imperva

Security firms ThreatBook and Imperva say attackers are targeting a critical flaw in Fastjson, Alibaba's JSON library for Java. In affected Spring Boot applications, a malicious JSON request can execute code without authentication, with the privileges of the Java process. Tracked as CVE-2026-16723, the vulnerability carries an Alibaba-assigned CVSS score of 9.0. The confirmed chain requires Fastjson 1.2.68 through 1.2.83, a Spring Boot executable fat-JAR, a network-reachable path that sends attacker-controlled JSON to an affected parser, and SafeMode left at its disabled default. AutoType can remain disabled, and no classpath gadget is required. As of July 25, Alibaba had not released a fixed Fastjson 1.x version. Organizations that cannot migrate immediately should enable SafeMode with -Dfastjson.parser.safeMode=true or use com.alibaba:fastjson:1.2.83_noneautotype. Alibaba lists migration to Fastjson2 as the long-term fix. Alibaba published its advisory on July 21 following responsible disclosure by Kirill Firsov of FearsOff Cybersecurity. The maintainers described the vulnerability as requiring "no AutoType enablement" and "no classpath gadget." They verified the chain on Spring Boot 2.x, 3.x, and 4.x with JDK 8, 11, 17, and 21. Firsov traced the issue to Fastjson's type-resolution path. An attacker-controlled @type value can be turned into a class-resource lookup. In a compatible Spring Boot fat-JAR, a crafted nested JAR path can fetch attacker-controlled bytecode. An @JSONType annotation in that resource can then be treated as a trust signal, allowing the class to pass Fastjson's type checks and load. His technical analysis also describes a newer-JDK path that downloads a remote JAR and references it through /proc/self/fd. The exploit depends on the Spring Boot executable fat-JAR loader. Alibaba lists plain non-fat JARs, generic uber-JARs, and Tomcat or Jetty WAR deployments as unaffected. Reachable entry points include JSON.parse, JSON.parseObject(String), and JSON.parseObject(String, Class). Binding input to a fixed class is not sufficient when an object contains an Object or Map field where the payload can be nested. ThreatBook said on July 22 that its platform had captured in-the-wild exploitation after adding detection support two days earlier. Its laboratory results were narrower: it reproduced full code execution in a Spring Boot fat-JAR on JDK 8, while its embedded Tomcat test produced only a remote JAR fetch or server-side request forgery. Imperva reported activity against financial services, healthcare, computing, retail, and other organizations, primarily in the United States, with smaller volumes in Singapore and Canada. It said browser impersonators generated most requests, while Ruby and Go tools represented about 30% collectively. Neither vendor published attack counts, raw requests, execution evidence, named victims, or confirmed compromises. Their reports establish observed exploit activity, not proof of successful code execution against a real-world target or a breach. A July 23 CISA-ADP assessment nevertheless marked exploitation as none. The Hacker News confirmed on July 25 that the flaw was absent from CISA's current Known Exploited Vulnerabilities catalog. The available sources do not explain the mismatch. The Hacker News also found no patched Fastjson 1.x artifact in the project's GitHub tags or Maven Central repository as of July 25. Version 1.2.83 remains the latest standard 1.x release, while 1.2.83_noneautotype remains the available restricted build. Organizations should inventory direct and transitive Fastjson dependencies and inspect affected systems for suspicious @type values, nested JAR URLs, unexpected outbound connections, child processes, file changes, and web shells. Fastjson2 is not affected because it does not use the same resource-probing or annotation-based trust path. The Hacker News has reached out to Alibaba for clarification on the affected versions and Fastjson 1.x patch plans, and to Imperva for details about the reported exploitation activity. We will update the story with any response. Fastjson 1.2.83 was Alibaba's recommended upgrade for a separate AutoType bypass disclosed in 2022. That final 1.x release now sits inside the affected range for CVE-2026-16723.

Two security teams have shown, in separate research published this week, that OpenClaw, the popular self-hosted AI agent, can be driven to run attacker-controlled code or hand over sensitive data through ordinary-looking inputs. Imperva buried instructions inside shared contacts, vCards, and location pins that the agent executed without the victim ever seeing them. Varonis built a test agent on the platform, gave it a mailbox full of synthetic business data, and watched a single plain email talk it into forwarding mock AWS keys and a fake customer export to an outside address. The flaw Imperva found is patched in OpenClaw 2026.4.23, so update if you run it. The phishing weakness Varonis found is not something a patch fixes; it comes down to limiting what the agent can do on its own. Different doors into the same room: the agent trusts what reaches it, and its access becomes the attacker's. Hidden commands in a shared contact Imperva researcher Yohann Sillam looked at how OpenClaw hands messaging data to the model behind it. The problem is in the plumbing. When the agent passes a shared contact, vCard, or location to the LLM, it flattens the object into the prompt text inline, with no boundary marking it as untrusted. The content the agent fetches from the web gets wrapped in an untrusted-content marker. Message objects do not. Only some fields travel to the model, and that is what the attack abuses. A shared contact sends just the name field, serialized as . The angle brackets are legal in a name, so the model cannot tell where the real name ends and an injected instruction begins. The contact name is truncated where it shows on screen, both on WhatsApp and in the receiving app, so the victim does not see the payload either. The same trick works through a vCard's full-name field, which WhatsApp supports natively, and through the label on a shared location pin. In Imperva's tests against Gemini 3.1 Pro (preview build), the hidden text told the agent to download and run a script from a server the researchers controlled. It did. A plain image with instructions buried in it failed, likely because that attack has been reported so often that models are now trained to resist it; the message-object route worked because models have seen far fewer examples of it. With OpenClaw's memory on by default, Imperva warns, a single piece of widely shared content carrying a hidden instruction could quietly compromise the agents that ingest it, if they are not sandboxed. Imperva disclosed the issue, and OpenClaw shipped a fix in version 2026.4.23 that moves contact names, vCard fields, and location labels out of the prompt body and into a separate untrusted-metadata channel. Imperva found the same flattening pattern in other personal AI assistants, so the underlying problem is not OpenClaw's alone. A normal email is enough Varonis Threat Labs came at OpenClaw from the social angle. In research led by Itay Yashar, the team built an agent called Pinchy on the platform, wired it to a Gmail inbox stocked with realistic but synthetic business clutter and mock secrets, and ran it through four phishing simulations on Google Gemini 3.1 Pro and OpenAI Codex GPT-5.4. They draw a line between prompt injection, which hides instructions in data, and what they call agent phishing: a believable request that arrives through a normal channel and works because the agent acts before checking who sent it. The agent failed both exfiltration tests. In the first, a message posing as a team lead named Dan, sent from an outside Gmail address, asked for staging access during a fake production incident. Pinchy found the credentials and forwarded mock AWS IAM access keys, database connection strings, and SSH credentials in plaintext. The second pretext was softer: a routine-sounding request for the weekly customer export, supposedly for a QBR deck. The agent shipped out a synthetic dataset of 247 enterprise customers, contacts, and contract values included. Both failures happened under a strict profile that told the agent to verify senders first. The rule existed. Urgency beat it once, routine beat it the second time. The agent did better when the threat was technical rather than social. It interacted with a gift-card phishing page but withheld real credentials and eventually flagged it; the strict profile blocked the page outright. On a malicious OAuth consent screen dressed up as a timesheet app, it inspected the redirect target, judged it suspicious, and stopped before granting access. That is the split Varonis draws out: the agent is better than many people at spotting bad URLs and fake login portals, and worse at the social judgment that makes a human pause when a colleague suddenly asks for credentials at an odd hour. The drive to be helpful is the attack surface. Varonis says OpenAI Codex GPT-5.4 was more cautious than Gemini 3.1 Pro about entering or sending data to outside sites without confirmation, but both fell for the social pretexts. The weak spot behind both attacks Varonis maps both attacks onto what Simon Willison calls the lethal trifecta: an agent that can read private data, take in untrusted content, and send data back out. OpenClaw has all three, which is why a poisoned contact and a friendly email end in the same place. That trust boundary is not only a prompt problem; it shows up in OpenClaw's code as well. A separate InfoSec Write-ups analysis turned OpenClaw's past advisories into static-analysis rules, then used them to find five more flaws across the Slack, Discord, Matrix, Zalo, and Microsoft Teams channel extensions. All five were the same bug: the startup code resolved each channel's allowlist by mutable display name instead of a stable ID, so an attacker who renamed themselves to match an allowed user could slip onto the list and steer the agent. OpenClaw has patched them. OpenClaw ships with broad access to files, shells, and more than twenty messaging platforms, and it has drawn a steady run of earlier prompt-injection and data-exfiltration warnings since it launched late last year. The Dutch data protection authority took the strongest line: the Autoriteit Persoonsgegevens told users and organisations not to run OpenClaw on systems that hold sensitive data, citing data-breach and account-takeover risks. What to do about it Anyone running OpenClaw should update to 2026.4.23 or later for the message-object fix. The rest is architecture, not prompt wording, and Varonis lays out four controls. Treat the agent's instruction file as an enforced, version-controlled policy, not a suggestion. Outbound mail needs a gate: no first-time sends to unfamiliar addresses without approval, so a hijacked agent cannot relay phishing from a trusted account. Connector access should track the trust level of whatever triggered the task, so an inbox handling outside email cannot also read the whole CRM. And the riskiest actions, forwarding credentials or moving money, should wait for a human. Both teams land on the same mental model. Varonis frames it as treating the agent like a junior employee with system access and no instinct for what looks off, not as a security tool. Imperva gets there from the other direction, calling it an authenticated executor that trusts its inputs. The fixes on offer today are specific patches and guardrails. The harder problem is still open. An agent useful enough to act on your email and run your commands is, by design, one that trusts input and wants to help, and nobody has a general fix for that yet.

The US cybersecurity agency CISA on Wednesday urged federal agencies to immediately patch a critical-severity vulnerability in the Mirasvit Full Page Cache Warmer for Magento 2 extension that has been exploited in the wild for remote code execution (RCE). Cache Wormer monitors a page’s cache status and automatically adds the latest version of the page to the cache to speed up loading and improve page rankings. The exploited bug, tracked as CVE-2026-45247 (CVSS score of 9.8), is described as a PHP object injection vulnerability that can be exploited remotely, without authentication, to execute arbitrary code on Magento and Adobe Commerce servers. Attackers can exploit the Mirasvit flaw via crafted serialized PHP objects injected into the CacheWarmer cookie, which are deserialized without restricting the classes that may be instantiated. “An attacker controls the objects PHP reconstructs. This is PHP object injection (CWE-502). Combined with a gadget chain from classes that Magento and its dependencies already ship, object injection escalates to remote code execution,” Sansec notes. According to the company, thousands of Magento and Adobe Commerce stores are running the Mirasvit Cache Warmer extension. All stores using an extension iteration before version 1.11.12 are potentially exposed to attacks. The CVE was publicly disclosed on May 26. According to Imperva, threat actors started exploiting it for RCE shortly after disclosure. On Wednesday, CISA added CVE-2026-45247 to its Known Exploited Vulnerabilities (KEV) catalog, urging federal agencies to patch within three days, in line with the Binding Operational Directive (BOD) 22-01. While BOD 22-01 only applies to federal agencies, all organizations are advised to update their Mirasvit Cache Warmer installations to version 1.11.12 or newer, which contain patches for the exploited flaw. According to Sansec, administrators can identify potential compromises by checking for storefront requests with a CacheWarmer cookie containing the marker CacheWarmer: and a base64 string. “Serialized PHP objects base64-encode to values starting with Tz, Qz or YT, so a CacheWarmer cookie value matching CacheWarmer:(Tz|Qz|YT) is a strong indicator of an exploitation attempt,” Sansec explains. Related: Kirki, Burst Statistics WordPress Plugin Flaws in Attackers’ Crosshairs Related: Organizations Warned of Exploited Linux Kernel Vulnerability Related: Android Update Patches Exploited Zero-Day, 123 Other Vulnerabilities Related: Oracle WebLogic Vulnerability Exploited in the Wild

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a critical flaw impacting Mirasvit Cache Warmer, a popular Magento full-page cache extension, to its Known Exploited Vulnerabilities (KEV) catalog, following reports of active exploitation in the wild. The vulnerability, tracked as CVE-2026-45247 (CVSS score: 9.8), is a case of deserialization of untrusted data that could be exploited to execute arbitrary PHP code on an affected server. "Mirasvit Full Page Cache Warmer contains a deserialization of untrusted data vulnerability that could allow unauthenticated attackers to achieve remote code execution by supplying a crafted serialized PHP object in the CacheWarmer cookie," CISA said. The shortcoming impacts all versions of the extension prior to version 1.11.12. Patches for the were released on May 25, 2026. The addition of CVE-2026-45247 to the KEV catalog comes days after Sansec said the PHP object injection vulnerability could be exploited by means of any storefront request carrying a crafted CacheWarmer cookie, which then deserializes part of the cookie value with PHP's native unserialize() function without requiring any authentication or admin privileges. "Because that value comes straight from the client, an attacker controls the objects PHP reconstructs," the Dutch security company said. "This is PHP object injection (CWE-502). Combined with a gadget chain from classes that Magento and its dependencies already ship, object injection escalates to remote code execution." Sansec said it identified about 6,000 stores running Mirasvit extensions, although the exact number is likely to be higher given that content delivery networks (CDNs) like Cloudflare mask installs. Thales-owned Imperva has since disclosed it has observed active attack activity attempting to exploit CVE-2026-45247 through serialized PHP object payloads delivered via malicious HTTP requests. "Observed payloads contain base64-encoded serialized objects designed to trigger PHP Object Deserialization and achieve remote code execution through commonly abused gadget chains," the company said. "The payloads attempt to invoke functions such as system() and current() to execute arbitrary commands on the underlying server. In several observed cases, attackers used test commands designed to validate successful code execution." The activity has primarily singled out gaming and business sites, with the U.S., the U.K., France, and Australia emerging as the most targeted countries. It's currently not known who is behind the exploitation efforts, although the end goal appears to be to flag vulnerable Magento environments and confirm remote code execution is possible. In light of active exploitation, Federal Civilian Executive Branch (FCEB) agencies have been ordered to apply the fixes by June 6, 2026. To detect potential exploitation efforts, site owners are advised to audit for storefront requests that carry a CacheWarmer cookie whose value contains the marker "CacheWarmer:" followed by a Base64-encoded string. "Serialized PHP objects base64-encode to values starting with Tz, Qz or YT, so a CacheWarmer cookie value matching CacheWarmer:(Tz|Qz|YT) is a strong indicator of an exploitation attempt," Sansec added.

Konvu, the agentic AI triage management platform, has won the inaugural Infosecurity Europe Cyber Startup competition. Live on stage in the Cyber Startups Zone at Infosecurity Europe 2026, and in front of an audience of potential customers, partners and investors, the AI-native vulnerability triage platform start-up beat four other contenders. As the winner of the Cyber Startup competition, Konvu has won a prize package which includes an exhibition stand at Infosecurity Europe 2027, PR support from cybersecurity PR agency Origin Communications, and a future-brand workshop package from Dusted brand consultancy. “I have been really impressed by the pitches here, so it means a lot that our solution resonated with the judges,” said Lucas Masson, CEO, Konvu. Konvu is an AI-native vulnerability triage platform that automates investigation. It connects to the scanners enterprises already use, runs agent-driven checks across code, configuration, and optional runtime signals, then returns evidence-backed exploitability decisions directly into existing workflows. “Frontier models like Mythos are getting very good at finding new vulnerabilities, but the same capability is in attackers' hands, so the window between discovery and exploitation is collapsing,” Masson explained. “Detection is heading toward being largely automated, which moves the bottleneck onto the enterprises who have to triage and fix. That's where Konvu cuts the load off security teams and remediates at the speed attackers now operate,” he added. The judging panel said that they were impressed by how Konvu helps organizations know what vulnerabilities need to be fixed and which of those should be prioritized. The panel also noted that Konvu had an impressive product pipeline and roadmap for expansion. The judges included Shlomo Kramer, co-founder and CEO at Cato Networks. He is a founder and investor of serveral pioneering cybersecurity companies including Check Point, Palo Alto Networks, Imperva and Sumo Logic and one of the most influential figures in the global cybersecurity industry. “What stood out about the award winner was the strength of their vision," said Kramer. "They identified a compelling entry point, expanded it into a platform strategy and addressed a genuine market problem. That's a powerful combination, and ultimately what set them apart.” “Detection is heading toward being largely automated, which moves the bottleneck onto the enterprises who have to triage and fix. That's where Konvu cuts the load off security teams and remediates at the speed attackers now operate,” he added. Also on the judging panel were Mun Valiji, group CISO at specialist banking group Close Brothers, and Kirsty Kelly, a global CISO and board and venture advisor. Infosecurity Europe’s Cyber Startup Programme is designed to shine a light on the next generation of cybersecurity innovators, bringing startup founders, investors and ecosystem enablers together through a dedicated show-floor experience.

Varonis is proud to announce the general availability of Varonis Atlas, an end-to-end AI Security Platform that helps organizations see and control AI across the enterprise. Atlas is the only platform that covers the entire AI security lifecycle — from discovery and posture management to runtime protection and compliance — in a single solution. It connects to any AI system organizations build or run: hosted AI platforms, custom LLMs, agentic frameworks, chatbots, and embedded AI. And because Atlas is built on the Varonis Data Security Platform, it brings data context that no standalone AI security tool can match. “AI completely disrupts the enterprise security model. Instead of humans clicking through UIs, agents are accessing data directly — and this places data and AI security front and center,” said Yaki Faitelson, CEO and Co-founder of Varonis. “If you can’t see what AI systems you have and what sensitive data they can reach, you can’t safely use AI at scale. Varonis Atlas gives organizations the fastest path to safe and trustworthy AI.” Your fastest path to safe and trustworthy AI AI agents, copilots, and LLMs are now embedded in enterprise workflows. They read, write, and act on data at machine speed. However, most organizations don’t know which AI systems they have, what those systems can access, or whether they’re compliant with emerging regulations. Gartner® recently wrote a report, the Future of AI Security is in Securing Agent Actions, Not Prompts, and in their analysis, researchers discovered that over 50% of organizations have already begun deploying or plan to deploy AI agents. Organizations are also building with AI. The report predicts AI security platforms will be used in 30% of organizations to secure agent development within AI-native software engineering, as the growing majority of enterprise software relies on agentic coding tools. As enterprises deploy more autonomous and agentic AI systems, risk escalates: Agents read, write, create, and modify data continuously and at machine speed Data access is often too broad and poorly understood Small misconfigurations can result in massive data breaches or compliance fines This is why AI security must be rooted in data security, and why Varonis Atlas exists. Atlas secures everything you build and run with AI. Let's take a deeper look at these capabilities. Experience how Varonis Atlas finds AI risk, fixes exposure, and stops dangerous AI behavior before it becomes a breach. Request a free trial with full access to Atlas’ AI inventory, posture management, security testing, runtime guardrails, and compliance reporting functionality. Request a Free Trial Atlas AI security capabilities AI Inventory and Shadow AI Varonis Atlas provides continuous discovery of all AI systems across the enterprise, including sanctioned tools, custom-built agents, embedded AI, and shadow AI used without formal approval. By scanning cloud accounts, code repositories, AI platforms, and SaaS usage, Atlas builds a living inventory that shows what AI exists, how it’s connected, what data it can access, and what actions it can take — forming the foundation for every other AI security control. Go beyond surface discovery: Atlas inventories agents, models, tools, MCP servers, dependencies, and supporting infrastructure — not just LLM endpoints or chat apps. Uncover shadow AI with context: Discovered AI assets are tied to users, data access, and activity context, making shadow AI immediately actionable instead of just visible. AI Security Posture Management (AI-SPM) Atlas AI Security Posture Management continuously assesses AI systems for vulnerabilities, misconfigurations, sensitive data exposure, and agentic risks across the entire AI stack. It analyzes code, prompts, models, dependencies, and configurations to surface concrete security issues and links them directly back to the AI assets and data they affect. This comprehensive approach allows teams to remediate risk before AI systems reach production or scale. Data-aware posture, not just model checks: Findings are enriched with data sensitivity and access context from the Varonis Data Security Platform, exposing real business risk. Built for enterprise scale: AI-SPM spans cloud platforms, agent frameworks, custom models, and third-party AI — not a single development environment or use case. AI Pen Testing Atlas proactively stress tests AI systems by executing adversarial prompts and dynamic attacks against live LLM endpoints. Only through runtime analysis can teams uncover all possible issues. These tests, therefore, simulate real-world threats such as prompt injection, jailbreaks, and policy bypass attempts, then record unsafe behaviors as concrete security findings tied directly to the affected models, agents, and configurations. Live, dynamic testing: Pen tests run against real production endpoints, not offline simulations or static rule checks. Downstream enforcement: Pentest results directly inform runtime guardrails and posture policies, closing the loop from testing to protection. AI Runtime Guardrails Atlas enforces real-time guardrails through an AI Gateway that sits in the live request path, inspecting prompts, responses, and agent actions before they reach the model or downstream systems. These controls prevent sensitive data leakage, block malicious or noncompliant behavior, and generate real-time alerts — without requiring changes to the underlying AI application or model. AI-aware blocking and policy enforcement: Guardrails understand execution flow, agent tools, and indirect leakage paths — not just simple pattern matching. Customer-owned data plane: Prompts, responses, and telemetry stay inside the customer’s environment, supporting data residency and sovereignty requirements. AI Compliance and Governance Atlas operationalizes AI governance by continuously mapping AI systems to regulatory frameworks such as the EU AI Act and NIST AI RMF. The platform generates audit-ready reports, maintains lineage and transparency artifacts, and tracks risk assessments and remediation status—turning compliance from a one-time exercise into an ongoing, evidence-backed process. Built on real system evidence: Compliance reporting is grounded in live AI inventory, lineage graphs, activity logs, and security findings — not questionnaires alone. Unified with security controls: Governance is directly connected to discovery, posture, pen testing, and runtime enforcement, avoiding fragmented GRC tooling. AI Third-Party Risk Management (AI TPRM) Varonis Atlas extends AI security beyond internally built systems to include the AI services, models, and platforms organizations consume through their supply chain. It continuously assesses third-party AI vendors by combining their AI inventory or AI Bills of Materials (AIBOM) with vendor questionnaire responses to understand how external AI systems handle data and possibly create risk due to specific dependencies. This enables organizations to identify, track, and remediate third-party AI risk as part of a unified AI security lifecycle. Continuous, not point in time: Third-party AI risk is continuously reassessed as vendor inputs, dependencies, or behaviors change, rather than relying on static reviews. Integrated with AI inventory: Third-party AI systems are tracked alongside internal AI assets, providing automated risk analysis and visibility. AI Activity Monitoring Atlas AI Activity Monitoring provides end-to-end visibility into how AI systems behave in production by capturing prompts, responses, agent actions, data access, and guardrail decisions. Through a customer-owned observability layer and centralized dashboards, security and governance teams can understand how AI is used, detect anomalous behavior, and investigate incidents with full execution context across models, agents, and tools. Full execution visibility: Monitoring spans prompts, responses, agent tool calls, and data access—not just user chat logs or model outputs. Customer-owned telemetry: All AI activity logs remain within the customer’s environment, supporting auditability, data residency, and forensic investigation. AI Detection & Response (AIDR) Varonis Atlas delivers AI Detection and Response (AIDR) by identifying malicious, unsafe, or noncompliant AI behavior across models, agents, tools, and data flows in real time. When threats such as prompt injections or jailbreak attempts are detected, Atlas generates actionable alerts, blocks activity inline when needed, and integrates with SIEM and SOAR platforms to support rapid investigation and response. AI-native threat detection: AIDR understands AI-specific attack techniques and agentic behavior rather than relying on traditional application security signals. Unified with data security: Detections are enriched with data sensitivity and access context, enabling teams to prioritize incidents based on real business impact. Secure AI and the data that powers it AI security cannot live in silos or point solutions. It demands a unified approach that connects to the data that AI depends on. As organizations scale AI they also scale exposure. The only way forward is security that understands both how AI behaves and what data it can reach. “Most AI security tools are fragmented and data-blind. They can inventory your AI systems or monitor prompts, but they can’t see what sensitive data AI is accessing or control what it does with that data. That’s the real risk, and is exactly what Atlas and the Varonis Data Security Platform solve together.” Ron Bennatan, VP of AI and Data Security Strategy at Varonis, co-founder of AllTrue.ai, creator of Guardium (acquired by IBM) and jSonar (acquired by Imperva) Varonis Atlas is available today. Begin by watching the demo video below or with a free trial with full access to Atlas’ AI inventory, posture management, security testing, runtime guardrails, and compliance reporting functionality. Sponsored and written by Varonis.

Infosecurity Europe has unveiled a major line-up of keynote speakers for its 2026 conference program, bringing together prominent figures from the military, global cybersecurity, elite sport and intelligence communities. The event will run from 2–4 June at ExCeL London. Industry Visionary Shlomo Kramer and Former FBI Leader Cynthia Kaiser Lead Tuesday Line-Up Tuesday’s keynote program is set to be a standout moment at Infosecurity Europe 2026, spotlighting two of the industry’s most influential voices. Cybersecurity pioneer Shlomo Kramer, founder and investor behind companies including Check Point, Palo Alto Networks, Imperva, Cato Networks and Sumo Logic, will speak on Tuesday 2 June. Kramer will share his perspective on the technology trends, investment patterns and innovation cycles shaping the next era of cybersecurity. He will also serve as a judge in the cyber start-up competition, highlighting emerging innovation and rising cyber entrepreneurs. Also taking the stage on Tuesday 2 June, Cynthia Kaiser, former Deputy Assistant Director of the FBI’s Cyber Division and now leading ransomware research at Halcyon, will deliver rare insights into the cybercriminal economy. Kaiser will discuss how intelligence drawn from the dark web and wider criminal networks can help organizations anticipate evolving ransomware tactics and threat actor behavior. Women in Cybersecurity Marks its 10th Anniversary The 2026 event will also celebrate the 10th edition of Women in Cybersecurity event, hosted on Wednesday 3 June at 15:00 on the Keynote Stage. England Rugby World Cup winner and former elite athlete Maggie Alphonsi will open the session with a keynote exploring what elite sport can teach cybersecurity professionals about leadership, high‑performance cultures and developing a winning mindset. Alphonsi will share lessons on confidence, resilience and pushing beyond perceived limits. Cynthia Kaiser will return to join the Women in Cybersecurity panel, contributing her expertise on leadership, representation and the evolving role of women across the industry. Jason Fox to Open Thursday’s Keynote Program Former Special Boat Service (SBS) Sergeant and SAS: Who Dares Wins star Jason Fox will headline the Keynote Stage on Thursday 4 June (10:05–10:45). Drawing on his career in UK Special Forces, Fox will outline how the principles underpinning elite military teams can be applied to cyber resilience, decision‑making and leadership under pressure. His session will offer practical mental models to help security teams maintain focus, build trust and perform effectively in complex, high‑stakes environments. Deep Dives into AI-Driven Cloud Threats and Post-Quantum Security A series of technical sessions across Tuesday and Wednesday will provide deeper insight into emerging threat trends. On Tuesday 2 June (13:50–14:20), Ron Leizrowice, AI Researcher at Wiz, will present “The Infosec Big Fat Cloud Update of the Year.” The session will examine how rapid AI adoption is reshaping the cloud threat landscape, accelerating exploitation windows and expanding attack surfaces across control planes, identities and automated workflows. Leizrowice will outline techniques to reduce AI‑driven attack paths while enabling secure, rapid development. On Wednesday 3 June (11:00–11:35), Rik Ferguson, Vice President of Security Intelligence at Forescout and Infosecurity Hall of Fame inductee, will deliver “Quantum is still far off, we can wait – can’t we?”. Ferguson will highlight why organizations must begin preparing now for post‑quantum cryptography, discussing risks linked to crypto‑fragile components and offering practical steps to reduce long‑term cryptographic exposure. Registration Registration for Infosecurity Europe 2026 open and is free until 5 May, after which entry will cost £49, including access to the exhibition floor and all theatre sessions.

Cybersecurity researchers have disclosed details of a now-patched vulnerability in the popular figma-developer-mcp Model Context Protocol (MCP) server that could allow attackers to achieve code execution. The vulnerability, tracked as CVE-2025-53967 (CVSS score: 7.5), is a command injection bug stemming from the unsanitized use of user input, opening the door to a scenario where an attacker can send arbitrary system commands. "The server constructs and executes shell commands using unvalidated user input directly within command-line strings. This introduces the possibility of shell metacharacter injection (|, >, &&, etc.)," according to a GitHub advisory for the flaw. "Successful exploitation can lead to remote code execution under the server process's privileges." Given that the Framelink Figma MCP server exposes various tools to perform operations in Figma using artificial intelligence (AI)-powered coding agents like Cursor, an attacker could trick the MCP client to execute unintended actions by means of an indirect prompt injection. Cybersecurity company Imperva, which discovered and reported the problem in July 2025, described CVE-2025-53967 as a "design oversight" in the fallback mechanism that could allow bad actors to achieve full remote code execution, putting developers at risk of data exposure. The command injection flaw "occurs during the construction of a command-line instruction used to send traffic to the Figma API endpoint," security researcher Yohann Sillam said. The exploitation sequence takes place over through steps - The MCP client sends an Initialize request to the MCP endpoint to receive an mcp-session-id that's used in subsequent communication with the MCP server The client sends a JSONRPC request to the MCP server with the method tools/call to call tools like get_figma_data or download_figma_images The issue, at its core, resides in "src/utils/fetch-with-retry.ts," which first attempts to get content using the standard fetch API and, if that fails, proceeds to executing curl command via child_process.exec -- which introduces the command injection flaw. "Because the curl command is constructed by directly interpolating URL and header values into a shell command string, a malicious actor could craft a specially designed URL or header value that injects arbitrary shell commands," Imperva said. "This could lead to remote code execution (RCE) on the host machine." In a proof-of-concept attack, a remote bad actor on the same network (e.g., a public Wi-Fi or a compromised corporate device) can trigger the flaw by sending the series of requests to the vulnerable MCP. Alternatively, the attacker could trick a victim into visiting a specially crafted site as part of a DNS rebinding attack. The vulnerability has been addressed in version 0.6.3 of figma-developer-mcp, which was released on September 29, 2025. As mitigations, it's advisable to avoid using child_process.exec with untrusted input and switch to child_process.execFile that eliminates the risk of shell interpretation. "As AI-driven development tools continue to evolve and gain adoption, it’s essential that security considerations keep pace with innovation," the Thales-owned company said. "This vulnerability is a stark reminder that even tools meant to run locally can become powerful entry points for attackers." The development comes as FireTail revealed that Google has opted not to fix a new ASCII smuggling attack in its Gemini AI chatbot that could be weaponized to craft inputs that can slip through security filters and induce undesirable responses. Other large language models (LLMs) susceptible to this attack are DeepSeek and xAI's Grok. "And this flaw is particularly dangerous when LLMs, like Gemini, are deeply integrated into enterprise platforms like Google Workspace," the company said. "This technique enables automated identity spoofing and systematic data poisoning, turning a UI flaw into a potential security nightmare."

The financial services, telecoms and travel sectors were in the crosshairs of threat actors in the first half of the year, after Thales observed 40,000 incidents in the period alone. The firm’s Imperva business analyzed data from over 4000 environments worldwide to produce its API Threat Report (H1 2025). The report claimed that APIs now attract 44% of advanced bot traffic, which is generated by sophisticated software designed to mimic human behavior. Among the report’s key findings are: A 40% increase in credential-stuffing and account takeover attempts targeting APIs without adaptive multi-factor authentication (MFA) Data scraping accounted for nearly a third (31%) of API bot activity Coupon and payment fraud accounted for 26% of API attacks Remote code execution (RCE) attempts accounted for 13% Log4j, Oracle WebLogic and Joomla were the most targeted products “APIs are the digital economy’s connective tissue – but that also makes them its most attractive attack surface,” said Tim Chang, VP of application security products at Thales. “What we’re witnessing is not just the scale of attacks increasing, but a fundamental shift in how criminals operate: they don’t need to inject malware, they can simply bend your business logic against you. The requests look legitimate, but the impact can be devastating.” Financial services accounted for 27% of API incidents in the period, followed by telecoms and ISPs (10%), travel (14%) and entertainment & arts (13%), the report noted. Shadow APIs are still a major security blind spot, with organizations typically having 10-20% more active APIs than they think. Thales also reported a major application-layer DDoS attack in the first half of the year, at a record-breaking 15 million requests-per-second (RPS). The report claimed that 27% of API-focused DDoS traffic in the period was aimed at financial services targets, given that they’re heavily reliant on APIs for real-time transactions like balance checks, transfers and payment authorizations. Chang warned that the volume and sophistication of API attacks would continue to surge in the next six months, with 2025 on track for 80,000+ incidents. “The best time to act was yesterday – the next best time is now,” he concluded. “Organizations must discover every live endpoint, understand its business value and protect it with context-aware, adaptive defenses if they are to safeguard revenue, trust and compliance.”

Multiple HTTP/2 implementations have been found susceptible to a new attack technique called MadeYouReset that could be explored to conduct powerful denial-of-service (DoS) attacks. "MadeYouReset bypasses the typical server-imposed limit of 100 concurrent HTTP/2 requests per TCP connection from a client. This limit is intended to mitigate DoS attacks by restricting the number of simultaneous requests a client can send," researchers Gal Bar Nahum, Anat Bremler-Barr, and Yaniv Harel said. "With MadeYouReset, an attacker can send many thousands of requests, creating a denial-of-service condition for legitimate users and, in some vendor implementations, escalating into out-of-memory crashes." The vulnerability has been assigned the generic CVE identifier, CVE-2025-8671 (CVSS score: 7.5), although the issue impacts several products, including Apache Tomcat (CVE-2025-48989), F5 BIG-IP (CVE-2025-54500), and Netty (CVE-2025-55163). MadeYouReset is the latest flaw in HTTP/2 after Rapid Reset (CVE-2023-44487) and HTTP/2 CONTINUATION Flood that can be potentially weaponized to stage large-scale DoS attacks. Just like how the other two attacks leverage the RST_STREAM frame and CONTINUATION frame, respectively, in the HTTP/2 protocol to pull off the attack, MadeYouReset builds upon Rapid Reset and its mitigation, which limits the number of streams a client can cancel using RST_STREAM. Specifically, it takes advantage of the fact that the RST_STREAM frame is used for both client‑initiated cancellation and to signal stream errors. This is achieved by sending carefully crafted frames that trigger protocol violations in unexpected ways, prompting the server to reset the stream by issuing an RST_STREAM. "For MadeYouReset to work, the stream must begin with a valid request that the server begins working on, then trigger a stream error so the server emits RST_STREAM while the backend continues computing the response," Bar Nahum explained. "By crafting certain invalid control frames or violating protocol sequencing at just the right moment, we can make the server send RST_STREAM for a stream that already carried a valid request." The six primitives that make the server send RST_STREAM frames include - WINDOW_UPDATE frame with an increment of 0 PRIORITY frame whose length is not 5 (the only valid length for it) PRIORITY frame that makes a stream dependent on itself WINDOW_UPDATE frame with an increment that makes the window exceed 2^31 − 1 (which is the largest window size allowed) HEADERS frame sent after the client has closed the stream (via the END_STREAM flag) DATA frame sent after the client has closed the stream (via the END_STREAM flag) This attack is notable not least because it obviates the need for an attacker to send an RST_STREAM frame, thereby completely bypassing Rapid Reset mitigations, and also achieves the same impact as the latter. In an advisory, the CERT Coordination Center (CERT/CC) said MadeYouReset exploits a mismatch caused by stream resets between HTTP/2 specifications and the internal architectures of many real-world web servers, resulting in resource exhaustion -- something an attacker can exploit to induce a DoS attack. "The discovery of server-triggered Rapid Reset vulnerabilities highlights the evolving complexity of modern protocol abuse," Imperva said. "As HTTP/2 remains a foundation of web infrastructure, protecting it against subtle, spec-compliant attacks like MadeYouReset is more critical than ever." HTTP/1.1 Must Die The disclosure of MadeYouReset comes as application security firm PortSwigger detailed novel HTTP/1.1 desync attacks (aka HTTP request smuggling), including a variant of CL.0 called 0.CL, exposing millions of websites to hostile takeover. Akamai (CVE-2025-32094) and Cloudflare (CVE-2025-4366) have addressed the issues. HTTP request smuggling is a security exploit affecting the application layer protocol that abuses the inconsistency in parsing non-RFC-compliant HTTP requests by front-end and back-end servers, permitting an attacker to "smuggle" a request and sidestep security measures. "HTTP/1.1 has a fatal flaw: Attackers can create extreme ambiguity about where one request ends, and the next request starts," PortSwigger's James Kettle said. "HTTP/2+ eliminates this ambiguity, making desync attacks virtually impossible. However, simply enabling HTTP/2 on your edge server is insufficient – it must be used for the upstream connection between your reverse proxy and origin server." Update Multiple vendors have responded to the MadeYouReset disclosure -

Researchers have discovered another attack vector that can be exploited to launch massive distributed denial-of-service (DDoS) attacks. The attack, dubbed MadeYouReset, is similar to Rapid Reset, which in 2023 was exploited in zero-day attacks that broke DDoS records in terms of requests per second (RPS). MadeYouReset, discovered by researchers at security firm Imperva and Tel Aviv University in Israel, leverages a design flaw in HTTP2 implementations. “HTTP/2 introduced stream cancellation – the ability of both client and server to immediately close a stream at any time. However, after a stream is canceled, many implementations keep processing the request, compute the response, but don’t send it back to the client,” the CERT/CC at Carnegie Mellon University explained in an advisory. “This creates a mismatch between the amount of active streams from the HTTP/2 point of view, and the actual active HTTP requests the backend server is processing.” “By opening streams and then rapidly triggering the server to reset them using malformed frames or flow control errors, an attacker can exploit a discrepancy created between HTTP/2 streams accounting and the servers active HTTP requests. Streams reset by the server are considered closed, even though backend processing continues. This allows a client to cause the server to handle an unbounded number of concurrent HTTP/2 requests on a single connection.” CERT/CC added. An attacker can continually send reset requests to the targeted server, resulting in highly disruptive DDoS attacks. However, unlike in the case of Rapid Reset, the MadeYouReset method does not appear to have been exploited in the wild. The underlying vulnerability, tracked as CVE-2025-8671, has been found to impact projects and organizations such as AMPHP, Apache Tomcat, the Eclipse Foundation, F5, Fastly, gRPC, Mozilla, Netty, Suse Linux, Varnish Software, Wind River, and Zephyr Project. Patches have already been released by Apache Tomcat developers, F5, Fastly, and Varnish. Others are still investigating the impact and extent of the flaw. Mozilla is working on patches for affected services and websites, but pointed out that software such as Firefox is not impacted. While the vulnerability has been assigned CVE-2025-8671, some of the impacted vendors have assigned their own CVE identifiers. Imperva pointed out that MadeYouReset blends with normal traffic, making it more difficult to detect. The company noted that the attack may bypass many existing defenses, but there are several mitigations and other solutions that can thwart attacks. Related: New HTTP/2 DoS Attack Potentially More Severe Than Record-Breaking Rapid Reset Related: DDoS Attacks Blocked by Cloudflare in 2025 Already Surpass 2024 Total Related: Record-Breaking 7.3 Tbps DDoS Attack Targets Hosting Provider