berkeley

SAAS Salesforce partners not seeing meaningful revenue from Agentforce AI platform, report saysShow us the money ai and ml AI companies are burning books, advocates complain to FTCFahrenheit 203, the temperature GPUs stop gorging on literature DEVOPS Go updates may delight diehard gophers but displease AI overlordsv 1.27 expands generics to support methods EDGE AND IOT Waymo has designed a robocar chip to stay ahead of Tesla5 nm ML accelerators promise 1,000+ TOPS, ultra-low latency SYSTEMS AMD inches closer to its goal of making AI suck less ... energyHouse of Zen claims latest systems already 4x more efficient than two years ago Security Russians are posing as Signal support to launch phishing attacksPLUS: US takes down Iranian propaganda sites; Marketing company asks 'Why Do We Have Your Information?' And more! Security Microsoft patches failed to fix on-prem SharePoint, which is now under zero-day attackPLUS: China upgrades smartphone surveillance tools; Ring eases anti-snooping stance; and more Black Hat and DEF CON DEF CON Franklin project enlists hackers to harden critical infrastructureVoting village reports have been so successful, says Jeff Moss, that the whole of DEF CON will now be included Security EQT buys majority share in Swiss cybersecurity biz AcronisWent at equivalent of $3.5B+ valuation for entire firm, though portion sold not specified Malware Month Ten years since the first corp ransomware, Mikko Hyppönen sees no end in sightOn the plus side, infosec's a good bet for a long, stable career FOSS smashed one Microsoft monopoly. After 20 years of failure, it's time to smash anotherWord up GNOME can look like Windows – and Flashback can do it without extensionsNew 'Simple-taskbar' is an option, but there's a simpler, stabler way A moment of silence, please, for the final release of Debian on x86-32New Debian versions hit FOSSland in the form of 13.6 and 12.15 Baddies caught exploiting extensions bugs with perfect 10 scores on vulnerable Joomla websitesFlaws in iCagenda, Balbooa Forms extensions can impact open source CMS that powers a million sites worldwide Frame: A new X11 server – implemented directly in assemblyJoins yserver, Phoenix, and of course XLibre – and outlier Arcan Cinnamon 6.8 will support Wayland – if you want itNext version of Linux Mint’s desktop has both kinds of display server

Prompt injection is becoming the XSS of the web agent era Autonomous web agents read whatever a page displays, and much of that content comes from strangers. Product reviews, seller listings, and advertisements sit beside trusted site menus on a single page. An agent that reads all of that text as instructions can be steered by any of it. A group at UC Berkeley describe Cross-Site Prompting, or XSP, as the agent-era version of Cross-Site Scripting. Their system, Prismata, sits between a web agent and the browser. It filters the content an agent sees and limits the actions the agent can take. An old attack surface in new clothes The comparison to XSS runs through the whole design. Cross-Site Scripting lets an attacker plant a script on a trusted site so it runs in a visitor’s browser. XSP swaps executable code for plain language. An attacker writes a product review that tells the agent to send the user’s credit card details to a stranger, and the agent may comply. Older web defenses translate poorly to this setting. Input sanitizers screen for code, and prompt injections carry none. Prismata operates between the web agent and the browser, providing a system-level defense that filters and constrains web content before it reaches the web agent (Source: Research paper) Reading page structure to make the call Prismata works from the structure of the page. For any button, link, or form field, there is a path of ancestor elements running from the top of the page down to that element. The Berkeley team measured that these paths consist almost entirely of developer-written scaffolding such as layout containers and navigation. A reasoning model reads only that path and the user’s task, then decides whether the element belongs to the task. An injection sitting elsewhere on the page stays out of that decision. The measurement came from a corpus of real pages. Across more than 90,000 samples of untrusted content drawn from Common Crawl and Mind2Web, about 1.2 percent sat on a path leading to something the agent could click or fill. The rest were dead ends for an attacker. For the small share of cases where untrusted content does sit on such a path, Prismata borrows from a 1977 security design. The Biba integrity model enforces a no-read-down, no-write-up rule, and the team applies it to the page tree. The system reads each layer of the path before revealing its children, watching for signs that untrusted content is coming. Headings such as “Reviews,” accessibility labels, and developer class names like review-card mark the boundary. When a signal appears, everything below it inherits a lower trust label and gets pruned or set to read-only. Results in a test environment The tests ran in WebArena, which is about as close to the live web as a benchmark gets. It runs a real GitLab instance and a production-grade shopping platform, so the page structures resemble what an agent would meet in the wild. The attacks were pop-up style lures planted where a malicious user or ad network could plausibly put them. Attack success dropped from 85.5 percent without the defense to 0.7 percent with it. An attack counted as a win for the attacker when the agent took the bait, clicking a planted link or filling an injected form.Blocking attacks is one thing. Getting the agent to finish its job under attack is another, and here the gains were also sizable: task completion under attack climbed from roughly one in twenty to nearly one in four. Agents that would have wandered off into a fake pop-up stayed on task. With no attack present, task success slipped from 29.9 percent to 26.6 percent once the filtering kicked in. A few points of utility buys a lot of containment. The labels driving all of this come from language models, and the choice of model matters. Six labelers went head to head against human security experts on a set of WebArena pages, and each one admitted elements that lined up with the experts more than nine times out of ten. GPT-5.4-nano was the most cautious of the group, hitting 98.69 percent precision at the cost of the lowest recall. Gemini 3 Flash scored the highest F1. The limits When an injection sits on the path to an action with no signal ahead of it, the attacker’s text reaches the deciding step, and neither mechanism keeps it out. The team found this in roughly one in a thousand paths, dropping to about 0.017 percent on sites that follow web best practices. Well-built sites shrink the gap. Messy ones widen it. Language models sit at every stage of the pipeline, which sets a ceiling on the guarantee. 95 percent F1 score still leaves room for a single mislabel on a critical element to let an attack-relevant element through. Averages hide worst cases. Then there is the question of what happens when a determined attacker goes looking for that seam. The paper reports that Prismata held up against adaptive attackers who ran iterative attempts to fool its labeling, driving those attacks to zero. That is encouraging. It is also a small sample against a threat class. The bigger picture is an old idea carried into new territory. Classical confinement principles meet probabilistic model outputs, and the whole thing rests on two bets: that the models label pages well, and that sites keep structuring their HTML the way convention says they should. Anyone running agents that hold a user’s credentials and payment details has reason to watch where this goes. Guide: What automated pentesting alone cannot see

More than 400 packages in the Arch User Repository (AUR) are distributing a Linux rootkit and infostealer malware targeting credentials and access tokens. A report from the open-source intelligence community Independent Federated Intelligence Network (IFIN) notes that a new maintainer is spoofing a trusted publisher on the AUR platform to push infected packages. The Arch Linux distribution is popular among power users and developers, using the AUR catalog to provide the latest versions for installed software, drivers, and the kernel. AUR is a community-maintained repository for the Arch distribution that contains package build scripts (PKGBUILDs) with instructions for downloading, compiling, and installing software not available in Arch’s official repositories. AUR is considered essential for any Arch-based distribution because it contains proprietary applications, beta/nightly versions of open-source software, niche utilities, and older versions of packages that retain functionality which may have been removed in later releases. However, it is not a vetted space, and threat actors can use it to push malware through packages that change ownership without anyone noticing. According to IFIN member Michael Taggart, the compromised packages are modified with preinstall scripts that download and execute a malicious npm package called atomic-lockfile. Independent security researcher Whanos notes that one sample of the atomic-lockfile included a Linux ELF payload named deps, which was a "credential stealer with optional root-only eBPF [extended Berkeley Packet Filter] rootkit capabilities." "It is designed for developer workstations and build environments. It targets browser and Electron application data, Slack, Microsoft Teams, Discord, GitHub, npm, Vault, Docker/Podman, SSH, VPN material, shell histories, and other local developer secrets," Whanos says in the report. With eBPF technology present, the malware can run inside the kernel with elevated privileges and hide local processes. Supply-chain management company Sonatype also published a report on a campaign targeting the AUR repository and delivering the malicious atomic-lockfile npm package, but using a different method. Sonatype researchers say that the threat actor hijacked at least 20 orphaned packages on AUR and pushed atomic-lockfile by modifying the PKGBUILD file - a Bash script with the build information needed by Arch Linux packages. According to the report, the attacker added a post-install script to invoke npm and retrieve the malicious package. "The modified packages add a post-install script that invokes npm and installs atomic-lockfile during package installation," Sonatype says. However, analysis showed that the npm package installed a Linux executable with references to an eBPF rootkit that could hide processes, files, and network interfaces. Additionally, the Linux binary indicates that it has infostealer functionality, targeting the following types of sensitive information: GitHub credentials SSH artifacts HashiCorp Vault tokens Browser cookie databases Slack data Discord data Microsoft Teams data Telegram data Sonatype determined that the binary can archive data, handle multi-part files, and perform HTTP uploads, so the functionality for a typical exfiltration mechanism is present. AUR maintainers are working to identify and remove all malicious commits, and to ban the accounts pushing them. In a message to the community, Arch Linux package maintainer Jonathan Grotelüschen urged users to report any malicious package they find. As a general rule, it’s recommended to only trust projects with frequent updates and an active community around them. Arch users are advised to review the list of affected packages and look for the indicators of compromise provided in the report from Whanos. Michael Taggart also pointed to a script that checks for the atomic-lockfile malware on the system. If compromised packages are found, users should rotate all credentials and consider reinstalling Arch from scratch, since a rootkit may survive normal cleaning efforts. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

A long-term and ongoing campaign attributed to a China-nexus threat actor has embedded itself in telecom networks to conduct espionage against government networks. The strategic positioning activity, which involves implanting and maintaining stealthy access mechanisms within critical environments, has been attributed to Red Menshen, a threat cluster that's also tracked as Earth Bluecrow, DecisiveArchitect, and Red Dev 18. The group has a track record of striking telecom providers across the Middle East and Asia since at least 2021. Rapid7 described the covert access mechanisms as "some of the stealthiest digital sleeper cells" ever encountered in telecommunications networks. The campaign is characterized by the use of kernel-level implants, passive backdoors, credential-harvesting utilities, and cross-platform command frameworks, giving the threat actor the ability to persistently inhabit networks of interest. One of the most recognized tools in its malware arsenal is a Linux backdoor called BPFDoor. "Unlike conventional malware, BPFdoor does not expose listening ports or maintain visible command-and-control channels," Rapid7 Labs said in a report shared with The Hacker News. "Instead, it abuses Berkeley Packet Filter (BPF) functionality to inspect network traffic directly inside the kernel, activating only when it receives a specifically crafted trigger packet." "There is no persistent listener or obvious beaconing. The result is a hidden trapdoor embedded within the operating system itself." The attack chains begin with the threat actor targeting internet-facing infrastructure and exposed edge services, such as VPN appliances, firewalls, and web-facing platforms associated with Ivanti, Cisco, Juniper Networks, Fortinet, VMware, Palo Alto Networks, and Apache Struts, to obtain initial access. Upon gaining a successful foothold, Linux-compatible beacon frameworks such as CrossC2 are deployed to facilitate post-exploitation activities. Also dropped are Sliver, TinyShell (a Unix backdoor), keyloggers, and brute-force utilities to facilitate credential harvesting and lateral movement. Central to Red Menshen's operations, however, is BPFDoor. It features two distinct components: One is a passive backdoor deployed on the compromised Linux system to inspect incoming traffic for a predefined "magic" packet by installing a BPF filter and spawning a remote shell upon receiving such a packet. The other integral part of the framework is a controller that's administered by the attacker and is responsible for sending the specially formatted packets. "The controller is also designed to operate within the victim’s environment itself," Rapid7 explained. "In this mode, it can masquerade as legitimate system processes and trigger additional implants across internal hosts by sending activation packets or by opening a local listener to receive shell connections, effectively enabling controlled lateral movement between compromised systems." What's more, certain BPFDoor artifacts have been found to support the Stream Control Transmission Protocol (SCTP), potentially enabling the adversary to monitor telecom-native protocols and gain visibility into subscriber behavior and location, and even track individuals of interest. These aspects demonstrate that the functionality of BPFdoor goes beyond a stealthy Linux backdoor. "BPFdoor functions as an access layer embedded within the telecom backbone, providing long-term, low-noise visibility into critical network operations," the security vendor added. It doesn't end there. A previously undocumented variant of BPFdoor incorporates architectural changes to make it more evasive and stay undetected for prolonged periods in modern enterprise and telecom environments. These include concealing the trigger packet within seemingly legitimate HTTPS traffic and introducing a novel parsing mechanism that ensures the string "9999" appears at a fixed byte offset within the request. This camouflage, in turn, allows the magic packet to stay hidden inside HTTPS traffic and avoid causing shifts to the position of data inside the request, and allows the implant to always check for the marker at a specific byte offset and, if it's present, interpret it as the activation command. The newly discovered sample also debuts a "lightweight communication mechanism" that uses the Internet Control Message Protocol (ICMP) for interacting between two infected hosts. "These findings reflect a broader evolution in adversary tradecraft," Rapid7 said. "Attackers are embedding implants deeper into the computing stack — targeting operating system kernels and infrastructure platforms rather than relying solely on user-space malware." "Telecom environments — combining bare-metal systems, virtualization layers, high-performance appliances, and containerized 4G/5G core components — provide ideal terrain for low-noise, long-term persistence. By blending into legitimate hardware services and container runtimes, implants can evade traditional endpoint monitoring and remain undetected for extended periods." Update In a follow-up analysis, Rapid7 said it discovered seven new BPFDoor variants: 'F,' 'G,' 'H,' 'I,' 'J,' 'K,' and 'L,' alongside two primary versions – httpShell and icmpShell – that tunnel the magic packet via HTTP and ICMP tunnels, respectively. "The newly identified features in BPFDoor samples highlight how TAs are tailoring and reusing BPFDoor’s code to the target environment," the cybersecurity company said. "Variant H (active beacon) stands out as it tries to blend in with the network traffic, contacting fake NTP update servers."

Researchers release tool to detect stealthy BPFDoor implants in critical infrastructure networks Telecommunications providers around the world have been dealing with the burrowing efforts of the China-linked APTs for many years now. To help them identify hard-to-detect implants used by the China-based group dubbed Red Menshen, Rapid7 researchers have released a scanning script. BPFdoor US, Canadian, European and Asian telcos have been repeatedly hit by the infamous Salt Typhoon group in the past few years. Red Menshen has been previously observed using the BPFDoor implant/backdoor when targeting telecommunications providers across Asia and the Middle East, as well as organizations in the finance and retail sectors. Initial access is usually gained by exploiting known vulnerabilities in edge networking devices and VPN products or by leveraging compromised accounts. But, once inside, Red Menshen attackers are retaining long-term access by placing hard-to-detect kernel-level implants like BPFdoor and passive backdoors like TinyShell. “What makes BPFdoor particularly unique is its ability to operate at the kernel level without exposing a traditional network footprint,” Christiaan Beek, VP of Cyber Intelligence at Rapid7, told Help Net Security. This unconventional Linux malware abuses Berkeley Packet Filter (BPF) functionality to inspect network traffic directly inside the kernel, and passively listens for specially crafted network packets (aka “magic packets”) that will activate it. BPFDoor activation relying on magic packets (Source: Rapid7) Rapid7 researchers fittingly describe this type of implant as “sleeper cells” – waiting to spring into action when called, but otherwise laying dormant and blending into the environment. When triggered, BPFdoor spawns a bind shell or reverse shell. The researchers have analyzed a number of BPFdoor samples and have discovered that older and newer variants: Use code to masquerade as legitimate system services that run bare-metal infrastructure commonly deployed in telecom environments Spoof core containerization components Are capable of monitoring telecom-native protocols such as the Stream Control Transmission Protocol Don’t just rely on magic packets to spring into action, but can also be triggered with packets embedded within seemingly legitimate (encrypted) HTTPS traffic Use older or non-standard encryption routines to confuse inspection systems Use specially crafted Internet Control Message Protocol (ICMP) payloads to signal back to the operator, but also to pass execution instructions from one compromised host to another These techniques target different security boundaries, “from TLS inspection at the edge to IDS detection in transit and endpoint monitoring on the host, illustrating a deliberate effort to operate across the full defensive stack,” the researchers pointed out. A BPFDoor detection script BPFdoor isn’t the only “magic packet” malware out there: there’s the SEASPY backdoor targeting Barracuda Networks’ Email Security Gateway appliances, and the J-magic backdoor that’s been loaded by attackers into enterprise-grade Juniper router. Symbiote, a Linux userland-level rootkit/backdoor, is also capable of kernel packet filtering and hiding malicious network traffic from packet capture tools. In complex and noisy telecom environments, implants like BPFdoor are difficult to catch as – according to Rapid7 – many organizations lack visibility into kernel-level operations, raw packet filtering behavior, and anomalous high-port network activity on Linux systems. “Unlike most backdoors, [BPFdoor] doesn’t rely on open ports or persistent connections. You’re essentially trying to identify malicious behavior hidden inside otherwise normal network traffic. It’s like looking for a needle that looks and smells like hay, while the haystack itself keeps changing,” Beek added. Company researchers have therefore created a scanning script designed to detect known/analyzed BPFDoor variants across Linux environments, and are offering it to defenders. “The script is highly effective at identifying known patterns and behaviours we’ve validated in real samples,” Beek told us. That said, it can miss highly stealthy or evolving variants and may flag unusual but legitimate activity, so it should be used as part of a broader detection strategy. Unfortunately, the point of this type of threat is that organizations can’t be 100% certain that they’ve removed them all. “These threats shift the conversation from ‘Did we remove it?’ to ‘Do we have enough visibility to trust the system again?’,” he added. As their research is ongoing, Rapid7 may or may not create a detection tool for similar threats like Symbiote. “Rather than chasing individual malware families, we’re focusing on detecting the underlying techniques such as kernel-level stealth and covert network behaviour across multiple threats,” Beek concluded. Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!

This week on the Lock and Code podcast… Forget the runaway train thrillingly shot in Buster Keaton’s 1926 film “The General,” and never mind the charging locomotive rescued by actors Denzel Washington and Chris Pine in the 2010 film “Unstoppable,” as there’s a far more frequent (and far less heart-pounding) railcar drama happening across California’s Bay Area: The repeated breakdown of the Bay Area Rapid Transit (BART) system, all because of a few networking errors. Opened in 1972, BART today carries about 175,000 people every weekday on five separate lines to 50 different stations placed across dozens of cities in the Bay Area, including San Francisco, Oakland, Berkeley, Daly City, Fremont, Richmond, and more. Its tracks and railcars travel both above ground and below, and it is one of the only public transit systems in the US that goes underwater—traveling through what is called the TransBay tube. It is likely the region’s largest public project, spanning 131 miles of track, with a fleet of more than 700 cars, proving vital to workers and residents everywhere, and on May 9, 2025, it all came grinding to a halt, due to what BART officials called a “computer networking problem.” At the Glen Park station in San Francisco, would-be travelers found yellow caution tape at the entry gates. At the El Cerrito Plaza station, BART staff and police informed visitors that the system was down. And at the Rockridge station in Oakland, a reporter for The San Francisco Chronicle witnessed a small group of people sprinting up the stairs to try and catch a train that never came. It was the kind of meltdown for public infrastructure that puts an entire system in peril. And it happened again just months later. In September, a network crash brought BART to a halt, repeating almost the exact same frustrations and delays for travelers left without transportation to work. That’s the end of it, right? Wrong. In February 2026, another computer failure caused another outage. So, in one of the wealthiest regions in America, the subway doesn’t always run, its network is prone to crash, and any money for technology often goes elsewhere. Today, on the Lock and Code podcast with host David Ruiz, we speak with San Francisco Chronicle transportation reporter Rachel Swan about what the BART outages revealed about the state of the system’s aging technology, why public infrastructure so often struggles to modernize, and what exactly went wrong in the three prior outages. “One piece of equipment—and again, this is old equipment—one piece breaks down and they completely lose visibility, so they don’t know where any of the trains are.” Tune in today to listen to the full conversation. Show notes and credits: Intro Music: “Spellbound” by Kevin MacLeod (incompetech.com) Licensed under Creative Commons: By Attribution 4.0 License http://creativecommons.org/licenses/by/4.0/ Outro Music: “Good God” by Wowa (unminus.com) Listen up—Malwarebytes doesn’t just talk cybersecurity, we provide it. Protect yourself from online attacks that threaten your identity, your files, your system, and your financial well-being with our exclusive offer for Malwarebytes Premium Security for Lock and Code listeners.

L’intelligenza artificiale generativa potrebbe presto trasformarsi in un’arma sofisticata per manipolare l’opinione pubblica attraverso sciami di agenti autonomi capaci di infiltrarsi nelle comunità online, minacciando così le fondamenta stesse della democrazia. È questo l’allarme lanciato da un consorzio internazionale di esperti in intelligenza artificiale e disinformazione, che include ricercatori di numerose università internazionali, tra cui Berkeley, Harvard, Oxford, Cambridge e Yale, oltre alla vincitrice del Premio Nobel per la Pace Maria Ressa. L’avvertimento, pubblicato sulla rivista Science, descrive una minaccia emergente che, secondo gli autori, potrebbe materializzarsi in occasione delle elezioni presidenziali statunitensi del 2028: sciami di intelligenze artificiali malevole, difficili da rilevare, potrebbero invadere i social media e i canali di messaggistica per plasmare il consenso pubblico su scala industriale. Indice degli argomenti Gli esperti delineano uno scenario in cui leader politici con ambizioni autocratiche potrebbero schierare quantità pressoché illimitate di agenti artificiali programmati per impersonare esseri umani online. Questi sistemi sarebbero in grado di infiltrarsi con precisione chirurgica nelle comunità digitali, apprenderne nel tempo le caratteristiche peculiari e diffondere menzogne sempre più convincenti e accuratamente calibrate, fino a modificare opinioni su scala demografica. La capacità di tali tecnologie di coordinare autonomamente le proprie azioni, infiltrarsi tra gli utenti reali e fabbricare consenso in modo efficiente rappresenterebbe un salto qualitativo rispetto alle precedenti campagne di disinformazione. Attraverso l’imitazione adattiva delle dinamiche sociali umane, questi sciami minerebbero i processi democratici, potenzialmente convincendo intere popolazioni ad accettare elezioni cancellate o risultati elettorali sovvertiti. scalabilità Il pericolo viene amplificato dai progressi compiuti dalle intelligenze artificiali nella comprensione del tono e del contenuto delle conversazioni online. I sistemi più avanzati sono ormai capaci di replicare le dinamiche umane utilizzando espressioni gergali appropriate e pubblicando contenuti a intervalli irregolari per evitare il riconoscimento automatico. Lo sviluppo dell’intelligenza artificiale agente, dotata della capacità di pianificare e coordinare azioni in autonomia, rende questo scenario tecnicamente plausibile. Daniel Thilo Schroeder, ricercatore presso l’istituto Sintef di Oslo e tra gli autori dello studio, ha simulato il comportamento di questi sciami in condizioni di laboratorio, constatando quanto sia semplice creare piccoli eserciti di bot capaci di navigare le piattaforme social, utilizzare la posta elettronica e sfruttare diversi strumenti digitali a seconda del canale ritenuto più efficace per raggiungere un obiettivo specifico. La facilità con cui si possono programmare questi sistemi risulta particolarmente inquietante, considerando le potenzialità di scalabilità delle operazioni. Jonas Kunst, professore di comunicazione presso la BI Norwegian Business School, sottolinea come la vera minaccia emerga quando questi bot evolvono in un collettivo capace di scambiarsi informazioni per risolvere problemi comuni, in questo caso obiettivi malevoli come l’analisi di una comunità per individuarne i punti deboli. Tale coordinamento incrementerebbe esponenzialmente l’accuratezza e l’efficienza delle operazioni di influenza. Gli sciami potrebbero operare non solo attraverso i social media, ma anche mediante canali di messaggistica, blog e posta elettronica, selezionando autonomamente il mezzo più adatto a raggiungere lo scopo prefissato. Questa versatilità multicanale renderebbe estremamente complessa l’identificazione e il contrasto delle campagne di manipolazione. Nel corso delle consultazioni elettorali del 2024 in diversi Paesi, tra cui Taiwan, India e Indonesia, sono già emersi esempi di campagne di disinformazione supportate da strumenti di intelligenza artificiale, come l’uso di contenuti generati artificialmente e la creazione di fonti informative fittizie. A Taiwan, dove gli elettori sono regolarmente bersagliati dalla propaganda cinese, secondo testimonianze di esponenti politici e osservatori locali, account automatizzati avrebbero intensificato l’interazione con i cittadini su piattaforme come Threads e Facebook negli ultimi mesi. Durante discussioni su temi politici, tali account avrebbero diffuso grandi volumi di informazioni difficilmente verificabili, contribuendo a un sovraccarico informativo deliberato. disimpegno politico come propaganda mascherata Puma Shen, parlamentare taiwanese del Partito Progressista Democratico impegnato nella lotta alla disinformazione, ha riferito che questi account citerebbero articoli falsi sull’abbandono di Taiwan da parte degli Stati Uniti o cercherebbero di convincere i giovani taiwanesi a mantenere una posizione di neutralità sulla questione sino-taiwanese, presentandola come eccessivamente complessa per chi non possiede conoscenze approfondite. L’obiettivo, secondo tali valutazioni, non sarebbe promuovere direttamente la Cina, ma indurre al disimpegno politico, una strategia particolarmente insidiosa perché meno riconoscibile come propaganda tradizionale. Per contrastare questa minaccia, il consorzio di ricercatori chiede un’azione globale coordinata che includa lo sviluppo di strumenti in grado di individuare comportamenti collettivi riconducibili a sciami artificiali e l’adozione di meccanismi di contrassegno digitale dei contenuti per identificare le campagne di disinformazione gestite da sistemi di intelligenza artificiale. Michael Wooldridge, professore di fondamenti dell’intelligenza artificiale all’Università di Oxford, conferma la plausibilità dello scenario prospettato, ritenendo credibile che attori malintenzionati tentino di mobilitare eserciti virtuali di agenti basati su modelli linguistici per manipolare l’opinione pubblica e destabilizzare i processi elettorali, prendendo di mira ampie fasce di popolazione attraverso i social media ed altri canali digitali. La tecnologia necessaria, secondo gli autori, è in larga parte già disponibile e destinata a diventare progressivamente più accessibile. Tra gli autori dello studio figurano anche Gary Marcus della New York University, noto per il suo approccio critico nei confronti delle capacità attuali dei modelli di intelligenza artificiale, Audrey Tang, ministra per il digitale di Taiwan, David Garcia dell’Università di Costanza, Sander van der Linden dell’Università di Cambridge e Christopher Summerfield dell’Università di Oxford. La varietà di competenze rappresentate nel gruppo contribuisce a rafforzare la solidità delle analisi presentate. Altri esperti mantengono tuttavia un atteggiamento più cauto. Inga Trauthig, esperta di tecnologie della propaganda e consulente per il Panel Internazionale sull’Ambiente dell’Informazione, osserva che nel 2024, anno caratterizzato da numerose consultazioni elettorali, le capacità tecniche per campagne di microtargeting basate su intelligenza artificiale erano già presenti, ma il loro impiego non ha raggiunto i livelli ipotizzati da alcuni studiosi. La maggior parte dei propagandisti politici continuerebbe a fare affidamento su tecnologie più consolidate, mostrando una certa riluttanza ad adottare strumenti all’avanguardia. Questa lentezza nell’adozione sarebbe dovuta sia alla resistenza a cedere il controllo delle campagne elettorali a sistemi automatizzati, sia alla valutazione dei rischi associati all’uso di tecniche potenzialmente illecite, anche alla luce del fatto che gli elettori restano fortemente influenzati da materiali e dinamiche offline. Nonostante queste riserve, la convergenza tra capacità tecnologiche in rapida evoluzione e possibili utilizzi malevoli rende necessaria una vigilanza costante e lo sviluppo tempestivo di contromisure efficaci, prima che tali minacce possano incidere in modo sistematico sui processi democratici.

Dal 2018 la prestigiosa rivista Nature pubblica ogni anno una lista di tecnologie emergenti particolarmente significative da tenere d’occhio. In questa occasione, però, ha inserito per la prima volta anche tecnologie legate a qualcosa che in realtà conosciamo da almeno settant’anni. L’energia nucleare. Tra quelle presenti nella lista pubblicata a gennaio 2026 non poteva certo mancare l’Intelligenza Artificiale (AI), e in particolare i modelli di AI applicati alle previsioni meteorologiche. L’articolo cita l’esempio del modello AI di Google DeepMind che, nell’ottobre 2025, ha fornito al National Hurricane Center degli Stati Uniti un’allerta precoce sull’uragano Melissa e ne ha poi anticipato l’evoluzione fino al raggiungimento della categoria 5 di intensità con giorni di anticipo, per poi prevederne con precisione la traiettoria attraverso i Caraibi. Ma quest’anno Nature ha inserito per la prima volta anche tecnologie legate a qualcosa che in realtà conosciamo da almeno settant’anni: l’energia nucleare. E anche se può sembrare un paradosso, l’AI, sostanzialmente sviluppata negli ultimi anni, e le centrali nucleari, i cui primi esempi risalgono agli Anni Cinquanta del XX secolo, sono oggi due tecnologie correlate. Negli ultimi anni la domanda globale di energia è cresciuta con ritmi senza precedenti. E questo è dipeso anche (ma non solo) dall’avvento dell’AI. Come spesso accade, le tecnologie legate al mondo dell’informatica non esistono solo sulla rete, ma hanno una reale e concreta presenza nel mondo fisico. Nella nostra vita quotidiana non lo percepiamo, ma internet (con tutto quello che ne consegue: motori di ricerca, social media, cloud e AI) esiste concretamente sotto forma di cavi sottomarini, satelliti e server. AI uno dei settori maggiormente energivori Proprio l’Intelligenza Artificiale si è dimostrata uno dei settori maggiormente energivori degli ultimi anni per via dell’infrastruttura fisica su cui poggia: i datacenter. Sebbene non sia facile calcolare il consumo esatto di energia dovuto all’AI, i numeri, seppur differenti, sembrano tutti convergere verso la stessa direzione: l’Intelligenza Artificiale necessiterà di sempre maggiori quantità di energia nei prossimi anni. In un articolo del 20 maggio 2025 pubblicato sulla MIT Technology Review sono citate le proiezioni del Report 2024 per il consumo energetico dei datacenter statunitensi pubblicato dal Dipartimento per l’Energia e prodotte dal Lawrence Berkeley National Laboratory. Secondo questa stima, entro il 2028 l’AI dovrebbe consumare annualmente tanta energia quanto il 22% delle famiglie statunitensi. Analogamente, i dati aggiornati al 2024 e pubblicati dall’Agenzia Internazionale per l’Energia (IEA) riportano che l’1,5% del consumo di elettricità globale era dovuto ai datacenter, ma con proiezioni di crescita entro il 2035 che oscillano tra il 2% e il 4,4% Considerando che l’Intelligenza Artificiale sta diventando sempre più una tecnologia di importanza strategica per diversi Stati (USA e Cina in primis) e un settore di investimento multimiliardario per le grandi multinazionali, appare evidente che questa enorme richiesta di energia dovrà in qualche modo essere soddisfatta. Ed è qui che entra in gioco il nucleare, che offre diversi vantaggi rispetto alle fonti fossili e anche rispetto alle fonti c.d. rinnovabili: l’energia atomica, infatti, consente un approvvigionamento costante, scalabile, operatività decennale e con impatto ambientale ridotto. L’operatività dei privati Per questo i grandi attori privati si sono già mossi in tal senso. Microsoft si è attivata per riavviare l’ex reattore Unità 1 della centrale nucleare di Three Mile Island, che dovrebbe tornare commercialmente attivo entro il 2027. Amazon ha acquisito il campus del Cumulus Data Center per garantirsi l’accesso diretto all’elettricità generata dall’impianto nucleare di Susquehanna. Per il futuro, inoltre, le società private e gli enti pubblici si stanno muovendo anche nella direzione dei c.d. small reactors e micro reactors, ovvero reattori di dimensioni ridotte, fino a soli pochi metri di grandezza, che possano essere dislocati direttamente dove c’è maggiore necessità (in prossimità dei data center in zone remote, o vicino alle mining farm di criptovalute, o in zone insulari). Questi reattori miniaturizzati potrebbero anche diventare modulari. In questa direzione si sta muovendo Google, che ha firmato un accordo con un’azienda energetica per acquistare energia nucleare da reattori modulari che dovrebbero diventare operativi entro il 2030.

Week in review: Self-spreading npm malware hits developers, Cisco SD-WAN 0-day exploited since 2023 Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Identity verification systems are struggling with synthetic fraud Fake and expired IDs keep showing up in routine customer transactions, from alcohol purchases to credit card applications. The problem shows up most often in industries that depend on fast onboarding and remote transactions, where identity checks rely heavily on scanned documents and automated workflows. Enterprises are racing to secure agentic AI deployments AI assistants are tied into ticketing systems, source code repositories, chat platforms, and cloud dashboards across many enterprises. In some environments, these systems can open pull requests, query internal databases, book services, and trigger automated workflows with limited human involvement. The State of AI Security 2026 from Cisco places this level of access inside a growing pattern of AI-driven operations that connect directly to core business systems. The hidden security cost of treating labs like data centers In this Help Net Security interview, Rich Kellen, VP, CISO at IFF, explains why security teams should not treat OT labs like IT environments. He discusses how compromise can damage scientific integrity and create safety risks that backups cannot fix. AI is becoming part of everyday criminal workflows Underground forums include long threads about chatbots drafting phishing emails, generating code snippets, and coaching social engineering calls. A new study examined conversations captured between January 1, 2025 and July 31, 2025 across dozens of cybercrime forums to map how AI tools are entering day to day criminal operations. AI-driven DAST reduces manual setup and surfaces exploitable vulnerabilities In this Help Net Security interview, Joni Klippert, CEO at StackHawk, discusses what defines DAST coverage in 2026 and why scan completion does not equal security. She explains how AI-driven DAST testing automates attack surface discovery, supports business-logic testing in pre-production, and reduces the manual setup that has limited adoption. Klippert also describes how organizations can implement runtime testing without instrumenting production systems. Review: Digital Forensics, Investigation, and Response, 5th Edition Digital Forensics, Investigation, and Response, 5th Edition presents a structured survey of the digital forensics discipline. The book spans foundational principles, platform specific analysis, specialized branches, and incident response integration. Open-source security debt grows across commercial software Open source code sits inside nearly every commercial application, and development teams continue to add new dependencies. Black Duck’s 2026 Open Source Security and Risk Analysis Report data shows that nearly all audited codebases contain open source components, with average component counts rising sharply over the past year. The $19.5 million insider risk problem Routine employee activity across corporate systems carries an average annual cost of $19.5 million per organization. That figure comes from the 2026 Cost of Insider Risks Global Report, conducted by the Ponemon Institute and based on data from 354 organizations that experienced one or more material insider related incidents over the past year. Industrial networks continue to leak onto the internet Industrial operators continue to run remote access portals, building automation servers, and other operational technology services on public IP address ranges. Palo Alto Networks, Siemens, and Idaho National Laboratory describe the scope of that exposure in the Intelligence-Driven Active Defense Report 2026. DeVry University’s CISO on higher education cybersecurity risk In this Help Net Security interview, Fred Kwong, VP, CISO at DeVry University, outlines how the university balances academic openness with cyber risk. He describes how systems for students are separated from back end operations to limit exposure. Japanese chip-testing toolmaker Advantest suffers ransomware attack Japanese tech testing company Advantest has suffered a ransomware attack, the company confirmed last Thursday, after detecting unusual activity within its IT environment on February 15, 2026. Fake troubleshooting tip on ClawHub leads to infostealer infection A new malware delivery campaign has hit ClawHub, the official online repository for “skills” that augment the capabilities of the popular OpenClaw AI agent. Unlike previous ones, this campaign does not aim to trick users into downloading a bogus, malicious skill. Self-spreading npm malware targets developers in new supply chain attack Security researchers have uncovered another supply chain attack targeting developers: 19 typosquatting npm packages published on npmjs.com that steal credentials, infect projects, and propagate themselves across developer environments. CISA flags exploited FileZen command injection bug, patch now! (CVE-2026-25108) CISA has added CVE-2026-25108, an OS command injection vulnerability in Soliton Systems’ FileZen secure file transfer solution, to its Known Exploited Vulnerabilities (KEV) catalog. The vendor has confirmed active exploitation, stating it has received multiple reports of damage caused by attackers abusing the flaw. SolarWinds Serv-U hit by four critical RCE-level vulnerabilities SolarWinds has fixed four critical vulnerabilities in its popular Serv-U file transfer solution, which is used by businesses and organizations of all sizes. If exploited, the flaws may allow attackers to create a system admin user and/or execute code as a privileged account. Threat actor leveraged Cisco SD-WAN zero-day since 2023 (CVE-2026-20127) A “highly sophisticated” cyber threat actor has been exploiting a zero-day authentication bypass vulnerability (CVE-2026-20127) in Cisco Catalyst SD-WAN Controller (formerly vSmart) and Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage), Cisco has announced. Scattered Lapsus$ Hunters seeks women for vishing attacks The Scattered Lapsus$ Hunters (SLH) hacking collective has launched a recruitment push aimed specifically at women, offering cash payments for participating in voice-phishing (vishing) attacks. A few days ago, threat intelligence firm Dataminr detected posts on a public Telegram channel advertising roles for female callers willing to conduct social-engineering phone operations. IronCurtain: An open-source, safeguard layer for autonomous AI assistants Veteran security engineer Niels Provos is working on a new technical approach designed to stop autonomous AI agents from taking actions you haven’t specifically authorized. Why SOCs are moving toward autonomous security operations in 2026 The modern security operations center faces a crisis of scale that human effort cannot fix. With alert volumes exponentially growing and threat actors automating their attacks, organizations must pivot to autonomous SOC strategies. This shift to AI-driven defense is the only way to survive the operational realities of 2026. Binding Operational Directive 26-02 sets deadlines for edge device replacement In this Help Net Security video, Jen Sovada, General Manager, Public Sector at Claroty, explains CISA’s Binding Operational Directive 26-02 and what it means for federal agencies. The directive requires agencies to inventory, report, decommission, and replace unsupported edge devices such as firewalls, routers, switches, load balancers, and wireless access points. Police seize 100,000 stolen Facebook credentials in cybercrime raid Officers from Poland’s Central Bureau for Combating Cybercrime (CBZC) dismantled an organized group that used phishing to seize Facebook accounts and extract BLIK payment codes from victims. Spanish police arrest suspected Anonymous members over DDoS attacks on government sites Spanish police (Guardia Civil) arrested four members of the hacktivist group Anonymous Fénix over DDoS attacks targeting ministries, political parties and public institutions. Police identified the organization’s leadership, including its administrator and moderator, who were arrested in May 2025 in Alcalá de Henares (Madrid) and Oviedo (Asturias). Security and complexity slow the next phase of enterprise AI agent adoption Enterprise AI agents are embedded in routine business processes, particularly inside engineering and IT operations. Many organizations report active production deployments, and agent development ranks high on strategic agendas. A new study from Docker, The State of Agentic AI Report, examines how enterprises are deploying agentic systems and the challenges emerging as deployments scale. Microsoft extends security patching for three Windows products at a price Support is ending for three Windows products released in 2016, with deadlines beginning in October 2026. Windows 10 Enterprise LTSB 2016 and Windows 10 IoT Enterprise 2016 LTSB will reach end of support on October 13, 2026, followed by Windows Server 2016 on January 12, 2027. International operation dismantles fraud network, €400,000 seized A coordinated international operation supported by Eurojust dismantled a fraudulent call centre operating from three offices and targeting citizens throughout Europe. Authorities arrested 11 suspects and seized more than €400,000 in cash. Teenagers charged over public bike service breach that exposed 4.62 million records Two South Korean teenagers have been charged in connection with a cyberattack that compromised the personal data of 4.62 million users of Seoul’s public bike service, Ttareungyi. The compromised data included user IDs, mobile phone numbers, addresses, dates of birth, gender, and weight. Airline brands become launchpads for phishing, crypto fraud Airline brands sit at the center of peak travel booking cycles, loyalty programs, and high value transactions. Criminal groups continue to register thousands of lookalike domains tied to these brands, targeting travelers, employees, and business partners. Recent threat intelligence from BforeAI’s PreCrime Labs identifies sustained impersonation activity across the global commercial airline sector. Cyber valuations climb as capital concentrates, AI security expands Venture funding in cybersecurity continued to concentrate in large private rounds at the end of 2025, driving valuations higher across stages. Data from DataTribe shows total capital invested approached $150 billion for the year, with a disproportionate share flowing into fewer than 100 deals. Ex-L3Harris executive sentenced to 87 months for selling stolen cyber-exploit trade secrets Peter Williams, a former executive of Trenchant, L3Harris’ cyber division, has been sentenced to 87 months in prison by a federal judge in Washington, D.C., after pleading guilty to stealing and selling sensitive cyber-exploit trade secrets to a Russian broker. Anthropic’s Remote Control feature brings Claude Code to mobile devices Anthropic has introduced a new Claude Code feature called Remote Control, allowing developers to continue a local coding session from a phone, tablet, or any web browser. The feature is rolling out as a research preview to Max users. Samsung’s Galaxy S26 turns privacy into a visible and invisible feature The Samsung Galaxy S26 series is out, offering plenty of security features that protect personal data while providing users with transparency and control over how their information is used. The feature that grabbed the spotlight is the built-in Privacy Display on the Galaxy S26 Ultra model, designed to help keep on-screen activity out of view in public places. Telegram rises to top spot in job scam activity Encrypted messaging platforms are becoming a primary channel for Authorised Push Payment (APP) fraud, with Telegram representing a growing share of reported cases, according to the Revolut report. NATO greenlights iPhone and iPad for classified information handling Apple confirmed that the iPhone and iPad have been approved for use with classified information in NATO restricted environments. The devices will no longer require special software or settings to handle NATO restricted-level information. Microsoft taps ASUS and Dell for the Windows 365 Cloud PC strategy Microsoft is adding two new Windows 365 Cloud PC devices, the ASUS NUC 16 for Windows 365 and the Dell Pro Desktop for Windows 365, expanding hardware options for its cloud-based desktop service. Both devices are scheduled for release in the third quarter of 2026, with distribution varying by region and model. Meta tightens grip on scam advertisers Meta is stepping up the fight against scams on its platforms by filing multiple lawsuits targeting companies and individuals in Brazil, China, and Vietnam who used deceptive tactics to run scam ads. The company said it has taken technical enforcement actions in these cases, including suspending payment methods used in the scams, disabling accounts linked to those operations, and blocking domains associated with scam sites. Coroot: Open-source observability and APM tool Coroot is an open-source observability and application performance monitoring tool. The core software, published in Go and accompanied by companion repositories such as coroot-node-agent, focuses on collecting telemetry data across systems. It uses extended Berkeley Packet Filter (eBPF) technology to gather metrics and trace inter-service communications without manual instrumentation of application code. Perplexity AI lands on Samsung’s next Galaxy lineup Samsung will add Perplexity to its upcoming Galaxy S26 devices as part of its Galaxy AI multi-agent ecosystem expansion. Users will be able to access Perplexity through quick-access controls, such as pressing and holding the side button, or by using the voice wake phrase “Hey, Plex.” WhatsApp is adding another lock to your account Meta has released WhatsApp Beta for Android 2.26.7.8 through the Google Play Beta Program. The update includes references to password-protected accounts, indicating plans to introduce an additional layer of protection beyond the app’s current authentication options. Windows 365 for Agents brings managed cloud PCs to autonomous workflows Microsoft’s Windows 365 for Agents is a cloud platform that gives AI agents secure access to cloud PCs. It lets builders run copilots, agents, and automated workflows in Windows environments without managing infrastructure. The platform includes security, policy controls, scalability, and visibility so agents can browse websites, process data, and complete tasks inside a managed cloud PC. Microsoft expands Sovereign Cloud security with governance, local productivity and AI Microsoft expands Microsoft Sovereign Cloud with new disconnected and AI capabilities that help organizations run critical infrastructure, productivity services and large AI models inside sovereign boundaries while keeping governance and operational continuity across connected and disconnected environments. Edge systems take the brunt of internet-wide exploitation attempts Internet-facing VPNs, routers, and remote access services absorbed sustained exploitation attempts throughout the second half of 2025, with nearly 3 billion malicious sessions recorded over 162 days. The concentration on edge infrastructure aligns with how attackers pursue initial access across the public internet. Microsoft adds domain libraries and Copilot integration to the quantum development kit The Microsoft Quantum Development Kit (QDK) is an open-source toolkit that runs on laptops and in common development environments. It includes code, simulators, libraries, and workflows that work with Visual Studio Code and GitHub Copilot. Integration with these tools gives developers features for writing, testing, debugging, and submitting quantum code. Apple blocks 18+ app downloads in select markets Apple has introduced expanded age assurance tools to help developers comply with regulations taking effect in Brazil, Australia, Singapore, Utah, and Louisiana. The updates, available in beta, expand the Declared Age Range API and related App Store systems. Reddit fined $19.5 million for failing to protect children’s personal data The UK’s Information Commissioner’s Office (ICO) has fined Reddit $19.5 million after finding that the company failed to use children’s personal information lawfully, exposing them to inappropriate and harmful content. Hottest cybersecurity open-source tools of the month: February 2026 This month’s roundup features exceptional open-source cybersecurity tools that are gaining attention for strengthening security across various environments. Wireshark 4.6.4 resolves dissector flaws, plugin compatibility issue Packet inspection remains a routine activity across enterprise networks, incident response workflows, and malware investigations. Continuous use places long-term stability and parsing accuracy at the center of daily operations. Wireshark version 4.6.4 addresses two vulnerabilities affecting protocol dissectors and resolves a plugin compatibility issue within the 4.6 release series. Fraudsters integrate ChatGPT into global scam campaigns AI models are being folded into fraud and influence operations that follow long standing tactics. A February 2026 update to OpenAI’s Disrupting Malicious Uses of Our Models report details how ChatGPT and related API access were used in romance scams, fake legal services, coordinated influence campaigns, and a state linked harassment effort. AWS Security Hub Extended brings enterprise security under one roof AWS Security Hub Extended is a plan within Security Hub that simplifies how customers procure, deploy, and integrate a full-stack enterprise security solution across endpoint, identity, email, network, data, browser, cloud, AI, and security operations. The CISO role keeps getting heavier Personal liability is becoming a routine part of the CISO job. In Splunk’s 2026 CISO Report, titled From Risk to Resilience in the AI Era, 78% of CISOs said they are concerned about their own liability for security incidents, up from 56% last year. The role carries personal exposure alongside operational accountability, and that shift is influencing how security leaders approach risk, documentation, and board communication. Android app uses Bluetooth signals to detect nearby smart glasses Smart glasses with built-in cameras are showing up in more public spaces, and a growing number of people want a way to know when one is nearby. An Android app called Nearby Glasses, developed by Yves Jeanrenaud, attempts to fill that gap by scanning Bluetooth Low Energy traffic for manufacturer identifiers associated with known smart glasses makers. Ransomware activity peaks outside business hours Intrusions continue to center on credential access and timed execution outside standard business hours. The Sophos Active Adversary Report 2026 analyzes 661 incident response and managed detection and response cases handled between November 1, 2024 and October 31, 2025, spanning organizations in 70 countries. Android 17 second beta expands privacy controls for contacts, SMS and local networks Google’s second beta of Android 17 continues updates to platform behavior and introduces new APIs focused on protecting sensitive data. Europol goes after The Com’s ransomware and extortion networks Law enforcement agencies across 28 countries have spent the past year building cases against a loosely organized collective known as The Com, a decentralized network of mostly teenagers and young adults linked to high-profile ransomware attacks, financial extortion, and the coercion of vulnerable children. Cybersecurity jobs available right now: February 24, 2026 We’ve scoured the market to bring you a selection of roles that span various skill levels within the cybersecurity field. Check out this weekly selection of cybersecurity jobs available right now. New infosec products of the month: February 2026 Here’s a look at the most interesting products from the past month, featuring releases from Aikido Security, Avast, Armis, Black Duck, Compliance Scorecard, Fingerprint, Gremlin, Impart Security, Portnox, Redpanda, Socure, SpecterOps, Veza, and Virtana.

Hottest cybersecurity open-source tools of the month: February 2026 This month’s roundup features exceptional open-source cybersecurity tools that are gaining attention for strengthening security across various environments. Pompelmi: Open-source secure file upload scanning for Node.js Software teams building services in JavaScript are adding more layers of defense to handle untrusted file uploads. An open-source project called Pompelmi aims to insert malware scanning and policy checks directly into Node.js applications before files reach storage or business logic. Allama: Open-source AI security automation Allama is an open-source security automation platform that lets teams build visual workflows for threat detection and response. It includes integrations with 80+ types of tools and services typical in security operations, including SIEM systems, endpoint detection and response products, identity providers, and ticketing systems. OpenClaw Scanner: Open-source tool detects autonomous AI agents A new free, open source tool is available to help organizations detect where autonomous AI agents are operating across corporate environments. The OpenClaw Scanner identifies instances of OpenClaw, an autonomous AI assistant also known as MoltBot, that can execute tasks, access local files, and authenticate to internal systems without centralized oversight. Brutus: Open-source credential testing tool for offensive security Brutus is an open-source, multi-protocol credential testing tool written in pure Go. Designed to replace legacy tools that have long frustrated penetration testers with dependency headaches and integration gaps, Brutus ships as a single binary with zero external dependencies and native support for the JSON-based reconnaissance pipelines that define offensive security. Uptime Kuma: Open-source monitoring tool Service availability monitoring remains a daily operational requirement across IT teams, SaaS providers, and internal infrastructure groups. Many environments rely on automated checks and alerting to track outages, latency issues, and service degradation across web applications and network endpoints. Uptime Kuma is an open-source uptime monitoring project that supports this type of operational monitoring through a self-hosted deployment model. Coroot: Open-source observability and APM tool Coroot is an open-source observability and application performance monitoring tool. The core software, published in Go and accompanied by companion repositories such as coroot-node-agent, focuses on collecting telemetry data across systems. It uses extended Berkeley Packet Filter (eBPF) technology to gather metrics and trace inter-service communications without manual instrumentation of application code. Must read: 40 open-source tools redefining how security teams secure the stack GitHub CISO on security strategy and collaborating with the open-source community Subscribe to the Help Net Security ad-free monthly newsletter to stay informed on the essential open-source cybersecurity tools. Subscribe here!

Coroot: Open-source observability and APM tool Coroot is an open-source observability and application performance monitoring tool. The core software, published in Go and accompanied by companion repositories such as coroot-node-agent, focuses on collecting telemetry data across systems. It uses extended Berkeley Packet Filter (eBPF) technology to gather metrics and trace inter-service communications without manual instrumentation of application code. Coroot collects standard observability signals that engineering teams rely on. The software aggregates metrics, logs, traces, and continuous profiling data and makes them available in dashboards and structured views. Users can track service health, follow request paths through service maps, and examine performance profiles down to CPU and memory behavior over time. An eBPF-based agent is central to this model. It runs on nodes to expose container metrics in the Prometheus format and trace container TCP events, giving visibility into network behavior across environments. Coroot also has predefined inspections that scan telemetry data and summarize conditions such as service level objective (SLO) compliance and common failure patterns. Coroot’s visibility model aims to reduce manual instrumentation work by leveraging kernel-level data collection. That reflects broader trends in cloud native operations where teams balance signal coverage with ease of setup. Observability vendors and projects in open source communities continue to explore approaches that reduce configuration burden while addressing reliability needs. Coroot is available for free on GitHub. Must read: 40 open-source tools redefining how security teams secure the stack Firmware scanning time, cost, and where teams run EMBA Subscribe to the Help Net Security ad-free monthly newsletter to stay informed on the essential open-source cybersecurity tools. Subscribe here!

PoC code drops for remotely exploitable BIND 9 DNS flaw (CVE-2025-40778) A high-severity vulnerability (CVE-2025-40778) affecting BIND 9 DNS resolvers could be leveraged by remote, unauthenticated attackers to manipulate DNS entries via cache poisoning, allowing them to redirect Internet traffic to potentially malicious sites, distribute malware, or intercept network traffic. While attackers have yet to be spotted exploiting the flaw, a proof-of-concept (PoC) exploit code has been published, making it critical for administrators to patch internet-facing resolvers. What is BIND 9? BIND (v)9 is the latest and the only actively maintained version of Berkeley Internet Name Domain, the DNS software suite developed by the Internet Systems Consortium (ISC). The suite allows systems – primarily running Linux and Unix-like distributions – to act as: Advertising (authoritative) DNS servers, which store and serve the official DNS records for domains, and/or Recursive (resolving) servers, which perform DNS lookups on behalf of clients by querying other DNS servers and can cache responses to speed up future lookups Resolvers are typically set up by ISPs, organizations, or private networks to handle DNS requests for their users. About CVE-2025-40778 CVE-2025-40778 can lead to cache poisoning because, as the ISC explains, “under certain circumstances, BIND is too lenient when accepting records from answers”. Attackers can use it to inject forged records (i.e., IP – domain mappings) into the resolver’s cache during a query, and thus potentially affect resolution of future queries and redirect users to attacker-controlled assets. The vulnerability affects various BIND 9 and BIND Supported Preview Edition versions, and has been fixed in BIND 9 versions 9.18.41, 9.20.15, and 9.21.14, and BIND Supported Preview Edition versions 9.18.41-S1 and 9.20.15-S1. These fixed versions also contain patches for an additional cache poisoning vulnerability and an issue that can lead to denial of service. All three fixed vulnerabilities affect recursive DNS servers and, according to the German Federal Office for Information Security (BSI), authoritative DNS servers on which recursive functionality is mistakenly or intentionally enabled. The vulnerabilities have no known workarounds, so admins are advised to upgrade to the patched release most closely related to their current version of BIND 9 as soon as possible. Many Linux distributions have already integrated the fix or will soon release patches. In general, the BSI advises operators of recursive DNS servers to: Restrict recursion to trusted clients Enable DNSSEC validation Monitor cache activity for unexpected records, and Reduce maximum caching time to 24 hours of less (so that eventual poisoned entries don’t persist for days). Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!

It’s easy to think your defenses are solid — until you realize attackers have been inside them the whole time. The latest incidents show that long-term, silent breaches are becoming the norm. The best defense now isn’t just patching fast, but watching smarter and staying alert for what you don’t expect. Here’s a quick look at this week’s top threats, new tactics, and security stories shaping the landscape. ⚡ Threat of the Week F5 Exposed to Nation-State Breach — F5 disclosed that unidentified threat actors broke into its systems and stole files containing some of BIG-IP's source code and information related to undisclosed vulnerabilities in the product. The company said it learned of the incident on August 9, 2025, although it's believed that the attackers were in its network for at least 12 months. The attackers are said to have used a malware family called BRICKSTORM, which is attributed to a China-nexus espionage group dubbed UNC5221. GreyNoise said it observed elevated scanning activity targeting BIG-IP in three waves on September 23, October 14, and October 15, 2025, but emphasized the anomalies may not necessarily relate to the hack. Censys said it identified over 680,000 F5 BIG-IP load balancers and application gateways visible on the public internet, with the majority of hosts located in the U.S., followed by Germany, France, Japan, and China. Not all identified systems are necessarily vulnerable, but each represents a publicly accessible interface that should be inventoried, access-restricted, and patched proactively as a precautionary measure. "Edge infrastructure and security vendors remain prime targets for long-term, often state-linked threat actors," John Fokker, vice president of threat intelligence strategy at Trellix, said. "Over the years, we have seen nation-state interest in exploiting vulnerabilities in edge devices, recognizing their strategic position in global networks. Incidents like these remind us that strengthening collective resilience requires not only hardened technology but also open collaboration and intelligence sharing across the security community." Zero Trust + AI: Thrive in the AI Era and Empower Your Workforce It’s no surprise, hackers are using AI in creative ways to compromise users and breach organizations. Zscaler Zero Trust + AI helps defeat ransomware and AI-power attacks today by enabling you to detect and block advanced threats, and discover and classify sensitive data everywhere. Learn more about Zscaler Zero Trust + AI ➝ 🔔 Top News N. Korea Uses EtherHiding to Hide Malware Inside Blockchain Smart Contracts — North Korean threat actors have been observed leveraging the EtherHiding technique to distribute malware and enable cryptocurrency theft, marking the first time a state-sponsored hacking group has embraced the method. The activity has been attributed to a cluster tracked as UNC5342 (aka Famous Chollima). The attack wave is part of a long-running campaign codenamed Contagious Interview, wherein the attackers approach potential targets on LinkedIn by posing as recruiters or hiring managers, and trick them into running malicious code under the pretext of a job assessment after shifting the conversation to Telegram or Discord. In the latest attack waves observed since February 2025, the threat actors use a JavaScript downloader that interacts with a malicious BSC smart contract to download JADESNOW, which subsequently queries the transaction history associated with an Ethereum address to fetch the JavaScript version of InvisibleFerret. LinkPro Linux Rootkit Spotted in the Wild — An investigation into the compromise of an Amazon Web Services (AWS)-hosted infrastructure led to the discovery of a new GNU/Linux rootkit dubbed LinkPro. The backdoor features functionalities relying on the installation of two extended Berkeley Packet Filter (eBPF) modules to conceal itself and to be remotely activated upon receiving a magic packet - a TCP SYN packet with a specific window size (54321) that signals the rootkit to await further instructions within a one-hour window, allowing it to evade traditional security defenses. The commands supported by LinkPro include executing /bin/bash in a pseudo-terminal, running a shell command, enumerating files and directories, performing file operations, downloading files, and setting up a SOCKS5 proxy tunnel. It's currently not known who is behind the attack, but it's suspected that the threat actors are financially motivated. Zero Disco Campaign Targets Cisco Devices with Rootkits — A new campaign has exploited a recently disclosed security flaw impacting Cisco IOS Software and IOS XE Software to deploy Linux rootkits on older, unprotected systems. The activity, codenamed Operation Zero Disco by Trend Micro, involves the weaponization of CVE-2025-20352 (CVSS score: 7.7), a stack overflow vulnerability in the Simple Network Management Protocol (SNMP) subsystem that could allow an authenticated, remote attacker to execute arbitrary code by sending crafted SNMP packets to a susceptible device. The operation primarily impacted Cisco 9400, 9300, and legacy 3750G series devices, Trend Micro said. The intrusions have not been attributed to any known threat actor or group. Pixnapping Attack Leads to Data Theft on Android Devices — Android devices from Google and Samsung have been found vulnerable to a side-channel attack that could be exploited to covertly steal two-factor authentication (2FA) codes, Google Maps timelines, and other sensitive data without the users' knowledge pixel-by-pixel. The attack has been codenamed Pixnapping. Google is tracking the issue under the CVE identifier CVE-2025-48561 (CVSS score: 5.5). Patches for the vulnerability were issued by the tech giant as part of its September 2025 Android Security Bulletin, with additional fixes forthcoming in December. Chinese Threat Actors Exploited ArcGIS Server as Backdoor — Threat actors with ties to China have been attributed to a novel campaign that compromised an ArcGIS system and turned it into a backdoor for more than a year. The activity is the handiwork of a Chinese state-sponsored hacking group called Flax Typhoon, which is also tracked as Ethereal Panda and RedJuliett. "The group cleverly modified a geo-mapping application's Java server object extension (SOE) into a functioning web shell," ReliaQuest said. "By gating access with a hardcoded key for exclusive control and embedding it in system backups, they achieved deep, long-term persistence that could survive a full system recovery." The attack chain involved the threat actors targeting a public-facing ArcGIS server that was linked to a private, internal ArcGIS server by compromising a portal administrator account to deploy a malicious SOE, thereby allowing them to blend in with normal traffic and maintain access for extended periods. The attackers then instructed the public-facing server to create a hidden directory to serve as the group's "private workspace." They also blocked access to other attackers and admins with a hard-coded key. The findings demonstrate Flax Typhoon's consistent modus operandi of quietly turning an organization's own tools against itself rather than using sophisticated malware or exploits. ️🔥 Trending CVEs Hackers move fast. They often exploit new vulnerabilities within hours, turning a single missed patch into a major breach. One unpatched CVE can be all it takes for a full compromise. Below are this week’s most critical vulnerabilities gaining attention across the industry. Review them, prioritize your fixes, and close the gap before attackers take advantage. This week’s list includes — CVE-2025-24990, CVE-2025-59230 (Microsoft Windows), CVE-2025-47827 (IGEL OS before 11), CVE-2023-42770, CVE-2023-40151 (Red Lion Sixnet RTUs), CVE-2025-2611 (ICTBroadcast), CVE-2025-55315 (Microsoft ASP.NET Core), CVE-2025-11577 (Clevo UEFI firmware), CVE-2025-37729 (Elastic Cloud Enterprise), CVE-2025-9713, CVE-2025-11622 (Ivanti Endpoint Manager), CVE-2025-48983, CVE-2025-48984 (Veeam), CVE-2025-11756 (Google Chrome), CVE-2025-49201 (Fortinet FortiPAM and FortiSwitch Manager), CVE-2025-58325 (Fortinet FortiOS CLI), CVE-2025-49553 (Adobe Connect collaboration suite), CVE-2025-9217 (Slider Revolution plugin), CVE-2025-10230 (Samba), CVE-2025-54539 (Apache ActiveMQ), CVE-2025-41703, CVE-2025-41704, CVE-2025-41706, CVE-2025-41707 (Phoenix Contact QUINT4), and CVE-2025-11492, CVE-2025-11493 (ConnectWise Automate). 📰 Around the Cyber World Microsoft Unveils New Security Improvements — Microsoft revealed that "parts of the kernel in Windows 11 have been rewritten in Rust, which helps mitigate against memory corruption vulnerabilities like buffer overflows and helps reduce attack surfaces." The company also noted that it's taking steps to secure AI-powered agentic experiences on the operating system by ensuring that they operate with limited permissions and only obtain access to resources users' explicitly provide permission to. In addition, Microsoft said agents that integrate with Windows must be cryptographically signed by a trusted source so that they can be revoked if found to be malicious. Each AI agent will also run under its own dedicated agent account that's distinct from the user account on the device. "This facilitates agent-specific policy application that can be different from the rules applied to other accounts like those for human users," it said. SEO Campaign Uses Fake Ivanti Installers to Steal Credentials — A new attack campaign has leveraged SEO poisoning to lure users into downloading a malicious version of the Ivanti Pulse Secure VPN client. The activity targets users searching for legitimate software on search engines like Bing, redirecting them to attacker-controlled lookalike websites (ivanti-pulsesecure[.]com or ivanti-secure-access[.]org). The goal of this attack is to steal VPN credentials from the victim's machine, enabling further compromise. "The malicious installer, a signed MSI file, contains a credential-stealing DLL designed to locate, parse, and exfiltrate VPN connection details," Zscaler said. "The malware specifically targets the connectionstore.dat file to steal saved VPN server URIs, which it combines with hardcoded credentials for exfiltration. Data is sent to a command-and-control (C2) server hosted on Microsoft Azure infrastructure." Qilin's Ties with BPH Providers Exposed — Cybersecurity researchers from Resecurity examined Qilin ransomware group's "close affiliation" with underground bulletproof hosting (BPH) operators, finding that the e-crime actor has not only relied on Cat Technologies Co. Limited. (which, in turn, is hosted on an IP address tied to Aeza Group) for hosting its data leak site, but also advertised services like BEARHOST Servers (aka Underground) on its WikiLeaksV2 site, where the group publishes content about their activities. BEARHOST has been operational since 2016, offering its services for anywhere from $95 to $500. While BEARHOST abruptly announced the stoppage of its service on December 28, 2024, it is assessed that the threat actors have taken the BPH service into private mode, catering only to trusted and vetted underground actors. On May 8, 2025, it resurfaced as Voodoo Servers, only for the operators to terminate the service again towards the end of the month, citing political reasons. "The actors decided to disappear through an 'exit scam' scenario, keeping the underground audience completely clueless," Resecurity said. "Notably, the legal entities behind the service continue their operations." Notably, Cat Technologies Co. Limited. also shares links to shadowy entities like Red Bytes LLC, Hostway, Starcrecium Limited, and Chang Way Technologies Co. Limited, the last of which has been associated with extensive malware activity, hosting command-and-control (C2) servers of Amadey, StealC, and Cobalt Strike used by cybercriminals. Another entity of note is Next Limited, which shares the same Hong Kong address as Chang Way Technologies Co. Limited and has been attributed to malicious activity in connection with Proton66. U.S. Judge Bars NSO Group from Targeting WhatsApp — A U.S. judge barred NSO Group from targeting WhatsApp users and cut the punitive damages verdict awarded to Meta by a jury in May 2025 to $4 million, because the court did not have enough evidence to determine that NSO Group's behavior was "particularly egregious." The permanent injunction handed out by U.S. District Judge Phyllis Hamilton means that the Israeli vendor cannot use WhatsApp as a way to infect targets' devices. As a refresher, Meta sued the NSO Group in 2019 over the use of Pegasus spyware by exploiting a then-zero-day flaw in the messaging app to spy on 1,400 people from 20 countries, including journalists and human rights activists. It was fined close to $168 million earlier this May. The proposed injunction requires NSO Group to delete and destroy computer code related to Meta's platforms, and she concluded that the provision is "necessary to prevent future violations, especially given the undetectable nature of defendants' technology." Google's Privacy Sandbox Initiative is Officially Dead — In 2019, Google launched an initiative called Privacy Sandbox to come up with privacy-enhancing alternatives to replace third-party cookies on the web. However, with the company abandoning its plans to deprecate third-party tracking cookies, the project appears to be winding down. To that end, the tech giant said it's retiring the following Privacy Sandbox technologies citing low levels of adoption: Attribution Reporting API (Chrome and Android), IP Protection, On-Device Personalization, Private Aggregation (including Shared Storage), Protected Audience (Chrome and Android), Protected App Signals, Related Website Sets (including requestStorageAccessFor and Related Website Partition), SelectURL, SDK Runtime and Topics (Chrome and Android). In a statement shared with Adweek, the company said it will continue to work to improve privacy across Chrome, Android, and the web, but not under the Privacy Sandbox branding. Russia Blocks Foreign SIM Cards — Russia said it's taking steps to temporarily block mobile internet for foreign SIM cards, citing national security reasons. The new rule imposes a mandatory 24-hour mobile internet blackout for anyone entering Russia with a foreign SIM card. Flaw in CORS headers in Web Browsers Disclosed — The CERT Coordination Center (CERT/CC) disclosed details of a vulnerability in cross-origin resource sharing (CORS) headers in Chromium, Google Chrome, Microsoft Edge, Safari, and Firefox that enables the CORS policy to be manipulated. This can be combined with DNS rebinding techniques to issue arbitrary requests to services listening on arbitrary ports, regardless of the CORS policy in place by the target. "An attacker can use a malicious site to execute a JavaScript payload that periodically sends CORS headers in order to ask the server if the cross-origin request is safe and allowed," CERT/CC explained. "Naturally, the attacker-controlled hostname will respond with permissive CORS headers that will circumvent the CORS policy. The attacker then performs a DNS rebinding attack so that the hostname is assigned the IP address of the target service. After the DNS responds with the changed IP address, the new target inherits the relaxed CORS policy, allowing an attacker to potentially exfiltrate data from the target." Mozilla is tracking the vulnerability as CVE-2025-8036. Phishing Campaigns Use Microsoft's Logo for Tech Support Scams — Threat actors are exploiting Microsoft's Name and branding in phishing emails to lure users into fraudulent tech support scams. The messages contain links that, when clicked, take the victims to a fake CAPTCHA challenge, after which they are redirected to a phishing landing page to unleash the next stage of the attack. "After passing the captcha verification, the victim is suddenly visually overloaded with several pop-ups that appear to be Microsoft security alerts," Cofense said. "Their browser is manipulated to appear locked, and they lose the ability to locate or control their mouse, which adds to the feeling that the system is compromised. This involuntary loss of control creates a faux ransomware experience, leading the user to believe their computer is locked and to take immediate action to remedy the infection." From there, users are instructed to call a number to reach Windows Support, at which they are connected to a bogus technician to take the attack forward. "The threat actor could exploit further by asking the user to provide account credentials or persuade the user to install remote desktop tools, allowing full access to their system," the company said. Taxpayers, Drivers Targeted in Refund and Road Toll Smishing Scams — A smishing campaign has leveraged at least 850 newly-registered domain names in September and early October to target people living in the U.S., the U.K., and elsewhere with phishing links that use tax refunds, road toll charges, or failed package deliveries as a lure. The websites, designed to be loaded only when launched from a mobile device, claim to provide information about their tax refund status or obtain a subsidy of up to £300 to help offset winter fuel costs (note: this is a real U.K. government initiative), only to prompt them to provide personal details such as name, home address, telephone number and email address, as well as payment card information. The entered data is exfiltrated to the attackers over the WebSocket protocol. Some of the scam websites have also been found to target Canadian, German, and Spanish residents and visitors, per Netcraft. Meta's New Collage Feature May Use Photos in Phone's Camera Roll — Meta is officially rolling out a new opt-in feature to Facebook users in the U.S. and Canada to suggest the best photos and videos from users' camera roll and create collages and edits. "With your permission and the help of AI, our new feature enables Facebook to automatically surface hidden gems – those memorable moments that get lost among screenshots, receipts, and random snaps – and edit them to save or share," the company said. The feature was first tested back in late June 2025. The social media company emphasized that the suggestions are private and that it does not use media obtained from users' devices via the camera roll to train its models, unless users opt to edit the media with their AI tools or publish those suggestions to Facebook. Users who wish to opt out of the feature can do so by navigating Settings and Privacy > Settings > Preferences > Camera Roll Sharing Suggestions. Fake Homebrew, TradingView, LogMeIn Sites Serve Stealer Malware Targeting Macs — Threat actors are employing social engineering tactics to trick users into visiting fake websites impersonating trusted platforms like as Homebrew, TradingView, and LogMeIn, where they are instructed to copy and run a malicious command on the Terminal app as part of ClickFix-style attacks, resulting in the deployment of stealer malware such as Atomic Stealer and Odyssey Stealer. "More than 85 phishing domains were identified, connected through shared SSL certificates, payload servers, and reused infrastructure," Hunt.io said. "The findings suggest a coordinated and ongoing campaign in which operators continuously adapt their infrastructure and tactics to maintain persistence and evade detection within the macOS ecosystem." It's suspected that users are driven to these websites via sponsored ads on search engines like Bing and Google. Dutch Data Protection Watchdog Fines Experian $3.2 Million for Privacy Violations — The Dutch Data Protection Authority (DPA) imposed a fine of €2.7 million ($3.2 million) on Experian Netherlands for collecting data in contravention of the E.U. General Data Protection Regulation (GDPR). The DPA said the consumer credit reporting company gathered information on people from both public and non-public sources and failed to make it clear why the collection of certain data was necessary. In addition to the penalty, Experian is expected to delete the database of personal data by the end of the year. The company has also ceased its operations in the country. "Until January 1, 2025, Experian provided credit assessments about individuals to its clients," the DPA said. "To do this, the company collected data such as negative payment behavior, outstanding debts, or bankruptcies. The AP found that Experian violated the law by unlawfully using personal data." Threat Actors Send Fake Password Manager Breach Alerts — Bad actors are sending phishing alerts claiming that their password manager accounts for 1Password and Lastpass have been compromised in order to trick users into providing their passwords and hijack their accounts. In response to the attack, LastPass said it has not been hacked and that it's an attempt on the part of the attackers to generate a false sense of urgency. In some cases spotted by Bleeping Computer, the activity has also been found to urge recipients to install a more secure version of the password manager, resulting in the deployment of a legitimate remote access software called Syncro. The software vendor has since moved to shut down the malicious accounts to prevent further installs. SocGholish MaaS Detailed — LevelBlue has published an analysis of a threat activity cluster known as SocGholish (aka FakeUpdates), which is known to be active since 2017, leveraging fake web browser update prompts on compromised websites as a lure to distribute malware. Victims are typically routed through Traffic Distribution Systems (TDS) like Keitaro and Parrot TDS to filter users based on specific factors such as geography, browser type, or system configuration, ensuring that only the intended targets are exposed to the payload. It's offered under a malware-as-a-service (MaaS) by a financially motivated cybercrime group called TA569. SocGholish stands out for its ability to turn legitimate websites into large-scale distribution platforms for malware. Acting as an initial access broker (IAB), its operations profit from follow-on compromises by other actors. "Once executed, its payloads range from loaders and stealers to ransomware, allowing for extensive follow-up exploitation," LevelBlue said. "This combination of broad reach, simple delivery mechanisms, and flexible use by multiple groups makes SocGholish a persistent and dangerous threat across industries and regions." One of its primary users is Evil Corp, with the malware also used to deliver RansomHub in early 2025. 🎥 Cybersecurity Webinars The Practical Framework to Govern AI Agents Without Slowing Innovation → AI is changing everything fast — but for most security teams, it still feels like a fight just to keep up. The goal isn’t to slow innovation with more controls; it’s to make those controls work for the business. By building security into AI from the start, you can turn what used to be a bottleneck into a real accelerator for growth and trust. The Future of AI in GRC: Turning Risk Into a Compliance Advantage - AI is changing how companies manage risk and compliance — fast. It brings big opportunities but also new challenges. This webinar shows you how to use AI safely and effectively in GRC, avoid common mistakes, and turn complex rules into a real business advantage. Workflow Clarity: How to Blend AI and Human Effort for Real Results - Too many teams are rushing to “add AI” without a plan — and ending up with messy, unreliable workflows. Join us to learn a clearer approach: how to use AI thoughtfully, simplify automation, and build systems that scale securely. 🔧 Cybersecurity Tools Beelzebub - It turns honeypot deployment into a powerful, low-code experience. It uses AI to simulate real systems, helping security teams detect attacks, track emerging threats, and share insights through a global threat intelligence network. NetworkHound - It maps your Active Directory network from the inside out. It discovers every device — domain-joined or shadow-IT — validates SMB and web services, and builds a full BloodHound-compatible graph so you can see and secure your environment clearly. Disclaimer: These tools are for educational and research use only. They haven’t been fully security-tested and could pose risks if used incorrectly. Review the code before trying them, test only in safe environments, and follow all ethical, legal, and organizational rules. 🔒 Tip of the Week Most Cloud Breaches Aren’t Hacks — They’re Misconfigurations. Here’s How to Fix Them — Cloud storage buckets like AWS S3, Azure Blob, and Google Cloud Storage make data sharing easy — but one wrong setting can expose everything. Most data leaks happen not because of hacking, but because someone left a public bucket, skipped encryption, or used a test bucket that never got locked down. Cloud platforms give you flexibility, not guaranteed safety, so you need to check and control access yourself. Misconfigurations usually happen when permissions are too broad, encryption is disabled, or visibility is lost across multiple clouds. Doing manual checks doesn’t scale — especially if you manage data in AWS, Azure, and GCP. The fix is using tools that automatically find, report, and even fix unsafe settings before they cause damage. ScoutSuite is a strong starting point for cross-cloud visibility. It scans AWS, Azure, and GCP for open buckets, weak IAM roles, and missing encryption, then creates an easy-to-read HTML report. Prowler goes deeper into AWS, checking S3 settings against CIS and AWS benchmarks to catch bad ACLs or unencrypted buckets. For ongoing control, Cloud Custodian lets you write simple policies that automatically enforce rules — for example, forcing all new buckets to use encryption. And CloudQuery can turn your cloud setup into a searchable database, so you can monitor changes, track compliance, and visualize risks in one place. The best approach is to combine them: run ScoutSuite or Prowler weekly to find issues, and let Cloud Custodian handle automatic fixes. Even a few hours spent setting these up can stop the kind of data leaks that make headlines. Always assume every bucket is public until proven otherwise — and secure it like it is. Conclusion The truth is, no tool or patch will ever make us fully secure. What matters most is awareness — knowing what’s normal, what’s changing, and how attackers think. Every alert, log, or minor anomaly is a clue. Keep connecting those dots before someone else does.

An investigation into the compromise of an Amazon Web Services (AWS)-hosted infrastructure has led to the discovery of a new GNU/Linux rootkit dubbed LinkPro, according to findings from Synacktiv. "This backdoor features functionalities relying on the installation of two eBPF [extended Berkeley Packet Filter] modules, on the one hand to conceal itself, and on the other hand to be remotely activated upon receiving a 'magic packet,'" security researcher Théo Letailleur said. The infection, per the French cybersecurity company, involved the attackers exploiting an exposed Jenkins server vulnerable to CVE-2024-23897 (CVSS score: 9.8) as the starting point, following which a malicious Docker Hub image named "kvlnt/vv" (now removed) was deployed on several Kubernetes clusters. The Docker image consists of a Kali Linux base along with a folder called "app" containing three files - start.sh, a shell script to start the SSH service and execute the remaining two files link, an open-source program called vnt that acts as a VPN server and provides proxy capabilities by connecting to vnt.wherewego[.]top:29872, allowing the attacker to connect to the compromised server from anywhere and use it as a proxy to reach other servers app, a Rust-based downloader referred to as vGet that receives an encrypted VShell payload from an S3 bucket, which then proceeds to communicate with its own command-and-control (C2) server (56.155.98[.]37) over a WebSocket connection Also delivered to the Kubernetes nodes were two other malware strains, a dropper embedding another vShell backdoor, and LinkPro, a rootkit written in Golang. The stealthy malware can operate in either passive (aka reverse) or active (aka forward) mode, depending on its configuration, allowing it to listen for commands from the C2 server only upon receiving a specific TCP packet or directly initiate contact with the server. While the forward mode supports five different communication protocols, including HTTP, WebSocket, UDP, TCP, and DNS, the reverse mode only uses the HTTP protocol. The overall sequence of events unfolds as follows - Install the "Hide" eBPF module, which contains eBPF programs of the Tracepoint and Kretprobe types to hide its processes and network activity If the "Hide" module installation fails, or if it has been disabled, install the shared library "libld.so" in /etc/ld.so.preload If reverse mode is used, install the "Knock" eBPF module, which contains two eBPF programs of the eXpress Data Path (XDP) and Traffic Control (TC) types to ensure that the C2 communication channel is fired only upon the receipt of the magic packet Achieve persistence by setting up a systemd service Execute C2 commands On interruption (SIGHUP, SIGINT, and SIGTERM signals), uninstall the eBPF modules and delete the modified /etc/libld.so and restore it back to its original version To achieve this, LinkPro modifies the "/etc/ld.so.preload" configuration file to specify the path of the libld.so shared library embedded within it with the main objective of concealing various artifacts that could reveal the backdoor's presence. "Thanks to the presence of the /etc/libld.so path in /etc/ld.so.preload, the libld.so shared library installed by LinkPro is loaded by all programs that require /lib/ld-linux.so14," Letailleur explained. "This includes all programs that use shared libraries, such as glibc." "Once libld.so is loaded at the execution of a program, for example /usr/bin/ls, it hooks (before glibc) several libc functions to modify results that could reveal the presence of LinkPro." The magic packet, per Synacktiv, is a TCP packet with a window size value of 54321. Once this packet is detected, the Knock module saves the source IP address of the packet and an associated expiration date of one hour as its value. The program then keeps an eye out for additional TCP packets whose source IP address matches that of the already saved IP. In other words, the core functionality of LinkPro is to wait for a magic packet to be sent, after which the threat actor has a one-hour window to send commands to a port of their choice. The Knock module is also designed to modify the incoming TCP packet's header to replace the original destination port with LinkPro's listening port (2333), and alter the outgoing packet to replace the source port (2233) with the original port. "The purpose of this maneuver is to allow the operator to activate command reception for LinkPro by going through any port authorized by the front-end firewall," Synacktiv said. "This also makes the correlation between the front-end firewall logs and the network activity of the compromised host more complex." The commands supported by LinkPro include executing /bin/bash in a pseudo-terminal, running a shell command, enumerating files and directories, performing file operations, downloading files, and setting up a SOCKS5 proxy tunnel. It's currently not known who is behind the attack, but it's suspected that the threat actors are financially motivated. "For its concealment at the kernel level, the rootkit uses eBPF programs of the tracepoint and kretprobe types to intercept the getdents (file hiding) and sys_bpf (hiding its own BPF programs) system calls. Notably, this technique requires a specific kernel configuration (CONFIG_BPF_KPROBE_OVERRIDE)," the company said. "If the latter is not present, LinkPro falls back on an alternative method by loading a malicious library via the /etc/ld.so.preload file to ensure the concealment of its activities in user space."

Researchers at US universities have demonstrated how a malicious Android app can trick the system into leaking pixel data. That may sound harmless, but imagine if a malicious app on your Android device could glimpse tiny bits of information on your screen—even the parts you thought were secure, like your two-factor authentication (2FA) codes. That’s the chilling idea behind “Pixnapping” attacks described in the research paper coming from University of California (Berkeley and San Diego), University of Washington, and Carnegie Mellon University. A pixel is one of the tiny colored dots that make up what you see on your device’s display. The researchers built a pixel-stealing framework that bypasses all browser protections and can even lift secrets from non-browser apps such as Google Maps, Signal, and Venmo—as well as websites like Gmail. It can even steal 2FA codes from Google Authenticator. Pixnapping is a classic side-channel attack—stealing secrets not by breaking into software, but by observing physical clues that devices give off during normal use. Pixel-stealing ideas date back to 2013, but this research shows new tricks for extracting sensitive data by measuring how specific pixels behave. The researchers tested their framework on modern Google Pixel phones (6, 7, 8, 9) and a Samsung Galaxy S25 and succeeded in stealing secrets from both browsers and non-browser apps. They disclosed the findings to Google and Samsung in early 2025. As of October 2025, Google has patched part of the vulnerability, but some workarounds remain and both companies are still working on a full fix. Other Android devices may also be vulnerable. The technical knowledge required to perform such an attack is enormous. This isn’t “script kiddie” territory: Attackers would need deep knowledge of Android internals and graphics hardware. But once developed, a Pixnapping app could be disguised as something harmless and distributed like any other piece of Android malware. To perform an attack, someone would have to convince or trick the target into installing the malicious app on their device. This app abuses Android Intents—a fundamental part of how apps communicate and interact with each other on Android devices. You can think of an intent like a message, or request, that one app sends either to another app or to the Android operating system itself, asking for something to happen. The malicious app’s programming will stack nearly transparent windows over the app it wants to spy on and watch for subtle timing signals that depend on pixel color. It doesn’t take long—the paper shows it can steal temporary 2FA codes from Google Authenticator in under 30 seconds. Once stolen, the data is sent to a command-and-control (C2) server controlled by the attacker. How to stay safe From the steps it takes to perform such an attack we can list some steps that can keep your 2FA codes and other secrets safe. Update regularly: Make sure your device and apps have the latest security updates. Google and Samsung are rolling out fixes; don’t ignore those update prompts. The underlying vulnerability is tracked as CVE-2025-48561. Be cautious installing apps: Only install apps from trusted sources like Google Play and check reviews and permissions before installing. Avoid sideloading unknown APKs and ask yourself if the permissions an app asks for are really needed for what you want it to do. Review permissions: Android improved its permission system, but check regularly what apps can do, and don’t hesitate to remove permissions of the ones you don’t use often. Use app screenshots wisely: Don’t store or display sensitive info (like codes, addresses, or logins) in apps unless needed, and close apps after use. Monitor security news: Look for announcements from Google and Samsung about patches for this vulnerability, and act on them. Enable Play Protect: Keep Play Protect active to help spot malicious apps before they’re installed. Use up-to-date real-time anti-malware protection on your Android device, preferably with a web protection module. If you’re worried about your 2FA codes getting stolen, consider switching to hardware token 2FA options. Scammers know more about you than you think. Malwarebytes Mobile Security protects you from phishing, scam texts, malicious sites, and more. With real-time AI-powered Scam Guard built right in.

Bulletin ID: AWS-2025-023 Scope: AWS Content Type: Important (requires attention) Publication Date: 2025/10/10 10:15 PM PDT We identified the following CVEs: CVE-2025-11616 - A Buffer Over-read when receiving ICMPv6 packets of certain message types which are smaller than the expected size. CVE-2025-11617 - A Buffer Over-read when receiving a IPv6 packet with incorrect payload lengths in the packet header. CVE-2025-11618 - An invalid pointer dereference when receiving a UDP/IPv6 packet with an incorrect IP version field in the packet header. Description: FreeRTOS-Plus-TCP is an open source TCP/IP stack implementation specifically designed for FreeRTOS. The stack provides a standard Berkeley sockets interface and supports essential networking protocols including IPv6, ARP, DHCP, DNS, LLMNR, mDNS, NBNS, RA, ND, ICMP, and ICMPv6. These issues only affect applications using IPv6. Affected versions: v4.0.0 to v4.3.3, if IPv6 support is enabled

Betti RHC, la prima graphic novel al mondo dedicata alla cybersecurity awareness, ha finalmente il suo sito ufficiale. Uno spazio tutto suo dove scoprire il progetto, sfogliare le copertine degli episodi e immergersi nel mondo di Betti: la giovane laureanda in informatica che, dopo la morte misteriosa del padre, si trasforma nell'hacker più potente del mondo. Una storia avvincente che, episodio dopo episodio, affronta una minaccia digitale diversa — dal phishing al ransomware, fino al cyberbullismo — e insegna a riconoscerla e a difendersi, senza che sembri mai una lezione. Sul sito trovate tutto ciò che rende Betti un progetto diverso dal solito: la sua filosofia, le anteprime delle tavole e il racconto di come nasce ogni volume. Perché dietro Betti RHC c'è solo lavoro umano: ogni tavola è disegnata interamente a mano dagli artisti del Gruppo Arte di Red Hot Cyber, senza alcun uso di intelligenza artificiale. E a garantire che ogni storia sia realistica e tecnicamente corretta c'è la supervisione degli hacker etici del gruppo HackerHood, che mantengono il racconto fedele al mondo reale della sicurezza informatica. C'è spazio anche per le aziende, che possono usare Betti come strumento di awareness diverso dai soliti corsi: acquistare i volumi, personalizzarli con il proprio brand o sponsorizzare nuovi episodi. E come primo regalo, l'episodio "Byte the Silence", dedicato al cyberbullismo, è scaricabile gratuitamente per uso personale. Perché la miglior difesa, in fondo, è una bella storia. 👉 Scopri tutto su https://betti.redhotcyber.com/

DEF CON volunteers step up to help water sector after China, Iran attack utilities When Jake Braun put out a call online last year seeking volunteers who wanted to help secure a water utility, the response was so overwhelming that he had to shut down the website. He ended up with a list of 350 names, and says he could have probably gathered thousands more. The response enabled the work of DEF CON Franklin, an initiative that recently completed a nine-month pilot program that paired white-hat hackers with water utilities in Indiana, Oregon, Utah and Vermont. The volunteers — many of them annual participants in the DEF CON cybersecurity conference — provided free services necessary to combat an escalating array of nation-state attacks on utilities over the last three years. The emphasis was on no-cost, hands-on support for operational technology (OT) mapping, password protocols and vulnerability assessments. Braun and the project’s other founders are now looking to rapidly scale the program up to help the country’s more than 50,000 water utilities — most of which lack the staff, resources and tools to defend themselves against increasingly sophisticated cyberthreats. “This next phase brings together top minds from DEF CON, academia, industry, and philanthropy to provide support in ways that are designed specifically for the unique realities of the water sector,” Braun told Recorded Future News on the sidelines of this year’s conference in Las Vegas. “This isn’t just about protecting networks,” he said. “It’s about protecting drinking water, public health and national resilience.” China and Iran in mind Braun said he was inspired to start Franklin after serving in the Biden administration right as China’s Volt Typhoon campaign emerged as one of the preeminent cyberthreats facing the United States. He is currently executive director at the University of Chicago’s Cyber Policy Initiative. The Volt Typhoon operation — in which Chinese state-backed hackers breached the systems of U.S. critical infrastructure and embedded themselves in preparation for potential future conflicts — took place alongside other headline-grabbing attacks on the water industry by Iranian nation-state actors following the October 7, 2023, terrorist attack in Israel. One of Braun’s first public events after taking over as the White House’s acting principal deputy national cyber director in May 2023 was in Pittsburgh just weeks after a water utility in the area was attacked by Iran. “I got deeply immersed in trying to figure out what our response should be. Iran and China threats are even more severe now than they were even a few years ago,” he said. “The government really isn't doing a lot to help them, particularly with cybersecurity.” Braun was a co-founder of the DEF CON Voting Machine Hacking Village that previously tested election system security, and he knew from that experience that the DEF CON community has a large pool of volunteers eager to help secure systems critical to the United States. Braun announced the initiative at the conference last year, naming it DEF CON Franklin after founding father Benjamin Franklin because he created the first volunteer fire department in the United States while living in Philadelphia in the late 1700s. The organization also will publish a post-DEF CON report called the Hackers’ Almanack that translates hacker-disclosed vulnerabilities into actionable insights for U.S. cybersecurity policy. It is backed financially by Craig Newmark Philanthropies and has already formed partnerships with the National Rural Water Association (NRWA), Cyber Resilience Corps, Aspen Digital, the American Water Works Association, Cyberspace Solarium 2.0 (CSC 2.0) and others. Ann Cleaveland, executive director of the UC Berkeley Center for Long-Term Cybersecurity and a founding partner of the Cyber Resilience Corps, said the initiative is a replicable model for a more community-centered cybersecurity apparatus "This is what cyber civil defense looks like, when skilled cyber volunteers are stepping up, when industry is stepping up, and when NRWA and its members are stepping up to fill the cybersecurity gap together,” Cleaveland said. Operating as outsiders One of the biggest issues Braun faced in trying to establish the initiative was with the water utilities themselves. The water utility community is insular, according to Braun, and is deeply antagonistic toward any measures that will force operators to raise prices on customers. The Biden administration was forced to rescind a memorandum in 2023 that established new cybersecurity guidelines for water systems after utilities joined together to sue the federal government — in part over alleged concerns that the regulations would force them to raise rates. Braun credited the NRWA with acting as a sherpa for DEF CON Franklin — ingratiating them to a tight-knit community often distrustful of outsiders. “Protecting our nation’s critical infrastructure isn’t a want but a necessity, and for the nearly 50,000 water systems nationwide, they need the tools and resources to not only be cyber aware but also resilient,” said Matt Holmes, CEO of the NRWA. “By designing solutions that are scalable, we are ensuring that even our smallest systems have the ability to protect themselves.” The NRWA suggested they start with a small pilot program and Braun agreed, picking utilities in Utah, Vermont, Indiana and Oregon where volunteers were deployed. “The pilots have gone quite well and they're all still going, which is great because they could have just walked away,” Braun said. One of the biggest questions Braun says they get from water industry representatives is why any nation-state actor would care about relatively tiny water utilities serving small communities across the U.S. Braun has had to remind them of the Volt Typhoon campaign and noted that one of the volunteers recently dealt with a Chinese phishing attack targeting an employee of a utility in Utah. “I think I kind of stupidly thought when we launched this that we'd say, ‘Hey, there's this free support, and we'd have 50,000 water utilities raise their hand. But it's kind of an insular community and the little utilities are like, ‘why would the Chinese, or the Iranians care about me?” he said. “Why would the Chinese care? Well, guess what, they do. The Chinese have heard of you. They make it their business to know about you.” Braun said when he originally came up with the idea for DEF CON Franklin, he planned on it being a long term effort that would take years. But the escalating threats from China and Iran have coincided with a precipitous drop in federal support thanks to the dismantling of the Environmental Protection Agency (EPA) and downsizing of the Cybersecurity and Infrastructure Security Agency. “We don't have 10 years to scale this thing up. So what we've just started doing in the last month or two is trying to figure out how we can deploy technology to scale this faster as opposed to just the humans,” he said. Understanding the tools Braun and his team are hard at work searching for free cybersecurity services and tools that can be deployed at utilities to offer basic protections while volunteers offer more detailed advice on specific topics. He added that the program did not want to saddle utilities with “freemium” products that would only be cost free for a temporary amount of time. Thankfully, the cybersecurity industry was game for the program, and companies like Dragos offered suites of free tools that can be used by critical infrastructure. The cybersecurity volunteers have been critical in helping explain to utilities what tools are available for free and helping them set them up. “We're inventorying truly free tools that are out there that can do things like asset inventory, network scanning — the basic stuff that you need for [operational technology] security, and then also trying to understand how to make sure that they're tailored specifically for the water utilities,” Braun said. His hope going forward is that local officials will hear about the program and ask why utilities are not taking advantage of the free support available. Braun added that it has been inspiring to see the hacker community step up to help organizations in need — at times helping their own region with an issue near and dear to their hearts. He has had to temper expectations for some volunteers, explaining that most organizations need fairly basic help with things like default passwords and multi-factor authentication. Franklin has not deployed any volunteers with less than 10 years of experience, he said, and many of those volunteering are former government workers with security clearances or people who work on sophisticated cybersecurity teams for Fortune 500 companies. In the end, Braun believes the U.S. government should eventually just step in and pay for more sophisticated tools that can be deployed at every water utility. “I mean, this is a government's job. It's a national security threat. Having a bunch of volunteers doing this is not the end solution, but it's kind of all we've got right now,” Braun explained. “As I was saying to one of these guys the other day, it's not like it's one of our volunteers or [services from] Crowdstrike. It's one of our volunteers or nothing — and with the threat level as it is, the government needs to step in eventually.” Jonathan Greig is a Breaking News Reporter at Recorded Future News. Jonathan has worked across the globe as a journalist since 2014. Before moving back to New York City, he worked for news outlets in South Africa, Jordan and Cambodia. He previously covered cybersecurity at ZDNet and TechRepublic.

Zero day exploitation surged by 46% year-over-year in the first six months of 2025, according to the Forescout Research – Vedere Labs H1 2025 Threat Review. Products from 27 vendors were found to be impacted by zero days, with Microsoft making up around a third (30%). Google products experienced the second highest volume of zero day exploits, at 11%, followed by Apple (8%), Ivanti (6%), Qualcomm (5%) and VMware (5%). A total of 23,583 vulnerabilities were published in the first half of 2025, averaging 130 new CVEs per day or 3930 per month. This represents a 15% increase compared to the same period in 2024. Additionally, 132 CVEs were added to the Cybersecurity and Infrastructure Security Agency (CISA)’s Known Exploited Vulnerabilities (KEV) catalog in H1 2025, an 80% year-over-year rise. Of these, 47% were originally published before 2025, many of which targeted perimeter infrastructure. Six impacted end of life products, meaning no patches are available for this equipment. Ransomware Actors Target Non-Traditional Equipment The Forescout report, published on August 4 during Black Hat USA, found that ransomware actors increasingly targeted non-traditional equipment, such as edge devices, IP cameras and Berkeley Software Distribution (BSD) servers. This approach is designed to bypass defenses, as such devices often lack endpoint detection and response (EDR). These devices are then used as footholds to enable lateral movement across IT, OT and IoT environments. One example of this tactic highlighted by the researchers was the deployment of Akira ransomware to Windows endpoints via a compromised IP camera in March 2025. Another was the VanHelsing group introducing a multi-platform encryptor that includes support for BSD UNIX. “We expect both asset types – IP cameras and BSD systems – to be increasingly targeted in the near future,” the researchers noted. “BSD, while niche, is gaining attention from ransomware operators.” The study also found that ransomware attacks grew 36% year-over-year, with 3649 documented attacks in H1 2025. Ransomware victims were recorded in 112 countries over the six-month period, a 9% increase from the 103 countries impacted in H1 2024. Nation State and Hacktivist Gangs Prevalent Forescout observed 137 threat actors undertake notable activity in H1 2025. Of these, 51% were attributed as financially motivated cybercriminals, 40% state-sponsored actors and 9% hacktivists. China was the country of origin for the highest proportion of these threat actors, at 33. This was followed by Russia (22 groups), Iran (eight), Turkey (four) and Brazil (three). The country of origin was unknown for 45 of the active tracked groups. The researchers also highlighted the blurred lines between hacktivists and nation-state groups, with Iran-aligned hacktivist groups heavily targeting critical OT environments. Daniel dos Santos, head of research at Forescout, commented: “What we’re seeing from Iranian-aligned groups is a shift toward more aggressive, state-influenced disruption tactics masked as activism. As geopolitical tensions escalate, these actors are becoming faster, louder and harder to attribute, and that makes their threat even more urgent for defenders to address.”

INTERVIEW In July 1990, before the World Wide Web even existed, an unusual alliance was formed to fight for the rights of the emerging online community. Lotus founder Mitch Kapor, John Perry Barlow – who wrote some of the Grateful Dead's most epic lyrics – and John Gilmore, co-founder of the GNU Project for free software and employee number five at Sun Microsystems, met in San Francisco to form the Electronic Frontier Foundation (EFF). The organization has since been prominent in some of the most important legal battles for privacy, online operations, and legislative correction. The Register sat down with executive director Cindy Cohn to discuss the past, but more importantly what's coming down the line. REG AD "I got involved at the EFF in 2000 because I knew one of the founders, John Gilmore, socially, and he called me one day and asked me if I was a new lawyer," she told us. REG AD "I was about three years into my legal practice at a little firm, and he asked me if I wanted to do a lawsuit. The EFF was helping a math PhD student at UC Berkeley named Dan Bernstein, who wanted to publish a cryptography program on the internet and was facing the US export restrictions that essentially would have forbidden him from doing so without a license, and nobody got a license for strong cryptography." Bernstein was at the vanguard in the first crypto wars in the '90s – although some would argue they started before that. The US government had declared that strong cryptography was technically a munition and would therefore have to be licensed before it could be shared or exported. With the EFF's help, he beat the case. It was one of the first of many such cases. For example, when telecoms engineer Mark Klein realized he'd set up a system for AT&T to monitor communications through its switching stations and relay data to the US government, he turned up outside the EFF's offices in 2006 with a shoulder bag full of documents that blew the case wide open. There's plenty to do But it's the future that the EFF is looking toward, Cohn explained. We're in an immensely dangerous time, with government information potentially being amassed by Palantir into a massive database that could be used to surveil the populace, and with data brokers harvesting personal information that can be bought by the police to bypass warrant requirements. "If it's true that Palantir is building one database tool, we will be looking very closely at ways that we can challenge that because that's a really bad idea," she said. "Not just against political action, like an 'enemies list' kind of situation, but also against the Chinese, the Russians, and other hackers coming in and getting one big honeypot of information about all Americans." And that's at the core of what the EFF is trying to do. It is, at heart, an organization that seeks to mitigate the risks of an unbridled rush into new technologies without considering the consequences. That so many technology firms and luminaries, including Apple cofounder Steve Wozniak, continue to support the organization financially is a testament to its enduring relevance. For years, the EFF has been warning about the dangers of data harvesting on individuals. This, Cohn explained, was brought into sharp relief when the US Supreme Court struck down Roe v. Wade in 2022 and women found themselves facing being targeted and arrested for exercising their reproductive rights. REG AD "There were suddenly a tremendous number of people who thought they were safe against government surveillance and government prosecution who suddenly weren't," she said. "They found that their Facebook instant messages were being used to prosecute them, that their text message circles with their friends were being used to try to figure out that their searches were going to be used in a court of law to try to demonstrate that they had violated the law, which wasn't the law a year ago." There's also the ongoing fight over encryption, an issue that was key to the EFF's foundation during the first crypto wars. Governments are still trying to insist on backdooring encryption, although the US government, after years of trying, seems to have come to its senses on the issue. The problem, Cohn opined, is that once you break encryption, there's no telling if someone else will find the installed backdoors. Not that politicians of either stripe can be relied upon, she said. When Obama was running for president in 2008, he was very vocal on the issue of Klein's revelations on the stump, but when he got into government all the rhetoric stopped, Cohn told us. Once in office, he didn't challenge the retroactive immunity telcos had been given for breaking the law. It didn't used to be this way, she added. After the Watergate scandal in the 1970s, the US enacted real reforms to protect privacy and rein in the intelligence services. Since then there has been a gradual erosion of these laws to the point where many of them are almost useless at covering the rights they were supposed to protect. Surrender is not in our creed While that might seem to be a hopeless situation, that's an attitude we need to fight. Cohn said that there's a feeling of "learned helplessness" that people fall into and accept the status quo. That's not a trap citizens should let themselves fall into, she suggested, and organizations like the EFF are here to carry on the struggle. "There are two options," she told us. "There's lose now, or fight and maybe lose later. And if you think there's a third way where, like not fighting and it'll all work out fine, I've got a bridge to sell you. This is just where we are, and we have to convince more people in the world about the value of due process, rule of law, and human rights." REG AD To that end, the EFF has a staff of highly skilled lawyers, many of whom gave up highly paid jobs in industry to join the nonprofit on a fraction of their old wages. They fight on important issues such as abuse of copyright, help with privacy legal cases, and have the backs of whistleblowers who bring forward evidence of illegal abuse of data. While not a fan of Julian Assange on a personal basis, he did do important work in exposing government misconduct, Cohn said. Snowden learned from this and released more data that showed the extent of government surveillance. Whistleblowing is vital to exposing such cases, she commented, since the perpetrators of illegal activities aren't just going to volunteer evidence of their actions. The organization also employs technologists to build tools such as Privacy Badger, a simple browser plugin that blocks data harvesting, and maintains the Atlas of Surveillance, a searchable map that lets anyone in the US see what technologies their government is using to gather data on them. "I think we've tried to really think about our three pillars of free speech, privacy, and innovation as the things that, if we can protect them, might not make a perfect internet, but we'll make one that is a lot better than the one that would otherwise happen," she said. "That has been our North Star all along." ®