f-secure

Week in review: Infostealer dropped via FortiClient EMS flaw, exploited Trend Micro Apex One flaw Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Coinflow CISO on crypto payments security under AI pressure Crypto payment firms sit near the top of the target list for advanced persistent threat groups, and the workload on their security leaders keeps growing. Malcolm Portelli, CISO at Coinflow, runs the company’s security program from Malta. Coinflow is headquartered in the United States and operates across multiple jurisdictions. Portelli sat down for this interview at the Span Cyber Security Arena conference. Frontier AI models collapse under multi-turn AI attacks, Cisco finds Attackers who probe large language models rarely give up after one refusal. They reframe, build context across turns, adopt personas, and escalate gradually. New research from Cisco’s AI threat intelligence team finds that the safety benchmarks used across the industry miss almost all of this behavior, and the gap between published scores and observed resilience runs wide enough to misrank leading models. The CISO selling confidence in a market full of breach headlines Engineering teams across enterprise IT are writing their own software with AI coding assistants, spinning up agents that act on their behalf, and assigning those agents the same access privileges their human creators hold. The shift has pulled the role of the chief information security officer into territory that did not exist two years ago. Speaking at the Span Cyber Security Arena conference, Hrvoje Englman, CISO at Span, said it is changing what defenders worry about most. Zapier exploit chain shows how known anti-patterns compose into critical risk A five-stage exploit chain disclosed by Token Security researchers turned a free Zapier account into write access on Zapier’s public developer SDK packages and on internal packages that load in every authenticated zapier.com session. Each link in the chain was a known anti-pattern. The composition across five systems was the finding. High-severity SharePoint RCE bug patched by Microsoft (CVE-2026-45659) Microsoft has released patches for a high-severity remote code execution vulnerability (CVE-2026-45659) in SharePoint that may be exploited in low-complexity attacks. It affects the SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016. Actively exploited Trend Micro Apex One flaw gets CISA warning (CVE-2026-34926) A relative directory path traversal vulnerability (CVE-2026-34926) in Trend Micro’s Apex One platform has been exploited in zero-day attacks, the company confirmed. Trend Micro Apex One is a security platform that protects all the devices in an organization from cyber threats. LinkedIn-themed phishing abuses Adobe’s A/B testing platform A newly documented phishing campaign is targeting professionals with fake LinkedIn business emails and abusing a trusted service operated by Adobe. The attack starts with an email that looks, at first glance, like a routine business inquiry: someone wants to do business with you through LinkedIn and has attached a signed contract for your review. New infostealer reaches enterprise devices through FortiClient EMS vulnerability Attackers are delivering a broad-spectrum infostealer to enterprise computers by exploiting a known vulnerability (CVE-2026-35616) in FortiClient Enterprise Management Server (EMS). CVE-2026-35616 is an improper access control vulnerability vulnerability in FortiClient EMS, a centralized management platform through which IT admins deploy, configure, and monitor FortiClient endpoint security software across all devices in an organization’s network. Manage machine identities: The hidden privileged access layer you need to manage Every automation, integration, and workload needs authentication and permissions, creating a large population of machine identities such as service accounts, service principals, workload roles, OAuth apps, AI agents, and IAM roles. These identities use credentials like access keys, secrets, and tokens. Many hold privileges equal to or greater than human admins. Because they grow quickly, persist for long periods, and often receive limited oversight, they create a hidden layer of privileged access. Lessons for organizations from the Verizon 2026 Data Breach Investigations Report The latest Verizon 2026 Data Breach Investigations Report (DBIR) offers valuable insight into the evolving cyber threat landscape. Based on more than 31,000 security incidents and 22,000 confirmed data breaches across 145 countries, the vendor-neutral report draws on data from police forces, cybersecurity companies, and CSIRTs, making it one of the most comprehensive cybersecurity studies published each year. Building a risk-based vulnerability management program that scales In this Help Net Security video, Shankar Somasundaram, CEO at Asimily, explains how to build a risk-based vulnerability program. He notes that vulnerabilities are exploding by an order of magnitude in the age of AI-driven attacks, with one customer finding a thousand vulnerabilities for every one they knew about. Boards want cyber risk in dollars, not CVE counts In this Help Net Security video, Ziv Levi, SVP of Technology at CYE, explains why translating cyber risk into dollars is one of the most pressing tasks for security leaders. Boards and executives want cyber exposure described in business terms, not technical jargon. The alert economy is driving security analyst burnout In this Help Net Security video, Ido Livneh, CEO of Jazz, explains why security analysts burn out and what leaders can do about it. The cause, he argues, is not long hours but meaningless work. Analysts spend their days closing repetitive tickets while the institutional knowledge of senior staff walks out the door when they quit, taking organizational context with them and driving up false positives. OpenHack: Open-source AI-powered vulnerability research Source-guided vulnerability research increasingly leans on coding harnesses such as Claude Code, Codex, and Cursor to drive agent-based reviews of application code. A new MIT-licensed project from the Dutch security firm Hadrian, called OpenHack, packages that approach into a file-based workspace that any of those harnesses can run. Authorities seize 800 servers used for cyberattacks and disinformation Dutch authorities arrested two men and seized 800 servers linked to a hosting provider that investigators say supported Russian activities aimed at undermining democracy and security through cyberattacks, disinformation, and disruption of public and economic systems. Cisco refines its risk-based vulnerability disclosure for the AI era Security teams already struggle with long lists of vulnerabilities and limited time to patch them. Cisco believes AI could increase that pressure by accelerating vulnerability discovery and increasing the number of findings security teams need to review. Anthropic adds 28 security and compliance integrations for Claude AI tools are becoming part of everyday work in organizations, creating new security and oversight requirements as usage grows. To address that, Anthropic introduced 28 integrations with security and compliance tools that allow IT and security teams to manage Claude in the same way they manage other applications in their environments. What happens when security teams inherit identity Eric Woodruff, Chief Identity Architect at Semperis, shared his perspective on where organizations struggle with identity, why identity platforms become difficult to manage, how phishing-resistant authentication works in practice, and what non-human identities and AI could mean for security. Personal information of 185,000 people exposed after cyberattack on 7-Eleven Data belonging to about 185,000 people was exposed following a cyberattack on convenience store chain 7-Eleven that was later claimed by the ShinyHunters extortion gang, according to Have I Been Pwned. The exposed information includes email addresses, names, physical addresses, dates of birth, and phone numbers, while a small number of records also contained additional data fields. Chinese phishing gangs grow into a force to be reckoned with Chinese-language phishing-as-a-service (PhaaS) communities are expanding in an area historically dominated by Russian-speaking cybercriminal groups. The Google Threat Intelligence Group (GTIG) analyzed a dozen active PhaaS offerings operating in Chinese-language underground communities and found mature services, with several likely linked to broader criminal activity in the region. European AI adoption hits 99% with regulated data driving most policy violations Generative AI tools operate inside nearly every European workplace, embedded in meeting transcription services, writing assistants, coding copilots, and search features. Workers in the region pull these tools into daily routines that involve customer records, financial information, and proprietary code, and that volume of activity has produced a measurable pattern in where data exposure occurs. The Netskope Threat Labs Report: Europe 2026 documents this pattern across organizations in Europe over the past year. Claude now reviews and fixes vulnerabilities as you write code Anthropic introduced a security-guidance plugin for Claude Code that reviews code changes for common vulnerabilities and helps Claude identify and fix issues during the same development session. Hackers are knocking on office doors pretending to be IT staff The Silent Ransom Group (SRG) is targeting law firms using social engineering techniques and an unusual tactic for cybercriminals: showing up at victims’ offices in person while posing as IT staff, the FBI warns. AI chatbot recommendations lure users to cryptojacking malware sites Cybercriminals are using AI chatbot interactions alongside poisoned search results to direct users to malicious download sites in an active cryptojacking campaign, Microsoft has warned. Canonical releases Workshop for one-command sandboxed dev environments on Ubuntu Canonical released Workshop, a tool that launches sandboxed development environments on Ubuntu with a single command. Environments are configured once and reproduced on different machines, giving teams consistent setups across development workstations and deployment pipelines. Police arrest suspect in Ajax football club hack that exposed 300,000 fan records The Dutch National Police arrested a man suspected of hacking into the computer systems of AFC Ajax, a football club from Amsterdam. The investigation began after AFC Ajax discovered unauthorized access to its computer systems earlier this year. Dutch police traced the intrusion to a suspect from the municipality of Buren and arrested him following the investigation. Oil shipments, drone makers, and a poisoned code library targeted in recent APT campaigns Geopolitical pressure drove much of the state-sponsored cyber activity recorded between October 2025 and March 2026, according to ESET’s latest APT Activity Report. Espionage groups aligned with China, North Korea, Russia, and Iran adjusted their targets to match the economic and security concerns of their governments. A single typo could derail your World Cup plans Cybercriminals are spoofing Fédération Internationale de Football Association (FIFA) websites ahead of the 2026 FIFA World Cup, the FBI warns. The attackers are registering lookalike domains with small spelling changes or different domain endings to impersonate FIFA websites and services. The tactic, known as typosquatting, relies on users making small typing mistakes when entering website addresses. OpenAI prepares ChatGPT for the election misinformation wave AI-generated election misinformation could shape public opinion and influence the lives of millions of people. To address those risks, OpenAI outlined a series of safeguards ahead of the 2026 election cycle. The company said its efforts will focus on helping users access voting information, supporting cybersecurity defenders, and improving transparency around AI-generated content. Cybercriminals sail away with data from 6 million Carnival customers Carnival Corporation, one of the world’s largest cruise operators, confirmed a data breach weeks after the ShinyHunters hacking group claimed it had stolen millions of customer records. Carnival acknowledged a phishing incident involving a single employee account and stated that it was investigating the scope of the unauthorized activity. The behavioral signals that sharpen Trojan malware detection Malware analysts spend a lot of time deciding which signals from a sandbox run are worth keeping. A sample executed in a controlled environment can generate hundreds of measurable attributes covering file structure, registry edits, process behavior, and network traffic. Most of those attributes add noise. A recent study works through this problem in detail, and the part that earns attention from working defenders is the feature selection, not the deep learning model attached to it. Anthropic launches Claude Opus 4.8, prepares Mythos-class models for all customers Anthropic has released Claude Opus 4.8 and outlined plans for broader access to its Mythos-class models, which the company expects to make available to all customers in the coming weeks. Claude Opus 4.8 is available to all users, with pricing unchanged from Opus 4.7. Websites can spy on user activity by analyzing SSD behavior Websites have spent years collecting information about visitors through browser fingerprinting, tracking scripts, and other techniques designed to identify devices and monitor behavior. Researchers have demonstrated another method that relies on something most users would never expect a website to observe: activity on their SSD (Solid-State Drive), the storage device where applications and files are stored. Turns out the C-suite loves shadow AI Senior decision-makers are the heaviest users of unapproved AI tools, and they continue using them despite being aware of the security and privacy risks linked to shadow AI, according to TrustedTech’s Shadow AI in the Workplace report. The study found that 65% of decision-makers use shadow AI, compared with 31% of employees below decision-maker level. US states step up cyber defenses to protect local communities U.S. state governments are taking on a larger role in cybersecurity to help protect local communities and essential services. Many states are building state-led cyber defense programs, including cybersecurity clinics, regional security operations centers (RSOCs), and state cyber corps programs to reduce costs, strengthen the local workforce, and improve cyber resilience. Product showcase: F-Secure Internet Security blocks phishing sites, fake stores, and SMS scams F-Secure Internet Security protects against viruses, ransomware, spyware, infected email attachments, and other cyber threats. It focuses on securing devices and online activity through malware protection, scam prevention, safe browsing, and banking safeguards. The platform supports Windows, macOS, Android, and iOS devices under a single subscription. Anthropic: Claude Mythos identified 10,000+ software flaws Anthropic and its Project Glasswing partners have identified more than 10,000 high- or critical-severity vulnerabilities in critical software systems, the company announced in an update on the project’s progress. Vigolium: Open-source vulnerability scanner Vigolium, an open-source vulnerability scanner that combines deterministic scanning with AI-driven auditing, launched its initial open-source release this month. The project ships 235+ scanner modules and an in-process agent runtime called olium that handles autonomous endpoint discovery, attack planning, and finding triage. Apple makes its quantum-resistant encryption open source Apple has published its post-quantum cryptography implementations in corecrypto, together with mathematical proofs and verification tools for independent expert evaluation, allowing external researchers to review the work and reproduce the company’s analysis. Fake ChatGPT and Claude installers on GitHub are dropping Deno RAT malware Attackers are hosting counterfeit installers and plugins on GitHub and SourceForge that pose as widely used software, including ChatGPT, Claude, AutoTune, Kontakt, Ableton Live, and ZENOLOGY. The downloads deliver a backdoor called DinDoor, which then loads a remote access Trojan built on the Deno JavaScript runtime, according to Malwarebytes. Google AI Threat Defense targets attackers using AI to find flaws faster Google Cloud introduced AI Threat Defense, an automated cybersecurity platform that combines several of the company’s security assets to find, prioritize, and patch software vulnerabilities at machine speed. The product is aimed at enterprises contending with attackers who use AI to discover and exploit flaws in hours or days, compressing windows that once stretched into weeks. Companies built AI into core systems before figuring out how to govern it 70% of organizations use GenAI in live environments, and 64% have AI agents in pilot or production deployments. Some of those agents have privileged access to core systems, according to Check Point’s 2026 Cloud Security Report. Hottest cybersecurity open-source tools of the month: May 2026 Presented here is a curated selection of noteworthy open-source cybersecurity solutions that have drawn recognition for their ability to enhance security postures across diverse settings. Microsoft’s new cloud PCs place AI agents under enterprise controls Microsoft’s Windows 365 for Agents, a cloud PC platform for agentic workloads, runs AI agents in secure environments. Organizations can direct agents with natural language to interact with applications, browsers, files, and enterprise systems. The platform is available in public preview. Microsoft’s Copilot trust test: Zero findings, more models, wider oversight Microsoft 365 Copilot and Copilot Chat (Copilot) have been recertified under ISO/IEC 42001:2023 by an independent auditor for the second consecutive year. Copilot first received ISO 42001 certification in March 2025. This year’s recertification recorded zero non-conformities and zero improvement observations, resulting in a second audit in a row. Product showcase: TotalAV helps iOS users clean up their digital mess TotalAV Mobile Security helps protect devices from malicious websites, SMS scams, unsafe public Wi-Fi networks, and exposed credentials. The app is available for Windows, Android, macOS, and iOS devices. Microsoft 365 Copilot redesign brings context and actions into one workspace Microsoft 365 Copilot, an AI assistant that helps people write, summarize, analyze information, and complete work tasks, has been redesigned. It now serves as a single, flexible entry point to Copilot across Microsoft 365 apps, suggesting relevant actions based on the user’s work. Cybersecurity jobs available right now: May 26, 2026 We’ve scoured the market to bring you a selection of roles that span various skill levels within the cybersecurity field. Check out this weekly selection of cybersecurity jobs available right now. New infosec products of the month: May 2026 Here’s a look at the most interesting products from the past month, featuring releases from Alation, AppOmni, Apricorn, ASAPP, Babel Street, Checksum, Cogent, CTERA, Forward, LastPass, Operant AI, Riverbed, Sysdig, Trust3 AI, TrustCloud, VIAVI, Versa Networks, and XM Cyber.

Product showcase: F-Secure Internet Security blocks phishing sites, fake stores, and SMS scams F-Secure Internet Security protects against viruses, ransomware, spyware, infected email attachments, and other cyber threats. It focuses on securing devices and online activity through malware protection, scam prevention, safe browsing, and banking safeguards. The platform supports Windows, macOS, Android, and iOS devices under a single subscription. After downloading the Android app from the Play Store, I created an account and started using it. The setup process included enabling Device Protection, VPN, Scam Protection, and ID Monitoring. Once enabled, the app performed an initial scan of my Android device. Scam and browsing protection Device Protection scans content in real time to identify malware, spyware, ransomware, and other threats. Scam Protection addresses phishing attempts, fraudulent websites, and SMS-based scams. The feature monitors browsing activity and helps users avoid suspicious content. It can identify unsafe websites and online stores, block SMS scams, and use Scam Scanner to analyze screenshots of suspicious messages or websites. Browswing Protection blocks phishing websites, Banking Protection helps secure online banking sessions, and Shopping Protection identifies potentially fraudulent shopping sites. The Android app uses Accessibility Services permissions for Chrome Protection features. These permissions allow the app to access website addresses in Chrome and perform safety checks on visited pages. The permission is enabled during setup with user consent. The app adds safeguards for online banking and shopping by checking website safety during payment and banking sessions. These controls help users avoid phishing pages and fraudulent online stores that could expose credentials or financial information. VPN and privacy features The app includes VPN functionality with traffic management options. VPN Bypass allows users to select applications that connect directly to the internet without routing traffic through the VPN. A Killswitch feature blocks internet access if the VPN connection is interrupted. ID Monitoring tracks whether personal information appears in known data breaches and sends alerts when monitored information is exposed. Users can monitor email addresses and receive notifications if their information appears in leaked datasets. Conclusion F-Secure Internet Security’s setup process is straightforward, and its features continue running in the background after activation. Users looking for mobile protection against phishing attempts, SMS scams, and risks tied to everyday online activity will find a range of security tools in a single app.

Week in review: Cisco patches SD-WAN 0-day, unpatched Microsoft Exchange Server flaw exploited Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Review: Foundations of Cybersecurity, 2nd edition Jason Andress has refreshed his introductory security text for No Starch Press. He writes in the introduction that the term security now extends past data center servers to cloud resources, mobile devices, the Internet of Things, and AI. Foundations of Cybersecurity: A Straightforward Introduction book is aimed at newcomers to the field, network and system administrators, and managers who need a working grasp of security concepts. Rustinel: Open-source endpoint detection for Windows and Linux Open-source endpoint detection has long been split between Windows-focused tools built around Sysmon and Linux tools built around eBPF or auditd. Defenders running mixed environments have had to stitch together separate pipelines, separate rule sets, and separate maintenance burdens. Rustinel, a Rust-based endpoint agent, is an attempt to collapse that work into a single codebase. Google researchers uncover criminal zero-day exploit likely built with AI Google’s threat intelligence researchers have linked a zero-day exploit to AI-assisted development by a criminal group. The exploit targeted a popular open-source web-based system administration tool. It allowed attackers to bypass two-factor authentication once they had valid user credentials. The flaw stemmed from a semantic logic error, a case where a developer hardcoded a trust assumption that contradicted the application’s authentication enforcement. The hidden smart fridge risks that emerge years after purchase Household refrigerators are built to last more than a decade. The software, cloud services, and mobile apps that control them are not. A new analysis from Erik Buchmann at Leipzig University maps what happens when those two timelines collide, and the findings reach further than the kitchen. HEIDI: Free IDE security plugin for open-source vulnerability checks Open-source dependencies make up a large percentage of the code in production applications, and most vulnerability checks still run late in the pipeline, inside CI/CD systems or after a release ships. Meterian is moving those checks earlier with HEIDI, a free plugin for Visual Studio Code and JetBrains IDEs that flags vulnerable packages and offers one-click upgrades from inside the editor. Amazon Quick authorization bypass let users reach blocked AI chat agents Enterprises running Amazon Quick, the AWS business intelligence and agentic AI service, rely on a feature called custom permissions to restrict who inside an account can use AI chat agents. Fog Security founder Jason Kao discovered that those restrictions were enforced only in the user interface for a period earlier this year, and direct calls to the backend API returned successful chat responses from agents that administrators had explicitly disabled. Researchers open-source a Wi-Fi cyber range for security training Wireless security training programs lean heavily on generic network labs, with Wi-Fi appearing as a checkbox alongside Bluetooth, Zigbee, and cellular. Hands-on environments dedicated to IEEE 802.11 are uncommon, even as Wi-Fi remains the default on-ramp to corporate networks and a recurring entry point for attackers. A new paper from researchers at the Norwegian University of Science and Technology and the University of the Aegean takes aim at that gap with a cyber range built specifically for Wi-Fi. Sandyaa: Open-source autonomous security bug hunter Source code auditing has traditionally relied on static analyzers that flag long lists of potential issues, leaving engineers to sort bugs from noise. A new open-source project from offensive-security firm SecureLayer7 takes a different route, using LLMs to read a codebase, trace how data moves through it, and produce working exploit code for the vulnerabilities it confirms. Their open-source tool, called Sandyaa, was released under an MIT license. KDE gets over €1 million investment to strengthen security and core infrastructure European governments and public institutions have been shifting away from proprietary software for years, and the financial infrastructure supporting open-source alternatives is growing to match. Germany’s Sovereign Tech Fund announced today that it is investing more than €1 million in KDE, the open-source project behind the Plasma desktop environment and a broad range of Linux software. Vector embedding security gap exposes enterprise AI pipelines Enterprise adoption of retrieval-augmented generation has moved sensitive corporate content into a new storage format that existing security tools cannot inspect. Companies deploying internal AI assistants convert documents into high-dimensional numerical vectors and ship them to embedding services and vector databases over ordinary HTTPS connections. Data loss prevention products scan documents and network traffic, and they read none of it. A research framework called VectorSmuggle, released by Jascha Wanger of ThirdKey under the Apache 2.0 license, demonstrates what an attacker can do with that gap. Linux developers weigh emergency “killswitch” for vulnerable kernel functions Linux kernel developers are reviewing a proposal for an emergency risk mitigation mechanism (“Killswitch”) that would allow administrators to disable vulnerable kernel functions at runtime. The proposal, submitted by Linux kernel developer/maintainer Sasha Levin, arrives in the wake of the public disclosure of two privilege escalation vulnerabilities affecting the Linux kernel. JetBrains TeamCity vulnerability allows privilege escalation, API exposure (CVE-2026-44413) JetBrains has patched a high-severity vulnerability (CVE-2026-44413) in TeamCity, its popular continuous integration and continuous delivery platform, and is urging organizations with on-premises and self-managed deployments to upgrade to the fixed version or implement a security patch. Stealthy hackers exploit cPanel flaw in active backdoor campaign (CVE-2026-41940) Security researchers at XLab have outlined an active attack campaign targeting CVE-2026-41940, the recently disclosed vulnerability in cPanel & WHM, and have linked it to a stealthy hacking group that has been operating largely undetected for years. Microsoft May 2026 Patch Tuesday: Many fixes, but no zero-days Microsoft has marked May 2026 Patch Tuesday by releasing fixes for 120+ CVE-numbered vulnerabilities, none of which (for a change) are actively exploited or have been publicly disclosed. Still, some deserve more consideration and should be addressed sooner than others. Fragnesia: New Linux kernel LPE bug was spawned by Dirty Frag patch (CVE-2026-46300) Researchers have found and disclosed yet another local privilege escalation (LPE) vulnerability in the Linux kernel: CVE-2026-46300, aka “Fragnesia”. The flaw is in the same class of vulnerabilities as the recently disclosed Dirty Frag bug(s). Unpatched Microsoft Exchange Server vulnerability exploited (CVE-2026-42897) A critical cross-site scripting (XSS) vulnerability (CVE-2026-42897) in Microsoft Exchange Server is being exploited by attackers, Microsoft warned on Thursday. A permanent fix is still in the works. In the meantime, Microsoft provided temporary mitigations. Cisco patches another actively exploited SD-WAN zero-day (CVE-2026-20182) Cisco has patched yet another Catalyst SD-WAN Controller authentication bypass vulnerability (CVE-2026-20182) that has been exploited as a zero-day by “a highly sophisticated cyber threat actor”. Closing the AI governance gap in your enterprise In this Help Net Security video, Casey Bleeker, CEO at SurePath AI, talks about the AI governance gap that exists in almost every organization. Drawing from three years of conversations with IT, business, and security leaders, Casey explains why AI adoption is outpacing governance maturity by a wide margin, creating friction between security teams pushing for responsible use and business leaders worried about falling behind competitors. The hidden risk of non-human identities in AI adoption An employee with persistent, unsupervised admin access across critical systems, with no audit trail, no clear owner, and no regular access reviews, would raise immediate concern in most organizations. Yet non-human identities and AI agents are often granted that same kind of persistent, broadly privileged access. As AI adoption grows, that gap is becoming harder to ignore. Police take down relaunched criminal marketplace with 22,000 users, €3.6 million in revenue German authorities shut down a relaunched version of the criminal marketplace Crimenetwork and arrested its suspected operator. Authorities state the suspect allegedly created and operated a new technical infrastructure for Crimenetwork a few days after the previous version was shut down and its administrator was arrested in December 2024. Poor security left hackers inside water company network for nearly two years The UK’s data protection regulator, the Information Commissioner’s Office (ICO), fined South Staffordshire Water’s parent company £963,900 over security failures linked to a cyberattack that exposed the personal data of 633,887 people. iOS 26.5 is out, bringing encrypted RCS messaging to iPhone and Android users Apple is bringing long-awaited end-to-end encryption to Rich Communication Services (RCS) messaging between iPhone and Android users in iOS 26.5. The feature is launching in beta for iPhone users running iOS 26.5 on supported carriers and Android users using the latest version of Google Messages. Six new dnsmasq vulnerabilities open the door to DNS cache poisoning, local root Recent disclosures have revealed that open-source networking tool dnsmasq is grappling with a serious set of vulnerabilities. The problems span memory safety and input validation, with researchers identifying heap buffer overflows, heap corruption, and code execution bugs among the issues. Instructure took a risky approach to recover stolen Canvas data Instructure, the company behind the online learning platform Canvas, said it reached an agreement with the extortion group ShinyHunters to prevent data stolen in a recent breach from being leaked online. According to the company’s website, Canvas has more than 30 million active users worldwide and serves more than 8,000 institutions. Android pushes new scam, theft, and AI protections in 2026 update wave Phone scammers spoofing bank caller IDs have driven an estimated $980 million in annual losses worldwide, according to Europol. Android’s 2026 security roadmap takes direct aim at that pattern with a verified call system built in partnership with banks, alongside a wider set of protections covering app behavior, device theft, location data, and on-device AI processing. Microsoft’s agentic security system found four critical Windows RCE flaws Microsoft responded to growing competition in AI security by announcing that its new agentic security system helped researchers discover 16 new vulnerabilities in the Windows networking and authentication stack, including four critical remote code execution (RCE) vulnerabilities. Two of the four flaws — CVE-2026-40361 and CVE-2026-40364 — were deemed by Microsoft to be more likely to be exploited. Signal responds to phishing attacks with new in-app security warnings Signal is adding new protections for users following recent phishing and social engineering attacks.One of the new protections is an additional warning informing users that profile names on Signal are not verified and can be chosen freely by account holders, making impersonation attempts easier. WhatsApp adds Incognito Chat for private Meta AI conversations The company launched Incognito Chat with Meta AI, a feature that lets users hold AI conversations the platform itself cannot read. The rollout will reach WhatsApp and the standalone Meta AI app over the coming months. Incognito Chat runs on top of Meta’s Private Processing technology, the same infrastructure the company introduced earlier for AI tools in WhatsApp. CERN’s open source KiCad library gives the world 17,000 circuit board components CERN has released its complete KiCad component library under an open source license, making it available to hardware designers anywhere in the world. The library, maintained by CERN’s Design Office, contains more than 17,000 electronic components in the form of schematic symbols and printed circuit board footprints. AI cyber capability is speeding past earlier projections AI cyber capability is improving faster than expected, with newer models surpassing earlier projections, according to the UK government’s AI Security Institute (AISI). AISI measures AI cyber capability using “time horizon benchmarks”, which estimate how long AI systems can complete cybersecurity tasks autonomously compared to human experts. Microsoft’s WinUI agent plugin trims token use by over 70% during development Microsoft published a plugin on May 13 that lets GitHub Copilot CLI and Claude Code drive the full WinUI 3 development cycle, from project scaffolding through signed MSIX packaging. The WinUI agent plugin ships one agent, eight skills, and several supporting tools targeting the loop developers run dozens of times a day: scaffold, build, run, test, iterate. Zombie linkages are keeping expired domains trusted for years Domains expire, get transferred, and return to the market every day. The systems connected to those domains can continue trusting the original owner long after control has changed. Researchers at USC and the University of Twente examined this problem in three widely used systems: Web PKI, Maven Central, and Ethereum Name Service. They use the term “zombie linkages” to describe lingering trust records that remain active after the original domain owner no longer controls the domain. Deepfake detection is losing ground to generative models Deepfake detection has been built around a single question for close to a decade. Given a video or audio clip, is it real or synthetic? Commercial detectors analyze pixels, frequencies, and biometric signals to answer that question, and the best of them post strong accuracy numbers on standard benchmarks. In deployment, performance drops sharply on content from newer generators. Researchers at the Vector Institute think this gap is structural, and closing it means rethinking what the field is trying to detect in the first place. Rocky Linux launches opt-in security repository for urgent fixes Rocky Linux has introduced a Security Repository that allows the distribution to ship urgent security fixes ahead of upstream Enterprise Linux when public exploit code exists and upstream patches are unavailable. Thieves unlock stolen iPhones using cheap tools sold on Telegram Helping a friend recover a stolen phone, Infoblox researchers uncovered a thriving Telegram-based underground marketplace selling unlocking tools and phishing infrastructure used to monetize stolen iPhones. Activation Lock can remotely disable a stolen iPhone and prevent normal resale, with owners also able to lock individual components. Google lets Workspace admins apply one policy across all SAML apps Google has updated Context-Aware Access (CAA) in Google Workspace to introduce a default policy assignment for SAML applications. SAML applications are third-party or internal applications that use the Security Assertion Markup Language (SAML) protocol to enable single sign-on (SSO) with Google Workspace credentials. Security teams are turning to AI to survive alert overload The World Economic Forum white paper “Empowering Defenders: AI for Cybersecurity” identified AI as the biggest driver of change in cybersecurity for 94% of survey respondents. The paper found that 77% of organizations already use AI in cybersecurity, with much of the activity focused on phishing detection, anomaly monitoring, vulnerability management and incident response. The scam economy has found its AI upgrade Scam attempts continue to reach consumers via email, text messages, social media, online advertising, and phone calls. The volume of exposure has remained stable over the past year, with more than half of consumers encountering scam attempts at least monthly, according to the F-Secure Scam Intelligence & Impacts Report 2026. Instagram messaging encryption removed, and privacy advocates are pushing back After introducing optional end-to-end encrypted messaging in 2023, Instagram announced in March 2026 that encryption for direct messages would be discontinued, and the feature was removed on May 8. The change allows Instagram to access direct message content, including images, videos, and voice notes. OpenAI’s Daybreak uses Codex Security to identify risky attack paths OpenAI Daybreak is the company’s cybersecurity initiative focused on building AI-assisted software defense into the development process from the start. It combines OpenAI models, Codex Security, and cyber-focused GPT-5.5 variants to help organizations identify, validate, and prioritize software vulnerabilities. Škoda confirms unauthorized access to its online shop Car manufacturer Škoda discovered that attackers had exploited a vulnerability in its online shop software and gained temporary unauthorized access to the system. After discovering the incident, the company took the shop offline as a precautionary measure, fixed the vulnerability, referred the incident to a specialized IT forensics team for technical analysis, and reported it to the data protection supervisory authority. General Motors to pay $12.75 million over driver data sales General Motors has agreed to a $12.75 million settlement with California over allegations that it unlawfully sold drivers’ location and behavioral data to brokers, marking the largest penalty in the history of the state’s Consumer Privacy Act. Prosecutors say GM made approximately $20 million nationwide from the sales. Fedora Hummingbird brings the container security model to a Linux host OS Container image security pipelines have spent the past several years pushing toward minimal footprints, hermetic builds, and continuous CVE remediation. The Fedora Project is now applying that same approach to the host operating system. At Red Hat Summit 2026, Fedora announced Fedora Hummingbird, a container-based rolling Linux distribution delivered as an OCI image. Machine identities outnumber humans 109 to 1 Organizations manage an average of 109 machine identities for every human identity. AI agents account for a growing share of those identities, with companies expecting AI agent growth of 85% over the next 12 months. Machine identities are projected to increase by 77%, and human identities by 56%, based on data from Palo Alto Networks’ 2026 Identity Security Landscape report. Microsoft turns Copilot Studio into an AI agent control center The Microsoft Copilot Studio April 2026 updates improve visibility and governance for admins and expand workflow capabilities for managing agents. Copilot surfaces agent status in the authoring experience, giving admins insight into each agent’s security and protection posture. Customers can identify issues such as authentication gaps or policy impacts and investigate them at the source. The AI oversight paradox: Is the investment worth the cost of watching it? Unlike in 2025, when AI adoption and testing drove business strategies, organizations in 2026 want proven ROI before committing budgets, according to a report by Globalization Partners. Download: The IT and security field guide to AI adoption Security and IT teams are under pressure to adopt AI, but many are seeing the opposite of what was promised. Tools that demo well don’t hold up in real workflows. Complexity increases. Trust breaks down. And instead of reducing workload, AI can introduce new risks and oversight burdens. Cybersecurity jobs available right now: May 12, 2026 We’ve scoured the market to bring you a selection of roles that span various skill levels within the cybersecurity field. Check out this weekly selection of cybersecurity jobs available right now. New infosec products of the week: May 15, 2026 Here’s a look at the most interesting products from the past week Alation, Apricorn, Versa Networks, and TrustCloud.

The scam economy has found its AI upgrade Scam attempts continue to reach consumers via email, text messages, social media, online advertising, and phone calls. The volume of exposure has remained stable over the past year, with more than half of consumers encountering scam attempts at least monthly, according to the F-Secure Scam Intelligence & Impacts Report 2026. Most common channels for scam attempts (Source: F-Secure) The United States recorded the highest exposure levels among surveyed markets. Younger consumers reported higher scam activity than older age groups, linked to heavier digital activity through multiple platforms. Email remained the most common scam channel globally. Younger consumers encountered scam attempts across a wider mix of SMS, online advertising, and social media. Older consumers experienced a narrower threat environment, with phone calls remaining one of the leading channels after email. “Scams are getting so much more efficient. When you look at this data, it’s important to remember that each statistic is a real person who has lost money, confidence, or peace of mind,” said Dr. Megan Squire, Threat Intelligence Researcher at F-Secure. Scams aimed at direct payments dominate Fraud tied directly to financial transfer accounted for a large share of reported activity in 2026. Fake invoice and debt schemes, investment fraud, and banking or payment scams represented half of reported attempts. Fake invoice scams showed the largest year-over-year increase. Differences in digital environments affect victimization rates. Age is another factor, since younger generations reported higher victimization rates. More than half of victims reported losing money in 2026, more than double the level reported in 2025. Lost time, stress, data loss, and reputational damage were reported less frequently. Older victims were more likely to lose money once targeted. Consumers aged 65 to 74 recorded the highest rate of monetary loss among victims. Willingness to pay for scam protection may be influenced by cultural factors. The research shows that individual security behavior is influenced by digital maturity, institutional trust, and cybersecurity culture. Users consider cybersecurity an important part of service offerings and say they would switch providers based on security features. AI tools create new scam opportunities Fraudsters are experimenting with poisoning the data AI systems rely on and influencing responses from LLMs. User behavior has moved toward using AI assistants as search tools, opening new opportunities for manipulation. Internal testing found that ChatGPT returned fraudulent airline customer service numbers during a major winter storm in the United States that caused over 5,000 flight cancellations. Researchers said the same manipulation methods could be applied to any search for customer support or technical assistance. AI-powered shopping tools create another risk point. Recommendations from AI assistants can make fraudulent merchants appear trustworthy at the moment clients are ready to buy products online. In one test, ChatGPT repeated a fake store’s claim that it was “going out of business,” repeating the urgency messaging used on the merchant website. Generated content is changing the quality of online fraud. Fraudsters are using automated tools to produce polished messages, convincing visuals, and synthetic voices. Internal threat research found that 89% of scammers’ AI use focused on improving scam bait and making scams harder to identify. Public concern around AI-generated deception is growing. 84% of respondents said they worry AI will make it impossible to tell what is genuine online.

Cybersecurity researchers have discovered a new Lua-based malware created years before the notorious Stuxnet worm that aimed to sabotage Iran's nuclear program by destroying uranium enrichment centrifuges. According to a new report published by SentinelOne, the previously undocumented cyber sabotage framework dates back to 2005, primarily targeting high-precision calculation software to tamper with results. It has been codenamed fast16. "By combining this payload with self-propagation mechanisms, the attackers aim to produce equivalent inaccurate calculations across an entire facility," researchers Vitaly Kamluk and Juan Andrés Guerrero-Saade said in an exhaustive report published this week. Fast16 is estimated to predate Stuxnet – the world's first known digital weapon designed for disruptive actions – by at least five years. While Stuxnet is widely attributed to the U.S. and Israel and later served as the architectural foundation for the Duqu information-stealing rootkit, fast16 appears to have emerged much earlier. It also precedes the earliest known samples of Flame (aka Flamer and Skywiper), another sophisticated malware that was discovered in May 2012 incorporating a Lua virtual machine to realize its goals. The discovery makes fast16 the first strain of Windows malware to embed a Lua engine. SentinelOne said it made the discovery after it identified an artifact named "svcmgmt.exe" that, at first blush, appeared to be a generic console‑mode service wrapper. The sample has a file creation timestamp of August 30, 2005, per VirusTotal, to which it was uploaded more than a decade later on October 8, 2016. However, a deeper investigation has revealed an embedded Lua 5.0 virtual machine and an encrypted bytecode container, along with various other modules that bind directly into Windows NT file system, registry, service control, and network APIs. The implant's core logic resides in the Lua bytecode, with the binary also referencing a kernel driver ("fast16.sys") via a PDB path – a file with a creation date of July 19, 2005 – that's responsible for intercepting and modifying executable code as it's read from disk. That said, it's worth noting that the driver will not run on systems with Windows 7 or later. In what's a finding that could give an indication of the tool's origins, SentinelOne said it uncovered a reference to the string "fast16" in a text file called "drv_list.txt" that included a list of drivers designed for use in advanced persistent threat (APT) attacks. The nearly 250KB file was leaked by a mysterious hacking group nine years ago. In 2016 and 2017, the collective – calling itself The Shadow Brokers – published vast troves of data allegedly stolen from the Equation Group, an advanced persistent threat group with suspected ties to the U.S. National Security Agency (NSA). This included a bevy of hacking tools and exploits under the nickname "Lost in Translation." The text file was one of them. "The string inside svcmgmt.exe provided the key forensic link in this investigation," SentinelOne said. "The PDB path connects the 2017 leak of deconfliction signatures used by NSA operators with a multi-modal Lua‑powered 'carrier' module compiled in 2005, and ultimately its stealthy payload: a kernel driver designed for precision sabotage." "Svcmgmt.exe" has been described as a "highly adaptable carrier module" that can alter its behavior based on the command-line arguments passed to it, enabling it to run as a Windows service or execute Lua code. It comes with three distinct payloads: Lua bytecode to handle configuration and propagation and coordination logic, an auxiliary ConnotifyDLL ("svcmgmt.dll"), and the "fast16.sys" kernel driver. Specifically, it's designed to parse the configuration, escalate itself as a service, optionally deploy the kernel implant, and launch a Service Control Manager (SCM) wormlet that scans for network servers and propagates the malware to other Windows 2000/XP environments with weak or default credentials. An important aspect worth mentioning here is that the propagation only occurs when it's manually forced, or common security products aren't found on the system by scanning the Windows Registry database for associated registry keys. Some of the security tools it explicitly checks belong to Agnitum, F-Secure, Kaspersky, McAfee, Microsoft, Symantec, Sygate Technologies, and Trend Micro. The presence of Sygate Technologies is another indicator that the sample was developed in the mid-2000s, as the company was acquired by Symantec (now part of Broadcom) in August 2005, and sales and support for its products were formally discontinued by November. "For tooling of this age, that level of environmental awareness is notable," SentinelOne said. "While the list of products may not seem comprehensive, it likely reflects the products the operators expected to be present in their target networks whose detection technology would threaten the stealthiness of a covert operation." The ConnotifyDLL, on the other hand, is invoked each time the system establishes a new network connection using the Remote Access Service (RAS), and writes the remote and local connection names to a named pipe ("\\.\pipe\p577"). However, it's the driver that's responsible for the precision sabotage, targeting executables compiled with the Intel C/C++ compiler to perform rule-based patching and hijack execution flow through malicious code injections. One such block is capable of corrupting mathematical calculations, specifically going after tools used in civil engineering, physics, and physical process simulations. "By introducing small but systematic errors into physical‑world calculations, the framework could undermine or slow scientific research programs, degrade engineered systems over time, or even contribute to catastrophic damage," SentinelOne explained. "By separating a relatively stable execution wrapper from encrypted, task-specific payloads, the developers created a reusable, compartmentalized framework that they could adapt to different target environments and operational objectives while leaving the outer carrier binary largely unchanged across campaigns." Based on an analysis of the 101 rules defined in the patching engine and matching them against software used in the mid-2000s, it's assessed that three high-precision engineering and simulation suites may have been the targets: LS-DYNA 970, PKPM, and the MOHID hydrodynamic modeling platform. LS-DYNA, now part of the Ansys Suite, is a general-purpose multi physics simulation software package that's used for simulating crashes, impacts, and explosions. In September 2024, the Institute for Science and International Security (ISIS) released a report detailing Iran's possible use of computer modeling software like LS-DYNA for nuclear weapons development based on an examination of 157 academic publications found in open-source scientific and engineering literature. This chain of evidence assumes significance considering Iran's nuclear program is said to have suffered substantial damage after its uranium enrichment facility in Natanz was targeted by the Stuxnet worm in June 2010. What's more, Symantec revealed in February 2013 an earlier version of Stuxnet that was used to attack Iran's nuclear program in November 2007, with evidence indicating it was under development as early as November 2005. "Stuxnet 0.5 is the oldest known Stuxnet version to be analyzed," Symantec noted at the time. "Stuxnet 0.5 contains an alternative attack strategy, closing valves within the uranium enrichment facility at Natanz, Iran, which would have caused serious damage to the centrifuges and uranium enrichment system as a whole." Taken together, the latest finding "forces a re‑evaluation" of the historical timeline of development for clandestine cyber sabotage operations, SentinelOne said, adding it shows state-backed cyber sabotage tooling against physical targets had been fully developed and deployed by the mid‑2000s. "In the broader picture of APT evolution, fast16 bridges the gap between early, largely invisible development programs and later, more widely documented Lua‑ and LuaJIT‑based toolkits," the researchers concluded. "It is a reference point for understanding how advanced actors think about long‑term implants, sabotage, and a state’s ability to reshape the physical world through software. fast16 was the silent harbinger of a new form of statecraft, successful in its covertness until today."

The very British history of Ben Harris is a mischievous youngster who tinkered with school networks, evolved through legitimate pentesting and became the founder and CEO of WatchTowr. The WatchTowr platform builds a real-time attack view of its customers’ environments and continuously identifies and validates exploitable vulnerabilities before they can be leveraged. It wasn’t what his parents wanted – they wanted him to be a musician. School career “When I was very young, I was packed off to boarding school. It’s a British thing. If you’re old enough to think for yourself, it’s time for boarding school. I was seven.” The hope was that he would become a professional musician, so his school career revolved around music schools. His own interests, however, hit a diversion at that first boarding school. “I found a book in the library about these guys in the UK that had their house doors kicked in by the police for breaking into American military computers from their bedrooms. And it was just absolutely fascinating.” It wasn’t the idea of hacking, or breaking the law, or finding out what data is in American military computers that fascinated him, it was the simple concept of one computer being able to access a different computer, and he wanted to know more about all computers. It became a need – not so much to do it in anger, but simply to understand how it could be done. “That’s when my life kind of just took a divergence, and I became increasingly obsessed with the idea that you could use a computer to break into other computers and get access to things that you shouldn’t have access to,” he explains. He wasn’t entirely ignorant of computers. He was still a youngster playing computer games on an internet he couldn’t afford. That’s a common entrée into hacking, but he postdates the heyday of phreaking and blue boxes and fell straight into the IRC world. “I always say I was lucky the police didn’t kick in my doors when I was a kid,” more in jest than seriousness – not because they shouldn’t, but more because they wouldn’t. But all this time he was learning more about computers. And learning more about – and from – school networks. He attended various schools, and while he gives few details, he does comment, “I went to a few different schools because, well, who would keep me? Each time I moved, my old school would warn the new one: ‘This guy might touch things, blah, blah, blah.’ But none of them really knew what was going on. Like worrying about Father Christmas, it was just some mythical thing that people talked about, but nobody really understood.” His last school was an Upper Sixth College – the British equivalent to 11th and 12th Grades in US High Schools. “They let me join but made me sign a document. It basically said, ‘If you break our acceptable use policy, we can kick you out’.” Like that was going to work! It was just another rule when Harris had just one rule to rule all others – so long as he didn’t cause damage or harm, other rules weren’t that important. They were just unactionable threats. But he tried to behave himself. His exploratory and computer-educational activities were initially kept out of school, and he managed to stay at the school for three-quarters of the allotted span. “Towards the end of my first year, I just got relentlessly bored. I never enjoyed education; I’m not the studious type. So, when things become very tempting and look very interesting, it’s hard to resist just finding out. What would happen if I did this; how far could I get doing that; is there something new here?” Eventually, his activity was noticed, and he was called in to see the Headmistress, who claimed the school had ‘evidence’. “With the IT Admin sitting next to her looking very smug with his ridiculous face, she said, ‘We have evidence. You have a choice: either we suspend you and you leave, or we call the police’.” Red rag and bull? He replied, “You have nothing, nothing that will stand up in court, so call the effing police!” Luckily, or unluckily, his father had been summoned to the same meeting; and his father certainly didn’t like the idea of involving the police. “Benjamin, we’re leaving.” Strange how it only seems to be angry parents that call you by your full name. “So, my educational career came to an end. I didn’t have any choice.” There is no doubt he had been a rebellious troublemaker during his educational career. But he never caused any harm or damage, and had an apparently flippant attitude toward authorities and the law. This latter is worth exploring, since the UK’s Computer Misuse Act (CMA) had become law in 1990. It was enacted to fill a legal loophole exposed by two early British hackers, Robert Schifreen (aka hex) and Steve Gold. Neither could be described as black hat. Schifreen and Gold broke into BT’s Prestel viewdata service and accessed private mailboxes (including one belonging to Prince Philip) in the mid-1980s. They were caught. Since there was no specific law against their actions, they were prosecuted under the Forgery and Counterfeiting Act 1981. They were found guilty, but the conviction was overturned on appeal – the law simply didn’t work with breaking into computers, and using misappropriated passwords can hardly be classified as forgery. By 1990, parliament had filled the gap with the Computer Misuse Act – but in Harris’ own words, it was still like Father Christmas that no-one understood. “I always felt, even into the early 2000s,” when he started his network tinkering, “the authorities had a hard time working out where they should be focusing their efforts. In the late ’90s and early 2000s their focus was really on financial crime rather than the online equivalent of graffiti or anti-social behavior. If what you did wasn’t high profile, and if you didn’t stick your neck out too far, I believed law enforcement already had their hands full with real criminals.” He draws a distinction between technically breaking the law with no intent to cause harm, and committing a crime to steal money or to cause damage. “So, for me, it wasn’t fear of the law that guided my actions, it was simply my passion to learn more about computers. Lawyers would disagree with my distinction – and they’d be correct – but that was the distinction in my head.” Back to his last day of education when his father took him out of school. It wasn’t a choice, there was no other option. Within thirty minutes of getting home, he was back on his computer in the IRC channels. But a little later, his father took him aside and said, “I don’t care what you do. I’m not really interested. But within seven days, you must have a job.” Professional career Harris doesn’t dwell on the gravity of situations – he just gets on with things. He immediately applied for two pentesting positions and was offered a job three days after his first interview. He turned it down. “It was a terrible salary. It was exploitative. They probably felt, here’s this kid who knows a bit about computers but has no school qualifications whatsoever. We can screw him. Offer the minimum possible and he’ll accept it just to get into the industry.” The UK is well-known for offering pitiful entry-level salaries. The second interview was different. It was with a better known consultancy within London. “A couple of days later I was offered a position that I could start within 24 hours. So, I was able to say to my dad, ‘Okay, I’ve got a job’. He was a bit shocked. In his own words he wasn’t expecting it to happen so fast. But I didn’t really think about it myself – I needed a job and got one. It wasn’t until years later that I thought, ‘That could have gone terribly wrong. I could have ended up stacking shelves in a supermarket’.” He spent a couple of years at Portcullis as a security consultant before moving to MWR Infosecurity, starting as senior security consultant and working up to Technical Director. From there he moved to F-Secure as Technical Director – and then, in August 2021, he founded and became CEO of WatchTowr. The difference between his school and academic careers is striking. The education system failed him, probably because it and his parents wanted him to be something he wasn’t – either a musician or an economist or similar. All he was interested in was computers, but with no training he had to find his own way. This meant using what was available and that was usually the school network. He tinkered with it (or them, because he kept having to move to a new school). What he did was almost certainly illegal, but he did it for no other reason than to learn about computers, and he was never prosecuted. He was most certainly a hacker, although he hesitates over this title because he was never the archetypal hooded hacker breaking into computers to steal money or wreak havoc. He just wanted to know how things worked. And that understanding paved the way for a successful career in pentesting and consultancy. Harris the hacker Asked if he has ever been tempted to sell discovered weaknesses on the dark web, Harris says, “No. There were times when I was young that I didn’t always report things I found, I had issues – I still do – with the whole responsible disclosure process. I don’t think ‘responsible’ is the right word. But selling is a very different ball game. Does it end up with criminals? With foreign governments? That’s a very different place to be. So, no, never. I’ve never considered selling.” This is a complex character. As a child and youth, he had no qualms breaking society’s rules and even laws – what he has likened to online anti-social behavior – and had no fear of the law (CMA) as it then stood. But he is rigid with his own moral standards. He has a moral compass. Most young hackers did more harm than Harris ever did, before shunning the dark side. When asked why they didn’t become black hats, a common response is ‘good parental upbringing instills knowledge of the difference between right and wrong’. Harris says nothing like this. Many young hackers have manipulated school networks, but often with a purpose: to find exam questions before the exam, or to edit and improve their end of term grades. Harris did none of this while poking around the school networks. Many young hackers are motivated by a drive to disassemble systems and reassemble them into something improved, or at least different. This was not his motivation. What is left is a hacker with a rebellious spirit and a willingness to break rules in the pursuit of his purpose – but without causing harm or damage. The purpose was purely to understand how computers work and communicate. He describes himself as, “A person with a rather fierce obsession with understanding how computers work, combined with perhaps a relatively tame mischievous streak.” Related: Hacker Conversations: Rachel Tobac and the Art of Social Engineering Related: Hacker Conversations: Frank Trezza – From Phreaker to Pentester Related: Hacker Conversations: Joe Grand – Mischiefmaker, Troublemaker, Teacher Related: Hacker Conversations: HD Moore and the Line Between Black and White

The AV-Comparatives Stalkerware Test 2025 delivers a sobering look at the evolving threat posed by stalkerware on mobile devices. Despite measures from both the tech industry and platform providers, stalkerware-type apps, which are apps that can be installed covertly to spy on a victim’s private life, remain a critical concern. This comprehensive assessment, developed in collaboration with Electronic Frontier Foundation (EFF), evaluated 13 leading Android security solutions against 17 diverse stalkerware-type apps. Key findings show that stalkerware persists even as providers and coalitions crack down: it’s sideloaded from developer websites, designed to evade detection, and frequently stores sensitive victim data on insecure servers, often exposing it to wider risks like public data leaks. For this test, each security app was assessed for its ability to clearly detect and report stalkerware, not just using generic labels, but with explicit warnings tailored to support possible victims. AV-Comparatives is an independent organization offering systematic testing that checks whether security software, such as PC/Mac-based antivirus products and mobile security solutions, lives up to its promises. Of the 13 security products tested in September 2025, only a few stood out for detection accuracy, clarity, and responsible alerting, with Malwarebytes the only one to score a 100% detection rate. From the report: The results show clear differences in performance between mobile security products. Malwarebytes stood out by detecting all stalkerware testcases, achieving a 100% detection rate. It went on to say: Bitdefender, ESET, Kaspersky, and McAfee followed closely with 94% each, showing consistently high effectiveness. Avast, Avira, and F-Secure also performed well, identifying 88% of the test set, while Norton and Sophos achieved moderate coverage, detecting around 82%. At the lower end, G Data (65%), Google (53%), and Trend Micro (59%) missed a substantial portion of the stalkerware. Why it matters to Malwarebytes As one of the founding members of the Coalition Against Stalkerware, Malwarebytes sees this result as much more than a technical win. For us, the mission goes beyond simply blocking malicious software. Stalkerware-type apps are often used by abusers to systematically invade privacy and exert control. Their impact is highly personal, making reliable detection and safe reporting imperative. Our participation in the coalition reflects a commitment to industry best practices: preventing stalkerware-type apps from being quietly installed, giving users detailed and honest threat information, and ensuring that every detection alert is crafted with survivor safety in mind. Scoring 100% in this test validates years of advocacy and development focused on the real-world needs of victims and their supporters, which goes beyond focusing on theoretical malware samples. Ultimately, consistent leadership in stalkerware detection means standing alongside partners and survivor organizations to raise public awareness, drive safer technology, and provide every user with a clear path to reclaim their privacy. For Malwarebytes, achieving a perfect score isn’t just a mark of product quality; it’s proof of our commitment to your privacy and security. Scammers know more about you than you think. Malwarebytes Mobile Security protects you from phishing, scam texts, malicious sites, and more. With real-time AI-powered Scam Guard built right in.

A new Endpoint Detection and Response (EDR) killer that is considered to be the evolution of 'EDRKillShifter,' developed by RansomHub, has been observed in attacks by eight different ransomware gangs. Such tools help ransomware operators turn off security products on breached systems so they can deploy payloads, escalate privileges, attempt lateral movement, and ultimately encrypt devices on the network without being detected. According to Sophos security researchers, the new tool, which wasn't given a specific name, is used by RansomHub, Blacksuit, Medusa, Qilin, Dragonforce, Crytox, Lynx, and INC. The new EDR killer tool uses a heavily obfuscated binary that is self-decoded at runtime and injected into legitimate applications. The tool searches for a digitally signed (stolen or expired certificate) driver with a random five-character name, which is hardcoded into the executable. If found, the malicious driver is loaded into the kernel, as required to perform a 'bring your own vulnerable driver' (BYOVD) attack and achieve kernel privileges required to turn off security products. The driver masquerades as a legitimate file such as the CrowdStrike Falcon Sensor Driver, but once active, it kills AV/EDR-related processes and stops services associated with security tools. The targeted vendors include Sophos, Microsoft Defender, Kaspersky, Symantec, Trend Micro, SentinelOne, Cylance, McAfee, F-Secure, HitmanPro, and Webroot. Although variants of the new EDR killer tool differ in driver names, targeted AVs, and build characteristics, they all use HeartCrypt for packing, and evidence suggests knowledge and tool sharing among even competing threat groups. Sophos specifically notes that it's unlikely the tool was leaked and then reused by other threat actors, but is rather developed via a shared and collaborative framework. "To be clear, it's not that a single binary of the EDR killer leaked out and was shared between threat actors. Instead, each attack used a different build of the proprietary tool," explained Sophos. This tactic of tool sharing, especially in what concerns EDR killers, is common in the ransomware space. Apart from EDRKillShifter, Sophos also discovered another tool called AuKill, which Medusa Locker and LockBit used in attacks. SentinelOne also reported last year about FIN7 hackers selling their custom "AvNeutralizer" tool to multiple ransomware gangs, including BlackBasta, AvosLocker, MedusaLocker, BlackCat, Trigona, and LockBit. The complete indicators of compromise associated with this new EDR killer tool are available on this GitHub repository. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

The security industry is hitting Vegas hard this week with three conferences in Sin City that bring the world's largest collection of security pros together for the annual summer camp. The week kicks off with BSides Las Vegas, which runs from Monday to Wednesday. Of the over 200 BSides security conventions held around the world every year, this one is the biggest and is being held at the Tuscany Hotel, although tickets are sold out. BSides started as a conference for rejected Black Hat speakers, but those days are long gone. Now it has a range of talk tracks showcasing new research, and this year, passwords are a key theme, with a specific three-day schedule devoted to finding solutions to one of computing's oldest security challenges. There is a series of live feeds on the conference's YouTube channel and, if you miss seeing the talks in real time, the videos should remain archived. At the password track on Monday at 1700 PT, there's a disturbing-sounding presentation on a custom rig used to crack 936 million passwords with 92 percent accuracy that should be worth tuning into. Also on Tuesday at 1130 PT, there's an informative talk by Stacey Schreft, the former deputy director for research and analysis at the US Treasury Department's Office of Financial Research, about the possibilities of security problems triggering the next big financial crisis. She warns that a major outage could cause massive damage to the increasingly digitized financial system. With the collapse in security hiring, particularly for entry-level positions, BSides has a jobs track as well. For those seeking advice about getting started in the industry, or advancing further, four security execs will be giving advice on how to get into the recruitment cycle on Tuesday at 1600 PT. For anyone considering adding BSides to their schedule, it's worth a visit. While the smallest of the conventions, it's also one of the most offbeat and there are presentations on everything from building hacking hardware to commercial licensing problems in the industry. And, as is traditional, there's a Capture the Flag competition running and festivities in the evening. Black Hat – the biggie Located in Mandalay Bay, Black Hat's main conference days are August 6 and 7. There are also training sessions in IT skills that start on August 2, and the talks begin on Wednesday. You'll need to pay and register to see them, but we'll be onsite bringing in regular reports. The opening keynote will be a farewell (sort of) address from Mikko Hyppönen, who, after a 34-year tenure at F-Secure hunting malware, is quitting the industry to work on drones. As he told The Register in June, the Ukraine war has spurred him into working on the technology, particularly since his home country, newly minted NATO member Finland, has a massive border with Russia. The core of the talks is about unpleasant new hacks and vulnerabilities in hardware and software. It was at Black Hat in 2008 that the late Dan Kaminsky revealed a fundamental flaw in DNS that could have run riot through the internet's backbone. While there's nothing on that scale this year, there are sessions scheduled on an Apple zero-day, ways to bypass Windows Hello's authentication systems, and even a talk on satellite vulnerabilities and how to exploit them. Elsewhere in the talk tracks, there is a key focus on AI, as with everything in the security business these days, but this isn't a cheerleading event and there are some skeptical sessions planned, as well as deep dives into flaws. Several speakers are giving talks on how to fool AIs into breaking safety guardrails or leak information and bots – their use and misuse – are a particular focus. Given Black Hat's status, senior government officials, past and present, are giving multiple talks on policy and practice in the field. Bailey Bickley, the NSA's head of Defense Industrial Base protection, will be sharing lessons learned in staving off large-scale system attacks. The acting director of CISA, Madhu Gottumukkala, was due to be on stage introducing himself after two months on the job and laying out his priorities, but has pulled out for a personal matter, so executive assistant director for cybersecurity Chris Butera and CIO Bob Costello will replace him. Former National Cyber Director Chris Inglis will also share his experiences in government. Elsewhere, the Expo Business Hall is a good place to network and meet people, and the FBI, NSA, and other government agencies have recruiting booths on site. However, if you're there, avoid it on Wednesday between 1600 and 1700 PT as it's the so-called Booth Crawl, where the show has free food and drink and turns into a morass of attendees swarming booths picking up free squeezy balls, T-shirts, and other paraphernalia. Attendees also get a hidden bonus – their security is being remotely checked by the conference's network operations center (NOC), which is staffed by volunteers scanning the networks for suspicious activity using state-of-the-art hardware, and The Register will report from inside the NOC. As the operators explained, if someone's egregiously slack on security or has malware on their system already, they'll have a private word about fixing the problem. The original – DEF CON Located at the Las Vegas Convention Center, DEF CON has its own NOC folks, but they don't take the discreet approach; instead, broadcasting, safely, the details of people who are showing poor security practices on the infamous Wall of Sheep, displayed to all attendees. DEF CON is the original hacker summer camp, started in 1993 in a few hotel rooms by an 18-year-old Jeff Moss with around 100 people. It now hosts tens of thousands of visitors paying more than $500 a head to listen to talks, take part in hacking and gaming competitions, and visit over 30 "villages" dedicated to everything from ham radio to military hacking demonstrations. Its talks are not live-streamed, but most get posted to YouTube eventually. Once again, AI will feature heavily and the convention is host to the annual AI Cyber Challenge run by DARPA, a competition using the latest LLM models to find vulnerabilities, install fixes that don't break the system, and generate reports while under time pressure. Teams have been competing for months and the final event will see a winner, who will presumably be barraged with lucrative job offers. DEF CON used to be renowned for its Spot the Fed competition, trying to find government infiltrators (and the occasional undercover journalist) who had come in on the quiet. But it's a lot more Fed-friendly these days, and Moss will be on stage with former NSA boss Paul Nakasone for a fireside chat. The bulk of the talks are pure hacking – vulnerabilities, interesting ways to crack systems, and war stories that advise on what not to do. With the exception of DARPA's competition, this is possibly the least AI-focused conference of the three and is much more about hacking existing systems with current technology. Most of the villages have their own talks scheduled on everything from policy to privacy and industry-specific topics. There's a car hacking center that Tesla is fond of, the social engineering village is fascinating but also terrifying in showing how easy it is to play people, and the lock picking village is well worth a visit to meet some of the best in the business and get a tutorial. DEF CON is a lot less buttoned-down than Black Hat and you don't see a lot of people wearing suits. Instead, it's a chance for security folks and those interested to let their hair down and mingle with people they usually only see online. While it's very useful for networking and learning new techniques, there's also a substantial party scene. Red-clad "goons," volunteers who help people find their way around the show, will not hesitate to stop any bad behavior. DEF CON is one of the most inclusive conferences out there, with a strict code of conduct, and is a very safe environment, and even has kids-only sections for fledgling hackers. DEF CON is the fun convention for hackers, while Black Hat is becoming more of a sales and networking-led event, but still has very high-quality security talks and training, and BSides is useful to see what's up and coming in the security industry. The Reg will report on news as it happens, but if you've got any recommendations, feel free to add them to the comments section. ®