bachmann

Week in review: ServiceNow pre-auth RCE exploited in the wild, Hugging Face breached Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: AI agents are still logging in as humans Most large companies run more than one AI platform at the same time. Developers pull up coding assistants, marketing teams lean on writing tools, and analysts query enterprise search across separate vendors. Single-provider setups keep giving way to mixed stacks as companies keep their options open. PR3TACK preemptive framework maps threats before attackers use them Defensive frameworks in cybersecurity record what attackers have already done. Analysts study a breach, document the method, and build detections around confirmed activity. This cycle leaves a gap between the moment an attacker invents a technique and the moment defenders learn to catch it. PR3TACK, the Preemptive Tactics and Countermeasures Knowledgebase, aims to close that gap. The air gap is a myth and other OT security truths Benjamin Bachmann, Director Group Information Security at Bilfinger, speaks with Help Net Security about defending industrial plants. He explains why attackers want to control operations instead of stealing data, and why the air gap is mostly a myth. Cisco’s open-weight Antares models make vulnerability localization cheaper A security analyst opens an unfamiliar repository, reviews a vulnerability advisory, and begins searching for the source file where the flaw resides. The naming conventions are unfamiliar, and clues are scattered across thousands of files. That initial triage can consume hours of expert effort. Cisco aims to shorten that process with Antares, a family of small language models designed to identify the source files most likely to contain a known vulnerability. Snowpick: Open-source ServiceNow exposure scanner An employee opens a company service portal, searches the knowledge base, and drops a file onto a ticket. Someone who never signed in can send a request to that same portal and get records back. Bishop Fox ran that test across 166 ServiceNow instances during authorized penetration tests. The firm published the results along with the Go tool it used, Snowpick. The AI code vulnerabilities that grow with your app Theori built 28 apps with AI coding agents and scanned each one through its pentesting platform. Five models did the building, split between Anthropic and OpenAI, across apps written from a spec, thrown together from a casual prompt, and rewritten from an aging PHP codebase. Multi-patch vulnerability fixes can leave open source exposed Vulnerability management runs on a shorthand. A CVE shows a linked patch, someone applies it, and the ticket moves to closed. That shorthand covers most open source fixes. A share work in a different way, arriving as a run of two or more commits where the first one leaves the flaw in place. Researchers at the University of Texas at Dallas went through 1,646 open source CVEs that carry more than one patch in the National Vulnerability Database, drawn from records filed between 1999 and 2025. Chaos ransomware msaRAT hides its C2 channel inside a legitimate browser process Cisco Talos has identified a Rust-based remote access trojan it attributes to the Chaos ransomware group, named msaRAT after four of the binding names left in the binary. The tool starts its own instance of Chrome or Edge on the victim machine and controls it through Chrome DevTools Protocol, a debugging interface built into both browsers. The browser then carries the command-and-control traffic over a WebRTC channel. The best-funded companies open the most phishing attachments An employee gets an email dressed as a password reset. She clicks the link, types her credentials into a page built to copy her company’s login screen, and moves on with her morning. She tells no one. That silence is the exposure. Across 13.9 million simulated phishing messages, one in ten recipients flagged the attempt to their security team. The rest let it through, and a live attacker needs only one of them. Hugging Face breached by autonomous AI agent Hugging Face, the widely used platform for sharing open-source machine learning models and datasets, has disclosed a security breach it says was carried out by an autonomous AI agent system. In a blog post published Thursday (July 16), the company said that earlier that week, it identified unauthorized access to some internal datasets and to several credentials used by its services. ServiceNow pre-auth RCE exploited in the wild (CVE-2026-6875) Attackers have begun exploiting CVE-2026-6875, a critical pre-authentication vulnerability in the ServiceNow AI Platform, according to threat intelligence firm Defused. CVE-2026-6875 is a code injection vulnerability that lets unauthenticated attackers escape ServiceNow’s script sandbox and execute code remotely on a targeted instance. SonicWall SMA zero-days were exploited weeks before disclosure Two recently disclosed SonicWall SMA 1000 vulnerabilities – CVE-2026-15409 and CVE-2026-15410 – were exploited in zero-day attacks for weeks, allowing threat actors to install custom malware on vulnerable VPN appliances, Volexity researchers revealed. JadePuffer returns with ransomware built to target AI models and infrastructure JadePuffer, the threat actor behind the recently documented extortion operation executed end-to-end by an AI agent, is now attempting to leverage ENCFORGE, novel ransomware created to target AI and machine learning (ML) infrastructure. The extortion contact embedded in the ransomware is the same one Sysdig researchers found when analyzing that prior campaign. Another SharePoint RCE exploited: Patch, then rotate your machine keys (CVE-2026-50522) Attackers are exploiting a critical SharePoint remote code execution (RCE) vulnerability (CVE-2026-50522) to extract the servers’ IIS machine keys. WatchTowr’s global honeypot network registered successful exploitation attempts on July 20, mere hours after the release of the proof-of-concept exploit and less than a week after Microsoft confirmed that CVE-2026-56164 (an privilege elevation flaw) and CVE-2026-58644 (a RCE vulnerability) are being actively exploited by attackers. OpenAI: Our models breached Hugging Face during a cyber capability test The recent Hugging Face breach was the work of several OpenAI models, the AI research company claimed in a blog post. Late last week, the company behind Hugging Face, a platform that enables users to share machine learning models and datasets, said some of its internal datasets had been accessed without authorization. Attackers exploit critical Check Point flaw to take over firewall management (CVE-2026-16232) Attackers are exploiting a critical authentication bypass vulnerability (CVE-2026-16232) that affects Check Point Security Management and Multi-Domain Security Management, the management servers that push policy to Check Point security gateways (i.e., firewalls). How attackers hosted a fake Claude download page on the claude.ai domain A threat actor abused Anthropic’s Claude Artifacts feature to funnel users toward malware, Huntress researchers have disclosed. Employees at at least 29 organizations were compromised over two days in July, after searching for the Claude desktop app and clicking a sponsored Bing ad. Shadow AI is becoming enterprise security’s biggest blind spot Artificial intelligence has moved from experimentation to everyday business operations with remarkable speed. Employees are using it to summarize documents, draft communications, analyze spreadsheets, write code, build automations, and create AI-powered workflows across nearly every business function. As AI is integrated into team members’ daily jobs, businesses are struggling to keep pace with governance, management practices, and organizational readiness. More alerts are making your team slower, and an outcome-based SOC fixes that In this Help Net Security video, Thom Langford, EMEA CTO, Rapid7, explains why piling on more security alerts makes a SOC slower to respond. Attackers log in with stolen credentials and use trusted tools like PowerShell instead of custom malware. He shares a case where attackers called a help desk, reset a privileged cloud account, and exposed thousands of passwords in three minutes. Building a defense in depth strategy for sensitive data In this Help Net Security video, Venkata Pavan Kumar Gummadi, Professional Software Engineer at Broadridge, explains how to build a defense in depth strategy for protecting sensitive data. Governing Al agents at scale: Lessons from the leaders who’ve done it Enterprise AI leaders from ZoomInfo, Docusign and AppViewX share what it took to build AI Centers of Excellence and govern agent identities inside two companies operating at scale. A forensic tool for backdoored code completions in AI assistants Developers lean on AI coding assistants for a growing share of their daily work, letting the tools predict the next few lines and accepting many suggestions with a quick glance. Those tools learn from large collections of code, and some of that code can be tampered with before training starts. A poisoned example teaches a model to write insecure code when it sees a certain cue, and the flaw sits quietly until the right prompt sets it off. Italy fines WINDTRE €1.7 million over security flaws behind two data breaches Italy’s data protection authority, the Garante per la Protezione dei Dati Personali, fined WINDTRE €1.7 million over “serious data security shortcomings” that let hackers breach its systems twice and exfiltrate personal data belonging to more than 365,000 customers. Paidwork breach exposes sensitive data of 23 million users Data belonging to more than 23 million users has been exposed following a breach at Paidwork, a platform that pays people for completing online microtasks. Paidwork markets itself as a way to earn money through simple tasks like watching ads, testing apps, and completing surveys, with most jobs paying only a few cents at a time. HOLLOWGRAPH malware turns Microsoft 365 calendars into an espionage channel Microsoft 365 calendars have become a hiding place for espionage malware, with commands and stolen files stashed inside appointments dated to the year 2050, researchers from Group-IB discovered. The Odyssey piracy scams surface hours after its theatrical debut Christopher Nolan’s The Odyssey had barely reached theaters before scammers began targeting people searching for pirated copies, according to Malwarebytes. Within hours of the film’s release, researchers found two separate scams running on cloned piracy sites: fake browser warnings and Windows executables disguised as movie downloads. Estée Lauder discloses data breach tied to Oracle EBS vulnerability Cosmetics company Estée Lauder disclosed a data breach tied to a vulnerability in Oracle E-Business Suite (EBS) used for the company’s human resources operations. The data taken varied from person to person. According to the notification, it included names, postal and email addresses, dates of birth, Social Security numbers, passport numbers, bank account numbers, health information, and employment records such as performance evaluations and payroll history. Fake FBI agents target people who already got scammed Scammers are impersonating FBI personnel who supposedly handle Internet Crime Complaint Center (IC3) complaints, using that disguise to deceive and revictimize people who already lost money once. AI agents tricked into recommending malicious GitHub repositories Roughly 7,600 malicious GitHub repositories were uncovered, more than 800 of them posing as AI Skills or Model Context Protocol (MCP) servers, in a wave that peaked in April 2026, according to Island. Small teams are the heaviest users of AI coding agents The pull request arrives with the tests already run and the description already written, the work of an agent that handled the whole thing on its own. Somebody still has to read it. On GitHub that somebody is usually one developer sitting alone with the diff, and the rest of the project never sees the code. Maliha Noushin Raida and Daqing Hou at Rochester Institute of Technology sorted 25,264 agentic pull requests by who reviewed them and who committed to them. Police dismantle Kratos phishing platform behind 15,000 monthly campaigns German and US law enforcement have dismantled the infrastructure behind Kratos, a notorious phishing-as-a-service (PhaaS) platform. Its alleged developer and administrator was arrested in Indonesia by local police. AI models cheat on cybersecurity evaluations, then fail to admit it Frontier AI models will take just about any route to finish a task, cheating included, according to new cybersecurity evaluations from the UK government’s AI Security Institute (AISI). AISI defines cheating as a model doing something outside the bounds of what a task allows, or breaking a stated rule outright, in order to reach the goal through a shortcut the task wasn’t designed to permit. US seizes over 1,000 domains used for illegal World Cup 2026 streams The US Department of Justice has seized more than 1,000 internet domains that streamed FIFA World Cup 2026 matches without a license. The seizures came in three waves over the course of the tournament. The first two rounds took down nearly 400 domains by the end of June, and two later rounds pushed the total past 1,000. OpenAI Presence connects AI agents to enterprise data with built-in guardrails OpenAI has introduced Presence, a product designed to help companies deploy AI agents that handle customer support and internal service requests across voice and chat. The company describes Presence as a deployment platform rather than a standalone model. Swiss rail manufacturer Stadler refuses to pay $12.3 million ransom after cyberattack Cybercriminal group Everest is demanding 10 million Swiss francs ($12.3 million) from Swiss rail vehicle manufacturer Stadler after breaching a data exchange platform shared with one of its suppliers through compromised credentials. Months-long breach exposes South Korean diplomats’ personal data South Korea’s Foreign Ministry has disclosed that attackers breached the Korea National Diplomatic Academy’s online education system, compromising personal data belonging to current and former ministry staff and diplomats stationed abroad. Ransomware gangs go after EMEA healthcare’s supply chain A ransomware attack against a hospital makes headlines, while attacks on the rest of the ecosystem around it tend to stay quiet despite doing damage that can be just as bad. Flare researcher Assaf Morag analyzed ransomware leak-site activity tied to healthcare organizations in the EMEA region between 2024 and 2026, and found that ransomware groups are going after the entire healthcare supply chain. Google gives developers an AI bug hunter that also writes patches Google has launched a preview of CodeMender, an AI agent built to scan code for security flaws, confirm they are exploitable, and generate fixes for developers to review. The company describes it as a response to attackers who are already using AI to speed up their work, arguing that defenders need automation that moves at the same speed. Russian hackers exploit unpatched Zimbra servers to steal emails Russian state-backed hacker group Laundry Bear has been breaking into government and commercial networks for at least a year by exploiting a vulnerability in the Zimbra Collaboration Suite (ZCS) webmail platform. Meta takes on AI-generated accounts with free Facebook verification badge Meta has introduced Facebook Verified, a free badge meant to show that a person behind a profile has completed identity verification through a selfie check. The company says the goal is to give users a signal that they are dealing with a person, not a bot or an AI-generated account, when browsing Marketplace listings, dating profiles, or Group conversations. Nearly half of open-source AI projects never reach production Open models are moving into production across more organizations, and the work of securing those deployments increasingly extends beyond the model weights. Mozilla’s The State of Open Source AI 2026 identifies deployment, governance and operational tooling as persistent obstacles as model capability improves. Product showcase: ZoneAlarm Mobile Security adds customizable content filtering to mobile security ZoneAlarm Mobile Security is a security app from Check Point designed to protect mobile devices against phishing, malicious websites, unsafe networks, and fraudulent links. It is available for iPhone, iPad, Android, and can run on Apple silicon Macs through the App Store. Meet Dusseldorf, Microsoft’s open-source out-of-band security platform Out-of-band vulnerabilities surface when an application quietly reaches out to an external system during an attack, and capturing that traffic calls for infrastructure that many researchers assemble on their own. A new open-source project from Microsoft supplies that infrastructure in a package meant to run inside a private environment. The Windows 10 hangover is becoming a security problem Windows 11 now runs on 78.8% of Windows devices after Microsoft ended support for Windows 10 on 14 October 2025, according to Lansweeper. Windows 10 still accounts for 16.9% of devices and no longer receives security updates, leaving newly discovered vulnerabilities unpatched. AI-generated reports push GNOME to shorten its disclosure window Volunteer maintainers of open source projects now receive a steady flow of security vulnerability reports produced with AI tools. Many arrive with no mention that a language model helped write them. The volume has grown enough that GNOME is revising the rules it uses to track and disclose vulnerabilities across its projects. Nobody was checking the drives that encrypt your laptop A drive ships with a label promising hardware encryption. You plug it in, set a password, and trust the chip inside to handle the rest. Millions of laptops and workstations run this way, on solid-state drives built to the TCG Opal2 standard. Milan Brož and three colleagues bought 38 of those drives and ran them through a test bench. Open-source maintainers still work underfunded as sponsorship crosses $100 million A maintainer patches a library late at night that ships inside thousands of products, without receiving payment. Sebastián Ramírez (tiangolo) builds tools that many Python projects depend on, while Caleb Porzio created Livewire and Alpine.js, widely used by web developers. That gap comes at a cost. Critical projects lose maintainers to salaried jobs, security fixes slow, and software supply chains become more fragile. AWS wants GuardDuty to automate the first steps of threat investigations Amazon GuardDuty investigation agent is now in public preview. The feature provides AI-powered investigations of GuardDuty findings, AWS accounts and AWS organizations, helping security teams reduce investigation time. Cloud operations become the next big role for agentic AI Companies are using agentic AI to manage growing application environments, automate routine tasks, and support decisions. Business and IT leaders increasingly see the technology as part of cloud application management, according to Unisys’ AI & Cloud Insights Report. AI can’t fix cybersecurity’s hiring problem Organizations are redefining cybersecurity roles through workforce frameworks and placing greater emphasis on verified skills as AI and new regulatory requirements change hiring. The SANS 2026 Cybersecurity Workforce Survey found demand for specialists in new roles more than doubled over the past year, alongside increased hiring for existing cybersecurity skills. Security teams keep finding critical flaws after scheduled testing ends Enterprise environments change between scheduled security assessments, leaving organizations with periods where new vulnerabilities can go undetected. Synack’s State of Continuous Security Validation report found that 95% of surveyed organizations identified high- or critical-severity vulnerabilities outside planned testing windows during the past year, with 42% encountering them at least once a month. Google’s Gemini 3.5 Flash Cyber becomes a vulnerability hunter Google’s Gemini 3.5 Flash Cyber model finds, validates, and patches vulnerabilities before they can be exploited while helping mitigate broader misuse. It is part of a limited-access pilot program that will soon be available to governments and trusted partners through CodeMender, Google DeepMind’s AI coding agent, with broader access planned over time. GitHub revamps bug bounty program with new VIP tier, payout changes GitHub is changing its bug bounty program to reward higher-quality vulnerability reports and reduce low-effort submissions, including AI-generated reports. The changes will take effect on July 27, 2026. Reports submitted before that date will be honored under the previous bounty structure. PyPI hardens package security with new upload restrictions The Python Package Index (PyPI) now rejects uploads of new files to releases older than 14 days to prevent attackers from poisoning long-stable releases if a project’s publishing tokens or release workflows are compromised. Ransomware in 2026: More groups, more victims, no slowdown Ransomware activity followed a recognizable pattern during the previous four years. Each year was defined by a dominant actor, its collapse, or a major supply chain incident. Black Kite’s 2026 Ransomware Report documents a more fragmented market, with multiple ransomware playbooks scaling at the same time. The automotive software vulnerabilities hiding in your dashboard Pop the hood on a new car and you won’t find much you can fix with a wrench. What you’ll find is software, and a lot of it. The screen in the dash probably runs Android or a flavor of Linux. The system watching the road for you might run QNX or VxWorks, the same kind of code that flies aircraft and runs factory floors. Google’s newest sign-in method asks you to look at the camera Google’s selfie video sign-in option verifies that an account owner is a real person and that the account wasn’t created or used by computer programs or bots for the purpose of abuse, such as spamming. It is not available for all regions, accounts, or devices. Microsoft tightens Windows enterprise activation security Microsoft is making Trusted Platform Module (TPM)-backed attestation a requirement for Windows Key Management Service (KMS), the on-premises service used for Windows volume activation, replacing the software-only trust model with hardware-backed verification to strengthen enterprise activation security. Product Showcase: AppViewX Agent Identity Security Agent Identity Security is a product within the AppViewX platform that enables zero-trust for AI agents by continuously discovering, monitoring, governing, and securing identities across their lifecycle. Cybersecurity jobs available right now: July 21, 2026 We’ve scoured the market to bring you a selection of roles that span various skill levels within the cybersecurity field. Check out this weekly selection of cybersecurity jobs available right now. New infosec products of the week: July 24, 2026 Here’s a look at the most interesting products from the past week, featuring releases from Astelia, Druva, Swimlane, and ThreatDown.

The air gap is a myth and other OT security truths Benjamin Bachmann, Director Group Information Security at Bilfinger, speaks with Help Net Security about defending industrial plants. He explains why attackers want to control operations instead of stealing data, and why the air gap is mostly a myth. Bachmann covers how containment plans get negotiated before an incident, how to build visibility on old equipment through network monitoring, and how ransomware crews price their demands on downtime. He also questions the idea that people are the weakest link in OT security. When you walk an executive who has never set foot in a plant through your threat model, what is the one misconception you find yourself dismantling first? That the attacker wants our data. Most executives come from a world where a breach means stolen files, and that mental model is hard to shake. But nobody breaks into an industrial environment to read the recipe for district heating. They want the button that makes things stop. Once you reframe the threat model from “someone steals our secrets” to “someone else is operating your plant,” the conversation changes completely. Suddenly availability and physics are on the table. At Bilfinger, we operate in highly sensitive environments like refineries, chemical plants, and energy infrastructure, where this shift in perspective helps to prioritize investments where they have the most impact on resilience. The second misconception usually dies on the same walk: “But it’s all air-gapped, right?” The air gap is the unicorn of industrial security. Everyone has heard of it; nobody has actually seen one in the wild. It typically survives until the first cabinet with a forgotten LTE dongle in it. Engineers optimize for uptime and safety. Security teams optimize for containment. When those instincts pull against each other during a live incident, who wins in your organization, and how did you arrive at that answer? I push back on the premise. Containment is not my goal, it is my method. The goal is the same one the engineers have: a plant that runs safely. The moment security becomes the department that stops production, I have turned myself into a second incident. So, the honest answer is: nobody has the upper hand in this scenario at 3 a.m., because we refuse to have it at 3 a.m. Whoever “wins” a live incident won it years earlier. Plant state belongs to the people who understand the process. Network state belongs to my team. And the trigger points where one touches the other (which zone gets isolated, under which conditions, at what cost per hour) are negotiated in daylight, written down, and exercised. An incident is a terrible moment for an org chart debate. There is also a tactical reason for this. If my containment plan requires halting production, an attacker no longer needs to break the plant. They just need to trigger my plan. A security team that can only respond by pulling the plug is not a defense. It is a free denial-of-service button. That realization shaped the architecture: containment has to be cheap enough that nobody ever has to choose between safety, uptime, and defense. A lot of legacy equipment was never designed to authenticate anything or log anything. How do you build defensible visibility on top of protocols that predate the concept of a threat actor? I stopped expecting the devices to testify and started treating the network as the witness. A controller from 1998 was never designed to tell you what happened. But it never lies on its own. If it starts lying, someone taught it to. It does exactly one thing, in the same rhythm, for decades. People frame that as legacy debt. I frame it as the most underrated security feature in industrial environments. IT traffic is chaos. People browse, update, stream, join video calls. OT traffic is choreography. The same devices, the same conversations, the same cadence, every day outside of maintenance windows. Against chaos, an anomaly is a needle in a haystack. Against choreography, it is a stranger on the dance floor. So, visibility gets built around the equipment, not on it: passive listening at a few choke points, segmentation strict enough that those choke points see every conversation that crosses a zone boundary, and a baseline that someone genuinely maintains. That last part matters, because visibility has quietly become a product category, and a sensor nobody baselines is just a screensaver with a license fee. And note the word in the question: defensible. Defensible does not mean you saw everything. It means that when something happens, you can state with confidence what normal looked like, when it stopped, and what was within reach. That is a sentence you can defend in front of a board, a regulator, or an insurer. “We had a dashboard” is not. Ransomware crews have learned that halting production is more lucrative than encrypting files. How has extortion against physical operations changed your calculus on segmentation and recovery? It forced us to look closely at the economic calculation behind these attacks. Cybercriminals calculate the exact cost of operational downtime to set their demands. This means our defense strategy cannot just be about building higher walls, it must focus on disrupting their business model by making downtime as short and manageable as possible. Once you see it that way, segmentation and recovery stop being two separate disciplines and become one question: how fast does this operation get back to a safe state without paying anyone? Segmentation defines how much of the plant can restart independently of the compromised part. Recovery defines how fast that restart actually happens, which is why we rehearse restarts, not restores. Engineering workstations, project files, controller configurations, held offline and tested. The capability that matters most here is degraded operation. Waiting for a forensically perfect network before restarting is exactly the delay the extortion is priced on. An operation that can run safely at partial capacity while the rest is cleaned up has taken the leverage out of the negotiation. What is a widely repeated piece of OT security advice that you think is quietly wrong? “The human is the weakest link, so invest in awareness.” It sounds humble, it fits on a slide, and it is quietly wrong. If clicking a link can stop a turbine, the problem is not the click. It is an architecture that lets a click reach a turbine. I sum this up as “trust is not a control”. People are part of the system, not the threat inside it, and systems get engineered. In practice, that means I stopped caring about phishing click rates and started caring about paths from a click to a controller. One number describes people. The other describes the system. Only one of them is mine to fix. Runner-up: “Never touch OT, you will break it.” Repeat that for 20 years and it becomes “never secure OT”. Caution is a virtue. Paralysis just likes to dress up as one. Download: The ultimate guide to network operations management