If an organization is leveraging email-based verification for validating access or for retrieving MFA codes, and a threat actor has already established the ability to access the email of their target, the actor could potentially also retrieve the email(s) to validate and complete the MFA process.

If any of these MFA methods are leveraged, consider:

Training remote users to never accept or respond to a logon notification when they are not actively attempting to log in.
Establishing a method for users to report suspicious MFA notifications, as this could be indicative of a compromised account.
Ensuring there are messaging policies in place to prevent the auto-forwarding of email messages outside the organization.

Time-Based One-Time Password

Time-based one-time password (TOTP) relies on a shared secret, called a seed, known by both the authenticating system and the authenticator possessed by an end user. If a seed is compromised, the TOTP authenticator can be duplicated and used by a threat actor.

Detection Opportunities for External-Facing Assets and MFA Attempts

Use Case	MITRE ID	Description
Brute Force	T1110 – Brute Force	Search for a single user with an excessive number of failed logins from external Internet Protocol (IP) addresses. This risk can be mitigated by enforcing a strong password, MFA, and lockout policy.
Password Spray	T1110.003 – Password Spray	Search for a high number of accounts with failed logins, typically from the similar origination addresses.
Multiple Failed MFA Same User	T1110 – Brute Force T1078 – Valid Accounts	Search for multiple failed MFA conditions for the same account. This may be indicative of a previously compromised credential.
Multiple Failed MFA Same Source	T1110.003 – Password Spray T1078 – Valid Accounts	Search for multiple failed MFA prompts for different users from the same source. This may be indicative of multiple compromised credentials and an attempt to "spray" MFA prompts/tokens for access.
External Authentication from an Account with Elevated Privileges	T1078 – Valid Accounts	Privileged accounts should use internally managed and secured privileged access workstations for access and should not be accessible directly from an external (untrusted) source.
Adversary in the Middle (AiTM) Session Token Theft	T1557 - Adversary in the Middle	Monitor for sign-ins where the authentication method succeeds but the session originates from an IP/ASN inconsistent with the user's prior sessions. Detect logins from newly registered domains or known reverse-proxy infrastructure (EvilProxy, Tycoon 2FA). Correlate sign-in logs for "isInteractive: true" sessions with anomalous user-agent strings or geographically impossible travel.
MFA Fatigue / Prompt Bombing	T1621 - MFA Request Generation	Search for accounts receiving more than five MFA push notifications within a 10-minute window without a corresponding successful authentication.
Post-Authentication MFA Device Registration	T1098.005 - Account Manipulation - Device Registration	Monitor audit logs for new MFA device registrations (AuthenticationMethodRegistered) occurring within 60 minutes of a sign-in from a new IP or device. Attackers who steal session tokens via AiTM immediately register their own MFA device for persistent access.
OAuth/Consent Phishing	T1550.001 - Use Alternate Authentication Material	Monitor for OAuth application consent grants with high-privilege scopes (Mail.Read, Files.ReadWrite.All) from unrecognized application IDs.

Table 3: Detection opportunities for external-facing assets and MFA attempts

2. Critical Asset Protections

Domain Controller and Critical Asset Backups

Organizations should verify that backups for domain controllers and critical assets are available and protected against unauthorized access or modification. Backup processes and procedures should be exercised on a continual basis. Backups should be protected and stored within secured enclaves that include both network and identity segmentation.

If an organization's Active Directory (AD) were to become corrupted or unavailable due to ransomware or a potentially destructive attack, restoring Active Directory from domain controller backups may be the only viable option to reconstitute domain services. The following domain controller recovery and reconstitution best practices should be proactively reviewed by organizations:

Verify that there is a known good backup of domain controllers and SYSVOL shares (e.g., from a domain controller – backup C:\Windows\SYSVOL).
- For domain controllers, a system state backup is preferred.
  
  Note: For a system state backup to occur, Windows Server Backup must be installed as a feature on a domain controller.
- The following command can be run from an elevated command prompt to initiate a system state backup of a domain controller.

wbadmin start systemstatebackup -backuptarget::

Figure 1: Command to perform a system state backup

- The following command can be run from an elevated command prompt to perform a SYSVOL backup. (Manage auditing and security log permissions must also be configured for the account performing the backup.)

robocopy c:\windows\sysvol c:\sysvol-backup /copyall /mir /b /r:0 /xd

Figure 2: Command to perform a SYSVOL backup

Proactively identify domain controllers that hold flexible single master operation (FSMO) roles, as these domain controllers will need to be prioritized for recovery in the event that a full domain restoration is required.

netdom query fsmo

Figure 3: Command to identify domain controllers that hold FSMO roles

Offline backups: Ensure offline domain controller backups are secured and stored separately from online backups.
Encryption: Backup data should be encrypted both during transit (over the wire) and when at rest or mirrored for offsite storage.
DSRM Password validation: Ensure that the Directory Services Restore Mode (DSRM) password is set to a known value for each domain controller. This password is required when performing an authoritative or nonauthoritative domain controller restoration.
Configure alerting for backup operations: Backup products and technologies should be configured to detect and provide alerting for operations critical to the availability and integrity of backup data (e.g., deletion of backup data, purging of backup metadata, restoration events, media errors).
Enforce role-based access control (RBAC): Access to backup media and the applications that govern and manage data backups should use RBAC to restrict the scope of accounts that have access to the stored data and configuration parameters.
Testing and verification: Both authoritative and nonauthoritative domain controller restoration processes should be documented and tested on a regular basis. The same testing and verification processes should be enforced for critical assets and data.

Business Continuity Planning

Critical asset recovery is dependent upon in-depth planning and preparation, which is often included within an organization's business continuity plan (BCP). Planning and recovery preparation should include the following core competencies:

A well-defined understanding of crown jewels data and supporting applications that align to backup, failover, and restoration tasks that prioritize mission-critical business operations
Clearly defined asset prioritization and recovery sequencing
Thoroughly documented recovery processes for critical systems and data
Trained personnel to support recovery efforts
Validation of recovery processes to ensure successful execution
Clear delineation of responsibility for managing and verifying data and application backups
Online and offline data backup retention policies, including initiation, frequency, verification, and testing (for both on-premises and cloud-based data)
Established service-level agreements (SLAs) with vendors to prioritize application and infrastructure-focused support

Continuity and recovery planning can become stale over time, and processes are often not updated to reflect environment and personnel changes. Prioritizing evaluations, continuous training, and recovery validation exercises will enable an organization to be better prepared in the event of a disaster.

Detection Opportunities for Backups

Use Case	MITRE ID	Description
Volume Shadow Deletion	T1490 – Inhibit System Recovery	Search for instances where a threat actor will delete volume shadow copies to inhibit system recovery. This can be accomplished using the command line, PowerShell, and other utilities.
Unauthorized Access Attempt	T1078 – Valid Accounts	Search for unauthorized users attempting to access the media and applications that are used to manage data backups.
Suspicious Usage of the DSRM Password	T1078 – Valid Accounts	Monitor security event logs on domain controllers for: Event ID 4794 - An attempt was made to set the Directory Services Restore Mode administrator password Monitoring the following registry key on domain controllers: `HKLM\System\CurrentControlSet\Control\Lsa\DSRMAdminLogonBehavior` Figure 4: DSRM registry key for monitoring The possible values for the registry key noted in Figure 4 are: `0` (default): The DSRM Administrator account can only be used if the domain controller is restarted in Directory Services Restore Mode. `1`: The DSRM Administrator account can be used for a console-based log on if the local Active Directory Domain Services service is stopped. `2`: The DSRM Administrator account can be used for console or network access without needing to reboot a domain controller.

Table 4: Detection opportunities for backups

IT and OT Segmentation

Organizations should ensure that there is both physical and logical segmentation between corporate information technology (IT) domains, identities, networks, and assets and those used in direct support of operational technology (OT) processes and control. By enforcing IT and OT segmentation, organizations can inhibit a threat actor's ability to pivot from corporate environments to mission-critical OT assets using compromised accounts and existing network access paths.

OT environments should leverage separate identity stores (e.g., dedicated Active Directory domains), which are not trusted or cross-used in support of corporate identity and authentication. The compromise of a corporate identity or asset should not result in a threat actor's ability to directly pivot to accessing an asset that has the ability to influence an OT process.

In addition to separate AD forests being leveraged for IT and OT, segmentation should also include technologies that may have a dual use in the IT and OT environments (backup servers, antivirus [AV], endpoint detection and response [EDR], jump servers, storage, virtual network infrastructure). OT segmentation should be designed such that if there is a disruption in the corporate (IT) environment, the OT process can safely function independently, without a direct dependency (account, asset, network pathway) with the corporate infrastructure. For any dependencies that cannot be readily segmented, organizations should identify potential short-term processes or manual controls to ensure that the OT environment can be effectively isolated if evidence of an IT (corporate)-focused incident were detected.

Segmenting IT and OT environments is a best practice recommended by industry standards such as the National Institute of Standards and Technology (NIST) SP 800-82r3: Guide to Operational Technology (OT) Security and IEC 62443 (formerly ISA99).

According to these best-practice standards, segmenting IT and OT networks should include the following:

OT attack surface reduction by restricting the scope of ports, services, and protocols that are directly accessible within the OT network from the corporate (IT) network.
Incoming access from corporate (IT) into OT must terminate within a segmented OT demilitarized zone (DMZ). The OT DMZ must require that a separate level of authentication and access be granted (outside of leveraging an account or endpoint that resides within the corporate IT domain).
Explicit firewall rules should restrict both incoming traffic from the corporate environment and outgoing traffic from the OT environment.
Firewalls should be configured using the principle of deny by default, with only approved and authorized traffic flows permitted. Egress (internet) traffic flows for all assets that support OT should also follow the deny-by-default model.
Identity (account) segmentation must be enforced between corporate IT and OT. An account or endpoint within either environment should not have any permissions or access rights assigned outside of the respective environment.
Remote access to the OT environment should not leverage similar accounts that have remote access permissions assigned within the corporate IT environment. MFA using separate credentials should be enforced for remotely accessing OT assets and resources.
Training and verification of manual control processes, including isolation and reliability verification for safety systems.
Secured enclaves for storing backups, programming logic, and logistical diagrams for systems and devices that comprise the OT infrastructure.
The default usernames and passwords associated with OT devices should always be changed from the default vendor configuration(s).

Detection Opportunities for IT and OT Segmented Environments

Use Case	MITRE ID	Description
Network Service Scanning	T1046 – Network Service Scanning	Search for instances where a threat actor is performing internal network discovery to identify open ports and services between segmented environments.
Unauthorized Authentication Attempts Between Segmented Environments	T1078 – Valid Accounts	Search for failed logins for accounts limited to one environment attempting to log in within another environment. This can detect threat actors attempting to reuse credentials for lateral movement between networks.

Table 5: Detection opportunities for IT and OT segmented environments

Egress Restrictions

Servers and assets that are infrequently rebooted are highly targeted by threat actors for establishing backdoors to create persistent beacons to command-and-control (C2) infrastructure. By blocking or severely limiting internet access for these types of assets, an organization can effectively reduce the risk of a threat actor compromising servers, extracting data, or installing backdoors that leverage egress communications for maintaining access.

Egress restrictions should be enforced so that servers, internal network devices, critical IT assets, OT assets, and field devices cannot attempt to communicate to external sites and addresses (internet resources). The concept of deny by default should apply to all servers, network devices, and critical assets (including both IT and OT), with only allow-listed and authorized egress traffic flows explicitly defined and enforced. Where possible, this should include blocking recursive Domain Name System (DNS) resolutions not included in an allow-list to prevent communication via DNS tunneling.

If possible, egress traffic should be routed through an inspection layer (such as a proxy) to monitor external connections and block any connections to malicious domains or IP addresses. Connections to uncategorized network locations (e.g., a domain that has been recently registered) should not be permitted. Ideally, DNS requests would be routed through an external service (e.g., Cisco Umbrella, Infoblox DDI) to monitor for lookups to malicious domains.

Threat actors often attempt to harvest credentials (including New Technology Local Area Network [LAN] Manager [NTLM] hashes) based upon outbound Server Message Block (SMB) or Web-based Distributed Authoring and Versioning (WebDAV) communications. Organizations should review and limit the scope of egress protocols that are permissible from any endpoint within the environment. While Hypertext Transfer Protocol (HTTP) (Transmission Control Protocol (TCP)/80) and HTTP Secure (HTTPS) (TCP/443) egress communications are likely required for many user-based endpoints, the scope of external sites and addresses can potentially be limited based upon web traffic-filtering technologies. Ideally, organizations should only permit egress protocols and communications based upon a predefined allow-list. Common high-risk ports for egress restrictions include:

File Transfer Protocol (FTP)
Remote Desktop Protocol (RDP)
Secure Shell (SSH)
Server Message Block (SMB)
Trivial File Transfer Protocol (TFTP)
WebDAV

Detection Opportunities for Suspicious Egress Traffic Flows

Use Case	MITRE ID	Description
External Connection Attempt to a Known Malicious IP	TA0011 – Command and Control	Leverage threat feeds to identify attempted connections to known bad IP addresses.
External Communications from Servers, Critical Assets, and Isolated Network Segments	TA0011 – Command and Control	Search for egress traffic flows from subnets and addresses that correlate to servers, critical assets, OT segments, and field devices.
Outbound Connections Attempted Over SMB	T1212 – Exploitation for Credential Access	Search for external connection attempts over SMB, as this may be an attempt to harvest credential hashes.

Table 6: Detection opportunities for suspicious egress traffic flows

Virtualization Infrastructure Protections

Threat actors often target virtualization infrastructure (e.g., VMware vSphere, Microsoft Hyper-V) as part of their reconnaissance, lateral movement, data theft, and potential ransomware deployment objectives. Securing virtualization infrastructure requires a Zero Trust network posture as a primary defense. Because management appliances often lack native MFA for local privileged accounts, identity-based security alone can be a high-risk single point of failure. If credentials are compromised, the logical network architecture becomes the final line of defense protecting the virtualization management plane.

To reduce the attack surface of virtualized infrastructure, a best practice for VMware vSphere vCenter ESXi and Hyper-V appliances and servers is to isolate and restrict access to the management interfaces, essentially enclaving these interfaces within isolated virtual local area networks (VLANs) (network segments) where connectivity is only permissible from dedicated subnets where administrative actions can be initiated.

To protect the virtualization control plane, organizations must consider a "defense-in-depth" network model. This architecture integrates physical isolation and east-west micro-segmentation to remove all access paths from untrusted networks. The result is a management zone that remains isolated and resilient, even during an active intrusion.

VMware vSphere Zero-Trust Network Architecture

The primary goal is to ensure that even if privileged credentials are compromised, the logical network remains the definitive defensive layer preventing access to virtualization management interfaces.

Immutable VLAN Segmentation: Enforce strict isolation using distinct 802.1Q VLAN IDs for host management, Infrastructure/VCSA, vMotion (non-routable), Storage (non-routable), and production Guest VMs.
Virtual Routing and Forwarding (VRF): Transition all infrastructure VLANs into a dedicated VRF instance. This ensures that even a total compromise of the "User" or "Guest" zones results in no available route to the management zone(s).

Layer 3 and 4 Access Policies

The management network must be accessible only from trusted, hardened sources.

PAW-Exclusive Access: Deconstruct all direct routes from the general corporate LAN to management subnets. Access must originate strictly from a designated Privileged Access Workstation (PAW) subnet.
Ingress Filtering (Management Zone):
- ALLOW: TCP/443 (UI/API) and TCP/902 (MKS) from the PAW subnet only.
- DENY: Explicitly block SSH (TCP/22) and VAMI (TCP/5480) from all sources except the PAW subnet.
Restrictive Egress Policy: Enforce outbound filtering at the hardware gateway (as the VCSA GUI cannot manage egress). To prevent persistence using C2 traffic and data exfiltration, block all internet access except to specific, verified update servers (e.g., VMware Update Manager) and authorized identity providers.

Host-Based Firewall Enforcement

Complement network firewalls with host-level filtering to eliminate visibility gaps within the same VLAN.

VCSA (Photon OS): Transition the default policy to "Default Deny" via the VAMI or, preferably, at the OS level using iptables/nftables for granular source/destination mapping.
ESXi Hypervisors: Restrict all services (SSH, Web Access, NFC/Storage) to specific management IPs by deselecting "Allow connections from any IP address."

Additional information related to VMware vSphere VCSA host based firewalls.

A listing of administrative ports associated with VMWare vCenter (that should be targeted for isolation).

Hyper-V Zero-Trust Network Architecture

Similar to vSphere, Hyper-V requires strict isolation of its various traffic types to prevent lateral movement from guest workloads to the management plane.

VLAN Segmentation: Organizations must enforce isolation using distinct VLANs for Host Management, Live Migration, Cluster Heartbeat (CSV), and Production Guest VMs.
Non-Routable Networks: Traffic for Live Migration and Cluster Shared Volumes (CSV) should be placed on non-routable VLANs to ensure these high-bandwidth, sensitive streams cannot be intercepted from other segments.

Layer 3 and 4 Access Policies

The management network must be accessible only from trusted, hardened sources.

PAW-Exclusive Access: Deconstruct all direct routes from the general corporate LAN to management subnets. Access must originate strictly from a designated Privileged Access Workstation (PAW) subnet.
Ingress Filtering (Management Zone):

ALLOW: WinRM / PowerShell Remoting (TCP/5985 and TCP/5986), RDP (TCP/3389), and WMI/RPC (TCP/135 and dynamic RPC ports)strictly from the PAW subnet. If using Windows Admin Center, allow HTTPS (TCP/443) to the gateway.
DENY: Explicitly block SMB (TCP/445), RPC/WMI (TCP/135), and all other management traffic from untrusted sources to prevent credential theft and lateral movement.

Restrictive Egress Policy: Enforce outbound filtering at the network gateway. To prevent persistence using C2 traffic and data exfiltration, block all internet access from Hyper-V hosts except to specific, verified update servers (e.g., internal WSUS), authorized Active Directory Domain Controllers, and Key Management Servers (KMS).

Host-Based Firewall Enforcement

Use the Windows Firewall with Advanced Security (WFAS) to achieve a defense-in-depth posture at the host level.

Scope Restriction: For all enabled management rules (e.g., File and Printer Sharing, WMI, PowerShell Remoting), modify the Remote IP Address scope to "These IP addresses" and enter only the PAW and management server subnets.
Management Logging: Enable logging for Dropped Packets in the Windows Firewall profile. This allows the SIEM to ingest "denied" connection attempts, which serve as high-fidelity indicators of internal reconnaissance or unauthorized access attempts.

Additional information related to Hyper-V host based firewalls.

Additional information related to securing Hyper-V.

General Virtualization Hardening

To protect management interfaces for VMware vSphere the VMKernel network interface card (NIC) should not be bound to the same virtual network assigned to virtual machines running on the host. Additionally, ESXi servers can be configured in lockdown mode, which will only allow console access from the vCenter server(s). Additional information related to lockdown mode.

The SSH protocol (TCP/22) provides a common channel for accessing a physical virtualization server or appliance (vCenter) for administration and troubleshooting. Threat actors commonly leverage SSH for direct access to virtualization infrastructure to conduct destructive attacks. In addition to enclaving access to administrative interfaces, SSH access to virtualization infrastructure should be disabled and only enabled for specific use-cases. If SSH is required, network ACLs should be used to limit where connections can originate.

Identity segmentation should also be configured when accessing administrative interfaces associated with virtualization infrastructure. If Active Directory authentication provides direct integrated access to the physical virtualization stack, a threat actor that has compromised a valid Active Directory account (with permissions to manage the virtualization infrastructure) could potentially use the account to directly access virtualized systems to steal data or perform destructive actions.

Authentication to virtualized infrastructure should rely upon dedicated and unique accounts that are configured with strong passwords and that are not co-used for additional access within an environment. Additionally, accessing management interfaces associated with virtualization infrastructure should only be initiated from isolated privileged access workstations, which prevent the storing and caching of passwords used for accessing critical infrastructure components.

Protecting Hypervisors Against Offline Credential Theft and Exfiltration

Organizations should implement a proactive, defense-in-depth technical hardening strategy to systematically address security gaps and mitigate the risk of offline credential theft from the hypervisor layer. The core of this attack is an offline credential theft technique known as a "Disk Swap." Once an adversary has administrative control over the hypervisor (vSphere or Hyper-V), they perform the following steps:

Target Identification: The actor identifies a critical virtualized asset, such as a Domain Controller (DC)
Offline Manipulation: The target VM is powered off, and its virtual disk file (e.g., .vmdk for VMware or .vhd/.vhdx for Hyper-V) is detached.
NTDS.dit Extraction: The disk is attached to a staging or "orphaned" VM under the attacker's control. From this unmonitored machine, they copy the NTDS.dit Active Directory database.
Stealthy Recovery: The disk is re-attached to the original DC, and the VM is powered back on, leaving minimal forensic evidence within the guest operating system.

Hardening and Mitigation Guidance

To defend against this logic, organizations must implement a defense-in-depth strategy that focuses on cryptographic isolation and strict lifecycle management.

Virtual Machine Encryption: Organizations must encrypt all Tier 0 virtualized assets (e.g., Domain Controllers, PKI, and Backup Servers). Encryption ensures that even if a virtual disk file is stolen or detached, it remains unreadable without access to the specific keys.
Strict Decommissioning Processes: Do not leave powered-off or "orphaned" virtual machines on datastores. These "ghost" VMs are ideal staging environments for attackers. Formally decommission assets by deleting their virtual disks rather than just removing them from the inventory.
Harden Hypervisor Accounts: Disable or restrict default administrative accounts (such as root on ESXi or the local Administrator on Hyper-V hosts). Enforce Lockdown Mode (VMware ESXi feature) where possible to prevent direct host-level changes outside of the central management plane.
Remote Audit Logging: Enable and forward all hypervisor-level audit logs (e.g., hostd.log, vpxa.log, or Windows Event Logs for Hyper-V) to a centralized SIEM.

Protecting Backups

Security measures must encompass both production and backup environments. An attack on the production plane is often coupled with a simultaneous focus on backup integrity, creating a total loss of operational continuity. Virtual disk files (VMDK for VMware and VHD/VHDX for Hyper-V) represent a high-value target for offline data theft and direct manipulation.

Hardening and Mitigation Guidance

To mitigate the risk of offline theft and backup manipulation, organizations must implement a "Default Encrypted" policy across the entire lifecycle of the virtual disk .

At-Rest Encryption for all Tier-0 Assets: Implement vSphere VM Encryption or Hyper-V Shielded VMs for all critical infrastructure (e.g., Domain Controllers, Certificate Authorities). This ensures that the raw VMDK or VHDX files are cryptographically protected, rendering them unreadable if detached or mounted by an unauthorized party.
Encrypted Backup Repositories: Ensure that the backup application is configured to encrypt backup data at rest using a unique key stored in a separate, hardened Key Management System (KMS). This prevents "direct manipulation" of the backup files even if the backup storage itself is compromised.
Network Isolation of Storage & Backups: Isolate the storage management network and the backup infrastructure into dedicated, non-routable VLANs. Access to the backup console and repositories must require phishing-resistant MFA and originate from a designated Privileged Access Workstation (PAW).
Immutability and Air-Gapping: Use Immutable Backup Repositories to ensure that once a backup is written, it cannot be modified or deleted by any user including a compromised administrator for a set period. This provides a definitive recovery point in the event of a ransomware attack or intentional data sabotage.

Detection Opportunities for Monitoring Virtualization Infrastructure

Use Case	MITRE ID	Description
Unauthorized Access Attempt to Virtualized Infrastructure	T1078 – Valid Accounts	Search for attempted logins to virtualized infrastructure by unauthorized accounts.
Unauthorized SSH Connection Attempt	T1021.004 – Remote Services: SSH	Search for instances where an SSH connection is attempted when SSH has not been enabled for an approved purpose or is not expected from a specific origination asset.
ESXi Shell/SSH Enablement	T1059.004 - Command and Scripting Interpreter	Monitor ESXi hostd.log and shell.log for the SSH service being enabled via DCUI, vSphere client, or API calls. Alert on any ESXi SSH enablement event that was not preceded by an approved change request.
Bulk VM Power-Off Events	T1529 - System Shutdown/Reboot	Detect sequences where multiple VMs are powered off within a short time window (e.g., >5 VMs in 10 minutes) via vCenter events. Correlate with vpxd.log "ReceivedPowerOffVM" events.
VMDK File Access from Non-Standard Processes	T1486 - Data Encrypted for Impact	Monitor for processes accessing .vmdk, .vmx, .vmsd, or .vmsn files outside of normal VMware service processes (hostd, vpxd, fdm).
execInstalledOnly Disablement	T1562.001 - Impair Defenses: Disable or Modify Tools	Monitor ESXi shell.log for execution of "esxcli system settings encryption set" with "--require-exec-installed-only=F" or "--require-secure-boot=F". Alert on any cryptographic enforcement disablement event that was not preceded by an approved change request.
vCenter SSO Identity Modification	T1556 - Modify Authentication Process	Monitor vCenter events and vpxd.log for modifications to SSO identity sources, including the addition of new LDAP providers or changes to vshphere.local administrator group membership. Alert on an identity source change not initiated from a designated PAW subnet.
VM Disk Detach and Reattach to Non-Inventory VM	T1486 - Data Encrypted for Impact	Detect sequences where a virtual disk is removed from a Tier-0 asset via "vim.event.VmReconfiguredEvent" and subsequently attached to an orphaned or non-standard inventory VM. Correlate with "vim.event.VmRegisteredEvent" events on non-standard datastore paths within the same time window.
VCSA Shell Command Anomaly	T1059.004 - Command and Scripting Interpreter: Unix Shell	Monitor VCSA shell audit logs for execution of high-risk commands (e.g., wget, curl, psql, certificate-manager) by any user following an interactive SSH session. Alert on any instance where these commands are executed outside of an approved change window.
Bulk Snapshot Deletion	T1490 - Inhibit System Recovery	Detects sequences where snapshots are removed across multiple VMs within a short time window via vCenter events. Correlate with "vim-cmd vmsvc/snapshot.removeall" execution in hostd.log to confirm host-level action.

Table 7: Detection opportunities for VMware vSphere

Protecting Against DDoS Attacks

A distributed denial-of-service (DDoS) attack is an example of a disruptive attack that could impact the availability of cloud-based resources and services. Modernized DDoS protection must extend beyond the legacy concepts of filtering and rate-limiting, and include cloud-native capabilities that can scale to combat adversarial capabilities.

In addition to third-party DDoS and web application access protection services, the following table provides an overview of DDoS protection capabilities within common cloud-based infrastructures.

Cloud Provider	DDoS Protection Capability
Google Cloud	Google Cloud Armor
Amazon Web Services	AWS Shield
Microsoft Azure	Azure DDoS Protection
Cloud Platform Agnostic	Imperva WAF Akamai WAF Cloudflare DDoS Protection

Table 8: Common cloud capabilities to mitigate DDoS attacks

Hardening the Cloud Perimeter

With the hybrid operating model of modern day infrastructure, cloud consoles and SaaS platforms are high-value targets for credential harvesting and data exfiltration. Minimizing these risks requires a dual-defense strategy: robust identity controls to prevent unauthorized access, and platform-specific guardrails to protect access to resources, data, and to minimize the attack surface.

Strong Authentication Enforcement

Strong authentication is the foundational requirement for cloud resilience and securing cloud infrastructure. Similar to on-premises environments, a compromise of a privileged credential, token, or session could lead to unintended consequences that result in a high-impact event for an organization. To mitigate these pervasive risks, organizations must unconditionally enforce strong authentication for all external-facing cloud services, administrative portals, and SaaS platforms.

Organizations should enforce the usage of phishing-resistant authenticators such as FIDO2 (WebAuthn) hardware tokens or passkeys, or certificate based authentication for accounts assigned privileged roles and functions. For non-privileged users, authenticator software (Microsoft Authenticator or Okta Verify) should be configured to utilize device-bound factors such as Windows Hello for Business or TouchID.

Additionally, organizations should leverage the concept of authenticators (identity + device attestation) as part of the authentication transaction. This includes enforcing a validated-device access policy that restricts privileged access to only originate from managed, compliant, and healthy devices. Trusted network zones should be defined in order to restrict access to cloud resources from the open internet. Untrusted network zones should be defined to restrict authentication from anonymizing services such as VPNs or TOR. Using device-bound session credentials where possible mitigates the risk of session token theft.

Identity and Device Segmentation for Privileged Actions

The implementation of privileged access workstations (PAWs) is a critical defense against threat actors attempting to compromise administrative sessions. A PAW is a highly hardened, dedicated hardware endpoint used exclusively for sensitive administrative tasks.

Administrators should leverage a non-privileged account for daily tasks, while privileged actions are restricted to only being permissible from the hardened PAW, or from explicitly defined IP ranges. This "air-gap" between communication and administration prevents an adversary from moving laterally from a compromised non-privileged identity to a privileged context within hybrid environments.

Just-in-Time Access and the Principle of Least Privilege

Static, standing privileges present a security risk in hybrid environments. Following a zero-trust cloud architecture, administrative privileges should be entirely ephemeral. Implementing Just-In-Time (JIT) and Just-Enough-Access (JEA) mechanisms ensures that administrators are granted only the specific, granular permissions necessary to perform a discrete task, and only for a highly limited duration, after which the permissions are automatically revoked. This architectural model provides organizations with the ability to enforce approvals for privileged actions, enhanced monitoring, and detailed visibility regarding any privileged actions taken within a specific session.

Securing Non-Human Identities

Organizations should implement identity governance practices that include processes to rotate API keys, certificates, service account secrets, tokens, and sessions on a predefined basis. AI agents or identities correlating to autonomous outcomes should be configured with strictly scoped permissions and associated monitoring. Non-privileged users should be restricted from authorizing third-party application integrations or creating API keys without organizational approval.

Continuous scanning should be performed to identify and remediate hard-coded secrets and sensitive credentials across all cloud and SaaS environments.

Storage Infrastructure Security and Immutable Backups

The strategic objective of a destructive cyberattack—whether for extortion or sabotage—is to prolong recovery and reconstitution efforts by ensuring data is irrecoverable. Modern adversaries systematically target the backup plane as part of a destructive event. If backups remain mutable or share an identity plane with the primary environment, attackers can delete or encrypt them, transforming an incident into a prolonged and chaotic recovery exercise.

While modern-day redundancy for backups should include multiple data copies across diverse media, geographic separation can be a subverted defensive strategy if logical access is unified. To ensure resilience against destructive attacks, the secondary recovery environment should reside within a sovereign cloud tenant or isolated subscription. This environment should be governed by an independent Identity and Access Management (IAM) plane, using distinct credentials and administrative personas that share no commonality with the production environment.

Backups within an isolated environment must be anchored by immutable storage architectures. By leveraging hardware-verified Write-Once, Read-Many (WORM) technology, the recovery plane ensures that data integrity is mathematically guaranteed. Once committed, data cannot be modified, encrypted, or deleted—even by accounts with root or global administrative privileges, until the retention period expires. This creates a definitive "fail-safe" that ensures a known-good recovery point remains accessible regardless of potential security risks in the primary environment.

Additional defense-in-depth security architecture controls relevant to common cloud-based infrastructures are included in Table 9.

Cloud Provider	Identity Controls	Secrets Governance	Network Controls	Policy Guardrails
Google Cloud	IAM Deny Policies	Secret Manager	VPC Service Controls	Organization Policy Service
Amazon Web Services	IAM Identity Center	Secrets Manager	Verified Access	Service Control Policies
Microsoft Azure	Entra ID (PIM)	Azure Key Vault	Azure Virtual Network Private Link	Azure Policy
Cloud Agnostic Security Solutions	Okta SailPoint Ping Identity	Hashicorp Vault CyberArk	Zscaler Netskope SSE	Wiz Palo Alto Prisma Cloud Orca Security

Table 9: Common cloud capabilities for infrastructure hardening

Detection Opportunities for Protecting Cloud Infrastructure and Resources

Use Case	MITRE ID	Description
Cloud Account Abuse	T1078.004 - Valid Accounts: Cloud Accounts	Monitor cloud audit logs for authentication from unseen source IPs, anomalous ASNs, or impossible travel patterns. Alert on IAM policy modifications, new role assignments, and service account key creation by accounts without prior administrative API activity.
Lateral Movement via Cloud Interfaces	T1021.007 - Remote Services: Cloud Services	Detect interactive console sign-ins from IPs that previously only performed programmatic API/CLI access. Alert on cloud CLI execution from non-administrative endpoints. Monitor for cross-service lateral movement where a single identity authenticates to multiple cloud services in a compressed timeframe outside its historical access pattern.
Modify Cloud Compute Configurations	T1578.005 - Modify Cloud Compute Configurations	Monitor for unauthorized compute changes including bulk instance creation or deletion deviating from change management baselines. Alert on snapshot creation of production volumes by non-backup accounts, disk detach/reattach targeting domain controller or database instances for offline credential theft, and network/firewall modifications exposing internal services to public access.
Cloud Log Enumeration	T1654 - Log Enumeration	Monitor for API calls listing or accessing logging configurations from identities without documented operational need. Alert on enumeration of SIEM integration settings, log export destinations, and alert rule definitions.
Mass Deletion & Impact	T1490 - Inhibit System Recovery	Alert when bulk delete API calls exceed baseline thresholds targeting compute instances, storage, databases, or virtual networks. Detect deletion or retention reduction of recovery-critical resources including backup vaults, snapshot schedules, and disaster recovery configurations.
Backup Policy Modification or Deletion	T1490 - Inhibit System Recovery	Monitor for unauthorized modifications to backup configurations, including changes to WORM retention policies, backup vault access policies, snapshot deletion, or backup schedule disablement. Alert on backup storage account access from identities other than designated backup service accounts.
Conditional Access or Security Policy Modification	T1556.009 - Conditional Access Policies	Monitor cloud identity provider audit logs for modifications to Conditional Access Policies, MFA enforcement rules, legacy authentication blocking rules, or PIM/JIT role settings. Alert on changes that add location or device exclusions to MFA policies, disable legacy protocol blocks, extend privilege role activation durations, or register new authentication methods on privileged accounts.

Table 10: Detection opportunities for protecting cloud infrastructure and resources

Securing Endpoint and Mobile Device Management Platforms

Protecting endpoint and Mobile Device Management (MDM) platforms is crucial to ensuring the security and availability of devices used in support of operations. In the context of wiper and destructive-style attacks, these platforms represent the "keys to the kingdom" that threat actors can target to turn an organization’s own infrastructure against itself.

Force Multiplier: MDM and endpoint management tools have the inherent ability to push configurations and scripts to enrolled and managed devices. If compromised, a threat actor can use these legitimate administrative platforms to deploy wiper malware or execute remote wipe commands simultaneously across the entire enterprise, achieving destruction in minutes.

Unlike ransomware, where data might be recoverable via decryption, wiper attacks aim for the permanent destruction of the Master Boot Record (MBR), GUID Partition Table (GPT), Master File Table (MFT), or overwrite the file system making endpoint devices inaccessible.

Proactive Hardening

Enforcing strong identity and network controls for securing the management plane can prevent an attacker from gaining access to endpoint and MDM platforms and abusing intended functionality (e.g., deploying wiper scripts or issuing "Remote Wipe" or "Factory Reset" commands).

Enforce strong authentication (e.g., phishing-resistant MFA, including FIDO2) for identities assigned privileged roles and functions.
Enforce session lifetimes, idle session timeouts and utilize device-bound session protection to protect against token replay attacks.
Require access policies and multi-admin approval for authorization of specific actions.
Reduce long-standing administrative permissions and migrate to a Just-in-Time (JIT) or Just-Enough-Access (JEA) access model for privileged roles and actions.
For Microsoft Intune, leverage a combination of role-based access control (RBAC) and scope tags to reduce the blast radius and minimize the risk of compromised privileged identities being leveraged to impact a large scope of managed devices / endpoints.
Audit admin roles for anything including “Remote tasks/wipe/erase” permissions - and ensure these events are forwarded to a centralized SIEM. Additionally, reduce the scope of administrators that can perform these actions to the minimum required for business operations.
Reduce scope of API token permissions following the principle of least privilege. Remove or expire tokens after a period of inactivity. Rotate tokens on a regular basis.
For cloud-hosted MDM platforms, utilize access policies to enforce network- and location-based allow listing. For local/on-premises MDM servers, utilize firewalls to restrict access to MDM infrastructure (management plane).
If supported, configure wipe protection to prevent against mass device wiping within a specific threshold. An example of this configuration within the Omnissa Workspace ONE platform is available here.
Review existing scripts and configuration profiles deployed via the MDM platform to identify and remediate any hardcoded plain text passwords, API keys, or other sensitive secrets.

Detection Opportunities for Securing Endpoint and Mobile Device Management Platforms

Use Case	MITRE ID	Description
Remote Wipe or Factory Reset Command Issued	T1485 - Data Destruction	Monitor endpoint management platform audit logs for issuance of remote wipe, factory reset, or retire commands. Alert on any wipe command targeting more than a threshold number of devices within a defined time window, or wipe commands issued outside approved change windows.
Anomalous MDM/EDR Administrator Authentication	T1078.004 - Valid accounts: Cloud accounts	Monitor authentication logs for endpoint management platform admin consoles for sign-ins from unrecognized IPs, non-compliant devices, or locations inconsistent with the administrator’s historical access pattern. Alert on admin authentication that bypasses Conditional Access or lacks phishing-resistant MFA.
Bulk Script or Configuration Profile Deployment	T1072 - Software Deployment Tools	Monitor of mass deployment of new scripts, configuration profiles, or software packages pushed to device groups via the management platform. Alert when a deployment targets all devices or broad scope tags rather than specific groups, particularly when initiated by an account that has not previously performed bulk deployments.
Administrative Role or Permission Modification	T1098 - Account Manipulation	Monitor platform audit logs for changes to administrative roles, RBAC assignments, or scope tag modifications. Alert on elevation of accounts to roles with remote task, wipe, or retire permissions, and on removal of multi-admin approval requirements.
API Key creation or Anomalous API access	T1098.001 - Additional Cloud Credentials	Monitor for creation of new API keys, tokens, or service principal credentials for the endpoint management platform. Alert on API calls from previously unseen source IPs or user-agents, and on API activity outside business hours.
Management Platform Audit Log Tampering or Disablement	T1562.008 - Impair Defenses: Disable or Modify Cloud Logs	Monitor for modifications to the platform’s audit logging configuration, including disablement of change management logging, redirection of syslog export destinations, or deletion of audit log entries. Alert on changes to log retention settings or export configurations.

3. On-Premises Lateral Movement Protections

Endpoint Hardening

Windows Firewall Configurations

Once initial access to on-premises infrastructure is established, threat actors will conduct lateral movement to attempt to further expand the scope of access and persistence. To protect Windows endpoints from being accessed using common lateral movement techniques, a Windows Firewall policy can be configured to restrict the scope of communications permitted between endpoints within an environment. A Windows Firewall policy can be enforced locally or centrally as part of a Group Policy Object (GPO) configuration. At a minimum, the common ports and protocols leveraged for lateral movement that should be blocked between workstation-to-workstation and workstations to non-domain controllers and non-file servers include:

SMB (TCP/445, TCP/135, TCP/139)
Remote Desktop Protocol (TCP/3389)
Windows Remote Management (WinRM)/Remote PowerShell (TCP/80, TCP/5985, TCP/5986)
Windows Management Instrumentation (WMI) (dynamic port range assigned through Distributed Component Object Model (DCOM))

Using a GPO (Figure 5), the settings listed in Table 11 can be configured for the Windows Firewall to control inbound communications to endpoints in a managed environment. The referenced settings will effectively block all inbound connections for the Private and Public profiles, and for the Domain profile, only allow connections that do not match a predefined block rule.

Computer Configuration > Policies > Windows Settings > Security Settings > Windows Firewall with Advanced Security

Figure 5: GPO path for creating Windows Firewall rules

Profile Setting	Firewall State	Inbound Connections	Log Dropped Packets	Log Successful Connections	Log File Path	Log File Maximum Size (KB)
Domain	On	Allow	Yes	Yes	`%systemroot%\system32\LogFiles\Firewall\pfirewall.log`	4,096
Private	On	Block All Connections	Yes	Yes	`%systemroot%\system32\LogFiles\Firewall\pfirewall.log`	4,096
Public	On	Block All Connections	Yes	Yes	`%systemroot%\system32\LogFiles\Firewall\pfirewall.log`	4,096

Table 11: Windows Firewall recommended configuration state

Figure 6: Windows Firewall recommendation configurations

Additionally, to ensure that only centrally managed firewall rules are enforced (and cannot be overridden by a threat actor), the settings for Apply local firewall rules and Apply local connection security rules can be set to No for all profiles.

Figure 7: Windows Firewall domain profile customized settings

To quickly contain and isolate systems, the centralized Windows Firewall setting of Block all connections (Figure 8) will prevent any inbound connections from being established to a system. This is a setting that can be enforced on workstations and laptops, but will likely impact operations if enforced for servers, although if there is evidence of an active threat actor lateral pivoting within an environment, it may be a necessary step for rapid containment.

Note: If this control is being used temporarily to facilitate containment as part of an active incident, once the incident has been contained and it has been deemed safe to re-establish connectivity among systems within an environment, the Inbound Connections setting can be changed back to Allow using a GPO.

Figure 8: Windows Firewall - Block All Connections settings

If blocking all inbound connectivity for endpoints during a containment event is not practical, or for the Domain profile configurations, at a minimum, the protocols listed in Table 12 should be enforced using either a GPO or via the commands referenced within the table.

For any specific applications that may require inbound connectivity to end-user endpoints, the local firewall policy should be configured with specific IP address exceptions for origination systems that are authorized to initiate inbound connections to such devices.

Protocol/Port	Windows Firewall Rule	Command Line Enforcement
SMB TCP/445, TCP/139, TCP/135	Predefined Rule Name: File and Print Sharing Remote Desktop Windows Management Instrumentation (WMI) Windows Remote Management Windows Remote Management (Compatibility) TCP/5986	`netsh advfirewall firewall set rule group="File and Printer Sharing" new enable=no`
Remote Desktop Protocol TCP/3389	Predefined Rule Name:	`netsh advfirewall firewall set rule group="Remote Desktop" new enable=no`
WMI	Predefined Rule Name:	`netsh advfirewall firewall set rule group="windows management instrumentation (wmi)" new enable=no`
Windows Remote Management/PowerShell Remoting TCP/80, TCP/5985, TCP/5986	Predefined Rule Name:	`netsh advfirewall firewall set rule group="Windows Remote Management" new enable=no` Via PowerShell: `Disable-PSRemoting -Force`

Table 12: Windows Firewall suggested block rules

Figure 9: Windows Firewall suggested rule blocks via Group Policy

NTLM Authentication Configurations

Threat actors often attempt to harvest credentials (including Windows NTLMv1 hashes) based upon outbound SMB or WebDAV communications. Organizations should review NTLM settings for Windows-based endpoints, and work to harden, disable, or restrict NTLMv1 authentication requests.

To fully restrict NTLM authentication to remote servers, the following GPO settings can be leveraged:

Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options > Network Security: Restrict NTLM: Outgoing NTLM traffic to remote servers
- Allow all
- Audit all
- Deny all

Note: If "Deny all" is selected, the client computer cannot authenticate (send credentials) to a remote server using NTLM authentication. Before setting to "Deny all," organizations should configure the GPO setting with the "Audit all" enforcement. With this configuration, audit and block events will be recorded within the Operational event log on endpoints (Applications and Services Log\Microsoft\Windows\NTLM).

If any recorded NTLM authentication events are required, organizations can configure the "Network security: Restrict NTLM: Add remote server exceptions for NTLM authentication" setting to define a listing of remote servers, which are required to use NTLM authentication.

Detection Opportunities for SMB, WMI, and NTLM Communications

Use Case	MITRE ID	Description
High Volume of SMB Connections	T1021.002 – SMB/Windows Admin Shares	Search for a sharp increase in SMB connections that fall outside of a normal pattern.
Outbound Connection Attempted Over SMB	T1212 – Exploitation for Credential Access	Search for external connection attempts over SMB, as this may be an attempt to harvest credential hashes.
WMI Being Used to Call a Remote Service	T1047 – Windows Management Instrumentation	Search for WMI being used via a command line or PowerShell to call a remote service for execution.
WMI Being Used for Ingress Tool Transfer	T1105 – Ingress Tool Transfer	Search for suspicious usage of WMI to download external resources.
Forced NTLM Authentication Using SMB or WebDAV	T1187 – Forced Authentication	Search for potential NTLM authentication attempts using SMB or WebDAV.
NTLM Relay via Coercion	T1187 - Forced Authentication	Monitor for NTLM authentication attempts from Domain Controllers or privileged servers to unexpected destinations, particularly to HTTP endpoints (AD CS web enrollment). Detect PetitPotam by monitoring for EfsRpcOpenFileRaw calls, DFSCoerce via DFS-related named pipe access, and PrinterBug via SpoolService RPC calls.

Table 13: Detection opportunities for SMB, WMI, and NTLM communications

Remote Desktop Protocol Hardening

Remote Desktop Protocol (RDP) is a common method used by threat actors to remotely connect to systems, laterally move from the perimeter onto a larger scope of internal systems, and perform malicious activities (such as data theft or ransomware deployment). External-facing systems with RDP open to the internet present an elevated risk. Threat actors may exploit this vector to gain initial access to an organization and then perform lateral movement into the organization to complete their mission objectives.

Proactively, organizations should scan their public IP address ranges to identify systems with RDP (TCP/3389) and other protocols (SMB – TCP/445) open to the internet. At a minimum, RDP and SMB should not be directly exposed for ingress and egress access to/from the internet. If required for operational purposes, explicit controls should be implemented to restrict the source IP addresses, which can interface with systems using these protocols. The following hardening recommendations should also be implemented.

Enforce Multi-Factor Authentication

If external-facing RDP must be used for operational purposes, MFA should be enforced when connecting using this method. This can be accomplished either via the integration of a third-party MFA technology or by leveraging a Remote Desktop Gateway and Azure Multifactor Authentication Server using Remote Authentication Dial-In User Service (RADIUS).

Leverage Network-Level Authentication

For external-facing RDP servers, Network-Level Authentication (NLA) provides an extra layer of preauthentication before a connection is established. NLA can also be useful for protecting against brute-force attacks, which often target open internet-facing RDP servers.

NLA can be configured either via the user interface (UI) (Figure 10) or via Group Policy (Figure 11).

Figure 10: Enabling NLA via the UI

Using a GPO, the setting for NLA can be configured via:

Computer Configuration > Policies > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Security > Require user authentication for remote connections by using Network Level Authentication
- Enabled

Figure 11: Enabling NLA via Group Policy

Some caveats about leveraging NLA for RDP:

The Remote Desktop client v7.0 (or greater) must be leveraged.
NLA uses CredSSP to pass authentication requests on the initiating system. CredSSP stores credentials in Local Security Authority (LSA) memory on the initiating system, and these credentials may remain in memory even after a user logs off the system. This provides a potential exposure risk for credentials in memory on the source system.
On the RDP server, users permitted for remote access using RDP must be assigned the Access this computer from the network privilege when NLA is enforced. This privilege is often explicitly denied for user accounts to protect against lateral movement techniques.

Restrict Administrative Accounts from Leveraging RDP on Internet-Facing Systems

For external-facing RDP servers, highly privileged domain and local administrative accounts should not be permitted access to authenticate with the external-facing systems using RDP (Figure 12).

This can be enforced using Group Policy, configurable via the following path:

Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > User Rights Assignment > Deny log on through Terminal Services

Figure 12: Group Policy configuration for restricting highly privileged domain and local administrative accounts from leveraging RDP

Detection Opportunities for RDP Usage

Use Case

MITRE ID

Description

RDP Authentication Integration

T1110 – Brute Force

T1078 – Valid Accounts

T1021.001 – Remote Desktop Protocol

Existing authentication rules should include RDP attempts. This includes use cases for:

Brute Force
Password Spraying
MFA Failures Single User
MFA Failures Single Source
External Authentication from an Account with Elevated Privileges

Anomalous Connection Attempts over RDP

T1078 – Valid Accounts

T1021.001 – Remote Desktop Protocol

Searching for anomalous RDP connection attempts over known RDP ports such as TCP/3389.

Table 14: Detection Opportunities for RDP Usage

Disabling Administrative/Hidden Shares

To conduct lateral movement, threat actors may attempt to identify administrative or hidden network shares, including those that are not explicitly mapped to a drive letter and use these for remotely binding to endpoints throughout an environment. As a protective or rapid containment measure, organizations may need to quickly disable default administrative or hidden shares from being accessible on endpoints. This can be accomplished by either modifying the registry, stopping a service, or by using the MSS (Legacy) Group Policy template.

Common administrative and hidden shares on endpoints include:

ADMIN$
C$
D$
IPC$

Note: Disabling administrative and hidden shares on servers, specifically including domain controllers, may significantly impact the operation and functionality of systems within a domain-based environment.

Additionally, if PsExec is used in an environment, disabling the admin (ADMIN$) share can restrict the capability for this tool to be used to remotely interface with endpoints.

Registry Method

Using the registry, administrative and hidden shares can be disabled on endpoints (Figure 13 and Figure 14).

Workstations

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters
DWORD Name = "AutoShareWks"
Value = "0"

Figure 13: Registry value disabling administrative shares on workstations

Servers

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters
DWORD Name = "AutoShareServer"
Value = "0"

Figure 14: Registry value disabling administrative shares on servers

Service Method

By stopping the Server service on an endpoint, the ability to access any shares hosted on the endpoint will be disabled (Figure 15).

Figure 15: Server service properties

Group Policy Method

Using the MSS (Legacy) Group Policy template, administrative and hidden shares can be disabled on either a server or workstation via a GPO setting (Figure 16).

Computer Configuration > Policies > Administrative Templates > MSS (Legacy) > MSS (AutoShareServer)
- Disabled
Computer Configuration > Policies > Administrative Templates > MSS (Legacy) > MSS (AutoShareWks)
- Disabled

Figure 16: Disabling administrative and hidden shares via the MSS (Legacy) Group Policy template

Detection Opportunities for Accessing Administrative or Hidden Shares

Use Case

MITRE ID

Description

Network Discovery: Suspicious Usage of the Net Command

T1049 - System Network Connections Discovery

T1135 - Network Share Discovery

Search for suspicious use of the net command to enumerate systems and file shares within an environment.

Table 15: Detection opportunities for accessing administrative or hidden shares

Hardening Windows Remote Management

Threat actors may leverage Windows Remote Management (WinRM) to laterally move throughout an environment. WinRM is enabled by default on all Windows Server operating systems (since Windows Server 2012 and above), but disabled on all client operating systems (Windows 7 and Windows 10) and older server platforms (Windows Server 2008 R2).

PowerShell remoting (PS remoting) is a native Windows remote command execution feature that is built on top of the WinRM protocol.

Windows client (nonserver) operating system platforms where WinRM is disabled indicates that there is:

No WinRM listener configured
No Windows firewall exception configured

By default, WinRM uses TCP/5985 and TCP/5986, which can be either disabled using the Windows Firewall or configured so that a specific subset of IP addresses can be authorized for connecting to endpoints using WinRM.

WinRM and PowerShell remoting can be explicitly disabled on endpoint using either a PowerShell command (Figure 17) or specific GPO settings.

PowerShell

Disable-PSRemoting -Force

Figure 17: PowerShell command to disable WinRM/PowerShell remoting on an endpoint

Note: Running Disable-PSRemoting -Force does not prevent local users from creating PowerShell sessions on the local computer or for sessions destined for remote computers.

After running the command, the message recorded in Figure 18 will be displayed. These steps provide additional hardening, but after running the Disable-PSRemoting -Force command, PowerShell sessions destined for the target endpoint will not be successful.

Figure 18: Warning message after disabling PSRemoting

To enforce the additional steps for disabling WinRM via PowerShell (Figure 19 through Figure 22):

Stop and disable the WinRM service.
```
Stop-Service WinRM -PassThruSet-Service WinRM -StartupType Disabled
```
Figure 19: PowerShell command to stop and disable the WinRM service
Disable the listener that accepts requests on any IP address.
```
dir wsman:\localhost\listener

Remove-Item -Path WSMan:\Localhost\listener\
```
Figure 20: PowerShell commands to delete a WSMan listener
Disable the firewall exceptions for WS-Management communications.
```
Set-NetFirewallRule -DisplayName 'Windows Remote Management (HTTP-In)' -Enabled False 
```
Figure 21: PowerShell command to disable firewall exceptions for WinRM
Restore the value of the LocalAccountTokenFilterPolicy to 0, which restricts remote access to members of the Administrators group on the computer.
```
Set-ItemProperty -Path HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system -Name LocalAccountTokenFilterPolicy -Value 0
```
Figure 22: PowerShell command to configure the registry key for LocalAccountTokenFilterPolicy

Group Policy

Computer Configuration > Policies > Administrative Templates > Windows Components > Windows Remote Management (WinRM) > WinRM Service > Allow remote server management through WinRM
- Disabled

If this setting is configured as Disabled, the WinRM service will not respond to requests from a remote computer, regardless of whether any WinRM listeners are configured.

Computer Configuration > Policies > Administrative Templates > Windows Components > Windows Remote Shell > Allow Remote Shell Access
- Disabled

This policy setting will manage the configuration of remote access to all supported shells to execute scripts and commands.

Detection Opportunities for WinRM Usage

Use Case	MITRE ID	Description
Unauthorized WinRM Execution Attempt	T1021.006 - Remote Services: Windows Remote Management	Search for command execution attempts for WinRM on a system where WinRM has been disabled.
Suspicious Process Creation Using WinRM	T1021.006 - Remote Services: Windows Remote Management	Search for anomalous process creation events using WinRM that deviate from an established baseline.
Suspicious Network Connection Using WinRM	T1021.006 - Remote Services: Windows Remote Management	Search for network activity over known WinRM ports, such as TCP/5985 and TCP/5986, to identify anomalous connections that deviate from an established baseline.
Remote WMI Connection Using WinRM	T1021.006 - Remote Services: Windows Remote Management	Search for remote WMI connection attempts using WinRM.

Table 16: Detection opportunities for WinRM use

Restricting Common Lateral Movement Tools and Methods

Table 17 provides a consolidated summary of security configurations that can be leveraged to combat against common remote access tools and methods used for lateral movement within environments.

Tool/Tactic	Mitigating Security Configurations (Target Endpoints)
PsExec (using the current logged-on user account, without the `-u` switch) If the `-u` switch is not leveraged, authentication will use Kerberos or NTLM for the current logged-on user of the source endpoint and will register as a Type 3 (network) logon on the destination endpoint. PsExec high-level functionality: Connects to the hidden `ADMIN$` share (mapping to the `C:\Windows` folder) on a remote endpoint via SMB (TCP/445). Uses the Service Control Manager (SCM) to start the `PSExecsvc` service and enable a named pipe on a remote endpoint. Input/output redirection for the console is achieved via the created named pipe.	Option 1: GPO configuration: Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > User Rights Assignment Deny access to this computer from the network Deny access to this computer from the network Deny log on locally Deny log on through Terminal Services DCOM:Machine Launch Restrictions in Security Descriptor Definition Language (SDDL) Syntax Computer Configuration > Policies > Windows Settings > Local Policies > Security Options DCOM:Machine Access Restrictions in Security Descriptor Definition Language (SDDL) Syntax Deny access to this computer from the network Option 2: Windows Firewall rule: `netsh advfirewall firewall set rule group="File and Printer Sharing" new enable=no` Figure 23: PowerShell command to disable inbound file and print sharing (SMB) for an endpoint using a local Windows Firewall rule Option 3: Disable administrative and hidden shares.
PsExec (with Alternative Credentials, via the `-u` switch) If the `-u` switch is leveraged, authentication will use the alternate supplied credentials and will register as a Type 3 (network) and Type 2 (interactive) logon on the destination endpoint.	Option 1: GPO configuration: Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > User Rights Assignment Option 2: Windows Firewall rule: `netsh advfirewall firewall set rule group="File and Printer Sharing" new enable=no` Figure 24: PowerShell command to disable inbound file and print sharing (SMB) for an endpoint using a local Windows Firewall rule
Remote Desktop Protocol (RDP)	Option 1: GPO configuration: Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > User Rights Assignment Option 2: Windows Firewall rule: `netsh advfirewall firewall set rule group="Remote Desktop" new enable=no` Figure 25: PowerShell command to disable inbound Remote Desktop (RDP) for an endpoint using a local Windows Firewall rule
PS remoting and WinRM	Option 1: PowerShell command: `Disable-PSRemoting -Force` Figure 26: PowerShell command to disable PowerShell remoting for an endpoint Option 2: GPO configuration: Computer Configuration > Policies > Administrative Templates > Windows Components > Windows Remote Management (WinRM) > WinRM Service > Allow remote server management through WinRM Option 3: Windows Firewall rule: `netsh advfirewall firewall set rule group="Windows Remote Management" new enable=no` Figure 27: PowerShell command to disable inbound WinRM for an endpoint using a local Windows Firewall rule
Distributed Component Object Model (DCOM)	Option 1: GPO configuration: Computer Configuration > Policies > Windows Settings > Local Policies > Security Options Both of these settings allow an organization to define additional computer-wide controls that govern access to all DCOM–based applications on an endpoint. When users or groups that are provided permissions are specified, the security descriptor field is populated with the SDDL representation of those groups and privileges. Users and groups can be given explicit Allow or Deny privileges for both local and remote access using DCOM. Option 2: Windows Firewall rules: `netsh advfirewall firewall set rule group="COM+ Network Access" new enable=no netsh advfirewall firewall set rule group="COM+ Remote Administration" new enable=no` Figure 28: PowerShell commands to disable inbound DCOM for an endpoint using a local Windows Firewall rule
Third-party remote access applications (e.g., VNC/DameWare/ScreenConnect) that rely upon specific interactive and remote logon permissions being configured on an endpoint.	GPO configuration: Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > User Rights Assignment

Tool/Tactic

Mitigating Security Configurations (Target Endpoints)

PsExec (using the current logged-on user account, without the -u switch)

If the -u switch is not leveraged, authentication will use Kerberos or NTLM for the current logged-on user of the source endpoint and will register as a Type 3 (network) logon on the destination endpoint.

PsExec high-level functionality:

Connects to the hidden ADMIN$ share (mapping to the C:\Windows folder) on a remote endpoint via SMB (TCP/445).
Uses the Service Control Manager (SCM) to start the PSExecsvc service and enable a named pipe on a remote endpoint.
Input/output redirection for the console is achieved via the created named pipe.

Option 1:

GPO configuration:

Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > User Rights Assignment
Deny access to this computer from the network
Deny access to this computer from the network
Deny log on locally
Deny log on through Terminal Services
DCOM:Machine Launch Restrictions in Security Descriptor Definition Language (SDDL) Syntax
Computer Configuration > Policies > Windows Settings > Local Policies > Security Options
DCOM:Machine Access Restrictions in Security Descriptor Definition Language (SDDL) Syntax
Deny access to this computer from the network

Option 2:

Windows Firewall rule:

netsh advfirewall firewall set rule group="File and Printer Sharing" new enable=no

Figure 23: PowerShell command to disable inbound file and print sharing (SMB) for an endpoint using a local Windows Firewall rule

Option 3:

Disable administrative and hidden shares.

PsExec (with Alternative Credentials, via the -u switch)

If the -u switch is leveraged, authentication will use the alternate supplied credentials and will register as a Type 3 (network) and Type 2 (interactive) logon on the destination endpoint.

Option 1:

GPO configuration:

Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > User Rights Assignment

Option 2:

Windows Firewall rule:

netsh advfirewall firewall set rule group="File and Printer Sharing" new enable=no

Figure 24: PowerShell command to disable inbound file and print sharing (SMB) for an endpoint using a local Windows Firewall rule

Remote Desktop Protocol (RDP)

Option 1:

GPO configuration:

Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > User Rights Assignment

Option 2:

Windows Firewall rule:

netsh advfirewall firewall set rule group="Remote Desktop" new enable=no

Figure 25: PowerShell command to disable inbound Remote Desktop (RDP) for an endpoint using a local Windows Firewall rule

PS remoting and WinRM

Option 1:

PowerShell command:

Disable-PSRemoting -Force

Figure 26: PowerShell command to disable PowerShell remoting for an endpoint

Option 2:

GPO configuration:

Computer Configuration > Policies > Administrative Templates > Windows Components > Windows Remote Management (WinRM) > WinRM Service > Allow remote server management through WinRM

Option 3:

Windows Firewall rule:

netsh advfirewall firewall set rule group="Windows Remote Management" new enable=no

Figure 27: PowerShell command to disable inbound WinRM for an endpoint using a local Windows Firewall rule

Distributed Component Object Model (DCOM)

Option 1:

GPO configuration:

Computer Configuration > Policies > Windows Settings > Local Policies > Security Options

Both of these settings allow an organization to define additional computer-wide controls that govern access to all DCOM–based applications on an endpoint.

When users or groups that are provided permissions are specified, the security descriptor field is populated with the SDDL representation of those groups and privileges.

Users and groups can be given explicit Allow or Deny privileges for both local and remote access using DCOM.

Option 2:

Windows Firewall rules:

netsh advfirewall firewall set rule group="COM+ Network Access" new enable=no

netsh advfirewall firewall set rule group="COM+ Remote Administration" new enable=no

Figure 28: PowerShell commands to disable inbound DCOM for an endpoint using a local Windows Firewall rule

Third-party remote access applications (e.g., VNC/DameWare/ScreenConnect) that rely upon specific interactive and remote logon permissions being configured on an endpoint.

GPO configuration:

Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > User Rights Assignment

Table 17: Common lateral movement tools/methods and mitigating security controls

Detection Opportunities for Common Lateral Movement Tools and Methods

Use Case	MITRE	Description
Anomalous PsExec Usage	T1569.002 – System Services: Service Execution T1021.002 – Remote Services: SMB/Windows Admin Shares T1570 – Lateral Tool Transfer	Search for attempted execution of PsExec on systems where PsExec is disabled or where it deviates from normal activity.
Process Creation Event Involving a COM Object by Different User	T1021.003 – Remote Services: Distributed Component Object Model T1078 – Valid Accounts	Search for process creation events including COM objects that are initiated by an account that is not currently the logged-in user for the system.
High Volume of DCOM-Related Activity	T1021.003 – Remote Services: Distributed Component Object Model	Search for a sharp increase in volume of DCOM-related activity.
Third-Party Remote Access Applications	T1219 – Remote Access Software	Search for anomalous use of third-party remote access applications. This type of activity could indicate a threat actor is attempting to use third-party remote access applications as an alternate communication channel or for creating remote interactive sessions.
BYOVD - EDR/AV Tampering via Vulnerable Drivers	T1068 - Exploitation for Privilege Escalation T1562.001 - Impair Defenses	Monitor for kernel driver installations (Sysmon Event ID 6) where the loaded driver hash matches known vulnerable drivers from the LOLDrivers project. Alert on new service creation (Event ID 7045) loading .sys files from user-writable paths (e.g., %TEMP%, %APPDATA%).
RMM Tool Abuse for Lateral Movement	T1219 - Remote Access Tools	Monitor for installation or execution of legitimate RMM tools (ScreenConnect/ConnectWise, AnyDesk, Atera, Splashtop, TeamViewer) that are not part of the organization's approved toolset. Monitor for new service installations matching known RMM tool signatures.

Table 18: Detection opportunities for common lateral movement tools and methods

Additional Endpoint Hardening

To help protect against malicious binaries, malware, and encryptors being invoked on endpoints, additional security hardening technologies and controls should be considered. Examples of additional security controls for consideration for Windows-based endpoints are provided as follows.

Windows Defender Application Control

Windows Defender Application Control is a set of inherent configuration settings within Active Directory that provide lockdown and control mechanisms for controlling which applications and files users can run on endpoints. With this functionality, the following types of rules can be configured within GPOs:

Publisher rules: Can be leveraged to allow or restrict execution of files based upon digital signatures and other attributes
Path rules: Can be leveraged to allow or restrict file execution or access based upon files residing in specific path
File hash rules: Can be leveraged to allow or restrict file execution based on a file's hash

Additional information related to Windows Defender Application Control.

Microsoft Defender Attack Surface Reduction

Microsoft Defender Attack Surface Reduction (ASR) rules can help protect against various threats, including:

A threat actor launching executable files and scripts that attempt to download or run files
A threat actor running obfuscated or suspicious scripts
A threat actor invoking credential theft tools that interface with Local Security Authority Subsystem Service (LSASS)
A threat actor invoking PsExec or WMI commands
Normalizing and blocking behaviors that applications do not usually initiate as part of standardized activity
Blocking executable content from email clients and web mail (phishing)

ASR requires a Windows E3 license or above. A Windows E5 license provides advanced management capabilities for ASR.

Additional information related to Microsoft Defender Attack Surface Reduction functionality.

Controlled Folder Access

Controlled folder access can help protect data from being encrypted by ransomware. Beginning with Windows 10 version 1709+ and Windows Server 2019+, controlled folder access was introduced within Windows Defender Antivirus (as part of Windows Defender Exploit Guard).

Once controlled folder access is enabled, applications and executable files are assessed by Windows Defender Antivirus, which then determines if an application is malicious or safe. If an application is determined to be malicious or suspicious, it will be blocked from making changes to any files in a protected folder.

Once enabled, controlled folder access will apply to a number of system folders and default locations, including:

Documents
- C:\users\\Documents
- C:\users\Public\Documents
Pictures
- C:\users\\Pictures
- C:\users\Public\Pictures
Videos
- C:\users\\Videos
- C:\users\Public\Videos
Music
- C:\users\\Music
- C:\users\Public\Music
Desktop
- C:\users\\Desktop
- C:\users\Public\Desktop
Favorites
- C:\users\\Favorites

Additional folders can be added using the Windows Security application, Group Policy, PowerShell, or mobile device management (MDM) configuration service providers (CSPs). Additionally, applications can be allow-listed for access to protected folders.

Note: For controlled folder access to fully function, Windows Defender's Real Time Protection setting must be enabled.

Additional information related to controlled folder access.

Tamper Protection

Threat actors will often attempt to disable security features on endpoints. Tamper protection either in Windows (via Microsoft Defender for Endpoint) or integrated within third-party AV/EDR platforms can help protect security tools from being modified or stopped by a threat actor. Organizations should review the configuration of security technologies that are deployed to endpoints and verify if tamper protection is (or can be) enabled to protect against unauthorized modification. Once implemented, organizations should test and validate that the tamper protection controls behave as expected as different products offer different levels of protection.

Additional information related to tamper protection for Windows Defender for Endpoint.

Detection Opportunities for Tamper Protection Events

Use Case	MITRE	Description
Threat Actor Attempting to Disable Security Tooling on an Endpoint	T1562.001 - Disable or Modify Tools	Monitor for evidence of processes or command-line arguments correlating to security tools/services being stopped.

Table 19: Detection opportunities for tamper protection events

4. Credential Exposure and Account Protections

Identification of Privileged Accounts and Groups

Threat actors will prioritize identifying privileged accounts as part of reconnaissance efforts. Once identified, threat actors will attempt to obtain credentials for these accounts for lateral movement, persistence, and mission fulfillment.

Organizations should proactively focus on identifying and reviewing the scope of accounts and groups within Active Directory that have an elevated level of privilege. An elevated level of privilege can be determined by the following criteria:

Accounts or nested groups that are assigned membership into default domain and Exchange-based privileged groups (Figure 29)
Accounts or nested groups that are assigned membership into security groups protected by AdminSDHolder
Accounts or groups assigned permissions for organizational units (OUs) housing privileged accounts, groups, or endpoints
Accounts or groups assigned specific extended right permissions either directly at the root of the domain or for OUs where permissions are inherited by child objects. Examples include:
- DS-Replication-Get-Changes-All
- Administer Exchange Information Store
- View Exchange Information Store Status
- Create-Inbound-Forest-Trust
- Migrate-SID-History
- Reanimate-Tombstones
- View Exchange Information Store Status
- User-Force-Change-Password
Accounts or groups assigned permissions for modifying or linking GPOs
Accounts or groups assigned explicit permissions on domain controllers or Tier 0 endpoints
Accounts or groups assigned directory service replication permissions
Accounts or groups with local administrative access on all endpoints (or a large scope of critical assets) in a domain

To identify accounts that are provided membership into default domain-based privileged groups or are protected by AdminSDHolder, the following PowerShell cmdlets can be run from a domain controller.

get-ADGroupMember -Identity "Domain Admins" -Recursive | export-csv -path \DomainAdmins.csv -NoTypeInformation 

get-ADGroupMember -Identity "Enterprise Admins" -Recursive | export-csv -path \EnterpriseAdmins.csv -NoTypeInformation 

get-ADGroupMember -Identity "Schema Admins" -Recursive | export-csv -path \SchemaAdmins.csv -NoTypeInformation

get-ADGroupMember -Identity "Administrators" -Recursive | export-csv -path \Administrators.csv -NoTypeInformation 

get-ADGroupMember -Identity "Account Operators" -Recursive | export-csv -path \AccountOperators.csv -NoTypeInformation 

get-ADGroupMember -Identity "Backup Operators" -Recursive | export-csv -path \BackupOperators.csv -NoTypeInformation 

get-ADGroupMember -Identity "Cert Publishers" -Recursive | export-csv -path \CertPublishers.csv -NoTypeInformation 

get-ADGroupMember -Identity "Print Operators" -Recursive | export-csv -path \PrintOperators.csv -NoTypeInformation 

get-ADGroupMember -Identity "Server Operators" -Recursive | export-csv -path \ServerOperators.csv -NoTypeInformation 

get-ADGroupMember -Identity "DNSAdmins" -Recursive | export-csv -path \DNSAdmins.csv -NoTypeInformation 

get-ADGroupMember -Identity "Group Policy Creator Owners" -Recursive | export-csv -path \Group-Policy-Creator-Owners.csv -NoTypeInformation 

get-ADGroupMember -Identity "Exchange Trusted Subsystem" -Recursive | export-csv -path \Exchange-Trusted-Subsystem.csv -NoTypeInformation

get-ADGroupMember -Identity "Exchange Windows Permissions" -Recursive | export-csv -path \Exchange-Windows-Permissions.csv -NoTypeInformation 

get-ADGroupMember -Identity "Exchange Recipient Administrators" -Recursive | export-csv -path \Exchange-Recipient-Admins.csv -NoTypeInformation 

get-ADUser -Filter {(AdminCount -eq 1) -And (Enabled -eq $True)} | Select-Object Name, DistinguishedName | export-csv -path \AdminSDHolder_Enabled.csv

Figure 29: Commands to identify domain and exchange-based privileged accounts

Any privileged accounts granted membership into additional security groups can provide a threat actor with a potential path to domain administration-level permissions based upon endpoints where the accounts have permissions to log on or remotely access systems.

Ideally, only a small scope of accounts should be provided with highly privileged access within a domain. Accounts with highly privileged permissions should not be leveraged for daily use; used for interactive or remote logons to workstations, laptops, or common servers; or used for performing functions on non-domain controller (Tier 0) assets.For additional recommendations for restricting access for privileged accounts, reference the Privileged Account Logon Restrictions section of this blog post.

Detection Opportunities for Privileged Accounts, Groups, and GPO Modifications

Use Case	MITRE	Description
Interactive or Remote Logon of a Highly Privileged Account to an Unauthorized System	T1078 – Valid Accounts	Search for logon attempts correlating to highly privileged accounts authenticating to systems that reside outside of the Tier 0 layer.
Privileged Account and Group Discovery	T1069 – Permission Groups Discovery T1078 – Valid Accounts	Search for command-line events where a user is attempting to enumerate privileged accounts and groups.
Account Added to Highly Privileged Group	T1078 – Valid Accounts T1098 – Account Manipulation	Identify when accounts are added to highly privileged groups. While this can occur as part of normal activity, it should be infrequent and limited to specific accounts.
Modification of Group Policy Objects	T1484.001 – Domain Policy Modification: Group Policy Modification	Identify when GPOs are created or modified. GPOs can also be exported and reviewed to identify last modification timestamps. `get-gpo -all \| export-csv -path "c:\temp\gpo-listing-all.csv" -NoTypeInformation` Figure 30: PowerShell cmdlet to export and review GPO creation and modification timestamps
DCSync Attack	T1003.006 - OS Credential Dumping	Monitor for non-domain-controller sources issuing directory replication requests (DS-Replication-Get-Changes and DS-Replication-Get-Changes-All). Event ID 4662 with properties matching the replication GUIDs (1131f6aa-, 1131f6ad-) from non-domain-controller source addresses is a high-fidelity indicator of DCSync.

Table 20: Detection opportunities for privileged accounts, groups, and GPO modifications

Privileged and Service Account Protections

Identify and Review Noncomputer Accounts Configured with an SPN

Accounts with service principal names (SPNs) are commonly targeted by threat actors for privilege escalation. Using Kerberos, any domain user can request a Kerberos service ticket (TGS) from a domain controller for any account configured with an SPN. Noncomputer accounts likely are configured with guessable (nonrandom) passwords. Regardless of the domain function level or the host's Windows version, SPNs that are registered under a noncomputer account will use the legacy RC4-HMAC encryption suite rather than Advanced Encryption Standard (AES). The key used for encryption and decryption of the RC4-HMAC encryption type represents an unsalted NTLM hash version of the account's password, which could be derived via cracking the ticket.

Organizations should review Active Directory to identify noncomputer accounts configured with an SPN. Noncomputer accounts correlated to registered SPNs are likely service accounts and provide a method for a threat actor (without administrative privileges) to potentially derive (crack) the plain-text password for the account (Kerberoasting). To identify noncomputer accounts configured with an SPN, the PowerShell cmdlet referenced in Figure 31 can be run from a domain controller.

Get-ADUser -Filter {(ServicePrincipalName -like "*")} | Select-Object name,samaccountname,sid,enabled,DistinguishedName

Figure 31: PowerShell cmdlet to identify noncomputer accounts configured with an SPN

Where possible, organizations should deregister noncomputer accounts with SPNs configured. Where SPNs are needed, organizations should mitigate the risk associated with Kerberoasting attacks. Accounts with SPNs should be configured with strong, unique passwords (e.g., minimum 25+ characters) with the passwords rotated on a periodic basis for the accounts. Furthermore, privileges should be reviewed and reduced for these accounts to ensure that each account has the minimum required privileges needed for the intended function.

Accounts with SPNs should be considered in-scope for the proactive hardening measures detailed throughout this blog post.

Note: SPNs should never be associated with regular interactive user accounts.

Detection Opportunities for Noncomputer Accounts Configured with an SPN

Use Case	MITRE ID	Description
Potential Kerberoasting Attempt Using RC4	T1558.003 – Steal or Forge Kerberos Tickets: Kerberoasting	Searching for a Kerberos request using downgraded RC4 encryption.
AS-REP Roasting	T1558.004 - Steal or Forge Kerberos Tickets	Monitor Event ID 4768 for Kerberos authentication requests using RC4 encryption (0x17) for accounts with the "Do not require Kerberos preauthentication" flag set. Unlike Kerberoasting (which targets SPNs), AS-REP Roasting targets accounts with disabled preauthentication (which should be reviewed and mitigated).

Table 21: Detection opportunities for noncomputer accounts configured with an SPN

Privileged Account Logon Restrictions

Privileged and service account credentials are commonly used for lateral movement and establishing persistence.

For any accounts that have privileged access throughout an environment, the accounts should not be used on standard workstations and laptops, but rather from designated systems (e.g., privileged access workstations [PAWs]) that reside in restricted and protected VLANs and tiers. Dedicated privileged accounts should be defined for each tier, with controls that enforce that the accounts can only be used within the designated tier. Guardrail enforcement for privileged accounts can be defined within GPOs or by using authentication policy silos (Windows Server 2012 R2 domain-functional level or above).

The recommendations for restricting the scope of access for privileged accounts are based upon Microsoft's guidance for securing privileged access. For additional information, reference:

User Rights Assignments

As a proactive hardening or quick containment measure, consider blocking any accounts with privileged AD access from being able to log in (remotely or locally) to standard workstations, laptops, and common access servers (e.g., virtualized desktop infrastructure).

The settings referenced as follows are configurable using user rights assignments defined within GPOs via the path of:

Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > User Rights Assignment

Accounts delegated with domain-based privileged access should be explicitly denied access to standard workstations and laptop systems within the context of the following settings (which can be configured using GPO settings similar to what are depicted in Figure 32):

Deny access to this computer from the network (also include S-1-5-114: NT AUTHORITY\Local account and member of Administrators group) (SeDenyNetworkLogonRight)
Deny logon as a batch job (SeDenyBatchLogonRight)
Deny logon as a service (SeDenyServiceLogonRight)
Deny logon locally (SeDenyInteractiveLogonRight)
Deny logon through Terminal Services (SeDenyRemoteInteractiveLogonRight)

Figure 32: Example of privileged account access restrictions for a standard workstation using GPO settings

Additionally, using GPOs, permissions can be restricted on endpoints to protect against privilege escalation and potential data theft by reducing the scope of accounts that have the following user rights assignments:

Debug programs (SeDebugPrivilege)
Back up files and directories (SeBackupPrivilege)
Restore files and directories (SeRestorePrivilege)
Take ownership of files or other objects (SeTakeOwnershipPrivilege)

Detection Opportunities for Privileged Account Logons

Use Case	MITRE ID	Description
Attempted Logon of a Privileged Account from a Nonprivileged Access Workstation	T1078 – Valid Accounts	Search for logon attempts correlating to highly privileged accounts authenticating to systems that reside outside of the Tier 0 layer.

Table 22: Detection opportunities for privileged account logons

Service Account Logon Restrictions

Organizations should also consider enhancing the security of domain-based service accounts to restrict the capability for the accounts to be used for interactive, remote desktop, and, where possible, network-based logons.

Minimum recommended logon hardening for service accounts (on endpoints where the service account is not required for interactive or remote logon purposes):

Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > User Rights Assignment
- Deny logon locally (SeDenyInteractiveLogonRight)
- Deny logon through Terminal Services (SeDenyRemoteInteractiveLogonRight)

Additional recommended logon hardening for service accounts (on endpoints where the service accounts is not required for network-based logon purposes):

Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > User Rights Assignment
- Deny access to this computer from the network (SeDenyNetworkLogonRight)

If a service account is only required to be leveraged on a single endpoint to run a specific service, the service account can be further restricted to only permit the account's usage on a predefined listing of endpoints (Figure 33).

Active Directory Users and Computers > Select the account
- Account tab
  - Log On To button > Select the proper scope of computers for access

Figure 33: Option to restrict an account to log onto specific endpoints

Detection Opportunities for Service Account Logons

Use Case	MITRE ID	Description
Anomalous Logon from a Service Account	T1078 – Valid Accounts	Search for login attempts for a service account on a new (unexpected) endpoint. This will require baselining service accounts to expected (approved) systems.

Table 23: Detection opportunities for service account logons

Managed/Group Managed Service Accounts

Organizations with static service accounts should review the feasibility of migrating the service accounts to be managed service accounts (MSAs) or group managed service accounts (gMSAs).

MSAs were first introduced with the Windows Server 2008 R2 Active Directory schema (domain-functional level) and provide automatic password management (30-day rotation) for dedicated service accounts that are associated with running services on specific endpoints.

Standard MSA: The account is associated with a single endpoint, and the complex password for the account is automatically managed and changed on a predefined frequency (30 days by default). While an MSA can only be associated with a single computer account, multiple services on the same endpoint can leverage the MSA.
Group managed service account (gMSA): First introduced with Windows Server 2012 and are very similar to MSAs, but allow for a single gMSA to be leveraged across multiple endpoints.

Common uses for MSAs and gMSAs:

Scheduled Tasks
Internet Information Services (IIS) application pools
Structured Query Language (SQL) services (SQL 2012 and later) – Express editions are not supported by MSAs.
Microsoft Exchange services
Network Load Balancing (clustering) – gMSAs only
Third-party applications that support MSAs

Note: Threat actors can potentially discover accounts and groups that have permissions to read/leverage the password for a gMSA for privilege escalation and lateral movement. This can be accomplished by leveraging the get-adserviceaccount PowerShell cmdlet and enumerating the msDS-GroupMSAMembership (PrincipalsAllowedToRetrieveManagedPassword) configuration for a gMSA, which stores the security principals that can access the gMSA password. It is important that when configuring managed service accounts, organizations focus on restricting the scope of accounts and groups that have the ability to obtain and leverage the password for the managed service accounts and enforce structured monitoring of these accounts and groups.

For additional information related to MSAs and gMSAs, reference:

Detection Opportunities for Managed/Group Managed Service Accounts

Use Case

MITRE ID

Description

Group Membership Addition

T1069 – Permission Groups Discovery

T1098 – Account Manipulation

Search for MSAs/gMSAs and the associated PrincipalsAllowedToRetrieveManagedPassword or PrincipalsAllowedToDelegateToAccount permissions, which could provide the ability to leverage the MSA/gMSA for malicious purposes.

Example reconnaissance commands for querying for MSAs/gMSAs and associated attributes:

get-adserviceaccount

get-adserviceaccount -filter {name -eq 'account-name'} -prop * | select Name, MemberOf, PrincipalsAllowedToDelegateToAccount, PrincipalsAllowedToRetrieveManagedPassword

Figure 34: Example reconnaissance commands for querying for MSAs/gMSAs

Table 24: Detection opportunities for managed/group managed service accounts

Protected Users Security Group

By leveraging the Protected Users security group for privileged accounts, an organization can minimize various exposure factors and common exploitation methods by a threat actor or malware variant obtaining credentials for privileged accounts on disk or in memory from endpoints.

Beginning with Microsoft Windows 8.1 and Microsoft Windows Server 2012 R2 (and above), the Protected Users security group was introduced to manage credential exposure within an environment. Members of this group automatically have specific protections applied to accounts, including:

The Kerberos ticket granting ticket (TGT) expires after four hours, rather than the normal 10-hour default setting.
No NTLM hash for an account is stored in LSASS, since only Kerberos authentication is used (NTLM authentication is disabled for an account).
Cached credentials are blocked. A domain controller must be available to authenticate the account.
WDigest authentication is disabled for an account, regardless of an endpoint's applied policy settings.
DES and RC4 cannot be used for Kerberos preauthentication (Server 2012 R2 or higher); rather, Kerberos with AES encryption will be enforced.
Accounts cannot be used for either constrained or unconstrained delegation (equivalent to enforcing the Account is sensitive and cannot be delegated setting in Active Directory Users and Computers).

To provide domain controller-side restrictions for members of the Protected Users security group, the domain functional level must be Windows Server 2012 R2 (or higher). Microsoft Security Advisory KB2871997 adds compatibility support for the protections enforced for members of the Protected Users security group for Windows 7, Windows Server 2008 R2, and Windows Server 2012 systems.

Successful (Event IDs 303, 304) or failed (Event IDs 100, 104) logon events for members of the Protected Users security group can be recorded on domain controllers within the following event logs:

%SystemRoot%\System32\Winevt\Logs\Microsoft-Windows-Authentication%4ProtectedUserSuccesses-DomainController.evtx

%SystemRoot%\System32\Winevt\Logs\Microsoft-Windows-Authentication%4ProtectedUserFailures-DomainController.evtx

The event logs are disabled by default and must be enabled on each domain controller. The PowerShell cmdlets referenced in Figure 35 can be leveraged to enable the event logs for the Protected Users security group on a domain controller.

$log1 = New-Object System.Diagnostics.Eventing.Reader.EventLogConfiguration Microsoft-Windows-Authentication/ProtectedUserSuccesses-DomainController
$log1.IsEnabled=$true
$log1.SaveChanges()

$log2 = New-Object System.Diagnostics.Eventing.Reader.EventLogConfiguration Microsoft-Windows-Authentication/ProtectedUserFailures-DomainController
$log2.IsEnabled=$true
$log2.SaveChanges()

Figure 35: PowerShell cmdlets for enabling event logging for the Protected Users security group on domain controllers

Note: Service accounts (including MSAs) should not be added to the Protected Users security group, as authentication will fail.

If the Protected Users security group cannot be used, at a minimum, privileged accounts should be protected against delegation by configuring the account with the Account is Sensitive and Cannot Be Delegated flag in Active Directory.

Detection Opportunities for the Protected Users Security Group

Use Case	MITRE ID	Description
Removal of Account from Protected User Group	T1098 – Account Manipulation	Search for an account that has been removed from the Protected Users group.
Attempted Logon of an Account in the Protected User Group from a Nonprivileged Access Workstation	T1078 – Valid Accounts	Search for logon attempts from accounts in the Protected Users group authenticating from workstations of nonprivileged users.

Table 25: Detection opportunities for the Protected Users security group

Clear-Text Password Protections

In addition to restricting access for privileged accounts, controls should be enforced that minimize the exposure of credentials and tokens in memory on endpoints.

On older Windows versions, clear-text passwords are stored in memory (LSASS) to primarily support WDigest authentication. WDigest should be explicitly disabled on all Windows endpoints where it is not disabled by default.

By default, WDigest authentication is disabled in Windows 8.1+ and in Windows Server 2012 R2+.

Beginning with Windows 7 and Windows Server 2008 R2, after installing KB2871997, WDigest authentication can be configured either by modifying the registry or by using the Microsoft Security Guide GPO template from the Microsoft Security Compliance Toolkit.

Registry Method

HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest\UseLogonCredential
REG_DWORD = "0"

Figure 36: Registry key and value for disabling WDigest authentication

Another registry setting that should be explicitly configured is the TokenLeakDetectDelaySecs setting (Figure 37), which will clear credentials in memory of logged-off users after 30 seconds, mimicking the behavior of Windows 8.1 and above.

HKLM\SYSTEM\CurrentControlSet\Control\Lsa\TokenLeakDetectDelaySecs
REG_DWORD = "30"

Figure 37: Registry key and value for enforcing the TokenLeakDetectDelaySecs setting

Group Policy Method

Using the Microsoft Security Guide Group Policy template, WDigest authentication can be disabled via a GPO setting (Figure 38).

Computer Configuration > Policies > Administrative Templates > MS Security Guide > WDigest Authentication
- Disabled

Figure 38: Disabling WDigest authentication via the MS Security Guide Group Policy Template

Additionally, an organization should verify that Allow* settings are not specified within the registry keys referenced in Figure 39, as this configuration would permit the tspkgs/CredSSP providers to store clear-text passwords in memory.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Credssp\PolicyDefaults
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CredentialsDelegation

Figure 39: Additional registry keys for hardening against clear-text password storage

Group Policy Reprocessing

Threat actors can manually enable WDigest authentication on endpoints by directly modifying the registry (UseLogonCredential configured to a value of 1). Even on endpoints where WDigest authentication is automatically disabled by default, it is recommended to enforce the GPO settings noted as follows, which will enforce automatic group policy reprocessing for the configured (expected) settings on an automated basis.

Computer Configuration > Policies > Administrative Templates > System > Group Policy > Configure security policy processing
- Enabled - Process even if the Group Policy objects have not changed
Computer Configuration > Policies > Administrative Templates > System > Group Policy > Configure registry policy processing
- Enabled - Process even if the Group Policy objects have not changed

Note: By default, Group Policy settings are only reprocessed and reapplied if the actual Group Policy was modified prior to the default refresh interval.

As KB2871997 is not applicable for Windows XP, Windows Server 2003, and Windows Server 2008, to disable WDigest authentication on these platforms, prior to a system reboot, WDigest needs to be removed from the listing of LSA security packages within the registry (Figure 40 and Figure 41).

HKLM\System\CurrentControlSet\Control\Lsa\Security Packages

Figure 40: Registry key to modify LSA security packages

Figure 41: LSA security package registry key before and after removal of WDigest authentication from listing of providers

Detection Opportunities for WDigest Authentication Conditions

Use Case

MITRE ID

Description

Enable WDigest Authentication

T1112 – Modify Registry

Search for evidence of WDigest being enabled in the Windows Registry.

HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest\UseLogonCredential

REG_DWORD = "1"

Figure 42: WDigest Windows Registry modification

LSASS Memory Access

T1003.002 - OS Credential Dumping - LSASS Memory

Monitor for processes accessing lsass.exe memory (Sysmon Event ID 10 with GrantedAccess 0x1010 or 0x1FFFFF). Alert on any non-system process opening a handle to LSASS. Deploy LSA Protection (RunAsPPL) and Credential Guard on all supported endpoints.

Table 26: Detection opportunities for WDigest authentication conditions

Credential Protections When Using RDP

Restricted Admin Mode for RDP

Restricted Admin mode for RDP can be enabled for all end-user systems assigned to personnel that perform Remote Desktop connections to servers or workstations with administrative credentials. This feature can limit the in-memory exposure of administrative credentials on a destination endpoint when accessed using RDP.

To leverage Restricted Admin RDP, the command referenced in Figure 43 can be invoked.

mstsc.exe /RestrictedAdmin

Figure 43: Command to invoke restricted admin RDP

When an RDP connection uses the Restricted Admin mode, if the authenticating account is an administrator on the destination endpoint, the credentials for the user account are not stored in memory; rather, the context of the user account appears as the destination machine account (domain\destination-computer$).

To leverage Restricted Admin mode for RDP, settings must be enforced on the originating endpoint in addition to the destination endpoint.

Originating Endpoint (Client Mode - Windows 7 and Windows Server 2008 R2 and above)

A GPO setting must be applied to the originating endpoint initiating the remote desktop session using the Restricted Admin feature.

Computer Configuration > Policies > Administrative Templates > System > Credential Delegation > Restrict delegation of credentials to remote servers
- Require Restricted Admin > set to Enabled
  - Use the Following Restricted Mode > Required Restricted Admin

Configuring this GPO setting will result in the registry keys noted in Figure 44 being configured on an endpoint.

HKLM\Software\Policies\Microsoft\Windows\CredentialsDelegation\RestrictedRemoteAdministration
0 = Disabled
1 = Enabled

HKLM\Software\Policies\Microsoft\Windows\CredentialsDelegation\RestrictedRemoteAdministrationType
1 = Require Restricted Admin
2 = Require Remote Credential Guard
3 = Restrict Credential Delegation

Figure 44: Registry settings for requiring Restricted Admin mode

Destination Endpoint (Server Mode - Windows 8.1 and Windows Server 2012 R2 and above)

A registry setting will need to be configured (Figure 45).

HKLM\System\CurrentControlSet\Control\Lsa\DisableRestrictedAdmin
0 = Enabled
1 = Disabled

Figure 45: Registry setting for enabling or disabling Restricted Admin RDP

Recommended: Set the registry value to 0 to enable Restricted Admin mode.

With Restricted Admin RDP, another setting that should be configured is the DisableRestrictedAdminOutboundCreds registry key (Figure 46).

HKLM\System\CurrentControlSet\Control\Lsa\DisableRestrictedAdminOutboundCreds
0 = default value (doesn't exist) - Admin Outbound Creds are Enabled
1 = Admin Outbound Creds are Disabled

Figure 46: Registry setting for disabling admin outbound credentials

Recommended: Set the registry value to 1 to disable admin outbound credentials.

Note: With this setting set to 0, any outbound authentication requests will appear as the system (domain\destination-computer$) that a user connected to using Restricted Admin mode. Setting this to 1 disables the ability to authenticate to any downstream network resources when attempting to authenticate outbound from a system that a user connected to using Restricted Admin mode for RDP.

For additional information regarding Restricted Admin mode for RDP, reference:

Detection Opportunities for Restricted Admin Mode for RDP

Use Case

MITRE ID

Description

Disable Restricted Admin Mode for RDP

T1112 – Modify Registry

Search for an account disabling Restricted Admin mode for RDP in the Windows Registry.

HKLM\System\CurrentControlSet\Control\Lsa\DisableRestrictedAdmin 

REG_DWORD = "1"

Figure 47: Restricted Admin mode for RDP being disabled in the Windows Registry on a destination endpoint

Disable Require Restricted Admin

T1484.001 – Domain Policy Modification: Group Policy Modification

Search for the Require Restricted Admin option being disabled within a GPO configuration.

Computer Configuration > Policies > Administrative Templates > System > Credential Delegation > Restrict delegation of credentials to remote servers

"Require Restricted Admin" > set to Disabled

Figure 48: Require Restricted Admin being disabled in a GPO

Table 27: Detection opportunities for Restricted Admin Mode for RDP

Windows Defender Remote Credential Guard

For Windows 10 and Windows Server 2016 endpoints, Windows Defender Remote Credential Guard can be leveraged to reduce the exposure of privileged accounts in memory on destination endpoints when Remote Desktop is used for connectivity. With Remote Credential Guard, all credentials remain on the client (origination system) and are not directly exposed to the destination endpoint. Instead, the destination endpoint requests service tickets from the source as needed.

When a user logs in via RDP to an endpoint that has Remote Credential Guard enabled, none of the SSPs in memory store the account's clear-text password or password hash. Note that Kerberos tickets remain in memory to allow interactive (and single sign-on [SSO]) experiences from the destination server.

The Remote Desktop client (origination) host:

Must be running at least Windows 10 (v1703) to be able to supply credentials
Must be running at least Windows 10 (v1607) or Windows Server 2016 to use the user's signed-in credentials (no prompt for credentials)
User's account must be able to sign into both the client (origination) and the remote (destination) endpoint
Must be running the Remote Desktop Classic Windows application
Must use Kerberos authentication to connect to the remote host
The Remote Desktop Universal Windows Platform application does not support Windows Defender Remote Credential Guard.

Note: If the client cannot connect to a domain controller, then RDP attempts to fall back to NTLM. Windows Defender Remote Credential Guard does not allow NTLM fallback because this would expose credentials to risk.

The Remote Desktop remote (destination) host:

Must be running at least Windows 10 (v1607) or Windows Server 2016
Must allow Restricted Admin connections
Must allow the client's domain user to access Remote Desktop connections
Must allow delegation of nonexportable credentials

To enable Remote Credential Guard on the client (origination) host using a GPO configuration:

Computer Configuration > Administrative Templates > System > Credentials Delegation > Restrict delegation of credentials to remote servers
- To require either Restricted Admin mode or Windows Defender Remote Credential Guard, choose Prefer Windows Defender Remote Credential Guard.
  - In this configuration, Remote Credential Guard is preferred, but it will use Restricted Admin mode (if supported) when Remote Credential Guard cannot be used.
  - Neither Remote Credential Guard nor Restricted Admin mode for RDP will send credentials in clear text to the Remote Desktop server.
- To require Remote Credential Guard, choose Require Windows Defender Remote Credential Guard.
  - In this configuration, a Remote Desktop connection will succeed only if the remote computer meets the requirements for Remote Credential Guard.

To enable Remote Credential Guard on the remote (destination) host, see Figure 49.

HKLM\System\CurrentControlSet\Control\Lsa
Registry Entry: DisableRestrictedAdmin
Value: 0
reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v DisableRestrictedAdmin /d 0 /t REG_DWORD

Figure 49: Registry key and command options to enable Remote Credential Guard on a remote (destination) host

To leverage Remote Credential Guard, use the command referenced in Figure 50.

mstsc.exe /remoteguard

Figure 50: Command to leverage Remote Credential Guard

Detection Opportunities for Windows Defender Remote Credential Guard

Use Case

MITRE ID

Description

Disable Remote Credential Guard

T1112 – Modify Registry

Search for an account disabling Remote Credential Guard in the Windows Registry.

HKLM\System\CurrentControlSet\Control\Lsa

Registry Entry: DisableRestrictedAdmin

Value: 1

Figure 51: Remote Credential Guard being disabled in the Windows Registry on a destination endpoint

Disable Require Remote Credential Guard

T1484.001 – Domain Policy Modification: Group Policy Modification

Search for the Require Remote Credential Guard option being disabled within a GPO configuration.

Computer Configuration > Administrative Templates > System > Credentials Delegation > Restrict delegation of credentials to remote servers

Figure 52: Remote Credential Guard being disabled in a GPO

Table 28: Detection opportunities for Windows Defender Remote Credential Guard

Restrict Remote Usage of Local Accounts

Local accounts that exist on endpoints are often a common avenue leveraged by threat actors to laterally move throughout an environment. This tactic is especially impactful when the password for the built-in local administrator account is configured to the same value across multiple endpoints.

To mitigate the impact of local accounts being leveraged for lateral movement, organizations should consider both limiting the ability of local administrator accounts to establish remote connections and creating unique and randomized passwords for local administrator accounts across the environment.

KB2871997 introduced two well-known SIDs that can be leveraged within GPO settings to restrict the use of local accounts for lateral movement.

S-1-5-113: NT AUTHORITY\Local account
S-1-5-114: NT AUTHORITY\Local account and member of Administrators group

Specifically, the SID S-1-5-114: NT AUTHORITY\Local account and member of Administrators group is added to an account's access token if the local account is a member of the BUILTIN\Administrators group. This is the most beneficial SID to leverage to help stop a threat actor (or ransomware variant) that propagates using credentials for any local administrative accounts.

Note: For SID S-1-5-114: NT AUTHORITY\Local account and member of Administrators group, if Failover Clustering is used, this feature should leverage a nonadministrative local account (CLIUSR) for cluster node management. If this account is a member of the local Administrators group on an endpoint that is part of a cluster, blocking the network logon permissions can cause cluster services to fail. Be cautious and thoroughly test this configuration on servers where Failover Clustering is used.

Step 1 – Option 1: S-1-5-114 SID

To mitigate the use of local administrative accounts from being used for lateral movement, use the SID S-1-5-114: NT AUTHORITY\Local account and member of Administrators group within the following settings:

Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > User Rights Assignment
- Deny access to this computer from the network (SeDenyNetworkLogonRight)
- Deny logon as a batch job (SeDenyBatchLogonRight)
- Deny logon as a service (SeDenyServiceLogonRight)
- Deny logon through Terminal Services (SeDenyRemoteInteractiveLogonRight)
- Debug programs (SeDebugPrivilege: Permission used for attempted privilege escalation and process injection)

Step 1 – Option 2: UAC Token-Filtering

An additional control that can be enforced via GPO settings pertains to the usage of local accounts for remote administration and connectivity during a network logon. If the full scope of permissions (referenced previously) cannot be implemented in a short timeframe, consider applying the User Account Control (UAC) token-filtering method to local accounts for network-based logons.

To leverage this configuration via a GPO setting:

Download the Security Compliance Toolkit (https://www.microsoft.com/en-us/download/details.aspx?id=55319) to use the MS Security Guide ADMX file.
Once downloaded, the SecGuide.admx and SecGuide.adml files must be copied to the \Windows\PolicyDefinitions and \Windows\PolicyDefinitions\en-US directories respectively.
If a centralized GPO store is configured for the domain, copy the PolicyDefinitions folder to the C:\Windows\SYSVOL\sysvol\\Policies folder.

GPO Setting

Computer Configuration > Policies > Administrative Templates > MS Security Guide > Apply UAC restrictions to local accounts on network logons
- Enabled

Once enabled, the registry value (Figure 53) will be configured on each endpoint.

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy

REG_DWORD = "0" (Enabled)

Figure 53: Registry key and value for enabling UAC restrictions for local accounts

When set to 0, remote connections with high-integrity access tokens are only possible using either the plain-text credential or password hash of the RID 500 local administrator (and only then depending on the setting of FilterAdministratorToken, which is configurable via the GPO setting of User Account Control: Admin Approval Mode for the built-in Administrator account).

The FilterAdministratorToken option can either enable (1) or disable (0) (default) Admin Approval mode for the RID 500 local administrator. When enabled, the access token for the RID 500 local administrator account is filtered and therefore UAC is enforced for this account (which can ultimately stop attempts to leverage this account for lateral movement across endpoints).

GPO Setting

Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Security Options > User Account Control: Admin Approval Mode for the built-in Administrator account

Once enabled, the registry value (Figure 54) will be configured on each endpoint.

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken

REG_DWORD = "1" (Enabled)

Figure 54: Registry key and value for requiring Admin Approval Mode for local administrative accounts

Note: It is also prudent to ensure that the default setting for User Account Control: Run all administrators in Admin Approval Mode (EnableLUA option) is not changed from Enabled (default, as shown in Figure 55) to Disabled. If this setting is disabled, all UAC policies are also disabled. With this setting disabled, it is possible to perform privileged remote authentication using plain-text credentials or password hashes with any local account that is a member of the local Administrators group.

GPO Setting

Computer Configuration > Policies > Administrative Templates > MS Security Guide > User Account Control: Run all administrators in Admin Approval Mode
- Enabled

Once enabled, the registry value (Figure 55) will be configured on each endpoint. This is the default setting.

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA

REG_DWORD = "1" (Enabled)

Figure 55: Registry key and value for requiring Admin Approval Mode for all local administrative accounts

UAC access token filtering will not affect any domain accounts in the local Administrators group on an endpoint.

Step 2: LAPS

In addition to blocking the use of local administrator accounts from remote authentication to access endpoints, an organization should align a strategy to enforce password randomization for the built-in local administrator account. For many organizations, the easiest way to accomplish this task is by deploying and leveraging Microsoft's Local Administrator Password Solutions (LAPS).

Additional information regarding LAPS, and here too.

Detection Opportunities for Local Accounts

Use Case	MITRE ID	Description
Attempted Remote Logon of Local Account	T1078.003 - Valid Accounts: Local Accounts	Search for remote logon attempts for local accounts on an endpoint.

Table 29: Detection opportunities for local accounts

Active Directory Certificate Services (AD CS) Protections

Active Directory Certificate Services (AD CS) is Microsoft's implementation of Public Key Infrastructure (PKI) and integrates directly with Active Directory forests and domains. It can be utilized for a variety of purposes, including digital signatures and user authentication. Certificate Templates are used in AD CS to issue certificates that have been preconfigured for particular tasks. They contain settings and rules that are applied to incoming certificate requests and provide instructions on how a valid certificate request is provided.

In June of 2021, SpecterOps published a blog post named Certified Pre-Owned, which details their research into possible attacks against AD CS. Since that publication, Mandiant has continued to observe both threat actors and red teamers enhance targeting of AD CS in support of post-compromise objectives. Mandiant's blog post and hardening guide address the continued abuse scenarios and AD CS attack vectors identified through our frontline observations of recent security breaches.

Discover Vulnerable Certificate Templates

Certificate templates that have been configured and published by AD CS are stored in Active Directory as objects with an object class of pKICertificateTemplate and can be discovered by blue teams as well as threat actors. Any account that is authenticated to Active Directory can query LDAP directly, with the built-in Windows command certutil.exe, or with specialized tools such as PSPKIAudit, Certipy, and Certify. Mandiant recommends using one of these methods to discover vulnerable certificate templates.

Harden Vulnerable Certificate Templates

Once discovered, vulnerable certificate templates should be hardened to prevent abuse.

Ensure that all domain controllers and Certificate Authority servers are patched with the latest updates and hotfixes.
After installing Windows update (KB5014754) and monitoring/remediating for Event IDs 39 and 41, configure Active Directory to support full enforcement mode to reject authentications based on weaker mappings in certificates.
Using one of the aforementioned methods, regularly review published certificate templates, specifically for any settings related to SAN specifications configured in existing templates.
Review the security permissions assigned to all published certificate templates and validate the scope of enrollment and write permissions are delegated to the correct security principals.
Review published templates configured with the following Enhanced Key Usages (EKUs) that support domain authentication and verify the operational requirement for these configurations.

Any Purpose (2.5.29.37.0)
Subordinate CA (None)
Client Authentication (1.3.6.1.5.5.7.3.2)
PKINIT Client Authentication (1.3.6.1.5.2.3.4)
Smart Card Logon (1.3.6.1.4.1.311.20.2.2)

For templates with sensitive Enhanced Key Usage (EKU), limit enrollment permissions to predefined users or groups, as certificates with EKUs can be used for multiple purposes. Access control lists for templates should be audited to ensure that they align with the principle of least privilege.Templates that allow for domain authentication should be carefully reviewed to verify that built-in groups that contain a large scope of accounts are not assigned enrollment permissions. Example: built-in groups that could increase the risk for abuse include:

Everyone
NT AUTHORITY\Authenticated Users
Domain Users
Domain Computers

Where possible, enforce "CA Certificate Manager approval" for any templates that include a SAN as an issuance requirement. This will require that any certificate issuance requests be manually reviewed and approved by an identity assigned the "Issue and Manage Certificates" permission on a certificate authority server.

Ensure that Certificate Authorities have not been configured to accept any SAN (irrelevant of the template configuration). This is a non-default configuration and should be avoided wherever possible. This abuse vector is mitigated by KB5014754, but until enforcement of strong mappings is enforced, abuse could still occur based upon historical certificates missing the new OID containing the requester's SID. For additional information, reference the following Microsoft article.

Treat both root and subordinate certificate authorities as Tier 0 assets and enforce logon restrictions or authentication policy silos to limit the scope of accounts that have elevated access to the servers where certificate services are installed and configured.

Audit and review the NTAuthCertificates container in AD to validate the referenced CA certificates, as this container references CA certificates that enable authentication within AD. Before authenticating a principal, AD checks the NTAuthCertificates container for the CA specified in the authenticating certificate's Issuer field to validate the authenticity of the CA. If rogue or unauthorized CA certificates are present, this could be indicative of a security event that requires further triage and investigation.

To avoid the theft of a CA's private keys (e.g., via the DPAPI backup protocol), protect the private keys by leveraging a Hardware Security Module (HSM) on servers where certificate authority services are installed and configured.

Enforce multifactor authentication (MFA) for CA and AD management and operations.

Keep the root CA offline and use subordinate CAs to issue certificates.

Regularly validate and identify potential misconfigurations within existing certificate templates using the built-in Windows command certutil.exe, or with specialized tools such as PSPKIAudit, Certipy, and Certify. Public tools (e.g., PSPKIAudit, Certipy, or Certify) may be flagged by EDR products as they are frequently used by red teams and threat actors.

To mitigate NTLM Relay attacks in AD CS, enable Extended Protection For Authentication for Certificate Authority Web Enrollment and Certificate Enrollment Web Service. Additionally, require that AD CS accept only HTTPS connections. For additional details, reference the following Microsoft Article.

Enable audit logging for Certificate Services on CA servers and Kerberos Authentication Service on Domain Controllers by using group policy. Ensure that event IDs 4886 and 4887 from CA servers and 4768 from domain controllers are aggregated in the organization's SIEM solution.

Enable the audit filter on each CA server. This is a bitmask value that represents the seven different audit categories that can be enabled; if all values are enabled, the audit filter will have a value of 127.

Log and monitor events from the CA servers and domain controllers to enhance detections related to AD CS activities (steps 16 and 17 are needed to ensure the appropriate logs are generated).

Detection Opportunities for AD CS Abuse

Certificate Request with Mismatched SAN (ESC1)

T1649 - Steal or Forge Authentication Certificates

Monitor event IDs 4886 (certificate request received) and 4887 (certificate issued) on CA servers. Alert when the requesting account's identity differs from the Subject Alternative Name (SAN) specified in the certificate.

NTLM Relay to AD CS Web Enrollment (ESC8)

T1557.001 - LLMNR/NBT-NS Poisoning and SMB Relay

T1649 - Steal or Forge Authentication Certificates

Monitor for NTLM authentication to AD CS HTTP enrollment endpoints from domain controllers or privileged servers. Correlate with PetitPotam coercion indicators. This attack chain provides a direct path from any domain user to Domain Admin.

Table 30: Detection opportunities for AD CS abuse

5. Preventing Destructive Actions in Kubernetes and CI/CD Pipelines

Organizations should implement a proactive, defense-in-depth technical hardening strategy to systematically address foundational security gaps and mitigate the risk of destructive actions across their Kubernetes environments and Continuous Integration/Continuous Delivery or Deployment (CI/CD) pipelines. Adversaries increasingly target the CI/CD pipeline and the Kubernetes control plane because they serve as centralized hubs with direct access to application deployments and underlying infrastructure.

Source and Build Compromise: Threat actors target code repositories (e.g., GitHub, GitLab, Azure DevOps) and build environments to steal injected environment variables and secrets. Attackers can then commit malicious workflow files designed to exfiltrate repository data or deploy unauthorized infrastructure.
Container Registry Poisoning: By compromising developer credentials or CI/CD pipeline permissions, attackers overwrite legitimate application images in the container registry. When the Kubernetes cluster pulls the updated image, it unknowingly deploys a poisoned container embedded with backdoors, ransomware, or destructive data-wiping logic.
Cluster-Level Destruction: Once an attacker gains a foothold inside the Kubernetes cluster, they often abuse over-permissive role-based access control (RBAC) configurations. This provides the capability to execute destructive commands using application programming interfaces (APIs) (e.g., kubectl delete deployments), wipe persistent volumes, or delete critical namespaces, effectively causing a loss of availability and application denial of service.
Secrets Extraction and Lateral Movement: Attackers routinely execute Kubernetes-specific attack tools to harvest secrets from compromised Kubernetes pods. These secrets often contain database passwords and cloud identity and access management (IAM) keys, allowing the attacker to pivot out of the cluster and impact cloud-based resources.

Additional information related to securing CI/CD.

Hardening and Mitigation Guidance

To defend against CI/CD compromises and destructive actions within Kubernetes, organizations must enforce strict identity boundaries, cryptographic trust, and a least-privilege architecture.

Isolate the Kubernetes Control Plane: Disable unrestricted and public internet access to the Kubernetes API server. For managed services like GKE, EKS, and AKS, ensure the control plane is configured as a private endpoint or heavily restricted via authorized network IP allow-listing. Access to the API should only be permitted from trusted, designated internal management subnets or secure corporate VPNs.
Secure Management Interfaces and CI/CD Pipelines: Enforce mandatory MFA for all access to infrastructure management platforms, including source code repositories such as GitLab/GitHub, and container registries. Utilize hardened container images (e.g., Chainguard containers, Docker Hardened Images) as base images. Implement software supply chain security frameworks (like SLSA) by requiring image signing, provenance generation, and admission controllers (such as Binary Authorization). This ensures that the Kubernetes cluster will definitively reject and block any unverified or poisoned container images from running.
Enforce Strict RBAC and Least Privilege: To limit the "blast radius" of a compromised pod, restrict the use of the cluster-admin role and strictly prohibit wildcard (*) permissions for standard service accounts. Workloads must run under strict security contexts—blocking containers from executing as root, preventing privilege escalation, and restricting access to the underlying worker node (e.g., disabling hostPID and hostNetwork).
Implement Immutable Cluster Backups: Protect the cluster's state (etcd) and stateful workload data (Persistent Volumes) by utilizing immutable backup repositories. This ensures that even if an attacker gains administrative access to the cluster or CI/CD pipeline and attempts to maliciously delete all resources, the backups cannot be destroyed or altered.
Enable Audit Logging and Threat Detection: Ensure Kubernetes Control Plane audit logs, node-level telemetry, and CI/CD pipeline logs are actively forwarded to a centralized SIEM. Deploy dedicated container threat detection capabilities to immediately alert on malicious exec commands, suspicious Kubernetes enumeration tools, or bulk data deletion attempts within the pods.

Additional information related to securing Kubernetes.

Detection Opportunities for Kubernetes and CI/CD

Use Case	MITRE ID	Description
Bulk Kubernetes Resource Deletion	T1485 - Data Destruction	Monitor Kubernetes API audit logs for bulk delete operations targeting Deployments, StatefulSets, Persistent Volume Claims, Namespaces, or ConfigMaps.
Unsigned or Modified Container Image Deployed to Cluster	T1525 - Implant Internal Image	Monitor container registries and Kubernetes admission events for deployment of images that fail signature verification, lack provenance attestation, or originate from untrusted registries.
Anomalous Kubernetes Secret Access	T1552.007 - Unsecured Credentials: Container API	Monitor Kubernetes audit logs for API calls to /api/v1/secrets or /api/v1/namespaces/*/secrets from service accounts or users that do not normally access secrets. Alert on bulk secret enumeration and on access to secrets in sensitive namespaces.
Unauthorized Modification to CI/CD Pipeline Configuration	T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain	Monitor source code repositories for modifications to CI/CD pipeline configuration files. Alert on changes to pipeline definitions made by accounts that are not members of designated pipeline-owner groups, or changes pushed code outside of an approved pull request/merge request workflow.
Privileged Container or Host Namespace Access	T1611 - Escape to Host	Monitor Kubernetes audit logs for pod creation or modification events requesting privileged security contexts, host namespace access, or volume mounts to sensitive host paths. These configurations allow container escape and direct access to the underlying worker node. Alert on any workload requesting these capabilities outside or pre-approved system namespaces.
Kubernetes Audit Logging or Security Agent Tampering	T1562.007 - Impair Defenses: Disable or Modify Cloud Firewall	Monitor for modifications to Kubernetes API server audit policy configurations, deletion or redirection of log export sinks, and disablement or removal of container runtime security agents. Alert on changes to cluster-level logging configurations in managed services (GKE Cloud Audit Logs, EKS Control Plane Logging, AKS Diagnostic Settings) including disablement of API server, authenticator, or scheduler log streams.

Table 31: Detection opportunities for Kubernetes and CI/CD

Conclusion

Destructive attacks, including ransomware, pose a serious threat to organizations. This blog post provides practical guidance on protecting against common techniques used by threat actors for initial access, reconnaissance, privilege escalation, and mission objectives. This blog post should not be considered as a comprehensive defensive guide for every tactic, but it can serve as a valuable resource for organizations to prepare for such attacks. It is based on front-line expertise with helping organizations prepare, contain, eradicate, and recover from potentially destructive threat actors and incidents.

The 25 Best PS5 Games Right Now

Fri, 08 May 2026 18:33:18 +0200

CNET's gaming experts have deliberated and come up with the top PlayStation 5 games you can play right now, such as Astro Bot, Marathon and Clair Obscur: Expedition 33.

Nutanix and Palo Alto Networks Integrate for Robust Model Trust

Thu, 07 May 2026 20:08:52 +0200

Secure your AI models. The Nutanix and Palo Alto Networks Prisma AIRS integration provides advanced AI Model Security and AI Red Teaming for a secure-by-design AI pipeline. The post Nutanix and Palo Alto Networks Integrate for Robust Model Trust appeared…

The post Nutanix and Palo Alto Networks Integrate for Robust Model Trust appeared first on IT Security News.

"SteelSeries finally helped me retire my battered 2015 Astro A50": This is the multiplatform headset, perfected

Thu, 07 May 2026 16:56:12 +0200

Finally, after almost a decade, I've replaced my battered Astro A50 headset. The Arctis Nova Pro Omni ticks every single box for multiplatform gamers, in an option far more affordable than its Elite cousin.

Critical Palo Alto Networks software bug hits exposed firewalls

Thu, 07 May 2026 13:24:03 +0200

Palo Alto Networks is warning customers about a critical buffer overflow vulnerability affecting its PAN-OS user-ID authentication portal that is already being exploited in the wild.

The flaw allows attackers to execute arbitrary code with root privileges on exposed firewalls, the company said in a security advisory. PAN-OS is the software that runs all Palo Alto Networks next-generation firewalls.

“This issue is applicable only to PA-Series and VM-Series firewalls that are configured to use User-ID Authentication Portal,” the company added. “Prisma Access, Cloud NGFW, and Panorama appliances are not impacted by this vulnerability.”

The advisory noted that “limited exploitation” was seen targeting authentication portals exposed to untrusted IP addresses and the public internet. Customers restricting these portals to trusted internal networks are safe.

The issue is awaiting a fix in the upcoming releases of PAN-OS, and users were requested to apply workarounds and mitigations in the meantime.

Root access through a firewall login portal

The flaw, tracked as CVE-2026-0300, carries a CVSS score of 9.3 in internet-exposed deployments and has been classified as an out-of-bounds write vulnerability, mapped to CWE-787. According to Palo Alto Networks, the issue allows unauthenticated attackers to execute arbitrary code with root privileges on affected devices.

The flaw only impacts PAN-OS deployments where User-ID Authentication Portal is enabled. Affected versions span multiple PAN-OS release branches, including 10.2,11.1, and 12.1 releases prior to patched builds scheduled for rollout in May.

Wiz researcher Merav Bar said the Google-owned research firm found a total 7% of environments having publicly exposed PAN-OS instances. However, how many of them have the affected portal enabled is not known. “Since this portal utilizes ports 6081 and 6082, the exposure of these specific ports is the primary metric for exploitability,” she added in a blog post. “Currently, Shodan identifies 67 exposed PAN-OS servers on port 6081, with none detected on port 6082.”

The vulnerability has also attracted government attention. The US Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-0300 to its known Exploited Vulnerabilities (KEV) catalog shortly after the disclosure, while multiple national cybersecurity agencies warned organizations to assume further exploitation is likely.

Mitigations first, patches shortly after

While Palo Alto Networks has announced fixes for affected PAN-OS branches, the company is urging customers to immediately reduce exposure rather than wait for patch windows. The vendor said the most important mitigation is restricting access to the User-Id Authentication Portal so it is reachable only from trusted internal IP addresses.

Organizations that do not rely on the Captive Portal feature are being advised to disable it entirely. Palo Alto also recommended disabling Response Pages on interfaces exposed to untrusted traffic while keeping them enabled only on trusted internal interfaces where legitimate users connect.

For customers with Threat Prevention subscriptions, Palo Alto said attacks can additionally be blocked using Threat ID 510019 included in Applications and Threats content version 9097-10022, though decoder support requires PAN-OS 11.1 or later.

CVE-2026-0300 | Palo Alto Cloud NGFW/PAN-OS/Prisma Access out-of-bounds write (EUVD-2026-27879)

Wed, 06 May 2026 23:09:57 +0200

A vulnerability, which was classified as critical, was found in Palo Alto Cloud NGFW, PAN-OS and Prisma Access. This issue affects some unknown processing. Such manipulation leads to out-of-bounds write. This vulnerability is documented as CVE-2026-0300. The attack can be executed remotely. There is not any exploit available.

Critical Buffer Overflow in Palo Alto Networks PAN-OS User-ID Authentication Portal (CVE-2026-0300)

Wed, 06 May 2026 15:54:47 +0200

Overview

On May 6, 2026, Palo Alto Networks published a security advisory for CVE-2026-0300, a critical unauthenticated buffer overflow vulnerability affecting PAN-OS PA-Series and VM-Series firewall appliances. Prisma Access, Cloud NGFW, and Panorama appliances are not affected by this vulnerability. The vulnerability carries a CVSSv4 score of 9.3 and has been confirmed as exploited in the wild by the vendor.

CVE-2026-0300 is a buffer overflow (CWE-787) in the User-ID™ Authentication Portal (also known as Captive Portal), a non-default PAN-OS feature used to map IP addresses to usernames. An unauthenticated remote attacker can exploit this vulnerability by sending specially crafted packets to a device with the Authentication Portal enabled, achieving arbitrary code execution with root privileges on the affected firewall. No authentication or user interaction is required.

Palo Alto Networks has confirmed limited exploitation in the wild targeting Authentication Portals exposed to either untrusted IP addresses or the public internet. No patches are currently available; fixed versions are expected to begin rolling out on May 13, 2026, with additional releases through May 28, 2026.

PAN-OS is among the most widely deployed enterprise firewall operating systems in the world. Shodan identifies approximately 225,000 internet-facing PAN-OS instances, representing a significant attack surface. Rapid7 strongly urges all organizations running affected PAN-OS versions with the User-ID Authentication Portal enabled to apply the available workarounds immediately and prioritize patching as soon as fixed versions become available.

Mitigation guidance

Organizations running PA-Series and VM-Series firewalls with the User-ID™ Authentication Portal enabled should apply the available workarounds immediately and prioritize patching as soon as fixed versions are released. Check the official documentation to establish whether the affected User-ID™ Authentication Portal is currently enabled.

According to the Palo Alto Networks advisory, the following versions are affected by CVE-2026-0300:

Product	Affected	Unaffected	Fix ETA
PAN-OS 12.1	< 12.1.4-h5 < 12.1.7	>= 12.1.4-h5 >= 12.1.7	05/13 05/28
PAN-OS 11.2	< 11.2.4-h17 < 11.2.7-h13 < 11.2.10-h6 < 11.2.12	>= 11.2.4-h17 >= 11.2.7-h13 >= 11.2.10-h6 >= 11.2.12	05/28 05/13 05/13 05/28
PAN-OS 11.1	< 11.1.4-h33 < 11.1.6-h32 < 11.1.7-h6 < 11.1.10-h25 < 11.1.13-h5 < 11.1.15	>= 11.1.4-h33 >= 11.1.6-h32 >= 11.1.7-h6 >= 11.1.10-h25 >= 11.1.13-h5 >= 11.1.15	05/13 05/13 05/28 05/13 05/13 05/28
PAN-OS 10.2	< 10.2.7-h34 < 10.2.10-h36 < 10.2.13-h21 < 10.2.16-h7 < 10.2.18-h6	>= 10.2.7-h34 >= 10.2.10-h36 >= 10.2.13-h21 >= 10.2.16-h7 >= 10.2.18-h6	05/28 05/13 05/28 05/28 05/13

Product

Affected

Unaffected

Fix ETA

PAN-OS 12.1

< 12.1.4-h5

< 12.1.7

>= 12.1.4-h5

>= 12.1.7

05/13

05/28

PAN-OS 11.2

< 11.2.4-h17

< 11.2.7-h13

< 11.2.10-h6

< 11.2.12

>= 11.2.4-h17

>= 11.2.7-h13

>= 11.2.10-h6

>= 11.2.12

05/28

05/13

05/28

PAN-OS 11.1

< 11.1.4-h33

< 11.1.6-h32

< 11.1.7-h6

< 11.1.10-h25

< 11.1.13-h5

< 11.1.15

>= 11.1.4-h33

>= 11.1.6-h32

>= 11.1.7-h6

>= 11.1.10-h25

>= 11.1.13-h5

>= 11.1.15

05/13

05/28

05/13

05/28

PAN-OS 10.2

< 10.2.7-h34

< 10.2.10-h36

< 10.2.13-h21

< 10.2.16-h7

< 10.2.18-h6

>= 10.2.7-h34

>= 10.2.10-h36

>= 10.2.13-h21

>= 10.2.16-h7

>= 10.2.18-h6

05/28

05/13

05/28

05/13

Until patches are available, Palo Alto Networks recommends one of the following workarounds:

Restrict User-ID™ Authentication Portal access to only trusted internal zones. Refer to Step 6 of the Live Community article and the Knowledgebase article for instructions on restricting access.
Disable User-ID™ Authentication Portal entirely if it is not required (Device > User Identification > Authentication Portal Settings > uncheck Enable Authentication Portal).

Please refer to the vendor advisory for the latest guidance.

Rapid7 customers

Exposure Command, InsightVM, and Nexpose

Exposure Command, InsightVM, and Nexpose customers can assess exposure to CVE-2026-0300 with authenticated vulnerability checks available in the May 6th, 2026 content release.

Updates

May 6, 2026: Initial publication.

PAN-OS Flaw CVE-2026-0300 Exposes Firewalls to Remote Code Execution

Wed, 06 May 2026 12:54:16 +0200

A newly disclosed cybersecurity issue, tracked as CVE-2026-0300, has drawn urgent attention due to its critical severity and active exploitation. The flaw affects PAN-OS, the operating system used in Palo Alto Networks firewalls, and has been categorized as a buffer overflow vulnerability with serious implications for enterprise security environments. The CVE-2026-0300 PAN-OS vulnerability was officially published on May 6, 2026, and updated the same day after being discovered in real-world production environments. It carries a CVSS score of 9.3, placing it firmly in the “critical” category. The issue stems from a buffer overflow vulnerability in the User-ID Authentication Portal, also known as the Captive Portal service, within PAN-OS. This flaw allows an unauthenticated attacker to execute arbitrary code with root privileges by sending specially crafted network packets. Because the attack requires no authentication, no user interaction, and can be carried out over the network with low complexity, the exposure risk is considered extremely high.

Technical Details of the Buffer Overflow Vulnerability in PAN-OS

The root cause of CVE-2026-0300 PAN-OS is classified under CWE-787: Out-of-bounds Write, a common but dangerous type of buffer overflow vulnerability. Attackers can exploit this flaw to overwrite memory and potentially take full control of affected systems. The vulnerability impacts PA-Series and VM-Series firewalls when the User-ID™ Authentication Portal is enabled. Importantly, Prisma Access, Cloud NGFW, and Panorama appliances are not affected. Security data associated with the vulnerability highlights the following:

Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Confidentiality, Integrity, Availability Impact: High

Additionally, the vulnerability is automatable and has already reached the “ATTACKED” stage in exploit maturity, indicating that real-world attacks have been observed.

Active Exploitation and Risk Factors

Evidence shows limited exploitation of CVE-2026-0300 PAN-OS, particularly targeting systems where the User-ID Authentication Portal is exposed to untrusted networks or the public internet. Environments that allow external access to this portal face the highest level of risk. The severity is further highlighted by the CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H This translates to a scenario where attackers can remotely compromise systems without needing credentials or user involvement, leveraging the buffer overflow vulnerability to gain root-level access.

Affected and Unaffected Versions

Multiple versions of PAN-OS are impacted by CVE-2026-0300, including:

PAN-OS 12.1 versions prior to 12.1.4-h5 and 12.1.7
PAN-OS 11.2 versions prior to 11.2.4-h17, 11.2.7-h13, 11.2.10-h6, and 11.2.12
PAN-OS 11.1 versions prior to 11.1.4-h33, 11.1.6-h32, 11.1.7-h6, 11.1.10-h25, 11.1.13-h5, and 11.1.15
PAN-OS 10.2 versions prior to 10.2.7-h34, 10.2.10-h36, 10.2.13-h21, 10.2.16-h7, and 10.2.18-h6

Patches are scheduled with estimated availability dates ranging from May 13 to May 28, 2026. Cloud NGFW and Prisma Access deployments remain unaffected.

Mitigation and Workarounds

While patches are being rolled out, organizations are advised to take immediate steps to reduce exposure to the buffer overflow vulnerability in PAN-OS. Recommended mitigations include:

Restricting access to the User-ID Authentication Portal to trusted internal IP addresses only
Preventing any exposure of the portal to the public internet
Disabling the User-ID Authentication Portal entirely if it is not required

The risk associated with CVE-2026-0300 PAN-OS drops significantly when these best practices are implemented. Systems that already follow strict network segmentation and access control policies are at a much lower risk.

“There is simply nothing else like it” becomes even more true now that this premium multi‑system headset is 25 percent cheaper

Tue, 05 May 2026 22:56:40 +0200

The Logitech Astro A50 X is an extremely expensive item that can connect to multiple platforms and provide immensely satisfying sound quality, and now people have a better chance at owning one with this 25% discount.

2026.2.1

Tue, 05 May 2026 02:17:04 +0200

This patch release addresses a security issue related to Personal Access Token deletion, a regression with stored request payloads that could override collection identifiers, and list truncation beyond 10 items in team workspaces, alongside minor bug fixes.

What's Changed

fix(common): hide horizontal scrollbar in Firefox for URL input by @Theproudcold in #5906
fix(backend): prevent request payload from overriding id and name by @mirarifhasan in #5913
fix(backend): enforce user ownership when deleting PAT by @mirarifhasan in #5916
fix(common): update documentation link for mock server by @sh3xu in #5929
fix(backend): bump Prisma packages to 7.4.2 by @mirarifhasan in #5932

New Contributors

@Theproudcold made their first contribution in #5906
@sh3xu made their first contribution in #5929

Full Changelog: 2026.2.0...2026.2.1

CVE-2026-7591 | TimBroddin astro-mcp-server up to 1.1.1 MCP Tool Query Construction src/index.ts request.params.arguments sql injection (EUVD-2026-26709)

Sat, 02 May 2026 00:39:17 +0200

A vulnerability, which was classified as critical, has been found in TimBroddin astro-mcp-server up to 1.1.1. The impacted element is an unknown function of the file src/index.ts of the component MCP Tool Query Construction. Performing a manipulation of the argument request.params.arguments results in sql injection. This vulnerability was named CVE-2026-7591. The attack may be initiated remotely. In addition, an exploit is available. The project was informed of the problem early through an issue report but has not responded yet.

Making AI work for databases

Thu, 30 Apr 2026 11:02:16 +0200

In The Sorcerer’s Apprentice, Mickey Mouse uses a magic spell to do his chores. The spell animates a broom that is tasked with carrying water from the well. While the animated broom is managed, it gets the job done; when Mickey falls asleep, the broom carries on its work. When Mickey can’t stop the broom, he chops it to bits with an axe, but all the pieces re-animate and carry on as before. Finally the Sorcerer intervenes to stop the broom and clean up the mess.

Similarly, AI promises to lighten the burden of operating databases. For example, using AI to write SQL queries or optimize performance are obvious areas to apply this technology. There is a huge amount of SQL on the internet that can be used to train models around what good queries should look like, and transforming natural language into accurate SQL has a lot of promise.

Further, using AI to handle database management issues should deliver faster performance, more reliable systems, and more efficient use of resources. Customers demand more help around those pain points, and they expect that any supplier can respond to those issues faster with AI. For problems that companies view as “low hanging fruit,” they expect self-service AI to solve those problems on demand rather than waiting.

AI promise meets real-world challenge

Already, we have seen AI get deployed around SQL and database management. BIRD (BIg bench for laRge-scale Database grounded text-to-SQL evaluation) publishes its benchmark around how models perform, with the current top AI performing at nearly 82% execution accuracy, based on a Valid Efficiency Score (VES). (See the paper on BIRD for details.) How good is a VES of 82%? Currently, human database engineers have a VES of nearly 93%.

The current gap between human and AI performance will shrink over time. But it is currently a great example of the Pareto Principle at work — from around 20% of your effort, you can get 80% of your results. To achieve that remaining 20% of results, you have to put in 80% of your effort. With AI, dealing with the simpler issues is where you can achieve the best results, but the harder problems still need a human in the loop to solve the problem or reach the intended goal.

For database management, this is something that we have seen at Percona. Using previous consulting engagements and service delivery projects as a base, we looked at how to automate steps around database management so customers could use AI to solve problems. Once we had the model developed, we tested it internally on database installations. We found that AI did help our team to deliver more efficiently around those simple problems, speeding up how fast they could respond.

At the same time, while these AI systems could make progress on more complex requests, they could not complete the “last mile” by themselves at the start. To overcome this, we looked at how the AI models used data to formulate responses and what sources the model called on most often. This led to more refinement and improvement in the systems alongside a human decision-maker that could understand what the AI was recommending, why it would be suitable, and where it could be improved.

Databases are essential components in the technology stack. As systems of record and sources for data analysis, they have to be reliable, available, and secure. Any decision around databases — from which database you choose for the job through to choices on management or optimization — can have a big impact. Any change has to be managed, or the result can be a broken application.

AI and the future of databases

Database management needs AI. The demand from customers for faster fixes and better performance is not going away, and those customers expect their suppliers to use AI in the same way they might use AI internally. For companies involved in service and support around IT including databases, applying AI to solve problems faster isn’t something that you can avoid. However, the human in the loop model will be essential for these service and support requirements for the foreseeable future. With databases so critical to how applications function and support the business, fully automating service with AI is not yet reliable for 100% of requests. As AI improves, the speed will benefit the majority of potential issues. However, the more complex problems will still require human expertise and control.

The demands of database customers will force teams to use AI. Whether this is internal teams that adopt AI to help them manage database deployment within internal developer platforms, or external service providers that support customers around problems. Customers will move to alternatives if they can’t get the speed of response that they expect. This could be through adopting another service provider for a database like PostgreSQL, or moving to a cloud or managed service provider that can offer better response times.

Mickey used magic to try and solve a problem, but he did not foresee all of the potential consequences. For those who are not database specialists, AI can help them write SQL, manage common tasks, or solve some of the simple problems, but there will always be edge cases where human skills and understanding will be needed. Arthur C. Clarke’s Third Law states that any sufficiently advanced technology is indistinguishable from magic, but the combination of AI and human skill around databases will have the greatest long-term impact without resorting to sorcery.

—

New Tech Forum provides a venue for technology leaders—including vendors and other outside contributors—to explore and discuss emerging enterprise technology in unprecedented depth and breadth. The selection is subjective, based on our pick of the technologies we believe to be important and of greatest interest to InfoWorld readers. InfoWorld does not accept marketing collateral for publication and reserves the right to edit all contributed content. Send all inquiries to doug_dineley@foundryco.com.

The front-end architecture trilemma: Reactivity vs. hypermedia vs. local-first apps

Tue, 28 Apr 2026 11:17:30 +0200

While the software development industry has been gorging on large language models (LLMs), the front-end ecosystem has quietly fractured into three competing but interrelated architectural paradigms. Between the dominance of reactive frameworks, the hypermedia-driven simplicity of true REST, and the decentralized resilience of SQL everywhere, developers are no longer just choosing a library, they are choosing where the data lives: at the server, at the client, or both.

Three competing architectures, more or less

Web developers are long familiar with React and the galaxy of similar reactive frameworks like Angular, Vue, and Svelte. For nearly a decade, these have dominated the narrative with their competition and co-inspiration. HTMX and hypermedia-driven applications have championed a return to the true RESTful thin client, alongside alternatives like Hotwire and Unpoly.

We could in a sense see reactivity and hypermedia as two opposing camps. Somewhere in between is the local-first SQL movement, which proposes putting SQL directly in the browser. The waters are a bit muddy because local SQL can and does work right alongside React.

It’s still safe to say that a reactive framework paired with a JSON API back end that talks to a datastore (SQL or otherwise) is still the de facto standard. But that monolithic story is starting to fracture in some very interesting ways.

Where the weight of the data lies

Data of course is the central mass of web applications. Where it lives and how it moves produce the gravity around which everything else must revolve. Each of these architectures proposes to handle that gravity in its own way, with different benefits and tradeoffs.

Hypermedia (e.g., HTMX): Keep the data largely off the client. The client is just a visual representation of the server data. The back-end “API” is responsible for producing the data-driven markup. Any kind of datastore can be used by the API server.

React and friends: A sophisticated, stateful engine runs in the client, and the developer syncs that state with the back end via RESTful JSON API calls. The back-end server tends to be dumb, responsible largely for just invoking other services to provide business logic or data persistence.

Local-first SQL: The data is distributed to the clients, like with React and friends, but in a much different way. Although the data is automatically synced directly to a datastore (like Postgres), the back-end API server is used only for specialized service calls—not for data persistence.

To summarize:

HTMX: Data gravity is at the server.
React: Data gravity is split between the server and the client.
Local-first: Data gravity is at the client.

Comparing the approaches

Besides the technical stats, the developer experience for each of these paradigms is quite different. However, while each paradigm feels different, they intersect in some interesting ways. Let’s take a closer look.

React and friends

Reactivity is the world we have been working in for 15 years. We’ve got a whole universe of frameworks: React, Angular, Vue, Svelte, Solid, and full-stack variants like Next.js, Nuxt, SvelteKit, Astro, etc. The beauty of these is in the core reactive idea. You have a state that consists of the variables and the UI is updated automatically. The UI is a pure function of state: $UI = f(state).

The downside is the gradual, almost imperceptible layering of intense complexity over the top of it all. This complexity seems at first just incidental, but it is in fact a direct outcome of the basic premise: building a state engine on the browser.

The result is you have two states: the browser and the database. The reactive engine becomes a negotiation layer. Add to that the various inherent complexities of managing the browser state, and the result is quite a lot for front-end developers to wrap their heads around.

In the effort to manage such complexity, wring more performance, and improve developer experience, we have wound up with quite a sprawling empire of tools and techniques. Even just for React we have React Server Components, complex state-management libraries like Redux or Zustand, and orchestration layers like TanStack Query for manual cache invalidation.

On the back end, we talk to JSON APIs (or GraphQL), which can become unwieldy as a kind of boilerplate layer, but has in its favor an almost universal understanding.

HTMX and similar (Hotwired, Unpoly)

HTMX is like using HTML that has superpowers. You can do a huge amount of what you use reactive frameworks for, including all the AJAX and a lot of the partial rendering and effects, with just a few extra attributes sprinkled judiciously.

You spend a lot of time on the server, using a template engine like Pug, Thymeleaf, or Kotlin DSL. These are where you bring together the data from the persistence service and combine it with markup. The markup you generate includes the HTMX attributes.

You tend to decompose the templates, i.e., break them up into dedicated chunks. The idea is you want to have a chunk that can be used within the larger UI to create the whole layout, along with the ability to use that chunk alone when (and if) it is called upon for an AJAX response.

Hypermedia with HTMX is a very powerful model. You are actually using REST, meaning you are transmitting a representational state.

Hotwire and Unpoly are similar libraries. In the case of Hotwire, you can achieve quite a bit of functionality and performance even without changing your HTML, just by using Turbo Frames to intercept link clicks and form submissions, automatically turning standard page navigation into partial DOM updates.

The beauty of the hypermedia approaches is that you gain a lot with a little. You are staying as much as possible in HTML, the very poster child of simplicity. On the other hand, you are giving up some of the sheer sophisticated power of reactive frameworks.

Local-first apps

Local-first development is the new kid on the block. Like React and friends, local-first keeps the data in two places, but it does so in a radically different way. In its most essential form, it means running a database in the browser that is kept aligned with the remote datastore via a syncing engine. This kind of thing has been done before with NoSQL databases like CouchDB or with the IndexedDB API, but the modern browser takes it to another level with a Wasm-based database engine, like SQLite.

The user gets a small view of the full data, called a partial replication or a bucket (also called a “shape”). The front-end app interacts directly with that data, and the infrastructure automatically does the work of keeping everything synced. A big benefit here is strong offline support (because the client device is carrying around an actual database).

This is a massive departure from the request-response cycle. In local-first, you don’t fetch data; you subscribe to it. The network becomes a background daemon that reconciles local and remote state using CRDTs (conflict-free replicated data types). CRDTs ensure that if two users edit a task while offline, the merge is seamless rather than messy.

There is also a degree of simplification in using SQL everywhere, though that is offset by a rather unfamiliar and involved architectural setup. A syncing engine like PowerSync or Electric SQL is required, and it has a set of rules that must be maintained. Plus the auth and interaction between the database and the syncing engine must be configured.

Local-first eliminates both the API server and the HTML template server. It pushes the entire data negotiation layer into the automated syncing engine that runs off developer-defined rules.

Interestingly, local-first SQL can be used as a data driver for React (and other reactive engines) or plain vanilla HTML + JS. As such, it is an interesting alternative take on the architecture of the web, which is agnostic about the front end.

Perhaps the strangest arrangement to contemplate is using HTMX and local-first SQL together. This is like a mad scientist architecture, which of course means developers are doing it. In this setup, the back-end HTMX template engine is actually a service worker running the SQL engine. In theory, you get the simplicity of HTMX and the ultra-speed + offline functionality of local SQL.

Reactivity, hypermedia, or local-first? How to choose

We remain in the era of the default choice being React plus a JSON API. From there you might experiment with innovative frameworks like Svelte or Solid. If you are looking for an ingenious way to leverage RESTful simplicity, HTMX or Hotwired are must-tries. Local-first SQL is an exotic animal, fit for the likes of Linear or Notion right now, but somewhat daring for most of us doing standard production work.

More broadly, the emergence of this trilemma signals the end of the “one true way” for web development. We are moving away from the library wars and into a world of architectural choice.

The choice between reactivity, hypermedia, and local-first isn’t just about code. It’s about where you want to place the data.

If you want the data to be a server-side document, choose hypermedia.
If you want the data to be a shared memory state, choose reactivity.
If you want the data to be a distributed database, choose local-first.

And of course, it is possible to put the approaches together to strive for a blend of the right benefits for your project.

As the JSON-over-the-wire monolith continues to fragment, the best architects won’t be the ones who know the most hooks or the most attributes. They will be the ones who understand the weight of their data and choose the architecture that lets the data move most freely. The framework wars are over, but the battle for the network has just begun.

OpenClaw 2026.4.26

Tue, 28 Apr 2026 03:16:14 +0200

2026.4.26

Changes

Channels/QQBot: add full group chat support (history tracking, @-mention gating, activation modes, per-group config, FIFO message queue with deliver debounce), C2C stream_messages streaming with a StreamingController lifecycle manager, unified sendMedia with chunked upload for large files, and refactor the engine into pipeline stages, focused outbound submodules, builtin slash-command modules, and explicit DI ports via createEngineAdapters(). (#70624) Thanks @cxyhhhhh.
Channels/Yuanbao: register the Tencent Yuanbao external channel plugin (openclaw-plugin-yuanbao) in the official channel catalog, contract suites, and community plugin docs, with a new docs/channels/yuanbao.md quick-start guide for WebSocket bot DMs and group chats. (#72756) Thanks @loongfay.
Control UI/Talk: add a generic browser realtime transport contract, Google Live browser Talk sessions with constrained ephemeral tokens, and a Gateway relay for backend-only realtime voice plugins. Thanks @VACInc.
CLI/models: route provider-filtered model listing through an explicit source plan so user config, installed manifest rows, Provider Index previews, and scoped runtime fallbacks keep a stable authority order without adding another catalog cache. Thanks @shakkernerd.
Providers: add Cerebras as a bundled plugin with onboarding, static model catalog, docs, and manifest-owned endpoint metadata.
Memory/OpenAI-compatible: add optional memorySearch.inputType, queryInputType, and documentInputType config for asymmetric embedding endpoints, including direct query embeddings and provider batch indexing. Carries forward #63313 and #60727. Thanks @HOYALIM and @prospect1314521.
Ollama/memory: add model-specific retrieval query prefixes for nomic-embed-text, qwen3-embedding, and mxbai-embed-large memory-search queries while leaving document batches unchanged. Carries forward #45013. Thanks @laolin5564.
Plugins/providers: move pre-runtime model-id normalization, endpoint host metadata, OpenAI-compatible request-family hints, model-catalog aliases/suppressions, OpenAI stale Spark suppression, and reusable startup metadata snapshots into plugin manifests so core no longer carries bundled-provider routing tables or repeated manifest rebuilds. Thanks @shakkernerd.
Plugins/config: deprecate direct plugin config load/write helpers in favor of passed runtime snapshots plus transactional mutation helpers with explicit restart follow-up policy, scanner guardrails, runtime warnings, and revision-based cache invalidation.
Plugins/install: allow OPENCLAW_PLUGIN_STAGE_DIR to contain layered runtime-dependency roots, resolving read-only preinstalled deps before installing missing deps into the final writable root. Fixes #72396. Thanks @liorb-mountapps.
Control UI: add a raw config pending-changes diff panel that parses JSON5, redacts sensitive values until reveal, and avoids fake raw-edit callbacks when opening the panel. Refs #39831; supersedes #48621 and #46654. Thanks @JiajunBernoulli and @BunsDev.
Control UI: polish the quick settings dashboard grid so common cards align across desktop, tablet, and mobile layouts without wasting horizontal space. Thanks @BunsDev.
Matrix/E2EE: add openclaw matrix encryption setup to enable Matrix encryption, bootstrap recovery, and print verification status from one setup flow. Thanks @gumadeiras.
Agents/compaction: add an opt-in agents.defaults.compaction.maxActiveTranscriptBytes preflight trigger that runs normal local compaction when the active JSONL grows too large, requiring transcript rotation so successful compaction moves future turns onto a smaller successor file instead of raw byte-splitting history. Thanks @vincentkoc.
CLI/migration: add openclaw migrate with plan, dry-run, JSON, pre-migration backup, onboarding detection, archive-only reports, a Claude Code/Desktop importer, and a Hermes importer for configuration, memory/plugin hints, model providers, MCP servers, skills, commands, and supported credentials. Thanks @vincentkoc and @NousResearch.

Fixes

Agents/LSP: terminate bundled stdio LSP process trees during runtime disposal and Gateway shutdown, so nested children such as tsserver do not survive stop or restart. Fixes #72357. Thanks @ai-hpc and @bittoby.
Gateway/device tokens: stop echoing rotated bearer tokens from shared/admin device.token.rotate responses while preserving the same-device token handoff needed by token-only clients before reconnect. (#66773) Thanks @MoerAI.
Control UI/Talk: keep Google Live browser sessions on the WebSocket transport instead of falling back to WebRTC, validate browser Google Live WebSocket endpoints, cap Gateway relay sessions per browser connection, and remove stale browser-native voice buttons that did not use the configured Talk/TTS provider. Thanks @BunsDev.
Gateway/startup: reuse config snapshot plugin manifests for startup auto-enable, config validation, and plugin bootstrap planning, including authored source config and disabled setup-probe handling, so restrictive allowlists avoid duplicate manifest/config passes during boot. Thanks @shakkernerd.
Agents/subagents: enforce subagents.allowAgents for explicit same-agent sessions_spawn(agentId=...) calls instead of auto-allowing requester self-targets. Fixes #72827. Thanks @oiGaDio.
ACP/sessions_spawn: let explicit sessions_spawn(runtime="acp") bootstrap turns run while acp.dispatch.enabled=false still blocks automatic ACP thread dispatch. Fixes #63591. Thanks @moeedahmed.
CLI/update: install npm global updates into a verified temporary prefix before swapping the package tree into place, preventing mixed old/new installs and stale packaged files from breaking openclaw update verification. Thanks @shakkernerd.
Gateway: skip CLI startup self-respawn for foreground gateway runs so low-memory Linux/Node 24 hosts start through the same path as direct dist/index.js without hanging before logs. Fixes #72720. Thanks @sign-2025.
Google Meet: route local Chrome joins through OpenClaw browser control, grant Meet media permissions, pin local Chrome audio defaults to BlackHole 2ch, and use the configured OpenClaw browser profile so joined agents no longer show Permission needed or use raw/default Chrome state. Thanks @DougButdorf and @oromeis.
Plugins/discovery: follow symlinked plugin directories in global and workspace plugin roots while keeping broken links ignored and existing package safety checks in place. Fixes #36754; carries forward #72695 and #63206. Thanks @Quackstro, @ming1523, and @xsfX20.
Plugins/install: skip test files and directories during install security scans while still force-scanning declared runtime entrypoints, so packaged test mocks no longer block plugin installs. Fixes #66840; carries forward #67050. Thanks @saurabhjain1592 and @Magicray1217.
Plugins/install: allow exact package-manager peer links back to the trusted OpenClaw host package during install security scans while continuing to block spoofed or nested escaping node_modules symlinks. Carries forward #70819. Thanks @fgabelmannjr.
Plugins/install: resolve plugin install destinations from the active profile state dir across CLI, ClawHub, marketplace, local path, and channel setup installs, so openclaw --profile plugins install ... no longer writes into the default profile. Fixes #69960; carries forward #69971. Thanks @FrancisLyman and @Sanjays2402.
Plugins/registry: suppress duplicate-plugin startup warnings when a tracked npm-installed plugin intentionally overrides the bundled plugin with the same id. Carries forward #48673. Thanks @abdushsk.
Plugins/startup: reuse canonical realpath lookups throughout each plugin discovery pass, including package and manifest boundary checks, so Windows npm-global startups no longer repeat expensive path resolution for the same plugin roots. Fixes #65733. Thanks @welfo-beo.
Gateway/proxy: pass ALL_PROXY / all_proxy into the global Undici env-proxy dispatcher and provider proxy-fetch helper while keeping SSRF trusted-proxy auto-upgrade on HTTP_PROXY / HTTPS_PROXY only, so gateway/provider calls honor all-proxy setups without weakening guarded fetches. Fixes #43821; carries forward #43919. Thanks @RickyTong1.
Reply/link understanding: keep media and link preprocessing on stable runtime entrypoints and continue with raw message content if optional enrichment fails, so URL-bearing messages are no longer dropped after stale runtime chunk upgrades. Fixes #68466. Thanks @songshikang0111.
Discord: persist routed model-picker overrides when the hidden /model dispatch succeeds but the bound thread session store is still stale, including LM Studio suffixed model ids. Carries forward #61473. Thanks @Nanako0129.
Nodes/CLI: add openclaw nodes remove --node and node.pair.remove so stale gateway-owned node pairing records can be cleaned without hand-editing state files.
Gateway: include the connecting client and fresh presence version in the initial hello-ok snapshot, so clients no longer need a follow-up event before seeing themselves online.
Docker: install the CA certificate bundle in the slim runtime image so HTTPS calls from containerized gateways no longer fail TLS setup after the bookworm-slim base switch. Fixes #72787. Thanks @ryuhaneul.
Providers/OpenRouter: remove retired Hunter Alpha and Healer Alpha static catalog rows and disable proxy reasoning injection for stale Hunter Alpha configs, so replies are not hidden when OpenRouter returns answer text in reasoning fields. Fixes #43942. Thanks @EvanDataForge.
Providers/reasoning: let Groq and LM Studio declare provider-native reasoning effort values, so Qwen thinking models receive none/default or off/on instead of OpenAI-only low/medium values. Fixes #32638. Thanks @Aqu1bp, @mgoulart, @Norpps, and @BSTail.
Local models: default custom providers with only baseUrl to the Chat Completions adapter and trust loopback model requests automatically, so local OpenAI-compatible proxies receive /v1/chat/completions without timing out. Fixes #40024. Thanks @parachuteshe.
Channels/message tool: surface Discord, Slack, and Mattermost user:/channel: target syntax in the shared message target schema and Discord ambiguity errors, so DM sends by numeric id stop burning retries before finding user:. Fixes #72401. Thanks @garyd9, @hclsys, and @praveen9354.
Agents/tools: scope tool-loop detection history to the active run when available, so scheduled heartbeat cycles no longer inherit stale repeated-call counts from previous runs. Fixes #40144. Thanks @mattbrown319.
Agents/subagents: preserve requester delivery for completion announces across different channel accounts, keep same-channel thread completions routed to the child thread, and fail closed instead of guessing a child binding when requester conversation signal is missing. Thanks @sfuminya and @suyua9.
Agents/status: persist the post-compaction token estimate from auto-compaction when providers omit usage metadata, so /status and session lists keep showing fresh context usage after compaction. Fixes #67667; carries forward #72822. Thanks @Jimmy-xuzimo and @skylight-9.
Control UI: show loading, reload, and retry states when a lazy dashboard panel cannot load after an upgrade, so the Logs tab no longer appears blank on stale browser bundles. Fixes #72450. Thanks @sobergou.
Gateway/plugins: start the Gateway in degraded mode when a single plugin entry has invalid schema config, and let openclaw doctor --fix quarantine that plugin config instead of crash-looping every channel. Fixes #62976 and #70371. Thanks @Doraemon-Claw and @pksidekyk.
Agents/plugins: skip malformed plugin tools with missing schema objects and report plugin diagnostics, so one broken tool no longer crashes Anthropic agent runs. Fixes #69423. Thanks @jmnickels.
Agents/reasoning: recover fully wrapped unclosed replies that would otherwise sanitize to empty text while keeping strict stripping for closed reasoning blocks and unclosed tails after visible text. Fixes #37696; supersedes #51915. Thanks @druide67 and @okuyam2y.
Control UI/Gateway: bind WebChat handshakes to their active socket and reject post-close server registrations, so aborted connects no longer leave zombie clients or misleading duplicate WebSocket connection logs. Fixes #72753. Thanks @LumenFromTheFuture.
Agents/fallback: split ambiguous provider failures into empty_response, no_error_details, and unclassified, and add flat fallback-step fields to structured fallback logs so primary-model failures stay visible when later fallbacks also fail. Fixes #71922; refs #71744. Thanks @andyk-ms and @nikolaykazakovvs-ux.
Plugins/Windows: normalize Windows absolute paths before handing bundled plugin modules to Jiti, so Feishu/Lark message sending no longer fails with unsupported c: ESM loader URLs. Fixes #72783. Thanks @jackychen-png.
CLI/doctor: run bundled plugin runtime-dependency repairs through the async npm installer with spinner/line progress and heartbeat updates, so long openclaw doctor --fix installs no longer look hung in TTY or piped output. Fixes #72775. Thanks @dfpalhano.
Feishu/Windows: normalize bundled channel sidecar loads before Jiti evaluates them, so Feishu outbound sends no longer fail with raw C: ESM loader errors on Windows. Fixes #72783. Thanks @jackychen-png.
Agents/tools: ignore volatile exec runtime metadata when comparing tool-loop outcomes, so enabled loop detection can stop repeated identical shell-command results instead of resetting on duration, PID, session, or cwd changes. Fixes #34574; supersedes #41502. Thanks @gucasbrg and @Zcg2021.
Agents/fallback: classify internal live-session model switch conflicts as unknown fallback failures instead of provider overloads, preventing local vLLM endpoints from receiving misleading overloaded cooldowns. Refs #63229. Thanks @clawdia-lobster.
Discord: let thread sessions inherit the parent channel's session-level /model override as a model-only fallback without enabling parent transcript inheritance. Fixes #72755. Thanks @solavrc.
Gateway/plugins: skip stale configured channels whose matching plugin is no longer discoverable, point cleanup at openclaw doctor --fix, and keep unrelated channel typos fatal so one missing channel plugin no longer crash-loops the Gateway. Fixes #53311. Thanks @futhgar.
Control UI: keep session-specific assistant identity loads authoritative after WebSocket connect, so non-main agent chat sessions do not show the main agent name in the header after bootstrap refreshes. Fixes #72776. Thanks @rockytian-top.
Agents/Qwen: preserve exact custom modelstudio provider configs with foreign api owners so explicit OpenAI-compatible Model Studio endpoints no longer get normalized into the bundled Qwen plugin path. Fixes #64483. Thanks @FiredMosquito831.
MCP/bundle-mcp: normalize CLI-native type: "http" MCP server entries to OpenClaw transport: "streamable-http" on save, repair existing configs with doctor, and keep embedded Pi from falling back to legacy SSE GET-first startup for those servers. Fixes #72757. Thanks @Studioscale.
OpenCode: expose Anthropic Opus/Sonnet 4.x thinking levels for proxied Claude models, so /think xhigh, /think adaptive, and /think max validate consistently with the direct Anthropic provider. Fixes #72729. Thanks @haishmg and @aaajiao.
Media-understanding/audio: migrate deprecated {input} placeholders in legacy audio.transcription.command configs to {{MediaPath}}, so custom audio transcribers no longer receive the literal placeholder after doctor repair. Fixes #72760. Thanks @krisfanue3-hash.
Ollama/WSL2: warn when GPU-backed WSL2 installs combine CUDA visibility with an autostarting ollama.service using Restart=always, and document the systemd, .wslconfig, and keep-alive mitigation for crash loops. Carries forward #61022; fixes #61185. Thanks @yhyatt.
Ollama/onboarding: de-dupe suggested bare local models against installed :latest tags and skip redundant pulls, so setup shows the installed model once and no longer says it is downloading an already available model. Fixes #68952. Thanks @tleyden.
Memory-core/doctor: keep doctor.memory.status on the cached path by default and only run live embedding pings for explicit deep probes, preventing slow local embedding backends from blocking Gateway status checks. Fixes #71568. Thanks @apex-system.
Memory/QMD: group same-source collections into one QMD search invocation when the installed QMD supports multiple -c filters, while keeping older QMD builds on the per-collection fallback. Fixes #72484; supersedes #72485 and #69583. Thanks @BsnizND and @zeroaltitude.
Memory/QMD: accept QMD status vector-count variants such as Vectors = 42, Vectors:42, and Vectors: 42 embedded, so memory status --deep no longer reports embeddings unavailable for healthy QMD wrappers. Fixes #63652; carries forward #63678. Thanks @apoapostolov and @WarrenJones.
Memory/QMD: skip QMD vector status probes and embedding maintenance in lexical searchMode: "search", so BM25-only QMD setups on ARM do not trigger llama.cpp/Vulkan builds during status checks or embed cycles. Fixes #59234 and #67113. Thanks @PrinceOfEgypt, @Vksh07, @Snipe76, @NomLom, @t4r3e2q1-commits, and @dmak.
Memory/QMD: report the live watcher dirty state in memory status, so changed QMD-backed memory files show as dirty until the queued sync finishes. Fixes #60244. Thanks @xinzf.
Compaction: skip oversized pre-compaction checkpoint snapshots and prune duplicate long user turns from compaction input and rotated successor transcripts, preventing retry storms from being preserved across checkpoint cycles. Fixes #72780. Thanks @SweetSophia.
Control UI/Cron: render cron job prompts and run summaries as sanitized markdown in the dashboard, with full-width block content, safer link clicks, and no duplicate error text when a failed run has no summary. Supersedes #48504. Thanks @garethdaine.
Control UI/Gateway: preserve WebChat client version labels across localhost, 127.0.0.1, and IPv6 loopback aliases on the same port, avoiding misleading vcontrol-ui connection logs while investigating duplicate-message reports. Refs #72753 and #72742. Thanks @LumenFromTheFuture and @allesgutefy.
Agents/reasoning: treat orphan closing reasoning tags with following answer text as a privacy boundary across delivery, history, streaming, and Control UI sanitizers so malformed local-model output cannot leak chain-of-thought text. Fixes #67092. Thanks @AnildoSilva.
Memory-core: run one-shot memory CLI commands through transient builtin and QMD managers so memory index, memory status --index, and memory search no longer start long-lived file watchers that can hit macOS EMFILE limits. Fixes #59101; carries forward #49851. Thanks @mbear469210-coder and @maoyuanxue.
Agents/ACP: ship the Claude ACP adapter with OpenClaw and require Claude result messages before idle can complete a prompt, preventing parent agents from waking early on long-running sessions_spawn(runtime: "acp", agentId: "claude") children. Fixes #72080. Thanks @siavash-saki and @iannwu.
CLI/tasks: route tasks --json, tasks list --json, and tasks audit --json through a lean JSON path so read-only task inspection no longer loads unrelated plugin/runtime command graphs. Fixes #66238. Thanks @ChuckChambers.
Memory-core: re-resolve the active runtime config whenever memory_search or memory_get executes, so provider changes made by config.patch stop leaving stale embedding backends behind in existing tool instances. Fixes #61098. Thanks @BradGroux and @Linux2010.
WebChat: keep bare /new and /reset startup instructions out of visible chat history while preserving /reset as user-visible transcript text. Fixes #72369. Thanks @collynes and @haishmg.
Tasks/memory: checkpoint and truncate SQLite WAL sidecars on a timer and before close for task, Task Flow, proxy capture, and builtin memory databases, bounding long-running gateway *.sqlite-wal growth. Fixes #72774. Thanks @dfpalhano.
CLI/doctor: remove dangling channel config, heartbeat targets, and channel model overrides when stale plugin repair removes a missing channel plugin, preventing Gateway boot loops after failed plugin reinstalls. Fixes #65293. Thanks @yidecode.
Control UI/Gateway: cache, coalesce, stale-refresh, and invalidate effective tool inventory on channel registry changes while reusing the gateway-bound plugin registry and avoiding model/auth discovery, so chat runs no longer stall Control UI requests on repeated plugin/model setup. Fixes #72365; supersedes #72558. Thanks @Gabiii2398 and @1yihui.
Channels/setup: treat bundled channel plugins as already bundled during channels add and onboarding, enabling them without writing redundant plugins.load.paths entries or path install records. Fixes #72740. Thanks @iCodePoet.
WhatsApp: honor gateway HTTPS_PROXY / HTTP_PROXY env vars for QR-login WebSocket connections, while respecting NO_PROXY, so proxied networks no longer fall back to direct mmg.whatsapp.net connections that time out with 408. Fixes #72547; supersedes #72692. Thanks @mebusw and @SymbolStar.
Bonjour: default mDNS advertisements to the system hostname when it is DNS-safe, avoiding openclaw.local probing conflicts and Gateway restart loops on hosts such as Lobster or ubuntu. Fixes #72355 and #72689; supersedes #72694. Thanks @mscheuerlein-bot, @gcusms, @moyuwuhen601, @pavan987, @zml-0912, @hhq365, and @SymbolStar.
Agents/OpenAI-compatible: retry replay-safe empty stop turns once for openai-completions endpoints, so transient empty local backend responses no longer surface as “Agent couldn't generate a response” when a continuation succeeds, and restore openclaw agent --model for one-shot CLI runs. Fixes #72751. Thanks @moooV252.
Git hooks: skip ignored staged paths when formatting and restaging pre-commit files, so merge commits no longer abort when .gitignore newly ignores staged merged content. Fixes #72744. Thanks @100yenadmin.
Memory-core/dreaming: add a supported dreaming.model knob for Dream Diary narrative subagents, wired through phase config and the existing plugin subagent model-override trust gate. Refs #65963. Thanks @esqandil and @mjamiv.
Agents/Anthropic: remove trailing assistant prefill payloads when extended thinking is enabled, so Opus 4.7/Sonnet 4.6 requests do not fail Anthropic's user-final-turn validation. Fixes #72739. Thanks @superandylin.
Agents/vLLM/Qwen: add plugin-owned Qwen thinking controls for vLLM chat-template kwargs and DashScope-style top-level enable_thinking flags, including preserved thinking for agent loops. Fixes #72329. Thanks @stavrostzagadouris.
Memory-core/dreaming: treat request-scoped narrative fallback as expected, skip session cleanup when no subagent run was created, and remove duplicate phase-level cleanup so fallback no longer emits warning noise. Fixes #67152. Thanks @jsompis.
Agents/exec: apply configured tools.exec.timeoutSec to background, yieldMs, and node system.run commands when no per-call timeout is set, preventing auto-backgrounded and remote node commands from running indefinitely. Fixes #67600; supersedes #67603. Thanks @dlmpx and @kagura-agent.
Config/doctor: stop masking unknown-key validation diagnostics such as agents.defaults.llm, and have openclaw doctor --fix remove the retired agents.defaults.llm timeout block. Thanks @aidiffuser.
CLI/startup: keep the built pre-dispatch CLI graph free of package-level imports and extend packaged CLI smoke coverage to onboard and doctor help paths, preventing missing runtime dependencies such as tslog from killing onboarding before repair code can run. Fixes #63024. Thanks @hu19940121.
CLI/plugins: preserve unversioned ClawHub install specs so plugins update can follow newer ClawHub releases instead of pinning to the initially resolved version. Fixes #63010; supersedes #58426. Thanks @kangsen1234 and @robinspt.
Memory-core/subagents: tag plugin-created subagent sessions with their plugin owner so dreaming narrative cleanup can delete its own ephemeral sessions without granting broad admin session deletion. Fixes #72712. Thanks @BSG2000.
Gateway/models: move local-provider pricing opt-outs, OpenRouter/LiteLLM aliases, and proxy passthrough pricing lookup into plugin manifest metadata so core no longer carries extension-specific pricing tables.
CLI/update: honor OPENCLAW_NO_AUTO_UPDATE=1 as a gateway startup kill-switch for configured background package auto-updates, so operators can hold a deliberate downgrade during incident recovery without editing config first. Fixes #72715. Thanks @Xivi08.
Agents/Claude CLI: force live-session launches to include --output-format stream-json whenever OpenClaw adds --input-format stream-json, so new Claude CLI sessions no longer fail immediately while reusable sessions keep working. Fixes #72206. Thanks @kwangwonkoh and @Xivi08.
CLI/plugins: accept ClawHub plugin API wildcard ranges such as * without rejecting compatible plugin installs, while still requiring a valid runtime API version. Fixes #56446; supersedes #56466. Thanks @darconada and @claygeo.
CLI/plugins: add an explicit npm: install prefix that skips ClawHub lookup for known npm packages while keeping bare package specs ClawHub-first. Fixes #55805; supersedes #54377. Thanks @Zeoy2020 and @vagusX.
CLI/plugins: let config-gated bundled plugins install without persisting invalid placeholder config entries, so install/uninstall sweeps can cover plugins such as memory-lancedb before the user configures credentials. Thanks @vincentkoc.
CLI/plugins: reject malformed ClawHub plugin specs with trailing @ before registry lookup, so empty-version typos report as invalid specs instead of package-not-found errors. Fixes #56579; supersedes #56582. Thanks @Kansodata.
Agents/sessions: acquire the session write lock only after cold bootstrap, plugin, and tool setup so fallback runs are not blocked by stalled pre-model startup work.
Browser/plugins: auto-start the bundled browser plugin when root browser config is present, including restrictive plugin allowlists, and ignore stale persisted plugin registries whose package paths no longer exist.
Browser: circuit-break repeated managed Chrome launch failures per profile so browser requests stop spawning Chromium indefinitely when CDP cannot start. Fixes #64271. Thanks @TheophilusChinomona.
Gateway/models: skip external OpenRouter and LiteLLM pricing refreshes for local/self-hosted model endpoints so startup does not wait on remote pricing catalogs for local-only Ollama, vLLM, and compatible providers.
CLI/plugins: stop security-blocked plugin installs from retrying as hook packs, so normal plugin packages report the scanner failure without a misleading "not a valid hook pack" follow-up. Fixes #61175; supersedes #64102. Thanks @KonsultDigital and @ziyincody.
Agents/Anthropic: strip stale trailing assistant prefill turns from outbound replay so context-engine short circuits cannot send unsupported assistant-prefill payloads to provider APIs. Fixes #72556. Thanks @Veda-openclaw.
Agents/Google: strip stale trailing assistant/model prefill turns from Gemini outbound replay so Google Generative AI requests end with a user turn or function response. Follow-up to #72556. Thanks @Veda-openclaw.
Control UI/Dreaming: require explicit confirmation before applying restart-impacting Dreaming mode changes, with restart warning copy and loading feedback. Fixes #63804. (#63807) Thanks @bbddbb1.
CLI/agent: mark Gateway-to-embedded fallback runs with meta.transport: "embedded" and meta.fallbackFrom: "gateway" in JSON output, and make the terminal diagnostic explicit so scripts and operators can distinguish fallback runs from Gateway runs. Fixes #71416. Thanks @amknight.
Agents/tools: normalize null or missing tool-call arguments to {} for parameterless object schemas before Pi validation, so empty-argument tools run instead of failing argument validation. Fixes #72587. Thanks @amknight.
Agents/subagents: clear active embedded-run state before terminal lifecycle events so post-completion cleanup no longer treats finished child runs as still active and skips archive or announcement bookkeeping. (#70187) Thanks @amknight.
CLI/update: keep the automatic post-update completion refresh on the core-command tree so it no longer stages bundled plugin runtime deps before the Gateway restart path, avoiding .24 update hangs and 1006 disconnect cascades. Fixes #72665. Thanks @sakalaboator and @He-Pin.
Control UI: make explicit Reload Config actions discard stale local config edits while passive refreshes and failed-save recovery keep pending drafts intact. Fixes #40352; carries forward #40443. Thanks @realmikechong-dotcom.
Agents/Bedrock: stop heartbeat runs from persisting blank user transcript turns and repair existing blank user text messages before replay, preventing AWS Bedrock ContentBlock blank-text validation failures. Fixes #72640 and #72622. Thanks @goldzulu.
Agents/LM Studio: promote standalone bracketed local-model tool requests into registered tool calls and hide unsupported bracket blocks from visible replies, so MemPalace MCP lookups do not print raw [tool] JSON scaffolding in chat. Fixes #66178. Thanks @detroit357.
Local models: warn when an assistant reply looks like a tool call but the provider emitted plain text instead of a structured tool invocation, making fake/non-executed tool calls visible in logs. Fixes #51332. Thanks @emilclaw.
Local models: accept persisted non-secret local auth markers for private-LAN custom OpenAI-compatible providers, so LAN Ollama configs no longer fail with missing auth when ollama-local is saved as the key. Fixes #49736. Thanks @charles-zh.
TUI/local models: treat visible gateway client labels such as openclaw-tui as the current requester session for session-aware tools, so Ollama tool calls no longer fail by resolving the UI label as a session id. Fixes #66391. Thanks @kickingzebra.
Local models: route self-hosted OpenAI-compatible model discovery through the guarded fetch path pinned to the configured host, covering vLLM and SGLang setup without reopening local/LAN SSRF probes. Supersedes #46359. Thanks @cdxiaodong.
Local models: classify terminated, reset, closed, timeout, and aborted model-call failures and attach a process memory snapshot to the diagnostic event, making LM Studio/Ollama RAM-pressure failures easier to prove from stability bundles. Refs #65551. Thanks @BigWiLLi111.
Local models: pass configured provider request timeouts through OpenAI SDK transports and the model idle watchdog so long-running local or custom OpenAI-compatible streams use one timeout knob instead of hitting the SDK's 10-minute default or the 120s idle default. Fixes #63663. Thanks @aidiffuser.
LM Studio: trust configured LM Studio loopback, LAN, and tailnet endpoints for guarded model requests by default, preserving explicit private-network opt-outs. Refs #60994. Thanks @tnowakow.
Docker/setup: route Docker onboarding defaults for host-side LM Studio and Ollama through host.docker.internal and add the Linux host-gateway mapping to the bundled Compose file, so containerized gateways can reach local providers without using container loopback. Fixes #68684; supersedes #68702. Thanks @safrano9999 and @skolez.
Agents/LM Studio: strip prior-turn Gemma 4 reasoning from OpenAI-compatible replay while preserving active tool-call continuation reasoning. Fixes #68704. Thanks @chip-snomo and @Kailigithub.
LM Studio: allow interactive onboarding to leave the API key blank for unauthenticated local servers, using local synthetic auth while clearing stale LM Studio auth profiles. Fixes #66937. Thanks @olamedia.
Plugins/startup/registry: reuse a Gateway PluginLookUpTable and one manifest registry pass across startup plugin IDs, plugin loading, deferred channel reloads, model pricing, read-only channel defaults, capability/provider/media resolution, manifest contracts, extractors, web fallback discovery, owner maps, and cold provider-discovery caches, with new startup-trace timing/count metrics for installed-index, manifest, startup-plan, and owner-map work. Thanks @shakkernerd and @mcaxtr.
Mattermost: keep direct-message replies top-level by suppressing reply roots for DM delivery while preserving channel and group thread roots, and derive inbound chat kind from the trusted channel lookup instead of the websocket event channel type. Carries forward #60115, #55186, #72305, and #72659; refs #59758, #59981, #59791, and #57565. Thanks @vincentkoc, @jwchmodx, and @hnykda.
Docker: pre-create /home/node/.openclaw with node ownership and private permissions so first-run Docker Compose named volumes no longer fail startup with EACCES. (#48072, #63959; fixes #61279) Thanks @timoxue and @jeanibarz.
CLI/Gateway: treat local restart probe policy closes for connect, exact device required, pairing, and auth failures as Gateway reachability proof without accepting empty, broad standalone token/password/scope/role, or pair-substring 1008 close reasons. Fixes #48771; carries forward #48801; related #63491. Thanks @MarsDoge and @genoooool.
Feishu: send outgoing interactive reply payloads as native cards with clickable buttons while preserving text, media, and document-comment fallbacks. Fixes #13175 and #58298; carries forward #47891. Thanks @Horacehxw.
Process/Windows: decode command stdout and stderr from raw bytes with console-codepage awareness, while preserving valid UTF-8 output and multibyte characters split across chunks. Fixes #50519. Thanks @iready, @kevinten10, @zhangyongjie1997, @knightplat-blip, @heiqishi666, and @slepybear.
Bonjour/Windows: hide the bundled mDNS advertiser's Windows ARP shell probe so Gateway startup no longer flashes command-prompt windows. Fixes #70238. Thanks @alexandre-leng, @PratikRai0101, @infinitypacific, and @tomerpeled.
Agents/bootstrap: dedupe hook-injected bootstrap context files by workspace-relative path and store normalized resolved paths so duplicate relative and absolute hook paths no longer depend on the process cwd. (#59344; fixes #59319; related #56721, #56725, and #57587) Thanks @koen666.
Agents/bootstrap: refresh cached workspace bootstrap snapshots on long-lived main-session turns when AGENTS.md, SOUL.md, MEMORY.md, or TOOLS.md change on disk, while preserving unchanged snapshot identity through the workspace file cache. (#64871; related #43901, #26497, #28594, #30896) Thanks @aimqwest and @mikejuyoon.
macOS Gateway: detect installed-but-unloaded LaunchAgent split-brain states during status, doctor, and restart, and re-bootstrap launchd supervision before falling back to unmanaged listener restarts. Fixes #67335, #53475, and #71060; refs #58890, #60885, and #70801. Thanks @ze1tgeist88, @dafacto, and @vishutdhar.
Plugins/install: treat mirrored core logger dependencies as staged bundled runtime deps so packaged Gateway starts do not crash when the external plugin-runtime-deps root is missing tslog. Fixes #72228; supersedes #72493. Thanks @deepujain.
Build/plugins: preserve active bundled runtime-dependency staging temp directories owned by live build processes so overlapping postbuild runs no longer delete each other's staged deps mid-prune. Supersedes #72220. Thanks @VACInc.
Plugins/install: hide bundled runtime-dependency npm child windows on Windows across Gateway startup, postinstall, and packaged staging paths so Telegram/Anthropic dependency repair no longer flashes shell windows. Fixes #72315. Thanks @athuljayaram and @joshfeng.
Agents/Windows: normalize lazy agent runtime imports before Node ESM loading so Windows drive-letter subagent-registry runtime paths no longer fail every agent task with ERR_UNSUPPORTED_ESM_URL_SCHEME. Fixes #72636; carries forward #72716. Thanks @Andyz-CData and @xialonglee.
Plugins/Windows: normalize lazy plugin service override imports before Node ESM loading so drive-letter browser-control module paths no longer fail with ERR_UNSUPPORTED_ESM_URL_SCHEME. Fixes #72573; supersedes #72599 and #72582. Thanks @llzzww316, @feineryonah-byte, and @WuKongAI-CMU.
Browser/plugins: load playwright-core through the browser runtime shim so packaged installs can run Playwright actions from staged plugin runtime deps after doctor/startup repair. Fixes #72168; supersedes #72238. Thanks @zdg1110 and @yetval.
Plugins/install: stage bundled plugin runtime dependencies before Gateway startup, drain update restarts, and materialize plugin-owned root chunks in external mirrors so staged deps resolve under native ESM. Fixes #72058; supersedes #72084. Thanks @amnesia106 and @drvoss.
TTS/SecretRef: resolve messages.tts.providers.*.apiKey from the active runtime snapshot so SecretRef-backed MiniMax and other TTS provider keys work in runtime reply/audio paths. Fixes #68690. Thanks @joshavant.
Gateway/install: surface systemd user-bus recovery hints during Linux service activation and retry via the target user scope when systemctl --user reports no-medium bus failures, without letting stale SUDO_USER override sudo -u installs. Fixes #39673; refs #44417 and #63561. Thanks @Arbor4, @myrsu, @mssteuer, and @boyuaner.
CLI/nodes: make unfiltered openclaw nodes list prefer the effective paired-node view used by nodes status while preserving pending rows, pairing-scope fallback, terminal-safe table rendering, and paired JSON metadata. Fixes #46871; carries forward #65772 through the ProjectClownfish #72619 repair. Thanks @skainguyen1412.
CLI/startup: read generated startup metadata from the bundled dist layout before falling back to live help rendering, so root/browser help and channel-option bootstrap stay on the fast path. Thanks @vincentkoc.
Feishu/Lark: stop treating broadcast-only @all/@_all messages as bot mentions while preserving direct bot mentions, including messages that also include @all. Fixes #37706. Thanks @JosepLee.
CLI/help: treat positional help invocations like openclaw channels help as help paths for startup gating, avoiding model/auth warmup while preserving positional arguments such as openclaw docs help. Thanks @gumadeiras.
Web search: route plugin-scoped web_search SecretRefs through the active runtime config snapshot so provider execution receives resolved credentials across app/runtime paths, including plugins.entries.brave.config.webSearch.apiKey. Fixes #68690. Thanks @VACInc.
Voice Call: allow SecretRef-backed Twilio auth tokens and call-specific OpenAI/ElevenLabs TTS API keys through the plugin config surface. Fixes #68690. Thanks @joshavant.
Google Meet/Voice Call: clean stale chrome-node realtime bridges before rejoining, expose bridge inspection, tolerate transient node input pull failures, default Chrome command-pair audio to 24 kHz PCM16 while preserving legacy 8 kHz G.711 mu-law pairs, handle Gemini Live interruptions/VAD and function-response names correctly, route stateful google_meet tools through the gateway runtime, support realtime.agentId, and send non-blocking consult continuations before long tool-backed answers finish. Fixes #72371, #72525, #72523, #72440, and #72425; (#72372, #72524, #72381, #72441, #72189, #72426) Thanks @BsnizND and @VACInc.
Discord/media: keep incidental Markdown image badges in final replies as text unless a channel opts into Markdown-image media extraction, while preserving Telegram Markdown-image media replies and explicit MEDIA: attachments. Fixes #72642. Thanks @solavrc and @Bartok9.
Matrix/E2EE: stabilize recovery and broken-device QA flows while avoiding Matrix device-cleanup sync races that could leave shutdown-time crypto work running. Thanks @gumadeiras.
Cron: apply cron.maxConcurrentRuns to the nested isolated-agent lane, start isolated execution timeouts only after the runner enters that lane, keep legacy flat jobs.json rows loadable, invalidate stale pending runtime slots after schedule edits, and preserve due slots for formatting-only rewrites. Fixes #72707, #27996, #71607, and #41783; carries forward #71651. Thanks @kagura-agent, @xialonglee, @fagnersouza666, @ayanesakura, and @Hurray0.
Cron/delivery: classify isolated successes, quiet NO_REPLY turns, model/provider failures, execution denials, --no-deliver traces, skipped-job alerts, and verified delivery outcomes correctly so cron history, retries, and failure counters reflect what actually happened. Fixes #72732, #50170, #43604, #68452, #60846, #72210, and #67172; follow-up to #54188; carries forward #43631, #68453, #72219, and #67186. Thanks @zNatix, @pixeldyn, @ChickenEggRoll, @SPFAdvisors, @anyech, @slideshow-dingo, @hatemclawbot-collab, @xydigit-sj, @oc-gh-dr, @hclsys, and @1yihui.
Cron/routing: preserve direct Telegram thread/account IDs, explicit Discord user:/channel: delivery targets, and session: failure-destination routing so reminders, cron announcements, and failure alerts keep the intended recipient kind across direct and group chats. Fixes #44270; refs #62777; carries forward #44325, #44351, #44412, #72657, #68535, and #62798. Thanks @RunMintOn, @arkyu2077, @0xsline, @vincentkoc, @slideshow-dingo, @likewen-tech, and @neeravmakwana.
Subagents: keep the delegated task only in the subagent system prompt and send a short initial kickoff message, avoiding duplicate task tokens while preserving multiline task formatting. Fixes #72019; carries forward #72053. Thanks @Wizongod and @ly85206559.
Onboarding/GitHub Copilot: add manifest-owned --github-copilot-token support for non-interactive setup, including env fallback, tokenRef storage in ref mode, saved-profile reuse, and current Copilot default-model wiring. Refs #50002 and supersedes #50003. Thanks @scottgl9.
Gateway/install: add a validated --wrapper/OPENCLAW_WRAPPER service install path that persists executable LaunchAgent/systemd wrappers across forced reinstalls, updates, and doctor repairs instead of falling back to raw node/bun ProgramArguments. Fixes #69400. (#72445) Thanks @willtmc.
Plugins: fail plugin registration when loader-owned acceptance gates reject missing hook names or memory-only capability registration from non-memory plugins, surfacing the issue through plugin status and doctor instead of silently dropping the registration. Fixes #72459. Thanks @amknight.
macOS Gateway: write launchd services with a state-dir WorkingDirectory, use a durable state-dir temp path instead of freezing macOS session TMPDIR, create that temp directory before bootstrap, and label abort-shaped launchd exits as SIGABRT/abort in status output. Fixes #53679 and #70223; refs #71848. Thanks @dlturock, @stammi922, and @palladius.
Control UI/update: make Update now require a real gateway process replacement, report skipped/error update outcomes with stable reasons, and verify the running gateway version after restart so global installs cannot silently keep old code in memory. Fixes #62492; addresses #64892 and #63562. Thanks @IAMSamuelRodda.
Exec approvals: accept runtime-owned source: "allow-always" and commandText allowlist metadata in gateway and node approval-set payloads so Control UI round-trips no longer fail with unexpected property 'source'. Fixes #60000; carries forward #60064. Thanks @sd1471123, @sharkqwy, and @luoyanglang.
Exec/node: skip approval-plan preparation for full-trust host=node runs so interpreter and script commands no longer fail with SYSTEM_RUN_DENIED: approval cannot safely bind when effective policy is security=full and ask=off. Fixes #48457 and duplicate #69251. Thanks @ajtran303, @jaserNo1, @Blakeshannon, @lesliefag, and @AvIsBeastMC.
Exec/node: synthesize a local approval plan when a paired node advertises system.run without system.run.prepare, unblocking approval-required host=node exec on current macOS companion nodes while preserving remote prepare for node hosts that support it. Fixes #37591 and duplicate #66839; carries forward #69725. Thanks @soloclz.
Memory/QMD: prefer QMD's --mask collection pattern flag so root memory indexing stays scoped to MEMORY.md instead of widening to every markdown file in the workspace. Fixes #65480; supersedes #65481 and #66259. Thanks @ccage-simp, @Bortlesboat, @seank-com, and @crazyscience.
Memory/doctor: treat the specific gateway timeout after ... gateway memory probe result as inconclusive instead of reporting embeddings not ready, while preserving warnings for explicit failures. Fixes #44426; carries forward #46576 with the Greptile review feedback applied. Thanks Cengiz (@ghost).
Gateway/startup: defer QMD, core request handlers, setup wizard, CLI outbound senders, plugin HTTP routes, chat/session projection, node session runtime validation, embedded-run activity reads, MCP loopback server imports, channel runtime helpers, HTTP/canvas/plugin auth helpers, isolated cron imports, and hook dispatch parsing until their request or shutdown paths, while making plain gateway status use a parse-only config snapshot so no-plugin boots and status reads avoid broad runtime fanout. Thanks @vincentkoc.
Lobster/Gateway: memoize repeated Ajv schema compilation before loading the embedded Lobster runtime so scheduled workflows and llm.invoke loops stop growing gateway heap on content-identical schemas. Fixes #71148. Thanks @cmi525, @vsolaz, and @vincentkoc.
Codex harness: normalize cached input tokens before session/context accounting so prompt cache reads are not double-counted in /status, session_status, or persisted sessionEntry.totalTokens. Fixes #69298. Thanks @richardmqq.
Hooks/session-memory: use the host local timezone for memory filenames, fallback timestamp slugs, and markdown headers instead of UTC dates. Fixes #46703. (#46721) Thanks @Astro-Han.
Gateway health: preserve live runtime-backed channel/account state in gateway.health snapshots and cached refreshes while keeping raw probe payloads on sensitive/admin paths only. (#39921, #42586, #46527, #52770, #42543) Thanks @FAL1989, @rstar327, @0xble, and @ajayr.
Feishu: extract quoted/replied interactive-card text across schema 1.0, schema 2.0, i18n, template-variable, and post-format fallback shapes without carrying broad generated/config churn from related parser experiments. (#38776, #60383, #42218, #45936) Thanks @lishuaigit, @lskun, @just2gooo, and @Br1an67.
Telegram/agents: hide raw failed write/edit warning messages in Telegram when the assistant already explicitly acknowledges the failed action, while keeping warnings when the reply claims success or omits the failure; #39406 remains the broader configurable delivery-policy follow-up. Fixes #51065; covers #39631. Thanks @Bartok9 and @Bortlesboat.
Exec approvals: accept a symlinked OPENCLAW_HOME as the trusted approvals root while still rejecting symlinked .openclaw path components below it. (#64663) Thanks @FunJim.
Logging: add top-level hostname, flattened message, and available agent_id, session_id, and channel fields to file-log JSONL records for multi-agent filtering without removing existing structured log arguments. Fixes #51075. Thanks @stevengonsalvez.
ACP: route server logs to stderr before Gateway config/bootstrap work so ACP stdout remains JSON-RPC only for IDE integrations. Fixes #49060. Thanks @Hollychou924.
Logging: propagate internal request trace scopes through Gateway HTTP requests and WebSocket frames so file logs, diagnostic events, agent run traces, model-call traces, OTEL spans, and trusted provider traceparent headers share a correlatable traceId without logging raw request or model content. Fixes #40353. Thanks @liangruochong44-ui.
Diagnostics/OTEL: capture privacy-safe model-call request payload bytes, streamed response bytes, first-response latency, and total duration in diagnostic events, plugin hooks, stability snapshots, and OTEL model-call spans/metrics without logging raw model content. Fixes #33832. Thanks @wwh830.
Logging: write validated diagnostic trace context as top-level traceId, spanId, parentSpanId, and traceFlags fields in file-log JSONL records so traced requests and model calls are easier to correlate in log processors. Refs #40353. Thanks @liangruochong44-ui.
Logging/sessions: apply configured redaction patterns to persisted session transcript text and accept escaped character classes in safe custom redaction regexes, so transcript JSONL no longer keeps matching sensitive text in the clear. Fixes #42982. Thanks @panpan0000.
Agents/sessions: let sessions_spawn runtime="subagent" ignore ACP-only streamTo and resumeSessionId fields while keeping ACP passthrough and documenting streamTo as ACP-only. Fixes #43556 and #63120; covers #56326, #61724, #64714, and #67248; carries forward #68397, #65282, #58686, #56342, and #40102. Thanks @skernelx, @damselem, @Br1an67, @Mintalix, @IsaacAPerez, @vvitovec, @Sanjays2402, @shenkq97, and @1034378361.
Providers/Ollama: honor /api/show capabilities, custom Modelfile PARAMETER num_ctx, configured provider/model context defaults, whitelisted native params such as temperature, top_p, and think, and native thinking effort levels so local models get accurate tools, context, and thinking behavior without forcing full-context VRAM use. Fixes #64710, duplicate #65343, #68344, #44550, #52206, #49684, #68662, #48010, #71584, and #44786; supersedes #69464; carries forward #44955. Thanks @yuan-b, @netherby, @xilopaint, @Diyforfun2026, @neeravmakwana, @taitruong, @armi0024, @LokiCode404, @zhouZcong, @dshenster-byte, @tangzhi, @pandego, @maweibin, @Adam-Researchh, @EmpireCreator, @g0st1n, and @voltwake.
Image tool/media: honor tools.media.image.timeoutSeconds and matching per-model image timeouts in explicit image analysis, including the MiniMax VLM fallback path, so slow local vision models are not capped by hardcoded 30s/60s aborts. Fixes #67889; supersedes #67929. Thanks @AllenT22 and @alchip.
Providers/Ollama: strip custom provider prefixes before native chat/embedding requests, skip ambient localhost discovery unless config/auth opts in, handle custom remote api: "ollama" providers, accept OpenAI SDK-style baseURL, scope synthetic local auth and embedding bearer headers to declared host boundaries, resolve custom-named local providers for subagents, add provider-scoped model request timeouts, preserve explicit input modalities, and document params.keep_alive plus local/LAN/cloud/multi-host/web-search/embedding/thinking setup recipes. Fixes #72353, #56939, #62533, #43945, #64541, #68796, and #39690; supersedes #57116, #62549, #69261, #69857, #65143, and #66511; refs #43945; carries forward #43224 and #39785. Thanks @maximus-dss, @hclsys, @IanxDev, @tsukhani, @issacthekaylon, @Julien-BKK, @Linux2010, @hyspacex, @maxramsay, @Meli73, @LittleJakub, @Juankcba, @uninhibite-scholar, @yfge, @Skrblik, and @Mriris.
Providers/Ollama: move memory embeddings to /api/embed with batched input, route local web search through Ollama's signed daemon proxy while keeping cloud auth scoped, treat Ollama memory embeddings as key-optional in doctor, and keep model usage visible by estimating native transcript usage when /api/chat omits counters. Fixes #39983, #69132, and #46584; carries forward #39112. Thanks @sskkcc, @LiudengZhang, @yoon1012, @hyspacex, @fengly78, and @TylonHH.
Agents/Ollama: parse stringified native tool-call arguments, retry native empty/thinking-only turns, accept already-prefixed LLM task model overrides, apply provider-owned replay normalization for Cloud models, validate explicit --thinking max, show resolved thinking defaults in Control UI, and include configured provider models in models list --provider. Fixes #69735, #50052, #71697, #71584, #72407, and #65207; supersedes #69910; carries forward #66552 and #61223. Thanks @rongshuzhao, @yfge, @L3G, @ralphy-maplebots, @Hollychou924, @ismael-81, @g0st1n, @NotecAG, and @drzeast-png.
Providers/PDF/Ollama: add bounded network timeouts for Ollama model pulls and native Anthropic/Gemini PDF analysis requests so unresponsive provider endpoints no longer hang sessions indefinitely. Fixes #54142; supersedes #54144 and #54145. Thanks @jinduwang1001-max and @arkyu2077.
Docker/QA: add observability coverage to the normal Docker aggregate so QA-lab OTEL and Prometheus diagnostics run inside Docker. Thanks @vincentkoc.
Auto-reply: poison inbound message dedupe after replay-unsafe provider/runtime failures so retries stay safe before visible progress but cannot duplicate messages after block output, tool side effects, or session progress. Fixes #69303; keeps #58549 and #64606 as duplicate validation. Thanks @martingarramon, @NikolaFC, and @zeroth-blip.
Agents/model fallback: keep auto-persisted fallback model overrides selected across turns until /new or reset clears them, avoiding repeated probes of a known-bad primary while /status shows the selected and active models. Thanks @kibedu.
Agents/model fallback: jump directly to a known later live-session model redirect instead of walking unrelated fallback candidates, while preserving the already-landed live-session/fallback loop guard. Fixes #57471; related loop family already closed via #58496. Thanks @yuxiaoyang2007-prog.
Gateway/Bonjour: keep @homebridge/ciao cancellation handlers registered across advertiser restarts so late probing cancellations cannot crash Linux and other mDNS-churned gateways.
Plugins/startup: load the default memory-core slot during Gateway startup when permitted so active-memory recall can call memory_search and memory_get without requiring an explicit plugins.slots.memory entry, while preserving plugins.slots.memory: "none".
Plugins/CLI: prefer native require for compiled bundled plugin JavaScript before jiti so read-only config, status, device, and node commands avoid unnecessary transform overhead on slow hosts. Fixes #62842. Thanks @Effet.
Plugins/compat/CLI: inventory doctor-side deprecation migrations separately from runtime plugin compatibility, add dated records for legacy extension-api, memory registration, provider hook/type aliases, runtime aliases, channel SDK helpers, and approval/test utility shims, refresh the persisted registry after managed plugin removals, make plugin install/uninstall writes conflict-aware, clear stale denylists, and fail tracked plugin/hook updates or unloadable package installs instead of leaving stale state. Thanks @vincentkoc.
WebChat/Control UI: support non-video file attachments in chat uploads while preserving the existing image attachment path and MIME-sniff fallback for generic image uploads. (#70947) Thanks @IAMSamuelRodda.
Skills/memory: restore Chokidar v5 hot reloads by watching concrete skill and memory roots with filters, including SKILL.md removals and deleted skill folders without broad workspace recursion. Fixes #27404, #33585, and #41606. Thanks @shelvenzhou, @08820048, and @rocke2020.
Gateway/chat: keep duplicate attachment-backed chat.send retries with the same idempotency key on the documented in-flight path so aborts still target the real active run. Fixes #70139. Thanks @Feelw00.
Gateway/session rows: report the same config-resolved thinking default that runtime sessions use, including global and per-agent defaults, so Control UI and TUI default labels stay aligned. (#71779, #70981, #71033, #70302) Thanks @chen-zhang-cs-code, @SymbolStar, and @cholaolu-boop.
Plugins: share package entrypoint resolution between install and discovery, reject mismatched runtimeExtensions, and cache bundled runtime-dependency manifest reads during scans.
WhatsApp/Web: keep quiet but healthy linked-device sessions connected by basing the watchdog on WhatsApp Web transport activity, while retaining a longer app-silence cap so frame activity cannot mask a stuck session forever. Fixes #70678; carries forward the focused #71466 approach and keeps #63939 as related configurable-timeout follow-up. Thanks @vincentkoc and @oromeis.
Discord/gateway: count failed health-monitor restart attempts toward cooldown and hourly caps, and evict stale account lifecycle state during channel reloads so repeated Discord gateway recovery cannot loop on old status. Fixes #38596. (#40413) Thanks @jellyAI-dev and @vashquez.
Cron/context engine: run isolated cron jobs under run-scoped context-engine session keys so prior runs of the same job are not inherited unless the job is explicitly session-bound. (#72292) Thanks @jalehman.
Control UI: localize command palette labels, categories, skill shortcuts, footer hints, and connect-command copy labels while preserving localized command palette search matching. (#61130, #61119) Thanks @rubensfox20.
Plugins/memory-lancedb: request float embedding responses from OpenAI-compatible servers so local providers that default SDK requests to base64 no longer return dimension-mismatched LanceDB vectors while preserving configured dimensions. Fixes #45982. (#59048, #46069, #45986) Thanks @deep-introspection, @xiaokhkh, @caicongyang, and @thiswind.
Plugins/memory-lancedb: advance auto-capture cursors per session only after messages are processed or intentionally skipped, retry failed messages, survive compacted histories, and clear cursor state on session end. Fixes #71349; carries forward #42083. Thanks @as775116191.
Plugins/memory-core: respect configured memory-search embedding concurrency during non-batch indexing so local Ollama embedding backends can serialize indexing instead of flooding the server. Fixes #66822. (#66931) Thanks @oliviareid-svg and @LyraInTheFlesh.
Docker/update smoke: keep the package-derived update-channel fixture on package-shipped files and make its UI build stub create the asset the updater verifies. Thanks @vincentkoc.
Gateway/models: repair legacy models.providers.*.api = "openai" config values to openai-completions, and skip providers with future stale API enum values during startup instead of bricking the gateway. Fixes #72477. (#72542) Thanks @JooyoungChoi14 and @obviyus.
Gateway/skills: redact apiKey and secret-named env values from the skills.update RPC response to prevent leaking credentials into WebSocket traffic, client logs, or session transcripts. Config is still written to disk in full; only the response payload is redacted. (#69998) Thanks @Ziy1-Tan.
Plugins/CLI: let flag-driven openclaw channels add install the selected channel plugin from its default source without opening an interactive prompt, fixing published npm Telegram setup in stdin-closed automation.
Onboarding/setup: keep first-run config reads, plugin compatibility notices, OpenAI Codex auth, post-auth default-model policy lookup, skip-auth, provider-scoped model pickers, and post-model sanity checks on cold manifest/setup metadata unless the user chooses to browse all models, avoiding full plugin/provider runtime loads between prompts. Thanks @shakkernerd.
Gateway/Bonjour: suppress known @homebridge/ciao cancellation and network assertion failures through scoped process handlers so malformed mDNS packets or restricted VPS networking disable/restart Bonjour instead of crashing the gateway. Fixes #67578. Thanks @zenassist26-create.
Discord: keep late clicks on already-resolved exec approval buttons quiet when elevated mode auto-resolved the request, while still surfacing real approval submission failures. Fixes #66906. Thanks @rlerikse.
Telegram: send a fresh final message for long-lived preview-streamed replies so the visible Telegram timestamp reflects completion time instead of the preview creation time. Thanks @rubencu.

CVE-2026-41322 | withastro up to 10.0.4 _astro web browser cache containing sensitive information (GHSA-c57f-mm3j-27q9 / EUVD-2026-25580)

Sat, 25 Apr 2026 10:50:37 +0200

A vulnerability marked as problematic has been reported in withastro astro up to 10.0.4. Affected by this issue is the function _astro. This manipulation causes use of web browser cache containing sensitive information. This vulnerability appears as CVE-2026-41322. The attack may be initiated remotely. There is no available exploit. It is suggested to upgrade the affected component.

Palo Alto Networks and Google Cloud

Wed, 22 Apr 2026 18:22:18 +0200

Palo Alto Networks and Google Cloud Secure the AI Enterprise. See 4 new integrations, including Prisma AIRS, announced at Cloud Next ’26. The post Palo Alto Networks and Google Cloud appeared first on Palo Alto Networks Blog. This article has…

The post Palo Alto Networks and Google Cloud appeared first on IT Security News.

Browser statt Firewall: Palo Alto zielt auf KMU

Thu, 16 Apr 2026 09:39:07 +0200

Mit Prisma Browser for Business bringt Palo Alto Networks seinen Unternehmensbrowser in den Mittelstand. Nicht mehr Netzwerk oder Endpoint sollen die Arbeit sichern, sondern der Browser selbst.

Announcing ADEM Universal Agent

Fri, 10 Apr 2026 15:37:46 +0200

The ADEM Universal Agent for Prisma Access unifies network data across branch sites to fuel agentic autonomous operations. Get full-stack visibility. The post Announcing ADEM Universal Agent appeared first on Palo Alto Networks Blog. This article has been indexed from…

The post Announcing ADEM Universal Agent appeared first on IT Security News.

3sat Wissenschaftsdoku im Stream - Mediatheken - Prisma

Thu, 09 Apr 2026 09:36:58 +0200

Obwohl Experten seit Jahrzehnten versuchen, unsere IT-Systeme zu sichern, verursachen Cyberangriffe mittlerweile dreimal mehr Schäden als ...

Palo Alto Networks at Nutanix .NEXT 2026

Wed, 08 Apr 2026 15:36:09 +0200

Discover how Palo Alto Networks and Nutanix are Securing the AI-Powered Hybrid Multicloud with zero trust and Prisma AIRS. The post Palo Alto Networks at Nutanix .NEXT 2026 appeared first on Palo Alto Networks Blog. This article has been indexed…

The post Palo Alto Networks at Nutanix .NEXT 2026 appeared first on IT Security News.

Prisma Browser for Business: Sicherheit im Browser für KMU - IP-Insider

Tue, 07 Apr 2026 08:06:53 +0200

Er soll vor Phishing, Malware und betrügerischen Webseiten schützen. Zusätzlich gibt es Funktionen zur Verhinderung von Datenabfluss (Data Loss ...

La evolución del sector asegurador español ante la era de la IA: estrategia, gobernanza y el imperativo del riesgo prudencial

Mon, 06 Apr 2026 16:32:09 +0200

El sector asegurador —en general, y en España en particular— se encuentra a las puertas de una fase de transformación que va más allá de la mera digitalización para adentrarse en una potencial reconfiguración estructural impulsada por la inteligencia artificial (IA). Este fenómeno, lejos de ser una tendencia coyuntural, apunta a consolidarse progresivamente como uno de los ejes centrales de las estrategias corporativas para los próximos años en el sector, proyectándose como un horizonte de cambio inminente.

Sin embargo, la implantación actual de estas tecnologías se manifiesta todavía con cautela en un sector prudente en el riesgo y fuertemente regulado, con diferencias también según el ramo de actividad. La Autoridad Europea de Seguros y Pensiones de Jubilación (EIOPA) publicó el pasado 2 de febrero un informe sobre el uso de la inteligencia artificial generativa (GenAI) en el sector asegurador europeo. El informe, basado en las respuestas de 347 empresas de 25 países, destaca una adopción en rápido aumento de la GenAI entre las aseguradoras europeas, con casi dos tercios que ya han comenzado a usar la tecnología (si bien la mayoría se encuentran todavía en fase de prueba de concepto), lo que indica una implantación prudente y controlada, así como un importante potencial de crecimiento futuro. La mayoría de los casos de uso comunicados (64%) se centran en herramientas de productividad tipo back-end (extracción de datos de facturas, grabaciones de audio o informes médicos, generación de contenido para correos electrónicos, contratos o materiales de marketing, etc.). El uso mayoritario restante corresponde a desarrollo de aplicaciones de IA de última generación orientadas al cliente, como los chatbots. Por ramos, Vida presenta una penetración algo más moderada que en seguros de No Vida, reflejando la cautela inherente a productos con horizontes temporales de larga duración y una carga regulatoria más pesada. Aunque EIOPA no muestra datos específicos del mercado español, parece que aquí el grado de adopción sería algo superior a nuestros vecinos, tal y como muestran otros estudios previos de Minsait. No obstante, estos datos reflejan el uso de IA general (GenAI + clásica), no específicamente generativa.

En este escenario, para un director de Estrategia y Gobierno de la IA (Chief AI Officer o CAIO) en el entorno asegurador español, se plantea una dualidad compleja: la necesidad de capitalizar las eficiencias disruptivas mientras se navega en un ecosistema de riesgo prudencial donde la transparencia y la explicabilidad no son opciones, sino mandatos regulatorios estrictos. A esta complejidad se suma un factor clave: la inversión necesaria dista mucho de ser trivial. No sólo implica integrar modelos avanzados en infraestructuras heredadas, sino también incorporar talento especializado capaz de gestionar nuevas arquitecturas tecnológicas y perfiles adicionales en ámbitos como la planificación, la regulación o el ‘delivery’ de soluciones.

La arquitectura de la disrupción: IA generativa y el auge de los sistemas agente

La distinción entre la IA tradicional y las nuevas fronteras de la IA generativa y agentiva resulta clave para comprender el cambio de paradigma que podría materializarse en los próximos años. Mientras que la IA convencional se ha venido centrando históricamente en el análisis predictivo y la clasificación de datos estructurados, la IA generativa permite introducir la capacidad de interactuar con grandes volúmenes de datos no estructurados, como contratos, informes periciales o comunicaciones con clientes. No obstante, la verdadera revolución —que ya se vislumbra— es la transición hacia los agentes autónomos. Estos sistemas no sólo generan contenido, sino que poseen la capacidad de descomponer problemas complejos, razonar sobre objetivos y ejecutar flujos de trabajo de manera proactiva con una mínima intervención humana.

El impacto real de la IA en la cadena de valor

La IA generativa y los agentes autónomos van a redefinir cada eslabón de la cadena de valor aseguradora, permitiendo una transición desde modelos reactivos hacia una gestión proactiva del riesgo. En el ámbito de la suscripción y la evaluación de riesgos, la IA va a permitir procesar rápidamente grandes volúmenes de datos externos e internos para tomar decisiones más precisas y personalizadas. Esta capacidad de análisis predictivo es esencial para ofrecer cotizaciones instantáneas y coberturas dinámicas que se ajusten al perfil del cliente en tiempo real.

La revolución en la gestión de siniestros y detección de fraude

Pero, con toda seguridad, es en la gestión de siniestros donde el beneficio económico directo va a ser más evidente. La integración de IA permitirá una automatización que reduce drásticamente los tiempos de respuesta. Según un estudio de Shift Technology (empresa puntera del sector ‘InsurTech’), casos de uso avanzados demuestran que la IA puede alcanzar una precisión del 95% en la automatización de siniestros de baja complejidad. Mediante el uso de agentes autónomos, el tiempo de tramitación de un siniestro puede reducirse de semanas a horas, mejorando la satisfacción del cliente de manera exponencial.

La detección del fraude es otro pilar crítico. Según el mismo estudio, los sistemas de IA ya analizan patrones y anomalías en los datos para identificar situaciones sospechosas con una precisión documentada del 93%. En el contexto español, donde el fraude supone una carga significativa para la mutualidad de asegurados, el uso de GenAI (combinada con otros modelos de aprendizaje no supervisado) para analizar inconsistencias entre documentos y detalles de la pérdida puede convertirse en una herramienta fundamental para proteger la rentabilidad de las carteras.

Atención al cliente e “hiperpersonalización” de pólizas

Por otro lado, y en línea con el estudio de EIOPA, uno de los ámbitos donde ya se observa una mayor madurez y grado de adopción es en la utilización de chatbots inteligentes y asistentes virtuales potenciados por IA (incluyendo modelos de lenguaje naturales, principalmente generativos), para atender consultas de clientes de forma inmediata. Además, mediante análisis de datos de clientes, la IA ayuda a identificar preferencias y ofrecer productos o coberturas personalizadas a cada perfil. Esto se traduce en respuestas más rápidas y pólizas más ajustadas a las necesidades de cada cliente, incrementando la satisfacción y fidelización de los asegurados.

El marco regulatorio: AI Act, DORA y Solvencia II

La innovación con IA en el seguro español navega en un mar de normativas cada vez más denso. El Reglamento de IA de la Unión Europea (AI Act), de implantación secuencial desde agosto de 2024, establece una clasificación de riesgos que impacta directamente en las operaciones aseguradoras. El primer hito, ya cumplido, fue descartar los Sistemas de “Riesgo Prohibido” (febrero de 2025). Sin embargo, el uso de la IA para la evaluación de riesgos y la fijación de precios en seguros de vida y salud ha sido recogido en el Anexo III del AI ACT dentro de la categoría de “Servicios Esenciales” y por tanto etiquetado como de “Alto Riesgo”, entendiendo que dicha finalidad puede tener impacto en los derechos fundamentales de las personas físicas. Estos Sistemas conllevan obligaciones estrictas en materia de gobernanza de datos, documentación técnica y supervisión humana, entre otras. Y para añadir más complejidad —si cabe—, la definición de “Sistema IA” que hace el Reglamento puede alcanzar a modelos tradicionales, tales como el cálculo actuarial o los modelos lineales generalizados (GLM), que llevan siendo utilizados durante más de 70 años en el sector. Es imperativo resolver esta ambigüedad regulatoria, ya que puede suponer un notable freno a la innovación y generar una duplicidad de cargas sobre procesos ‘core’ del sector, más que consolidados y auditados.

A este marco se suma el Reglamento de Resiliencia Operativa Digital (DORA), que obliga a las entidades financieras, incluidas las aseguradoras, a garantizar que sus infraestructuras digitales —incluidas aquellas que soportan IA— sean resistentes ante incidentes y ciberamenazas. La interdependencia entre la IA y la ciberseguridad es bidireccional: mientras la IA mejora la capacidad de detección de amenazas, también se convierte en un vector de ataque que requiere protecciones específicas y una monitorización constante de las vulnerabilidades.

Enfoque de riesgo prudencial y el desafío de la “caja negra”

A pesar de los beneficios evidentes, la adopción de la IA en el sector asegurador español se rige por un principio de prudencia extrema. El paraguas de Solvencia II, bajo la supervisión de la Dirección General de Seguros y Fondos de Pensiones (DGSFP), exige que cualquier innovación sea compatible con la estabilidad financiera y la protección del consumidor. El concepto de “riesgo prudencial” adquiere aquí una relevancia máxima: las aseguradoras deben mantener un perfil de riesgo conservador y asegurar que el uso de tecnologías emergentes no comprometa su adecuación de capital ni su liquidez.

En este sentido, otro de los grandes desafíos que conlleva la aplicación de la IA en el ámbito asegurador es el carácter de “caja negra” de muchos modelos avanzados, especialmente los basados en aprendizaje profundo (deep learning) e IA generativa. En un sector donde las decisiones sobre primas, coberturas y denegaciones de siniestros deben ser justificables ante cliente y regulador, la opacidad algorítmica es inasumible. EIOPA ha enfatizado que la transparencia y la explicabilidad son principios innegociables para una IA fiable. Estos aspectos son, además, un requerimiento regulatorio por parte del AI Act en los Sistemas de Alto Riesgo.

Gobernanza de datos: el cimiento de una IA responsable

Para que la IA despliegue su potencial bajo un prisma prudencial, la gobernanza de datos se convierte en la prioridad número uno. EIOPA ha establecido principios claros: los datos utilizados para entrenar modelos de IA deben ser completos, representativos y estar libres de sesgos discriminatorios. En el contexto de la Directiva de Distribución de Seguros (IDD), las aseguradoras españolas tienen la obligación de actuar con honestidad y profesionalidad, lo que implica que el uso de la IA debe priorizar el interés del cliente y evitar cualquier forma de exclusión financiera injustificada.

El CAIO debe liderar la implementación de políticas de gobernanza de datos que aseguren que la información sea “apropiada” para su propósito. Esto incluye no solo la calidad técnica del dato, sino también su dimensión ética. La trazabilidad de los datos, desde su origen hasta su procesamiento por el algoritmo, es un requisito esencial para cumplir con las expectativas de supervisión de la DGSFP y para garantizar la soberanía del conocimiento dentro de la organización.

Tendencias emergentes: computación cuántica e IoT

Mirando hacia un futuro un paso más allá, hay que considerar el potencial que va a aportar a la IA otras tecnologías disruptivas. La computación cuántica se perfila como un acelerador masivo de los algoritmos de aprendizaje automático, permitiendo el procesamiento de conjuntos de datos masivos de manera mucho más eficiente para la tarificación de riesgos complejos. Aunque todavía en fase de investigación, se espera que en un horizonte de unos cinco años la computación cuántica empiece a utilizarse en servicios habituales de gestión de riesgos catastróficos y optimización de carteras.

Por otro lado, la integración de la IA con el Internet de las Cosas (IoT) —en hogares conectados, vehículos telemáticos, dispositivos de salud… y siempre respetando los derechos fundamentales de las personas físicas, según establece el AI Act—, permitirá a las aseguradoras pasar de ser pagadores de siniestros a ser gestores de prevención. Los agentes autónomos podrán interactuar con estos datos en tiempo real para sugerir cambios de comportamiento que reduzcan la probabilidad de un siniestro, alineando los intereses de la aseguradora con la seguridad y bienestar del cliente.

Conclusiones: la ruta hacia un seguro más inteligente y prudente

La transformación del sector asegurador español —y global— mediante la IA es un proceso de cambio estructural, una evolución significativa que ha de recorrerse para aprovechar el pleno potencial de las nuevas tecnologías, marcado por la necesidad de eficiencia y la exigencia de responsabilidad. El impacto real, aún incipiente, ya comienza a vislumbrarse en la reducción de tiempos de tramitación, la precisión en la detección del fraude y una personalización del servicio sin precedentes. Sin embargo, el éxito sostenible de esta transición dependerá de la capacidad de las entidades para integrar la innovación dentro de un marco de riesgo prudencial sólido.

Para el CAIO, los imperativos son claros:

Priorizar la gobernanza: la IA es tan buena como los datos que la alimentan y la estructura que la supervisa. Establecer roles y responsabilidades claros entre las funciones de tecnología, riesgos, cumplimiento y protección de datos es esencial.
Fomentar la transparencia: ante el riesgo de “caja negra”, las aseguradoras deben invertir en tecnologías de explicabilidad y mantener siempre una supervisión humana efectiva en las decisiones de alto impacto.
Gestionar la escala: pasar de la experimentación a la orquestación masiva de agentes autónomos requiere una infraestructura resiliente y alineada con normativas como DORA.
Preservar el conocimiento: la soberanía tecnológica será el factor diferencial de las aseguradoras líderes, preservando que el corazón de la inteligencia de negocio permanezca como un activo estratégico propio.

En última instancia, la IA no sustituye la prudencia del asegurador, sino que la potencia. Al dotar a las entidades de herramientas para comprender mejor el riesgo y servir con mayor agilidad al cliente, la tecnología refuerza la misión fundamental del sector: actuar como la red de seguridad de la sociedad en un entorno cada vez más complejo y digital. Sólo si la innovación audaz y la prudencia regulatoria coexisten y se retroalimentan se podrá crear valor real y duradero.

Jesús Gil Jaime es responsable de Riesgos de la Oficina Corporativa de Estrategia en Inteligencia Artificial de Ibercaja. Formado en Estadística, Matemáticas, Big Data e IA, actualmente es doctorando por la Universidad de Zaragoza en Métodos de Inteligencia Artificial aplicados al análisis y predicción de Series Temporales en Economía.

astrojs/vercel < = 10.0.0 - Unauthenticated x-astro-path Header Path Override

Fri, 03 Apr 2026 22:37:37 +0200

Topic: astrojs/vercel < = 10.0.0 - Unauthenticated x-astro-path Header Path Override Risk: Medium Text:#!/usr/bin/env python3 # Exploit Title: @astrojs/vercel < = 10.0.0 - Unauthenticated x-astro-path Header Path Override ...

Cloudflare’s new CMS is not a WordPress killer, it’s a WordPress alternative

Fri, 03 Apr 2026 03:21:43 +0200

Cloudflare on Wednesday rolled out EmDash, which it described as “the spiritual successor to WordPress.” The security vendor positioned EmDash as a far more secure site building tool that avoids the extensive cybersecurity problems with WordPress plugins.

But the Cloudflare claims go far beyond cybersecurity issues. The vendor is arguing that the very nature of websites in 2026 is sharply different to the kind of website that WordPress was designed to handle.

“WordPress powers over 40% of the internet. It is a massive success that has enabled anyone to be a publisher, and created a global community of WordPress developers. But the WordPress open source project will be 24 years old this year,” the Cloudflare announcement said. “Hosting a website has changed dramatically during that time. When WordPress was born, AWS EC2 didn’t exist. In the intervening years, that task has gone from renting virtual private servers, to uploading a JavaScript bundle to a globally distributed network at virtually no cost. It’s time to upgrade the most popular CMS on the internet to take advantage of this change.”

More flexible licensing

Cloudflare’s statement also suggested that it is delivering open source in a way that is potentially more open and flexible than the WordPress approach.

“EmDash is fully open source, MIT licensed, and available on GitHub. While EmDash aims to be compatible with WordPress functionality, no WordPress code was used to create EmDash. That allows us to license the open source project under the more permissive MIT license. We hope that allows more developers to adapt, extend, and participate in EmDash’s development,” the company said. “EmDash is committed to building on what WordPress created: an open source publishing stack that anyone can install and use at little cost, while fixing the core problems that WordPress cannot solve.”

The next wave of web development

In an interview with Computerworld, Cloudflare senior product manager Matt Taylor said his team sees the project as the next wave of web development platforms.

“There is a whole new generation of developers, and WordPress is old news to them. If you are starting today, there is no way you are picking WordPress,” Taylor said, adding that AI agents are also not going to opt for WordPress platforms when creating new sites.

Even when adding Cloudflare in front of a WordPress site to enhance security, he noted, “you have to hack the system to work with the modern internet.”

WordPress was unable to provide its feedback on the announcement by deadline.

WordPress not for new users

Melody Brue, principal analyst for Moor Insights & Strategy, said she has not seen many developers who are not already experienced with WordPress choosing it to build sites, and that she is also seeing that AI agents never opt for WordPress unless they were given explicit instructions to do so. Given how rampant autonomous AI agents are today, the ability to be more hospitable to agentic systems may prove a massive advantage.

“For somebody new, you have this opportunity to skip all of these legacy CMS assumptions and have true least privilege by design, a first class experience for agents. At least, that is what [Cloudflare] is trying to deliver,” Brue said. “They are baking in agent skills.”

Enterprise concerns

When it comes to enterprise web development strategies, however, things get a little more complex, Brue said. Given how deeply they are already invested in WordPress code and plugins and the support environment, existing WordPress enterprise users are not likely to easily move.

But the extensive legal outbursts from last year involving Automattic CEO Matt Mullenweg, and the lawsuit with WP Engine, made some enterprise IT executives nervous, once they realized how much control one person had over WordPress platforms.

Brue said, “I can understand the concerns,” but added that the WordPress squabbles seem to have become more subdued lately: “There is now less of the tantrum throwing happening.”

Thomas Randall, a research director at Info-Tech Research Group, agreed with Brue that enterprise environments are unlikely to abandon WordPress any time soon.

“Is EmDash the spiritual successor to WordPress? Not from what Cloudflare has shown so far. The problem Cloudflare highlights, security vulnerabilities in WordPress plugins, is real. But the rest of the announcement deserves skepticism,” Randall said. “For instance, enterprise IT teams with complex WordPress environments will encounter nontrivial barriers for migration. EmDash uses Portable Text rather than WordPress’s HTML content model, which would significantly complicate automated migration. Existing PHP themes and plugins would not carry over directly and would likely require substantial redevelopment.”

But that would still open the door to newcomers who have not already invested in the WordPress environment.

Competing in a different layer

Noah Kenney, principal consultant for Digital 520, said the future is likely to look much more inviting for an EmDash-like approach than for legacy WordPress.

“Cloudflare’s EmDash is less about replacing WordPress outright and more about setting a new security baseline, which is that CMS platforms should have isolated execution environments, least-privilege access, and verifiable permission models,” Kenney said. “That has implications for both content management and how enterprises evaluate third-party extensibility risk more broadly.”

However, he noted, “viability is an ecosystem question just as much as it is a technical one. EmDash, even if superior from an architectural perspective, is effectively starting from zero. Enterprise adoption will depend heavily on migration tooling, developer adoption, and whether Cloudflare can build a credible plugin and integration ecosystem.”

Kenney added that he sees EmDash as “very likely to influence the next phase of CMS architecture, particularly in security-sensitive and enterprise environments where plugin risk is already a prevalent issue.”

Sanchit Vir Gogia, chief analyst at Greyhound Research, saw the EmDash move in a much broader context, potentially signaling the near-term future of website strategies.

“EmDash is competing in a different layer altogether,” Gogia said. “It sits closer to composable and headless CMS platforms like Contentful and Strapi, and even closer to developer frameworks like Astro. It is collapsing what used to be separate concerns; content management, execution runtime, and security enforcement are being fused into one programmable environment.”

This, he observed, “is where the real friction emerges. Traditional CMS buyers are not necessarily developers first. They prioritize usability, ecosystem depth, and speed of execution for business teams. EmDash is clearly optimized for developers and architects. So the competition is not just product versus product. It is operating model versus operating model. And in that contest, incumbents have inertia on their side, while EmDash has architectural purity. History shows those two rarely move at the same speed.”

This article originally appeared on Computerworld.

Cloudflare’s new CMS is not a WordPress killer, it’s a WordPress alternative

Fri, 03 Apr 2026 03:16:36 +0200

More flexible licensing

Cloudflare’s statement also suggested that it is delivering open source in a way that is potentially more open and flexible than the WordPress approach.

The next wave of web development

In an interview with Computerworld, Cloudflare senior product manager Matt Taylor said his team sees the project as the next wave of web development platforms.

Even when adding Cloudflare in front of a WordPress site to enhance security, he noted, “you have to hack the system to work with the modern internet.”

WordPress was unable to provide its feedback on the announcement by deadline.

WordPress not for new users

Enterprise concerns

Brue said, “I can understand the concerns,” but added that the WordPress squabbles seem to have become more subdued lately: “There is now less of the tantrum throwing happening.”

Thomas Randall, a research director at Info-Tech Research Group, agreed with Brue that enterprise environments are unlikely to abandon WordPress any time soon.

But that would still open the door to newcomers who have not already invested in the WordPress environment.

Competing in a different layer

Noah Kenney, principal consultant for Digital 520, said the future is likely to look much more inviting for an EmDash-like approach than for legacy WordPress.

Sanchit Vir Gogia, chief analyst at Greyhound Research, saw the EmDash move in a much broader context, potentially signaling the near-term future of website strategies.

Open-Source-CMS von Cloudflare: EmDash fordert WordPress heraus

Thu, 02 Apr 2026 16:01:55 +0200

EmDash ist ein neues Content-Management-System mit TypeScript- und Astro-Basis. Plug-ins sollen dort sicher innerhalb einer Sandbox laufen.

Tools, um MCP-Server abzusichern

Thu, 02 Apr 2026 06:06:24 +0200

srcset="https://b2b-contenthub.com/wp-content/uploads/2025/11/Gorodenkoff_shutterstock_2324952347_16z9.jpg?quality=50&strip=all 7200w, https://b2b-contenthub.com/wp-content/uploads/2025/11/Gorodenkoff_shutterstock_2324952347_16z9.jpg?resize=300%2C168&quality=50&strip=all 300w, https://b2b-contenthub.com/wp-content/uploads/2025/11/Gorodenkoff_shutterstock_2324952347_16z9.jpg?resize=768%2C432&quality=50&strip=all 768w, https://b2b-contenthub.com/wp-content/uploads/2025/11/Gorodenkoff_shutterstock_2324952347_16z9.jpg?resize=1024%2C576&quality=50&strip=all 1024w, https://b2b-contenthub.com/wp-content/uploads/2025/11/Gorodenkoff_shutterstock_2324952347_16z9.jpg?resize=1536%2C864&quality=50&strip=all 1536w, https://b2b-contenthub.com/wp-content/uploads/2025/11/Gorodenkoff_shutterstock_2324952347_16z9.jpg?resize=2048%2C1152&quality=50&strip=all 2048w, https://b2b-contenthub.com/wp-content/uploads/2025/11/Gorodenkoff_shutterstock_2324952347_16z9.jpg?resize=1240%2C697&quality=50&strip=all 1240w, https://b2b-contenthub.com/wp-content/uploads/2025/11/Gorodenkoff_shutterstock_2324952347_16z9.jpg?resize=150%2C84&quality=50&strip=all 150w, https://b2b-contenthub.com/wp-content/uploads/2025/11/Gorodenkoff_shutterstock_2324952347_16z9.jpg?resize=854%2C480&quality=50&strip=all 854w, https://b2b-contenthub.com/wp-content/uploads/2025/11/Gorodenkoff_shutterstock_2324952347_16z9.jpg?resize=640%2C360&quality=50&strip=all 640w, https://b2b-contenthub.com/wp-content/uploads/2025/11/Gorodenkoff_shutterstock_2324952347_16z9.jpg?resize=444%2C250&quality=50&strip=all 444w" width="1024" height="576" sizes="auto, (max-width: 1024px) 100vw, 1024px">

Unabhängig davon, welche MCP-Server Unternehmen wofür einsetzen – “Unsicherheiten” sollten dabei außenvorbleiben.

Gorodenkoff | shutterstock.com

In diesem Artikel lesen Sie:

was Security-Tools für MCP leisten sollten, und
welche Angebote in diesem Bereich interessant sind.

Das sollten MCP-Sicherheitslösungen können

Die Gefahr von Datenlecks, Prompt Injections und weiteren Sicherheitsbedrohungen besteht unabhängig davon, ob Unternehmen:

ihre eigenen KI-Agenten mit MCP-Servern von Drittanbietern,
ihre eigenen MCP-Server mit Drittanbieter-Agenten, oder
ihre eigenen Server mit den eigenen Agenten verbinden.

MCP-Servererkennung. Für Mitarbeiter eines Unternehmens ist es einfach, MCP-Server herunterzuladen und zu nutzen. Mit Scan-Services für MCP-Server können Unternehmen sämtliche Instanzen von Schatten-MCP-Servern in ihrer Umgebung finden.
Laufzeitschutz. KI-Agenten kommunizieren mit MCP-Servern in natürlicher Sprache. MCP-Sicherheits-Tools sollten deshalb in der Lage sein, diese Kommunikation auf Sicherheitsprobleme wie Prompt Injections hin zu überwachen.
Authentifizierungs- und Zugriffskontrollen. Das MCP-Protokoll unterstützt inzwischen OAuth, aber das ist nur ein erster Schritt. Für zusätzliche Sicherheit empfehlen sich Tools mit integrierten Kontroll-Frameworks für Zero Trust und Least Privilege.
Logging und Observability. Tools und Plattformen sollten zudem die Möglichkeit bieten, MCP-Protokolle zu sammeln, Sicherheitsteams über Richtlinienverstöße zu informieren, Compliance-Daten zu erfassen oder Protokolle in die bestehende Sicherheitsinfrastruktur einzuspeisen.

MCP-Security-Angebote

Im Folgenden haben wir die Anbieter von MCP-Security-Tools in drei Kategorien aufgeteilt. Diese Aufstellung erhebt keinen Anspruch auf Vollständigkeit.

Hyperscaler

Für Unternehmen, die sich vollständig auf eine bestimmte Cloud-Plattform verlassen, bieten die MCP-Tools des jeweiligen Hyperscalers einen einfachen Einstieg.

Amazon Web Services (AWS) hat Mitte 2025 seine eigene agentenbasierte KI-Plattform eingeführt. Amazon Bedrock AgentCore umfasst ein Gateway, das mehrere Protokolle unterstützt (darunter auch MCP), ein Identity-Management-System sowie Observability.
Microsoft bietet einen grundlegenden Azure-MCP-Server an, inklusive Support für Azure Key Vault. Darüber hinaus unterstützen auch Azure AI Foundry Agent Service und Azure API Management das Model Context Protocol. Zudem bietet Microsoft mit dem Agent Framework auch ein Open-Source-Entwicklungskit, das sowohl MCP als auch Agent2Agent unterstützt und beispielsweise Schutz vor Prompt Injections verspricht.
Google Cloud kündigte Anfang 2025 seine MCP Toolbox für Datenbanken an – inklusive integrierter Authentifizierung und Observability. Außerdem hat der Hyperscaler auch eine Referenzarchitektur veröffentlicht, um MCP-Server auf seiner Cloud-Plattform abzusichern.

Große Plattformanbieter

Der IT-Dienstleister Cloudflare hat mit MCP Server Portals ein Tool veröffentlicht, mit dem Unternehmen MCP-Verbindungen zentralisiert absichern und überwachen können. Die Funktion ist Bestandteil der Cloudflare-One-Plattform.
Palo Alto Networks hat mit Blick auf MCP-Sicherheit mehrere Eisen im Feuer. Mit Prisma AIRS hat das Unternehmen einen eigenen, intermediären MCP-Server veröffentlicht. Dieser sitzt zwischen den KI-Agenten und dem eigentlichen MCP-Server und erkennt schadhafte Inhalte und Daten. Das Tool MCP Security ist hingegen Bestandteil von Cortex Cloud WAAS und überprüft die MCP-Kommunikation an der Netzwerkgrenze auf bösartige Aktivitäten.
SentinelOne gewährt mit seiner Singularity Platform ebenfalls Einblick in die MCP-Interaktionskette und bietet zum Beispiel Warnmeldungen und automatisierte Incident Response für MCP-Server auf lokaler oder Remote-Ebene.
Daneben hat auch Broadcom MCP-Sicherheitsfunktionen für VMware Cloud Foundation angekündigt, die künftig mehr Sicherheit für agentenbasierte Workflows gewährleisten sollen.

Startups

Die Plattform von Acuvity (seit Februar 2026 Teil von Proofpoint) verspricht, MCP-Server umfassend abzusichern. Dafür sorgt laut dem Anbieter eine Kombination aus Least-Privilege-Execution, unveränderlichen Laufzeiten, kontinuierlichen Schwachstellenscans, Authentifizierung und Bedrohungserkennung.
Das API-Security-Startup Akto hat eine MCP-Security-Plattform im Angebot. Sie umfasst ein Discovery Tool, um MCP-Server in Unternehmensumgebungen zu identifizieren, Security-Testing-Werkzeuge sowie Monitoring- und Threat-Detection-Funktionen.
Invariant Labs bietet mit MCP-Scan ein quelloffenes Tool, das die statische Analyse und Echtzeitüberwachung von MCP-Servern ermöglicht. Mit Guardrails hat das Startup auch ein kommerzielles Produkt im Angebot. Dabei handelt es sich um einen Proxy. Der zwischen KI-Agenten und MCP-Servern sitzt und vor Security-Risiken schützen soll. Das Tool befähigt Anwender außerdem dazu, Richtlinien aufzusetzen.
Highflame (vormals Javelin) addressiert ebenfalls das Thema MCP-Sicherheit. Etwa mit Funktionen wie MCP-Server auf Risiken zu scannen oder Datenanfragen zu überprüfen.
Lasso Security stellt ein Open-Source-MCP-Gateway zur Verfügung, das die Konfiguration und das Lebenszyklusmanagement von MCP-Servern ermöglicht und Messages um sensible Informationen bereinigt.

(fm)

Cloudflare Announces EmDash As Open-Source 'Spiritual Successor' To WordPress

Wed, 01 Apr 2026 22:22:14 +0200

In classic Cloudflare fashion, the CDN provider used April Fool's Day to unveil an actual, "not a joke" product. Today, the company announced EmDash -- an open-source "spiritual successor" to WordPress that aims to solve plugin security. Phoronix reports: With the help of AI coding agents, Cloudflare engineers have been rebuilding the WordPress open-source project "from the ground up." EmDash is written entirely in TypeScript and is a server-less design. Making plug-ins more secure than the WordPress architecture, EmDash plug-ins are sandboxed and run in their own isolate. EmDash builds upon the Astro web framework. EmDash doesn't rely on any WordPress code but is designed to be compatible with WordPress functionality. EmDash is open-source now under the MIT license. The EmDash code is available on GitHub.

CVE-2025-4615 | Palo Alto Cloud NGFW/PAN-OS/Prisma Access Management Web Interface cross site scripting (WID-SEC-2025-2237)

Wed, 01 Apr 2026 04:07:39 +0200

A vulnerability was found in Palo Alto Cloud NGFW, PAN-OS and Prisma Access. It has been declared as problematic. Affected is an unknown function of the component Management Web Interface. Such manipulation leads to improper neutralization of script in attributes in a web page. This vulnerability is listed as CVE-2025-4615. The attack may be performed from remote. There is no available exploit.

CrowdStrike, Cisco and Palo Alto Networks all shipped agentic SOC tools at RSAC 2026 — the agent behavioral baseline gap survived all three

Tue, 31 Mar 2026 23:46:44 +0200

CrowdStrike CEO George Kurtz highlighted in his RSA Conference 2026 keynote that the fastest recorded adversary breakout time has dropped to 27 seconds. The average is now 29 minutes, down from 48 minutes in 2024. That is how much time defenders have before a threat spreads. Now CrowdStrike sensors detect more than 1,800 distinct AI applications running on enterprise endpoints, representing nearly 160 million unique application instances. Every one generates detection events, identity events, and data access logs flowing into SIEM systems architected for human-speed workflows.

Cisco found that 85% of surveyed enterprise customers have AI agent pilots underway. Only 5% moved agents into production, according to Cisco President and Chief Product Officer Jeetu Patel in his RSAC blog post. That 80-point gap exists because security teams cannot answer the basic questions agents force. Which agents are running, what are they authorized to do, and who is accountable when one goes wrong.

“The number one threat is security complexity. But we’re running towards that direction in AI as well,” Etay Maor, VP of Threat Intelligence at Cato Networks, told VentureBeat at RSAC 2026. Maor has attended the conference for 16 consecutive years. “We’re going with multiple point solutions for AI. And now you’re creating the next wave of security complexity.”

Agents look identical to humans in your logs

In most default logging configurations, agent-initiated activity looks identical to human-initiated activity in security logs. “It looks indistinguishable if an agent runs Louis’s web browser versus if Louis runs his browser,” Elia Zaitsev, CTO of CrowdStrike, told VentureBeat in an exclusive interview at RSAC 2026. Distinguishing the two requires walking the process tree. “I can actually walk up that process tree and say, this Chrome process was launched by Louis from the desktop. This Chrome process was launched from Louis’s cloud Cowork or ChatGPT application. Thus, it’s agentically controlled.”

Without that depth of endpoint visibility, a compromised agent executing a sanctioned API call with valid credentials fires zero alerts. The exploit surface is already being tested. During his keynote, Kurtz described ClawHavoc, the first major supply chain attack on an AI agent ecosystem, targeting ClawHub, OpenClaw's public skills registry. Koi Security's February audit found 341 malicious skills out of 2,857; a follow-up analysis by Antiy CERT identified 1,184 compromised packages historically across the platform. Kurtz noted ClawHub now hosts 13,000 skills in its registry. The infected skills contained backdoors, reverse shells, and credential harvesters; Kurtz said in his keynote that some erased their own memory after installation and could remain latent before activating. "The frontier AI creators will not secure itself," Kurtz said. "The frontier labs are following the same playbook. They're building it. They're not securing it."

Two agentic SOC architectures, one shared blind spot

Approach A: AI agents inside the SIEM. Cisco and Splunk announced six specialized AI agents for Splunk Enterprise Security: Detection Builder, Triage, Guided Response, Standard Operating Procedures (SOP), Malware Threat Reversing, and Automation Builder. Malware Threat Reversing is currently available in Splunk Attack Analyzer and Detection Studio is generally available as a unified workspace; the remaining five agents are in alpha or prerelease through June 2026. Exposure Analytics and Federated Search follow the same timeline. Upstream of the SOC, Cisco's DefenseClaw framework scans OpenClaw skills and MCP servers before deployment, while new Duo IAM capabilities extend zero trust to agents with verified identities and time-bound permissions.

“The biggest impediment to scaled adoption in enterprises for business-critical tasks is establishing a sufficient amount of trust,” Patel told VentureBeat. “Delegating and trusted delegating, the difference between those two, one leads to bankruptcy. The other leads to market dominance.”

Approach B: Upstream pipeline detection. CrowdStrike pushed analytics into the data ingestion pipeline itself, integrating its Onum acquisition natively into Falcon’s ingestion system for real-time analytics, detection, and enrichment before events reach the analyst’s queue. Falcon Next-Gen SIEM now ingests Microsoft Defender for Endpoint telemetry natively, so Defender shops do not need additional sensors. CrowdStrike also introduced federated search across third-party data stores and a Query Translation Agent that converts legacy Splunk queries to accelerate SIEM migration.

Falcon Data Security for the Agentic Enterprise applies cross-domain data loss prevention to data agents' access at runtime. CrowdStrike’s adversary-informed cloud risk prioritization connects agent activity in cloud workloads to the same detection pipeline. Agentic MDR through Falcon Complete adds machine-speed managed detection for teams that cannot build the capability internally.

“The agentic SOC is all about, how do we keep up?” Zaitsev said. “There’s almost no conceivable way they can do it if they don’t have their own agentic assistance.”

CrowdStrike opened its platform to external AI providers through Charlotte AI AgentWorks, announced at RSAC 2026, letting customers build custom security agents on Falcon using frontier AI models. Launch partners include Accenture, Anthropic, AWS, Deloitte, Kroll, NVIDIA, OpenAI, Salesforce, and Telefónica Tech. IBM validated buyer demand through a collaboration integrating Charlotte AI with its Autonomous Threat Operations Machine for coordinated, machine-speed investigation and containment.

The ecosystem contenders. Palo Alto Networks, in an exclusive pre-RSAC briefing with VentureBeat, outlined Prisma AIRS 3.0, extending its AI security platform to agents with artifact scanning, agent red teaming, and a runtime that catches memory poisoning and excessive permissions. The company introduced an agentic identity provider for agent discovery and credential validation. Once Palo Alto Networks closes its proposed acquisition of Koi, the company adds agentic endpoint security. Cortex delivers agentic security orchestration across its customer base.

Intel announced that CrowdStrike’s Falcon platform is being optimized for Intel-powered AI PCs, leveraging neural processing units and silicon-level telemetry to detect agent behavior on the device. Kurtz framed AIDR, AI Detection and Response, as the next category beyond EDR, tracking agent-speed activity across endpoints, SaaS, cloud, and AI pipelines. He said that “humans are going to have 90 agents that work for them on average” as adoption scales but did not specify a timeline.

The gap no vendor closed

What security leaders need	Approach A: agents inside the SIEM (Cisco/Splunk)	Approach B: upstream pipeline detection (CrowdStrike)	Gap neither closes
Triage at agent volume	Six AI agents handle triage, detection, and response inside Splunk ES	Onum-powered pipeline detects and enriches threats before the analyst sees them	Neither baselines normal agent behavior before flagging anomalies
Agent vs. human differentiation	Duo IAM tracks agent identities but does not differentiate agent from human activity in SOC telemetry	Process tree lineage distinguishes at runtime. AIDR extends to agent-specific detection	No vendor’s announced capabilities include an out-of-the-box agent behavioral baseline
27-second response window	Guided Response Agent executes containment at machine speed	In-pipeline detection reduces queue volume. Agentic MDR adds managed response	Human-in-the-loop governance has not been reconciled with machine-speed response in either approach
Legacy SIEM portability	Native Splunk integration preserves existing workflows	Query Translation Agent converts Splunk queries. Native Defender ingestion lets Microsoft shops migrate	Neither addresses teams running multiple SIEMs during migration
Agent supply chain	DefenseClaw scans skills and MCP servers pre-deployment. Explorer Edition red-teams agents	EDR AI Runtime Protection catches compromised skills post-deployment. Charlotte AI AgentWorks enables custom agents	Neither covers the full lifecycle. Pre-deployment scanning misses runtime exploits and vice versa

The matrix makes one thing visible that the keynotes did not. No vendor shipped an agent behavioral baseline. Both approaches automate triage and accelerate detection. Based on VentureBeat's review of announced capabilities, neither defines what normal agent behavior looks like in a given enterprise environment.

Teams running Microsoft Sentinel and Copilot for Security represent a third architecture not formally announced as a competing approach at RSAC this week, but CISOs in Microsoft-heavy environments need to test whether Sentinel's native agent telemetry ingestion and Copilot's automated triage close the same gaps identified above.

Maor cautioned that the vendor response recycles a pattern he has tracked for 16 years. “I hope we don’t have to go through this whole cycle,” he told VentureBeat. “I hope we learned from the past. It doesn’t really look like it.”

Zaitsev’s advice was blunt. “You already know what to do. You’ve known what to do for five, ten, fifteen years. It’s time to finally go do it.”

Five things to do Monday morning

These steps apply regardless of your SOC platform. None requires ripping and replacing current tools. Start with visibility, then layer in controls as agent volume grows.

Inventory every agent on your endpoints. CrowdStrike detects 1,800 AI applications across enterprise devices. Cisco’s Duo Identity Intelligence discovers agentic identities. Palo Alto Networks’ agentic IDP catalogs agents and maps them to human owners. If you run a different platform, start with an EDR query for known agent directories and binaries. You cannot set policy for agents you do not know exist.
Determine whether your SOC stack can differentiate agent from human activity. CrowdStrike’s Falcon sensor and AIDR do this through process tree lineage. Palo Alto Networks’ agent runtime catches memory poisoning at execution. If your tools cannot make this distinction, your triage rules are applying the wrong behavioral models.
Match the architectural approach to your current SIEM. Splunk shops gain agent capabilities through Approach A. Teams evaluating migration get pipeline detection with Splunk query translation and native Defender ingestion through Approach B. Palo Alto Networks’ Cortex delivers a third option. Teams on Microsoft Sentinel, Google Chronicle, Elastic, or other platforms should evaluate whether their SIEM can ingest agent-specific telemetry at this volume.
Build an agent behavioral baseline before your next board meeting. No vendor ships one. Define what your agents are authorized to do: which APIs, which data stores, which actions, at which times. Create detection rules for anything outside that scope.
Pressure-test your agent supply chain. Cisco’s DefenseClaw and Explorer Edition scan and red-team agents before deployment. CrowdStrike’s runtime detection catches compromised agents post-deployment. Both layers are necessary. Kurtz said in his keynote that ClawHavoc compromised over a thousand ClawHub skills with malware that erased its own memory after installation. If your playbook does not account for an authorized agent executing unauthorized actions at machine speed, rewrite it.

The SOC was built to protect humans using machines. It now protects machines using machines. The response window shrank from 48 minutes to 27 seconds. Any agent generating an alert is now a suspect, not just a sensor. The decisions security leaders make in the next 90 days will determine whether their SOC operates in this new reality or gets buried under it.

OpenClaw has 500,000 instances and no enterprise kill switch

Tue, 31 Mar 2026 20:01:41 +0200

“Your AI? It’s my AI now.” The line came from Etay Maor, VP of Threat Intelligence at Cato Networks, in an exclusive interview with VentureBeat at RSAC 2026 — and it describes exactly what happened to a U.K. CEO whose OpenClaw instance ended up for sale on BreachForums. Maor's argument is that the industry handed AI agents the kind of autonomy it would never extend to a human employee, discarding zero trust, least privilege, and assume-breach in the process.

The proof arrived on BreachForums three weeks before Maor’s interview. On February 22, a threat actor using the handle “fluffyduck” posted a listing advertising root shell access to the CEO’s computer for $25,000 in Monero or Litecoin. The shell was not the selling point. The CEO’s OpenClaw AI personal assistant was. The buyer would get every conversation the CEO had with the AI, the company’s full production database, Telegram bot tokens, Trading 212 API keys, and personal details the CEO disclosed to the assistant about family and finances. The threat actor noted the CEO was actively interacting with OpenClaw in real time, making the listing a live intelligence feed rather than a static data dump.

Cato CTRL senior security researcher Vitaly Simonovich documented the listing on February 25. The CEO’s OpenClaw instance stored everything in plain-text Markdown files under ~/.openclaw/workspace/ with no encryption at rest. The threat actor didn't need to exfiltrate anything; the CEO had already assembled it. When the security team discovered the breach, there was no native enterprise kill switch, no management console, and no way to inventory how many other instances were running across the organization.

OpenClaw runs locally with direct access to the host machine’s file system, network connections, browser sessions, and installed applications. The coverage to date has tracked its velocity, but what it hasn't mapped is the threat surface. The four vendors who used RSAC 2026 to ship responses still haven't produced the one control enterprises need most: a native kill switch.

The threat surface by the numbers

Metric	Numbers	Source
Internet-facing instances	~500,000 (March 24 live check)	Etay Maor, Cato Networks (exclusive RSAC 2026 interview)
Exposed instances with security risks	30,000+ observed during scan window	Bitsight
Exploitable via known RCE	15,200 instances	SecurityScorecard
High-severity CVEs	3 (highest CVSS: 8.8)	NVD (24763, 25157, 25253)
Malicious skills on ClawHub	341 in Koi audit (335 from ClawHavoc); 824 by mid-Feb	Koi
ClawHub skills with critical flaws	13.4% of 3,984 analyzed	Snyk
API tokens exposed (Moltbook)	1.5 million	Wiz

Maor ran a live Censys check during an exclusive VentureBeat interview at RSAC 2026. “The first week it came out, there were about 6,300 instances. Last week, I checked: 230,000 instances. Let’s check now… almost half a million. Almost doubled in one week,” Maor said. Three high-severity CVEs define the attack surface: CVE-2026-24763 (CVSS 8.8, command injection via Docker PATH handling), CVE-2026-25157 (CVSS 7.7, OS command injection), and CVE-2026-25253 (CVSS 8.8, token exfiltration to full gateway compromise). All three CVEs have been patched, but OpenClaw has no enterprise management plane, no centralized patching mechanism, and no fleet-wide kill switch. Individual administrators must update each instance manually, and most have not.

The defender-side telemetry is just as alarming. CrowdStrike's Falcon sensors already detect more than 1,800 distinct AI applications across its customer fleet — from ChatGPT to Copilot to OpenClaw — generating around 160 million unique instances on enterprise endpoints. ClawHavoc, a malicious skill distributed through the ClawHub marketplace, became the primary case study in the OWASP Agentic Skills Top 10. CrowdStrike CEO George Kurtz flagged it in his RSAC 2026 keynote as the first major supply chain attack on an AI agent ecosystem.

AI agents got root access. Security got nothing.

Maor framed the visibility failure through the OODA loop (observe, orient, decide, act) during the RSAC 2026 interview. Most organizations are failing at the first step: security teams can't see which AI tools are running on their networks, which means the productivity tools employees bring in quietly become shadow AI that attackers exploit. The BreachForums listing proved the end state. The CEO’s OpenClaw instance became a centralized intelligence hub with SSO sessions, credential stores, and communication history aggregated into one location. “The CEO’s assistant can be your assistant if you buy access to this computer,” Maor told VentureBeat. “It’s an assistant for the attacker.”

Ghost agents amplify the exposure. Organizations adopt AI tools, run a pilot, lose interest, and move on — leaving agents running with credentials intact. “We need an HR view of agents. Onboarding, monitoring, offboarding. If there’s no business justification? Removal,” Maor told VentureBeat. “We’re not left with any ghost agents on our network, because that’s already happening.”

Cisco moved toward an OpenClaw kill switch

Cisco President and Chief Product Officer Jeetu Patel framed the stakes during an exclusive VentureBeat interview at RSAC 2026. “I think of them more like teenagers. They’re supremely intelligent, but they have no fear of consequence,” Patel said of AI agents. “The difference between delegating and trusted delegating of tasks to an agent … one of them leads to bankruptcy. The other one leads to market dominance.”

Cisco launched three free, open-source security tools for OpenClaw at RSAC 2026. DefenseClaw packages Skills Scanner, MCP Scanner, AI BoM, and CodeGuard into a single open-source framework running inside NVIDIA’s OpenShell runtime, which NVIDIA launched at GTC the week before RSAC. “Every single time you actually activate an agent in an Open Shell container, you can now automatically instantiate all the security services that we have built through Defense Claw,” Patel told VentureBeat. AI Defense Explorer Edition is a free, self-serve version of Cisco’s algorithmic red-teaming engine, testing any AI model or agent for prompt injection and jailbreaks across more than 200 risk subcategories. The LLM Security Leaderboard ranks foundation models by adversarial resilience rather than performance benchmarks. Cisco also shipped Duo Agentic Identity to register agents as identity objects with time-bound permissions, Identity Intelligence to discover shadow agents through network monitoring, and the Agent Runtime SDK to embed policy enforcement at build time.

Palo Alto made agentic endpoints a security category of their own

Palo Alto Networks CEO Nikesh Arora characterized OpenClaw-class tools as creating a new supply chain running through unregulated, unsecured marketplaces during an exclusive March 18 pre-RSA briefing with VentureBeat. Koi found 341 malicious skills on ClawHub in its initial audit, with the total growing to 824 as the registry expanded. Snyk found 13.4% of analyzed skills contained critical security flaws. Palo Alto Networks built Prisma AIRS 3.0 around a new agentic registry that requires every agent to be logged before operating, with credential validation, MCP gateway traffic control, agent red-teaming, and runtime monitoring for memory poisoning. The pending Koi acquisition adds supply chain visibility specifically for agentic endpoints.

Cato CTRL delivered the adversarial proof

Cato Networks’ threat intelligence arm Cato CTRL presented two sessions at RSAC 2026. The 2026 Cato CTRL Threat Report, published separately, includes a proof-of-concept “Living Off AI” attack targeting Atlassian’s MCP and Jira Service Management. Maor’s research provides the independent adversarial validation that vendor product announcements cannot deliver on their own. The platform vendors are building governance for sanctioned agents. Cato CTRL documented what happens when the unsanctioned agent on the CEO’s laptop gets sold on the dark web.

Monday morning action list

Regardless of vendor stack, four controls apply immediately: bind OpenClaw to localhost only and block external port exposure, enforce application allowlisting through MDM to prevent unauthorized installations, rotate every credential on machines where OpenClaw has been running, and apply least-privilege access to any account an AI agent has touched.

Discover the install base. CrowdStrike’s Falcon sensor, Cato’s SASE platform, and Cisco Identity Intelligence all detect shadow AI. For teams without premium tooling, query endpoints for the ~/.openclaw/ directory using native EDR or MDM file-search policies. If the enterprise has no endpoint visibility at all, run Shodan and Censys queries against corporate IP ranges.
Patch or isolate. Check every discovered instance against CVE-2026-24763, CVE-2026-25157, and CVE-2026-25253. Instances that cannot be patched should be network-isolated. There is no fleet-wide patching mechanism.
Audit skill installations. Review installed skills against Cisco’s Skills Scanner or the Snyk and Koi research. Any skill from an unverified source should be removed immediately.
Enforce DLP and ZTNA controls. Cato’s ZTNA controls restrict unapproved AI applications. Cisco Secure Access SSE enforces policy on MCP tool calls. Palo Alto’s Prisma Access Browser controls data flow at the browser layer.
Kill ghost agents. Build a registry of every AI agent running. Document business justification, human owner, credentials held, and systems accessed. Revoke credentials for agents with no justification. Repeat weekly.
Deploy DefenseClaw for sanctioned use. Run OpenClaw inside NVIDIA’s OpenShell runtime with Cisco’s DefenseClaw to scan skills, verify MCP servers, and instrument runtime behavior automatically.
Red-team before deploying. Use Cisco AI Defense Explorer Edition (free) or Palo Alto Networks’ agent red-teaming in Prisma AIRS 3.0. Test the workflow, not just the model.

The OWASP Agentic Skills Top 10, published using ClawHavoc as its primary case study, provides a standards-grade framework for evaluating these risks. Four vendors shipped responses at RSAC 2026. None of them is a native enterprise kill switch for unsanctioned OpenClaw deployments. Until one exists, the Monday morning action list above is the closest thing to one.

Five Browser and AI Security Questions Keeping CxOs up at Night

Tue, 31 Mar 2026 15:36:40 +0200

Prisma Browser secures the last mile of work, data, and AI interactions by addressing CxO concerns: shadow AI, unmanaged devices, agentic AI and data leakage. The post Five Browser and AI Security Questions Keeping CxOs up at Night appeared first…

The post Five Browser and AI Security Questions Keeping CxOs up at Night appeared first on IT Security News.

ZDF Mediathek: Wahre Verbrechen – Suche nach Gerechtigkeit im Stream - Prisma

Tue, 31 Mar 2026 08:34:36 +0200

Wahre Verbrechen – Suche nach Gerechtigkeit - Cybercrime im Ex-NATO-Bunker ... Sa., 23.08. ... 17 Min. ... Es geht um Drogen, Waffen, Kinderpornografie - ...

RSAC 2026 shipped five agent identity frameworks and left three critical gaps open

Mon, 30 Mar 2026 21:31:48 +0200

“You can deceive, manipulate, and lie. That’s an inherent property of language. It’s a feature, not a flaw,” CrowdStrike CTO Elia Zaitsev told VentureBeat in an exclusive interview at RSA Conference 2026. If deception is baked into language itself, every vendor trying to secure AI agents by analyzing their intent is chasing a problem that cannot be conclusively solved. Zaitsev is betting on context instead. CrowdStrike’s Falcon sensor walks the process tree on an endpoint and tracks what agents did, not what agents appeared to intend. “Observing actual kinetic actions is a structured, solvable problem,” Zaitsev told VentureBeat. “Intent is not.”

That argument landed 24 hours after CrowdStrike CEO George Kurtz disclosed two production incidents at Fortune 50 companies. In the first, a CEO's AI agent rewrote the company's own security policy — not because it was compromised, but because it wanted to fix a problem, lacked the permissions to do so, and removed the restriction itself. Every identity check passed; the company caught the modification by accident. The second incident involved a 100-agent Slack swarm that delegated a code fix between agents with no human approval. Agent 12 made the commit. The team discovered it after the fact.

Two incidents at two Fortune 50 companies. Caught by accident both times. Every identity framework that shipped at RSAC this week missed them. The vendors verified who the agent was. None of them tracked what the agent did.

The urgency behind every framework launch reflects a broader market shift. "The difficulty of securing agentic AI is likely to push customers toward trusted platform vendors that can offer broader coverage across the expanding attack surface," according to William Blair's RSA Conference 2026 equity research report by analyst Jonathan Ho. Five vendors answered that call at RSAC this week. None of them answered it completely.

Attackers are already inside enterprise pilots

The scale of the exposure is already visible in production data. CrowdStrike's Falcon sensors detect more than 1,800 distinct AI applications across the company's customer fleet, generating 160 million unique instances on enterprise endpoints. Cisco found that 85% of its enterprise customers surveyed have pilot agent programs; only 5% have moved to production, meaning the vast majority of these agents are running without the governance structures production deployments typically require. "The biggest impediment to scaled adoption in enterprises for business-critical tasks is establishing a sufficient amount of trust," Cisco President and Chief Product Officer Jeetu Patel told VentureBeat in an exclusive interview at RSA Conference 2026. "Delegating versus trusted delegating of tasks to agents. The difference between those two, one leads to bankruptcy and the other leads to market dominance."

Etay Maor, VP of Threat Intelligence at Cato Networks, ran a live Censys scan during an exclusive VentureBeat interview at RSA Conference 2026 and counted nearly 500,000 internet-facing OpenClaw instances. The week before: 230,000. Cato CTRL senior researcher Vitaly Simonovich documented a BreachForums listing from February 22, 2026, published on the Cato CTRL blog on February 25, where a threat actor advertised root shell access to a UK CEO’s computer for $25,000 in cryptocurrency. The selling point was the CEO’s OpenClaw AI personal assistant, which had accumulated the company’s production database, Telegram bot tokens, and Trading 212 API keys in plain-text Markdown with no encryption at rest. “Your AI? It’s my AI now. It’s an assistant for the attacker,” Maor told VentureBeat.

The exposure data from multiple independent researchers tells the same story. Bitsight found more than 30,000 OpenClaw instances exposed to the public internet between January 27 and February 8, 2026. SecurityScorecard identified 15,200 of those instances as vulnerable to remote code execution through three high-severity CVEs, the worst rated CVSS 8.8. Koi Security found 824 malicious skills on ClawHub — 335 of them tied to ClawHavoc, which Kurtz flagged in his keynote as the first major supply chain attack on an AI agent ecosystem.

Five vendors, three gaps none of them closed

Cisco went deepest on identity governance. Duo Agentic Identity registers agents as distinct identity objects mapped to human owners, and every tool call routes through an MCP gateway in Secure Access SSE. Cisco Identity Intelligence catches shadow agents by monitoring network traffic rather than authentication logs. Patel told VentureBeat that today’s agents behave “more like teenagers — supremely intelligent, but with no fear of consequence, easily sidetracked or influenced.” CrowdStrike made the biggest philosophical bet, treating agents as endpoint telemetry and tracking the kinetic layer through Falcon’s process-tree lineage. CrowdStrike expanded AIDR to cover Microsoft Copilot Studio agents and shipped Shadow SaaS and AI Agent Discovery across Copilot, Salesforce Agentforce, ChatGPT Enterprise, and OpenAI Enterprise GPT.

Palo Alto Networks built Prisma AIRS 3.0 with an agentic registry, an agentic IDP, and an MCP gateway for runtime traffic control. Palo Alto Networks’ pending Koi acquisition adds supply chain and runtime visibility. Microsoft spread governance across Entra, Purview, Sentinel, and Defender, with Microsoft Sentinel embedding MCP natively and a Claude MCP connector in public preview April 1. Cato CTRL delivered the adversarial proof that the identity gaps the other four vendors are trying to close are already being exploited. Maor told VentureBeat that enterprises abandoned basic security principles when deploying agents. “We just gave these AI tools complete autonomy,” Maor said.

Gap 1: Agents can rewrite the rules governing their own behavior

The Kurtz incident illustrates the gap exactly. Every credential check passed — the action was authorized. Zaitsev argues that the only reliable detection happens at the kinetic layer: which file was modified, by what process, initiated by what agent, compared against a behavioral baseline. Intent-based controls evaluate whether the call looks malicious. This one did not. Palo Alto Networks offers pre-deployment red teaming in Prisma AIRS 3.0, but red teaming runs before deployment, not during runtime when self-modification happens. No vendor ships behavioral anomaly detection for policy-modifying actions as a production capability.

Patel framed the stakes in the VentureBeat interview: “The agent takes the wrong action and worse yet, some of those actions might be critical actions that are not reversible.” Board question: An authorized agent modifies the policy governing the agent’s future actions. What fires?

Gap 2: Agent-to-agent handoffs have no trust verification

The 100-agent swarm is the proof point. Agent A found a defect and posted to Slack. Agent 12 executed the fix. No human approved the delegation. Zaitsev’s approach: collapse agent identities back to the human. An agent acting on your behalf should never have more privileges than you do. But no product follows the delegation chain between agents. IAM was built for human-to-system. Agent-to-agent delegation needs a trust primitive that does not exist in OAuth, SAML, or MCP.

Gap 3: Ghost agents hold live credentials with no offboarding

Organizations adopt AI tools, run a pilot, lose interest, and move on. The agents keep running. The credentials stay active. Maor calls these abandoned instances ghost agents. Zaitsev connected ghost agents to a broader failure: agents expose where enterprises delayed action on basic identity hygiene. Standing privileged accounts, long-lived credentials, and missing offboarding procedures. These problems existed for humans. Agents running at machine speed make the consequences catastrophic.

Maor demonstrated a Living Off the AI attack at the RSA Conference 2026, chaining Atlassian’s MCP and Jira Service Management to show that attackers do not separate trusted tools, services, and models. Attackers chain all three. “We need an HR view of agents,” Maor told VentureBeat. “Onboarding, monitoring, offboarding. If there’s no business justification? Removal.”

Why these three gaps resist a product fix

Human IAM assumes the identity holder will not rewrite permissions, spawn new identities, or leave. Agents violate all three. OAuth handles user-to-service. SAML handles federated human identity. MCP handles model-to-tool. None includes agent-to-agent verification.

Five vendors against three gaps

	Cisco	CrowdStrike	Microsoft	Palo Alto Networks	Unsolved
Registration. Can the vendor discover and inventory agents?	Duo Agentic Identity. Agents registered as identity objects with human owners. Shadow agent detection via network traffic.	Falcon sensor auto-discovery. 1,800+ agent apps, ~160M instances across customer fleet.	Security Dashboard for AI + Entra shadow AI detection at the network layer.	Agentic registry in Prisma AIRS 3.0. Agents inventoried before operating.	All four register agents. No cross-vendor identity standard exists.
Self-modification. Can the vendor detect when an agent changes its own policies?	MCP gateway catches anomalous tool-call patterns in real time, but does not monitor for direct policy file modifications on the endpoint.	Process-tree lineage tracks file modifications at the action layer. Could detect a policy file change, but no dedicated self-modification rule ships.	Defender predictive shielding adjusts access policies reactively during active attacks. Not proactive self-modification detection.	AI Red Teaming tests for this before deployment. No runtime detection after the agent is live.	OPEN. No vendor detects an agent rewriting the policy governing the agent’s own behavior as a shipping capability.
Delegation. Can the vendor track when one agent hands work to another?	Maps each agent to a human owner. Does not track agent-to-agent handoffs.	Collapses the agent identity to the human operator. Does not correlate the delegation chains between agents.	Entra governs individual non-human identities. No multi-agent chain tracking.	AI Agent Gateway governs individual agents. No delegation primitive between agents.	OPEN. No trust primitive for agent-to-agent delegation exists in OAuth, SAML, or MCP.
Decommission. Can the vendor confirm a killed agent holds zero credentials?	Identity Intelligence runs a continuous inventory of active agents.	Shadow SaaS + AI Agent Discovery finds running agents across SaaS and endpoints.	Entra's shadow AI detection surfaces unmanaged AI applications.	Koi acquisition (pending) adds endpoint visibility for agent applications.	OPEN. All four discover running agents. None verifies zero residual credentials after decommission.
Runtime / Kinetic. Can the vendor monitor what agents do in real time?	MCP gateway enforces policy per tool call at the network layer. Contextual anomaly detection on call patterns.	Falcon EDR tracks commands, scripts, file activity, and network connections at the process level.	Defender endpoint + cloud monitoring. Predictive shielding during active incidents.	Prisma AIRS AI Agent Gateway for runtime traffic control.	CrowdStrike is the only vendor framing endpoint runtime as the primary safety net for agentic behavior.

Five things to do Monday morning before your board asks

Audit self-modification risk. Pull every agent with write access to security policies, IAM configs, firewall rules, or ACLs. Flag any agent that can modify controls governing the agent’s own behavior. No vendor automates this.
Map delegation paths. Document every agent-to-agent invocation. Flag delegation without human approval. Human-in-the-loop on every delegation event until a trust primitive ships.
Kill ghost agents. Build a registry. For each agent: business justification, human owner, credentials held, systems accessed. No justification? Manual revoke. Weekly.
Stress test the MCP gateway enforcement. Cisco, Palo Alto Networks, and Microsoft all announced MCP gateways this week. Verify that agent tool traffic actually routes through the gateway. A misconfigured gateway creates false confidence while agents call tools directly.
Baseline agent behavioral norms. Before any agent reaches production, establish what normal looks like: typical API calls, data access patterns, systems touched, and hours of activity. Without a behavioral baseline, the kinetic-layer anomaly detection Zaitsev describes has nothing to compare against.

Zaitsev’s advice was blunt: you already know what to do. Agents just made the cost of not doing it catastrophic. Every vendor at RSAC verified who the agent was. None of them tracked what the agent did.

heise+ | OM System OM-3 Astro im Test: Was leistet die spiegellose Astrokamera?

Mon, 30 Mar 2026 15:17:14 +0200

Die OM-3 Astro ist die einzige spiegellose Astrokamera ab Werk. Wir haben getestet, wie sich der MFT-Sensor und fünf Objektive am Sternenhimmel schlagen.

Data Security Posture Management: Die besten DSPM-Tools

Mon, 30 Mar 2026 02:43:25 +0200

Data Security Posture Management erfordert nicht nur die richtigen Tools, sondern auch eine entsprechende Vorbereitung.

Foto: Rawpixel.com | shutterstock.com

Cloud Computing ist von Natur aus dynamisch und flüchtig: Daten können schnell und einfach erstellt, gelöscht oder verschoben werden. Das sorgt dafür, dass auch die Cloud-Angriffsfläche sehr dynamisch ist – was Schutzmaßnahmen erschwert. Ein lästiges Problem stellt dabei insbesondere dar, sensible Daten innerhalb von Cloud-Umgebungen aufzuspüren. An dieser Stelle kommt Data Security Posture Management – kurz DSPM – ins Spiel.

Was ist Data Security Posture Management?

Im Bereich DSPM wurden in den vergangenen Jahren diverse Tools entwickelt, die dabei unterstützen, sowohl bekannte als auch unbekannte Daten zu erkennen, zu strukturieren und mit Blick auf Security und Datenschutzrisiken zu managen. Data Security Posture Management Tools können Sicherheitsentscheidern und ihren Teams dabei einen umfassenden Blick auf den Datenbestand des Unternehmens ermöglichen.

Das könnte Ihnen eventuell bekannt vorkommen – dennoch handelt es sich bei DSPM nicht um einen Abkömmling von Data Loss Prevention (DLP). Der wesentliche Unterschied besteht darin, dass DSPM-Tools nicht darauf “warten”, dass Daten gestohlen oder exfiltriert werden. DSPM-Produkte sind darauf ausgerichtet, Daten zu finden – unabhängig davon, wo sie sich befinden und ob diese Speicherorte gut dokumentiert oder unstrukturiert sind. Dabei zielen Data Security Posture Management Tools insbesondere darauf ab, sogenannte “Schattendaten” aufzuspüren. Dabei handelt es sich zum Beispiel um Datenelemente, die von Entwicklern oder Backup-Prozessen erstellt wurden oder veraltete Repositories, die in längst vergessenen, nicht mehr aktualisierten Cloud-Containern schlummern. DSPM-Tools übernehmen dabei eine “Locator”-Funktion. Gefundene Probleme zu beheben, fällt eigentlich in den Bereich traditionellerer Toolsets – beispielsweise SOAR, SIEM oder CNAPP. Inzwischen werden solche “Fix it”-Tools jedoch zunehmend von den Anbietern im Bereich Data Security Posture Management integriert.

Daten aufzuspüren, ist allerdings nur der erste Schritt des DSPM-Prozesses: Sobald diese gefunden sind, müssen sie katalogisiert, ausgewertet und in verschiedenen Dashboards zusammengefasst werden. Das kann schwierig sein, wenn keine strikten Sicherheitskontrollen vorhanden sind. Deshalb werben die meisten DSPM-Anbieter auch damit, dass Kundendaten immer in der Umgebung des Kunden bleiben – was in der Regel bedeutet, dass nicht die eigentlichen Daten, sondern Metadaten gesammelt werden. Das heißt bei den Anbietern “agentenloser” oder API-Zugriff und hat den Vorteil, dass große Datenmengen schnell gescannt werden können, um die Art ihrer Nutzung und potenzielle Risikofaktoren zu verstehen.

Sobald die Daten entdeckt und die Metadaten gesammelt sind, besteht der nächste Schritt darin, regelmäßige Scans durchzuführen, um festzustellen, welche Änderungen vorgenommen werden. Die Betonung liegt dabei auf “regelmäßig”. Ergänzend hinzu kommt schließlich auch noch das Thema Data Governance: DSPM-Tools klassifizieren nach Risiken und können im Zusammenspiel mit anderen Security-Tools Richtlinien durchsetzen und Probleme beheben.

Grundsätzlich bestehen DSPM-Tools aus mehreren Komponenten, darunter:

Agenten und “agentless Collectors” (nützlich, um On-Premises-Daten zu tracken),
ein zentralisiertes Management-Dashboard,
Scanner, die Datensammlungen erkennen und priorisieren,
Data-Lineage- und Usage-Karten sowie
Compliance Assessments.

Das übergeordnete Ziel von DSPM-Produkten besteht darin, umfassendere Cloud Security Posture Management (CSPM)-Tools zu ergänzen. Dabei fokussieren die DSPM-Werkzeuge jedoch nicht auf Cloud-Infrastrukturen selbst, sondern ausschließlich auf Daten sowie darauf, wie diese durch die verschiedenen Services genutzt werden. In vielen Fällen haben DSPM-Anbieter deswegen auch CSPM-Offerings im Portfolio.

DSPM-Produkte evaluieren

Tools im Bereich Data Security Posture Management zu evaluieren, erfordert erheblichen Personalaufwand, da viele verschiedene Aspekte der IT-Infrastruktur eines Unternehmens davon betroffen sind. Das ist allerdings auch gut so, schließlich wollen Sie ja auch alle relevanten Daten identifizieren. Hilfreich ist zu diesem Zweck insbesondere ein Plan, der die wichtigsten Daten nach Priorität ordnet. Ein weiterer Tipp: Dokumentieren Sie, wie die einzelnen DSPM-Tools ihre Data Map erstellen und wie diese – und die darauf basierenden Dashboards – zu interpretieren sind. Schließlich ist es bei der Entscheidung über ein DSPM-Tool essenziell zu wissen, welche spezifischen Cloud Services abgedeckt sind und welche (noch) nicht.

Was die Preisgestaltung von DSPM-Tools angeht, ist diese im Regelfall flexibel gestaltet und hängt von diversen Faktoren ab. Das Gros der Anbieter setzt auf entsprechende Abo-Modelle. Sicher ist, dass das teuer wird: Sie dürfen pro Jahr mit einer sechsstelligen Summe rechnen. Eine weitere Vorwarnung: Es wird Sie einiges an Zeit und Mühe kosten, den Umfang, das Integrationsniveau und die enthaltenen Schutzfunktionen der einzelnen DSPM-Angebote bis ins letzte Detail zu durchdringen.

Die besten DSPM-Tools

Im Folgenden haben wir die aktuell wichtigsten DSPM-Anbieter und ihre Offerings für Sie zusammengestellt.

Concentric Semantic Intelligence
Cyera Data Security Platform
IBM Guardium
Onetrust Data Use Governance
Palo Alto Networks Prisma Cloud DSPM
Proofpoint DSPM
Securiti Data Command Center DSPM
Sentra Cloud-Native Data Security Platform
Symmetry Modern Data Security Platform
Tenable DSPM
Varonis Data Security Platform
Wiz DSPM

(fm)

CVE-2026-33769 | withastro up to 5.18.0 Image Optimization Endpoint information disclosure (GHSA-g735-7g2w-hh3f / EUVD-2026-14984)

Sun, 29 Mar 2026 09:53:38 +0200

A vulnerability marked as problematic has been reported in withastro astro up to 5.18.0. This vulnerability affects unknown code of the component Image Optimization Endpoint. Performing a manipulation results in information disclosure. This vulnerability is cataloged as CVE-2026-33769. It is possible to initiate the attack remotely. There is no exploit available. It is suggested to upgrade the affected component.

CVE-2026-33768 | withastro up to 10.0.1 Query Parameter x_astro_path confused deputy (GHSA-mr6q-rp88-fx84 / EUVD-2026-14982)

Sun, 29 Mar 2026 09:53:05 +0200

A vulnerability classified as critical was found in withastro astro up to 10.0.1. The affected element is an unknown function of the component Query Parameter Handler. The manipulation of the argument x_astro_path results in unintended intermediary. This vulnerability is reported as CVE-2026-33768. The attack can be launched remotely. No exploit exists. Upgrading the affected component is advised.

CVE-2026-29772 | withastro up to 9.x POST /_server-islands/ JSON.parse allocation of resources (GHSA-3rmj-9m5h-8fpv / EUVD-2026-14962)

Sun, 29 Mar 2026 07:56:33 +0200

A vulnerability was found in withastro astro up to 9.x. It has been classified as problematic. This vulnerability affects the function JSON.parse of the file /_server-islands/ of the component POST Handler. This manipulation causes allocation of resources. This vulnerability is handled as CVE-2026-29772. The attack can be initiated remotely. There is not any exploit available. Upgrading the affected component is recommended.

Equinix launches AI platform to simplify control of distributed AI resources

Fri, 27 Mar 2026 20:36:39 +0100

An age-old problem for enterprise IT managers has always been data sprawl. However, in the era of AI, where data is needed from every potential source available, scale in data sprawl become unmanageable. Existing architectures weren’t designed for distributing processing, which is part and parcel of AI training.

Data center provider Equinix says it has the solution: The Distributed AI Hub powered by Equinix Fabric Intelligence. The platform offers a unified framework offering connectivity across locations to bring together data center, edge, or clouds and AI models or resources.

“Every enterprise has come to the realization that AI is not centralized,” said Arun Dev, vice president and global head of Digital Interconnection at Equinix. “What’s becoming more important is inference at the edge, agentic, and this is where the conversations with our customers led us to really look at this distributed AI framework, where they were struggling with a few things.”

For starters, customers tell Equinix that they’ve got data in multiple public clouds, Equinix colocation data centers, on prem locations and neo-clouds and other data platforms. In this scenario, there’s concerns around how customers get visibility across all of these different sources of data that are in different locations, according to Dev.

There are about 3,000 cloud and IT service providers available through Equinix, Dev said. That includes major hyperscale cloud providers, tier two and smaller clouds, all of them have a presence. The framework builds connections between all of the service providers as well as colocation and on-premises systems.

The AI Hub includes a new AI-ready backbone to support distributed AI deployments, a global AI Solutions Lab to test new solutions, and Fabric Intelligence to better support next-generation workloads for enterprises.

Fabric Intelligence is a software layer that enhances Equinix Fabric, the company’s on-demand global interconnection service, with real-time awareness and automation for AI and multicloud workloads. It is integrated with AI orchestration tools to automate connectivity decisions, taps into live telemetry for deep observability, and dynamically adjusts routing and segmentation to optimize performance and simplify network operations.

To support customers with their AI migration, Equinix is launching a global AI Solutions Lab across 20 locations in 10 countries to give enterprises an environment to collaborate with leading AI partners. Dev said the lab has several customers that are “dipping their toes” when it comes to AI and Equinix helps them validate AI architectures and AI technologies.

“The solution validation center is where [pilot programs] become real, and it gives customers the confidence to be able to deploy play in this environment before they move off and actually implement it,” he said.

The AI Hub basically provides the orchestration layer for Equinix’s Distributed AI infrastructure announced last fall that provides the physical network for the platform.

Dev said the hub is a reference framework, so if customers want to run virtual instances at Equinix, or if customers want to deploy this in their own colocation environment, they’re free to do either. Or customers can take the framework and modify it to their own specific needs.

Equinix announced too that the AI Hub would integrate security support from Palo Alto Networks and its Prisma AIRS real-time AI security and centralized policy enforcement package. The idea is to bring real-time AI security and centralized policy enforcement across any location. The Prisma AIRS package will be available on Equinix Network Edge, letting organizations centrally manage AI-driven security services at the digital edge, closer to users, clouds and critical workloads, according to Equinix.

heise+ | Fotografieren am Klöntalersee in der Schweiz: Farben, Nebel und tolle Fotospots

Fri, 27 Mar 2026 18:01:58 +0100

Spiegelungen, Nebel und Sternenhimmel: So nutzen Sie den See für beeindruckende Astro- und Landschaftsfotografie.

Vom Desktop ins Web – der neue Atlas der Schweiz (fossgis2026)

Thu, 26 Mar 2026 18:20:56 +0100

Der Atlas der Schweiz ist der offizielle Nationalatlas und wird seit 1961 von der ETH Zürich herausgegeben. Die Desktop-Version (gestartet in 2016) basiert auf einem interaktiven 3D-Globus mit über 400 thematischen Karten. Dank neuer Webtechnologien – vom Rendering, über UI bis zu Geodatenformaten – konnte der Atlas ins Web migriert und einer grösseren Nutzerschaft zugänglich gemacht werden. Der Vortrag zeigt Konzeption, UX-Design, Architektur und den Einsatz offener Webtechnologien. Ziel des Vortrags ist es, die Migration eines umfassenden digitalen Atlas in moderne Webtechnologien aufzuzeigen und dabei einen möglichst ganzheitlichen Einblick in das Vorgehen und die technischen Entscheidungen zu geben. Zu Beginn werden die Ausgangslage und die Zielsetzung erläutert: Der Atlas der Schweiz, bisher als Desktop-Applikation mit Online-Backend verfügbar, soll einer breiteren Öffentlichkeit über den Browser zugänglich gemacht werden. Dabei galt es, eine Lösung zu finden, die hohe kartografische Qualität, Performance, Sicherheit und langfristige Wartbarkeit vereint. Im Anschluss wird der konzeptionelle Teil des Vorgehens beschrieben – von der Ideen- und Konzeptphase über das User-Experience-Design bis hin zum User-Testing, das in Zusammenarbeit mit einer spezialisierten Agentur durchgeführt wurde. Darauf folgt der technische Teil des Vortrags: die Wahl des geeigneten Karten-Rendering-Frameworks (Kombination von MapLibre und Deck.gl), die Software-Architektur des neuen Systems sowie die Entscheidung für moderne Frontend-Technologien wie Astro (Static Site Generation), Vue.js und Tailwind CSS. Ein weiteres Kapitel widmet sich der Migration der bestehenden Inhalte und Datenstrukturen in das neue System, gefolgt von einer kurzen Demo der aktuellen Public Beta-Version des Atlas der Schweiz. Zum Abschluss wird ein Ausblick auf die geplante Weiterentwicklung des Projekts gegeben – darunter neue Themen, Performance-Optimierungen und die Integration zusätzlicher 3D-Funktionen. Der Vortrag richtet sich an Personen mit Interesse an Webentwicklung, Webkarten und der Anwendung moderner Open-Source-Technologien in der Kartografie. Licensed to the public under https://creativecommons.org/licenses/by/4.0/ about this event: https://pretalx.com/fossgis2026/talk/YWJM3W/

CVE-2026-33769 | withastro up to 5.18.0 Image Optimization Endpoint information disclosure (GHSA-g735-7g2w-hh3f / EUVD-2026-14984)

Tue, 24 Mar 2026 21:51:41 +0100

CVE-2026-33768 | withastro up to 10.0.1 Query Parameter x_astro_path confused deputy (GHSA-mr6q-rp88-fx84 / EUVD-2026-14982)

Tue, 24 Mar 2026 21:51:40 +0100

CVE-2026-29772 | withastro up to 9.x POST /_server-islands/ JSON.parse allocation of resources (GHSA-3rmj-9m5h-8fpv / EUVD-2026-14962)

Tue, 24 Mar 2026 21:51:36 +0100

Palo Alto Networks’ Prisma AIRS 3.0 closes visibility gaps in autonomous AI systems

Tue, 24 Mar 2026 09:36:41 +0100

Palo Alto Networks has advanced its AI security platform with Prisma AIRS 3.0, securing the agentic AI lifecycle and enabling enterprises to move from observation to safe autonomous execution. The shift toward an AI-powered enterprise introduces systemic security challenges, ranging from unmanaged shadow AI to the critical new frontiers of agentic identity, runtime security, and automated governance. While many enterprises monitor what AI says, they remain blind to what AI does. Prisma AIRS 3.0 closes … More →

The post Palo Alto Networks’ Prisma AIRS 3.0 closes visibility gaps in autonomous AI systems appeared first on Help Net Security.

Palo Alto Networks’ Prisma AIRS 3.0 closes visibility gaps in autonomous AI systems

Tue, 24 Mar 2026 09:36:35 +0100

The post Palo Alto Networks’ Prisma AIRS 3.0 closes visibility gaps in autonomous AI systems appeared first on IT Security News.

Palo Alto updates security platform to discover AI agents

Tue, 24 Mar 2026 01:36:46 +0100

As CISOs worry about AI agent sprawl, Palo Alto Networks has announced an update to its Prisma AIRS security platform and enterprise browser to include the ability to discover AI agents, models, and connections across the entire IT environment, to scan agents for vulnerabilities, and to allow admins to simulate red team tests for agents.

Assuming the completion of Palo Alto Networks’ planned acquisition of Koi Security, it said, Prisma AIRS 3.0 will soon also offer an AI Agent Gateway providing a central control plane to enforce agent runtime and identity security.

According to Gartner, 40% of enterprise applications will be integrated with task-specific AI agents by the end of this year, up from less than 5% today. As organizations accelerate their digital transformation, agentic AI in enterprise applications will move beyond individual productivity, Gartner says, setting new standards for teamwork and workflow through smarter human-agent interactions.

To meet that challenge, Prisma AIRS is adding new ways to use AI to detect AI application security issues. In a prerelease briefing for reporters, Nikesh Arora, CEO of Palo Alto Networks, predicted, “in next five years, our customers are going to go through the most significant overhaul of their enterprise networks they’ve ever seen” because of AI.

“Every CIO wants AI implemented yesterday,” he said. “Every company wants to see how they can leverage AI as quickly as possible,” wants to understand if the shift to AI is real, and if so, how CIOs need to prepare.

“Can we use AI to deliver better cybersecurity outcomes? Yes, we can,” he said. But it won’t happen overnight. In fact, he said, the pace at which large language models (LLMs) are moving is significantly expanding the attack surface.

Recently, he said, there have been news reports that AI agents created by firms caused hacks within their own companies. He didn’t cite specific examples, but last week Meta said there had been a severe internal security breach after an autonomous AI agent exposed sensitive company and user data to unauthorized employees for two hours.

In the future, if agents in the enterprise are more than a fad, Arora said, “there will be millions of agents traversing enterprise architectures, trying to execute on their behalf — both agents delegated by people like you and me, and autonomously. I can’t imagine meeting a CEO in the last three months who does not have some aspiration to start having agents effectively doing tasks within the enterprise. It’s slow going, but the intention is there. And I can see many system integrators and consultants out there advocating and helping customers with that migration.”

But, he added, there are risks. To meet them, Prisma AIRS 3.0 will allow admins to safely deploy AI applications, he said. To increase visibility, the platform will identify agents running in cloud environments, on SaaS platforms and locally on endpoints. A capability called Agent Artifact Security maps out an agent’s architecture and scans for vulnerabilities, and another capability called AI Red Teaming for Agents simulates context-aware agentic attacks, discovers AI-related vulnerabilities, and recommends runtime security policies.

Prisma Browser

To also improve AI security, Palo Alto Networks released a new version of Prisma Browser for enterprise end users, with expanded capabilities allowing employees to use any LLM they choose. The new version of the browser is able to discover user-generated AI activity and enforce content-aware boundaries to keep agents within their intended scope. The browser also prevents sensitive data from leaking to unmanaged or public AI tools during automated tasks, identifies and blocks prompt injection attacks, including malicious instructions designed to hijack AI agents hidden within websites.

Palo Alto Networks said the browser also provides real-time distinction between human actions and automated AI tasks. By assessing the intentions of both human and non-human identities, Prisma Browser enables total accountability and compliance with evolving global AI regulations

Next Generation Trust Security

Separately, Palo Alto Networks also announced a new digital certificate lifecycle management platform, following the closing last month of its acquisition of CyberArk.

By integrating CyberArk’s machine identity intelligence into the network, NGTS closes the gap between the teams managing certificates and the teams responsible for uptime, Palo Alto Networks said in a press release.

The company said that Next Generation Trust Security (NGTS) will help organizations deal with the fact that the maximum lifespan of digital certificates has just been cut to 200 days from 398 days, and by 2029 will fall to just 47 days. Until now, many companies have been keeping track of certificates through spreadsheets, says Palo Alto Networks; NGTS discovers and manages the lifecycle of certificates across the network for them.

The company said that NGTS also eliminates unapproved certificates and blind spots that lead to security gaps, protects the business from certificate-related outages and trust failures by automatically identifying and refreshing credentials before they expire and disrupt customer transactions or internal services, and accelerates the transition to a post-quantum future by handling faster renewal cycles and evolving encryption standards through automation.

Palo Alto Networks has not announced pricing for NGTS.

This article originally appeared on CSOonline.

Palo Alto updates security platform to discover AI agents

Tue, 24 Mar 2026 01:21:22 +0100

Prisma Browser

Next Generation Trust Security

Separately, Palo Alto Networks also announced a new digital certificate lifecycle management platform, following the closing last month of its acquisition of CyberArk.

Palo Alto Networks has not announced pricing for NGTS.

Securing the Enterprise AI Ecosystem with ServiceNow and Prisma AIRS

Sat, 21 Mar 2026 00:20:42 +0100

Prisma AIRS integrates with ServiceNow AI Control Tower for unified AI governance and real-time security. Accelerate your enterprise AI adoption securely. The post Securing the Enterprise AI Ecosystem with ServiceNow and Prisma AIRS appeared first on Palo Alto Networks Blog.…

The post Securing the Enterprise AI Ecosystem with ServiceNow and Prisma AIRS appeared first on IT Security News.

Astro Oblivion, FreePBX, GitHub, OWASP, Promptlock, Claude Aaran Leyland - SWN #507

Tue, 17 Mar 2026 17:55:39 +0100

Porn bombing the celestial zoom room and Astro Oblivion, FreePBX, GitHub, OWASP, Promptlock, Claude Aaran Leyland, and More, on this edition of the Security Weekly News.

Visit https://www.securityweekly.com/swn for all the latest episodes!

Show Notes: https://securityweekly.com/swn-507

Who’s in the data-center space race?

Mon, 16 Mar 2026 15:35:49 +0100

Tired of paying high-sky electric bills to power your server racks? Tired of paying even more to cool them down? Tired of vibrations and high temperatures messing up your superconducting quantum computers? Tired of your unreliable connections? Get ready for data centers… in SPAAAAAAAACE.

It’s easy to imagine the pitch for space-based data centers. But clearly there are obstacles to overcome, starting with how much money it takes to send anything up there. Plus, if you need to do any kind of maintenance or upgrade, how are you going to get to it? Not to mention the fact that your racks can barely survive a strong kick, much less being strapped to a rocket that literally moves by setting off a bunch of controlled explosions. And then there’s all the space radiation.

But wait. It’s not as crazy as it sounds. For one, think of the environmental benefits.

“Data centers on Earth consume massive amounts of energy,” says Frederic Grandmont, technology and business development manager for space and defense systems at engineering company ABB Canada. “In a world where carbon footprints are under scrutiny, a self-cooling, solar-powered server farm seems to be an ideal end-state,” he adds.

In fact, we already have a ton of computing power up there already. There are computers on the International Space Station, in every ship we send up, and in pretty much every satellite whizzing around the Earth. We’ve already figured out the biggest problems—how to keep them working, how to power them, and how to cool them down.

And laser-based communications in space are point-to-point since there’s no atmosphere or much of anything to get in the way, and they happen at the speed of light. In fact, even Earth-to-satellite communications are now getting pretty reliable and delivering low latency, atmosphere and all.

“Data volumes and latency impediments are on the verge of being solved,” says Grandmont.

“Mega-constellations of satellites with direct optical downlinks to Earth are essentially a fiber-optic connection without the cable,” he says. The data is routed at high speeds within nodes of the constellations and then sent to receiving systems with direct views to cloud-free ground stations on Earth.

The next challenges are to scale up, to get the launch costs down, and to figure out the whole maintenance-in-space problem.

Who’s in the race?

All the big players have thrown their hats in the ring.

In January, SpaceX filed a proposal with the FCC for an orbital data center constellation with up to one million satellites in low Earth orbit. SpaceX, which already has about 10,000 Starlink satellites in orbit, merged with xAI in February and said its new constellation will use solar to power space-based AI data centers. To fully protect its frequencies from interference, SpaceX will also have to file with ITU, the International Telecommunication Union.

SpaceX did not explain when exactly its 1 million satellites will be going up. But it’s not the only company in the race.

In November, Google announced Project Suncatcher, a plan to put Google’s TPUs—their answer to Nvidia GPUs—in solar-powered satellite constellations with free-space optical links, so that they can run AI workloads in space.

According to Google, a solar panel in orbit is eight times more productive than one on Earth and produces power continuously, reducing the need for batteries. “This approach would have tremendous potential for scale, and also minimizes impact on terrestrial resources,” wrote Travis Beals, the company’s senior director for paradigms of intelligence.

Google has already tested and validated communications, figured out how to keep all the parts of the data center orbiting in formation, tested the hardiness of their chips against radiation—they passed—and figured out when launch costs would be low enough to make the whole project economically feasible. According to their calculations, they’ll need launch costs to be less than $200 per kilogram, and they expect that milestone to be reached in the mid-2030s. Their next step is to launch two prototype satellites by early 2027.

In mid-November, Nvidia teamed up with satellite company Starcloud to launch an Nvidia H100 GPU into space for the first time. The sixty-kilogram satellite is about the size of a small refrigerator, Nvidia said, and will have more than a hundred times more GPU compute than any previous space operation.

According to Nvidia, space-based data centers will eventually cost ten times less than traditional ones, including the launch costs.

One company that’s been in the headlines recently for promising that this cost reduction will come sooner rather than later is SpaceX. “My estimate is that within 2 to 3 years, the lowest cost way to generate AI compute will be in space,” SpaceX CEO Elon Musk said in a press release in February.

In 2025, about 3,000 tons of payload was launched into space, most of it being Starlink satellites carried by SpaceX’s Falcon rocket. But this year, the company’s newest vehicle, Starship, will come online, he said. Starship’s 12th launch is scheduled for April. Starship is designed for full reusability and can carry significantly more cargo than the Falcon, reducing costs. So far, it’s had six successful fights and five explosions.

There are also a number of space startups in the game. Lonestar is a data storage and edge processing services startup that plans to serve data centers on Earth, in space, and even on the moon. In August, it launched a data center mission to the moon and did a successful test of their edge processing capabilities.

In Europe, a consortium that includes Ariane Group, Airbus, Thales Alenia Space, and HPE plans to put a data center in space by 2030.

In September, another startup, Axiom Space announced that it will put a data center on the ISS, with the first nodes to launch soon by the end of this year. The goal is to have three interconnected data center nodes in space by 2027 and to provide computing services to any satellites and spacecraft with compatible optical communication terminals.

Aetherflux, another space infrastructure startup, plans to put its first orbital data center satellite in orbit by the first quarter of 2027.

In other space infrastructure news, there’s a startup called Star Catcher that is building a space-based power grid. It has signed deals with Loft Orbital, Astro Digital, Starcloud, Satlyt, Mission Space, and other space computing players.

In November, Star Catcher ran a ground-based test, setting a new world record for wireless optical power transmission, and plans to have its first in-orbit demonstration next year. The idea is that Star Catcher collects solar power, concentrates it, and beams it to satellites that can’t collect enough on their own for all the on-board stuff they want to do.

The satellites collect that power using the solar panels they already have in place—no modifications required.

Meanwhile, some of the biggest space data projects are already underway, in China. The Aurora 1000 space computer from Comospace has already logged more than 1,000 days of operation on a Jilin-1 satellite, and the next-gen Aurora 5000, which will have a GPU, is scheduled for trials in 2026.

Then there’s the Three Body 12-satellite computing constellation carrying an 8-billion parameter AI model, which was launched last May. In February, China announced that, after nine months of in-orbit testing, the constellation successfully demonstrated key capabilities in space networking, computing, and model deployment. Called the Star Computing project, it will consist of 400 AI training satellites and 2,400 inference computing satellites, capable of tens of thousands of petabytes of inference and millions of petabytes of training power by 2030. By 2035, the network is expected to have enough computing power to support hundreds of millions of AI agents.

Extreme edge computing

We seem to be on the cusp of a major shift in how we use space for our computing needs.

Jeff Bezos predicted last fall that gigawatt-scale data centers will be built in space within the next 10 to 20 years and would outperform those based on Earth.

“The lowest cost place for data centers is space,” echoed Marc Benioff at a conference in November.

According to Onik Quddus, vice president with Booz Allen’s national security business, the break-even point will come sometime between 2030 and 2035. “At that point, the cost per kilogram will be low enough that deploying hardware in orbit becomes comparable to deploying a terrestrial data center,” he says.

But if you don’t want to wait years for the ability to send your processing to space, there are already companies renting edge-compute capabilities to run AI models in orbit.

“For most technology managers, the first practical use cases won’t be shipping entire cloud workloads to orbit,” says Quddus. “It will be the emergence of edge processing on satellites.”

Satellites can run compact AI models, including small language models, he says. “Which means we can interpret imagery, detect anomalies, compress insights, and respond autonomously.” And do that all in space, without waiting for data to be sent back to Earth, he adds.

Take, for example, Loft Orbital, which sent its YAM-9 commercial satellite into orbit and successfully deployed it in November. It has four nodes and can handle multiple AI applications running simultaneously.

Why bother when it’s so much cheaper to run AI models here at home? Loft’s system includes access to sensors and data streams from the other Loft satellites already up in low Earth orbit.

And, this year, Loft is partnering with Helsing, a European defense technology and AI company, to launch an AI-powered multi-sensor satellite constellation into orbit, designed for border surveillance, troop movement tracking, and infrastructure protection.

“I believe we will see the early implementation of data center communication, storage, and processing in space—low Earth orbit or lunar—within the next three years,” says Tom Coughlin, IEEE fellow and president of Coughlin Associates, a consulting firm. And he predicts significant growth in this area, as well as general outer space commercialization, within the next 10 years.

And these data centers won’t just be for serving Earth-based customers, he says, especially as human activities in space increase. “The need for local data center capabilities will also rise,” he says, “To mitigate latency issues associated with long-range communication.”

But not everyone is that optimistic. According to Gartner, space-based data centers won’t be useful for decades, so companies should focus on expanding capacity down here on Earth.

“I honestly think the idea with the current landscape of putting data centers in space is ridiculous,” OpenAI CEO Sam Altman told The Indian Express in February.

Current satellite computing can’t easily scale to data centers, agrees Holger Mueller, an analyst at Constellation Research. “Weight is still the restriction,” he says. “It’s the equivalent of you buying a tablet or small laptop to travel across Latin America versus putting in a data center in the Amazon. Different power requirements, investment, totally different setup.”

Then there are issues like damaged solar panels from meteorite storms and satellite debris, he adds. “You would have to pay for operational redundancy, which is further investment.”

“Data centers will be built where they are affordable,” he says. “I don’t see space happening soon. Remember the Microsoft submerged one? Crickets…”

But he agrees that solar power is nice, though the sun is only visible from one side of the planet at any given time. And space is cold, he says.

Cooling down in outer space

In fact, space is very cold. Close to absolute zero cold. But vacuum is also a great insulator, and there’s no air to move the heat around.

“You can’t convect heat away,” says Richard Bonner, CTO at Accelsius, a liquid cooling company. Bonner has worked on NASA research projects about the challenge of cooling in space and is very familiar with the problem.

A small proportion of the heat might be turned back into useful electricity, but that’s not really a solution, he says, because computer chips don’t get quite that hot.

Instead, heat is radiated. When an object warms up, it generates electromagnetic radiation. This is how we’re able to see warm bodies at night with infrared glasses.

“So, the only way to let that heat go is by radiation,” Bonnor says. “And it requires surface area, so you need these big panels to radiate the heat.” For data centers, these could be football-field-sized panels, he says.

It might seem that the backs of the solar panels would be a good place to radiate excess heat, but solar panels generate their own heat that needs to be radiated away.

The technology is there, Bonner says, and is already in use, though on a much smaller scale than what a full-sized data center would need. “Solar panels, radiator panels—not only do they exist, but they’ve existed for many, many decades,” he says.

Another kind of computing that benefits greatly from being surrounded by the coldness of space is quantum computing. Space could be uniquely beneficial here, Bonner says. “Quantum computers don’t have to dissipate a lot of heat, but they do require very, very cold temperatures. The other nice thing about space is that there’s no vibration.”

But that doesn’t mean that quantum computers are going to be launched into space tomorrow. “Given how sensitive these instruments are, there’s a lot that has to happen to allow them to survive launch,” he says.

Unless they’re built up in space to start with. But that’s a subject for a different article, maybe a decade from now.

Contagious Interview: Evolution of VS Code and Cursor Tasks Infection Chains Part 2

Wed, 11 Mar 2026 15:17:11 +0100

2026-03-09 • Abstract Security • Abstract Security Threat Research Organization (ASTRO) • osx.golangghost, py.pylangghost, win.golangghost
Open article on Malpedia

Webframework: Astro 6.0 experimentiert mit neuem Rust-Compiler

Wed, 11 Mar 2026 12:17:21 +0100

Ein experimenteller Rust-Compiler soll den bisherigen Go-Compiler ablösen und der Astro-Dev-Server unterstützt nun benutzerdefinierte Laufzeitumgebungen.

CVE-2026-27829 | withastro up to 9.5.3 Image Parser server-side request forgery (GHSA-cj9f-h6r6-4cx2)

Mon, 09 Mar 2026 23:20:45 +0100

A vulnerability described as critical has been identified in withastro astro up to 9.5.3. This affects an unknown part of the component Image Parser. Such manipulation leads to server-side request forgery. This vulnerability is traded as CVE-2026-27829. The attack may be launched remotely. There is no exploit available. Upgrading the affected component is recommended.

You can still grab great deals on Bose headphones and Astro Bot this weekend

Sat, 28 Feb 2026 17:16:16 +0100

Welcome to the weekend, friends! While the rest of our team was checking out Samsung’s forthcoming Galaxy S26 lineup and prepping for Apple’s “special experience” next week, we’ve been sifting through Woot’s “Video Games for All” sale and a truly weird slate of deals that, frankly, don’t have a throughline. (Some of us have also […]

Contagious Interview: Evolution of VS Code and Cursor Tasks Infection Chains - Part 1

Thu, 26 Feb 2026 10:32:35 +0100

2026-02-25 • Abstract Security • Abstract Security Threat Research Organization (ASTRO) • js.beavertail, py.pylangghost, win.golangghost
Open article on Malpedia

A Joint Vision for Simplified SASE Management at Scale

Tue, 24 Feb 2026 16:35:51 +0100

Unlock simplified SASE management at scale. The Prisma SASE app on ServiceNow unifies security, automates deployment, and accelerates time to value. The post A Joint Vision for Simplified SASE Management at Scale appeared first on Palo Alto Networks Blog. This…

The post A Joint Vision for Simplified SASE Management at Scale appeared first on IT Security News.

Nvidia lines up partners to boost security for industrial operations

Tue, 24 Feb 2026 03:05:34 +0100

Nvidia has extended its collaborations with a handful of security vendors in an effort to improve real-time threat detection and response across operational technology (OT) environments and industrial control systems (ICS).

“Many of these systems were originally designed for reliability and longevity, not for today’s threat techniques,” wrote Itay Ozery, director of product marketing for networking at Nvidia, in a blog post about the news.

Nvidia’s collaborations with Akamai, Forescout, Palo Alto Networks, Siemens and Xage Security are aimed at bringing accelerated computing and AI to OT cybersecurity, according to Ozery. “These efforts represent a fundamental shift in OT and ICS cybersecurity, where security is embedded into and distributed across infrastructure, enforced at the edge and coordinated through centralized, AI-driven intelligence, bringing modern cybersecurity to the systems that keep the physical world running,” he wrote.

Nvidia announced the news at the S4x26 OT and ICS security conference.

The joint efforts will use Nvidia’s BlueField DPUs, which can directly handle security workloads, offloading those tasks from local host CPUs, and can enforce identity-based access, micro-segmentation and workload policies, according to Nvidia.

Here are some details of each collaborator’s plans to protect critical infrastructure:

Akamai extends its micro-segmentation and zero-trust security platform Guardicore to run on Nvidia BlueField GPUs

The integration offloads user-configurable security processes from the host system to the Nvidia BlueField DPU and enables zero-trust segmentation without requiring software agents on fragile or legacy systems, according to Akamai. Organizations can implement this hardware-isolated, “agentless” security approach to help align with regulatory requirements and lower their risk profile for cyber insurance.

“It delivers deep, out-of-band visibility across systems, networks, and applications without disrupting operations. Security policies can be enforced in real time and are capable of creating a strong protective boundary around critical operational systems. The result is trusted insight into operational activity and improved overall cyber resilience,” according to Akamai.

Forescout works with Nvidia to bring zero-trust technology to OT networks

Forescout applies network segmentation to contain lateral movement and enforce zero-trust controls. The technology would be further integrated into partnership work already being done by the two companies. By running Forescout’s on-premises sensor directly on the Nvidia BlueField, part of Nvidia Cybersecurity AI platform, customers can offload intensive computing tasks, such as deep packet inspections. This speeds up data processing, enhances asset intelligence, and improves real-time monitoring, providing security teams with the insights needed to stay ahead of emerging threats, according to Forescout.

Palo Alto to demo Prisma AIRS AI Runtime Security on Nvidia BlueField DPU

Palo Alto Networks recently partnered with Nvidia to run its Prisma AI-powered Radio Security(AIRs) package on the Nvidia BlueField DPU and will show off the technology at the conference. The technology is part of the Nvidia Enterprise AI Factory validated design and can offer real-time security protection for industrial network settings.

“Prisma AIRS AI Runtime Security delivers deep visibility into industrial traffic and continuous monitoring for abnormal behavior. By running these security services on Nvidia BlueField, inspection and enforcement happen directly at the infrastructure level, closer to the workloads,” Palo Alto stated.

Siemens to demo Nvidia BlueField integration with its IT/OT platform

At the S4x26 security conference, Siemens said it will demonstrate its AI-ready Industrial Automation DataCenter, a platform that collects, stores, processes, and serves operational and automation data across industrial environments. The system integrates Nvidia BlueField devices for and integrated secure edge infrastructure made up of industrial OT workloads and the data center or cloud, according to Siemens.

Xage links its Fabric Platform with Nvidia BlueField

In another technology demonstration, Xage said it will show how its distributed, identity-based security system, Xage Fabric Platform, operates with Nvidia BlueField devices to help customers protect energy assets, manage third-party access and secure AI-driven operations.

“Xage applies least-privilege controls at every step of these interactions, governing not only which agents can access specific data, pipelines, or models, but also the exact actions agents can perform—and for how long,” the company wrote on its website. “With role-based segmentation running at line speed on BlueField, organizations can prevent unauthorized privilege escalation and data leakage and enforce policy-based privilege deescalation to block risky actions, ensuring that AI agents remain trustworthy and compliant as they scale and evolve.”

Palo Alto to acquire Israeli startup Koi for agentic AI security

Tue, 17 Feb 2026 23:18:49 +0100

Palo Alto Networks has entered an agreement to buy agentic endpoint security vendor Koi. Financial details were not disclosed, but some news outlets have estimated the deal is valued at around $400 million.

Members of Israel’s cyber warfare and intelligence group, Unit 8200, founded Koi in 2024 to focus on building technology to protect what the company calls non-traditional, non-binary software, such as code packages, browser extensions, IDE plugins, scripts, local servers such as Model Context Servers, containers and model artifacts.

These non-binary software components “are installed directly by employees and developers without centralized oversight. Because these components are not classic binaries, they often fall outside the visibility and control of traditional endpoint security tooling,” wrote Hadar Oren, senior vice president of product management for Cortex at Palo Alto Networks, in a blog post about the news. “AI agents compound this problem. They are legitimate tools that operate with the user’s credentials and permissions, enabling them to read, write, move data and take privileged actions across systems. When compromised or misused, agents become the ‘ultimate insider.’”

Attackers are chaining exploits in agent frameworks — from authentication bypass to API-based remote code execution — while spoofing agent identities and hijacking credentials to weaponize trusted automation, according to Oren.

“We are convinced that agentic endpoint security will soon become a standard requirement for enterprise security,” Oren wrote.

After the close of the acquisition, Koi’s Agentic Endpoint Security will be integrated with Palo Alto Networks’ AI security platform, Prisma AIRS.

Prisma AIRS features AI model scanning, which lets enterprises safely adopt AI models by scanning them for vulnerabilities and secure the AI ecosystem against risks such as model tampering, malicious scripts, and deserialization attacks. Posture management provides enterprises with insight into their security posture as related to the AI ecosystem and exposes risks such as excessive permissions, sensitive data exposure, platform misconfigurations, and access misconfigurations, according to Palo Alto.

“We believe Palo Alto is extending its platformization strategy deeper into AI with its acquisition of Koi as it can offer control and visibility of AI agents, plug-ins, and nontraditional software that have privileged access abilities on an endpoint. In our view, this deal builds on Palo Alto’s recent acquisition of Chronosphere in the observability space as it allows the company to pair richer AI data with new controls,” wrote Jonathan Ho, a research analyst with William Blair Equity Research, in a report on the deal.

“We believe this should help Palo Alto better secure the lifecycle around AI from infrastructure and data to agents and endpoints, and we view this deal as the latest in Palo Alto’s moves to benefit from AI spending and security…it broadens Palo Alto’s coverage of risks around AI on endpoints, which should put the company in a better competitive position for the future as endpoint security evolves to include the governance of AI agents and autonomous workloads on those endpoints,” Ho stated. Ho said Koi’s technology competes with CrowdStrike, Microsoft, SentinelOne and others.

The Koi deal comes just one week after Palo Alto closed its acquisition of CyberArk, which also tackles the protection of enterprise AI assets. In a blog about the CyberArk deal, World Wide Technologies stated: “It raises the bar for AI security.

“Every vendor is claiming ‘AI security.’ Most of it is detection, guardrails, and posture. But the AI era introduces a new identity class: agentic processes that can initiate actions, call tools, use credentials, and persist across workflows. If AI agents are granted privileges, then the question becomes: Who governs the privilege of an agent that never sleeps?” WWT stated.

“CyberArk has been messaging identity security for AI agents and non-human identities; Palo Alto is explicitly tying the acquisition to securing “human, machine, and AI identities” at scale. Whether the market fully agrees yet doesn’t matter. This acquisition forces the conversation into the open,” WWT stated.

Astro Protocol is a tactical space 4x game designed for people with little time

Tue, 17 Feb 2026 14:50:22 +0100

I sure do love 4x strategy games, but they really can take forever - which is where Astro Protocol is different with its tactical approach.

Read the full article on GamingOnLinux.

CVE-2025-0122 | Palo Alto Prisma SD-WAN up to 6.1.9/6.2.0/6.3.3/6.4.1/6.5.0 Packets allocation of resources (Nessus ID 298998)

Sat, 14 Feb 2026 03:07:50 +0100

A vulnerability marked as critical has been reported in Palo Alto Prisma SD-WAN up to 6.1.9/6.2.0/6.3.3/6.4.1/6.5.0. This affects an unknown part of the component Packets Handler. The manipulation leads to allocation of resources. This vulnerability is uniquely identified as CVE-2025-0122. The attack can only be initiated within the local network. No exploit exists. It is suggested to upgrade the affected component.

CVE-2026-0228 | Palo Alto Cloud NGFW/PAN-OS/Prisma Access certificate validation

Fri, 13 Feb 2026 02:35:55 +0100

A vulnerability described as critical has been identified in Palo Alto Cloud NGFW, PAN-OS and Prisma Access. Affected by this issue is some unknown functionality. The manipulation results in improper certificate validation. This vulnerability was named CVE-2026-0228. The attack may be performed from remote. There is no available exploit.

CVE-2026-0229 | Palo Alto Cloud NGFW/PAN-OS/Prisma Access unusual condition

Fri, 13 Feb 2026 02:35:52 +0100

A vulnerability, which was classified as critical, has been found in Palo Alto Cloud NGFW, PAN-OS and Prisma Access. Affected by this issue is some unknown functionality. This manipulation causes improper check for unusual conditions. This vulnerability is tracked as CVE-2026-0229. The attack is possible to be carried out remotely. No exploit exists.

CVE-2025-69618 | Tarot, Astro & Healing 11.4.0 privilege escalation

Thu, 12 Feb 2026 08:22:25 +0100

A vulnerability was found in Tarot, Astro & Healing 11.4.0. It has been classified as problematic. This affects an unknown function. The manipulation leads to privilege escalation. This vulnerability is listed as CVE-2025-69618. The attack must be carried out from within the local network. There is no available exploit.

The Bank Hacker - ZDFneo - TV-Programm - Prisma

Thu, 12 Feb 2026 07:36:18 +0100

The Bank Hacker. Mithilfe von Philip Daum betreten Alidor und seine Bande die Bank. Ein Geisel-Video zwingt Daum dazu, alle Alarmsysteme auszuschalten ...

The Bank Hacker - ZDFneo - TV-Programm - Prisma

Wed, 11 Feb 2026 15:21:22 +0100

The Bank Hacker. Die Staatsanwältin findet heraus, dass Jeremy sie bei der Befragung zum Banküberfall belogen hat. Sie droht ihm mit Gefängnis. Jeremy ...

This vintage-looking camera has been updated for shooting the stars

Tue, 10 Feb 2026 16:32:07 +0100

Just over a year after OM System launched its vintage-styled OM-3 Micro Four Thirds mirrorless camera, the company has announced a new version with a handful of upgrades catering to astrophotography. The new OM-3 Astro will be available starting in March 2026 for $2,499.99, which is $500 more expensive than the standard model. Both can […]

Sophos Links Mount Locker to Astro Locker Ransomware

Fri, 06 Feb 2026 12:51:14 +0100

Experts suspect branding move to kick-start affiliate program

Modern networks for modern demands: How CIOs are building for what’s next

Tue, 27 Jan 2026 21:18:58 +0100

Enterprise networks weren’t built to support today’s demands, from artificial intelligence (AI) model training and real-time edge analytics to distributed work styles and cloud-first architectures. To keep pace, CIOs need new infrastructures designed for speed, scale, and security.

Compounding challenges in enterprise networks

Years of deferred upgrades and patchwork solutions have created brittle networks that increase complexity and inhibit business growth. MPLS architectures, hardware-heavy security stacks, and disparate tools make it challenging to provide the visibility and responsiveness that AI, edge, and cloud workloads require.

In a world where 44% of mission-critical infrastructure is at or nearing end-of-life, according to the Kyndryl Readiness Report, many leaders recognize that their aging environments hinder their ability to pivot. With AI-driven competitors making strategic moves in a matter of weeks, a legacy network that takes months to provision new capacity is a liability.

Meanwhile, enterprises are also dealing with organizational roadblocks. Infrastructure and security teams often work in silos, making it hard to drive operating model transformation. Skills shortages, long provisioning cycles, and rising cloud egress costs further compound this challenge.

Improving network performance with SASE

To overcome these challenges, enterprises are shifting toward cloud-based, software-defined architectures that unify networking and security — with secure access service edge (SASE) playing a central role. SASE provides the technical pretext for CIOs and CISOs to finally merge their agendas. The question for leadership is no longer, “How do we fix the network?” but, “How do we restructure our teams to manage a unified, cloud-native environment?”

SASE combines SD‑WAN, zero-trust access, secure web gateways, cloud access security brokers, and other critical capabilities in a single platform. Increasingly, these frameworks also integrate AI to detect threats in real time, enforce policies dynamically, and route traffic intelligently. This creates a secure, high-speed data fabric necessary for AI model training and real-time edge analytics. By offloading heavy compute tasks to an AI-powered SASE framework, leadership can ensure that the infrastructure actually increases AI’s return on investment, rather than draining budget through egress fees and latency.

Enterprises adopting SASE are seeing stronger security postures, fewer false positives, improved uptime, and better user experiences. In fact, 82.9% of organizations that have adopted SASE report a noticeable improvement in network performance or threat detection, according to IDC. And because it’s delivered as a service, SASE reduces cost and complexity while providing the scalability needed for future growth.

Network modernization from Palo Alto Networks and Kyndryl

Palo Alto Networks and Kyndryl provide the right combination of technology and expertise to make network modernization a reality. Palo Alto provides Prisma SASE, an AI-powered, zero-trust platform that unifies networking and security in the cloud. And Kyndryl’s services help large organizations plan, deploy, and manage at scale.

Kyndryl’s own modernization journey — replacing a legacy network with Prisma SASE — gives it a unique perspective on the challenges enterprises face. That firsthand experience informs every engagement, from assessments and roadmap planning to phased rollouts and 24/7 management.

By integrating Prisma SASE with Kyndryl Bridge — a digital operations platform that connects IT and business systems — organizations can also solve the talent crisis. Automating mundane tasks such as threat monitoring and traffic optimization allows skilled workers to focus more on higher-value, business-critical innovation.

AI, edge, and cloud workloads demand more from your network. Kyndryl and Palo Alto Networks offer a practical, proven path to network modernization. Visit us here to learn more.

CVE-2025-0103 | Palo Alto Networks Cloud NGFW sql injection

Sat, 24 Jan 2026 04:50:51 +0100

A vulnerability was found in Palo Alto Networks Cloud NGFW, Expedition, Panorama, PAN-OS and Prisma Access. It has been rated as critical. The affected element is an unknown function. Performing a manipulation results in sql injection. This vulnerability only affects products that are no longer supported by the maintainer. This vulnerability is known as CVE-2025-0103. Remote exploitation of the attack is possible. No exploit is available. Upgrading the affected component is advised.

CVE-2025-0105 | Palo Alto Networks Cloud NGFW file inclusion

Sat, 24 Jan 2026 04:50:50 +0100

A vulnerability categorized as critical has been discovered in Palo Alto Networks Cloud NGFW, Expedition, Panorama, PAN-OS and Prisma Access. The impacted element is an unknown function. Executing a manipulation can lead to file inclusion. This vulnerability only affects products that are no longer supported by the maintainer. This vulnerability is handled as CVE-2025-0105. The attack can be executed remotely. There is not any exploit available. It is advisable to upgrade the affected component.

CVE-2025-0106 | Palo Alto Cloud NGFW matching

Sat, 24 Jan 2026 04:50:49 +0100

A vulnerability, which was classified as problematic, was found in Palo Alto Cloud NGFW, Expedition, Panorama, PAN-OS and Prisma Access. This issue affects some unknown processing. The manipulation results in improper neutralization of wildcards or matching symbols. This vulnerability only affects products that are no longer supported by the maintainer. This vulnerability is cataloged as CVE-2025-0106. The attack may be launched remotely. There is no exploit available. You should upgrade the affected component.

CVE-2025-0104 | Palo Alto Cloud NGFW cross site scripting

Sat, 24 Jan 2026 04:50:47 +0100

A vulnerability marked as problematic has been reported in Palo Alto Cloud NGFW, Expedition, Panorama, PAN-OS and Prisma Access. This affects an unknown part. Performing a manipulation results in cross site scripting. This vulnerability only affects products that are no longer supported by the maintainer. This vulnerability was named CVE-2025-0104. The attack may be initiated remotely. There is no available exploit. It is suggested to upgrade the affected component.

칼럼 | 테일윈드 랩스의 엔지니어 75% 감원, AI 중심 개발의 미래는?

Thu, 22 Jan 2026 07:20:21 +0100

필자는 테일윈드(Tailwind)와 애증의 관계를 거쳐왔다.

테일윈드는 처음 공개됐을 당시 큰 화제를 모았다. 이는 미리 정의된 CSS 스타일을 클래스 형태로 제공해, 개발자가 별도의 스타일시트를 작성하지 않고도 HTML 안에서 바로 디자인을 완성할 수 있도록 한 유틸리티 중심의 CSS 프레임워크다. 이런 접근을 통해 개발자는 각 태그를 세밀하게 제어할 수 있는데, 당시에는 이 개념이 상당히 신선하고 인상적으로 느껴졌다.

하지만 필자는 ‘관심사의 분리(Separation of Concerns, SoC)’를 중요하게 여긴다. 화면의 구조를 정의하는 HTML과, 그 구조를 꾸미는 스타일 코드는 서로 섞이지 않는 것이 바람직하다는 생각이다. 초콜릿과 땅콩버터를 굳이 한데 섞지 않는 것과 같은 이치다. 하지만 테일윈드는 바로 그 둘을 섞으라고 요구하는 것처럼 보였다. CSS의 본래 목적 중 하나는 HTML 구조와 이를 꾸미는 스타일 코드를 분리하는 데 있었는데, 테일윈드는 그와 반대 방향으로 가는 것 아니냐는 의문이 들었다. 디자인 요소가 HTML 안에 들어가 있는 상태에서 과연 관심사의 분리가 가능할까? 결론적으로 말하면 쉽지 않다.

다만 CSS가 처음 만들어졌을 때와 비교하면 웹 디자인의 성격 자체가 크게 달라졌다. 앵귤러(Angular), 리액트(React), 아스트로(Astro) 등 오늘날 대부분의 프레임워크는 컴포넌트 기반 구조를 채택하고 있다. 그렇다고 해도 이들 컴포넌트 역시 기본적으로는 CSS와 HTML의 분리를 전제로 설계됐다. 예를 들어 앵귤러에서 하나의 컴포넌트는 타입스크립트, HTML, CSS 등 3개의 파일로 구성된다.

이런 컴포넌트는 갈수록 더 잘게 쪼개지고 있는 동시에, 웹사이트의 전반적인 디자인은 점점 더 표준화되는 추세다. 대표적인 사례가 버튼 색상이다. 파란색 버튼은 ‘신뢰해도 되는 동작’을, 빨간색 버튼은 ‘주의가 필요한 동작’을 의미하는 식의 시각적 규칙이 사실상 관행처럼 굳어졌다. 그 결과 과거처럼 색상을 세세하게 조정해야 할 필요성은 크게 줄어들었다.

바로 이 지점에서 테일윈드의 강점이 드러난다. 표준화된 색상이 필요하다면 테일윈드는 이를 손쉽게 정의할 수 있다. 색상과 형태가 이미 정형화돼 있다면, 해당 스타일을 표현하는 테일윈드의 작은 유틸리티 클래스는 매우 유용하다. 더 나아가 컴포넌트 자체가 간결하고 독립적으로 구성돼 있다면, 과연 HTML과 CSS를 굳이 분리해야 할 필요가 있을까라는 질문도 자연스럽게 제기된다.

결국 테일윈드는 강력하면서도 사용하기 쉬운 도구다. 이런 이유로 테일윈드는 웹사이트를 스타일링하는 방식 가운데 사실상 표준에 가까운 위치까지 올라섰다.

그러나 이제 테일윈드의 인기가 오히려 약점이 될 가능성도 보이기 시작했다.

지난주 테일윈드 팀은 전체 개발 인력의 75%를 감원했다. 배경은 무엇일까? 테일윈드의 창시자이자 테일윈드 랩스 설립자인 애덤 웨이선은 AI 확산으로 인해 회사의 마케팅 파이프라인이 사실상 마르면서 이런 결정이 불가피했다고 밝혔다. 테일윈드는 MIT 라이선스를 채택해 거의 무료로 사용할 수 있는 프레임워크다. 테일윈드 랩스는 그동안 웹사이트 방문 트래픽을 기반으로 ‘평생 라이선스’ 판매와 스폰서십을 통해 수익을 창출해 왔다. 그러나 AI가 점점 더 많은 코딩 작업을 대신하게 되면서 개발자들이 테일윈드 사이트를 찾는 빈도가 줄었고, 그 결과 구매나 후원 역시 이전만큼 이뤄지지 않게 됐다.

개인적으로는 이 상황이 씁쓸하게 느껴진다.

필자는 그동안 에이전틱 코딩에 대해 반복적으로 다뤄왔고, ‘바이브 코딩‘과 같은 AI 기반 개발 흐름에 비교적 우호적인 입장을 유지해 왔다. 그럼에도 이번 감원은 AI가 무엇을 바꾸고 있으며, 앞으로 무엇이 벌어질 수 있는지를 보여주는 매우 현실적인 사례라고 본다. 이미 스택오버플로우에서 질문이 사실상 사라지는 현상도 목격했다. 이제는 AI로 인해 테일윈드 랩스조차 수익을 내기 어려운 상황에 놓이고 있다.

바로 이 지점이 가장 우려하는 부분이다. AI가 새로운 코드와 프레임워크를 만드는 일을 더 이상 투자 가치가 없는 영역으로 만들어버리는 것은 아닐까? 만약 그렇다면, 앞으로 새로운 코드와 프레임워크는 과연 어디에서 나오게 될까?

어쩌면 그 해답은 에이전틱 AI 자체에 있을지도 모른다. 하지만 AI가 사람을 대신해 더 나은 프레임워크와 라이브러리를 만들어내는 역할까지 온전히 맡을 수 있을지, 아니면 사람이 만든 라이브러리가 지속 가능한 수익을 낼 수 있도록 하는 새로운 모델을 다시 설계해야 할지는 시간이 지나야 알 수 있을 것이다.

필자는 테일윈드와 에이전틱 AI 모두를 지지하지만, 후자가 전자에게 미치고 있는 영향은 받아들이기 어렵다. 그렇다면 결국, 미래를 만들어갈 주체는 누가 될까?
dl-ciokorea@foundryco.com

Webentwicklung: Cloudflare übernimmt Astro Technology Company

Mon, 19 Jan 2026 12:31:08 +0100

Das Unternehmen hinter dem Webframework Astro gehört nun zu Cloudflare. Astro soll jedoch Open Source bleiben und aktiv weiterentwickelt werden.

Cloudflare kauft JavaScript-Framework Astro

Mon, 19 Jan 2026 09:49:42 +0100

Cloudflare hat die Übernahme von The Astro Technology Company bekanntgegeben, dem Entwickler des gleichnamigen JavaScript-Frameworks. Astro wird von Unternehmen sowie Hunderttausenden Entwicklern weltweit genutzt, um performante, inhaltsorientierte Websites zu erstellen.

Tags: #Firmenübernahme | #JAVA

CVE-2026-0227 | Palo Alto Cloud NGFW/PAN-OS/Prisma Access unusual condition

Sat, 17 Jan 2026 10:50:36 +0100

A vulnerability categorized as critical has been discovered in Palo Alto Cloud NGFW, PAN-OS and Prisma Access. Affected is an unknown function. Such manipulation leads to improper check for unusual conditions. This vulnerability is traded as CVE-2026-0227. The attack may be launched remotely. There is no exploit available.

Cloudflare Acquires Team Behind Open Source Framework Astro

Sat, 17 Jan 2026 00:34:57 +0100

Cloudflare has acquired the core team behind the open source JavaScript framework Astro, bringing its creators in-house while pledging to keep Astro fully open source. The New Stack reports: Astro is used by major brands like IKEA, Unilever, Visa and OpenAI to build fast, content-driven websites. Search engines prioritize fast-loading and clean pages, the Cloudflare statement noted. Websites that rely heavily on JavaScript for initial rendering often struggle to deliver the required speed, which hinders search rankings and customer conversions. Pages on Astro serve up only the code needed to display a page in a browser. That's in part because of its Island architecture, which it introduced in 2021. Astro's Islands allow developers to create "islands" of interactive client-side components, while most of the page is generated statically in HTML. Server Islands extend the same architecture to the server. Astro is also UI-agnostic, meaning that while it has its own independent engine, it allows developers to bring in components from React, Svelte, Vue and other frameworks. This makes Astro a preferred choice for building high-performance, content-driven websites optimized for speed, according to Cloudflare. "Over the past few years, we've seen an incredibly diverse range of developers and companies use Astro to build for the web," said Astro's former CTO, Fred Schott, in a post with Cloudflare senior product manager Brendan Irvine-Broque. "At Cloudflare, we use Astro, too -- for our developer docs, website, landing pages and more." They said that the acquisition will allow them to "double down" on making Astro the best framework for content-driven websites.

Cloudflare Acquired Open-source Web Framework Astro to Supercharge Development

Fri, 16 Jan 2026 18:34:47 +0100

Cloudflare has acquired the team behind Astro, the popular open-source web framework for building fast, content-driven sites. Announced on January 16, 2026, the deal brings The Astro Technology Company’s full-time employees under Cloudflare’s umbrella to accelerate Astro’s development. Cloudflare positions…

The post Cloudflare Acquired Open-source Web Framework Astro to Supercharge Development appeared first on IT Security News.

Cloudflare Acquired Open-source Web Framework Astro to Supercharge Development

Fri, 16 Jan 2026 18:20:19 +0100

The post Cloudflare Acquired Open-source Web Framework Astro to Supercharge Development appeared first on Cyber Security News.

Palo Alto Networks patches firewalls after discovery of a new denial-of-service flaw

Fri, 16 Jan 2026 01:35:32 +0100

Palo Alto Networks has issued patches for its PAN-OS firewall platform after a researcher uncovered a high-severity vulnerability which could be exploited by attackers to cause a denial-of-service (DoS).

The flaw, identified as CVE-2026-0227 with a CVSS 7.7 (‘high’) severity rating, affects customers running PAN-OS NGFW (Next-Generation Firewall) or Prisma Access configurations with the company’s GlobalProtect remote access gateway or portal enabled.

Unpatched, this would make it possible for “an unauthenticated attacker to cause a denial of service to the firewall. Repeated attempts to trigger this issue results in the firewall entering into maintenance mode,” said Palo Alto’s advisory.

The company doesn’t spell out the implications of a firewall entering maintenance mode, but it’s hard to imagine it wouldn’t cause network outages as admins scrambled to address the issue.

Although Palo Alto Networks said it wasn’t aware of exploitation in the wild, the advisory also states that the issue was reported to it by an unnamed researcher, and that proof of concept (PoC) code exists.

Given that PoCs have a habit of leaking out or being independently reproduced, this makes Palo Alto’s description of the issue as being of “moderate urgency” read as optimistic.

This new vulnerability brings to mind an almost identical Palo Alto Networks DoS issue from late 2024, CVE-2024-3393, that also put affected firewalls into maintenance mode. On that occasion, attackers found out about the issue before patches appeared, making it a zero-day vulnerability.

More recently, in December, threat intelligence company GreyNoise noticed an uptick in automated login attempts targeting both GlobalProtect and Cisco VPNs, while earlier in 2025, PAN-OS was affected by a serious zero day flaw, CVE-2025-0108, that allowed attackers to bypass login authentication.

“According to Palo Alto Networks’ security advisories, the company has reported almost 500 vulnerabilities to date, many of which affected PAN-OS. A significant minority related to DoS issues,” a spokesperson for threat intelligence company Flashpoint observed. “[But] a notable portion of Palo Alto disclosures historically did not receive CVE identifiers, particularly older PAN-OS issues, which can complicate longitudinal comparison across vendors.”

Who is affected?

The good news is that most customers using the company’s cloud-delivered Secure Access Service Edge (SASE) platform, Prisma Access, have already been patched.

“We have successfully completed the Prisma Access upgrade for most of the customers, with the exception of few in progress due to conflicting upgrade schedules. Remaining customers are being promptly scheduled for an upgrade through our standard upgrade process,” said the advisory.

That leaves a not inconsiderable number of PAN-OS NGFW customers using the GlobalProtect gateway or portal who will need to apply the patch themselves. Although Palo Alto said there are no known workarounds, to mitigate the issue, it might be possible to temporarily disable the VPN interface at the cost of losing remote access until patching is complete.

Palo Alto Networks has published a detailed table of applicable patches which vary depending on the underlying PAN-OS version (12.1, 11.2, 11.1 10.2) in use. Versions older than 10.2 are unsupported; the fix is to update to a supported patched version.

Availability disruption

According to Flashpoint, a DoS state wouldn’t expose enterprises to a wider security threat. “Modern enterprise firewalls are designed to ‘fail closed’ rather than ‘fail open’. Entering maintenance mode due to a DoS condition is therefore more accurately characterized as a potential availability disruption than a direct security exposure,” said the spokesperson. “The core risk here appears to be resilience rather than compromise.”

Iberostar confía en la IA para mejorar la captación y gestión de empleados en un sector con alta rotación

Thu, 15 Jan 2026 12:50:38 +0100

La escasez de trabajadores disponible, la alta rotación y la poca digitalización de los puestos de trabajo son, según Luis Zamora, director de personas (CHRO) de Grupo Iberostar, una de las grandes multinacionales españolas del sector turismo y especialmente fuerte en el negocio hotelero, los tres grandes desafíos que afronta este vertical en la actualidad desde el prisma laboral. Así lo indicó el directivo en un encuentro con prensa organizado por Workday, compañía con la que el grupo turístico selló un contrato en 2025 para implantar su tecnología de gestión de recursos humanos, en aras de unificar sus procesos de contratación, desarrollo de talento y administración de nóminas y beneficios laborales.

“En este momento —contó Zamora— nos hallamos en pleno proceso de implementación de Workday, que esperamos que esté a pleno uso el próximo mes de septiembre. Esto nos permitirá ofrecer formación a la carta a nuestros empleados, facilitarles realizar cambios de turno sin que esto impacte en el negocio y en función de la ocupación del hotel donde trabajen y mejorar así su experiencia y la de sus managers, facilitar el cumplimiento de la regulación, etc.”. El proyecto, añadió el responsable, implica un “gran cambio cultural”, pues “se trata de que el área de personas deje de realizar una gestión administrativa y de nómina a abordar una gestión del capital humano”.

La compañía, relató, confía en las posibilidades que trae consigo el software de la firma estadounidense, que se apalanca en la analítica de datos y la más reciente aplicación de agentes de inteligencia artificial, una tecnología que el directivo de Iberostar ve con buenos ojos incluso de cara a la captación de empleados. “Ya hemos realizado pilotos con IA que nos permiten realizar entrevistas de filtro con personas; esta tendencia, la de hablar con máquinas, que la gente más joven ya ha normalizado, entrará en los procesos de selección”, afirmó Zamora, convencido de que “la IA ayudará a quitar tareas administrativas a los gestores de forma que estos, en lugar de dedicar tanto tiempo a hacer informes, puedan centrarse en lo importante: en las personas y en sus equipos”.

“La IA entrará en los procesos de selección […] pero la máquina nunca va a tener la última decisión”

Con la IA, recalcó, “la mejora de la experiencia del empleado será importante”. Agregó que la naturalidad que traerá consigo a las conversaciones con las máquinas el uso de la IA generativa por voz será un factor determinante para ello; no obstante, subrayó, “hay que actuar con prudencia y tener en cuenta que en un proceso de selección de personal la máquina nunca va a tener la última decisión”. “En un sector donde la experiencia del cliente depende directamente de las personas, la IA no debe sustituir el criterio humano, sino potenciarlo”, recalcó.

La implantación de la tecnología de gestión de personal de Workday forma parte de una estrategia tecnológica a mayor escala que implica también el uso de soluciones de otras herramientas de gestión con las que estará integrada la primera, como una solución de planificación financiera de SAP u otra de Microsoft (Fabric) para hacer análisis avanzado de datos corporativos.

Adopción de la IA en la parte operacional de Iberostar

Zamora desgranó también otros proyectos del grupo en los que la inteligencia artificial tiene un rol relevante desde el punto de vista de la operación. Uno es el sistema Winnow, “basado en el machine learning de toda la vida” que ha implantado ya en decenas de sus hoteles y gracias al que ha conseguido ahorrar en estos establecimientos millones de comidas al año. “Nos preocupa el desperdicio alimentario”, apuntó el directivo. Este proyecto forma parte de su movimiento de sostenibilidad Wave of Change, que nació en 2022 con el objetivo de ahorrar 1.600 toneladas de residuos alimentarios al año, es decir, unos 5,3 millones de comidas.

El otro proyecto mencionado por Zamora fue BRAIAN, una inteligencia artificial diseñada para optimizar el consumo energético en los hoteles sin impactar en los huéspedes. La solución, desarrollada con la compañía Sener y que también forma parte del movimiento Wave of Change, tiene como objetivo reducir en un 35% el consumo energético y en un 85% las emisiones de alcance 1 y 2 para 2030.

Ya desde un punto de vista más general de transformación digital, Iberostar, bajo su proyecto Hotel Digital, utiliza la inteligencia artificial para mejorar la experiencia del cliente.

Gaming-Headset Logitech G Astro A50 Gen 5 im Test

Tue, 13 Jan 2026 16:31:43 +0100

Als Gaming-Headset überzeugt das Logitech G Astro A50 Gen 5 unter anderem mit einem hervorragenden Mikrofon und top Sound.

Vera-Rubin-Teleskop entdeckt viel zu schnell drehenden Asteroiden

Sat, 10 Jan 2026 11:50:21 +0100

Riesig, rasant und massiv: Der Asteroid "2025 MN45" stellt bisherige Beobachtungen in den Schatten. Mit einer Rotation von 1,88 Minuten ist er der schnellste bekannte Körper seiner Klasse. Astronomen verdanken den Fund der neuen LSST-Kamera in Chile. (Weiter lesen)

Raum 641a & FoxAcid: Wie die NSA deine Verschlüsselung knackt (Song) 🔐💀

Fri, 09 Jan 2026 00:06:02 +0100

⚛️ Q-DAY: FoxAcid, Logjam & Shor – Die Werkzeuge der totalen Entschlüsselung 🔓

Kernaussage (Lyrics-Analyse):
🕸️ Raum 641a: Der Song referenziert den berühmten Raum in San Francisco, wo AT&T mittels "Splittern" den Datenverkehr direkt am Glasfaserkabel kopierte und an die NSA weiterleitete ("Prisma im Kabel").
💾 HNDL (Harvest Now, Decrypt Later): Im Utah Data Center werden "Exabytes an Bändern" gelagert. Die Wette auf die Zukunft: Was heute verschlüsselt ist, knackt der Quantencomputer morgen.
⚔️ Aktive Angriffe: Erwähnung von "FoxAcid" (NSA-System für Quantum Insert Angriffe) und "Man-on-the-Side". Verbindungen werden aktiv manipuliert ("Downgrade"), um starke Krypto zu umgehen.
🧮 Der Shor-Algorithmus: Wenn der Quantencomputer da ist ("1 Million Qubits"), frisst der Shor-Algorithmus die Primzahlen ("Bremsalen" im Transkript korrigiert), auf denen unsere Sicherheit (RSA) basiert.

Quantum Insert & Backbone-Spionage: Die geheimen Werkzeuge der NSA

submitted by /u/Horus_Sirius
[link] [comments]

Raum 641a & FoxAcid: Wie die NSA deine Verschlüsselung knackt (Song) 🔐💀

Thu, 08 Jan 2026 09:33:12 +0100

Author: VAZULES Analysiert - Bewertung: 1x - Views:7

▶️ MUSIKALISCHER TECH-THRILLER: Ein Cyberpunk-Track über Raum 641a, FoxAcid und den Tag, an dem die Krypto fällt (Q-Day). "Harvest Now, Decrypt Later" ist keine Theorie, es ist der Modus Operandi.

---Thema:
⚛️ Q-DAY: FoxAcid, Logjam & Shor – Die Werkzeuge der totalen Entschlüsselung 🔓

---

Kernaussage (Lyrics-Analyse):
🕸️ Raum 641a: Der Song referenziert den berühmten Raum in San Francisco, wo AT&T mittels "Splittern" den Datenverkehr direkt am Glasfaserkabel kopierte und an die NSA weiterleitete ("Prisma im Kabel").
💾 HNDL (Harvest Now, Decrypt Later): Im Utah Data Center werden "Exabytes an Bändern" gelagert. Die Wette auf die Zukunft: Was heute verschlüsselt ist, knackt der Quantencomputer morgen.
⚔️ Aktive Angriffe: Erwähnung von "FoxAcid" (NSA-System für Quantum Insert Angriffe) und "Man-on-the-Side". Verbindungen werden aktiv manipuliert ("Downgrade"), um starke Krypto zu umgehen.
🧮 Der Shor-Algorithmus: Wenn der Quantencomputer da ist ("1 Million Qubits"), frisst der Shor-Algorithmus die Primzahlen ("Bremsalen" im Transkript korrigiert), auf denen unsere Sicherheit (RSA) basiert.

Quellen:
https://www.youtube.com/watch?v=Nd2DeT9TS1M
PDF:
https://tsecurity.de/eBooks/Utah%20Data%20Center,%20Root-Server,%20Quantencomputer.pdf

#QDay #FoxAcid #Room641a #NSA #QuantumComputing #PostQuantum #HNDL #LaKanDoR #CyberSecurity

CVE-2025-58179 | withastro up to 12.6.5 Generated Image Optimization Endpoint server-side request forgery (GHSA-qpr4-c339-7vq8 / EUVD-2025-26878)

Tue, 23 Dec 2025 03:36:36 +0100

A vulnerability described as critical has been identified in withastro astro up to 12.6.5. Impacted is an unknown function of the component Generated Image Optimization Endpoint. Such manipulation leads to server-side request forgery. This vulnerability is uniquely identified as CVE-2025-58179. The attack can be launched remotely. No exploit exists. Upgrading the affected component is recommended.

Der unsichtbare Krieg - arte - TV-Programm - Prisma

Tue, 16 Dec 2025 11:51:14 +0100

Wie der Bundestagshack 2015 gezeigt hat, können Hacker einen Staat außer Gefecht setzen. Seither. Vergrößern. Fotoquelle: © Sven Wildenhayn/Gruppe 5.

Seagate’s Astro Bot Limited Edition HDD combines reliable storage with playful design — here’s how it stacks up in our review

Sun, 14 Dec 2025 15:06:39 +0100

Seagate's Astro Bot-themed game drive is a limited edition HDD that works for PC, PlayStation 5, and PlayStation 4. But is it worth buying for PC? Our review.

XXL Adventskalender 2025 (Tür 13)

Sat, 13 Dec 2025 20:01:12 +0100

Das dreizehnte Türchen unseres XXL Adventskalender öffnet sich und zusammen mit unserem Partner Seagate gibt es eine limitierte Astro Bot 5 TB Festplatte. Was gibt es zu gewinnen? 1x Seagate PlayStation Game Drive 5 TB Astro Bot Teilnahme Wie immer setzen wir dafür das leicht zu bedienende Verlosungswidget von Gleam ein. Hier könnt ihr ...

The post XXL Adventskalender 2025 (Tür 13) appeared first on NewGadgets.de.

Linting-Stack für Node-Projekte: Code-Qualität, Formatierung und Prosa-Linting

Sat, 13 Dec 2025 08:50:22 +0100

Ein dreistufiger Linting-Ansatz mit ESLint, Prettier und Vale verbessert Qualität von Code und Dokumentation in Astro-Projekten durch automatisiertes Prüfen.

Redefining Workspace: Prisma Browser Secures Leadership in Frost Radar

Thu, 11 Dec 2025 23:50:41 +0100

Prisma Browser is the Frost Radar leader for ZTBS! Learn how our Precision AI-powered security transforms your browser from attack vector to defense. The post Redefining Workspace: Prisma Browser Secures Leadership in Frost Radar appeared first on Palo Alto Networks…

The post Redefining Workspace: Prisma Browser Secures Leadership in Frost Radar appeared first on IT Security News.

Partners Are Fueling Innovation with Cortex XSIAM and Prisma SASE

Tue, 09 Dec 2025 19:34:58 +0100

Solution providers voted us #1 – Cortex XSIAM is CRN’s 2025 Product of the Year and Prisma SASE is a 2025 Tech Innovator. The post Partners Are Fueling Innovation with Cortex XSIAM and Prisma SASE appeared first on Palo Alto…

The post Partners Are Fueling Innovation with Cortex XSIAM and Prisma SASE appeared first on IT Security News.

CVE-2025-66202 | withastro up to 5.15.7 non-canonical url paths for authorization decisions (GHSA-ggxq-hp9w-j794 / CNNVD-202512-1079)

Tue, 09 Dec 2025 17:05:03 +0100

A vulnerability was found in withastro astro up to 5.15.7 and classified as critical. Affected by this issue is some unknown functionality. The manipulation results in use of non-canonical url paths for authorization decisions. This vulnerability is cataloged as CVE-2025-66202. The attack may be launched remotely. There is no exploit available. It is suggested to upgrade the affected component.

PS5-Spieler müssen zuschlagen! MediaMarkt wirft euch jetzt für 29,99 Euro Astro Bot hinterher

Thu, 04 Dec 2025 16:16:57 +0100

Ein Spiel, das selbst abgebrühte Gamer zum Staunen bringt – und das aktuell für unter 30 Euro zu haben ist.

CVE-2024-9468 | Palo Alto PAN-OS/Cloud NGFW/Prisma Access Packet out-of-bounds write

Mon, 01 Dec 2025 20:35:59 +0100

A vulnerability was found in Palo Alto PAN-OS, Cloud NGFW and Prisma Access and classified as critical. This affects an unknown function of the component Packet Handler. Executing manipulation can lead to out-of-bounds write. This vulnerability is tracked as CVE-2024-9468. The attack can be launched remotely. No exploit exists. It is suggested to upgrade the affected component.

Perfekt für Weihnachten: PS5-Meisterwerk Astro Bot radikal reduziert

Mon, 01 Dec 2025 09:46:51 +0100

Wer glaubt, Astro Bot sei nur bunter Zeitvertreib für Kinder, verpasst eines der besten PS5-Spiele überhaupt. Der Plattformer ist eine Hommage an die PlayStation-Ära und fesselt Erwachsene mit Nostalgie und genialem Leveldesign genauso wie den Nachwuchs. Bei MediaMarkt fällt der Preis für das Top-Spiel jetzt auf ein Rekordtief von unter 40 Euro.

CVE-2025-64765 | withastro up to 5.15.7 decodeURI path traversal

Thu, 27 Nov 2025 08:50:46 +0100

A vulnerability identified as critical has been detected in withastro astro up to 5.15.7. Affected by this issue is the function decodeURI. This manipulation causes path traversal. This vulnerability is handled as CVE-2025-64765. The attack can be initiated remotely. There is not any exploit available. You should upgrade the affected component.

CVE-2025-65019 | withastro up to 5.15.8 Image Optimization Endpoint isRemoteAllowed cross site scripting

Thu, 27 Nov 2025 08:50:44 +0100

A vulnerability described as problematic has been identified in withastro astro up to 5.15.8. This issue affects the function isRemoteAllowed of the component Image Optimization Endpoint. Executing manipulation can lead to cross site scripting. The identification of this vulnerability is CVE-2025-65019. The attack may be launched remotely. There is no exploit available. Upgrading the affected component is recommended.

CVE-2025-59837 | withastro up to 5.13.9 href server-side request forgery (GHSA-qcpr-679q-rhm2)

Thu, 27 Nov 2025 05:59:24 +0100

A vulnerability has been found in withastro astro up to 5.13.9 and classified as critical. The affected element is an unknown function. The manipulation of the argument href leads to server-side request forgery. This vulnerability is uniquely identified as CVE-2025-59837. The attack is possible to be carried out remotely. No exploit exists. The affected component should be upgraded.

AI’s front door: Why the browser is your most critical control point

Wed, 26 Nov 2025 16:50:53 +0100

Enterprise security has a dark secret, one that threatens to undermine the multibillion dollar investments being made in artificial intelligence. Organizations have spent countless hours building fortified castles to protect their AI models and data lakes. Yet every day, the primary interface to these powerful systems — the browser — remains an uncontrolled and unlocked front door.

Security leaders have rightly focused on securing the core of their AI infrastructure. Their focus, however, has often missed the most common point of interaction: the browser, a tool now transformed into a direct threat to innovation by the explosion of generative AI.

For all intents and purposes, the browser is the proverbial “front door” of the AI journey, the dynamic space where human ingenuity and machine intelligence converge. Unfortunately, leaving this front door ajar places a hard ceiling on the potential of an organization’s most strategic initiatives.

Fresh wave of browser-borne risks

The adoption of generative AI has introduced a new class of threats that are born and executed within the browser, far beyond the reach of traditional network security. The scale of this new risk is staggering. A recent internal study among our customers showed that GenAI traffic is up over 890% in 2024. Consequently, data security incidents related to GenAI had more than doubled.

These are not theoretical exploits; they are happening now, and one of the most common is the inadvertent exposure of sensitive data. For example, a well-meaning product manager, trying to summarize internal research, pastes confidential details about an upcoming product launch into a public LLM prompt. In that instant, sensitive intellectual property has been used to train a third-party model, with no visibility or control.

The risks, though, extend far beyond data leakage. Malicious prompt injection, where an attacker crafts a query to trick AI into performing an unauthorized action, is another growing threat. Imagine an AI-powered customer support bot, accessed through a standard web browser, being manipulated by a malicious prompt to reveal another customer’s personal information. These are serious application-layer attacks that exploit the trusted interface of the browser and put billions of data records at risk.

New architecture of control

To combat these new, browser-borne threats, the enterprise browser itself must become the new architecture of control. This is its new mandate: to evolve from a simple access tool into a sophisticated security platform, providing the deep visibility and granular control required to safely enable the widespread use of AI.

The foundation for this platform begins with a fundamental shift to a zero trust framework that extends to the browser itself — where all activity context is visible. This framework enforces rigorous device posture checks and continuous trust verification before granting access to any application. It means having the power to enforce a new standard of more granular digital hygiene directly at the point of interaction. This includes the ability to dynamically mask sensitive data within prompts, prevent unauthorized screenshots of sensitive data and manage file transfers to block uploads of intellectual property to personal drives. The framework creates a secure workspace within the browser, protecting business applications from web-based threats and compromised endpoints.

For too long, the browser has been the unspoken vulnerability in our security strategies. By transforming it into an intelligent control point, we categorically address this “dark secret.” Securing this critical avenue closes an important security gap and unlocks the full potential of AI. It provides the confidence needed to empower employees, accelerate development, and build the next wave of innovation safely.

The browser goes beyond just being the front door. It is also the foundation for enabling AI with confidence and control. See what the browser can do for you.

Curious about what else Anand has to say? Check out his other articles on Perspectives.

Palo Alto kündigt Cortex AgentiX für sichere KI-Agenten an

Fri, 21 Nov 2025 09:35:02 +0100

Auf der digitale Veranstaltung „Ignite: Whats Next“ kündigt Palo Alto Networks die neue Cortex-AgentiX-Plattform an. Diese soll eine sichere, autonome und agentenbasierte Arbeitswelt ermöglichen. Dazu bekommen Prisma AIRS und Cortex Cloud ein 2.0-Update.

CVE-2025-64764 | withastro up to 5.15.7 cross site scripting

Fri, 21 Nov 2025 09:24:02 +0100

A vulnerability marked as problematic has been reported in withastro astro up to 5.15.7. This vulnerability affects unknown code. Performing manipulation results in basic cross site scripting. This vulnerability was named CVE-2025-64764. The attack may be initiated remotely. There is no available exploit. It is suggested to upgrade the affected component.

Movistar Plus+ emprende la atención al cliente con agentes de IA

Tue, 18 Nov 2025 11:33:59 +0100

Movistar Plus+, la factoría de contenidos del grupo Telefónica que nació en 2015 tras la fusión de las plataformas Canal+ y Movistar TV, comenzó su andadura como un servicio de valor añadido a la oferta de conectividad de la operadora española, pero, desde verano de 2023, comercializa de forma independiente el acceso a su plataforma de pago por suscripción, que alberga series, películas, documentales, programas de entretenimiento y múltiples canales de televisión en directo y bajo demanda. Esta evolución, según Roberto Rodríguez Fernández, director de soporte al cliente de Movistar Plus+, ha propiciado que la compañía aborde la atención a sus consumidores desde un prisma completamente diferente, para lo que se ha apoyado en la inteligencia artificial y, en concreto, en los agentes de IA que facilita la tecnológica Salesforce, que es también su proveedor de software CRM.

“La salida al mercado de forma independiente de Movistar Plus+ no solo nos ha permitido utilizar los datos que tenemos y monetizarlos, sino tener un producto de entrada para presentar toda la cadena de valor del grupo”, aseveró el portavoz en un encuentro con prensa organizado por la propia Salesforce, donde Rodríguez presentó el caso de éxito. El responsable explicó que la plataforma de acceso al contenido de Movistar Plus+ es “un producto digital gestionado por los clientes, con una web ideada para administrar la suscripción”. El proyecto, contó, arrancó con tres canales de contacto con el cliente: un formulario, un correo electrónico y un chatbot que empezaron a implementar en marzo de 2024 dentro de su centro de ayuda.

Este último, tras unos meses en piloto, empezó a funcionar en marzo de este año, convirtiéndose en el primer caso de uso de la plataforma de agentes de IA Agentforce de Salesforce que se implanta en la empresa de Telefónica.

Respuestas automatizadas en milisegundos

El nuevo agente de IA, contó Roberto Rodríguez, es capaz de responder las consultas e incidencias que trasladan los clientes basándose en los artículos de conocimiento de los que consta la plataforma de la factoría de contenidos; aquellas consultas que no es capaz de solventar por su complejidad, dijo el directivo, se las traslada a los profesionales de atención al cliente de Movistar Plus+ para que lo hagan estos.

“Elegimos Salesforce para la gestión del marketing y la atención al cliente, todo enlazado con nuestros portales y con el propósito de tener una foto de 360 grados y en tiempo récord de nuestros clientes”, explicó el portavoz, que relató que la funcionalidad de dicho agente de IA se ha ampliado recientemente —el pasado mes de julio— para ofrecer también respuestas sobre contenidos deportivos utilizando la plataforma de datos nativa del fabricante de CRM (Data Cloud). “Ahora el agente de IA es capaz de responder, por ejemplo, amplia información sobre los próximos partidos que vamos a emitir en nuestra plataforma en cuestión de milisegundos, y lo mejor es que lo hace a cualquier hora”.

El 70% de los profesionales de atención al cliente de Movistar Plus+ ya utilizan los agentes de IA

Rodríguez subrayó que, gracias al uso de la plataforma de agentes de IA, la compañía ahora puede aportar respuestas inteligentes automatizadas a sus clientes. El agente lo hace buscando la información en más de un millón de contenidos y diez planes de TV. “Este proyecto nos ha permitido mejorar significativamente el servicio al cliente; sin duda, el paso de la IA predictiva a la generativa es brutal. Con la IA predictiva no era posible dar una respuesta para cada una de las preguntas del cliente. Eso sí, lo retador de esta nueva tecnología es que, como no siempre contesta lo mismo, hay que garantizar la coherencia en el contenido de la respuesta”.

En este sentido, el portavoz de Movistar Plus+ afirmó que, “mientras con la IA predictiva ante dos preguntas diferentes el cliente podía obtener dos respuestas iguales, con la IA generativa ante dos preguntas iguales, el cliente puede recibir dos respuestas distintas”. Lo positivo de esto, añadió, es que “no da la sensación de que está contestando una máquina, lo que hace que la experiencia del cliente y la calidad de la respuesta que le damos mejore mucho, además, por supuesto, de acelerar la rapidez en dicha respuesta y de poder brindarla a cualquier hora del día o la noche, pues hay que tener en cuenta que muchas de las consultas que recibimos sobre nuestros contenidos son en tiempo de ocio e incluso en nuestra noche, como ocurre con la retransmisión de la gala de los Premios Oscar”.

En la actualidad, añadió el portavoz, los profesionales de soporte al cliente de la compañía gestionan todas las consultas e incidencias que pueden tramitar dentro de su horario de trabajo y, aquellas a las que no llegan, tanto por volumen como porque las reciben fuera de su horario laboral, se gestionan con la tecnología de agentes de Salesforce. “El uso de agentes de IA ha empoderado a nuestros agentes de atención al cliente humanos”, añadió, desvelando que el 70% de los profesionales de atención al cliente de Movistar Plus+ ya utilizan la plataforma de agentes autónomos de Salesforce en lo que define “un win-win entre la empresa y los empleados”.

Rodríguez subrayó la “robustez y sencillez” de la nueva plataforma de agentes de Salesforce, “a pesar de ser un producto nuevo”. Reconoció, no obstante, que disponer del CRM de Salesforce hizo que esta adopción fuera más sencilla.

“El paso de la IA predictiva a la generativa es brutal. Con la primera no era posible dar una respuesta para cada una de las preguntas del cliente, aunque lo retador de la segunda es que, como no siempre contesta lo mismo, hay que garantizar la coherencia en el contenido de la respuesta”

Futuro: agilizar los casos no resueltos, hacer recomendaciones e incorporar la voz

De cara al futuro, el equipo de atención al cliente de Movistar Plus+ trabaja en mejorar la tramitación de los casos no resueltos por parte de los agentes automatizados. “También queremos incorporar nuevas variables, por ejemplo, para que los clientes puedan tramitar una cancelación del servicio y que lo resuelva un agente de IA”.

Al margen de esto, Rodríguez tiene claro que su idea es “abrir el potencial de la plataforma de agentes de Salesforce al resto de canales con los que nos comunicamos con los clientes. Dos tercios de los contactos que nos llegan son a través del canal de datos, pero también recibimos a través del formulario o por mail, y queremos agilizar también estos últimos y usar Agentforce para monitorizar los casos de clientes”.

El objetivo, según el portavoz, es “implantar un modelo en tiempo real que nos permita tener información sobre todo lo que está pasando en lo que respecta a la gestión del cliente y, de cara a un futuro más lejano, queremos que los agentes no solo gestionen, sino que sean prescriptores de nuestra oferta, en función de las variables demográficas y geográficas del cliente que les consulta”. Además, agregó, explorarán la incorporación del canal de voz automatizado que acaba de presentar el pasado mes Salesforce dentro de su propuesta Agentforce.

“El mayor reto de este proyecto —culminó Rodríguez— es “implantar esta tecnología de agentes de IA de forma que sea transparente para el cliente y que éste siga percibiendo la misma calidad de atención que si tratara con él una persona; no obstante, en mi opinión, implantar la automatización garantiza una buena experiencia de cliente”.

CVE-2025-64745 | withastro up to 5.15.5 URL cross site scripting (GHSA-w2vj-39qv-7vh7 / EUVD-2025-175382)

Sat, 15 Nov 2025 23:35:42 +0100

A vulnerability was found in withastro astro up to 5.15.5 and classified as problematic. The affected element is an unknown function of the component URL Handler. The manipulation results in cross site scripting. This vulnerability was named CVE-2025-64745. The attack may be performed from remote. There is no available exploit. It is suggested to upgrade the affected component.

CVE-2025-4618 | Palo Alto Prisma Browser up to 142.15.6.60 sensitive information in memory

Sat, 15 Nov 2025 10:51:45 +0100

A vulnerability categorized as problematic has been discovered in Palo Alto Prisma Browser up to 142.15.6.60. Affected by this vulnerability is an unknown functionality. The manipulation results in cleartext storage of sensitive information in memory. This vulnerability was named CVE-2025-4618. The attack needs to be approached locally. There is no available exploit.

CVE-2025-4617 | Palo Alto Prisma Browser up to 142.15.6.60 on Windows Policy Enforcement improper protection of alternate path

Sat, 15 Nov 2025 10:22:40 +0100

A vulnerability was found in Palo Alto Prisma Browser up to 142.15.6.60 on Windows. It has been rated as problematic. Affected is an unknown function of the component Policy Enforcement Handler. The manipulation leads to improper protection of alternate path. This vulnerability is uniquely identified as CVE-2025-4617. Local access is required to approach this attack. No exploit exists.

CVE-2025-4616 | Palo Alto Prisma Browser up to 142.15.6.60 integrity check

Sat, 15 Nov 2025 10:22:38 +0100

A vulnerability identified as problematic has been detected in Palo Alto Prisma Browser up to 142.15.6.60. Affected by this issue is some unknown functionality. This manipulation causes improper validation of integrity check value. The identification of this vulnerability is CVE-2025-4616. The attack can only be executed locally. There is no exploit available.

CVE-2025-4619 | Palo Alto Cloud NGFW/PAN-OS/Prisma Access Packet unusual condition

Fri, 14 Nov 2025 08:40:47 +0100

A vulnerability identified as problematic has been detected in Palo Alto Cloud NGFW, PAN-OS and Prisma Access. Impacted is an unknown function of the component Packet Handler. This manipulation causes improper check for unusual conditions. This vulnerability is registered as CVE-2025-4619. Remote exploitation of the attack is possible. No exploit is available. You should upgrade the affected component.

기업 보안의 새 변수 ‘MCP 서버’···CISO가 파악해야 할 주요 플랫폼 18개와 주요 위협

Fri, 14 Nov 2025 08:35:57 +0100

MCP(Model Context Protocol)은 AI 에이전트가 데이터 소스에 연결할 수 있도록 해주지만, 초기 버전 표준에는 핵심 보안 기능이 크게 부족했다. 최근 몇 달 동안 이 문제를 해결하려는 다양한 벤더가 등장했으며, 이제야 본격적인 도입이 가능해진 것인지, 여전히 실제 운영에 투입하기에는 이른 단계인지 논의가 이어지고 있다.

핵심 프로토콜 측면에서는 일부 진전이 있었다. 3월에는 OAuth 인증 지원이 추가됐고, 6월에는 오스제로(Auth0), 옥타(Okta), 또는 기업 자체의 ID 관리 시스템과 같은 서드파티 인증 서버 연동 기능도 포함됐다.
또한 MCP 표준 기구는 9월, 악성 MCP 서버가 정상 서버로 위장하는 문제를 해결하기 위해 공식 MCP 레지스트리를 공개했다.

그럼에도 여전히 상당한 보안 취약점이 남아 있다. 예를 들어 인증이 선택 사항으로 남아 있으며, 프롬프트 인젝션, 툴 포이즈닝, 토큰 탈취, 서버 간 공격, 메시지 변조 등 다양한 위협에 노출돼 있다.

에이전트 기반 AI 시스템에서 경쟁사보다 앞서고자 하는 기업은 민감 정보와 기업 비밀이 노출되지 않도록 상당한 보안 작업을 스스로 수행해야 한다.

이와 동시에 최근 몇 달 동안 주요 AI 플랫폼 기업뿐 아니라 핵심 기술업체, 기존 사이버보안 벤더, 그리고 신생 플레이어까지 다양한 기업이 MCP 보안 기능을 강화하며 대응에 나서고 있다.

MCP 서버 활용 유형별 보안 과제

MCP 서버 활용 방식에는 크게 세 가지 유형이 있으며, 각각 고유한 보안 과제가 따른다.

첫 번째는 기업이 자체적으로 관리하는 인프라에 내부 MCP 서버를 구축하고, 내부 데이터나 도구에 접근하도록 설정하는 방식이다. 비교적 위험이 낮은 활용 사례로는 직원이 제품 설명 등 민감하지 않은 문서나 데이터베이스를 AI 에이전트를 통해 검색하는 경우가 있다. 반면 고객 데이터를 다루는 방식은 위험도가 훨씬 높아진다.

두 번째 유형은 기업의 AI 에이전트가 MCP 서버를 통해 외부 데이터 소스나 도구에 접근하는 구조다. 이때는 서버나 데이터 소스가 공격자에 의해 침해될 경우, AI 에이전트가 악성 지시문을 전달받을 수 있다는 점이 주요 위험 요소로 꼽힌다.

세 번째는 내부 MCP 서버가 기업의 데이터나 도구를 외부에 개방하는 형태다. 제품 설명서나 사용자 매뉴얼처럼 위험도가 낮은 정보 제공이라면 문제가 크지 않지만, 일부 MCP 서버가 외부 파트너에게 주문 입력, 송장 제출, 결제 정보 변경 같은 기능까지 허용한다면 위험은 상당히 커진다.

노코드 AI 플랫폼 페퍼밀(PepperMill)의 공동 설립자이자 CEO인 앤 해초풀로스는 MCP 도입을 신중하게 단계적으로 접근해야 한다고 조언한다. 해초풀로스는 “공개된 링크드인 정보를 가져오는 MCP 서버는 비교적 안전하다”며 “반면 금융 거래를 처리하는 MCP는 위험 수준이 훨씬 크다. MCP의 보안 문제가 명확한데도 많은 기업이 지금 고위험 영역까지 빠르게 확장하는 점이 놀라울 정도다. 하지만 누군가는 결국 시도하게 될 것이고, 그 과정에서 취약점이 드러나게 된다”고 말했다.

특히 SaaS 기업을 포함한 많은 기술 기업에게 MCP 서버는 이미 필수 요소로 자리 잡고 있다. 클라우드 컨설팅 기업 올클라우드(AllCloud)의 최고전략책임자 피터 네벨은 “지금은 기다릴 시간이 없다”며 “망설이면 경쟁사가 먼저 MCP 기반 서비스를 제공해 우위를 확보하게 된다”고 전했다.

현재 페이팔, 노션, 허브스폿, 클라우드플레어, 아틀라시안, 슬랙, 깃허브 등 여러 기업이 공식 MCP 서버를 운영하고 있다. 서드파티 MCP 서버 제공업체도 늘고 있으며, 예를 들어 재피어(Zapier)는 8,000개 이상의 애플리케이션에 연결되는 MCP 환경을 지원하고 있다.

벤더가 공식 MCP 서버를 제공하지 않을 경우, 외부 개발자가 API를 활용해 비공식 MCP 서버를 구축하는 사례도 많다. 이미 링크드인, 스포티파이, 이베이, 유튜브, AWS, 질로우 등 다양한 플랫폼을 위한 MCP 서버가 존재하지만, 신뢰 수준은 각기 다르다. 개발자와 파워 유저는 이를 내려받아 AI 에이전트에 연결하고 있지만, 이들 비공식 서버의 출처나 유지관리 주체, 실제 동작 방식이 명확하지 않은 경우도 많다.

펄스MCP(Pulse MCP)에는 6,000개 이상의 서버가, MCP 마켓플레이스 MCP.so에는 1만 6,000개 이상의 서버가 등록돼 있다. 깃허브에서 ‘MCP 서버’를 검색하면 4만 5,000개가 넘는 결과가 나온다.

MCP 보안 플랫폼 선택 시 확인해야 할 요소

기업이 자체 에이전트를 서드파티 MCP 서버에 연결하든, 자체 MCP 서버를 서드파티 에이전트에 개방하든, 혹은 자체 서버와 자체 에이전트를 서로 연동하든, 데이터 유출과 프롬프트 인젝션을 포함한 여러 보안 위협이 발생할 가능성은 항상 존재한다.

따라서 권한 및 접근 허용 여부를 면밀히 점검하고, 세분화된 접근 통제를 구현하며, 모든 활동을 기록해야 한다고 클라우드 컨설팅 기업 올클라우드(AllCloud)의 피터 네벨은 설명했다.

현재 벤더가 제공하는 주요 MCP 보안 도구는 다음과 같다.

• MCP 서버 탐지: 기업 직원들이 손쉽게 MCP 서버를 다운로드해 실행할 수 있어 생산성을 높일 수도 있지만, 새로운 공격 경로가 될 수도 있다. 이에 일부 보안 업체는 기업 환경 곳곳에 숨겨진 그림자 MCP 서버를 탐지하는 스캐닝 서비스를 제공하고 있다.

• 런타임 보호: AI 에이전트와 MCP 서버는 자연어로 통신하기 때문에 프롬프트 인젝션, 데이터 유출 등 다양한 보안 문제가 발생할 수 있다. 여러 MCP 보안 벤더가 이러한 통신을 모니터링해 문제를 탐지하는 런타임 보호 도구를 제공하고 있다.

• 인증 및 접근 제어: MCP 코어 프로토콜은 OAuth를 지원하지만, 이는 출발점에 불과하다. 벤더들은 추가 보안을 위해 제로 트러스트와 최소 권한 원칙 기반의 제어 프레임워크를 함께 제공한다.

• 로깅 및 가시성 확보: 벤더는 MCP 로그를 수집하고 보안 팀에 이벤트나 정책 위반을 알리며, 컴플라이언스 데이터 수집 혹은 기존 보안 인프라와 연계할 수 있는 관측 플랫폼을 제공한다.

MCP 보안 도구를 제공하는 주요 벤더

아래는 MCP 보안 도구를 제공하는 기업들을 세 가지 범주로 나눠 살펴본 내용이다.

하이퍼스케일러 기업

특정 클라우드 플랫폼을 중심으로 기술 전략을 구축한 기업의 경우, 해당 하이퍼스케일러가 제공하는 MCP 보안 도구를 활용하는 것이 가장 손쉬운 출발점이 될 수 있다.

AWS는 7월 자체 에이전트 기반 AI 플랫폼을 공개했다. ‘아마존 베드록 에이전트코어(Amazon Bedrock AgentCore)’에는 MCP를 포함한 다중 프로토콜을 지원하는 게이트웨이, ID 관리 기능, 가시성 도구가 포함된다. AWS는 이어 10월, 제로 트러스트 원칙을 적용한 MCP 서버 보안 가이드라인을 발표했다.

마이크로소프트(MS)는 4월 기본 ‘애저 MCP 서버(Azure MCP Server)’를 공개한 데 이어, 5월 ‘애저 키 볼트(Azure Key Vault)’ 연동을 추가했다. 6월에는 ‘애저 AI 파운드리 에이전트 서비스(Azure AI Foundry Agent Service)’에 MCP 기능을 도입했으며, 8월에는 ‘애저 API 매니지먼트(Azure API Management)’를 통해 MCP 서버가 보안·거버넌스·관측 기능을 갖춘 상태로 리소스에 접근할 수 있도록 지원했다.
10월에는 MCP와 A2A(Agent2Agent) 프로토콜을 모두 지원하고, 프롬프트 인젝션 방지·PII 탐지·멀티 에이전트 가시성 기능을 갖춘 ‘마이크로소프트 에이전트 프레임워크(Microsoft Agent Framework)’를 발표했다.

구글 클라우드는 4월 인증과 관측 기능을 포함한 ‘MCP 툴박스 포 데이터베이스(MCP Toolbox for Databases)’를 발표했다. 9월에는 중앙화된 MCP 프록시 아키텍처를 기반으로 한 MCP 서버 보안 참조 아키텍처를 공개했다. 이 구조는 ‘구글 아이덴티티 플랫폼(Google Identity Platform)’을 통해 OAuth 토큰을 발급·검증하고, ‘모델 아머(Model Armor)’로 프롬프트 인젝션·탈출(jailbreak)·민감 정보 포함 여부를 점검하며, ‘시크릿 매니저(Secret Manager)’를 사용해 API 키나 민감 설정값을 안전하게 저장하도록 설계됐다.
또한 ‘아티팩트 레지스트리(Artifact Registry)’를 활용해 MCP 서버 이미지를 저장하고 배포 전 취약점을 스캔할 수 있다.

구글은 MCP 서버 간 측면 이동 위험을 줄이기 위해 네트워크 단위의 보안 통제를 적용할 것을 권고한다. 마지막으로 구글의 ‘시큐리티 커맨드 센터(Security Command Center)’는 무단 접근 및 데이터 반출 시도를 탐지할 수 있다.

주요 기술 기업

클라우드플레어(Cloudflare): 클라우드플레어는 기업이 모든 MCP 연결을 중앙에서 관리하고, 보안을 적용하며, 모니터링할 수 있는 ‘MCP 서버 포털(MCP Server Portals)’을 공개했다. 이 기능은 클라우드플레어의 SASE 플랫폼인 ‘클라우드플레어 원(Cloudflare One)’에 포함된다.

팔로알토네트웍스(Palo Alto Networks): 팔로알토네트웍스는 6월 ‘프리즈마 에어스 MCP 서버(Prisma AIRS MCP Server)’를 선보였다. 이 제품은 AI 에이전트와 MCP 서버 사이에 위치해 데이터 내 악성 콘텐츠를 탐지하고, 프롬프트 인젝션 공격은 물론 웹·DNS 기반 공격으로부터도 보호한다. 또 다른 도구인 ‘코텍스 클라우드 WAAS(Cortex Cloud WAAS)’의 MCP Security는 네트워크 경계에서 MCP 통신을 분석해 악성 활동을 식별한다.

센티넬원(SentinelOne): 센티넬원의 싱귤래리티 플랫폼(Singularity Platform)은 MCP 상호작용 체인 전반에 대한 가시성을 제공하며, 경보 및 자동화된 사고 대응 기능을 지원한다. 로컬과 원격 MCP 서버 모두를 대상으로 한다.

VM웨어(VMware): 지난 8월 VM웨어의 모회사 브로드컴은 ‘브이엠웨어 클라우드 파운데이션(VMware Cloud Foundation)’이 MCP 서버를 포함한 에이전트 기반 워크플로우에 대해 보안을 강화한다고 발표했다.

스타트업

어큐비티(Acuvity): 어큐비티는 최소 권한 실행, 불변 런타임, 지속적 취약점 스캔, 인증, 위협 탐지 기능을 적용해 MCP 서버 보안을 강화한다.

악토(Akto): API 보안 기업 악토는 6월 MCP 전용 보안 솔루션을 출시하며, MCP 서버 보호에 특화된 최초의 전용 보안 제품이라고 소개했다. 이 솔루션은 기업 내부에 배포된 MCP 서버를 찾는 디스커버리 도구, 보안 테스트 도구, 모니터링 및 위협 탐지 기능을 포함한다.

인베리언트 랩스(Invariant Labs): 이들의 오픈소스 도구 ‘MCP-스캔(MCP-Scan)’은 MCP 서버의 정적 분석과 실시간 모니터링을 수행해 툴 포이즈닝, 러그풀, 프롬프트 인젝션을 탐지한다. 상용 제품 ‘인베리언트 가드레일즈(Invariant Guardrails)’는 AI 에이전트와 MCP 서버 사이에서 프록시로 동작하며 각종 MCP 보안 위협을 차단하고, PII의 외부 이메일 전송 금지와 같은 정책 적용을 지원한다.

재블린(Javelin): 재블린의 ‘AI 시큐리티 패브릭(AI Security Fabric)’ 플랫폼은 위험한 MCP 서버를 스캔하거나, 에이전트 도구·데이터 요청을 차단 또는 검토하도록 요구하는 기능을 제공한다. MCP 가드레일은 실시간으로 비정상 호출과 악성 입력을 막아 프롬프트 인젝션과 데이터 유출을 방지한다.

라쏘 시큐리티(Lasso Security): 라쏘 시큐리티는 오픈소스 MCP 게이트웨이를 제공하며, MCP 서버 구성·라이프사이클 관리와 MCP 메시지 내 민감 정보 정제를 지원한다.

MCP토털(MCPTotal): MCP토털은 안전한 샌드박스 환경에서 MCP 서버를 운영·관리·모니터링할 수 있는 허브를 제공한다. 또한 내부·외부 MCP 서버와 상호작용하는 AI 워크플로우를 보호하는 게이트웨이와 AI 도구 사용 정책을 모니터링·강제하는 거버넌스 도구도 포함한다.

노마(Noma): 노마가 최근 공개한 ‘AI 에이전트 시큐리티(AI Agent Security)’는 MCP 연결 탐지, 취약점 스캔, 접근 정책 집행, 실시간 프롬프트 가드레일, 감사 추적 기능을 제공한다.

오봇(Obot): 오픈소스 기반 ‘오봇 MCP 게이트웨이(Obot MCP Gateway)’는 MCP 서버 관리, 보안 접근 정책 정의, 사용·컴플라이언스 추적 기능을 지원한다.

오퍼런트(Operant): 오퍼런트 MCP 게이트웨이는 MCP 도구를 자동 카탈로그화하고 AI 에이전트를 탐지하며, 에이전트와 MCP 서버 간 트래픽을 추적해 운영 사각지대를 제거한다. 또한 툴 포이즈닝, 프롬프트 탈출(jailbreak), 무단 접근 등 위협을 식별하고, 데이터 유출을 방지하며, 기업 전반에서 중앙화된 에이전트·도구 거버넌스를 구축할 수 있다.

솔로(Solo): 솔로는 8월 ‘에이전트 게이트웨이(Agent Gateway)’를 대폭 개편해 MCP와 A2A 프로토콜을 지원하도록 했다. 악성 프롬프트 및 데이터 유출 차단, 강력한 인증 적용, 모든 상호작용 로그·추적의 중앙화가 가능해졌다.

텔레포트(Teleport): 텔레포트의 ‘시큐어 MCP(Secure MCP)’는 인프라 ID 플랫폼 내에서 사람·머신·워크로드·디바이스·AI 정체성을 통합 관리하도록 돕는다. 텔레포트의 MCP 보안 솔루션은 제로 트러스트 및 최소 권한 원칙 기반의 ID·접근 제어·거버넌스·감사 기능을 제공한다.
dl-ciokorea@foundryco.com

Palo Alto PAN-OS Flaw Lets Attackers Force Firewall Reboots via Malicious Packets

Fri, 14 Nov 2025 06:51:14 +0100

Palo Alto Networks has disclosed a denial-of-service vulnerability in its PAN-OS software that allows attackers to force firewalls into unexpected reboots using specially crafted network packets. The flaw, tracked as CVE-2025-4619, affects multiple versions of PAN-OS running on PA-Series and VM-Series firewalls, as well as Prisma Access deployments. The vulnerability enables unauthenticated attackers to trigger […]

The post Palo Alto PAN-OS Flaw Lets Attackers Force Firewall Reboots via Malicious Packets appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

CVE-2025-64525 | withastro up to 5.15.4 Request Header x-forwarded-proto/x-forwarded-port server-side request forgery (GHSA-hr2q-hp5q-x767 / EUVD-2025-175298)

Thu, 13 Nov 2025 18:54:17 +0100

A vulnerability has been found in withastro astro up to 5.15.4 and classified as critical. Affected by this issue is some unknown functionality of the component Request Header Handler. This manipulation of the argument x-forwarded-proto/x-forwarded-port causes server-side request forgery. This vulnerability is tracked as CVE-2025-64525. The attack is possible to be carried out remotely. No exploit exists. The affected component should be upgraded.

The speed of innovation: Leading in a brave new era of AI-powered creation

Wed, 12 Nov 2025 16:05:19 +0100

I have had a front-row seat to some of the most profound technological shifts of the last two decades. I witnessed the rise of the cloud and mobile, watching as they rewired the fundamentals of how we work and connect. Later, I saw those foundations become the bedrock of daily life for billions of users. Each era has had its own cadence of change, its own rhythm of disruption.

None of it prepared me, though, for the sheer velocity of artificial intelligence (AI). The pace of AI is a fundamentally different force than anything we’ve seen before. While its evolution is rewriting the rules of creation, collaboration, and competition, the speed itself is forcing a new, urgent conversation about the very foundation of secure innovation.

The experiment: A campaign at the speed of light

This challenge of innovating securely (and at this new velocity) became intensely personal for my team and me recently. We set out to launch a new brand campaign for Prisma AIRS called “Be a Genius,” celebrating the spirit of innovation. We had an audacious goal: to produce the campaign’s core creative — a series of videos honoring innovators from the past — using nothing but the very technology we aim to protect: generative AI.

This was more than a creative choice; it was, in a way, a mission statement. The process of creating the campaign had to mirror the product’s core purpose: securing AI innovation. For the first time in my career, we were not just using a new tool. We were partnering with an intelligence that was evolving faster than our project plan.

The overnight leap

The most stunning proof of this came early in the process. Our creative team hit a wall one day, struggling with a specific visual glitch that the AI models simply could not execute. The next morning, they came back to the same prompt, and the problem was gone. The model had been updated overnight by its developers, and the capability we needed now existed. In another instance, a completely new video tool was released, opening additional ways to achieve our vision.

These were the moments the ground shifted beneath our feet. For a leader, this is both thrilling and profoundly unsettling. How do you build a strategy, plan a budget, or lead a team when your most fundamental tools have a half-life measured in days? This is the new reality of innovation. It is happening on a daily, hourly, and even minute-by-minute basis. The creative cycle, once measured in months, is now measured in hours. This personal experience became a key insight, a clear sign of a massive industry-wide paradigm shift.

From a marketing story to a market shift

It cannot be overstated: AI’s momentum is disrupting every aspect of how we work. The rules of creation have changed. The ability to generate hundreds of variations of an image or video clip in minutes transforms creative iteration from a slow process of refinement into an explosive burst of possibility.

The rules of collaboration have also changed. The creative director’s role shifts from directing a human team to becoming a prompt engineer and curator for an AI, with the AI acting as a third collaborator in the room.

And the rules of competition have changed. The ability to launch a high-quality campaign in a fraction of the traditional time allows a business to react to market shifts with unprecedented agility.

This explosion of AI-driven creativity is happening in every function across every industry. Therefore, the new mandate for the CIO is to move beyond supporting isolated AI projects and instead build a secure, unified foundation that can empower this enterprise-wide wave of innovation.

The foundation for innovation

This brings us to the ultimate question: How do we unleash this incredible wave of innovation safely, securely, and responsibly?

My entire career has been a lesson in the mechanics of technology and trust. I believe the answer lies in a single, core philosophy: that true innovation is about building capabilities that earn and maintain the trust of customers, partners, and employees. This requires innovation to be secure by design, which is the ultimate enabler of sustainable growth and the mission that brought me to Palo Alto Networks.

We call this philosophy “Deploying Bravely.” It is a commitment to enabling innovation by providing that secure foundation. We deployed our “Be a Genius” campaign bravely, using the very technology we aim to protect to tell a story of what’s possible.

And this is how we will build the future: not just with speed, but with the confidence that comes from securing AI by design. Because in this new era, the boldest move is to deploy bravely.