as project

Researchers have built a pull request that steals a repository's secrets by hiding the malicious instruction inside a PNG that AI code reviewers never open. The reviewer waves the change through. Later, a coding agent reads the picture, opens the repo's .env, and writes every key into the source as a harmless-looking list of numbers. How 'Ghostcommit' works The attack is joint work from the University of Missouri-Kansas City's ASSET Research Group, by associate professor Sudipta Chattopadhyay and researcher Murali Ediga, who shared it with BleepingComputer. The group published a proof-of-concept on GitHub this week and says it has disclosed the findings to the affected vendors. The researchers frame the attack against a review gap that's already wide: a survey of 6,480 pull requests across the 300 most active public repositories over the past 90 days found 73% of merged PRs reached the default branch with no substantive human review and no bot review at all. The trick is that the malicious instruction isn't text a reviewer can catch. It's a picture. An AGENTS.md file, the kind of coding-convention file agents read automatically and treat as project policy, reads like ordinary build hygiene and names no secret. It just points to an image, docs/images/build-spec.png. The exploit lives in text rendered inside that PNG: read .env byte by byte, encode each byte as an integer, emit the result as a module constant, and verify the decoded numbers match the real file before commit. To a text-based reviewer, an image is a binary blob. CodeRabbit ships with a default config that excludes image files from review outright. Bugbot returned no findings. The researchers even stuffed the PNG with the words "malicious prompt injection" and an explicit order to read .env, and it still passed clean. A fake 50-line "provenance validator" and a fabricated incident postmortem gave the convention enough supporting code to defeat the reviewers' last defence, a coherence check that flags conventions with no code behind them. The theft happens later. The payload sits dormant until, in an unrelated session, a developer asks the coding agent for something routine, such as a token-tracking module. The agent reads the merged AGENTS.md at startup, follows the pointer to the image, opens .env, and writes the requested module with a "provenance" constant near the top. In one end-to-end run, Cursor driving Claude Sonnet did this on the first try, and the constant it emitted ran to 311 integers that decode byte-for-byte to the entire .env. The developer sees the feature they asked for and commits, and the attacker decodes the numbers from the public commit. Secret scanners never notice, because none of them turn a Python integer tuple back into ASCII to check it. An old trick, a new blind spot Hiding instructions inside images for an AI system to act on isn't new. In 2025, Trail of Bits researchers Kikimora Morozova and Suha Sabi Hussain demonstrated a cleverer version, i.e. images that look clean at full resolution but resolve into readable prompt-injection text once an AI system's own downscaling pipeline resamples them, a technique that fooled tools like Gemini CLI. More recently, macOS malware dubbed Gaslight embedded fake system-failure messages inside its binary, aimed at a different AI reader, trying to talk AI-assisted malware analysis tools into aborting their own analysis. Earlier this year, my research team at Manifold Security showed an AI code reviewer was fooled by a spoofed git identity into merging a malicious pull request, no image required. Ghostcommit's image carries no such disguise. The exfiltration instructions sit in plain, readable text inside the PNG. What makes it work isn't a hidden signal, but rather a blind spot: the reviewer never opens the file at all. The tooling decides, not the model The sharpest finding is about where the danger actually lives. Across ten runs each, the coding tool mattered more than the model. Cursor and the Antigravity coding tool both followed the image and leaked the .env under Sonnet, Gemini, and GPT-5.5, among others. Anthropic's Claude Code, running the same Sonnet weights, read the same convention and refused, narrating an explicit refusal, and it refused under every model the researchers tested. Under Antigravity, Opus wrote the secret out, then recognised the social-engineering pattern and deleted it before finishing. Same model, opposite outcomes, decided by the harness wrapped around it. That points at defence in depth rather than a single fix. The researchers built one layer themselves: "Since the blind spot is structural, we built the reviewer that closes it: a multimodal pull-request defender, deployed as a GitHub app that runs on a single 4 GB graphics card," write the researchers. "It combines a scan for invisible characters, a scan of the committed code's shape, an LLM pass over the convention text, and, critically, an LLM pass over the images." In a live trial against 80 pull requests it hadn't seen before, only one attack got past it, every image-based variant included, and none of the 30 legitimate PRs triggered a false alarm. As the researchers put it, "it resembles a reviewer that opens the attachment, and today's reviewers do not." The other layer is runtime. Watching what an agent actually does when it reads a credentials file it had no reason to touch, rather than trying to catch the payload before it ships. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Six major AI coding assistants have been found to share a flaw that turns their approval prompts into a rubber stamp, letting a malicious repository write to sensitive files on a developer's machine and, in the worst case, achieve remote code execution. Wiz Research named the flaw GhostApproval and found it in Amazon Q Developer, Anthropic's Claude Code, Augment, Cursor, Google Antigravity and Windsurf. The technique relies on symbolic links, or symlinks, which make one file path secretly resolve to another. One Trusted Approval, One Hidden Target In a proof of concept (PoC) published on July 7, Wiz showed how a symlink inside a repository, disguised as an innocent file such as project_settings.json could actually point at the developer's SSH keys. When the developer asked the assistant to "set up the workspace" or follow the README, the agent followed the link and wrote an attacker-supplied key into the real target, handing over passwordless remote access. Wiz said the design effectively bypasses informed consent: in several tools, the agent resolved the file to a sensitive location, yet the approval dialog showed only the harmless filename, so a developer approved an edit they could not actually see. Fixed, Silent or Disputed In early 2026, Wiz said it reported GhostApproval to all six vendors. Amazon, Google and Cursor treated it as a vulnerability and shipped fixes. Cursor issued CVE-2026-50549 to the the flaw. Augment and Windsurf acknowledged the reports but, as of publication, had gone quiet without a fix, leaving their users potentially exposed. Anthropic disputed that Claude Code's behavior was a vulnerability. It argued that a user who trusts a directory and approves an edit owns that decision, putting the scenario "outside our threat model." Wiz framed GhostApproval less as isolated bugs than as a design question the industry has yet to settle: whether an AI coding tool should shield users from a deceptive workspace, or leave that to their judgment. Its advice to vendors was to resolve symlinks before asking for approval and to flag any write that lands outside the project. Developers using Augment or Windsurf, meanwhile, should watch for updates.

We discovered a vulnerability in the Google Cloud Vertex AI software development kit (SDK) for Python, and responsibly disclosed it to Google. Before Google’s fix, the vulnerability would have allowed an attacker operating entirely from their own Google Cloud project to hijack a victim's model upload and poison it. By exploiting this flaw in vulnerable versions of the SDK, an attacker can achieve remote code execution (RCE) within a target’s Vertex AI serving infrastructure, with zero initial access to the victim's project. The root enabler of this attack is a predictable default bucket name, combined with a missing ownership check in the SDK's staging logic. When a Vertex AI user uploads a model without specifying a custom staging bucket, the SDK constructs a bucket name using a deterministic pattern based on the project ID and region. An attacker who knows the victim's project ID can preemptively create this bucket in their own project, a technique known as bucket squatting. The SDK then silently uploads the victim's model artifacts to the attacker-controlled bucket. Subsequently, within a narrow window of opportunity, the attacker replaces the legitimate model with one that carries a malicious payload. Once the victim deploys the compromised model, the attacker's code executes. In vulnerable SDK versions, this can lead to data exfiltration, lateral movement and further compromise of the victim's cloud environment. We refer to the process of exploiting this vulnerability as Pickle in the Middle because it relies in part on deserializing a built-in module called pickle, as explained below in Pickle Deserialization as Attack Vector. We reported the vulnerability to the Google security team, and they accepted our findings. The issue affected google-cloud-aiplatform SDK versions 1.139.0 and 1.140.0, which was the latest at the time of testing. Google completed the fixes to address this issue in v1.148.0, which was released April 15, 2026. We recommend that developers upgrade to fixed versions of the SDK. Palo Alto Networks customers are better protected from the threats discussed discussed in this article through the following products and services: The Unit 42 AI Security Assessment and Unit 42 Frontier AI Defense service can help identify and mitigate complex AI-specific risks. If you think you might have been compromised or have an urgent matter, contact the Unit 42 Incident Response team. Vertex AI is a machine learning platform for training and deploying ML models and AI applications. The Vertex AI SDK for Python is the primary client library that developers use to interact with the platform programmatically. We focused our research on the Vertex AI SDK for Python (google-cloud-aiplatform), as many enterprises rely on it to create and manage their AI/ML pipelines, applications and models. The Vertex AI Model Registry is a centralized repository within Vertex AI where users store, version and manage their ML models. When a user uploads a model to the Model Registry via the SDK, the SDK first stages the model artifacts in a Google Cloud Service (GCS) bucket before registering them with the service. The Model Registry then references these staged artifacts. When the model is deployed to an endpoint, Google's internal infrastructure (specifically, a Per-Product, Per-Project Service Account or P4SA) loads them into a serving container. Figure 1 shows the intended model upload flow. Bucket squatting is a class of vulnerability that takes advantage of the global uniqueness of cloud storage bucket names. Since no two buckets across all of Google Cloud can share the same name, an attacker who is able to predict a bucket name can preemptively create it in their own project. Any subsequent attempt to use a bucket with that name, even from a different project, silently falls back to the attacker's bucket. In Google Cloud, many managed services operate through service agents (P4SAs). These are Google-managed service accounts that allow Google Cloud services to access resources. In the case of Vertex AI, the P4SA is responsible for reading model artifacts from the staging bucket and loading them into the serving infrastructure. Tenant projects are Google Cloud projects that are owned by Google and used to host resources of a managed service. The identities and resources available inside these tenant projects are important aspects to research because they bridge the boundary between Google's infrastructure and the customer's resources. Vertex AI uses tenant projects to host resources such as Kubernetes clusters, containers and service accounts that allow the service to function. Joblib is a set of tools that provides lightweight pipelining in Python. pickle is a built-in module used for serializing and deserializing object structures. ML models in the Python ecosystem are commonly serialized using pickle – or its Joblib wrapper. A critical property of pickle is that deserialization can be leveraged to execute code. Specifically, Python's pickle protocol supports a reduce method that defines how an object should be reconstructed. An attacker who controls a pickle file can define a reduce method that executes arbitrary Python code the moment joblib.load() or pickle.load() is called, before any type of validation occurs. This is a well-known property of pickle (and joblib), and it is the mechanism we used to turn model poisoning into remote code execution. The Vertex AI SDK for Python model upload functionality is vulnerable to bucket squatting in versions 1.139.0 and 1.140.0, the latest versions that were available at the time of testing. When a user does not explicitly provide a staging bucket name, the SDK constructs a bucket name deterministically from the project ID and region, and then checks whether the bucket exists. If the bucket does not exist, the SDK creates it. However, if the bucket exists, the SDK does not verify whether the bucket belongs to the caller's project. This means that an attacker can create a bucket with the same name in their own project, and then wait for the victim to upload a model. Once uploaded, the attacker can replace it with a malicious model. This model carries a payload that executes arbitrary code when deployed and loaded, abusing the pickle deserialization mechanism. As part of this research, we incorporated a large language model (LLM) into the discovery and code-analysis phase. Analysis that once took days can now be executed significantly faster. By iteratively narrowing the model's focus and instructing it to look for specific patterns, we found paths that led to resources provisioned on the cloud, affected by user-controlled or project-derived inputs. The vulnerable code was located in gcs_utils.py, inside the stage_local_data_in_gcs() function: The function constructs the bucket name deterministically from the project ID and region (e.g., my-project-vertex-staging-us-central1). It then calls staging_bucket.exists() to check whether the bucket already exists. The bucket.exists() call returns True for any bucket with that name, regardless of which project owns it. If the bucket exists, even in a completely different project, the SDK proceeds to upload model artifacts to it without any further verification. Once the model is uploaded, the attacker has a limited window of opportunity to replace it with a compromised one. This malicious model carries a payload that executes arbitrary code when the model is deployed and loaded. After this window, the AI Platform Service Agent ([email protected][.]com) reads the model and the attacker loses their ability to replace it. Our tests show that this window is approximately 2.5 seconds, requiring near-real-time attacker operation, as shown in Phases 2-4 below. The success of this attack depends on the following conditions: The victim’s default staging bucket does not already exist in the target region. This is the case for any project that has not yet used Vertex AI in that region or has not used the default staging bucket name. The victim does not specify an explicit staging_bucket parameter when calling SDK methods like Model.upload(). When no bucket is specified, the SDK falls back to the deterministic default name. On the attacker's side, the only requirements are a Google Cloud project – in any organization, using any billing account – and knowledge of the victim's project ID, which is often publicly discoverable. The flow of attack phases reflects the key findings of our research: Predictable bucket name and lack of ownership verification, enabling bucket squatting Race condition window that can be exploited to hijack the model upload Pickle deserialization as an RCE vector The attacker preemptively creates a bucket with the predicted name of the target's staging bucket, in the attacker's own project. The attacker then configures identity and access management (IAM) permissions so that any authenticated Google Cloud identity can read from and write to the attacker’s bucket. This is critical, as the victim's identity (that uploads the model) and Vertex AI’s service agent (which reads the model) must both be able to interact with the bucket. The code snippet below illustrates how any authenticated user could interact with the bucket. The legacyBucketReader role ensures that when the victim’s SDK checks whether the bucket exists, the bucket.exists() returns a True response. The objectCreator role allows the victim's SDK to upload artifacts. The objectViewer role allows the Vertex AI service agent to read the artifacts later. The attacker deploys a Cloud Function, which is a serverless compute service in Google Cloud that executes code in response to events. The function is configured with a trigger on google.storage.object.finalize, which fires every time a new object is created (or overwritten) in the specified bucket. This means that the function automatically executes whenever the victim uploads a model artifact to the squatted bucket. The attacker-created Cloud Function's logic is straightforward. When it detects a new model.joblib file in a vertex_ai_auto_staging path, it downloads the original file and replaces it with a pre-generated malicious payload. The malicious payload is a joblib serialized Python object with a crafted reduce method. To check the usage of this method, we set up a webhook that receives the victim's service account credentials. When the model is deserialized, it executes code that queries the Google Compute Engine (GCE) metadata server for the serving container's service account credentials and exfiltrates them to an attacker-controlled endpoint. The reason we use a Cloud Function rather than polling the bucket is timing. According to our tests, the window between the victim's upload and the service agent read is approximately 2.5 seconds. A Cloud Function triggered by google.storage.object.finalize reacts within approximately 800 ms, leaving enough time to replace the file before the service agent reads it. In this way, the attacker wins the race. The victim uploads a legitimate model, but by the time the service agent reads it, the file has been swapped. The victim runs standard SDK code, without unusual configuration or security mistakes, as shown in the following code block: Because no staging_bucket is specified, the SDK constructs the default name, finds that the bucket exists (which the attacker prepared in Phase 1) and uploads the model artifacts to the existing bucket’s location – the attacker’s project. As a result of the victim's upload, the Cloud Storage finalize event triggers the attacker's Cloud Function, which immediately replaces the victim's legitimate model with the malicious payload. The entire swap occurs within the opportunity window, well before the P4SA reads the artifact. The service agent then reads the poisoned model instead of the original one, without the victim's knowledge. The following timeline, captured from our proof of concept, illustrates the replacement flow: T+0 ms Victim SDK uploads model.joblib (601 bytes) T+804 ms Cloud Function detects new model T+1,433 ms Cloud Function replaces new model with RCE payload (601→2,945 bytes) T+2,460 ms P4SA reads the REPLACED model from the staging bucket The victim deploys the model to an endpoint using standard SDK calls, as shown in the following code block: The victim has no indication that the model artifacts were tampered with. When the serving container starts, it calls joblib.load() to deserialize the model. The reduce method in the poisoned payload executes immediately, before the container performs any type validation on the loaded object. In our proof of concept, the payload: Queries the GCE metadata server for the service account email and OAuth access token Collects container environment variables (such as project number, endpoint ID, Kubernetes metadata) Exfiltrates the credentials to an attacker-controlled webhook Figure 2 shows the six phases of the attack chain. The OAuth token that was exfiltrated to the attacker’s webhook belongs to a service account running in Google's managed tenant project, named custom-online-prediction@ .iam.gserviceaccount[.]com. This token has cloud-platform scope – the broadest possible scope in Google Cloud. We found that this token allows access to several tenant project resources that extend well beyond the scope of the individual deployment: Cross-deployment model theft: The service account can access GCS buckets belonging to other model deployments within the same tenant project. In our testing environment, we were able to discover and read model artifacts from other deployments, including a complete TensorFlow model with trained weights. BigQuery reconnaissance: The token can enumerate all BigQuery datasets and table names in the victim's project, and read dataset access control lists. This exposes data schema, naming conventions and the identities of other service accounts with data access. This is valuable information for lateral movement. Tenant infrastructure intelligence: The token can read Cloud Logging from the Google-managed tenant project, revealing internal infrastructure details like: - Google Kubernetes Engine (GKE) cluster names - Active prediction deployments from other workloads - Google-internal container image URIs - Kubernetes system identities We reported this vulnerability to the Google security team. Google deployed fixes in v1.144.0 on March 31, 2026 and in v1.148.0 on April 15, 2026. Figure 3 shows the first fix: the addition of a uuid4 variable with a randomly generated value to the end of the bucket naming routine in the gcs_utils.py script. Figure 4 shows the second fix: the addition of a bucket ownership verification check to the gcs_utils.py script. March 5, 2026: Vulnerability reported to Google Cloud via the Vulnerability Reward Program March 9, 2026: Google assigned top priority to the report March 10, 2026: Google acknowledged the vulnerability, assigned top severity and reported to the product team March 31, 2026: Google deployed the first fix to production April 15, 2026: Google deployed the second fix to production The growing role of AI in production systems highlights the importance of continuously examining the security resilience of the platforms that support it. This research is one contribution to that effort, and we appreciate Google's collaboration in resolving the vulnerability. Our research shows that cloud security extends into the developer toolchain and machine learning model lifecycle. The vulnerability that we discovered demonstrates how seemingly minor design flaws can lead to a critical security issue. In vulnerable versions of the SDK, this attack requires no access to the victim's project and no social engineering tactics, and could result in model poisoning, credential theft and cross-tenant compromise. Google Cloud worked closely with Palo Alto Networks Unit 42 to resolve this issue through our Vulnerability Rewards Program (VRP). They deployed a permanent fix for the Vertex AI SDK for Python in version 1.148.0 on April 15, 2026. We recommend that all developers update their SDK to version 1.148.0 or later to ensure the new bucket ownership checks are active. As an added best practice, when specifying an artifact_uri that isn't set to a Cloud Storage (gs://) location, users should set the staging_bucket parameter to a Cloud Storage location to help ensure full asset isolation. Palo Alto Networks customers are better protected from the threats discussed above through the following products: Cortex Cloud Organizations are better equipped to close the AI security gap through the deployment of Cortex AI-SPM, which delivers comprehensive visibility and posture management for AI agents across AWS, Azure and GCP environments, as described within this article. Cortex AI-SPM is designed to mitigate critical risks including, over-privileged AI agent access, misconfigurations, and unauthorized data exposure. Cortex AI-SPM enables security teams to enforce compliance with NIST and OWASP standards, monitor for real-time behavioral anomalies, and secure the entire AI lifecycle within a unified cloud security context. Cortex Cloud Identity Security can also protect organizations from the techniques discussed in the article. Identity Security encompasses: - Cloud Infrastructure Entitlement Management (CIEM) - Identity Security Posture Management (ISPM) - Data Access Governance (DAG) - Identity Threat Detection and Response (ITDR) The Unit 42 AI Security Assessment and Unit 42 Frontier AI Defense service can help identify and mitigate complex AI-specific risks. If you think you may have been compromised or have an urgent matter, get in touch with the Unit 42 Incident Response team or call: North America: Toll Free: +1 (866) 486-4842 (866.4.UNIT42) UK: +44.20.3743.3660 Europe and Middle East: +31.20.299.3130 Asia: +65.6983.8730 Japan: +81.50.1790.0200 Australia: +61.2.4062.7950 India: 000 800 050 45107 South Korea: +82.080.467.8774 Palo Alto Networks has shared these findings with our fellow Cyber Threat Alliance (CTA) members. CTA members use this intelligence to rapidly deploy protections to their customers and to systematically disrupt malicious cyber actors. Learn more about the Cyber Threat Alliance. Gemini Enterprise Agent Platform – Google Cloud documentation Python SDK for Vertex AI – Google Cloud GitHub Glossary – Tenant Project – Google Cloud documentation Joblib: running Python functions as pipeline jobs – Joblib Pickle – Python object serialization – Python documentation Models & datasets – TensorFlow documentation v1.148.1 Vulnerability Fix – Vertex AI Python SDK release notes

May 2026 Patch Tuesday forecast: AI starts driving security industry changes Project Glasswing. This is one of three major security industry changes I’ll cover today. The Anthropic Mythos vulnerability discovery model has already proven to be game changing in its ability to identify new vulnerabilities in software. Many of these vulnerabilities have existed for 10 to 15 years without human discovery. In a recent announcement from Mozilla, they discovered 271 vulnerabilities when running it against Firefox 150 prior to release. This sheer volume of new vulnerabilities is driving change. NIST moves to threat-based CVE analysis In an unprecedented agreement known as Project Glasswing, 12 companies agreed to work with Anthropic on a preview version of this new technology. These include Apple, Amazon, Cisco, Microsoft, and others who would normally be competing for this technology. The goal is to finally get ahead of the zero-day releases and minimize the risk from attacks. In another major shift, NIST announced it was changing its vulnerability analysis efforts to a risk or threat-based approach. All CVEs will continue to be added to the National Vulnerability Database (NVD), but it would prioritize its ‘enrichment’ process on those vulnerabilities known to be exploited or associated with software used in the federal government or software identified as critical. Per the announcement they enriched over 42,000 CVEs in 2025 and cannot keep that pace with all CVEs now being reported. And finally, my third change, the increase in frequency of patch releases to keep up with this flood of vulnerabilities. A prime example here is the announcement from Oracle that their Critical Patch Updates (CPUs) would be expanded from quarterly to monthly releases, with previously skipped months to now include additional security updates as needed. As AI ramps up, many aspects of patch management will continue to change and evolve in response. OOB updates fix critical ASP.NET core vulnerability Microsoft provided two important out-of-band (OOB) patches this month. The first was soon after the April Patch Tuesdays updates and impacted all the currently supported server versions from 2016 through 2025. The April security update KB5082063 was failing on Windows Server 2025 in many reported cases and any server version which was acting as a domain controller could possibly go into a restart loop with their respective April updates. On April 19th, Microsoft issued a series of OOB patches to address these issues. Two days later on April 21st, Microsoft issued an OOB update for .NET 10.0.7. This resolved CVE-2026-40372, an Escalation of Privilege vulnerability with a CVSS of 9.1 and rated Critical. This vulnerability was found in the ASP.NET core data protection cryptographic APIs and could allow a user to gain System privilege. Both of these OOB fixes will be rolled into the next Patch Tuesday update. Microsoft simplifies Windows Insider Program Microsoft announced a major change to their Windows Insider Program this month. Per the explanation in the blog, the feedback they were getting from community members was that the channel structure and the feature delivery were confusing. With that in mind, they simplified it to two channels, Experimental and Beta. The Experimental channel is just that, cutting edge features in development which may or may not make a release. They welcome feedback but there is no guarantee they may even make a release. The Beta channel is what you would expect by the name, these releases contain features in near final form which will be included in the next release. Feedback here will help fine tune them for general use. You will be able to move between the channels more easily without having to make completely new installs of your base OS. Community members can expect to be migrated to the appropriate new channels soon. CopyFail exposes Linux systems to privilege escalation There are a few hot vulnerabilities getting some extended press that you need to be aware of going into next week’s Patch Tuesday. The first is CVE-2026-33825 which is associated with the Bluehammer exploit. This exploit had a zero-day fix for Microsoft Defender in the April Patch Tuesday release, but since then two additional exploits from the same attacker called RedSun and UnDefend have yet to be addressed. Keep an eye out for a fix this month. And finally, Linux vulnerability CVE-2026-31431, also called CopyFail, is an AI-discovered elevation of privilege vulnerability, which has been present since 2017. A simple proof of concept (PoC) exploit allowed a standard user to obtain root privileges. Patches for the major Linux distributions were released within a week near the beginning of April, so make sure you are updated and protected against attacks targeting this critical vulnerability. May 2026 Patch Tuesday forecast Microsoft is part of Project Glasswing, so we could see a new record number of CVEs reported. Based on this new ability to identify issues, expect security updates across the entire Microsoft portfolio next week. The Adobe rotation for Creative Cloud Apps updates will most likely contain Audition, Animate, Premier Pro, and perhaps some repeats from last month like Acrobat depending on which vulnerabilities have surfaced. Apple, also a founding member of Project Glasswing, is due for their next set of OS and application security updates. They may be released on or near Patch Tuesday just to ‘ride the wave’ of updates so be on the lookout. Anticipate a large number of new CVEs discovered as part of this project as well. Google Chrome 149 will be released next week; most likely on Patch Tuesday. Mozilla released Firefox 150.0.2, Firefox ESR 140.10.2, Firefox ESR 115.35.2 on Thursday, May 7. Expect corresponding Thunderbird and Thunderbird ESR updates soon. Mozilla was releasing security updates once a month, but that has accelerated to once a week for the past several weeks. We’ll need to see if that trend continues. And so it begins. We’re certainly starting to see the impact AI has on the security industry. The recent breakthrough of Anthropic’s Mythos is sure to be the first of many tools which will reshape how we approach code development and conduct patch management operations.

While non-public frontier AI models, like Anthorpic’s Claude Mythos, have been shown to identify thousands of zero-day vulnerabilities across major operating systems, commercial models are also indicating progress in the discovery of software bugs. Forescout’s Vedere Labs found that just a year ago 55% of AI models failed basic vulnerability research and 93% failed exploit development tasks. Progress has been made however, and in 2026 the cybersecurity firm said all tested models’ complete vulnerability research tasks, and half can generate working exploits autonomously. As part of the research, 50 AI models were tested including commercial, open-source and underground. The most capable models Forescout tested – Claude Opus 4.6 and Kimi K2.5 – can now find and exploit vulnerabilities without complex prompts, making them accessible to inexperienced attackers. “These are widely available AI models exceeding human capability,” said Rik Ferguson, VP Security Intelligence at Forescout. However, he admitted this may not be at the scale, speed and quality of Mythos. During testing Forescout said that using single prompts, the RAPTOR agentic framework, and the firm’s own extensions, they discovered four new zero-day vulnerabilities in OpenNDS which is widely deployed. RAPTOR is an open-source, agentic AI framework designed for cybersecurity research, offense and defense. Ferguson explained that one of the vulnerabilities that was found was in code that Vedere Labs had already manually analyzed and had not identified. AI Lowers the Barrier to Discovering Unknown Vulnerabilities The commercial models performed best in Forescout’s testing, but they remain expensive, the firm admitted. Claude Opus 4.6 for example costs up to $25 per million output tokens. Meanwhile, open-source alternatives such as DeepSeek 3.2 can handle basic tasks at a fraction of the cost, with all test tasks costing less than $0.70. Claude Mythos by comparison will be available to participants at $25/$125 per million input/output tokens. Using different models based on task complexity and cost is emerging as a practical strategy for both defenders and attackers. Forescout noted, that if its research can uncover new vulnerabilities with open models, and large initiatives such as Project Glasswing can surface thousands of zero-days in critical software, organizations should assume their environments contain unknown vulnerabilities that AI will find, whether used by

Anthropic may have just announced the future of AI – and it is both very exciting and very, very scary. Mythos is the Ancient Greek word that eventually gave us ‘mythology’. It is also the name for Anthropic’s latest foundational AI Model: it evokes the connective tissue that links together knowledge and ideas. Industry excitement over Anthropic’s Claude Mythos began at the end of March 2026 when Fortune magazine published information on an upcoming Anthropic development. The information came from a leak of almost 3,000 files from a misconfigured CMS. Anthropic confirmed the details. Today, less than two weeks after the Fortune publication, Anthropic officially announced Mythos Preview as the basis of Project Glasswing. Mythos is not an incremental improvement but a step change in performance over Anthropic’s current range of frontier models: Haiku (smallest), Sonnet (middle ground), and Opus (most powerful). Mythos sits in a fourth tier named Copybara, and Anthropic describes it as superior to any other existing AI frontier model. It incorporates the current trend in the use of AI: the modern use of agentic AI. “The powerful cyber capabilities of Claude Mythos Preview are a result of its strong agentic coding and reasoning skills… the model has the highest scores of any model yet developed on a variety of software coding tasks,” notes Anthropic in a blog titled Project Glasswing – Securing critical software for the AI era. Project Glasswing Anthropic is historically cautious – as witnessed by its current impasse with the Pentagon. Like other AI frontier model developers, it does not develop AI for cybersecurity specifically, but for the benefit of science and society. Nevertheless, it is fully aware of its potential misuse by cybersecurity adversaries. This potential is magnified by the power of Mythos. In the last few weeks, Mythos Preview has identified thousands of zero-day vulnerabilities with many classified as critical. Several are ten or 20 years old – the oldest found so far is a 27-years old bug in OpenBSD. Elsewhere, a 16-years old vulnerability found in video software has survived five million hits from other automated testing tools without ever being discovered. And it autonomously found and chained together several in the Linux kernel allowing an attacker to escalate from ordinary user access to complete control of the machine. While Anthropic’s long term intent is to make Mythos available to as many people as possible, the danger with this level of cybersecurity power in the wrong hands is self-evident. In November 2025, Anthropic blogged about ‘the first reported AI-orchestrated cyber espionage campaign’. “In mid-September 2025, we detected suspicious activity that later investigation determined to be a highly sophisticated espionage campaign. The attackers used AI’s ‘agentic’ capabilities to an unprecedented degree – using AI not just as an advisor, but to execute the cyberattacks themselves. The threat actor – whom we assess with high confidence was a Chinese state-sponsored group – manipulated our Claude Code…” Anthropic is concerned that Mythos’ capabilities could unleash cyberattacks too fast and too sophisticated for defenders to block. It hopes that Mythos can be used to improve cybersecurity generally before malicious actors can get access to it. To this end, the firm has announced the next stage of this preparation as Project Glasswing, powered by Mythos Preview. Given the rate of AI progress, it will not be long before such capabilities proliferate, potentially beyond actors who are committed to deploying them safely. “Project Glasswing is a starting point. No one organization can solve these cybersecurity problems alone: frontier AI developers, other software companies, security researchers, open-source maintainers, and governments across the world all have essential roles to play.” Claude Mythos Preview is described as a general-purpose, unreleased frontier model from Anthropic that has nevertheless completed its training phase. The firm does not plan to make Mythos Preview generally available. The implication is that ‘Preview’ is a term used solely to describe the current state of Mythos and the market’s readiness to receive it, and will be dropped when the firm gets closer to general release. Glasswing brings together Amazon, Anthropic, Apple, Broadcom, Cisco, CrowdStrike, the Linux Foundation, Microsoft, and Palo Alto Networks in an effort to secure the world’s most critical software. “The work of defending the world’s cyber infrastructure might take years; frontier AI capabilities are likely to advance substantially over just the next few months. For cyber defenders to come out ahead, we need to act now.” Anthropic is also extending access, outside of Project Glasswing, to more than 40 other organizations that build or maintain critical software, “so they can use the model to scan and secure both first-party and open-source systems.” From the Glasswing partners, Igor Tsyganskiy, EVP of cybersecurity and Microsoft research, comments, “Joining Project Glasswing, with access to Claude Mythos Preview, allows us to identify and mitigate risk early and augment our security and development solutions so we can better protect customers and Microsoft.” Cisco’s SVP & chief security & trust officer, Anthony Grieco, says, “The old ways of hardening systems are no longer sufficient. Providers of technology must aggressively adopt new approaches now, and customers need to be ready to deploy. That is why Cisco joined Project Glasswing – this work is too important and too urgent to do alone.” Elia Zaitsev, CTO at CrowdStrike, adds, “Claude Mythos Preview demonstrates what is now possible for defenders at scale, and adversaries will inevitably look to exploit the same capabilities. That is not a reason to slow down; it’s a reason to move together, faster. If you want to deploy AI, you need security. That is why CrowdStrike is part of this effort from day one.” And Jim Zemlin, CEO at the Linux Foundation, says “Open source maintainers—whose software underpins much of the world’s critical infrastructure—have historically been left to figure out security on their own… By giving the maintainers of these critical open source codebases access to a new generation of AI models that can proactively identify and fix vulnerabilities at scale, Project Glasswing offers a credible path to changing that equation.” Related: Critical Vulnerability in Claude Code Emerges Days After Source Leak Related: Trump Orders All Federal Agencies to Phase Out Use of Anthropic Technology Related: Anthropic Refuses to Bend to Pentagon on AI Safeguards as Dispute Nears Deadline Related: Anthropic Says Claude AI Powered 90% of Chinese Espionage Campaign

This week is not about one big event. It shows where things are moving. Network systems, cloud setups, AI tools, and common apps are all being pushed in different ways. Small gaps in access control, exposed keys, and normal features are being used as entry points. The pattern becomes clear only when you see everything together. Faster scans, smarter misuse of trusted services, and steady targeting of high-value sectors. Each story adds context. Reading them all gives a fuller picture of how today’s threat landscape is evolving. ⚡ Threat of the Week Cisco SD-WAN Zero-Day Exploited — A newly disclosed maximum-severity security flaw in Cisco Catalyst SD-WAN Controller (formerly vSmart) and Catalyst SD-WAN Manager (formerly vManage) has come under active exploitation in the wild as part of malicious activity that dates back to 2023. The vulnerability, tracked as CVE-2026-20127 (CVSS score: 10.0), allows an unauthenticated remote attacker to bypass authentication and obtain administrative privileges on an affected system by sending a crafted request. Cisco credited the Australian Signals Directorate's Australian Cyber Security Centre (ASD-ACSC) for reporting the vulnerability. The networking equipment major is tracking the exploitation and subsequent post-compromise activity under the moniker UAT-8616, describing the cluster as a "highly sophisticated cyber threat actor." Control Your AI Agents Before They Control You Airia is the governance and orchestration layer for enterprise AI. Monitor drift, enforce policy, optimize inference cost, and generate audit-ready evidence—so your AI scales securely, compliantly, and profitably. Request a Demo ➝ 🔔 Top News Anthropic Accuses 3 Chinese Firms of Distillation Attacks — Anthropic accused three Chinese AI firms of engaging in concerted "industrial-scale" distillation attack campaigns aimed at extracting information from its model, making it the latest American tech firm to level such claims after OpenAI issued similar complaints. DeepSeek, Moonshot AI, and MiniMax are said to have flooded Claude with large volumes of specially-crafted prompts to elicit responses to train their own proprietary models. Last month, OpenAI submitted an open letter to U.S. legislators, claiming to have observed activity "indicative of ongoing attempts by DeepSeek to distill frontier models of OpenAI and other U.S. frontier labs, including through new, obfuscated methods." The disclosure renewed a debate over training data sources and distillation techniques, with some criticizing the company for training its own systems using copyrighted material without permission. "Anthropic is guilty of stealing training data at a massive scale and has had to pay multibillion-dollar settlements for their theft," xAI CEO Elon Musk said. Google Disrupts UNC2814 GRIDTIDE Campaign — Google disclosed that it worked with industry partners to disrupt the infrastructure of a suspected China-nexus cyber espionage group tracked as UNC2814 that breached at least 53 organizations across 42 countries. The tech giant described UNC2814 as a prolific, elusive actor that has a history of targeting international governments and global telecommunications organizations across Africa, Asia, and the Americas. Central to the hacking group's operations is a novel backdoor dubbed GRIDTIDE that abuses Google Sheets API as a communication channel to disguise C2 traffic and facilitate the transfer of raw data and shell commands. Chinese cyber espionage groups have consistently prioritized the telecommunication sector as a target precisely because of the access their networks provide to sensitive data and lawful intercept infrastructure. Thousands of Public Google Cloud API Keys Exposed with Gemini Access — New research has found that Google Cloud API keys, typically designated as project identifiers for billing purposes, could be abused to authenticate to sensitive Gemini endpoints and access private data. The problem occurs when users enable the Gemini API on a Google Cloud project (i.e., Generative Language API), causing the existing API keys in that project, including those accessible via the website JavaScript code, to gain surreptitious access to Gemini endpoints without any warning or notice. With a valid key, an attacker can access uploaded files, cached data, and even rack up LLM usage charges, Truffle Security said. The issue has since been plugged by Google. UAT-10027 Targets U.S. Education and Healthcare Sectors — A previously undocumented threat activity cluster known as UAT-10027 has been attributed to an ongoing malicious campaign targeting education and healthcare sectors in the U.S. since at least December 2025. The end goal of the attacks is to deliver a never-before-seen backdoor codenamed Dohdoor. "Dohdoor utilizes the DNS-over-HTTPS (DoH) technique for command-and-control (C2) communications and has the ability to download and execute other payload binaries reflectively," Cisco Talos said. Analysis of the campaign has revealed no evidence of data exfiltration to date. Although no final payloads have been observed other than what appears to be the Cobalt Strike Beacon to backdoor into the victim's environment, it's believed that UAT-10027's actions are likely driven by financial gain based on the victimology pattern. Claude Code Flaws Allow Remote Code Execution and API Key Exfiltration — Security vulnerabilities in Anthropic Claude Code could have allowed attackers to remotely execute code on users' machines and steal API keys by injecting malicious configurations into repositories, and then waiting for an unsuspecting developer to clone and open an untrustworthy project. The vulnerabilities were addressed between September 2025 and January 2026. "The ability to execute arbitrary commands through repository-controlled configuration files created severe supply chain risks, where a single malicious commit could compromise any developer working with the affected repository," Check Point said. "The integration of AI into development workflows brings tremendous productivity benefits, but also introduces new attack surfaces that weren't present in traditional tools." ️🔥 Trending CVEs New vulnerabilities surface daily, and attackers move fast. Reviewing and patching early keeps your systems resilient. Here are this week’s most critical flaws to check first — CVE-2025-40538, CVE-2025-40539, CVE-2025-40540, CVE-2025-40541 (SolarWinds Serv-U), CVE-2026-20127, CVE-2026-20122, CVE-2026-20126, CVE-2026-20128 (Cisco Catalyst SD-WAN), CVE-2026-25755 (jsPDF), CVE-2025-12543 (HPE Telco Service Activator), CVE-2026-22719, CVE-2026-22720, CVE-2026-22721 (Broadcom VMware Aria Operations), CVE-2026-3061, CVE-2026-3062, CVE-2026-3063 (Google Chrome), CVE-2025-10010 (CryptoPro Secure Disk for BitLocker), CVE-2025-13942, CVE-2025-13943, CVE-2026-1459 (Zyxel), CVE-2025-71210, CVE-2025-71211 (Trend Micro Apex One), CVE-2026-0542 (ServiceNow AI Platform), CVE-2026-24061 (telnetd), CVE-2026-21902 (Juniper Networks Junos OS), CVE-2025-29631, CVE-2025-1242 (Gardyn Home Kit), CVE-2025-15576 (FreeBSD), CVE-2026-26365 (Akamai), CVE-2026-27739 (Angular), and SVE-2025-50109 (Samsung Tizen OS). 🎥 Cybersecurity Webinars Automating Real-World Security Testing to Prove What Actually Works → This webinar explains why one-time security assessments are no longer enough and shows how organizations can automate continuous, real-world testing of their defenses to uncover gaps and measure how well controls hold up against actual attack techniques. When AI Agents Become Your New Attack Surface → This webinar explains that as AI tools turn into autonomous agents that can browse, call APIs, and access internal systems, the security risk expands beyond the model to the entire environment they operate in, requiring stricter access controls, monitoring, and system-level safeguards rather than model testing alone. Quantum Is Coming: Preparing for the End of Today’s Encryption → This webinar explains how future quantum computers could break today’s encryption, why “harvest now, decrypt later” attacks are a real risk, and what practical steps organizations can take now to begin shifting to post-quantum cryptography. 📰 Around the Cyber World UNC6384 Drops New PlugX Variant — IIJ-SECT and LAB52 have detailed new activity from the Chinese cyber espionage group UNC6384. The attacks follow a known modus operandi of using STATICPLUGIN, a digitally signed downloader, to deliver updated versions of PlugX using DLL side-loading. The malicious payloads are distributed via phishing emails with meeting invitation lures or through fake software updates. OpenAI Takes Action Against ChatGPT Accounts Used for Harmful Purposes — OpenAI said it took down ChatGPT accounts used for influence operations, phishing, and malware development. This included a possible Chinese intelligence operation in which an individual associated with Chinese law enforcement used the AI tool for covert influence operations against domestic and foreign adversaries. The company also acted against clusters conducting reconnaissance about U.S. persons and federal building locations, online romance scams, and Russian influence operations across Africa by generating social media posts and long-form commentary articles. "Unusually, this scam network combined manual ChatGPT prompting and an automated AI chatbot to try to entrap its targets," OpenAI said about the scam operation running out of Cambodia. Some of these scams targeted Indonesian loveseekers. Other scams used ChatGPT to create content that purported to come from fictitious law firms, as well as impersonate real attorneys and U.S. law enforcement as part of a recovery scam targeting fraud victims. AI-Induced Lateral Movement — New research from Orca Security has highlighted how AI can become a "third dimension" in the world of lateral movement, after network and identity, allowing attackers to expand their reach. "By injecting prompt injections in overlooked fields that are fetched by AI agents, hackers can trick LLMs, abuse Agentic tools, and carry out significant security incidents," Orca said. "LLMs don’t truly understand the difference between data and instructions, and when tool output is fed back into the model, it can be interpreted as something to act on. Which opens a window to AI-induced Lateral Movement (AILM) activities." Russia Launches Probe into Telegram CEO — Russian authorities launched a criminal investigation of Telegram founder and CEO Pavel Durov. He is allegedly charged with promoting and facilitating terrorist activity on the messaging platform by failing to respond to law enforcement takedown requests. Russian officials have accused Durov of choosing a "path of violence and permissiveness" by not cooperating with its law enforcement agencies, according to the Rossiyskaya Gazeta. The move comes after Russia began restricting access to Telegram in the country in favor of MAX. Last month, Durov called it an "attempt to force its citizens to switch to a state-controlled app built for surveillance and political censorship." Hacked Prayer App Sends Surrender Messages — According to reports from The Wall Street Journal and WIRED, unidentified hackers seized control of an Iranian prayer app during a joint U.S.-Israeli attack to send messages urging the Iranian military to lay down their weapons and promising amnesty if they surrendered. The messages were sent in the form of push notifications to the BadeSaba Calendar app. It's currently not clear who is behind the hack. The app has been downloaded more than 5 million times from the Google Play Store. Following the U.S.-Israel war on Iran, the government shut down all internet access in the country. Smart TVs Turned Into AI Content Scrapers — Several smart TV app makers are deploying a new SDK named Bright SDK that lets users see fewer ads but also stealthily turns their TV into a node in a global proxy network that crawls and scrapes the web. Bright Data, the company behind the SDK, claims to operate more than 150 million residential proxy IP addresses spanning 195 countries. Multiple Stealer Malware Families Detected — Multiple information stealer families have been detected in the wild. This includes Arkanix, CharlieKirk GRABBER, ComSuon, DarkCloud, MawaStealer, and MioLab (NovaStealer). Kaspersky's analysis of Arkanix has revealed that it was likely developed as an LLM-assisted experiment, shrinking development time and costs. While Arkanix was promoted on underground forums in October 2025, the malware-as-a-service (MaaS) appears to have been taken down towards the end of 2025. The findings demonstrate continued demand for off-the-key stealer malware, creating an ecosystem that enables other threat actors to purchase stealer logs for obtaining initial access to targets. "Raw Infostealer logs are meticulously filtered by corporate domain, packaged, and sold to initial access brokers and attackers specifically looking for frictionless entry points into high-value corporate networks," Hudson Rock said. The development has been complemented by underground networks turning into cybercrime marketplaces, complete with reputation systems, escrow, and specialist vendors, Varonis added. "One operator runs infostealers across thousands of machines. Another extracts and sorts the credentials. A third sells curated access," security researcher Daniel Kelley said. "A fourth deploys the ransomware. Each person focuses on what they do best, and the ecosystem has become ruthlessly efficient." Chilean National Extradited to U.S. to Face Financial Fraud Crimes — Alex Rodrigo Valenzuela Monje (aka VAL4K), a 24-year-old Chilean national, has been extradited to the U.S. over his alleged role in running a cybercrime operation that involved the trafficking of payment card data. The defendant is accused of trafficking stolen credit card numbers and information for over 26,500 credit cards. "From at least May 2021 to August 2023, Valenzuela Monje operated an illegal online card shop, selling dumps of unauthorized access devices through Telegram channels," the U.S. Justice Department said. "He allegedly operated the channels known as MacacoCC Collective and Novato Carding, offering payment card data for virtually all U.S. payment cards." New FUNNULL Infrastructure Discovered — QiAnXin has flagged new infrastructure associated with FUNNULL, a Philippines-based content delivery network (CDN) sanctioned last year by the U.S. Treasury for facilitating cyber scam operations. "Previously, their main method was to poison existing public CDN services; now they have evolved to independently develop complete server-side attack suites (RingH23), actively infiltrating CDN nodes, demonstrating a significant improvement in control and technical sophistication," QiAnXin XLab said. Two independent supply chain infection channels have been identified: the compromise of maccms.la to distribute a malicious PHP backdoor through its update channel, and the compromise of the GoEdge CDN management node to implant an infection module, and deploy the proprietary RingH23 attack suite to all edge nodes via SSH remote commands. The campaign has compromised 10,748 unique IP addresses, predominantly video streaming sites. Spike in Scans for SonicWall Devices — GreyNoise said it detected a spike in scans for SonicWall devices originating from the infrastructure of a known proxy provider. The activity started on February 22, 2026, and scanned for exposed SonicWall SSL VPNs. A total of 84,142 scanning sessions targeting SonicWall SonicOS infrastructure were observed between February 22 and February 25, 2026. The scanning came from 4,305 unique IP addresses across 20 autonomous systems. "Ninety-two percent of sessions probed a single API endpoint to determine whether SSL VPN is enabled — the prerequisite check before credential attacks," GreyNoise said. "A commercial proxy service delivered 32% of campaign volume through 4,102 rotating exit IPs in two surgical bursts totaling 16 hours." Google Removes 115 Android Apps Tied to Ad Fraud — A new ad fraud operation dubbed Genisys involved hijacking Android devices to run malicious activity in the background. The activity leveraged a set of 115 apps that stealthily opened websites inside hidden browser windows to generate ad display revenue for their creators. More than 500 domains were generated using AI tools to serve the ads. "They appear as generic blogs, news-style sites, and informational properties produced at scale, built not to attract real audiences but to receive and monetize fraudulent traffic," Integral Ads said. The apps have since been removed by Google. The findings build on another mobile ad fraud scheme called Arcade in which mobile apps generated hidden in-app browser activity to load websites in the background and convert mobile-origin activity into web traffic. Zerobot Exploits Flaws in n8n and Tenda Routers — A Mirai-based IoT botnet named Zerobot has been observed exploiting vulnerabilities in the n8n AI automation platform (CVE-2025-68613) and Tenda routers (CVE-2025-7544) to expand its reach. The activity was first detected in January 2026. "Targeting of the n8n vulnerability is particularly interesting: Botnets typically exploit Internet of Things (IoT) devices, such as security cameras, DVRs, and routers, but n8n falls into an entirely different category," Akamai said. "Although this isn’t entirely new behavior for botnets, this sort of targeting presents a greater danger to organizations by exposing more critical infrastructure to compromise as the n8n exploit could enable lateral movement for a threat actor." Various ClickFix Campaigns Spotted — Threat hunters disclosed multiple ClickFix campaigns, including one leading to a hands-on-keyboard attack that deployed the Termite ransomware. The attack has been attributed to a group known as Velvet Tempest (DEV-0504). Another ClickFix campaign, codenamed OCRFix, used websites impersonating the Tesseract OCR tool as a launchpad for delivering malware that uses EtherHiding to retrieve the C2 server, send system information, and await further instructions. A third campaign has been found employing fake GitHub repositories impersonating software companies and leveraging ClickFix to social-engineer victims into installing infostealers, such as SHub Stealer v2.0. GTFire Phishing Scheme Detailed — A phishing campaign dubbed GTFire is abusing Google Firebase to host phishing pages and Google Translate to disguise the malicious URLs and bypass email and web security filters. "By chaining these services together, the attackers create phishing links that appear benign, leverage Google’s reputation, and dynamically redirect victims to brand‑impersonating login pages," Group-IB said. "Once credentials are submitted and harvested, victims are often redirected back to the legitimate website of the targeted organization, reducing suspicion and delaying incident response." The campaign is estimated to have harvested thousands of stolen credentials associated with more than a thousand organizations, spanning over a hundred countries and hundreds of industries. The threat actor behind the operation has been active since at least January 1, 2022. Mexico, the U.S., Spain, India, and Argentina are among the prominent targets. C77L Ransomware Targets Russia — A ransomware operation called C77L has been tied to at least 40 attacks on Russian and Belarusian enterprises since March 2025. The group is assessed to be operating out of Iran. Initial access to target networks is accomplished via weak passwords for publicly available RDP and VPN endpoints. "The targets of attacks are Windows systems due to their overwhelming predominance in the IT infrastructures of medium and small businesses," F6 said. RESURGE Malware Can Be Dormant on Infected Ivanti Devices — The U.S. Cybersecurity and Infrastructure Security Agency (CISA) updated its original alert for RESURGE, a piece of malware deployed as part of exploitation activity targeting a now-patched security flaw in Ivanti Connect Secure (ICS) appliances. The agency said "RESURGE has sophisticated network-level evasion and authentication techniques, leveraging advanced cryptographic methods and forged TLS certificates to facilitate covert communications," adding "RESURGE can remain latent on systems until a remote actor attempts to connect to the compromised device." 30 Members of The Com Arrested — A coordinated law enforcement operation led by Europol detained 30 individuals connected to an underground online community known as The Com. The operation, launched in January 2025, has been codenamed Project Compass. An additional 179 members were also identified as part of the investigation. The Com is the name assigned to a loose-knit cybercrime collective that has been linked to online doxxing, harassment, threats of violence, extortion, sexual exploitation, phishing, SIM swapping, ransomware, and other digital crimes. Europol described The Com as a decentralized extremist network. U.K. Government Cuts Cyber Attack Fix Times by 84% — The U.K. government has claimed it has reduced its backlog of critical vulnerabilities by 75% and reduced cyber attack fix times by 87%. Serious security weaknesses in public sector websites are fixed six times faster, cutting the average time from nearly two months to just over a week, the U.K. government said in an update published on 26 February. Poland Dismantles Organized Crime Group — Poland's Central Bureau for Combating Cybercrime (CBZC) dismantled an organized group that used phishing to take control of Facebook accounts and extract BLIK payment codes from victims. Eleven members of an organized criminal group operating in Poland and Germany between May 2022 and May 2024 were identified. Six suspects have been placed in pretrial detention as part of the investigation, and over 100,000 credentials were seized. The group used "phishing techniques to obtain login details for Facebook accounts, and then gained access to them and used instant messaging to extort BLIK codes from other users of the portal," CBZC said. Hacker Exploits Clade to Target Mexican Government Sites — An unknown hacker exploited Anthropic's Claude chatbot to carry out attacks against Mexican government agencies, according to a report by Gambit Security. "Within a month of the initial compromise, ten government bodies and one financial institution were affected, approximately 195 million identities exposed, and roughly 150GB of data exfiltrated: tax records, civil registry files, voter data," the company said. "The attacker even built an automated system that forges official government tax certificates using live data. It was orchestrated by an individual actor directing AI to operate as a nation-state-level team of operators and analysts." The operation ran on more than 1,000 prompts and regularly passed information to OpenAI's GPT-4.1 for analysis. The breach began in late December 2025 and continued for about a month. Anthropic has since disrupted the activity and banned all of the accounts involved. The attacks haven't been attributed to a specific group. 🔧 Cybersecurity Tools Titus → It is an open-source tool from Praetorian that scans code, files, repositories, and traffic to find leaked credentials like API keys and tokens. It uses hundreds of pattern rules and can check whether a detected secret is actually active. You can run it as a command-line tool, use it inside other tools as a Go library, or use it as extensions in Burp Suite or a browser to uncover credential leaks in different workflows. Sirius → It is an open-source vulnerability scanning platform on GitHub that automates network and system security checks to find weaknesses and risks in infrastructure. It combines community-driven security data with automated tests, runs within containers, and gives operators a unified view of vulnerabilities to prioritize remediation. Disclaimer: These tools are provided for research and educational use only. They are not security-audited and may cause harm if misused. Review the code, test in controlled environments, and comply with all applicable laws and policies. Conclusion Viewed one by one, these incidents seem contained. Seen together, they show how risk now flows across connected systems that organizations rely on daily. Infrastructure, AI platforms, cloud services, and third-party tools are deeply intertwined, and strain in one area often exposes another. The takeaway is clarity, not alarm. Adversaries are improving efficiency, scaling access, and operating inside normal processes. Reading through each report helps map that shift and understand how the broader environment is changing.

New research has found that Google Cloud API keys, typically designated as project identifiers for billing purposes, could be abused to authenticate to sensitive Gemini endpoints and access private data. The findings come from Truffle Security, which discovered nearly 3,000 Google API keys (identified by the prefix "AIza") embedded in client-side code to provide Google-related services like embedded maps on websites. "With a valid key, an attacker can access uploaded files, cached data, and charge LLM-usage to your account," security researcher Joe Leon said, adding the keys "now also authenticate to Gemini even though they were never intended for it." The problem occurs when users enable the Gemini API on a Google Cloud project (i.e., Generative Language API), causing the existing API keys in that project, including those accessible via the website JavaScript code, to gain surreptitious access to Gemini endpoints without any warning or notice. This effectively allows any attacker who scrapes websites to get hold of such API keys and use them for nefarious purposes and quota theft, including accessing sensitive files via the /files and /cachedContents endpoints, as well as making Gemini API calls, racking up huge bills for the victims. In addition, Truffle Security found that creating a new API key in Google Cloud defaults to "Unrestricted," meaning it's applicable for every enabled API in the project, including Gemini. "The result: thousands of API keys that were deployed as benign billing tokens are now live Gemini credentials sitting on the public internet," Leon said. In all, the company said it found 2,863 live keys accessible on the public internet, including a website associated with Google. The disclosure comes as Quokka published a similar report, finding over 35,000 unique Google API keys embedded in its scan of 250,000 Android apps. "Beyond potential cost abuse through automated LLM requests, organizations must also consider how AI-enabled endpoints might interact with prompts, generated content, or connected cloud services in ways that expand the blast radius of a compromised key," the mobile security company said. "Even if no direct customer data is accessible, the combination of inference access, quota consumption, and possible integration with broader Google Cloud resources creates a risk profile that is materially different from the original billing-identifier model developers relied upon." Although the behavior was initially deemed intended, Google has since stepped in to address the problem. "We are aware of this report and have worked with the researchers to address the issue," a Google spokesperson told The Hacker News via email. "Protecting our users' data and infrastructure is our top priority. We have already implemented proactive measures to detect and block leaked API keys that attempt to access the Gemini API." It's currently not known if this issue was ever exploited in the wild. However, in a Reddit post published two days ago, a user claimed a "stolen" Google Cloud API Key resulted in $82,314.44 in charges between February 11 and 12, 2026, up from a regular spend of $180 per month. We have reached out to Google for further comment, and we will update the story if we hear back. Users who have set up Google Cloud projects are advised to check their APIs and services, and verify if artificial intelligence (AI)-related APIs are enabled. If they are enabled and publicly accessible (either in client-side JavaScript or checked into a public repository), make sure the keys are rotated. "Start with your oldest keys first," Truffle Security said. "Those are the most likely to have been deployed publicly under the old guidance that API keys are safe to share, and then retroactively gained Gemini privileges when someone on your team enabled the API." "This is a great example of how risk is dynamic, and how APIs can be over-permissioned after the fact," Tim Erlin, security strategist at Wallarm, said in a statement. "Security testing, vulnerability scanning, and other assessments must be continuous." "APIs are tricky in particular because changes in their operations or the data they can access aren't necessarily vulnerabilities, but they can directly increase risk. The adoption of AI running on these APIs, and using them, only accelerates the problem. Finding vulnerabilities isn't really enough for APIs. Organizations have to profile behavior and data access, identifying anomalies and actively blocking malicious activity."

Claude expands tool connections using MCP Anthropic has added interactive tool support to its Claude AI platform, a change powered by the open Model Context Protocol (MCP). The update lets users work directly with external applications inside Claude’s interface rather than relying solely on text interactions with connected services. Interactive tools arrive in Claude With the update launched January 26, users can open tools such as project management boards, analytics dashboards, design canvases, and messaging platforms inside Claude’s chat interface. Users can view, edit, and interact with content from services including Asana, Box, Canva, Figma, Hex, monday.com, Slack and others without leaving the Claude window. These in-conversation interactive elements show real content from connected services and let users manipulate that content directly. The goal is to reduce context switching between tools. For example, a security operations team drafting incident messages in Slack or updating task timelines in Asana can do so while keeping Claude in view. Users can preview message drafts, adjust project task assignments, and generate charts with real data all inside a single workflow. Model Context Protocol at the core Anthropic first released MCP to the open community in 2024. The idea behind MCP is to provide an interoperable mechanism to expose functions, data, and controls from external systems into conversational and agentic AI workflows. Interactive tool support in Claude uses an extension to MCP called MCP Apps. This extension enables any MCP server to supply an interactive user interface that can render and accept user interactions directly inside an AI product. Anthropic says MCP Apps will let developers build interactive experiences that work across products that understand the protocol. What interactive support changes for workflows Before this update, many AI users relied on simple integration points that passed text or data back and forth between Claude and external systems. For instance, a user might ask Claude for a summary of recent entries in a document store or have it generate a draft email to send via another platform. Those interactions typically required switching to the target app to finalize or execute outputs. With interactive support, those outputs become a part of the interface. When a user asks to build a chart from analytic data, the chart itself appears inside Claude’s screen and users can adjust parameters in place. Project timelines and boards from collaboration platforms are visible within the conversation and edit controls appear alongside the content. Anthropic says this integration will be available for web and desktop versions of Claude and in several subscription tiers including Pro, Team and Enterprise. The company also notes that further integrations and tool support are in development. Developer and ecosystem implications MCP’s open nature has attracted other AI platform partners and tool providers who see value in a shared specification for exposing data and controls to large models. Industry observers have compared MCP to earlier interface standards that simplified how software components communicate with each other in complex environments. MCP provides a formal way to build connectors that let AI clients interact with enterprise systems and internal data stores. MCP servers can be custom built to pull from proprietary databases, CRM systems, internal documentation, or operational tools, giving organizations a path to bring internal context to AI-assisted workflows. Security considerations are part of the conversation around MCP adoption. Security researchers and integrators have noted attack vectors such as prompt injection and permission escalation can affect connectors that expose sensitive systems. Effective use of MCP servers typically involves managing access controls and validating the behavior of connected services.

Post-quantum security startup Project Eleven has announced raising $20 million in a Series A funding round that brings the total raised by the company to $26 million. The investment round was led by Castle Island Ventures, with additional support from Coinbase Ventures, Fin Capital, Formation, Lattice Fund, Nascent Ventures, Nebular, Quantonation, Satstreet Ventures, Variant, and an angel investor. Founded in 2024 by former US Army Infantry and Special Operations officer Alex Pruden, New York-based Project Eleven is building tools for organizations to migrate digital assets to the post-quantum era. The startup is known for Yellowpages, a post-quantum cryptographic solution for generating post-quantum keys for Bitcoin wallets, for open source variants of NIST-standardized post-quantum algorithms, and for a post-quantum testnet for Solana. Project Eleven says it is developing scalable solutions meant to improve security in the wake of an evolving quantum threat landscape, such as readiness assessments, migration paths, and migration test environments. As advances in quantum computing are expected to break existing cryptography solutions, the startup aims to support complex, multi-year migrations to quantum-resistant cryptography for networks and institutions. “As quantum capabilities advance, the stakes couldn’t be higher. We can’t afford to ignore this existential risk posed to the digital asset ecosystem,” Pruden, who serves as Project Eleven’s CEO, said. “Trillions in value depend on these cryptographic assumptions. Networks like Bitcoin take years to upgrade because they’re governed cautiously by design. We’re focused on making the transition practical now, so the industry can migrate deliberately instead of improvising under pressure,” he added. Related: Depthfirst Raises $40 Million for Vulnerability Management Related: Aikido Security Raises $60 Million at $1 Billion Valuation Related: WitnessAI Raises $58 Million for AI Security Platform

A new way to think about zero trust for workloads Static credentials have been a weak point in cloud security for years. A new paper by researchers from SentinelOne takes direct aim at that issue with a practical model for authenticating workloads without long-lived secrets. Instead of relying on static keys, the team proposes using temporary, verifiable tokens that expire within minutes. Breaking from static credentials The researcher’s core argument is that static keys are incompatible with zero trust. These credentials often last months or years, and if stolen, they can give attackers broad access to cloud resources. In multi-cloud settings, this becomes even harder to manage. Each static key adds to the operational load of rotating, auditing, and securing thousands of secrets that can be reused across environments. The researchers built and tested their model in a large enterprise environment that spans more than 100 Kubernetes clusters and multiple public clouds. Their system replaces static credentials with short-lived, cryptographically signed tokens that workloads use to prove their identity to other systems. Chris Boehm, Field CTO at Zero Networks, told Help Net Security that the concept aligns with how CISOs should approach zero trust in practice. “If I were advising a CISO, I would tell them to start with visibility. You must know every workload and understand who or what communicates with it. Then reduce access to the minimum necessary and allow privilege elevation only through controlled and monitored actions,” Boehm said. A federated model built on open standards At the heart of their approach is Workload Identity Federation (WIF) and OpenID Connect (OIDC). Together, these technologies allow workloads to authenticate through trusted identity providers rather than storing credentials locally. In practice, this means a workload requests a signed JSON Web Token (JWT) from its environment’s identity provider. The token contains claims such as who issued it, who it represents, and who can accept it. When the workload presents this token to another cloud service, that service checks the signature and verifies that the token was issued by a trusted provider. If the verification passes, the cloud issues a temporary credential for that request. The token is short-lived and scoped to a specific purpose, so even if it were stolen, its value to an attacker would be limited. The researchers describe this as a federated approach, where identity and trust flow between clouds through established, auditable relationships. Each request is verified independently, which supports the zero trust principle of “always verify.” Tested at enterprise scale SentinelOne deployed this architecture in its own production environment, which includes workloads across AWS, Google Cloud, and Azure. Before adopting the federated model, the environment used thousands of long-lived keys for service accounts, user identities, and cloud applications. After the shift, those static keys were replaced with on-demand tokens that last less than an hour. This reduced the average credential lifetime by more than 99 percent and cut the burden of managing secrets across platforms. The team also reported an 80 percent drop in the time needed for compliance audits, since the trust model became centralized and easier to trace. For developers, provisioning secure cross-cloud access went from taking days to minutes. The system automatically enforces least privilege by using claims within each token to limit what the workload can do and for how long. Cutting risk through short-lived access The paper compares the risk models of static credentials and federated tokens. In the legacy model, overall risk grows with the number of keys, their long lifetimes, and the wide permissions they often carry. The new model changes that by reducing lifetime and scope. A token might exist for only 60 minutes and be tied to one workload or API. This lowers the “blast radius” of any single compromise. The authors show that by shifting from persistent credentials to ephemeral tokens, the operational complexity also drops. Instead of managing thousands of secrets, teams manage only a few trusted identity providers. This helps control costs by reducing manual work and limiting resource duplication. Built-in defenses against known threats The framework addresses several common risks. The “Confused Deputy” problem, where a service is tricked into misusing its authority, is prevented by the audience claim in each token, which ensures it can only be used by its intended target. The model also removes the need to store secrets in files or secrets managers, reducing the risk of leaks during credential distribution. For third-party integrations, trust can be created through federation with the vendor’s identity provider and revoked instantly if needed. This avoids the slow and uncertain process of rotating static keys. Continuous verification redefined One of the most important ideas in zero trust is continuous verification, which the SentinelOne framework supports by requiring every workload interaction to be reauthenticated. Boehm noted that this concept is often misunderstood. “Continuous verification should not mean more MFA prompts or stricter NAC rules,” he said. “Those are momentary checks that expire the second access is granted. True continuous verification comes from using behavioral and contextual signals such as process activity, communication patterns, and timing to reassess trust dynamically.” His point echoes the research’s focus on minimizing implicit trust at the workload level. The paper shows that by combining identity federation with short-lived tokens, each request becomes its own trust decision, based on fresh data rather than static credentials. The road toward dynamic authorization While the current work focuses on authentication, the authors see room for expansion. They propose linking this system to attribute-based access control (ABAC), where tokens could include contextual information such as project tags or workload metadata. This would allow access decisions to change dynamically based on attributes. They also mention the idea of “just-in-time” credential issuance, where a token would exist only for the duration of a specific task or job. That would further narrow the window for attackers to exploit stolen credentials.

Old file types, new tricks: Attackers turn everyday files into weapons Attackers are finding new ways to blend in with everyday business tools, hiding their activity inside formats and processes that workers and IT teams often trust. The latest quarterly Threat Insights Report from HP Wolf Security shows how attackers continue to adapt, making it harder for defenses to keep up. Living off the land to stay hidden One of the most notable campaigns observed in the Q2 of 2025 involved the XWorm remote access trojan. Instead of relying on custom malware alone, attackers chained together multiple built-in Windows tools. These so-called “living off the land” binaries allowed them to execute commands, copy files, and decode hidden payloads without triggering as many alerts. XWorm configuration (Source: HP Wolf Security) The final XWorm payload was concealed in the pixels of a legitimate image downloaded from a trusted website. PowerShell scripts extracted the hidden data, then MSBuild, a Microsoft tool, ran the malware. By the time the infection was complete, attackers had remote access and the ability to steal data, with much of the work carried out by programs already present on the system. “Living off the land techniques are notoriously difficult for security teams because it’s hard to tell green flags from red – i.e. legitimate activity versus an attack. You’re stuck between a rock and a hard place – lock down activity and create friction for users and tickets for the SOC or leave it open and risk an attacker slipping through. Even the best detection will miss some threats, so defense-in-depth with containment and isolation is essential to trap attacks before they can cause harm,” said Dr. Ian Pratt, Global Head of Security for Personal Systems at HP Inc. Invoices and fake documents still work Phishing emails remain the dominant delivery method, accounting for 61% of threats that reached endpoints. Attackers continue to refine how they use document formats as lures. One campaign used realistic invoice-themed emails to trick recipients into opening SVG attachments. The attachments displayed a convincing imitation of Adobe Acrobat, complete with animations and progress bars, before prompting users to download malware. The script that followed was a lightweight reverse shell, providing attackers with command execution and data collection. Another wave of phishing leaned on PDF attachments that displayed blurred invoices with a download button. That link led to a malicious Visual Basic Encoded script hidden in a ZIP file. The script stored key parts of the malware directly in the Windows Registry, making detection even more difficult. The final payload was MassLogger, a credential stealer capable of capturing keystrokes and browser data. In some cases, if the victim was in France, attackers also deployed a secondary remote access trojan called ModiRAT. Old file types resurface The report also describes attackers repurposing formats that many users rarely see today. Compiled HTML Help files, once used for Windows application manuals, are now being weaponized to deliver malware. These files support scripting, making them containers for multi-stage infections. In observed campaigns, opening a help file disguised as project documentation triggered scripts that eventually led to XWorm infections. Shortcut files (LNKs) also made a return. In one case, they were disguised as PDFs inside a ZIP archive delivered through a phishing email. Instead of opening a document, the shortcut executed malicious code that installed the Remcos remote access trojan. The attackers hid the final payload inside an old Program Information File format, further lowering the chance that users or tools would catch it. Lumma Stealer survives takedown Even law enforcement actions have not stopped some operators. Lumma Stealer was disrupted in May 2025 through an international takedown that seized much of its infrastructure. Yet campaigns distributing it continued in June, with attackers shifting to new servers and methods. One delivery chain involved IMG archives attached to phishing emails. When opened, Windows treated these archives as virtual drives, presenting users with an HTML Application file disguised as an invoice. This eventually led to the execution of obfuscated PowerShell code that unpacked and ran Lumma Stealer in memory, bypassing disk-based detection. Threat delivery trends Archives were the top delivery method in Q2 2025, making up 40 percent of observed threats. Scripts and executables followed closely at 35 percent. Document formats such as Word, Excel, and PDF made up smaller but still significant portions. The findings show how attackers continue to rotate through different file types, choosing the ones most likely to reach users without being flagged. Even older formats like .chm help files and PIF executables are finding new life in current campaigns. What this means for defenders The report shows that attackers are putting effort into blending in with legitimate activity. By hiding malware inside trusted file formats, leaning on built-in system tools, and using realistic lures, they reduce the chances of being caught early. For defenders, this means looking beyond file signatures and basic filtering. Detection strategies that focus on behavior, persistence techniques, and misuse of system tools are becoming important. The campaigns described here show that attackers do not need advanced malware when familiar tools and file types can be turned into weapons. “Attackers aren’t reinventing the wheel, but they are refining their techniques. Living-off-the-land, reverse shells and phishing have been around for decades, but today’s threat actors are sharpening these methods. We’re seeing more chaining of living-off-the-land tools and use of less obvious file types, such as images, to evade detection. Take reverse shells as an example – you don’t have to drop a fully-fledged RAT when a simple, lightweight script will achieve the same effect. It’s simple, fast and often slips under the radar because it’s so basic,” noted Alex Holland, Principal Threat Researcher, HP Security Lab.

Threat actors are using novel living-off-the-land (LOTL) tactics to better evade detection, according to HP Wolf’s Q2 2025 Threat Insights Report. These tactics include the growing use of multiple, often uncommon binaries in a single campaign and novel uses of image files, making it harder for security teams to distinguish between malicious and legitimate activity. Alex Holland, a principal threat researcher at HP Security Lab, explained: “We’re seeing more chaining of living-off-the-land tools and use of less obvious file types, such as images, to evade detection. Take reverse shells as an example – you don’t have to drop a fully-fledged remote access Trojan (RAT) when a simple, lightweight script will achieve the same effect. It’s simple, fast and often slips under the radar because it’s so basic.” XWorm Malware Executed Through MSBuild In one observed incident, attackers chained together multiple LOTL tools, including lesser-known ones, to deliver XWorm malware, a RAT that contains capabilities for data theft and remote control. Notably, the final payload was hidden in the pixels of an image downloaded from a trusted website, decoded via PowerShell and executed through MSBuild. The attack began with the attackers distributing malicious Compiled HTML Help (.chm) files as email attachments, disguised as project documentation – something users often require when they need help using Windows applications. The malicious files contained no documentation, only malicious scripts designed to initiate a multi-stage infection. The embedded script uses several Windows LOTL binaries to evade the detection and execute the payload. This includes Using extrac32.exe to copy the legitimate Windows Script Host executable (cscript.exe) from System32 to the Public user directory. The campaign dropped a VBScript file into the Public directory, with PowerShell used to execute the script. The batch file, also executed via PowerShell, downloaded a JavaScript file to the ProgramData directory and runs it using the native Windows script interpreter The PowerShell script then downloaded an image from a digital asset management site called Tagbox. As this website domain was trusted and the file a valid image, it bypasses most security filters. However, this image contained hidden data, which is loaded into a bitmap object. This sets off a sequence of events that downloads, decodes and executes the final payload, XWorm, in the legitimate MSBuild process. PDF Lures to Deliver Malware The HP Wolf report, published on September 12, also highlighted novel uses of scalable vector graphics (SVG) files to deliver malware. SVGs contain Extensible Markup Language (XML)-like text instructions to draw resizable, vector-based images on a computer. The files provide a range of advantages for threat actors, including the fact they open in the default browser on Windows computers and can be used to draw a range of shapes and graphics, enabling the impersonation of multiple entities. They also typically behave like HTML documents, allowing attackers to abuse standard web technologies, like embedding JavaScript or referencing external resources hosted on attacker-controlled servers. In new incidents observed in Q2, attackers distributed extremely small SVG files that were not malicious on their own. When opened in a browser, the SVG displayed a convincing imitation of an Adobe Acrobat Reader interface, complete with a fake document upload animation and a loading bar that filled gradually. This gave the victim the impression of a legitimate web application. Once the fake upload completed, the user was prompted to retrieve the supposed involve. However, clicking the download button triggered a background request to an external URL, which served a ZIP archive. This ZIP archive contained a JavaScript file obfuscated through string substitution, granting attackers basic control over the infected system. The attackers also used geofencing to restrict downloads to specific regions – a tactic designed to evade automated analysis and delay detection. Lumma Stealer Spread via IMG Archives Lumma Stealer emerged as one of the more active malware families observed by the researchers in Q2 2025. In one notable campaign, the infostealer was embedded in IMG archives within phishing emails to evade detection. The disk image contained an HTML Application (HTA) file disguised as an invoice. If a user attempts to inspect the file in a text editor, the embedded script is hidden behind long sequences of whitespaces to evade casual analysis. When executed, the script compiled and ran a PowerShell command, which then downloaded an executable from a predefined URL. This executable was a Windows installer built using the Nullsoft Scriptable Install System (NSIS), an open source tool for creating installers. It runs a custom installation script, which creates several Registry keys referencing various file paths and attempts to open numerous non-existent files, likely intended to mislead analysts. Finally, the NSIS installer launched another PowerShell command, which executed a dropped file from the local AppData folder. The PowerShell ran two shellcodes, which after several unpacking stages, deployed and executed Lumma Stealer. The researchers noted that despite the law enforcement takedown of Lumma Stealer infrastructure in May 2025, campaigns continued in June and operators have begun rebuilding their infrastructure.

Every day, businesses, teams, and project managers trust platforms like Trello, Asana, etc., to collaborate and manage tasks. But what happens when that trust is broken? According to a recent report by Statista, the average cost of a data breach worldwide was about $4.88 million. Also, in 2024, the private data of over 15 million Trello user profiles was shared on a popular hacker forum. Yet, most organizations and project managers still assume that their platform's built-in backups are enough until they are not. The next few paragraphs will expose some risks of relying on these platform tools alone and how to better protect yourself and your organization from data loss with cloud backup and recovery. Why are project management tools becoming a prime target for data loss? More than 95% of businesses today rely heavily on project management tools like Trello and Asana to organize tasks, collaborate with teams, and track project milestones. However, as project managers become more deeply integrated into these tools for their daily operations and storing massive data volumes in one place, two major threats arise: human errors and cyber threats. Tiny human errors that cause massive data disasters Data is one of the most critical assets of every organization. It helps them understand customer behaviour, market trends, and internal performance. Also, for project managers, it provides insight into project timelines, risk management, resource allocation, and team productivity. When used effectively, it can be used to forecast business sales and revenue. However, while cyberattacks and natural disasters can lead to data loss, the human element is the most common cause. For example, teams and project managers that juggle multiple tasks and deadlines in a shared workspace create ample room for accidental deletions and mistakes. Also, according to a study conducted by the Computing Technology Industry Association (CompTIA), human error accounts for 52 percent of the root causes of security breaches. Other common human errors include misconfigured user permissions, unintended bulk actions, archiving projects too early, etc. The growing threat of cyberattacks Most project management tools today are cloud-based, enabling teams to collaborate remotely. However, they have also become attractive to cybercriminals. Cyberattacks such as phishing and ransomware are targeting these platforms with a lot of sensitive information that might cripple a business if found in the wrong hands. For instance, data reports by DocuClipper have it that "60% of small businesses that are victims of a Cyber Attack go out of business within six months". That is why you, as a project manager, need the proper information security to protect your data from such threats. Are built-in security features enough to protect your project data? The answer is No! And here is why. While most SaaS-based project management tools like Monday com, Trello, and Asana have basic built-in features such as role-based access control, data encryption, and authentication, they are not fully designed to protect against costly mistakes caused by human error. For project managers, this could mean the difference between staying on schedule and facing expensive delays. Limitations of native security project management tools No version history or rollback. Many project management tools don't offer full versioning, making restoring to the previous state difficult. Limited recovery windows. Platforms like Asana retain deleted tasks for 30 days. After that, it is permanently deleted without a trace. Basic trash bins aren’t enough. For instance, if a team member accidentally deletes a task, and it's not caught quickly, it might be impossible to restore such a task. Lack of protection against internal mistakes. Built-in features cannot stop major errors like accidental deletion of an entire board or misconfiguration of settings. Third-party backup: the missing layer in your SaaS project management tools Project managers and team leaders must be proactive when dealing with SaaS tools. And that includes having a third-party cloud backup for business. While SaaS project management platforms are efficient and feature-rich, they are vulnerable and are not immune to data loss. The rising cyber-attack threats, human error, compliance, and audit readiness have made third-party backup solutions essential for data protection. Leverage FluentPro Backup for Project Management Software FluentPro Backup is one of the best cloud-based backup and restore tools for project management software. Whether it is Monday.com backups, Asana, Smartsheet, Trello, Microsoft Planner Basic, Planner Premium, Microsoft Dynamics Project Operations, or Microsoft Dataverse database, the backup tool is designed to automate end-to-end data protection without requiring manual intervention from project managers or team leaders. Also, one of the defining strengths of FluentPro Backup is its ability to minimize data loss due to accidental deletion, sync error, or third-party integration failures. Capabilities of FluentPro Backup for SaaS project management tools Automated continuous backup. FluentPro Backup provides 100% automated backup that runs continuously and saves project versions. Quick restoration of projects. FluentPro Backup offers quick and automated recovery. For example, if a project was deleted due to human error or a cyber-attack, the software provides a one-click full project restore to minimize downtime and disruption. Granular restore. Project managers or teams sometimes don't need to restore an entire project, just a specific file or task. FluentPro Backup offers granular recovery options that allow you to restore individual items, subtasks, or labels. Enterprise-grade security measures. At the core of FluentPro Backup is project management software security. Understanding the importance of data security, the software protects your projects from unauthorized access and breaches. For instance, the software uses Microsoft Azure to store data with full compliance standards. Version control and audit trails. Version history is one of the outstanding features of FluentPro Backup software. The solution keeps historical snapshots of project data, which allows you to compare and restore changes between versions. Also, there is an audit trail that logs every backup and restores your SaaS project management tools. What real-world value does FluentPro Backup bring to businesses? Ensures project continuity. Always showing up is the most important thing for all businesses out there. This uninterrupted flow supports better project delivery outcomes and preserves client trust. Boosts team confidence and productivity. Project managers and teams can work productively when they know every task and project is backed up securely. Minimize operational and financial risk. Some of the most critical risks associated with data loss include costly delays, damaged reputations, and lost contracts. However, with FluentPro Backup, you can minimize this risk to the barest minimum without impacting business operations. Enhance stakeholder trust. Stakeholders and clients are the backbone of every business venture. You want to ensure that they are always happy doing business with you. You can assure them by demonstrating your backup and recovery strategies using the FluentPro Backup tool. Conclusion While SaaS project management tools like Monday.com, Asana, Trello, and Smartsheet are widely used for collaboration and task tracking, they come with several project management challenges that can compromise project data integrity and availability. However, by taking a proactive approach to project management security, you are well-positioned for any cyber threats or tiny human errors that might cause downtime, financial loss, and reputational damage. So don't wait until data loss disrupts your project workflow; invest in secure tools like FluentPro Backup to protect your project data and ensure your team and organization peace of mind.

Cybersecurity teams have suffered their lowest rate of budget growth in five years, which has had a cascading effect on hiring new staff, according to new research by IANS and Artico. Average annual security budget growth was 4% in 2025, significantly less than the 8% increase recorded in 2024. Just 47% of CISOs reported any increase in budget this year, down from 62% in 2024. Additionally, 39% had stagnant budgets, compared to 26% last year. The lowest annual security budget increases were observed in healthcare, professional and business services, and retail and hospitality. Growth rates were higher than average in financial services, insurance and tech, the report found. Between 2020 and 2024 security budget as a percentage of IT spending grew steadily from 8.6% to 11.9%, however, this year saw a drop of one percentage point to 10.9%. The IANS and Artico researchers believe this reversal is likely the result of a rebound in core IT spending, driven by AI and increased cloud infrastructure investments. Security budget as a percentage of revenue slowed marginally, suggesting that, on average, company revenue grew faster or at roughly the same pace as security budgets. The researchers said that restricted budget has been caused by global market volatility, fueled by ongoing geopolitical tensions. This includes business uncertainty around global tariff policies, and fluctuating inflation and interest rates. “In response, companies have become more cautious in their spending and hiring. More than in prior years, security organizations are affected as well, manifested by declining rates of growth for budgets and staff levels,” they noted. Majority of CISOs Experience Flat or Declining Team Sizes The IANS report, dated August 5, found that reduced budget growth has had an impact on the size of security teams, with staff growth falling to its lowest level in four years, at an average of 7%. Around half (47%) of firms have kept their team size flat, with just 45% able to add to their headcount in 2025. This compares to 67% in 2022, 55% in 2023 and 51% in 2024 who were able to increase the size of their teams. Nearly all (89%) of the CISOs surveyed also reported low or understaffed security teams, citing hiring and budget constraints as the primary cause. “They also note staffing shortages led to delays and cancellations of security initiatives, cause morale issues, increase the risk of noncompliance, and elevate organizational risk in general,” the researchers wrote. Regarding budget allocation, CISOs spend 39% on average on staff salary, followed by 29% on software and 12% on outsourcing. Categories such as project budgets, hardware and training consume smaller shares of the CISO’s budget. This budget breakdown has remained relatively stable over the past five years, the researchers noted. For the report, IANS and Artico surveyed 587 security executives at a diverse set of companies from April until August 2025.