Blahalla

Microsoft fixes Windows Autopatch bug installing restricted drivers

www.bleepingcomputer.com · 2 months ago

A bug in Windows Autopatch caused driver updates that administrative policies had restricted to be deployed on a limited subset of Autopatch managed Windows 11 client devices in the European Union, affecting versions 25H2, 24H2 and 23H2. Impacted systems installed recommended driver updates without administrator approval and experienced unexpected behavior including reboots and, in some cases, system failures depending on the drivers installed. Microsoft applied a service side fix to resolve the issue and stated that no client side updates or further action from customers are required.
Hackers Claim 11M Files Stolen From Foxconn, Supplier to Apple and Nvidia

www.techrepublic.com · 2 months ago

Foxconn confirmed that some of its North American factories suffered a cyberattack after the ransomware group Nitrogen claimed to have stolen 11 million files, reportedly about eight terabytes, linked to projects for Apple, Nvidia, Google, Dell, and Intel. The leaked cache is said to include confidential instructions, project documentation, and technical drawings that could expose how components are built and integrated, raising risks of counterfeit production and competitive leakage. Foxconn said its cybersecurity team activated response measures and that affected factories are resuming normal production while declining to confirm whether customer information was taken.
Canvas Breach Hackers Reach Deal After Claiming 275M Records Stolen

www.techrepublic.com · 2 months ago

Hackers behind the Canvas breach claimed they stole data tied to nearly nine thousand schools and 275 million people and reached a deal with Canvas parent company Instructure to stop further publication or extortion. Instructure said the stolen data was returned and that it received digital confirmation that remaining copies were destroyed, while acknowledging there is no way to verify every copy was deleted and not confirming whether a ransom was paid. Exposed fields included usernames, email addresses, course names, enrollment information, and messages, while core learning data such as course content, submissions, and credentials were not compromised, and the company identified and temporarily disabled an exploited vulnerability in its Free for Teacher support tickets.
Microsoft's MDASH AI System Finds 16 Windows Flaws Fixed in Patch Tuesday

thehackernews.com · 2 months ago

A new multi model artificial intelligence system called MDASH is designed to autonomously discover, validate, and prove exploitable defects in complex codebases by orchestrating more than one hundred specialized AI agents across an ensemble of frontier and distilled models and distinct pipeline stages. MDASH is being tested by some customers in a limited private preview and uses auditor, debater, and prover agent roles to build threat models, flag candidate issues, validate findings, group semantically equivalent results, and produce validated, proven findings. The system reportedly identified sixteen vulnerabilities fixed in the May 2026 Patch Tuesday release, including CVE 2026 33824, a double free in ikeext.dll with a CVSS score of 9.8 that can lead to remote code execution, and CVE 2026 33827, a race condition in tcpip.sys affecting IPv6 and IPSec with a CVSS score of 8.1 that can also enable remote code execution.
What happens when China’s AI catches up to Mythos?

www.csoonline.com · 2 months ago

The Trump Xi summit opening in Beijing this week includes an unprecedented agenda item on artificial intelligence that can autonomously find and exploit vulnerabilities in major operating systems and browsers. Anthropic's Mythos Preview has demonstrated the ability to discover zero day vulnerabilities that survived decades of human review, prompting Project Glasswing and one hundred million dollars in usage credits to give defenders early access while the model risks leaking to unauthorized users. Recent data show the US performance lead over Chinese models has narrowed substantially, China leads in AI patents and research output, and the flow of AI talent to the United States has dropped sharply, eroding Washington's strategic buffer. Policymakers are weighing deconfliction channels, guardrails, and testing requirements for frontier cyber capable models even as private companies make unilateral access decisions, and experts warn diffusion of these tools to nonstate and criminal actors could sharply lower the cost and complexity of attacks.
Webinar Today: ROI for Cyber-Physical Security Programs

www.securityweek.com · 2 months ago

There is a live webinar on May 13, 2026 at 1 PM Eastern focused on measuring Return on Security Investment for cyber physical systems, hosted by SecurityWeek and Claroty. It explains that in cyber physical systems a single hour of downtime can exceed an entire annual security budget and teaches how to quantify impacts from unplanned downtime, regulatory fines, and equipment damage to translate technical risk into financial terms. It outlines strategies for presenting CPS projects to finance and operations and argues that dedicated OT security reduces manual audit hours and streamlines asset management, positioning OT teams as resilience drivers rather than cost centers.
Azerbaijani Energy Firm Hit by Repeated Microsoft Exchange Exploitation

thehackernews.com · 2 months ago

A China affiliated threat actor conducted a multi wave intrusion against an Azerbaijani oil and gas company between late December 2025 and late February 2026, repeatedly exploiting the same vulnerable Microsoft Exchange Server entry point. Bitdefender attributed the activity with moderate to high confidence to FamousSparrow also known as UAT 9244 and observed the deployment of Deed RAT also called Snappybee on December 25, 2025, TernDoor in late January and early February 2026, and a modified Deed RAT in late February 2026. Initial access was achieved via the ProxyNotShell chain, operators deployed web shells and an evolved DLL side loading technique that abused a legitimate LogMeIn Hamachi binary to load a malicious library, conducted lateral movement to broaden access, and repeatedly returned until the original vulnerability was patched and credentials rotated.
LatAm Vibe Hackers Generate Custom Hacking Tools on the Fly

www.darkreading.com · 2 months ago

There are two threat campaigns named Shadow-Aether-040 and Shadow-Aether-064 that heavily leveraged AI agents to conduct attacks across the full kill chain, dynamically generating custom hacking tools and scripts to support scanning, exploitation, and persistence. Shadow-Aether-040 compromised six government entities in Mexico between December 27, 2025 and January 4, 2026 and used an agentic command line interface that sent prompts to Anthropic's Claude, employing Shodan and VulDB to find vulnerabilities, deploying web shells, and likely creating an AI-assisted Python backdoor called implantehttp. Shadow-Aether-064 targeted financial organizations in Brazil, used similar AI-driven tooling to create custom backdoors capable of reverse tunnels and leveraged tools such as ProxyChains, SOCKS5, Chisel, CrackMapExec, Impacket, and Neo-ReGeorg to maintain access. Because these tools vary with each execution and evade signature-based detection, defenders are advised to enforce timely patching, implement zero trust access controls, and maintain comprehensive monitoring to reduce the effectiveness of AI-augmented campaigns.
China's 'FamousSparrow' APT Nests in South Caucasus Energy Firm

www.darkreading.com · 2 months ago

China-linked FamousSparrow targeted an Azerbaijani oil and gas company in the South Caucasus, marking the group’s first observed operations in Azerbaijan. The campaign ran from late December until the end of February and used a novel two-stage DLL sideloading mechanism that gated payload execution behind a specific application execution path to evade analysis and install remote access tools. Attackers gained initial access through a vulnerable Microsoft Exchange server, and the victim’s failure to patch allowed FamousSparrow to return for at least two subsequent intrusions, while operational technology networks were not affected.
Foxconn confirms cyberattack claimed by Nitrogen ransomware gang

www.bleepingcomputer.com · 2 months ago

Foxconn says some North American factories suffered a cyberattack and are resuming normal production after its cybersecurity team activated response measures. The Nitrogen ransomware operation claims to have stolen eight terabytes of data and more than eleven million documents containing confidential instructions, projects, and drawings belonging to customers including Apple, Intel, Google, Nvidia, and AMD. Security researchers report Nitrogen first surfaced in 2023 with a malware loader, later developed a ransomware strain using leaked Conti 2 builder code, and Coveware found a coding mistake in its ESXi malware that causes files to be encrypted with the wrong public key and become irreversibly corrupted. Foxconn has previously been targeted by ransomware groups including LockBit and DoppelPaymer in earlier incidents.
73 Seconds to Breach, 24 Hours to Patch: The Case for Autonomous Validation

www.bleepingcomputer.com · 2 months ago

There are reports that Anthropic’s Mythos model wrote one hundred eighty one working Firefox exploits in its first fourteen days inside a gated preview and surfaced thousands of zero days across major operating systems and browsers, with over ninety nine percent of those findings still unpatched. There are examples of AI enabled campaigns using known vulnerabilities and misconfigurations that hit two thousand five hundred sixteen devices across one hundred six countries in minutes, and the median time from a CVE publication to a working exploit has collapsed to roughly ten hours in 2026. There are measurements showing an attacker timeline that can complete a compromise in seventy three seconds while organizational patching and remediation processes can take around twenty four hours because time is lost in handoffs between tools and teams rather than inside any single product. There are three recommended pillars of cyber resilience Identify, Protect, and Validate, and defenders are urged to adopt continuous autonomous validation that combines breach and attack simulation with autonomous penetration testing to run the remediation loop at machine speed.
Microsoft’s new AI system finds 16 Windows flaws, including four critical RCEs

www.csoonline.com · 2 months ago

Microsoft unveiled a new AI driven vulnerability discovery system called MDASH that found 16 previously unknown Windows vulnerabilities, including four critical remote code execution flaws that were patched in the May 12, 2026 Patch Tuesday release. Two of the critical issues are tracked as CVE-2026-33827, a remote unauthenticated use after free in the Windows IPv4 stack reachable via specially crafted packets carrying the Strict Source and Record Route option, and CVE-2026-33824, a pre authentication double free in the IKEEXT service affecting RRAS VPN, DirectAccess, and Always On VPN, while two other critical flaws affected Netlogon and the Windows DNS Client with CVSS scores of 9.8. MDASH orchestrates over one hundred specialized AI agents across multiple frontier and distilled models to scan source code, validate findings, and construct triggering inputs before human review, and Microsoft plans a private preview for enterprise customers in June 2026. Analysts warn that agentic AI driven discovery will accelerate both defensive and offensive operations and that vulnerability management is shifting toward continuous AI assisted discovery and remediation, requiring stronger governance and remediation discipline.
Government to Scrutinize Instructure Over Canvas Disruption, Data Breach

www.securityweek.com · 2 months ago

There was an initial intrusion detected on April 29, 2026 that disrupted Canvas tools relying on API keys and prompted a restoration on May 3, 2026 before a second intrusion on May 7, 2026 that defaced login portals and forced the platform into maintenance mode. The extortion group ShinyHunters claimed to have stolen roughly 3.65 terabytes of data and asserted it included personal information for about 275 million students, teachers, and staff across nearly 9,000 institutions, while the company said exposed fields included names, email addresses, course and enrollment data and messages but not passwords, financial information, or government identifiers. The House Committee on Homeland Security has requested a briefing to probe the circumstances of both intrusions, the nature and volume of data accessed, the adequacy of containment and notifications, and coordination with federal law enforcement and CISA, and the company says it reached an agreement with the actor to recover and delete the stolen data and has temporarily disabled Free For Teacher accounts pending a security review.
Palo Alto Networks bets on identity security for autonomous AI with Idira launch

www.csoonline.com · 2 months ago

Palo Alto Networks has launched Idira, an identity security platform designed to secure human users, machine identities, and AI agents as enterprises adopt autonomous AI. Idira operates as a single control plane across human, machine, and agent identities, continuously discovering identities across SaaS, cloud, and developer environments and enriching each with ownership, access, and active permission context. The platform applies dynamic privilege elevation when an agent needs to execute a task and instantly revokes privileges afterward, building on Palo Alto Networks integration of CyberArk to address gaps in legacy IAM and PAM systems. Analysts caution that multilayered security remains necessary and recommend least privilege, multi factor authentication, credential rotation, continuous monitoring, prompt filtering to prevent prompt injection, and adversarial testing and agentic red teaming before deploying autonomous systems.
Microsoft says some users can't install Office on Windows 365 devices

www.bleepingcomputer.com · 2 months ago

Some customers are unable to download and install Microsoft Office on Windows 365 Cloud PCs after a recent service update introduced a configuration change. Microsoft first acknowledged the problem tracked under WP1309017 on Tuesday, May 12, 2026, and is developing a fix that will be validated and deployed with a next update scheduled for Friday, while full remediation timing remains unclear. The incident is labeled as an advisory indicating limited scope, any Windows 365 user attempting to install Office is potentially affected, and affected users can manually download Office from the Microsoft 365 page while the fix is rolled out.
[Webinar] How Modern Attack Paths Cross Code, Pipelines, and Cloud

thehackernews.com · 2 months ago

Most application security tools act like smoke alarms that trigger on trivial issues, generating so many alerts that teams eventually ignore them. Experts from Wiz and Okta and GitLab will present a webinar explaining how attackers chain tiny flaws into a Lethal Chain to reach data and will show how to detect and break that chain, with registration available for the briefing.
A year of Apple Security Bounty research — 16 closed findings, full disclosure

stuart-thomas.com · 2 months ago

A security research blog publishes responsible disclosure writeups, methodology notes, and technical essays based on Apple Security Bounty submissions filed during 2024 and 2025, with sixteen reports now closed. Reports document confirmed fixes, vendor rejections, false positive proof of concept findings, and formal retractions used to distinguish design choices from security defects. Notable technical items include a patched mDNSResponder primary trust check bypass tracked as CVE-2025-24129 and a DNS over TLS hostname validation issue described with CWE-297 and a CVSS score of 8.1.
ClickFix finds a backup plan in PySoxy proxy chains

www.csoonline.com · 2 months ago

ClickFix, a one-shot social engineering technique that tricks victims into executing malicious fixes, now includes persistence through scheduled tasks, PowerShell command and control, and abuse of the PySoxy proxy tool. An intrusion observed in April established an initial PowerShell C2 channel and then deployed PySoxy to create a second encrypted proxy channel that preserves access if the PowerShell connection is blocked. Defenders are advised to isolate affected hosts, review recurring scheduled tasks, and hunt for Python artifacts and proxy style command lines containing ssl, remote ip, remote port, SOCKS, or pyc execution.
Most Remediation Programs Never Confirm the Fix Actually Worked

thehackernews.com · 2 months ago

There is more visibility into environments but security teams frequently do not confirm that fixes actually eliminated the exposure, with Mandiant M-Trends 2026 estimating mean time to exploit at negative seven days and the Verizon 2025 DBIR reporting a median time to remediate edge device vulnerabilities of 32 days. Organizational handoffs, competing priorities, and incomplete or partial fixes often turn true remediation into ticket closure without risk removal, and AI accelerated exploit development raises the cost of that false confidence. The recommended model consolidates validated findings into fix actions, routes them to confirmed owners, enforces SLAs and escalations, and crucially performs post fix revalidation so teams measure risk closed rather than tickets closed.
716,000 Impacted by OpenLoop Health Data Breach

www.securityweek.com · 2 months ago

Hackers stole the personal information of 716,000 individuals during a January 2026 intrusion of telehealth platform OpenLoop Health, with the company detecting unauthorized access on January 7, 2026 and reporting that intruders had access between January 7 and January 8, 2026. Compromised data included names, addresses, email addresses, birth dates, and medical data, while the incident did not involve access to electronic health records, Social Security numbers, or financial account information. OpenLoop disclosed the incident to authorities in March 2026 and added it to the US Department of Health and Human Services breach portal in May 2026, and the company said it terminated the access, engaged external cybersecurity specialists, improved security controls, coordinated with law enforcement, and offered affected individuals one year of free identity and credit monitoring. A threat actor claimed earlier that 1.6 million records were stolen, but OpenLoop has not identified the responsible actor or reported any known misuse of the stolen information.
OpenAI’s GPT-5.5 is as Good as Mythos at Finding Security Vulnerabilities

www.schneier.com · 2 months ago

The UK's AI Security Institute evaluated GPT-5.5 and found it comparable to Anthropic's Claude Mythos at finding security vulnerabilities, with GPT-5.5 achieving a 71.4 percent average pass rate on expert-level tasks versus 68.6 percent for Mythos in the Institute's benchmark. GPT-5.5 solved a complex reverse-engineering challenge in about ten minutes at an API cost of approximately one dollar seventy three cents and completed a 32-step simulated corporate network attack end-to-end in two of ten attempts, making it the second model to do so. A separate analysis found that a smaller, cheaper model can match this performance when given more prompt scaffolding from the user.
CISA’s AI SBOM guidance pushes software supply-chain oversight into new territory

www.csoonline.com · 2 months ago

CISA and G7 cyber agency partners released minimum elements for an AI software bill of materials that extend traditional SBOM concepts to document models, datasets, software components, providers, licenses, and other dependencies. The guidance is not mandatory and is expected to evolve, but it is intended to give security leaders procurement and vendor risk management tools to demand transparency about model provenance, training data sources, third party foundation models, APIs, licensing, security testing, update cycles, runtime monitoring, and shared responsibility boundaries. Experts warn that AI SBOMs provide visibility but not assurance because they reflect vendor disclosures rather than proving system behavior in production, leaving gaps around undisclosed dependencies, evolving model behavior, hallucinations, and prompt usage. For higher risk deployments, organizations should supplement AI SBOMs with evidence on data flows, security architecture, model behavior testing including red teaming and prompt injection assessments, privacy impact analyses, logging, and incident response plans.
Microsoft Patches 138 Vulnerabilities, Including DNS and Netlogon RCE Flaws

thehackernews.com · 2 months ago

Microsoft released patches for 138 security vulnerabilities across its product portfolio, none listed as publicly known or under active attack, with 30 rated Critical, 104 Important, three Moderate, and one Low, and with flaw types including 61 privilege escalations, 32 remote code execution, 15 information disclosure, 14 spoofing, eight denial of service, six security feature bypasses, and two tampering issues. High severity fixes include a Windows DNS heap based buffer overflow CVE-2026-41096 and a Windows Netlogon stack based buffer overflow CVE-2026-41089, alongside other critical flaws CVE-2026-42826, CVE-2026-33109, CVE-2026-42898, CVE-2026-42823, CVE-2026-33823, CVE-2026-35428, CVE-2026-40379, CVE-2026-40402, CVE-2026-41103, CVE-2026-33117, CVE-2026-42833, CVE-2026-33844, and an AMD CPU isolation issue CVE-2025-54518. Organizations are advised to apply the updates, rotate Windows Secure Boot certificates to 2023 counterparts before the June 26, 2026 deadline to avoid boot level failures, and prioritize patching and risk triage as AI assisted discovery via Microsofts MDASH system helped surface multiple issues.
Microsoft Patches Critical Zero-Click Outlook Vulnerability Threatening Enterprises

www.securityweek.com · 2 months ago

There is a critical zero click Outlook vulnerability tracked as CVE-2026-40361 that is a use after free in a DLL shared by Word and Outlook and can be exploited for remote code execution without any user interaction. The researcher credited with reporting the flaw created a proof of concept and warned that the bug bypasses enterprise firewalls and is triggered when emails are read or previewed, making mitigation difficult aside from rendering messages in plain text. Microsoft rated exploitation as more likely, issued a Patch Tuesday fix, and the flaw has been compared to a 2015 Outlook vulnerability tracked as CVE-2015-6172 known as BadWinmail.
Fortinet, Ivanti Patch Critical Vulnerabilities

www.securityweek.com · 2 months ago

Fortinet and Ivanti patched 18 vulnerabilities across their product portfolios, including three critical severity bugs. Fortinet published 11 advisories covering vulnerabilities including critical code execution defects CVE-2026-44277, an improper access control issue in FortiAuthenticator exploitable remotely without authentication via crafted requests, and CVE-2026-26083, a missing authorization flaw in FortiSandbox and related web interfaces that could allow remote unauthenticated HTTP requests to achieve code execution, and it also fixed CVE-2025-53844, a high severity out of bounds write in the FortiOS capwap daemon that requires control of an authenticated FortiAP FortiExtender or FortiSwitch to exploit. Ivanti published four advisories for seven defects, the most severe being CVE-2026-8043, an external control of file name vulnerability in Xtraction that can be exploited remotely to read sensitive files and write arbitrary HTML to a web directory, and it also patched multiple high severity flaws including SQL injection, incorrect permissions assignment, an OS command injection and a race condition that could lead to privilege escalation or remote code execution. Both vendors said they are not aware of any of the patched vulnerabilities being exploited in the wild.
ClickFix Evolves Using Decade-Old Open-Source Python SOCKS5 Proxy

gbhackers.com · 2 months ago

A ClickFix campaign has evolved to use PySoxy, a decade-old open-source Python SOCKS5 proxy, establishing an encrypted proxy channel alongside an in-memory PowerShell command-and-control agent and scheduled task persistence. The chain begins when a user runs an obfuscated PowerShell command from a compromised site, which stages a lightweight PowerShell RAT that polls for commands every few seconds and creates a scheduled task that relaunches the script roughly every 40 minutes. After reconnaissance using built-in Windows tools, attackers deploy PySoxy as compiled Python bytecode into ProgramData and run it to tunnel encrypted traffic over port 443, creating a redundant access path that can evade network-only containment. Defenders are advised to isolate affected hosts, review scheduled tasks, analyze ProgramData for staged scripts and Python artifacts, and hunt for proxy-style Python command lines rather than treating blocked connections as full containment.
AI-Coded App Vulnerability Checklist - 33 LLM-specific items with detection methods

z-ny.com · 2 months ago

An open source checklist catalogs 258 vulnerabilities common in applications built with AI coding assistants, organized into 17 categories and annotated with detection methods and severity ratings. One notable category contains 33 items specific to large language model integration, including model control plane tool poisoning where a malicious tool provider injects instructions, memory poisoning where attacker content stored in long term memory is later executed, cross agent prompt injection when outputs are passed between agents without sanitization, and insecure agent handoff where full API keys or tokens are shared instead of scoped credentials. A companion prompt runs all 258 checks against a codebase using capable language model CLIs and returns file paths, line numbers, code snippets and specific remediation guidance. The checklist is released under the Apache 2.0 license to allow free use and contributions.
Notable Researchers Join $4 Billion Effort to Build Self-Improving A.I.

www.nytimes.com · 2 months ago

A London-based startup called Recursive Superintelligence has raised at least 500 million dollars at a four billion dollar valuation to build AI systems that can autonomously optimize and improve their own research and training pipelines. The company was founded in late 2025 by former DeepMind, OpenAI and Salesforce researchers including Richard Socher and Tim Rocktaschel, and the funding round was led by GV with participation from Nvidia. Investors and analysts say the firm aims to automate evaluation, data selection, training and research prioritization so models can iteratively improve themselves, a direction that could accelerate capability gains while raising questions about oversight and safety.
Tired of Hacked Passwords? Help Is on the Way.

www.nytimes.com · 2 months ago

There are built-in credential managers from Apple, Google and other vendors that can generate, store and sync passwords and passkeys to help secure online accounts. Passkeys rely on device-bound public key cryptography to replace passwords for many services, reducing phishing and credential-reuse attacks while adoption grows but remains uneven across sites and devices. As adoption continues, practical advice is to enable passkeys for core accounts where available, keep a trusted password manager for accounts that still use passwords, and set up secure syncing or recovery methods to avoid losing access.
Andreessen Horowitz Is Playing Politics Like No Other

www.nytimes.com · 2 months ago

Andreessen Horowitz is the biggest known spender in the 2026 campaign cycle, channeling tens of millions into pro AI super PACs and independent expenditures to support candidates aligned with lighter AI regulation. Marc Andreessen and Ben Horowitz have contributed large sums, helping push the main pro AI political network past fifty million dollars and coordinating funding alongside other tech figures including OpenAI president Greg Brockman. The spending complements the firm’s broader push into Washington through increased lobbying, PAC activity, and targeted donations aimed at shaping AI policy and regulatory outcomes.
2026 CSO Award winners showcase business-enabling cyber innovation

www.csoonline.com · 2 months ago

There are 64 CSO Award winners recognized for security projects that deliver business value and innovation, and six exemplars are profiled that emphasize trends such as zero trust, AI and automation, and gamification. Copart deployed an automated, adaptive security awareness program with role based phishing simulations and gamification that delivered more than 202,000 simulations in a year and raised simulation reporting rates from roughly 17 to 24 percent to between 55 and 60 percent. Hawaii Medical Service Association launched a Zero Trust Data Governance Initiative in 2024 to eliminate confidential member information from nonproduction environments, using an AI enabled data masking suite from Perforce Delphix to de identify more than 50 terabytes of data and automate masked data refreshes. Other highlighted efforts include Hensel Phelps automating over 1,250 hours of manual security work through Project SAM, K and N Engineering shifting left with a code to cloud security transformation to prevent vulnerable code from being deployed, McDonald’s unifying security across more than 100 markets with the Securing the Arches program, and MISO building STRIKE to quantify detection and protection effectiveness against real world adversary techniques.
Elon Musk’s anonymous online BFF spreads his ideas and attacks his enemies

www.washingtonpost.com · 2 months ago

An anonymous X account called XFreeze rose from zero followers in late 2024 to become the account Elon Musk engaged with more than any other in 2026, with Musk replying to or sharing its posts more than 400 times this year. Musk amplified XFreeze posts that praised his companies and attacked his legal opponents in the lawsuit against OpenAI, including posts the judge cited when asking him to refrain from posting about the trial, and xAI was absorbed into SpaceX after the rocket builder acquired it earlier this year. The XFreeze operator produced a 78 page document offering bug fixes and improvements for Grok, appears to have ties to India, and stands to earn money through direct payments and subscription revenue that X awards to high profile accounts.
Why the U.S. job market is so hard, especially for recent college graduates

www.washingtonpost.com · 2 months ago

Hiring has slowed even as the U.S. economy grows, with the hiring rate near 3.5 percent while headline unemployment sits around 4.2 percent, a gap driven in part by a shrinking labor force. Recent college graduates are particularly hard hit, with unemployment for people ages 22 to 27 who recently completed college at about 5.6 percent and nearly half of that group underemployed in jobs that do not require a degree. Employers point to higher interest rates, anticipatory pauses because of artificial intelligence, and automated applicant screening that floods recruiters with AI generated applications, while many roles once labeled entry level now require years of experience and new technical skills. Health care is the main source of net job growth even as tech and media have cut thousands of positions including roughly 16,000 at Amazon, up to 30,000 at Oracle, about 8,000 at Meta, and about 4,800 at PayPal, creating a pattern of rolling labor recessions that closes doors for new workforce entrants.
Chipmaker Patch Tuesday: Intel and AMD Patch 70 Vulnerabilities

www.securityweek.com · 2 months ago

There are 70 vulnerabilities addressed by Intel and AMD on May 13, 2026, with Intel publishing 13 advisories that describe 24 defects, including one critical and eight high severity issues. The Intel critical flaw is CVE-2026-20794, a buffer overflow in the Data Center Graphics Driver for VMware ESXi that could enable privilege escalation and potentially code execution. AMD released 15 advisories covering 45 vulnerabilities, including critical CVE-2026-0481 which exposes port 50061 in the AMD Device Metrics Exporter within the ROCm ecosystem and allows unauthenticated access to the GPU-Agent gRPC server that could permit unauthorized configuration changes. Exploitable issues across both vendors range from denial of service and privilege escalation to arbitrary code execution and unauthorized read or write access to virtual machine or process data, and affected users are urged to apply the vendor updates.
Ransomware Gangs Use BYOVD and EDR Killers to Disable Security Tools

gbhackers.com · 2 months ago

Ransomware is evolving from simple file encryption to systematically dismantling security tools, stealing sensitive data, and adopting post-quantum cryptography, with attackers increasingly using EDR killer tools and Bring Your Own Vulnerable Driver techniques to disable endpoint defenses. Ransom payments fell to 28 percent in 2025, prompting many groups to shift toward data theft and extortion where backups offer less protection, and the manufacturing sector alone suffered an estimated eighteen billion dollars in losses in the first three quarters of 2025. New ransomware families such as PE32 are using ML KEM and the Kyber1024 algorithm to protect encryption keys in line with NIST post quantum standards, making recovery without payment increasingly difficult. The ecosystem is more industrialized, with Qilin leading activity in 2025, initial access brokers trading pre compromised access often via RDP and RDWeb, underground markets persisting despite law enforcement takedowns, and numerous smaller groups proliferating.
GemStuffer Abuses 150+ RubyGems to Exfiltrate Scraped U.K. Council Portal Data

thehackernews.com · 2 months ago

There is a campaign called GemStuffer that has published more than 150 RubyGems packages which embed scraped content from U.K. local government democratic services portals and use the registry as a data exfiltration channel. The packages do not appear aimed at mass developer compromise, often show little download activity, and contain repetitive, self contained payloads that fetch hard coded council URLs, package HTTP responses into valid.gem archives, and publish those archives using embedded registry credentials. Some variants create temporary RubyGems credential environments under a temporary directory and push via the gem command line, while others upload archives directly to the RubyGems API, after which the archived data can be retrieved with a gem fetch command. Analysts say the activity could be registry spam, a proof of concept worm, an automated scraper misusing the registry as storage, or a test of capability against government infrastructure, and RubyGems briefly disabled new account registration amid related malicious activity.
Google entdeckt erstmals KI-basierten Zero-Day-Exploit

www.csoonline.com · 2 months ago

Die Google Threat Intelligence Group meldet, dass Kriminelle künstliche Intelligenz nutzen, um Schwachstellen zu finden und danach Malware zu entwickeln, die diese ausnutzt. Bei der Analyse einer Attacke prorussischer Hacker wurde erstmals ein in freier Wildbahn eingesetzter, KI entwickelter Zero Day Exploit identifiziert. Die Schwachstelle ist in einem Python Skript implementiert und ermöglicht das Umgehen der Zwei Faktor Authentifizierung eines populären webbasierten Open Source System Management Tools. Welches Tool betroffen ist, wurde nicht genannt, betroffene Parteien wurden informiert und die Entdeckung könnte eine geplante groß angelegte Attacke verhindert haben.
Infostealer Malware Fuels Corporate Breaches From Personal Devices

gbhackers.com · 2 months ago

Infostealer malware is no longer just a consumer nuisance and now serves as a direct bridge from personal device infections to full scale enterprise breaches when harvested credentials are posted on dark web forums and used to gain footholds in corporate environments. Analysis of 10,198 compromised systems shows gaming lures still account for 43 percent of infections while 57 percent stem from productivity tools, file sharing platforms, developer utilities, and other channels, and roughly one in four infected users possess active corporate credentials including VPN access, SaaS sessions, and cloud platform logins. Technically advanced users are disproportionately affected, with 82 percent of infected users showing advanced technical behavior and 70 percent having specialized development tools installed, and organizations are urged to enforce application allowlisting, restrict administrative privileges, and monitor stealer logs for exposed credentials.
Hundreds of Malicious Packages Force RubyGems to Suspend Registrations

www.securityweek.com · 2 months ago

New account registrations on RubyGems.org were suspended after threat actors pushed more than 500 malicious packages in what maintainers described as a DDoS and spam attack. The maintainers announced on May 12, 2026 that registrations are temporarily disabled and will likely remain closed for two to three days while rate limiting is tightened and web application firewall protections are enabled. The malicious packages have been removed, existing packages were not compromised, gem installs and pushes for existing users are unaffected, and investigators say the attackers attempted cross site scripting and data exfiltration targeting the registry itself.
Anduril Raises $5 Billion in Funding and Is Valued at $61 Billion

www.nytimes.com · 2 months ago

There was a financing round in which Anduril raised 5 billion dollars, valuing the company at 61 billion dollars. The start up makes AI backed weapons. That valuation is roughly double what it was a year earlier.
Android Adds Intrusion Logging for Sophisticated Spyware Forensics

thehackernews.com · 2 months ago

There is a new opt in Android feature called Intrusion Logging in Advanced Protection Mode that stores end to end encrypted forensic logs to help investigate suspected spyware compromises. The logs capture daily device and network activity including app processes, installations and removals, Wi Fi and Bluetooth connections, DNS lookups and IP addresses, USB file transfers, system certificate changes, and lock and unlock events, and the encryption keys are tied to the Google Account password and device screen lock so only the device owner can decrypt them. Logs are retained on Google servers for twelve months and cannot be deleted before expiration, though users can download decrypted copies and would then be responsible for their security. The feature records network events generated during Chrome Incognito, is rolling out to devices on the Android 16 December update and newer, and Google is also introducing other protections including verified financial calls, expanded live threat detection, tighter accessibility API controls, and post quantum cryptography.
ICS Patch Tuesday: New Security Advisories From Siemens, Schneider, CISA

www.securityweek.com · 2 months ago

Many ICS vendors have not released new advisories for the May 2026 Patch Tuesday, and only Siemens, Schneider Electric, CISA, and Germany's CERT at VDE published new ICS advisories. Siemens published 18 advisories addressing critical and high severity flaws, including device takeover in Sentron 7KT PAC1261 Data Manager, cross site scripting in a Simatic S7 PLC web server, command execution and third party component issues in Ruggedcom Rox, arbitrary file access in a ROS component, numerous third party component flaws in Simatic CN4100, missing authentication in Opcenter RDnL, and that Ruggedcom APE1808 is affected by a recently disclosed Palo Alto Networks PAN OS vulnerability that has been exploited in the wild. Schneider Electric published four advisories covering high severity flaws in EcoStruxure Panel Server, unauthorized file access in EasyLogic T150 and Saitel DP remote terminal units, session hijacking across multiple product families, and a medium severity information disclosure in EcoStruxure Machine Expert HVAC, while CISA released advisories for ABB and other vendors and CERT at VDE published a medium severity denial of service flaw in Codesys Modbus.
Q1 2026 Ransomware Attacks Hits 2,122 Orgs Amid Fewer, More Impactful Groups

gbhackers.com · 2 months ago

Ransomware activity remained elevated in the first quarter of 2026, with 2,122 organizations listed on ransomware data leak sites, marking the second highest Q1 total on record. A smaller set of groups is driving most attacks, with the top ten ransomware groups responsible for 71 percent of victims, including Qilin with 338 victims and LockBit with 163 victims. A newcomer called The Gentlemen rose rapidly to third place by using preexisting access points and concentrated activity in APAC and Latin America, while some groups such as Play directed the majority of their attacks at United States organizations. Over 70 active leak sites were tracked with more than 700 victims posted on average each month, and industries including manufacturing, healthcare, and business services remain heavily impacted, prompting a need to secure entry points, limit lateral movement, and adopt Zero Trust practices.
Fake FinalShell and Xshell Sites Push Kong RAT Malware

gbhackers.com · 2 months ago

There are fake download sites posing as popular Chinese developer and VPN tools that poisoned search results from at least May 2025 through March 2026 to funnel victims to trojanized installers that ultimately deliver Kong RAT. The operation uses a.NET 10 NativeAOT compiled dropper that relaunches to elevate via UAC, fetches a file disguised as an MP4 from Alibaba Cloud in Hong Kong which is actually a DLL loaded reflectively, and abuses DLL sideloading by placing a malicious rcdll.dll alongside a legitimate signed binary to achieve execution. The malware persists by creating scheduled tasks with names starting SimpleActivityScheduleTimer, can silently re elevate using a CMSTPLUA COM UAC bypass and process masquerading, and finally deploys a 64 bit Kong RAT that supports remote shell, file operations, keylogging and C2 communication over TCP port 5947 using a custom MPK1 protocol. Defenders should monitor for SEO poisoned download sites, unusual Alibaba Cloud object downloads and file names such as Setupexe.exe and rcdll.dll in user profile paths, scheduled tasks with the SimpleActivityScheduleTimer prefix, and C2 traffic to TCP port 5947 bearing the MPK1 header.
Sharing a hands-on lab inspired by the recent Canvas security incident — looking for collaborators

www.kqed.org · 2 months ago

There was a widespread cyberattack on the educational platform Canvas and the operator Instructure said it reached an agreement with the unauthorized actor to recover the stolen data and received digital confirmation that the data was destroyed, with the company asserting no customers will be recorded as a result. The incident, which Instructure said it first detected on April 29 and which prompted Canvas to be taken offline on May 7, was claimed publicly by a group calling itself ShinyHunters and stemmed from an issue in the Free for Teacher demo program that allowed access to usernames, email addresses, course names, enrollment information and messages while reportedly not exposing credentials, course content or assignment submissions. Cybersecurity experts warned that paying attackers can create a dangerous feedback loop by reinforcing the economics of extortion, that deletion claims cannot be reliably verified, and that compromised data can be retained, resold or used for future attacks.
Der Kaufratgeber für Breach & Attack Simulation Tools

www.csoonline.com · 2 months ago

Breach & Attack Simulation Tools geben Aufschluss darüber, wie gut (oder schlecht) Ihre Sicherheitskontrollen funktionieren. Roman Samborskyi | shutterstock.com Lösungen im Bereich Breach & Attack Simulation (BAS) unterstützen Unternehmen dabei, ihr Sicherheitsniveau zu verstehen. Dazu automatisieren die Tools die Tests spezifischer Bedrohungsvektoren. Als Grundlage dienen dabei in der Regel das MITRE-ATT&CK, oder Cyber-Killchain-Framework. BAS-Produkte simulieren zum Beispiel: Netzwerkangriffe und Infiltrationsversuche, Lateral Movement, Phishing, Endpunkt- und Gateway-Attacken, Malware- und Ransomware-Angriffe sowie Insider-Bedrohungen. Breach & Attack Simulation eingeordnet Breach & Attack Simulation kann Red Teaming, Penetration Testing oder auch Attack Surface Assessments (ASA) ergänzen, unterscheidet sich aber deutlich von diesen Maßnahmen. Stellen Sie sich vor, Ihr Unternehmen wäre eine Villa: Beim Red Teaming oder Penetration Testing beauftragen Sie jemanden, in Ihr Anwesen einzubrechen und Ihren Safe auszuräumen. Das Ziel: potenzielle Zugangsmöglichkeiten aufzudecken. Breach & Attack Simulation ist hingegen, als würden Sie sämtliche Schlösser an den Türen auf Funktionstüchtigkeit prüfen und sicherstellen, dass die installierten Security-Kameras auch entsprechend reagieren, wenn sie Personen erkennen. Das Ziel: sichergehen, dass alle Kontrollmaßnahmen wie vorgesehen funktionieren. Während sich BAS dabei auf Enterprise-Security-Kontrollen wie EDR fokussiert, werden beim Attack Surface Assessment sämtliche potenziellen Schwachstellen und Angriffsvektoren untersucht. Das Analystenhaus Gartner fasst diese Technologien in der breiteren Kategorie “ Exposure Management ” zusammen. Laut den Analysten sind Lösungen im Bereich Breach & Attack Simulation vor allem in stark regulierten Branchen wie dem Banken- und Versicherungsumfeld gefragt, die mit wachsenden Compliance-Anforderungen konfrontiert sind. Diese Einschätzung kann Ilja Rabinovich, Director of Adversarial Tactics beim Sicherheitsanbieter Sygnia, nur bestätigen: “BAS-Produkte sind in der Regel teuer und werden von kleineren Unternehmen mit begrenztem Budget oder eingeschränkter Prozesslandschaft nicht angeschafft.” Der Markt für Breach & Attack Simulation Tools Die Auguren von Gartner prognostizieren, dass sich mehr als 40 Prozent aller Unternehmen bis zum Jahr 2026 auf konsolidierte Plattformen oder Managed Service Provider verlassen werden, wenn es um Validierungsprüfungen im Bereich Cybersecurity geht. Entsprechend breit aufgestellt präsentiert sich die BAS-Anbieterlandschaft: Sowohl Standalone-Anbieter als auch große Security-Unternehmen und Service Provider wollen ihre BAS-Lösungen an den Kunden bringen. Chirag Mehta, Analyst bei Constellation Research, sieht dabei eine weitergehende Konsolidierung des Marktes am Horizont: “Wenn Sie ein Tool haben, das Angriffe simulieren kann, ist der nächste logische Schritt, diese Attacken zu verhindern. Das erfordert allerdings, eine Reihe verschiedener Tools zu integrieren, was kein Kinderspiel ist.” Ein wachsender Trend in diesem, wie auch allen anderen Bereichen der IT-Sicherheit, ist der Einsatz von Generative AI (GenAI). Erik Nost, Analyst bei Forrester Research, sieht diese Entwicklung positiv: “Vermutlich werden wir generative KI als erstes im Bereich des User Interface im Einsatz sehen. Mit Daten auf coole Art und Weise interagieren zu können, ist der neue GenAI-Use-Case.” Der Analyst hält es auch für möglich, dass KI künftig auf der Basis von Daten, oder den für die Benutzer respektive das Unternehmen relevantesten Angriffsarten, Bedrohungen modelliert. Er fügt hinzu: “Generative KI könnte außerdem auch eingesetzt werden, um Unternehmen dabei zu helfen, die von BAS gefundenen Probleme zu verstehen, entsprechende Prioritäten zu setzen und spezifische Abhilfemaßnahmen vorzuschlagen.” Das sollten BAS-Lösungen leisten Auf folgende wichtige Features sollten Anwender bei Breach & Attack Simulation Tools achten: Repräsentative Angriffsvektoren, um ein möglichst breites Spektrum an für das Unternehmen relevanten Angriffen simulieren zu können. Realistische Angriffsszenarien auf Grundlage von Frameworks wie MITRE ATT&CK, die denen echter Angreifer ähneln. Anpassbare Szenarien, um spezielle Infrastrukturaspekte testen zu können. Automatisierte Tests, um regelmäßige und effiziente Simulationen zu realisieren, ohne den Betrieb zu beeinträchtigen oder zusätzliche personelle Ressourcen einzusetzen. Detaillierte Reportings und Analysen, um die Bedeutung der Tests erklären und verbesserungswürdige Bereiche identifizieren zu können. Skalierbarkeit, um nicht nur die aktuelle Unternehmensumgebung, sondern auch künftige Entwicklungen abdecken zu können. Testmöglichkeiten für hybride Produktionsumgebungen, um Kontrollmaßnahmen unter realen Bedingungen begutachten zu können. Einfache Nutzung und simple Deployment-Optionen, sowie Integrationsmöglichkeiten mit vorhandenen Security-Tools und -Plattformen. Fachkundiger Support, insbesondere, wenn Sie mit Breach & Attack Simulation Tools nicht vertraut sind oder keine größeren Sicherheitsteams mit entsprechenden Erfahrungswerten einsetzen können. Eine geeignete Kostenstruktur, da die Preismodelle von BAS-Anbietern in der Regel variieren. Die Preisstruktur sollte dem Anwendungsfall angemessen sein. Die wichtigsten Anbieter für Breach & Attack Simulation Tools Im Folgenden werfen wir einen Blick auf die wichtigsten Anbieter, und ihre Lösungen, im Bereich Breach & Attack Simulation. Die Auswahl basiert dabei auf Kundenrezensionen aus Gartners Peer-Insights-Ranking sowie den Einschätzungen der Spezialisten von Expert Insights. AttackIQ Laut Expert Insights repliziert die zentrale Emulationsplattform von AttackIQ die Taktiken, Techniken und Methoden von Angreifern im Einklang mit dem MITRE-ATT&CK-Framework. Das Angebot des Unternehmens im Bereich Breach & Attack Simulation gliedert sich in drei Optionen: Die Managed Platform “ Ready! ” soll Unternehmen schneller und einfacher zu einer konsistenten Security-Validation-Strategie verhelfen. Der agentenlose Testing Service “ Flex ” funktioniert On Demand und wird im Pay-as-you-Go-Modell oder auch auf monatlicher sowie jährlicher Basis abgerechnet. Bei “ Enterprise ” handelt es sich um einen umfassenden Co-Managed-Service. AttackIQ hat sich zudem einen Namen gemacht, wenn es darum geht, ML- und KI-basierte Cybersecurity-Komponenten zu testen. Nach eigener Aussage ist das Unternehmen zudem der einzige BAS-Anbieter, der sowohl Self-Service- als auch Full-Service-Lösungen anbietet. Künftig soll künstliche Intelligenz Attack-IQ-Kunden außerdem verstärkt dabei unterstützen, Sicherheitslücken automatisiert zu identifizieren und zu beheben. Cymulate Cymulate gehört nicht nur laut Expert Insights zu den führenden Anbietern für Continuous Threat Exposure Management, sondern ist auch der Anbieter mit den besten Kundenbewertungen bei Gartners Peer Insights, auch dank der guten User Experience. Die “ Breach and Attack (BAS)” -Lösung von Cymulate wird im SaaS-Modell bereitgestellt. Für Unternehmen mit Data-Segregation-Bedürfnissen steht auch eine Private-Tenancy-Option zur Verfügung. Wie AttackIQ verwendet Cymulate das MITRE ATT&CK Framework als Grundlage. Laut dem Anbieter dauert es derzeit circa drei bis vier Wochen, um die Integrationen einzurichten und sein BAS-Tool einzusetzen. Diesen Zeitraum möchte Cymulate künftig mit Hilfe von Generative AI auf wenige Minuten reduzieren. Doch die GenAI-Pläne des Anbieters gehen noch weiter: Die Technologie soll künftig automatisiert aus Tausenden oder gar Hunderttausenden verschiedenen Angriffsszenarien Mitigationsstrategien entwickeln können, und den Security-Teams erklären, wie diese umzusetzen sind. Die GenAI-Funktionen sollen laut Cymulate bis Ende Oktober 2024 in vollem Umfang zur Verfügung stehen. Fortinet In Sachen Kundenbewertungen kann das BAS-Offering von Fortinet nicht ganz mit den ersten beiden Angeboten mithalten. Allerdings kombiniert “ FortiTester ” Breach & Attack Simulation mit Netzwerk-Performance-Testing und stellt insofern eine umfassende Lösung dar. Das Fortinet-Tool simuliert diverse Angriffsarten auf Grundlage des MITRE-ATT&CK-Frameworks und unterstützt laut Expert Insights außerdem CVE-basierte IPS-Tests, sowie DDoS Traffic Generation. Mandiant Security-Anbieter Mandiant ist in erster Linie für seine Dienstleistungsangebote im Bereich Threat Intelligence bekannt. Die Expertise in diesem Bereich lässt das Unternehmen auch in seine BAS-Softwarelösung “ Security Validation ” einfließen, und hebt sich dadurch von seinen Mitbewerbern ab. Das Mandiant-Tool unterstützt zum Beispiel MITRE ATT&CK Framework Mapping, automatisiertes Alerting sowie Environmental Drift Detection und simuliert Angriffsszenarien aus der echten Welt. NetSPI In Sachen Penetrationstests hat sich NetSPI bereits einen Namen gemacht. Das Unternehmen hat mit “ Breach and Attack Simulation ” ebenfalls eine BAS-Lösung im Angebot, die Sicherheitskontrollen validieren, Detection-Lücken identifizieren und Angriffsflächen managen kann. Das Pentesting-Knowhow von NetSPI manifestiert sich dabei insbesondere in umfassenden Support, wie Derek Wilson, leitender Security-Berater des Unternehmens, verspricht: “Unser erfahrenes Pentester-Team schließt sich mit Ihrem SOC-Team kurz und unterstützt dabei, Detections einzuordnen und Präventionsmaßnahmen zu ergreifen.” Auch bei NetSPI soll künftig Generative AI Mehrwert für die BAS-Kunden erschließen: Künftig soll die Lösung des Anbieters dank der Technologie in der Lage sein, mehrere Datenquellen zu nutzen, um die nötigen Tests möglichst schnell zu identifizieren und zu priorisieren. Darüber hinaus stehen auch Playbooks, die auf Basis von Bedrohungsinformationen für spezifische Industrien generiert werden sowie die Simulation dynamischer Angriffsketten, um Abdeckungslücken zu identifizieren, auf dem Plan. Picus Security Auf Grundlage der Gartner Peer Insights ist Picus Security der BAS-Anbieter mit der zweithöchsten Kundenzufriedenheit und wurde von den Auguren mit einem “Customers Choice”-Award ausgezeichnet. Nach eigenen Angaben zählt Picus Hunderte von globalen Unternehmen zu seinen Kunden, darunter beispielsweise Mastercard oder die ING-Bankengruppe. Die “ Security Validation “-Plattform des Anbieters beinhaltet Breach & Attack Simulation, unterstützt darüber hinaus allerdings auch automatisierte Penetrationstests und Attack Surface Management sowie SOC-Optimierung und Cloud Security Posture Managenet (CSPM). Auch Picus investiert stark in KI und will künftig mit Hilfe der Technologie bessere, schnellere und umfassender personalisierte Einblicke in das Sicherheitsniveau der Anwender liefern. Redscan Weil Redscan auf Managed Detection and Response sowie Penetration Testing spezialisiert ist, bietet das Unternehmen einen praxisorientierten BAS-Ansatz namens “ FAST Attack Simulation s”. Dieser verspricht den Anwendern maßgeschneiderte Angriffssimulationen kombiniert mit Beratungsleistungen, um bei den nachfolgenden Schritten zu unterstützen. Reliaquest Der Anbieter Reliaquest wurde für seine Security-Plattform “GreyMatter” 2023 von Gartner in der Kategorie “Managed Detection and Response” mit einem “Customers Choice”-Award ausgezeichnet. Besonders stark ist diese Lösung im Umfeld mittelständischer Unternehmen verbreitet. Eine Funktion dieser Plattform heißt “ Verify ” und realisiert Breach & Attack Simulation. Die BAS-Lösung von Reliaquest verspricht Anwendern ein umfassendes Portfolio (kuratierter) Angriffsszenarien, um möglichst zeitnah zu entsprechenden Ergebnissen zu kommen. Diese Szenarien werden zudem laufend auf Grundlage aktueller Threat-Informationen aktualisiert. Die ermittelte Bedrohungsabdeckung gleicht das Tool mit Security-Frameworks wie MITRE ATT&CK ab. Sollten Sie diesen Anbieter ins Auge fassen, behalten Sie eines jedoch im Hinterkopf: Möglicherweise ist es im Sinne einer unabhängigen Überprüfung der Wirksamkeit von Sicherheitsmaßnahmen nicht die beste Idee, denselben Anbieter für BAS und MDR zu wählen. Andererseits könnten Anwender auch von dieser Integration profitieren. SafeBreach Auch der dedizierte BAS-Anbieter SafeBreach kommt bei den Peer Reviews von Gartner gut weg, auch dank seiner umfassenden Integrationsmöglichkeiten mit anderen Security-Tools. Auch in Sachen namhafte Kunden kann SafeBreach mit Netflix, PayPal, Pepsi und der Carlsberg-Gruppe überzeugen. Die BAS-Plattform “ SafeBreach ” testet die Wirksamkeit bestehender Sicherheitskontrollen auf der Grundlage von mehr als 25.000 Angriffsmethoden, die dem unternehmenseigenen “Hackers Playbook” entstammen. Zudem verspricht der Anbieter, seine Plattform innerhalb von 24 Stunden um neu aufkommende Bedrohungen ergänzen zu können. Neben maßgeschneiderten Angriffssimulationen auf Grundlage des MITRE-ATT&CK-Frameworks bietet die SafeBreach-Lösung auch die Option, die voraussichtlichen Kosten für Risikominimierungsmaßnahmen zu ermitteln. 7 Fragen vor dem BAS-Invest Forrester-Analyst Nost empfiehlt Unternehmen, ihre BAS-Journey mit einem guten Überblick über ihre Systeme und Kontrollmaßnahmen anzutreten und von “Schnellschüssen” abzusehen: “Bevor Sie nicht wissen, was Sie testen sollen, sollten Sie sich auch nicht auf ein BAS-Tool einlassen.” Davon abgesehen empfiehlt es sich, Anbieter von Breach & Attack Simulation Tools mit den richtigen Fragen zu löchern, um vor unschönen Überraschungen verschont zu bleiben. Zum Beispiel: Inwiefern gewährleistet Ihr Produkt verbesserte Detection-Fähigkeiten im Rahmen von Sicherheitskontrollen? Können Tests skaliert und in Produktionsumgebungen gefahren werden, ohne größere Auswirkungen für die Kunden? Wie sehen Ihre Research-Bemühungen mit Blick auf die neueste Bedrohungen aus? Wie oft aktualisieren Sie ihre Threat-Bibliothek? Können Sie anhand eines Beispiels demonstrieren, wie die Simulationsergebnisse präsentiert werden? Sind Ihre Plattformen transparent oder ist nur Black-Box-Testing möglich? Besteht die Option für On-Premises- oder Air-Gapped-Deployments? Sie wollen weitere interessante Beiträge rund um das Thema IT-Sicherheit lesen? Unser kostenloser Newsletter liefert Ihnen alles, was Sicherheitsentscheider und -experten wissen sollten, direkt in Ihre Inbox.
Nvidia C.E.O. Jensen Huang Hitches Ride With Trump to China After Last-Minute Invite

www.nytimes.com · 2 months ago

Jensen Huang boarded Air Force One during a refueling stop in Alaska and joined President Trump’s delegation to Beijing as a last minute addition. He had been left off earlier invitation lists as the White House emphasized agriculture and aviation, but was seen on the presidential plane and an Nvidia spokesperson said he was attending at the invitation of the president to support the administration’s goals.
Instructure Strikes Deal for Hackers for Return of Canvas Data

www.nytimes.com · 2 months ago

There was a data extortion attack on Instructure’s Canvas platform that temporarily took the system offline during finals and left the company saying it had restored service but not disclosing whether it had paid or what it had given the hackers. A group claiming to be ShinyHunters said it stole several terabytes of records from nearly nine thousand schools and roughly 275 million people, posted ransom demands, defaced some schools’ login pages and threatened to publish data by May 12 if no negotiation occurred. The compromised information reportedly included names, email addresses, student identification numbers and private Canvas messages, prompting colleges and K through 12 districts to consult cybersecurity firms and in some cases postpone or delay final exams.
May Patch Tuesday roundup: Critical holes in Windows Netlogon, DNS, and SAP S/4HANA

www.csoonline.com · 2 months ago

There are 118 vulnerabilities patched this May, including critical Windows Server networking and identity flaws and a severe Microsoft Dynamics 365 on premises remote code execution. The Netlogon unauthenticated remote exploit is CVE-2026-41089 with a CVSS score of 9.8, and the Windows DNS Client remote code execution is CVE-2026-41096 with a CVSS score of 9.8, both posing risk to domain controllers and wide endpoint compromise. Dynamics 365 on premises RCE is CVE-2026-42898 with a CVSS score of 9.9 and allows low privileged authenticated attackers to execute arbitrary code, and the Microsoft SSO plugin for Atlassian Jira and Confluence has an elevation of privilege flaw CVE-2026-41103 that can allow forged sign ins. SAP S4HANA Enterprise Search suffers an SQL injection tracked as CVE-2026-34260 with a CVSS score of 9.6 and SAP Commerce Cloud has a missing authentication issue, while administrators must also install updated Secure Boot certificates before June 26 to avoid boot level failures and note that Oracle will switch to monthly security patches beginning May 28.
US govt seeks Instructure testimony on massive Canvas cyberattack

www.bleepingcomputer.com · 2 months ago

There are two cyberattacks by the ShinyHunters extortion group that targeted the Canvas learning platform, allowing threat actors to steal student and staff data and to deface login portals, disrupting final exams at multiple schools. ShinyHunters claimed to have stolen 280 million records from 8,809 institutions, with exposed information including names, email addresses, student identification numbers, and messages but not passwords, financial information, or government identifiers, and investigators say attackers exploited multiple cross site scripting vulnerabilities to obtain authenticated administrator sessions. The U.S. House Committee on Homeland Security has requested Instructure executives testify and participate in a briefing no later than May 21 to explain the intrusions, data containment and notification efforts, and coordination with federal agencies, and Instructure later said it reached an agreement with ShinyHunters to stop public leaks and ensure the stolen data was deleted.