• Apple debuted a new Apple Watch feature called Live Rewind
• It lets you play back audio from the last 15 seconds
• Some observers are worried it could violate people’s privacy

When Apple announced its Live Rewind feature at its Surprise and Shine event earlier this week, many observers were concerned that it would allow you to secretly record other people without their consent. After all, the tool just requires you to press a button on your Apple Watch and it plays back any audio that was captured during the last 15 seconds.

Is this feature a privacy nightmare, one that turns every Apple Watch into a “mass surveillance device,” as some people have worried? Or have people misunderstood what is happening, with Apple putting enough safeguards in place to prevent abuse and privacy violations?

Social media users seem to be divided, with some calling it “creepy and antisocial,” while others pointed out how it could be useful for deaf people or those with autism. Let’s take a look at the facts to find out what’s really going on.

How does Live Rewind work?

What is this Live Rewind feature that is causing so much consternation? According to Apple, users of the Apple Watch Series 12 or Apple Watch Ultra 4 will be able to double-press the Digital Crown and receive a text transcription of what was said over the last 15 seconds. The company says this is useful if you missed something important, are deaf or hard of hearing, or are trying to recall a tip or recommendation from a friend.

Some people have worried that this would allow you to surreptitiously record other people without their knowledge, then save these recordings to your device for nefarious purposes.

However, Apple explained during the event that the feature never records or stores audio, it doesn’t identify anyone’s voice, and audio cannot be accessed by anyone (including Apple). To clarify matters, Apple has published an Audio Intelligence Privacy Overview that lays out how this feature — and Apple’s other new Audio Intelligence tools, including Siri Recap — works in detail.

When it comes to Live Rewind, any audio is processed in the Apple Watch’s Secure Enclave. This is a separate part of the S11 chip that, in this instance, processes audio. The Secure Enclave is siphoned off from the rest of the device and no part of the operating system can access it or the raw audio it handles. That includes both first- and third-party apps, and not even Apple can get to anything in the Secure Enclave.

Apple’s privacy paper notes that audio is never saved or recorded when you use Live Rewind. Instead, the audio is processed by the Secure Enclave and used to generate a transcript, then permanently deleted from both your device and from iCloud. There’s no way anyone can listen to the audio at a later date or extract it from your device.

Audio flows into the Secure Enclave on a rolling basis, which means that old data is continuously overwritten and deleted when new audio comes in. When activated, Live Rewind tries to send the last 15 seconds of audio to your iPhone. If it can’t — such as if your iPhone is not within wireless range — the audio is immediately discarded. If the process is successful, the audio is converted to text on your iPhone, deleted, then the text is sent back to the Secure Enclave in your Apple Watch.

The saved text stays available on your Watch for 30 seconds after the screen dims, after which it is discarded. You can optionally choose to save it to the Siri app, where it is end-to-end encrypted. This is the only instance where something is saved in the Live Rewind process. As mentioned previously, the text does not contain any speaker attribution.

You can ask Siri about your transcripts, at which point the text is sent to Apple’s secure Private Cloud Compute servers. If you use iCloud with two-factor authentication and have secured your device with a passcode, any transcripts from Live Rewind are synced using end-to-end encryption and not even Apple can decrypt them.

Respecting those around you

What about other people? Will they know that you’re using Live Rewind? Can you use the feature secretly?

Thankfully, you can’t really use Live Rewind without anyone knowing. When you double-press the Digital Crown, your Apple Watch plays an audible chime that occurs even if your device is in silent mode or you are listening via headphones. A full-screen animation also plays on screen and the microphone icon is displayed. Whether visually or through sound, your Apple Watch tries to alert other people about what is happening.

Apple also says that Live Rewind is opt-in rather than opt-out, and you can enable it when setting up a new device. You can also enable or disable the feature in Siri Settings on your Apple Watch or in the Siri Settings section of the Apple Watch app on your iPhone.

Although it would be polite to do so, there’s no way for Apple to force you to ask permission before using Live Rewind. But you might take some solace from the fact that there’s no way for anyone to save or extract the audio that the feature uses, nor can they attribute speakers. All a user gets out of it is a text transcript.

These privacy guardrails go some way to distancing Live Rewind from Meta’s so-called “Pervert Glasses” and their consent-busting data collection.

• FinCEN warns US banks of industrial‑scale scam centers in Southeast Asia stealing billions
• Victims coerced into crypto “investments,” later re‑scammed with fake recovery fees
• Laundered via digital assets, mixers, shell firms, and Chinese underground banking networks

American financial institutions need to be more vigilant when it comes to identifying and preventing money scams, especially those perpetrated by industrial-scale scam centers in Southeast Asia.

This was the warning issued by the US Department of the Treasury’s Financial Crimes Enforcement Network (FinCEN) alongside a long list of red flags these institutions can monitor in order to stay safe.

Large, dangerous crime rings

The scams are not done by small groups of teenagers, tricking the elderly from the depths of their parents’ basement, but are often large, well-organized crime machines responsible for billions of dollars in damages, around the world, every year.

In 2025 alone, US victims lost more than $7.2 billion to these scams, the warning said, and between September 2023 and December 2025, nearly $13 billion was stolen from Americans.

The criminal organizations are primarily located in Cambodia, Burma, and Laos. They trafficked hundreds of thousands of people to various centers around the countries, taking their passports and forcing them into participating in online fraud. Those that don’t meet certain quotas are often beaten - and some victims were liberated after their families paid ransom demands, while others ended up being coerced into commercial sex work.

To make matters worse, they are resilient to law enforcement activities because some of them are either endorsed, or outright operated by, local corrupt officials.

FinCEN says the criminals are engaged in all sorts of fraudulent activity, but stressed that investment fraud is, by far, the most popular one. The scammers would reach out to their victim either pretending to be a romantic interest, or a financial advisor. Sometimes, they would even begin the conversation by saying they mistyped a phone number.

After extensively communicating with their victim for a while, they try to persuade them into making an “investment”, often using cryptocurrencies, and promising unrealistically high returns. This is also, FinCEN stresses, is when the scams can most easily be identified:

“Most digital asset payments by victims to scam center operators originate from money services businesses (MSBs) offering digital asset services, includingdigital asset kiosks, according to FinCEN analysis and law enforcement information. Based on FinCEN’s analysis of BSA reporting, scammers often instruct their victims to open accounts withMSBs offeringdigital asset services to purchase specific types of digital assets. Then, the victim is told to send these funds toa digital asset address controlled by the scammers.”

But defrauding victims out of their hard-earned money is not where the scam ends. Instead, the criminals continue, this time abusing the emotional distress to cause even more harm. They pose as law enforcement, financial institutions, or even FinCEN itself, stating that they’re investigating (or that they have confiscated the stolen funds) and that the victims should pay a certain fee to have their funds returned to them.

In some cases, the fraudsters pose as investment advisors, telling the victims to take out their money, buy gold and silver bars, and hand them over to a courier for “safe keeping”.

The full list of red flags can be found on this link, and FinCEN stresses that the circumstances around each individual case should be carefully considered, since no single red flag is “determinative of illicit or other suspicious activity.”

The circumstances include a customer’s historical financial activity, whether the transactions are in line with prevailing business practices, and whether the customer exhibits multiple related red flags.

Laundering the proceeds

Stealing the money is only half of the work, though. It still needs to be laundered and reintroduced into the legitimate financial system, and to do that, scam center operators rely on professional money launderers and Chinese money laundering networks.

FinCEN describes a three-stage process, in which the criminals first extract payments in digital assets using bank accounts, money mules, shell companies, or fraudulent money services businesses.

Next, during on-chain laundering, they obfuscate the origins of the stolen money by rapidly moving it across addresses, using mixers, and swapping tokens across blockchains. The last step is to integrate the funds into the traditional financial system via money mules, stablecoin transfers to offshore exchanges, and Chinese underground banking networks.

• Zimperium uncovers Mantax Otax, Android malware merging infostealer, RAT, backdoor, and ransomware
• Distributed via APKs on third‑party stores, social media, and phishing; older Android versions most at risk
• Steals extensive data, enables remote monitoring, then encrypts files with AES and demands ransom

When threat actors target people’s devices, they usually infect it with one of many malware strains: an infostealer, a remote access trojan, a backdoor, or a ransomware encryptor.

Rarely do we see all of these functionalities merged into a single entity, and even rarer - to have it target Android mobile devices - yet, security researchers Zimperium discovered just that.

Mantax Otax

The security outfit published an in-depth report on Mantax Otax, a unique strain of malware circulating in the wild. It is apparently developed by an Indonesian threat actor, targeting victims in the country, but we don’t know exactly how many people are infected, or if this campaign is aimed primarily at business users, or individuals in general.

The malware is being distributed as a standalone APK, meaning it can be found on third-party app stores, Telegram channels, forums, and across social media. There are no traces of Mantax Otax on any of the official app repositories, including the Google Play Store, or Samsung’s Galaxy Store. Zimperium also speculates that it is likely being distributed via phishing emails.

Mantax Otax primarily targets users sporting older Android phones. Versions 9 and older are most at risk, since on these devices the attackers can make use of all of the malware’s features. Android 10 and newer models do get some protection:

“Conversely, on modern devices running Android 10 and above, the malware’s efficacy is severely hindered by native OS defenses, specifically Scoped Storage restrictions,” the researchers explained. “Due to these sandboxing rules, the ransomware is constrained to scanning only the application's localized external files directory, which drastically mitigates the blast radius and reduces the volume of accessible user files.”

Newer devices, as well as users of Zimperium’s Mobile Threat Defense (MTD) and Runtime Application Protection (zDefend) are said to be protected on a software level.

Another important caveat is the permissions. As is usual on Android devices, most malware won’t work unless the user grants an extensive set of permissions beforehand. In this case, Mantax Otax first asks for admin privileges, after which it grants itself an extensive list of capabilities, from accessing SMS messages, to contacts, audio, and images.

It then requests accessibility permissions, fully taking over the compromised device.

Malicious capabilities

Mantax Otax is said to be quite capable. It steals browser history, contacts, call logs, SMS messages, notifications, files, gallery media, Google account information, device specifications, location data, and application inventories. It can also pull WhatsApp information such as messages and profiles, and on Telegram it can also pull lock-screen PINs.

Infostealing features aside, it also serves as a remote monitoring tool, grabbing screenshots, recording the screen, or livestreaming it directly to the attackers. It can take photos using both the front and rear cameras, although Zimperium did not mention any microphone-recording capabilities.

Finally, once all of the data has been harvested, it encrypts user files with AES, deletes the originals, and appends a .enc extension. Victims are then shown a chat interface where they can communicate with the attackers directly and negotiate a ransom payment in exchange for getting their device back.

The tool seems to be in continuous development. Zimperium found two separate versions, one being an “evolution” of the other: “Notably, it has modified its network traffic behavior to utilize WebSockets and introduced a set of new commands,” the researchers said.

There is a reason why ransomware operators prefer targeting businesses instead of individuals. Although the latter has not disappeared entirely from the victim list, businesses stand to lose a lot more from disrupted operations and, as such, are targeted more frequently. Unfortunately, we don’t know what kind of app Mantax Otax is spoofing, therefore it is difficult to assess who the targets are.

If you've worked in cybersecurity for as long as I have, then you'll know there are a couple of things you can count on. First, the threats that are out there never stop evolving. And second, sooner or later, you're going to be in the bullseye.

What makes life so much harder today is that AI and other automated tools have dramatically narrowed the gap between vulnerability discovery and the time it takes to exploit them.

And when this can now be measured in minutes – seconds, even – you know you have a problem. This fundamental change in the way adversaries operate means we no longer have the luxury of time to understand an attack, assess the risk and decide what to do next.

Which means we have to be better prepared and have resiliency for whatever is thrown at us.

Visibility is key

For me, that starts with accepting a simple reality: you cannot defend what you cannot see. And it’s why visibility is one of the most important capabilities an organization can develop.

After all, if you understand what exists within your environment – how those systems interact and what normal looks like – then you're in a much stronger position to identify unusual behavior before it develops into something more serious.

Observability, on the other hand, takes that visibility to the next level. It provides the context security teams need to make informed decisions quickly, especially when time is working against them.

In other words, visibility tells you what is happening, while observability helps you understand why it's happening.

And that’s crucial. Today's organizations operate across on-premises infrastructure, cloud environments, networks, and an increasing number of connected technologies.

As those environments become more distributed, understanding what's happening across them becomes significantly harder.

Without that visibility, it's difficult to understand where your risks are, how systems interact, or where an attacker may be able to exploit a weakness.

Think like a hacker

Which leads me neatly onto my next point. Throughout my career, including my time working in offensive cyber operations in the intelligence community, I've found that the most effective way to understand risk is to think like the adversary.

I start by asking how someone would attack an organization and then work backwards to identify and close gaps.

That’s because attackers don't see organizations in the way that you or I might do. They’re always on the hunt for a toehold in. They look for weaknesses in people, processes and technologies.

They look for the easiest route first to achieve their objective. And then they exploit that weakness.

And it’s an approach I would urge all security leaders to adopt if they want to stay one step ahead.

That means continuously asking where an attacker would start, how they would move through the organization and what controls would slow them down or stop them altogether.

But for this to work, it also requires organizations to design resilience into the way they operate. And that’s something we’ve embedded across our organization.

For instance, we have internal and external teams that conduct continuous product, enterprise, spear-phishing and physical penetration testing.

For us, it's about educating the team across the business to ensure they remain vigilant. But it’s also about inoculating people so that when they see something suspicious online, they have that instinct that something might be wrong and they report it.

We also want to make it easy for people to report events so we can analyze them quickly and better understand the targeting.

Secure by design

We’ve also invested heavily in Secure by Design to ensure that all the products we deliver to customers are as secure as humanly possible. In practice, it means being able to trace every piece of code back to its source and verify its integrity throughout the development process.

It's similar to maintaining a chain of custody for evidence. We want to know exactly where software components come from, how they're verified and how they're protected throughout the entire build process.

More broadly, Secure by Design is increasingly being adopted across our industry as organizations recognize the importance of software integrity, traceability and transparency throughout the development lifecycle.

This is important because, as I said at the beginning, there are two certainties in cybersecurity: threats will continue to evolve, and organizations will continue to be targeted. Businesses across the world must adapt quickly to the grim reality that a cybersecurity incident isn’t a matter of if, but a matter of when. And AI is supercharging the pace at which all this is happening and broadening the blast radius of any attack.

That’s why you need to understand your environment well enough to reduce unnecessary risk, detect malicious activity quickly and limit the blast radius when something does happen. Pair that with a clearly defined and tested plan for recovery and that's what robust cyber resilience looks like in practice.

We've featured the best endpoint protection software.

This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit

Defense is operating in an environment where the pace of change continues to increase. Adversaries are adapting quickly and technology development cycles are becoming shorter. The boundaries between physical and digital operations are also becoming harder to define, while military commanders have more information available to them than ever before.

This changes how operational advantage is achieved. The performance of an individual platform or system remains important, but so does its ability to work effectively within the wider operational environment. Information needs to move securely to where it is needed, supporting decisions and action across different domains.

As new technologies are introduced, integration will become an increasingly important part of defense capability. The challenge is making sure innovation can be put to practical use alongside the systems and infrastructure already supporting operations.

Connecting technology across defence

Conversations around defense innovation often focus on AI, autonomous systems, advanced sensors, cyber capability and space assets. Each has a significant role to play, but none operates in isolation.

Information gathered by one system may need to be shared across multiple domains before it supports an operational decision. Networks, data, command systems and people all contribute to that process. The value of any individual technology is linked to how effectively it connects with the wider operational environment.

This principle also applies to the infrastructure supporting military operations. Communications networks, operational facilities and digital systems all contribute to creating an environment where information can move securely and reliably. As these environments evolve, resilience and security must be designed from the outset though approaches such as secure-by-design and zero-trust principles.

Strengthening the foundations of operational capability

AI has become one of the defining topics in defense. Its ability to process information and support decision-making has significant potential, but those capabilities depend on the quality of the data available and the resilience of the infrastructure that carries it.

Reliable communications, trusted data and secure networks remain fundamental to operational effectiveness. If those foundations are unavailable or compromised, the benefits of advanced technologies are reduced.

Therefore, creating decision advantage is not simply a technology challenge. It is an infrastructure and digital challenge and increasingly, a collaboration challenge.

For organizations supporting critical infrastructure, this has become an increasingly familiar challenge. Communications, operational technology, and digital infrastructure must work together to create environments where reliability cannot be compromised.

Keeping people at the heart of automation

Automation is attracting considerable attention across defense as organizations are looking to improve efficiency and increase operational tempo. However, automation should never be viewed as an end.

Its greatest value often comes from reducing routine activity rather than replacing people. Predictive maintenance, autonomous monitoring, automated network management and logistics optimization all help reduce the time spent on repetitive tasks, allowing highly trained personnel to focus on areas where experience and judgement remain essential.

The most effective technologies do not replace human capability - they amplify it.

The infrastructure supporting multi-domain operations

As operations become increasingly integrated across land, sea, air, cyber and space, infrastructure is taking on greater strategic importance. Communications, transport, energy, and digital systems all contribute to operational capability, showing how infrastructure and technology are becoming increasingly interdependent.

The movement of people, information, energy, and capability all contribute to operational readiness. Reliable infrastructure enables those elements to function as a single system, ensuring capability can be delivered when and where it is needed.

One example can be seen in the Falkland Islands, where runway infrastructure forms part of maintaining long-term strategic capability and readiness. It illustrates how infrastructure and operational capability are becoming increasingly interconnected.

Bringing innovation into operational use

The UK benefits from an established community of innovators, with government, industry, academia, SMEs and the Armed Forces all contributing to the development of new ideas and technologies. The opportunity now is to ensure those innovations can be adopted enough to meet operational needs.

Collaboration is still a critical part of this process. Bringing together different perspectives helps ensure technology is developed with practical application in mind and can be integrated more effectively into future capability.

Delivering the next phase of defense capability

Much of the technology required to support future defense operations already exists. The focus now needs to be on how quickly it can be integrated and put to operational use, giving the Armed Forces the advantage they need as threats and operating environments continue to change. That requires stronger connections across networks, data, platforms, people and infrastructure.

Collaboration between government, industry, academia, SMEs and the Armed Forces will remain central to moving capability from development into deployment. Technologies also need a clearer and faster route beyond demonstrations and pilots, so useful capability reaches operators when it is needed.

The organizations that succeed will be those able to bring people and technology together across the wider defense environment. Doing that securely, reliably and at pace will determine how effectively innovation translates into operational advantage.

We've featured the best AI tool.

This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit

AI has rewritten the enterprise data playbook. Workflows no longer just create temporary operational data, but vast amounts of high-value assets, from LLM training datasets and model outputs to logs, metadata and archived knowledge that may need to be preserved for years.

As enterprise tech leaders seek to scale infrastructure to meet these demands, storage requirements are undergoing a fundamental shift. Capacity and performance remain critical, but data security has become equally important. Today, long-term data integrity and absolute cyber resilience carry equal weight.

Protecting this data, however, is no longer just about defeating today’s threat vectors. It requires preparing storage infrastructure for a significant shift: the arrival of quantum computing.

Data is a long-term strategic asset, not a short-lived trend

AI is accelerating data growth, but it can also extend the useful life of information. Data recorded today will be harvested for compliance, advanced analytics and model retraining for years to come.

To manage this economically, enterprise architectures rely heavily on high-capacity HDDs. While flash technologies dominate performance-critical hot tiers, HDDs remain the undisputed backbone of large-scale storage, providing the capacity, economics and longevity needed to archive data at scale.

As a result, organizations must consider how to protect not only today's data, but also its future value. After all, if the underlying infrastructure is compromised down the road, the very assets driving future AI innovations become the biggest operational and regulatory liability.

Harvest now, decrypt later

Current encryption technologies remain effective against conventional threats. However, quantum computing is expected to challenge some of the cryptographic methods used for authentication and key exchange.

This has led to concerns around “harvest now, decrypt later” attacks, where encrypted data is collected today with the expectation that future quantum capabilities could potentially decrypt it later.

For organizations storing sensitive intellectual property, research data or AI training datasets, this means security decisions made today could have implications for years to come.

Preparing for that future requires action from security leaders and IT directors now.

Security must be built into the infrastructure

Security is often viewed through the lens of data encryption, and with good reason. Self-encrypting drives (SEDs) provide always-on, hardware-based AES-256 encryption that helps protect data at rest without impacting performance.

But protecting data alone is no longer enough.

Storage devices themselves must be trusted. Firmware, authentication mechanisms, provisioning processes and diagnostic tools all play a role in ensuring a drive operates securely throughout its lifecycle.

If attackers compromise a device's firmware or trust architecture, broader security controls can be undermined regardless of how data is encrypted elsewhere in the system. This makes storage security a critical component of overall cyber resilience.

Implementing quantum-resistant defenses in storage

To counter these emerging attack vectors, the storage industry is actively embedding post-quantum cryptography into hardware architecture of enterprise hard drives. Rather than focusing solely on protecting data, the objective is to protect the trust architecture that underpins the drive itself.

Post quantum cryptography (PQC) technologies are being incorporated into areas such as secure key establishment, firmware authentication, secure provisioning, and trusted diagnostics. These capabilities are designed in alignment with established NIST post-quantum standards and are implemented using hybrid approaches that combine classical cryptography with quantum-resistant algorithms.

In practical terms, this means that the mechanisms responsible for establishing trust, validating firmware integrity and protecting administrative functions can remain resilient against both conventional and future quantum-enabled attacks. With the operational service life of HDDs often spanning 5 years (or more), implementing PQC today helps protect against quantum-based threats that may not materialize for several years, but that we know are coming.

Importantly, HDDs have long incorporated security controls to defend against today's threats. PQC does not replace these protections; it enhances them by adding an additional layer of resilience against emerging attack vectors.

Trust in the AI era

For many years, storage innovation was primarily defined by increases in capacity. Today, the expectations placed on infrastructure are much broader.

Organizations seek storage platforms that can scale with AI-driven data growth, deliver reliable performance, preserve integrity over long retention periods and withstand an increasingly complex threat environment.

PQC represents an important step in that evolution. By extending protection beyond data encryption and into the trust mechanisms that underpin storage devices themselves, PQC-enabled HDDs help organizations prepare for the security challenges of tomorrow while protecting the data they manage today.

As AI continues to elevate the strategic value of enterprise data, security can no longer be a short-term, reactive consideration. Trust must be engineered directly into the hardware layer and built to outlast the threats of today, tomorrow and the quantum era ahead of us.

We've featured the best SSD.

This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit

• 153 million US driving licences have been leaked on a Russian cybercrime platform
• Among those apaprently discovered in the stolen data is US Secretary of Defense Pete Hegseth
• The FBI is now investigating the leak, which has been traced to an identity verification company

A data leak of 153 million US drivers licenses is said to have been shared on a Russian cybercrime forum, with US Secretary of Defense Pete Hegseth among those leaked prompting an FBI investigation.

Security researcher Brian Krebs identified the leak – which included his own data – as originating from a hack of an identity verification service. Louisiana-based IDScan provided ID verification for various well-known companies, including FedEx and Hertz car hire.

The data was shared on a Russian forum called Exploit, a long-established online community of cybercriminals. Following news of the leak, the identity theft service “Nexus” has apparently scrubbed its existence from the Dark Web.

Driving licenses and more

It wasn’t just US driving licenses that were found in the archive of recently-collected personal data. Krebs’ investigation found that Nexus claimed other types of data, and found a further 1.1 million driving licenses from Canada.

Other identity documentation alleged to be in the leak include 10 million identification cards, three million travel documents and international IDs, and 579,000 medical cards. The data was available to browse, notes Krebs, with Nexus providing details: “Records are available to preview before purchase with pertinent information redacted. Customer photos are displayed if available.”

The leak has a personal dimension for Krebs. Not only was his driving license in the collection, so was that of his mother. It has proved to be a useful coincidence, one that has enabled the security and privacy researcher to establish how the data was sourced by Nexus.

Both licenses were used for a car hire, which Krebs traced to Hertz. Others affected by the leak had also used the service, which has used New Orleans-based IDscan for identity verification.

The company, which claims to perform 21 million verifications a month, is yet to issue a statement on the matter. Its marketing and operations leader, Jillian Kossman, told the journalist: “At this point I’m not able to share any additional information, but the updates you have provided have been welcome, and helpful to our team’s investigation.”

Where is the data?

Krebs reports that he was alerted to the data on August 31, 2026, little over a week ago. Regular checking noted that the data was still being added to, increasing by “nearly 400,000” records prior to publishing his investigation on September 1.

Since then, however, it seems that Nexus has vanished, along with the data. But how widely was the data downloaded before that happened? While the FBI investigates, it falls on the American and Canadian public to be extra vigilant and wary of identity fraud.

• Huntress warns fake GTA 6 ISOs spreading malware ahead of official Nov 19, 2026 release
• Packages deliver RATs, infostealers, and Chaos ransomware disguised as game installers
• Users urged to avoid pirated downloads; infected systems should be reimaged and credentials reset

Grand Theft Auto 6 (GTA 6), one of the most anticipated computer games of all time, is due to launch on November 19, 2026 - so everything found online before that is almost certainly malware.

This is the warning sent out by security researchers Huntress, which said it recently saw one variant deploying all sorts of filth, from remote access trojans (RAT), across infostealers, to full-blown ransomware encryptors.

The story behind GTA 6

GTA 6 is a third-person action-adventure and open-world gam developed by Rockstar Games, which egan preliminary work more than a decade ago, and has allegedly spent more than a billion dollars during that decade and a half, which would make it, by far, the most expensive game ever developed.

It is also a sequel to GTA 5, a game that was sold in more than 230 million copies around the world, which made it one of the most popular games of all time.

In late August 2026, someone going by the alias LEEK claimed to have obtained a working, playable build of the game, roughly six months before the official release. They posted numerous screenshots and videos of them playing the game, even writing their nickname onto a wall, using a rifle to prove the authenticity. Truth be told, even without this, people would have still probably searched for, and downloaded, fake installers. This only made the problem worse.

And a major problem, it definitely is. Huntress is now saying it is seeing websites ranking relatively high (through SEO poisoning), offering for download an ISO of the game. Similar ISOs are circulating around different gaming forums, torrenting sites, and social media channels.

An ISO file is a digital copy of an entire disc, such as a CD, DVD, or Blu-ray, stored as one file. Users can download an ISO (which can weigh tens or hundreds of gigabytes), mount it into a virtual drive, and the computer will treat it like a physical disc.

Huntress found some ISOs weighing more than 100GB which was done just to make it seem authentic - the actual malware was “a factor smaller”. The ISOs they analyzed contained multiple variants, including NJRAT and CDRAT (two remote access trojans), Mercurial Grabber (an infostealer grabbing Roblox Studio cookies, Minecraft session data, Discord tokens, Chrome passwords and cookies, system information, IP addresses, and geolocation, Windows product keys, and screenshots), and Chaos Ransomware. The package also contained a legitimate, regular browser - “Just for kicks,” apparently.

A plausible failure

During the “game” installation, the installer displays a message in Russian, saying the product is unlicensed and that there is a good chance it won’t run. If that happens, the user is told to reach out to a specific Gmail address to receive an “updated crack”. After the installation completes, the victim will get that exact popup, saying “License not found”. All of this is just a smoke screen, to make the victim not suspicious as to why the “game” won’t run.

There is no way of telling how many people fell for the ruse and installed malware on their devices. Huntress says that generally speaking, trying to download cracked and pirated software is a bad idea, which is even worse if the game in question has not yet been released.

“This is fertile ground for scams and threat actors attempting to take advantage of the impatient and overeager,” the researchers said.

The good news is that all of the malware being distributed there is not new. Some of the variants contained in the ISOs are several years old, meaning most antivirus programs, such as Windows Defender for example, can easily detect it and stop it from compromising the system.

Those that do end up infected should disconnect the machine from the internet, reset all passwords, enable 2FA wherever possible, and do a complete reimage of the compromised system.

• Proofpoint detailed BlueMoon, an exploit kit chaining two Chromium flaws and one Windows bug
• Four groups, including China‑aligned TA412, used it loudly against NGOs, aerospace, and manufacturing targets
• Exploits were “patch‑gap” zero‑days; all flaws now patched

Four hacking groups, including some tied to the Chinese government, were seen using the exact same exploit kit in a span of a week, suggesting a certain “fear of missing out” among the criminals, experts have warned.

Security researchers Proofpoint have detailed BlueMoon, an exploit kit that leverages three vulnerabilities: two in Chromium, and one in older versions of Windows: Windows 10 (October 2018 Update), Windows Server 2019, Windows 10 2004, WIndows Server 2022, and the initial release of Windows 11.

The kit was first seen being used on August 28 2026, by a threat actor tracked as TA412, a China-aligned state-sponsored threat actor that was observed in the past targeting businesses using Microsoft SharePoint. TA412, also known as Violet Typhoon, used BlueMoon to “repeatedly target a small number of non-governmental organizations (NGOs), mining companies, and physical commodity trading firms in the United States.”

Soon after that, three others were spotted: UNK_LateNight, another China-aligned espionage group which targeted multiple US aerospace companies, UNK_DoubleCheck, a group going after a Vietnamese manufacturing entity, and UNK_QuietRacket, a threat actor taking aim at organizations across Singapore and Indonesia.

What all of these groups have in common is the fact that they did not try particularly hard to hide their activity. This is rather unusual, since a stealthy approach usually guarantees that a vulnerability can be exploited for longer.

Front running the Chromium supply chain train

BlueMoon takes advantage of three flaws, two in Chromium and one in older Windows variants. The Chromium vulnerabilities were found in V8, the JavaScript engine that the browsers use to allow applications to run efficiently. The first one is a “type confusion bug”, tracked as CVE-2026-85046, and assigned a severity score of 8.8/10 (high). The latter is a “sandbox escape” flaw, for which Google did not assign a CVE or a severity score.

The Windows bug, on the other hand, is tracked as CVE-2026-85880, and was given a severity score of 7.8/10 (high). It is described as a “heap-based buffer overflow” vulnerability in Windows Advanced Local Procedure Call, allowing malicious actors who can already execute code inside a low-privilege AppContainer to escape the sandbox and elevate privileges to SYSTEM. No additional user interaction is required.

Proofpoint has a theory as to why the crooks decided to be loud, instead of flying under the radar. Apparently, there is a very short window of opportunity between Google patching a Chromium vulnerability, and it being deployed to a browser such as Edge, or Brave, This window of opportunity also allows crooks to see how Google fixed a flaw, reverse-engineer it, and deploy an exploit before the browser is patched. This would mean that there is no time to be stealthy.

No time to hide

“Both V8 vulnerabilities were ‘patch-gap’ zero-days at the time of the observed activity,” Proofpoint said. “In other words, while they were known vulnerabilities already fixed in public upstream Chromium source code, they remained unpatched in the latest stable releases of Chrome and Chromium-based browsers available to the public. It is likely that the exploit kit developer used these publicly available Chromium patches to weaponize the browser exploit chain.”

Another important factor is Artificial Intelligence. It would seem that AI has made flaw detection significantly faster, reducing the barrier to entry and making threat actors move more loudly.

“A fully weaponized Chrome exploit chain has historically been a high-value, rare capability. BlueMoon was developed, deployed rapidly, and shared across multiple threat actors within days in a manner that had high detection signals. This may reflect a reduced cost and barrier to entry for this class of capability, as AI agents increasingly enable threat actor exploit development,” Proofpoint stressed.

All three flaws have since been patched, so make sure you’re running the latest version of both the OS and the Chromium browser.

Via Ars Technica

• Huntress warns of phishing campaign abusing Adobe branding with browser‑in‑the‑browser trick
• Victims lured into fake update pages, unknowingly installing rogue ScreenConnect clients
• Attackers gain persistent remote access; defenders urged to restrict RMM installs and monitor IoCs

Security researchers Huntress have warned of an ongoing phishing campaign that abuses Adobe’s brand while deploying clever browser-in-the-browser (BitB) techniques to trick the victims.

The goal is to deliver rogue ScreenConnect clients which would grant the attackers persistent access to target devices.

In its report, Huntress says it could not find the lure itself and thus could not report what the scam looks like. However, it saw the victims clicking on a link in the email and then being redirected to a typosquatted domain https[://]adoube[.]vu that spoofs an Adobe landing page.

We heard you like browsers…

This is where we get to the scam’s unique twist. Usually, phishing lures would simply redirect victims to a malicious website which could be identified simply by looking at the address bar. If the domain differs from the legitimate one, the scam falls apart. To work around that problem, scammers came with a solution called “browser in the browser”.

Using either HTML, CSS, or JavaScript, the crooks would create an entire fake browser window, including the address bar, URL, padlock icon, and more, inside the actual webpage content itself. Therefore, if the victim isn’t all too careful, they might look at the fake address bar, see a legitimate URL, and believe they are visiting the correct website.

In this fake browser window, the fraudsters display a blurred .PDF document. Overlaid is a message saying the documents are “secured” and created with “the latest version of Adobe.” The only way to read them, the message continues, is to “update or download Adobe PDF Reader.” Expectedly, there is a big “View Files” button just under the notification, leading to a different, equally fake BitB page, showing the download progress. In the background, something gets downloaded.

Victims might think they’re getting a PDF reader, while in reality they’re getting a rogue version of ScreenConnect.

Poisoned ScreenConnect instances

On its own, ScreenConnect is not malware, or dangerous in any other way. It is a legitimate remote access and support software, similar to TeamViewer, AnyDesk, or Remote Desktop, allowing IT professionals remotely connect to and control computers and other devices. These variants, however, are tainted to enable threat actors to obtain persistent remote access to their targets’ endpoints, Huntress explained.

“The first initial remote client installed was the rogue ScreenConnect Client configured to communicate with instance-uxh86b-relay[.]screenconnect[.]com. The attacker used a legitimate ScreenConnect Trial Relay domain to further avoid detection,” the researchers said. “This initial malicious ScreenConnect Client used the native Windows command shell and curl to retrieve and install a second malicious ScreenConnect Client configured to communicate with attacker-controlled IP. Both clients established service-based persistence for continued remote access.”

After installation, the attackers used the second ScreenConnect session to run HideCursor.exe, an executable, as the name suggests, that helps the attackers hide their mouse activity.

Huntress’ researchers don’t know what the endgame is, since the threat actors were spotted and shut down in this stage of the attack. The researchers also did not share the details about the target, such as the size of the organization, or the industry it operates in. Therefore, it is impossible to even speculate on the nature of the attack and if the threat actors aimed to install ransomware.

Still, the researchers stressed the importance of training employees to “treat unexpected software update prompts and file-viewing pages with caution”, and to make sure they know how to verify downloads through trusted channels. IT teams should also restrict who can install remote-management tools, maintain an approved inventory of RMM software, and alert on new or unapproved ScreenConnect clients, unusual relay connections, and executables launched from the user Downloads folders.

Finally, businesses should monitor for Indicators of Compromise (IoC) listed on this page.

• Bitdefender finds Google Play Early Access platform could give malicious apps an easy breeding ground
• User reviews and ratings are not publicly displayed, removing the ability for users to evaluate if an app is legitimate
• Games, casinos, and utility apps are being loaded with malicious packages and downloaded thousands of times

Google has unveiled an Early Access program for the Play Store, allowing developers to list early-access apps for testing and feedback.

While great for smaller apps looking to weed out any wrinkles in their apps, Early Access also offers a lucrative way for malicious actors to lure users into downloading apps that look legitimate, but can hide malicious packages inside.

However, new research from Bitdefender notes the fact that the Early Access program hides public reviews and ratings could lead to an app ecosystem filled with scams, fake casinos, and malware-laden packages masquerading as legitimate software.

Early Access is filled with dangerous apps

When looking for apps on the normal Play Store, one of the first things users are greeted with is an app’s rating. For fake or malicious apps, users can quickly evaluate whether or not to download the app thanks to the star rating and user reviews. While there is the potential for nefarious developers to fake reviews and ratings there is at least some ability to check if an app is legitimate.

But the Early Access system does away with public user ratings and reviews entirely. There is effectively no way for users who fall victim to a fake app to publicly warn other users not to download the app.

Add to this equation that ability for developers to show off their apps through sponsored Facebook and TikTok videos, offering outrageous rewards or using deepfakes of celebrities to entice users to install their apps.

This is especially true for fake gambling apps. Bitdefender has spotted numerous adverts for casino apps using deepfakes of well known celebrities such as Cristiano Ronaldo, Jason Statham, and Andrew Tate. These apps actively push users into the Google Play Early Access store, or direct to the apps website.

Other listings mimic well-known apps, adding financial incentives for downloading such as doubling the money you invest every time you complete a task or overcome an obstacle. Other apps take advantage of the hype for upcoming game releases, such as Grand Theft Auto V and VI. These apps often use screenshots from the actual games in order to appear legitimate.

When detected as illegitimate, these scam apps will often be deleted before being replaced by exact copies that perform the same malicious functions. Some illegitimate apps have been downloaded thousands of times, Bitdefender said, but many remain available on the Google Play Early Access store.

But the scam apps aren’t limited to games and casino apps. Bitdefender also saw numerous apps offering utility functions such as QR code scanners or PDF readers. In some circumstances, the exact same apps were listed multiple times by different developers - likely to expand the reach and maximize the number of downloads.

Bitdefender notes that Google Play’s reputation relies on users being able to trust the apps they are downloading, but the Early Access program removes almost every way users can detect a malicious app before installing.

• New Incogni research has found that the privacy preferences of Americans don't really align with what they say
• Many of those with 'nothing to hide' will happily snoop on the phones of their family members and partners
• But those same people tend to get twitchy when handing over their phone to strangers, or their data to the government

A new survey by Incogni has found almost half of Americans say they have ‘nothing to hide’ when it comes to their privacy, but almost immediately change their perspective when it comes to strangers looking at their phone - or sharing their private messages with the federal government.

Even when offered substantial sums of money, many of those with nothing to hide still wouldn’t hand over their devices, and their personal habits such as covering cameras or installing privacy screens show a level of contradiction in what they say, and how they behave.

Of those surveyed as part of Incogni’s research, Gen Z were the most likely to say they had nothing to hide at 57%, whereas just 26% of Baby Boomers offered the same response.

Americans don't want strangers or the government accessing their phones

As it turns out, those who fell into the 45% of respondents who said they had nothing to hide were more likely to snoop on other people's devices. In fact, when polled on whether they looked at other people’s devices in public, people with nothing to hide were double as likely (42%) to snoop compared to their something to hide counterparts (27%).

Those with nothing to hide were also more likely to look through the phones of their partners and family members without permission. In fact, 41% who fell into this category admitted to snooping on their partners phones, and 35% had looked through their family members' phones.

Despite claiming to have nothing to hide, 39% still covered their cameras with tape, stickers, or sliding covers - especially those of Gen Z. Over a quarter of respondents also said that they deliberately obscure their personal information when signing up to online services with fake names, false dates of birth, and masked emails.

But the most interesting data comes from paying for privacy. 41% of those who said they have nothing to hide would pay more for a product if it was better for their privacy. But when offered money in return for handing over their phone to a stranger, 60% of respondents refused any amount of money. 20% said it would take an amount of $1 million or more, and just 6% offered access for $100 or less.

When breaking these numbers down by group, 58% of those with nothing to hide would not let a stranger access their unlocked phone for any amount of money.

Even when offered three months of their salary, just 26% of respondents would hand over their SMS, chat-app, and email messages with law enforcement. This number drops to 25% with Big Tech companies, 24% for local government, and a staggering 21% for the federal government.

Incogni theorizes that those who said they have nothing to hide may be equating privacy with secretiveness and secretiveness with guilt. It may also be true that many people fail to see how their seemingly innocent data, such as an email address or phone number, should be kept private.

As numerous data breaches have shown, the leaking of such information can lead to phishing emails, scams, and general harassment or doxxing. Incogni says that people fail to see why this information should stay private, especially in an era when social media and the websites we use hoover up as much information as possible to be sold to advertisers and third-parties.

“The findings suggest that the “nothing to hide” argument may therefore say less about how much people actually value privacy than about how difficult it is to see the consequences of losing it,” the report concludes.

The AI infrastructure discussion is typically framed around the cost of data centers, the power requirements, and the compute needed to train and run models, including GPUs and high-performance storage. That’s hardly surprising given the eye-watering investment numbers occupying the headlines.

The other key commodity, of course, is data to fuel those models. According to Stanford University’s 2025 AI Index Report, dataset sizes for training LLMs are doubling every eight months. In practical terms, as each model is built, some data will move quickly into curation and model-development environments, where fast access is essential.

Much of it, however, will wait longer while teams establish its relevance to a particular AI use case – not sitting idle, but held securely and ready to move quickly into curation, training and transformation pipelines when needed.

From a storage perspective, this raises a point that is easy to overlook: a dataset does not need the same performance at every stage of the AI pipeline. What matters is that it is ready when it is needed – not that it sits on always-on, high-performance infrastructure throughout, which at scale becomes unnecessarily expensive.

The question for infrastructure planners, then, is not whether AI needs fast storage, but where organizations should keep the very large datasets that will be required in future, before they are ready to be processed. That choice is a strategic one, not a housekeeping one.

The right capacity tier should keep data protected and readily recoverable into AI, training and transformation pipelines, puts performance only where the work is actually happening, and returns the difference to the budget.

Your data portfolio as strategic advantage

As every organization's mission is different, so too each will be at a different stage of the AI journey. Some have raced ahead with systems already in production, while many others continue to explore how the data they already hold could support AI initiatives – documents, images and video, operational records, information collected through connected systems; the list goes on.

This is why knowing your own data is fast becoming a competitive lever rather than an IT chore. Models are available to everyone, so proprietary data is your competitive advantage – if you can access it and use it at scale.

The organizations that will move fastest are the ones that already know what they hold, where it sits, and how quickly it can be put to work. Shortening the distance between a business question and the data that answers it is now a measure of how fast a company can execute and succeed.

So data is not simply an input to AI: it is what shapes the model. The more of an organization's own data it can bring to bear, the sharper and more specific the resulting tools become, which is why the working assumption should be that almost anything the business holds is potentially useful.

The conventional approach has been to hold large datasets in a disk-based data lake until they are needed for further processing. Yet as data sets grow ever larger, so too could cost. If every candidate dataset has to live on always-on, high-performance infrastructure, cost sets the ceiling on how much data an organization can afford to keep in play at all.

The challenge, then, is to keep everything available to workflows as needed, so that the deciding factor is the use case, not the storage bill.

Tale of the tape

The smart play therefore is not to spend more, but to stop overspending where there is a better way. And it turns out one of the strongest answers here is a technology that has never stopped innovating: tape. Most people still associate it with backup and long-term archive – a role it continues to play well – but successive LTO generations have transformed its capacity, throughput and security while the industry looked elsewhere.

The latest tape technology and systems now behave like any other tier in the stack, ready to stream data into fast storage when curation or training is ready for it. And tape’s economics get better as it grows. At the multi-petabyte scale AI programs now reach, cost per terabyte is a fraction of flash or even HDD infrastructure. Performance and capacity can also scale independently, adding more drives for throughput and more cartridges for capacity.

When considered with tape’s extraordinary energy efficiency, this storage technology emerges as a strategic capability to build into the data center, allowing an organization to keep its entire data estate in play, at a cost that scales predictably.

A safer place for valuable data

Cost of storage and operation often gets projects approved, yet protection is the one that keeps people up at night. Here, tape offers something the online tiers structurally cannot. Encryption is handled in hardware on the cartridge. Write-Once-Read-Many (WORM) media makes a dataset immutable in the physical sense, so that irreplaceable data cannot be rewritten.

And for the most valuable material, tape sets can leave the library altogether and be stored in a secure location or offsite – fully offline, fully air-gapped, and insulated from anything that happens to the production environment.

What counts now in building data and AI pipelines for your organization is ensuring data is ready to move into the right performance tier the moment it is needed. Data is the fuel for the models an organization builds, the decisions it makes, and how fast it can act on either.

Tape is what makes it affordable to keep all of that ‘data fuel’ at scale, protect what cannot be replaced, and put any of it to work on demand. Build it in now, and what you can do with your data is no longer limited by what you can afford to keep online, and instead becomes the means to get, and stay, ahead of your competition.

We've featured the best cloud storage.

This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit

• Calif researchers found a zero‑click WeChat VoIP flaw enabling account takeover via calls
• “WeWorm” spreads through ringing calls; victims need not answer to be compromised
• Tencent patched in Android 8.0.77 and iOS 8.0.76; no exploitation seen in the wild

Security researchers have found a flaw in WeChat which allows malicious actors to take over people’s accounts on both Android and iOS devices - but what makes this flaw stand out is the fact that it’s a zero-click bug - victims need not do a thing to be compromised.

WeChat is a “super-app”, allegedly used by roughly 1.4 billion people, and is especially popular in China. It started as a communications app, letting users send messages, and make voice and video calls, and has evolved to function as a social network, allowing users to share photos and videos, as well as a payment app through which users can transfer money, pay for things, order food, book taxis, and even access government and business services.

Security researchers from Calif have now disclosed finding a ‘memory corruption’ issue in WeChat's VoIP stack. For now, they decided not to share the technical details, and to instead demonstrate the flaw “at an upcoming conference.” To that end, they built a worm called WeWorm, capable of taking over target WeChat accounts and spread through phone calls made via the app.

A phone call would suffice

In practice, it works remarkably simple: an attacker uses WeChat to call a person they have in their contacts list (this is a prerequisite). They can use both an Android and an iOS device, and can call anyone, regardless of the model or the OS they’re using. As soon as the phone starts ringing, WeWorm gets to work, “worming” its way into the victim’s device.

The victim does not even need to answer the phone - having it ring is enough. If they answer, they’ll hear nothing but silence, yet the worm will continue operating. If they decline the call, the attack stops, but this is hardly a mitigation - the attacker can simply call again while the victim is asleep (or otherwise away from their device).

Within a few seconds, the attacker will have access to the victim’s WeChat account, including their messages, contacts list, and virtually anything else found in the app. What makes this bug particularly worrisome on the surface is the fact that WeChat can be used to transfer money and pay for things, but WeChat Pay has additional authentication and risk controls designed to prevent that from happening.

The good news is that there is no evidence of this flaw being exploited in the wild. The bad news is that this is not the first zero-click flaw found in modern-day smartphones, and most likely will not be the last one.

Tencent's response

Calif said it responsibly disclosed its findings to WeChat’s parent company Tencent, who came back with a patch. Versions 8.0.77 for Android and 8.0.76 for iOS have apparently solved the problem, although

Tencent did not list any details in its patch notes, simply saying the version brought “bug fixes”, but in a statement shared with The Hacker News, it said the exploit has been “mitigated for all users”, and that it was applied server-side - users need not install anything, aside from the patch.

It’s also worth mentioning that WeChat has apps for HarmonyOS, Windows, Mac, and Linux. However, it would appear that Calif did not test those, and Tencent did not include them in its patch. The researchers did say that they would be looking into this same flaw in other products, too:

“This specific WeChat bug is one instance of the many unconventional attack surfaces that are present across many messaging apps,” they said. “We're conducting more of this research across other apps and attack surfaces, while working with app developers on attack surface reduction. This may take an industry-wide effort, since some of it depends on the platform owners. Once that work is further along, we'll share our progress, including the technical details of this WeChat bug.”

• Microsoft has fixed no fewer than 974 vulnerabilities in its latest Patch Tuesday release
• Two were already being exploited in the wild, 114 categorized as 'Critical'
• AI is to blame for boosting CVE discovery and also intensifying attacks

Microsoft's September 2026 Patch Tuesday has become its biggest security release on record, with the company issuing fixes for a staggering 974 vulnerabilities across the entire stack.

According to the company's release notes, an overwhelming majority (723) of the vulnerabilities addressed related to Windows, with Office coming in at second place with 111 of its own vulnerabilities being addressed.

While it's clear that the number of vulnerabilities is going up year-over-year, it's likely that the company was also simply able to find more of them that would otherwise have slipped through the net thanks to AI-assisted discovery tools.

This is Microsoft's biggest Patch Tuesday ever

Speaking about the September 2026 Patch Tuesday in a blog post, Dustin Childs explains that this could be the start of the "new normal." Childs goes on to reveal that Microsoft has patched 2,760 CVEs this year to date – more than double any other year that precedes it.

Childs' figures show that the company patched 1,139 CVEs in the whole of 2025, and a much lower 492 a decade ago in 2016. According to the post, 114 of the vulnerabilities patched in this latest update were 'Critical' – more than one in 10.

In its own notes, Microsoft described CVE-2026-85880 and CVE-2026-81963 as especially notable because they're both being actively exploited, hence the push to get them fixed and for customers to install the update.

Elsewhere in the industry, Microsoft isn't the only company addressing a higher volume of bugs. Childs also highlighted high activity from Adobe, while a number of browser developers including Google, Mozilla, Brave and Microsoft itself have doubled the release cycle to two weeks in order to get fixes into customer hands more quickly.

Besides fixing exploitable bugs, Microsoft also used the opportunity to issue fixes to known issues – including fixing Teams and Outlook crashes on Arm64 PCs – as well as to upgrade Copilot+ AI components.

• CISA, NSA, FBI warn Chinese AI firms of industrial‑scale knowledge distillation
• Companies like DeepSeek, Moonshot, Alibaba allegedly extracted billions of tokens from US frontier models
• Advisory urges detection of malicious prompts, deceptive responses to distillation, and cross‑provider intelligence sharing

Chinese AI companies’ core development strategy is to steal proprietary functionalities and capabilities from their US counterparts, law enforcement agencies have warned.

The US Cybersecurity and Infrastructure Security Agency (CISA) has published a new security advisory, drafted jointly with the National Security Agency (NSA) and the Federal Bureau of Investigation (FBI), warning American AI companies about an ongoing “aggressive, malicious, and targeted distillation activities at an industrial scale,” and sharing recommended mitigation steps.

Knowledge distillation

IBM defines knowledge distillation as a “machine learning technique that aims to transfer the learnings of a large pre-trained model, the ‘teacher model,’ to a smaller ‘student model’.” It is used in deep learning as a form of model compression and knowledge transfer, it added, particularly for massive deep neural networks.

So, knowledge distillation is not illegal or malicious, per se. Its goal is to train a more compact model to mimic a larger, more complex one. In the security advisory, the agencies stress it is “recognized as a legitimate and useful technique in AI research,” but add that China-based AI companies are using it in ill will.

In other words, the agencies claim that instead of spending months and millions developing new capabilities for their models, the Chinese are simply sending huge numbers of carefully designed questions to US models and extracting the answers.

Which companies are engaged in knowledge distillation?

Apparently, all companies worth anything. DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI all allegedly “extracted billions of tokens across millions of exchanges/requests from US frontier AI models, including variants of Claude, GPT, Gemini, and Grok, since at least late 2024.” CISA also stressed that this was likely done with the awareness of the Chinese government. It hasn’t outright said, “with its blessing”, although it could be read between the lines.

The advisory shares a thorough list of all the models that were being trained, as well as all the models being taken advantage of.

On the Chinese side, they include DeepSeek R1 and V3 models, Moonshot’s Kimi-K2 and Kimi-K3 models, and MiniMax’s M2 model. On the US side, they start with earlier models such as GPT-4, Claude 3.7, and Gemini 2.5 Flash Preview, all the way to Claude Fable 5, GPT-5, and similar.

When done in good faith, knowledge distillation is not illegal. However, the report says the companies routed the requests through multiple accounts, different API access points, multiple cloud providers, third-party AI aggregators, proxy services and “transfer stations”, as well as premium subscriptions shared between developers, all in an attempt to work around defenders trying to disrupt the process.

“This represents systematic extraction of proprietary functionalities and capabilities threatening U.S. technological leadership. Addressing industrial-scale distillation merits a coordinated response across the AI ecosystem, including effective information-sharing, spanning the U.S. Government, private industry, and allied nations,” the agencies concluded.

What US companies should be doing

To defend their intellectual property (and thus remain ahead of Chinese competing models) US AI companies should implement comprehensive detection and mitigation, the agencies said. That means hunting for anomalous and malicious prompts, accounts, networks, and behaviors. Furthermore, they should monitor subscription-to-usage ratios, immediate maximum usage from new accounts, and enterprise-scale throughput patterns.

The second step is to “deploy targeted response changes”: “Subtly alter responses for suspected malicious distillation attempts to attenuate the payoffs to companies conducting industrial-scale distillation campaigns.” In other words, AI companies should make sure their products lie when they spot they were being distilled for knowledge.

Finally, US AI firms should set up cross-organization intelligence sharing, correlating activity across model providers, cloud platforms, and API aggregators.

The bottleneck on sophisticated cyber operations that target nation states is breaking. Conducting a large-scale cyber attack used to mean scaling expert talent.

When the cost of adding a capable attacker approaches the cost of compute, the economics of offense fundamentally change.

This is already operational: Dream's threat research recovered an autonomous multi-agent framework that ran intrusion campaigns against government entities in Asia, executing twelve attack waves in four days with eight parallel agents, compromising 85 government accounts, and using a closed learning loop to adapt after failure.

The advantage is shifting from the number of experts to how effectively their expertise can be scaled.

AI benefits both attackers and defenders, but defenders start with a unique advantage: they already own the map attackers must discover.

Defenders that understand their environment can use AI to turn that knowledge into operational scale.

The Autonomous AI Government Hacker

In July, our threat research team recovered the operational workspace of an autonomous multi-agent framework that had been conducting intrusion campaigns against government entities in Asia.

Over roughly four days, the framework executed twelve attack waves and ran up to eight AI agents in parallel. Built on the publicly available Hermes and OpenClaw frameworks, it compromised 85 government employee accounts and used 84 of them to pivot through a government single sign-on environment.

What’s really intriguing is its autonomous operational decision making.

Assigning confidence scores

Every discovery was assigned a Bayesian confidence score to assess different paths and then chose how to proceed, just like an actual team.

Similarly, when an attack path failed, the framework automatically entered what it called a Learning Cycle, searched vulnerability databases and security research techniques relevant to that government's technology stack, and tried again. The framework audited itself – it created a closed learning loop: investigate, validate, act, observe the result, update its operational knowledge, and try again.

This was not a self-improving model. It was a self-adapting cyber attacker – there is a real expert behind it, embedded as AI system. The fundamentals of this attack weren’t even particularly impressive or novel. It is the scale – and the prospect for nearly infinite scale – that is daunting.

Until recently, one of the limiting factors in scaling sophisticated offensive operations was the expert reasoning required to decide what to investigate, validate findings, connect them into viable attack paths, and adapt when those paths failed. It was expensive, both in dollars and in expertise. That scarcity placed a natural constraint on offensive scale - scaling a sophisticated operation meant scaling skilled people, time and coordination.

AI is beginning to automate precisely that expensive layer of the operation: deciding what to investigate, validating hypotheses, learning from failure and choosing what to try next. Talent still determines the quality of those decisions. But the number of talented people no longer has to determine how many times those decisions can be made in parallel.

What happens when scaling an offensive operation no longer requires scaling the number of experts behind it at the same rate?

As someone who has spent 15 years in both offensive and defensive cyber roles, it’s becoming clearer every day that AI has changed that equation - the historical relationship between the amount of expert talent an organization has and the scale at which it can operate is beginning to break down.

AI does not eliminate talent - it changes what talent can scale.

An Attack Surface the Size of a Country

Government IT infrastructure is an interconnected ecosystem built over decades. It consists of ministries, municipalities, operational technology, legacy applications, cloud services, contractors, suppliers, and countless trust relationships connecting them together.

These connections typically exist for legitimate operational reasons (or at least historically legitimate reasons).

Of course, every connection is also a potential vulnerability.

This is how modern government attacks spread - not necessarily by exploiting one critical vulnerability, but by chaining together many ordinary ones.

Historically, this challenged both sides. No defensive team could continuously reason over every asset, identity, configuration, vulnerability and trust relationship across an entire country. But attackers faced a version of the same constraint. Their experts also had to decide where to spend their time to find a viable path from intrusion to crown jewel

Autonomous systems change that.

An autonomous attacker does not need to understand the entire government environment in advance. It can explore it continuously: discover a relationship, form a hypothesis, test it, learn from the result and move to the next one.

For the first time, governments may face adversaries capable of reasoning over national-scale attack surfaces faster than the institutions responsible for defending them.

The Race to Change the Outcome

The dramatic decline in the cost of offensive cyber expertise, via leveraging and weaponizing agents, is a tectonic shift. Until now, this was a skill limited to a select few and came with a high price tag.

Today, discovering, prioritizing and combining these techniques into viable attack paths is cheap, and one can repeat the process at machine speed.

With the pace of AI development, that statement becomes more true every day.

Offensive capability is becoming cheaper, faster and easier to reproduce.

But there is another side to this equation.

Defenders have always had structural advantages: more telemetry, deeper context, persistent access to their infrastructure, and knowledge of its configurations, identities and relationships, while also have a much better ability to act.

They too had the constraint of human capacity. No team could continuously reason over all that information, across every asset and relationship, all the time. The same AI that benefits attackers may operationalize defender’s historical edge at scale too.

This is where time plays a key role. Analyzing everything is not the same as defending everything. If AI detects a compromised identity in seconds but the credential remains active for six hours, the attacker still has six hours. If it identifies an exploitable path to a critical system but remediation takes three weeks, that path remains open for three weeks.

The opportunity, then, is not simply better analysis. It is reducing time-to-effective-action: the time between understanding a risk and changing the outcome.

And "effective" matters- disabling an identity, changing a firewall rule or patching a vulnerability is not enough. The system must verify that the attacker can no longer achieve its objective.

The defensive loop cannot end with intelligence - or even with action. It has to end with a verified security outcome.

The Gap That Matters

AI does not inevitably favor the attacker.

The framework we recovered had to steal its map of the environment, one probe at a time. Defenders already have that map. Every configuration, credential, telemetry stream and trust relationship could take an attacker – even an AI attacker – days to weeks to discover. What defenders could never do was reason over all the assets they had, continuously, due to the lack of talent capacity to do that.

AI begins to remove that human-attention constraint. It allows defenders to amplify expert talent across thousands of investigations in parallel, continuously identifying attack paths, prioritizing those that pose the greatest risk, and focusing action where it matters most.

Attackers get the same leverage. But they don't start from the same place. Defenders have a home-field advantage: they already know and control the environment the attacker must discover.

The gap that matters is no longer simply the number of experts on either side. It is how effectively each side can scale that expertise- and direct it toward the right risks first.

Ultimately, the race is not about who can know more.

It is about who can scale talent in the right way- and turn that scale into an outcome first.

We've ranked and reviewed the best antivirus software available.

This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit

• Check Point Research exposed coerced insider flaw in ChatGPT’s agent architecture
• Containers shared metadata via internal service, enabling cross‑account prompt injection and data theft
• OpenAI closed the path, but CPR warns similar risks may exist in other AI platforms

ChatGPT’s AI agents were allowed to pull sensitive data from one account shared with an entirely different account because, colloquially speaking, all agents used to walk down the same hallways, experts have warned.

A new report from security experts Check Point Research (CPR) dubbed the flaw “coerced insider”, since it revolves around persuading the agent instead of abusing a vulnerability.

Coerced insider

When an AI agent is given a task that needs code execution, it handles that task in an isolated container which also sometimes needs to install software. To enable that, without giving containers direct internet access (which would be too risky), OpenAI routes those packages through an internal JFrog Artifactory instance. As a separate security contingency, containers from different accounts cannot talk between themselves.

However - they can reach the same internal service (our proverbial hallways), which exposes an item management feature that lets the containers attach text or binary properties to a repository item. As a result, any container can read back the properties written by any other container.

“Check Point Research confirmed the isolation gap directly: a property written from one account’s container was fully readable from a different account’s container moments later, with data too large for one property simply split into chunks and reassembled on the other end,” the researchers explained.

“The package delivery metadata effectively became a shared clipboard between containers that were supposed to be walled off from one another.”

From there, the exploit turns into your usual, off-the-shelf prompt injection. The only difference is that the malicious prompt is not delivered directly to the victim, but rather left in the hallways, and the results are not shared with the attackers directly, but rather left in those same proverbial hallways, too.

The attacker then delivers a prompt or a shared conversation that instructs the agent to check the same storage during its next ordinary reply. The agent checks, sees the malicious instructions, executes them, all the while replying to the victim’s question in the usual manner. The victim is oblivious to the fact that data theft is taking place in the background.

What kind of information can be stolen?

But this is just half of the equation. How destructive this attack ends up being still depends on the amount of data being shared with the victim agent.

The bare minimum is the information shared while chatting to the agent. It then grows with every connected app: Gmail, Google Drive, Microsoft Teams, GitHub, and similar. “In Check Point Research’s demonstration, ChatGPT retrieved the victim’s email data through their connected Gmail account and delivered it to the attacker’s session, all within a single ordinary turn,” CPR stressed.

The good news is that you’ll likely never be exposed this way, at least not via ChatGPT. CPR says it disclosed the findings to OpenAI, who then confirmed that the specific internal Artifactory instance identified in the research has been commissioned. In other words, the hallways attack path has been closed.

The bad news is that this doesn’t automatically mean everyone’s safe. This particular path might be closed, but the architectural pattern behind the flaw could be present in other platforms, CPR warns.

“Any AI assistant that operates inside an organization’s trust boundary, holding credentials, running code, and reaching connected services, can become what Check Point Research calls a coerced insider,” the report states. “The model itself does not need to be malicious. It only needs to be persuaded, through text it was never meant to trust, to use access that was granted for entirely legitimate reasons.”

Going forward, businesses are advised to learn which AI tools their employees are using, and what those tools are connected to. Then, they should govern what AI tools and agents are allowed to do, treating all of their actions (not just output) as something that needs to be monitored.

• Chrome will get new updates every two weeks to minimize real-world attacks
• Smaller, incremental changes should also make it easier to track any issues
• Other major browsers are also shifting to two-weekly release cycles

Google has confirmed that Chrome has officially moved from a four-week Stable release cycle to a two-week one, with effect from September 8 2026 with the launch of Chrome 153.

Besides adding new features, the main objective is for Google to give us performance and security fixes more promptly in an era of increased complexity and heightened vulnerabilities.

And it's exactly those security concerns that pushed Google to want to double Chrome's update frequency in the first lace, with the company now having to deal with a higher volume of patches than ever before.

Chrome will get updates every two weeks

Together with a higher volume of attacks in general, Google has also benefitted from AI-powered vulnerability discovery tools, giving developers more work to do than before. "With automated AI discovery tools and community bug reports generating higher patch volume, shorter release cycles make managing security fixes significantly simpler," the company wrote.

Crucially, the faster cycle reduces the time between a fix landing in Chrome's public codebase and it actually reaching end users, making it less likely for a bug to be exploited in the wild.

Chrome has been adhering to a four-week cycle since 2021, but the world is a very different place in the space of just half a decade.

With the higher pace of releases, Google also anticipates a smaller scope of changes, which could actually be a good thing because it could be easier for developers to identify what went wrong in the event of any issues.

Desktop, Android and iOS versions of Chrome will all be impacted by the change, with Chrome 154 already slated for a September 22 release.

More broadly, Google says Chrome isn't the only browser getting more frequent updates. Microsoft, Mozilla and Brave are also making similar changes, and they're all undergoing those changes right now.

Enterprise infrastructure has always adapted as scale increased. Virtualization tackled server sprawl, cloud computing reduced the need to provision physical resources for every application, and automation made increasingly complex environments manageable. Artificial intelligence presents a different kind of scaling problem.

The discussion around enterprise AI has largely centered on models, GPUs, and inference performance, but those technologies represent only a fraction of what organizations must operate. Every production AI deployment creates a continuous flow of data that must be ingested, protected, moved, analyzed, retained, governed, and eventually archived.

Those activities place demands on infrastructure that are very different from the workloads storage systems were originally designed to support.

This is becoming increasingly apparent as organizations move beyond pilot projects. AI is no longer a single workload running on isolated infrastructure. A single application may include high-speed storage for model training, object storage for inference data, lower-cost capacity for operational datasets, immutable storage for cyber resilience, and long-term archives to satisfy regulatory requirements.

Traditionally, those functions have been handled by separate products with separate management tools, security policies, and operational teams. That architecture worked reasonably well when data moved slowly and applications followed predictable lifecycles. AI changes both assumptions.

Training datasets expand continuously. New models are introduced far more frequently than traditional enterprise applications. Inference workloads fluctuate as demand changes. The same dataset may move repeatedly between active processing, backup, compliance, and archival over its lifetime.

Each transition introduces another operational task, another opportunity for inconsistency, and another point where administrators must intervene. Before long, the effort required to manage the infrastructure begins to rival the effort required to build the AI applications themselves.

Complexity becomes the real infrastructure challenge

For years, the answer to operational complexity was automation. Administrators automated provisioning, scripted maintenance, and orchestrated repetitive tasks. Those capabilities remain valuable, but they were designed to execute predefined actions under predefined conditions.

AI environments are considerably less predictable. Infrastructure must continually adapt to changing workloads, shifting performance requirements, evolving security policies, and rapidly growing data volumes, often without the benefit of stable operating patterns.

That is where autonomous data infrastructure represents something more substantial than another automation framework. Rather than treating storage as a collection of independent systems, it starts with the assumption that the platform itself should continuously optimize how data is managed throughout its lifecycle. Capacity, performance, protection, and cost become policy decisions rather than infrastructure projects.

Data moves between performance tiers automatically according to business requirements instead of being exported, migrated, and re-imported into separate platforms. A single namespace spans workloads that historically required multiple storage systems, allowing infrastructure to evolve without repeatedly forcing administrators to redesign the environment.

That architectural change may ultimately prove more important than the automation itself. Many organizations underestimate how much operational complexity accumulates simply from running multiple storage platforms. Every environment has its own authentication model, monitoring tools, lifecycle policies, upgrade schedules, recovery procedures, and performance characteristics.

As AI expands across the enterprise, those management layers multiply alongside the data. Reducing the number of operational boundaries often creates greater long-term value than introducing another layer of orchestration.

The same principle applies to cyber resilience. AI has increased the value of enterprise data far beyond traditional business records. Training datasets, model checkpoints, vector indexes, and inference pipelines have become strategic assets in their own right. Protecting them requires more than backup software. It requires infrastructure that assumes failures and attacks will occur and is designed to recover without depending on manual intervention.

Governance becomes part of the data lifecycle

The conversation also extends beyond security to control. As AI initiatives become more strategic, organizations are under growing pressure to understand where data resides, who can access it, and which legal and regulatory frameworks govern it.

That is especially true for enterprises operating across multiple countries or in highly regulated industries, where data residency requirements, digital sovereignty initiatives, and industry-specific compliance obligations increasingly influence infrastructure decisions.

Rather than treating these as separate governance exercises, modern infrastructure must make location, retention, and access policies part of the data lifecycle itself, enabling organizations to meet regulatory requirements without introducing additional operational complexity.

One of the more significant design decisions behind autonomous data infrastructure is that immutability exists within the storage engine itself rather than being implemented solely through administrative policy. Instead of modifying existing data in place, new versions are written separately while previous versions remain intact.

Combined with distributed self-healing that rebuilds only affected objects instead of entire disks, this creates a fundamentally different operational model for resilience. Recovery becomes part of normal system behavior instead of an exceptional event requiring administrators to coordinate lengthy repair efforts.

Infrastructure operators become infrastructure architects

Perhaps the most interesting implication has little to do with storage technology itself. Infrastructure teams are already responsible for environments that are growing faster than headcount, and AI is accelerating that imbalance. The objective is not to remove people from operations, but to reduce the amount of time highly skilled engineers spend on repetitive maintenance that adds little strategic value.

As more routine activities become policy-driven and continuously optimized, infrastructure professionals can devote more attention to architecture, governance, capacity planning, and aligning technology decisions with business priorities.

That evolution mirrors what is happening across software engineering, networking, and cybersecurity. AI is steadily shifting human expertise away from repetitive execution and toward system design, governance, and strategic decision-making. Autonomous data infrastructure reflects the same progression.

Rather than asking administrators to manage an ever-growing collection of storage products, it treats the infrastructure as an adaptive system that operates within policies established by the people responsible for it. The most effective approach is not to take humans out of the loop, but to keep them in control of the decisions that shape security, compliance, and business outcomes while allowing the platform to execute routine operational tasks autonomously.

Viewed from that perspective, autonomous data infrastructure is less about storage than it is about preparing enterprise IT for the next decade. AI has exposed the limitations of architectures built around isolated products, manual coordination, and steadily increasing operational overhead.

Organizations will continue investing in faster GPUs and more capable models, but those investments will deliver their greatest value only if the infrastructure beneath them becomes equally capable of managing complexity. The next generation of enterprise infrastructure will not simply store data more efficiently. It will actively participate in operating the environments that modern AI depends upon.

We've featured the best business intelligence platform.

This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit

• Kinryū Labs found misconfigured APIS database in Vietnam exposing 220M passenger and crew records
• Data included PII, travel details, seat assignments, and baggage references from 2017–2026
• Archive locked and there is no evidence yet of dark web sale

Millions of travellers have had their sensitive information exposed on the internet, thanks to a “series of misconfigurations” discovered in a cloud database, experts have warned.

In early June 2026, security researchers from Kinryū Labs discovered an Elasticsearch cluster which, although inaccessible from the open internet, allowed access through an alternate route - a cloud-based path. Once inside that route, the researchers discovered that the cluster accepted default credentials, granting access to an archive with 29 indices, weighing roughly 107GB.

The archive was apparently generated by an Advance Passenger Information System (APIS), a system airlines use to collect and send passenger and crew information to country authorities before flight arrival or departure. Usually, the system collects people’s names, birth dates, nationalities, passport and travel document numbers, and flight details, which are then used for border control, immigration, and similar cases. In this case, however, it also contained people’s sex, document expiration dates, issuing countries, airlines, departure, destination and transit airports, seat assignments, baggage reference, and more.

It is not known who operated the APIS, or who owns and runs the database. All the researchers managed to find is that it was hosted in Viettel-assigned IP space in Hanoi, Vietnam’s capital.

Who was affected?

Of the 29 discovered indices, two were rather large: one contained 210,318, 069 passenger records, while another 10,465,631 crew records. In total, 220 million records, created between January 2017 and April 2026, from people who traveled to, from, or through Vietnam during that period.

The records don’t correspond to individuals, however. If a person travelled multiple times, they will show up in the archive multiple times. Canadians, Chinese, Korean, and New Zealandian nationals are among the ones whose information was exposed. The database is not limited to a specific airline, either - various airlines in Asia-Pacific, Europe, and Middle East regions were mentioned in the researchers’ report.

Since the researchers could not attribute the database to a specific entity, they reported it to the Vietnamese authorities, different airlines mentioned in the archives, and the country’s CERT (Computer Emergency Response Team), on June 3. The archive was locked down a week later, on June 8. According to BleepingComputer, it was the Singapore Airlines’ security team that took the lead on remediation efforts, telling the researchers they “engaged the relevant parties” and have “taken steps to contain the issue.”

Without a proper audit of the logs, and a full-blown forensic investigation, it is impossible to tell if any threat actors reached the database before the researchers, or if they exfiltrated and used the data found inside in identity theft, wire fraud, or other scams. What’s (somewhat) comforting is that there is no evidence of such activities on the dark web, and no hacking groups have made such claims. No one is selling the archive on the dark web, either.

Number one causes of data spills

Misconfigured databases remain one of the key causes of data leaks. Most businesses generate some type of data on their employees, partners, clients, or customers, and store it in the cloud for easy access and actionable insights. However, some businesses don’t understand the shared responsibility model of cloud security or are simply reckless and sloppy when it comes to securing their cloud-stored data. Others, according to Cassius Edison, COO of Closed Door Security, have a problem with visibility of their IT real estate:

“The range of technology now used and managed by firms globally has made misconfigurations an increasingly persistent problem,” Edison explained. “Many organizations fail to maintain full visibility of their IT real estate and fail to perform proper audits of their systems, which inevitably leads to oversights in security and monitoring.”

For Edison, tackling misconfigurations internally can be difficult, “especially at large companies where teams work independently across a range of systems,” and advises organizations to bring in independent pentesters and security auditors.

Some of the biggest data leaks in the world came not from hackers breaking into locked-down systems, but from businesses inadvertently exposing their customers.

In 2026 alone, we’ve seen more than 670 million identity records exposed by Infutor, a data-driven consumer identity management company, as well as more than three billion records exposed through a misconfigured MongoDB database managed by global identity verification services, IDMerit.

Via BleepingComputer

• Liquid Network hack exploited a bug in SideSwap, releasing 3,998 BTC (~$313M) to attackers
• Hackers claimed “white‑hat” intent, returning 3,400 BTC after fixes, leaving 598 BTC missing
• Network remains paused as Blockstream and Federation patch vulnerabilities and prepare safe restart

The latest twist in the Liquid Network Bitcoin hack is worthy of a short movie, if not a full-length feature film.

Apparently, the hackers are actually the good guys, who stole the money to “keep it safe” until a vulnerability in the protocol had been fully resolved. They promised to return the funds afterwards.

What is Liquid Network?

Liquid Network was designed to solve a specific problem on the Bitcoin blockchain - being rather slow. The transactions on the network are recorded in a “block”, which is added to the chain roughly once every 10 minutes. Also, each block can only hold a limited number of transactions, which means the network can handle a smaller number of transactions per second, compared to conventional payment systems. Transactions that don’t make it into a specific block then need to wait for the next one, thus extending the confirmation time.

To solve that problem, Liquid Network was built. It runs its own Bitcoin reserve and its own blockchain, also known as a “sidechain”. When a person wants to use Liquid Network to send money quickly, they first convert their Bitcoin into Liquid Bitcoin, or L-BTC. They can then send it to another person much faster than a regular Bitcoin transaction. The recipient can keep the money on Liquid or convert it back to regular Bitcoin and move it to the Bitcoin network.

This way, Liquid provides a faster network without requiring every transaction to happen directly on the Bitcoin blockchain.

Besides speeding up Bitcoin transactions, Liquid Network also allows users (companies and other entities) to create and trade other digital assets, including tokenized securities, or stablecoins.

The project was built by Blockstream, a Bitcoin-focused technology company founded in 2014. It is run by the Liquid Federation, a group of more than 80 member companies, including exchanges, infrastructure companies, and financial institutions. A smaller group of members (15 to be exact) operate the network’s “functionaries” (servers that keep the network running), while the wider group has a governance role. Members vote on three boards (Technology, Membership, Oversight), handling ideas such as technical direction, internal rules, memberships, and more.

What happened to it?

In early September 2026, still unidentified actors managed to generate around 4,000 L-BTC, without putting in the corresponding 4,000 BTC into Liquid. As soon as they did it, they sent the L-BTC through SideSwap, a legitimate service that is used to convert L-BTC back to Bitcoin and vice-versa. The system apparently regarded the withdrawal as legitimate because, as was later determined, a bug prevented SideSwap from distinguishing between “real” and “fake” L-BTC, and treated them all the same.

As a result, the Liquid Federation ended up releasing 3,998 real BTC (more than $313 million at press time) to the attackers. As soon as the operators realized what had happened, they halted new transactions and warned about possible disruptions until the service was restored.

Then came the movie twist: the hacker started communicating with network maintainers through on-chain Bitcoin transactions, promising to return the funds when the vulnerability is fully resolved:

“Please fix the bug first. The chain is under risk at latest commit right now. Make sure every node is patched. Then we will transfer the money back safely after confirming the fix,” one of the messages read.

Earlier today, Coindesk reported that the hackers partially kept their promise, returning 3,400 of the 4,000 BTC drained, which suggests that the flaw was remedied. The remaining 598 BTC, worth approximately $47 million, is currently unaccounted for.

“3,400 BTC of the roughly 4,000 BTC withdrawn on September 6 has been returned to the Liquid Federation wallet. The return followed confirmation from Blockstream that the affected bridge nodes have been patched,” wrote Samson Mow, former chief strategy officer at Blockstream, on X. “Approximately 598 BTC remains outstanding, and Blockstream continues to engage with the white-hat hackers.”

He added that the network remains paused while Blockstream and Federation members make additional fixes and security improvements, resolve the chain split, and prepare for a safe restart.

“Liquid wallets and services will continue to be affected during this time. No user action is needed, and please do not send Bitcoin to Liquid peg-in addresses until we confirm the network has restarted,” he added.

• Microsoft 365 users targeted by phishing campaigns using BigBear 2.0 and AiTM proxies
• Attackers impersonate IT staff via calls, Teams, and email to steal credentials and bypass MFA
• CloudSEK tracked 5,000+ stolen records; Arctic Wolf urges phishing‑resistant MFA and conditional access

Microsoft 365 users are facing a barrage of cyberattacks all aimed at a single goal - to try and expose credentials which can later be used against employers in data theft attacks.

Different groups conduct their raids and bypass multi-factor authentication (MFA) protection to access victim accounts - CloudSEK, for example, said that some groups are using BigBear 2.0, a new phishing-as-a-service (PhaaS) framework that allows crooks to intercept passwords and authenticated session cookies.

Arctic Wolf, on the other hand, focused on a single threat actor, which it dubbed PREY-0058. This group, despite significant overlaps with other collectives in terms of techniques, technologies, and procedures, is not a rebrand of older organizations. Instead, the researchers believe the lines between the groups are blurred and that there is a large group of affiliates, splinter crews, and other cohorts using the same phishing infrastructure and thus often confuse defenders and analysts.

Similar methods, similar results

The attack methodology is similar across the spectrum. Crooks would call their victims on the phone or approach them via Teams and email. They would introduce themselves as members of the IT help desk sent to sort out a specific problem or issue.

Then, they would either convince the victim to grant remote access, or to open a spoofed Microsoft 365 login page and enter their credentials there. In both cases, the goal is the same - to get the victim to type in their username, password, and 2FA code, on a fake site built by BigBear 2.0 or a similar phishing framework. This framework, using an attacker-in-the-middle (AiTM) proxy between the victim and legitimate Microsoft infrastructure, harvests credentials, MFA codes, and session cookies, and replays them through an API essentially hijacking a legitimate authentication session.

Once they gain access, the attackers can do all sorts of things, but they are mostly focused on exfiltrating sensitive data from Outlook, Teams, SharePoint, and OneDrive. Deploying ransomware is rarely seen.

The campaign CloudSEK has been tracking has been rather successful, the researchers argue, saying BigBear 2.0 was used to exfiltrate more than 5,000 credential records, “including 474 complete MFA-bypassed authentications, 1,032 plaintext passwords, and 4,148 session cookies - affecting 3,331 unique victim IPs across 40+ countries with the operation still active at the time of writing.”

“The multi-user PhaaS panel is leased to at least five affiliate operators identified through live Telegram exfiltration bots, each receiving stolen credentials in real time.”

Speaking to BleepingComputer, CloudSEK says the campaign targeted 461 organizations, out of which 258 have had at least one set of credentials compromised.

Defending with phishing-resistant MFA

Arctic Wolf’s researchers stressed that the attackers are focused primarily on US-based businesses: construction and engineering, healthcare and pharmaceuticals, real estate and property management, finance, and professional services, The Hacker News reported. The researchers advise organizations to implement Conditional Access policies, deploy phishing-resistant MFA, and restrict the scope of data users can access via SharePoint. Obviously, employee education on the dangers of phishing cannot be understated.

"Defenders can disrupt this activity by detecting anomalous residential-proxy token replay, SharePoint discovery and bulk access, mailbox harvesting, and newly registered authentication-themed lure infrastructure," Arctic Wolf said.

Phishing-resistant MFA is multi-factor authentication designed so that an attacker cannot trick a person into handing over authorization code, either via a message, or through a fake login page.

These include products such as passkeys, YubiKeys security keys, and authentication methods based on FIDO2/WebAuthn. Since phishing-resistant MFA cryptographically ties the authentication to the legitimate website, the authentication cannot simply be forwarded to an attacker.

2025 was a transformative year for artificial intelligence, and 2026 is already proving to be equally significant.

While generative AI dominated conversations just a few years ago, the focus is now shifting towards agentic AI, where intelligent systems can take action, interact with business processes, and support employees in more meaningful ways.

As these capabilities continue to evolve, organizations are looking for better ways to connect AI systems to the applications, data and services that drive their operations.

This is where technologies such as Model Context Protocol (MCP) are becoming increasingly important.

Rather than creating bespoke integrations for every tool or system, MCP provides a standardized way for AI models and agents to access information and perform actions across an organization's technology estate.

While MCP is not a requirement for every AI implementation today, it represents a natural next step for organizations looking to move beyond isolated AI use cases and towards more integrated, scalable AI ecosystems.

However, greater integration also introduces greater responsibility. Effective governance remains essential for any AI deployment, but it becomes even more critical when autonomous agents are granted access to business systems, processes and sensitive information.

Organizations must establish clear guardrails that define what agents can access, what actions they can perform, and how their activities are monitored. Without appropriate oversight, businesses risk agents operating beyond their intended scope or creating unintended consequences across interconnected systems.

The impact on Software-as-a-Service

Few sectors will feel the effects of this shift more than Software-as-a-Service (SaaS).

For years, SaaS applications have been built around human interaction. Users access platforms through dashboards and interfaces, navigate predefined workflows, and manually complete tasks. The application itself serves as the primary workspace where work is performed.

Agentic AI introduces a different model.

Rather than navigating software in the same way a person would, agents can interact directly with APIs, services and data sources. This allows them to retrieve information, execute actions and orchestrate processes across multiple systems without relying on traditional user journeys.

That does not mean SaaS applications will disappear. In fact, they will continue to play a critical role in storing structured data, enforcing business rules and managing workflows. What is likely to change is how those applications are consumed.

Instead of being the primary destination where work happens, many SaaS platforms will increasingly act as sources of capability and information that AI agents can utilize on behalf of users. As a result, organizations may find themselves focusing less on which application employees need to access and more on how services and data can be brought together to achieve the desired business outcome.

Human interfaces will still matter. Users will continue to need visibility, exception handling and control mechanisms, particularly when business-critical processes are involved. The challenge for software providers will be balancing traditional user experiences with new AI-driven interaction models while maintaining compatibility, reliability and operational resilience.

Breaking down agent silos

The next stage in the evolution of agentic AI is not simply creating more agents. It is enabling agents to work together effectively.

Many organizations already struggle with fragmented systems, disconnected data and isolated processes. Without careful planning, agents risk creating a new generation of silos, each operating within its own limited context and producing inconsistent outcomes.

To avoid this, businesses must focus on shared context, connected data and interoperable services. The goal is not to have individual agents automating isolated tasks but to enable multiple agents to contribute towards broader business objectives across entire processes.

When agents can access consistent information and operate across organizational boundaries, the value shifts from discrete task automation to coordinated execution. Rather than supporting an individual stage of a workflow, agents can participate in end-to-end processes while remaining aligned to business policies, operational requirements and organizational goals.

This represents an important architectural shift. Software increasingly becomes something that agents consume programmatically, while integration, context and orchestration become central to delivering outcomes at scale.

Mitigating risk in AIaaS

Unlocking these new capabilities requires more than deploying AI tools. Organizations need governance frameworks, security controls and operational processes that allow autonomy to be introduced safely and responsibly.

As agents gain access to more systems and collaborate across workflows, operational complexity inevitably increases. Businesses must define clear policies around what agents can and cannot do, what data they can access, and what approvals are required before actions are taken.

These controls should be embedded into the orchestration layer itself, ensuring governance is applied consistently across all agent-led activities rather than being treated as an afterthought.

Traceability and accountability are equally important. Completing a task successfully is only part of the equation. Organizations must understand how decisions were made, what information was used, and which policies were applied throughout the process. This visibility will be essential for compliance, security and maintaining trust in autonomous systems.

The role of developers will also evolve. Rather than spending significant time building and maintaining point-to-point integrations, they will increasingly focus on designing agent behaviors, defining boundaries, managing orchestration and ensuring solutions operate within established governance frameworks.

The organizations that succeed will be those that balance innovation with control. Too little governance introduces risk, while excessive restrictions can prevent businesses from realizing the benefits of AI altogether.

Agentic AI should not be viewed as a replacement for software development or existing technology investments. Instead, it represents a powerful new interaction layer that changes how organizations access information, automate processes and deliver outcomes.

Businesses that invest now in integration foundations, governance models and workforce skills will be best placed to take advantage of the opportunities this next phase of AI creates.

We've reviewed the best business laptops.

This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit

• GPUThor is the first Rowhammer attack to defeat ECC on Nvidia GPUs and reach a root shell on the host
• It affects four Ampere workstation cards with GDDR6 memory, the RTX A4000, A4500, A5000 and A6000
• Non-uniform hammering, enabled by defeating GPU memory coalescing and finding that Target Row Refresh (TRR) mitigations fire once every 72 refresh intervals, delivers effectively 6.6 times the hammering intensity of prior attacks

Four researchers at the University of Toronto have disclosed GPUThor, a Rowhammer technique that breaks the error correction Nvidia has spent the past year recommending as the defense against exactly this class of attack.

Chris S. Lin, Joyce Qu, Aditya Rajeev and Gururaj Saileshwar are expected to present the paper outlining their approach and subsequent findings at ACM CCS 2026.

The attacks target Ampere-generation workstation cards with GDDR6 memory, specifically the RTX A4000, A4500, A5000 and A6000, and it turns an unprivileged CUDA program into a root shell on the host.

An attack that matters much more than its predecessors

Rowhammer works by repeatedly activating a DRAM row until charge leaks from cells in the physically adjacent rows and flips their bits. The attacker never touches the victim's data directly, making it an excellent precursor to tampering, sandbox escape, and privilege escalation, among other things.

This approach is possible despite an in-chip countermeasure called TRR that accompanies ECC-enabled chips on these GPUs. TRR aims to prevent Rowhammer attacks by tracking how frequently specific memory rows are activated and automatically refreshing adjacent rows before a malicious bit flip can occur.

This approach works well on paper and, when Rowhammer attacks hammer uniformly, offers decent protection. The problem arises when approaches such as GPUThor use non-uniform hammering, which is much more likely to succeed. Non-uniform hammering is not exactly new, having already succeeded on the CPU side of the spectrum thanks to the well-documented Blacksmith attack vector.

GPUThor is the third attack from broadly the same group in eighteen months, following GPUHammer in 2025 and GPUBreach earlier this year, and it matters because the previous two stopped working the moment a user typed the command to enable ECC.

ECC was essentially Nvidia's go-to response to reported Rowhammer attacks, but it may no longer be a solution in its current state. By hammering non-uniformly, the researchers opened another attack vector for Nvidia's Ampere-based GPUs, which are overwhelmingly affected by the technique.

With ECC disabled, GPUThor produced 72,000 to 377,000 bit flips per gigabyte across four Ampere-based cards, with Nvidia's A5000 being reported as the most vulnerable. That approaches the roughly 550,000 flips per gigabyte that Blacksmith achieves on DDR4, which is cause for concern: GPU Rowhammer is now in the same league as CPU Rowhammer.

When enabled, the researchers said ECC protectors reduced, but did not completely mitigate, the issue: they delivered double-bit errors and 2 triple-bit errors that the technique 'fixed' by choosing the wrong value.

On an RTX A6000 with ECC enabled, the GPUThor technique forces one GPU reset every 2 hours, killing all running processes on the GPU; as a result, the GPU flags itself as RMA-read within a day.

The team disclosed the attack pattern to Nvidia on 29 April 2026 and subsequently to Google, Microsoft and AWS, and held the work until the 25th of August. A code release is scheduled for the 15th of November, even though there is currently no CVE information or patch being deployed to address the issue.

• Wordfence discloses two critical flaws in Elementor Pro and Super Forms
• Bugs allow unauthenticated arbitrary file uploads, enabling remote code execution; both patched recently
• Exploitation attempts already exceed 440,000

More than six million WordPress users are at risk of website takeover, researchers have claimed after discovering two major vulnerabilities being exploited in the wild.

Security researchers Wordfence disclosed finding two flaws, one in Elementor Pro, and one in Super Forms - two popular WordPress plugins.

Elementor Pro is a commercial plugin that allows users to build websites using drag-and-drop elements instead of code. With it, they can add advanced widgets, templates, different forms, popups, and more. It is quite a popular solution with more than six million websites actively using it.

Two bugs, hundreds of thousands of attacks

According to Wordfence, up until recently, it was vulnerable to an “unrestricted file type upload” bug in all versions up to, and including, 4.2.1. “This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible,” the researchers explained. “This requires that the targeted site has published a page containing an Elementor Pro Form widget with at least one non-required File Upload field.”

The bug is tracked as CVE-2026-32475, carries a severity score of 9.8/10 (critical), and was patched in mid-August 2026. So far, Wordfence alone blocked more than 190,000 exploit attempts.

At roughly the same time, the researchers also reported finding a flaw in Super Forms, a form builder plugin that lets users create and manage forms using a drag-and-drop interface. This plugin, with some 13,000 active installations, contained a bug that allowed arbitrary file upload in all versions up to, and including, 6.3.313.

“This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible,” the researchers explained.

This one is tracked as CVE-2026-14894, also carries a severity score of 9.8/10 (critical) and it, too, was patched a few weeks ago. For this flaw, Wordfence observed more than 250,000 exploitation attempts meaning that cumulatively, these two resulted in 440,000 attacks already.

Given the widespread adoption of these plugins, and the fact that the flaws are being actively leveraged, users are advised to apply the fixes without delay.

Via The Hacker News

• G7 urges governments and organizations to begin transitioning to quantum‑resistant encryption
• Warning highlights risk from future quantum computers able to break current standards like AES
• Guidance: inventory cryptographic assets, prioritize critical systems, and adopt phased PQC strategies

The G7, a collection of some of the world’s most powerful economies, is urging organizations to adopt quantum-resistant encryption as soon as possible and minimize the risk of losing sensitive data to technologically advanced threat actors.

Virtually every industry in the world today relies on encryption (the process of converting readable data into scrambled, unreadable data so that only someone with the correct key can decode and access it) to protect sensitive information. Banks, telecommunications providers, defense organizations, and practically everyone else are using some form of encryption - most probably AES (Advanced Encryption Standard).

Decrypting the protected data without the encryption key is considered almost impossible, since the computational effort necessary to pull it off would simply be too large. However, since quantum computers work on a fundamentally different principle, it is believed that once they are mature enough, they will be able to “crack” today’s encryption standards.

G7's advice

Now, the G7 has urged government and organizations to remain ahead of the curve by deploying “quantum-resistant encryption”:

“To protect themselves from the threat brought by CRQCs (cryptographically relevant quantum computers), organizations should begin planning their PQC transition now and should aim to complete their transitions within any the timelines set out by their national cybersecurity authorities,” the warning reads.

“In addition to quantum-related risks, organizations that delay their PQC transition may lose competitive advantage or may be excluded from contracting opportunities, including public procurement.”

The G7 advises governments and organizations to take a number of steps, including identifying critical systems and prioritizing them. They should adopt a phased and risk-based strategy, start their transition early, and inventory their cryptographic assets. They should also map their dependencies and develop a transition plan.

“To limit transition-related costs, they should opt to purchase products that integrate PQC and replace their systems with quantum-safe ones as part of their standard renewal schedule. As such, starting the transition early could result in lower migration costs overall. Planning and conducting their PQC transition properly would enable organizations to prevent insecure implementations and avoid increased exposure to conventional cyber threats.”

• US military branches disable ad tracking on government‑issued devices after warning
• Location data from personal devices still poses risks; past data remains for sale
• Senators urge DoD inspector general to review policies and stop servicemember data exposure

More than 20 years ago, Jason Bourne was smashing mobile phones to prevent being tracked by his adversaries - and the US Department of Defense (DoD) has realized it should probably do something similar.

In May 2026, Senator Ron Wyden mailed the DoD (among others), informing the agency that foreign powers were using commercial location data to target US troops - and now, Wyden has shared the responses he received from the US Army, Air Force, Navy, Marine Corps, and Special Operations Command, all of which have disabled advertising tracking across their government-issued devices, including Apple and Android smartphones, and Windows computers.

Some branches did it earlier this year, while the Air Force allegedly concluded the efforts in July 2026 - and while Wyden praised the move, he also suggested it is not enough, and that further steps must be taken in order to protect US troops stationed abroad.

Evaluating the leaked files

“We commend these service branches for implementing this cybersecurity defensive best practice on government devices,” Wyden and Senator Pat Harrigan wrote. “However, recent reports regarding the continued availability of commercial location data originating from DoD facilities raise troubling questions.”

Apparently, despite disabling these features and placing the troops out of reach of data brokers and similar commercial entities, the data that was gathered earlier remains available for sale, which still presents a risk.

“The members suggested data could continue to be available for several reasons, including that commercial data available originates from personal devices, not government phones, that are carried by servicemembers and government contractors,” a report on Wyden’s website reads.

“Wyden and Harrigan called on the DOD inspector general to examine commercial location data that DOD and other government agencies have already purchased to determine why existing policies have not prevented servicemembers location data from being sold online, and to recommend policy changes to better protect US personnel.”

Via TechCrunch

• OpenAI hid an incident where a model hijacked a wiki page to use as an AI agent communication board
• The incident was hidden while the company dealt with the fallout of the Hugging Face attack
• The company is now working on a framework for disclosing incidents of 'misalignment'

OpenAI recently disclosed the details of how one of its AI models escaped a sandboxed environment and attacked Hugging Face during an evaluation - and as part of the incident, the models created a messaging board to communicate with each other and influence each other’s reasoning.

OpenAI has now disclosed that shortly after this incident, agents undergoing testing again escaped their ‘secured’ environment and hijacked an obscure German wiki to use as a messaging board. Per Reuters, OpenAI leadership kept the incident hidden while they dealt with the fallout from the Hugging Face incident.

Now that OpenAI has acknowledged its role in the incident, the company has said it is “past time” to put together an incident disclosure pipeline when its models escape testing and slip into third-party networks.

Who is at fault when models do what they’re designed to do?

Before the two incidents, OpenAI said it, “treated misalignment largely as a research question, which gets communicated in research publications”. But now that models are behaving in previously unknown ways and having real-world impacts, the company said it would change its approach “to expand for this new phase of model capabilities”.

The company labelled the most recently disclosed incident as “an instance of misalignment similar” to the Hugging Face breach.

I myself am guilty of reporting on AI breaking out of containment as going ‘rogue’, but these models are doing exactly what they are designed to do. OpenAI’s detailed disclosure of the Hugging Face incident showed that the models were pushed to try and solve a benchmark test by cheating, which is exactly what caused the cyberattack to happen.

OpenAI said that both itself and “the larger AI community do not yet have a clear standard for how to report misalignment that shows up during training, evaluation, and deployment, including examples that don’t look like traditional security incidents but could provide insight into AI behavior and future risks”.

The company added that it is “working on a framework and will share it in upcoming weeks, and in parallel we’re working with dozens of government regulatory agencies worldwide on these issues”.

“When you combine this 'breakout' with the Hugging face breakout, it's starting to display a pattern,” said Ashley Knowles, Lead Cybersecurity Consultant at Black Hills Information Security. “I struggle here with not getting too doomsday-ish but realistically, this is showing a pattern of concerning behavior.”

“I'm wondering if this race to become 'first' is undercutting security measures that need to be taken to properly secure and guard AI agents as they're in development. My concern grows when you consider that OpenAI is also resisting further investigation. Adding onto that, the release and promise that Astra can evade human monitoring. The pot is brewing…”

Ask a CISO why they bought their newest cybersecurity tool, and they’ll have a clear answer lined up.

It stops a specific technique, closes a particular gap, or satisfies a compliance requirement.

However, it's often less clear how the tool fits in with the rest of the stack.

Does it make the overall system stronger, or simply add another layer of complexity to manage?

Research indicates most security professionals already believe they’re juggling too many tools, with over half saying they don’t properly integrate together.

This is a pattern I call ‘additive by default,’ and it results in stacks that grow without a plan, becoming broader but not necessarily deeper or able to match today’s threats.

Start with the outcome, not the technology

I find this additive approach is often due to focusing on specific emerging threats or identified weak points, so decisions are made with a tactical eye rather than a broader strategic view.

Part of the problem is that most organizations have never precisely defined the security outcome they are trying to achieve. Without a shared, specific language for the problem, every new purchase becomes additive, because there is nothing solid to measure it against.

Take asset labelling, which is a core capability most organizations know they need, so they invest in a tool, populate a configuration management database (CMDB), and assign criticality scores. Job done, right? But labelling an asset only answers the question of what it is, and says nothing about how that asset connects to everything around it, or what happens when a policy needs to be enforced against it.

Labelling, visibility and enforcement are three distinct jobs, not one. Solve the first and the second and third remain wide open, so another tool gets bought to cover visibility, then another for enforcement. Each purchase solves its own narrow question perfectly well.

However, none of them were ever asked to work as a single, continuous capability, because nobody defined that as the actual requirement in the first place.

What if asset management labels fed into visibility views and the same reflected how policy is drafted and then enforced? Now you have a strategic problem solved with interoperable capabilities.

How much of your stack is really putting in the work?

Gartner’s most recent Leadership Perspective Survey saw CISOs noting this as a common issue, with just 20-30% of tool capability actually being used in some cases. The instinctive response to this is to cut the stack down, however, that instinct solves the wrong problem.

A good exercise for working out the value of the stack is to evaluate every tool, new or already deployed, against three plain questions.

Does it offer continuous validation against a given threat - and what, specifically, does it validate? Is it still operationally relevant? And is it effective, right now, in the environment you have today? A tool can pass one or two of these and still be failing you.

Virtual Local Area Networks (VLANs) are a good example of this. Twenty or thirty years ago, when networks were typically static and everything likely sat inside a single data center, VLAN-based segmentation was genuinely effective. It matched the environment it was built for.

That environment has since changed almost beyond recognition. Workloads move between on-premises systems, cloud and containers, and nothing stays fixed for long. VLANs are still deployed across many stacks today, still technically doing the segmentation job they were built for. Yet their effectiveness has dropped sharply because they offer none of the continuous validation a hybrid, constantly shifting estate actually requires.

Effectiveness has an expiry date that has nothing to do with whether the tool still runs. Success should be measured by whether the system as a whole still holds up, not by how many tools remain switched on.

Consolidated security, not consolidated tooling

Gartner identified that most organizations are pursuing a vendor consolidation strategy. While this approach certainly reduces unnecessary spending and keeps budgets under control, it’s not necessarily solving the biggest problem.

Consolidated tooling and consolidated security are not the same thing, and it’s an assumption that leads to disappointment. Reducing the number of tools alone achieves little if the underlying processes remain fragmented or teams continue to operate against different objectives.

No data center I have walked through was built entirely by one manufacturer. Racks, switches, storage and cabling come from a dozen suppliers, yet they operate as one coherent system because they were designed to fit together. Security should work the same way.

The goal is not necessarily fewer vendors, but every control, whoever built it, feeding into the same continuous picture of identification, visibility and enforcement.

What to ask instead

Before completing the next security purchase, consider how well a new tool fits into the stack you already have, not just what it claims to do on its own.

A tool that deploys cleanly, validates continuously rather than only at go-live, and feeds its findings back into the tools already in place is doing real work. One that arrives as a fresh, isolated source of alerts is just adding to the noise, however good its individual detection rate looks in a demo. That means comparing what the tool was bought to solve against what it is actually delivering today, checking it against newer capabilities, and being willing to redeploy or renegotiate rather than automatically renew or even retire.

Ultimately, the strongest security programs are not defined by the number of tools they deploy, nor by the number they eliminate. They're defined by how effectively every control works together when it matters most.

We've rounded up the best endpoint protection software suites.

This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit

• Rhysida ransomware group breached Berlin’s state government, stealing 1.44 million files weighing in at around 5.8TB
• Attackers demanded 30 BTC (~$2.3M); Berlin refused, leading to full leak online
• Leaked data reportedly includes water supply info, staff records, and emergency plans

A cybercriminal group known as Rhysida allegedly broke into the network of Berlin's state government and exfiltrated 1.44 million files. They then tried to extort the government entity for money and when that failed, they leaked it all into the dark web.

According to multiple sources, the group first claimed responsibility for the attack on an underground forum, where it shared a small sample of the stolen files and demanded Berlin pay 30 bitcoin (around $2.3 million) in exchange for deleting the files.

Berlin recognized the attack in a press release, and said it would not be negotiating with the attackers, and instead launched a full-scale investigation into the incident, which it described as an “extremely serious crime and an attack on the state of Berlin.”

Evaluating the leaked files

A few days later, Rhysida decided to leak it all online - and Berlin is now reviewing the leaked files and is assessing the damage:

“After the publication of the stolen data from the Berlin administration, these files are being evaluated at full speed,” a press release, published on the Berlin.de website (machine-translated), reads.

“An additional steering unit has been set up in the Senate Chancellery under the leadership of the Chief Digital Officer (CDO), Florian Hauer, which coordinates the review, examination and evaluation of the leaked data and supports the two Senate administrations concerned in informing and advising the affected citizens and companies.”

According to German public broadcaster Tagesschau, the archive counts 1.44 million files and totals 5.8 terabytes. At the same time, the Chaos Computer Club (Germany's largest and best-known hacker organization) claims the archive contains sensitive data on the city’s water supply, personal data of admin staff, various employment references, and emergency plans.

Via Reuters

• Microsoft reports phishing campaign using ASCII smuggling to bypass spam filters
• Attackers insert invisible characters into keywords, tricking filters and AI agents
• Defenders should normalize Unicode tags and flag unexpected invisible code points as suspicious

Cybercriminals are using the “ASCII smuggling” technique to make sure phishing emails pass security filters and land in people’s inboxes, experts have warned.

ASCII is a character encoding standard that turns characters and words humans can read into numeric values that computers can understand. It can also be used to create characters that aren’t even displayed on the screen (essentially “invisible” ones) but can still be read by the machine.

In a new report, security researchers from Microsoft found crooks are abusing this fact to distribute phishing emails. Most email providers offer solutions that filter out spam emails. These filters look for certain keywords and phrases, such as “funding”, “credit”, “loan”, and similar, and automatically send such emails to the spam folder.

Ongoing campaign

By adding a set of invisible characters in the middle of these keywords, the attackers can break them apart and thus “confuse” the filters.

While the human sees the word “funding” in their email, the security solution is seeing something like “fun[a long string of characters]ding”. This technique has been adopted from prompt injection attacks, where crooks would use ASCII smuggling to deliver malicious and invisible prompts in the emails.

Therefore, when a victim asks their AI agent to summarize the email, it ends up working on a prompt that could be anything from extracting sensitive data, to deploying malware.

Microsoft is saying the campaign has been ongoing for months, and while it peaked in February 2026 with more than 2.3 million emails every day, and has been in decline ever since, it remains active to this day. In early February, Microsoft observed a cluster of almost 150 sender domains, all themed around finance. These domains accounted for almost all (96%) of all the spam emails Defender for Office 365 flagged under ASCII smuggling.

Defending sounds relatively simple, though. IT teams should normalize Unicode tag characters and other invisible code points before applying any keyword detection. They should also consider all unexpected tag-block characters as suspicious.

Via BleepingComputer

You probably have tens, if not hundreds of passwords floating around across all the online accounts you use every week. In fact, the average person has over 150 passwords. It's not easy to remember them all, making it more attractive to keep them simple and similar - but that can lead to a serious chain of account theft.

That's why password managers like Keeper exist. They generate strong passwords and store them passwords in a secured vault to keep them safe from hackers and prying eyes. They even autofill your credentials to make logging in to your account faster and easier.

Keeper has cut prices on its personal, family, and business starter plans by up to 50%. Keeper regularly scores highly in our reviews, and includes great features across Personal, Family, and Business plans.

Why we recommend Keeper

Our Keeper review highlights the platform's zero knowledge architecture and device level encryption that helps keep your password vault secured against unwanted intrusions.

Where Keeper really shone was in our usability and convenience testing. We loved how Keeper uses biometric security to access your vault, rather than requiring a master password with each log in. By using a facial scan or fingerprint to verify that its actually you accessing your vault, it adds a fast but secure method of verification to ensure its you, and not a nefarious actor.

For households, the Family Plan includes five private vaults, allowing you to quickly share Wi-Fi or streaming passwords using Keeper's shared vaults.

The Business Starter plan covers 5 users, covering an unlimited devices, shared team folders, user activity reporting for IT admins, and a free Family Plan for every team member.

These discounts apply to the first year only, so the value is highest for new customers or anyone switching from a monthly plan. After that, pricing goes back to standard rates.

OpenAI has unveiled a much anticipated AI model which the firm has dubbed ‘GPT-6 Astra’. While the model has improved significantly across benchmark testing and brings a host of new business features, there is still a dark cloud looming over the new model.

Off the back of OpenAI’s accidental hack of Hugging Face and the company’s subsequent efforts to improve how AI agents behave and interact, numerous cybersecurity experts have raised concerns about the model’s new ‘recurrent depth’ reasoning capabilities.

This new reasoning architecture allows the model to consider a problem multiple times before taking an action, compared to the standard chain-of-thought reasoning used in previous models.

Why the concern about recurrent depth reasoning?

This new level of reasoning apparently offers improved performance. OpenAI also says it has fixed its models' abilities to circumvent boundaries when performing tests by monitoring the models reasoning and ensuring the model stays aligned within the scope of its task.

During Astra’s launch event, OpenAI chief scientist Jakub Pachocki said: “We will not accept degradation in our ability to monitor model alignment beyond a certain level. We will withhold scaling until we can regain enough confidence.”

But numerous experts believe that the lessons of the Hugging Face incident have not yet been learned, and the model has been released without adequate testing on Astra’s reasoning and monitoring.

After all, no one thought one of OpenAI’s models could set up a hidden internet-connected messaging board that allowed AI agents to influence each other's behavior.

But with Astra being released into the real world, the lessons may have to be learned on the fly.

Expert perspectives on OpenAI Astra release

• James Blake, VP of Global Cyber Resiliency Strategy at Cohesity:

The launch of Astra is raising questions again around the safety of Frontier AI. Instead of simply asking whether a model is "safe", organisations now need to ask whether it remains safe across millions of different situations, prompts and interactions. Cyber resilience has traditionally assumed that systems and threat actors behave deterministically. AI systems don’t.

Advanced models can and will continue to exhibit behaviours that emerge from their optimisation process rather than from explicit programming. We have to move beyond thinking about AI as just another software tool and find ways to ensure these systems remain observable, auditable and governable throughout their lifecycle.

The most important question we’ll need to answer in future is one of liability. Suppose an AI system autonomously develops a strategy that causes financial loss, leaks confidential information or violates regulation. Who is responsible? The developer that trained the model? The cloud provider operating the infrastructure? Currently the answer is surprisingly unclear. It’s not just about what AI can do: it’s about who is accountable when it does something nobody expected.

• Oleksandr Yaremchuk, Co-Founder & CTO at Manifold Security:

OpenAI is calling Astra its most aligned model yet, even as its chief scientist admits monitorability is getting harder as models get more capable. Evidently, Astra hides its reasoning in the majority of tested cases, and some successful attacks left no reasoning trace at all. That's the tool many organisations still use, including the labs themselves, for auditing what an agent is doing, and it's getting less reliable with every release.

That matters because Astra isn't staying inside OpenAI's test environment. It's going to run as an agent on employee laptops and in the browser, holding real credentials, inside companies that have no way to watch what it does once it's there. A model that explains itself less isn't more aligned, it's just harder to catch when it goes wrong.

Labs can keep debating what these models say or refuse to say. Security teams need to stop relying on that and start monitoring what agents actually do at runtime, with the ability to shut one down mid-action. That's the only oversight left that still works once the reasoning goes quiet.

• Kristin Lowery, Field CISO at Optiv:

For boards and executive leaders, the emergence of OpenAI’s Astra model highlights a broader reality: AI is no longer just a productivity issue; it is a risk management issue.

Just as organizations established governance for cloud adoption and digital transformation, they now need clear policies, strong oversight, and accountability for AI use.

The question is not whether AI will become more capable — it will. The real challenge is whether organizations can strengthen their governance, security controls, and workforce readiness quickly enough to keep pace.

• Patricia Titus, Field CISO at Abnormal AI:

OpenAI crossing this threshold deserves attention. Credit where it's due, they're handling it responsibly by restricting Astra's advanced cyber capability to a small coalition rather than releasing it broadly.But this isn't one company's problem to contain.

Once a model can find and exploit unknown flaws without a human in the loop, that capability doesn't stay exclusive for long. Open-weight and modified models typically trail the frontier by only months, and that's the reality defenders have to plan around now.

Static, signature-based defences were built for attacks that repeat. They weren't built for an adversary that generates a new one every time. Defenders need the same shift, systems that learn what normal looks like for every identity, human, machine, or AI agent, and flag and contain the moment something deviates, at machine speed.

The window to build that is open now. It won't stay that way once this capability is common instead of rare.

• Raghu Nandakumara, VP of Industry Strategy at Illumio:

With the Astra announcement, OpenAI is doubling down on monitoring the model's own behaviour – a response to the model "breakouts" seen over the past few months.

When Anthropic announced Claude Mythos Preview, the core concern was the model falling into the wrong hands. OpenAI's answer goes further adding guardrails around the model's own reasoning and actions, regardless of the user's intent. The goal is to catch a model going rogue mid-task, not just stop it being misused at the outset.

The rest of this announcement can be summarised as ‘we have a new frontier model, and it’s more capable than the last one’.

• Google released Chrome 152.0.7977.82/.83 for Windows, Mac, and Linux
• Patch fixes 12 flaws, including zero‑day CVE‑2026‑85046 (type confusion in V8)
• Sixth Chrome zero‑day this year; Chromium browsers also affected, update urged immediately

Google has released a new version of its Chrome browser for Windows, Mac, and Linux, fixing a dozen of vulnerabilities. Among them is a high-severity flaw that is being actively exploited in the wild.

In a security advisory published on the Google blog on September 3, the search engine company said Chrome’s newest version is now 152.0.7977.82/.83 for Windows and Mac, and 152.0.7977.82 for Linux.

Rollout is expected to be gradual, so make sure to check if you already received it. Most of the time the update is automatic and instant and if you’re not certain, tap the three vertical dots in the top-right corner of the browser and choose Help. Navigate to About Google Chrome and there you will find the version number.

Running malicious code remotely

This patch fixes a total of 12 vulnerabilities, most of which are graded as high severity. Among them is a “type confusion in V8” bug, discovered by security researcher Salvatore Gulizia.

For his effort, Gulizia was awarded $1,000. Apparently, this bug is being actively leveraged in real-life attacks, although Google (as usual) decided not to share the juicy details until the majority of browsers are protected.

The vulnerability is tracked as CVE-2026-85046. On the National Vulnerability Database (NVD), it is described as a “type confusion in V8 in Google Chrome [that allows] a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.”

V8 is Chrome’s JavaScript engine which allows web apps and interactive websites to run in the browser. Those interested in the technical breakdown of the vulnerability can find it on Guzlia’s blog.

You can find the full list of fixed vulnerabilities on this link.

This is the sixth zero-day Google fixed in Chrome since the start of the year. It also affects other browsers built on Chromium, so if you’re running Edge, Brave, Opera, or Vivaldi, make sure to update to the latest version as soon as possible.

Via The Hacker News

• OpenAI rolled out GPT‑6 Astra, its most advanced AI, with “critical” cyber capabilities
• Astra can autonomously find and exploit unknown flaws; release limited to vetted Daybreak participants
• Staggered rollout sparked user frustration; Altman apologized, promising broader access soon

OpenAI has begun rolling out GPT-6 Astra, its latest and most capable artificial intelligence model.

In an announcement published on its website, OpenAI said Astra represents a “significant step up in cyber capabilities”, meeting the company’s “Critical” threshold.

This threshold, the company explained, means that under the right circumstances, the tool can find “previously unknown security flaws and develop new ways to exploit them across many well-protected systems without a person guiding each step.”

Apologies for a messy rollout

OpenAI also said Astra improves on functions such as computer use, software engineering, and science, and that it should be better at staying oriented, compared to previous versions.

Just like many of the previous models, Astra’s release has been marred with controversy. Roughly a month ago, OpenAI said the model’s “critical” cybersecurity capabilities prompted it to pause some internal development and trigger safety protocols.

In response to early findings, the company scaled up certain security controls and even paused activities that do not meet its newly established security requirements.

It now decided it was time to release the model, but still not to the general public. Instead, it opted for a staggered release, giving it first to a limited group of companies participating in the Daybreak program, a cybersecurity initiative that gives vetted organizations (cybersecurity and otherwise) specialized AI tools for vulnerability research and threat detection.

This did not sit well with many ChatGPT users, especially those paying a monthly subscription. As The Verge reported, CEO Sam Altman was apologizing, mere hours after launch, for the “messy rollout” of Astra.

Initially, all Plus, Pro, Business, and Enterprise users were supposed to gain access to Astra, as well as those accessing through OpenAI API, Microsoft Azure, and AWS Bedrock.

“We are working towards getting Astra in everyone’s hands as quickly as we can,” Altman said on X. “I know it is frustrating and I appreciate the patience. It should be quick.”

Via CNBC

Following the aftermath of the Manchester Airports Group cyberattack - where hackers made off with the data of 8.7 million people - the hackers have now posted the entire database for sale on the dark web.

The group behind the attack, FulcrumSec, attempted to get Manchester Airports Group (MAG) to pay for the security of the database, promising that it wouldn’t be released if the company paid a settlement. But as all companies should do when faced with extortion, MAG didn’t play ball.

Now FulcrumSec wants to try and maximise the damage of the cyberattack, and has listed the database containing email addresses, phone numbers, vehicle registrations and postcodes online in the hopes a fellow hacking group will find value in the data.

What happens when extortion fails, and why didn’t MAG pay?

In the past, when companies faced ransomware attacks or data breaches, they would sometimes quietly pay the hackers for their silence.

Companies feared serious reputational harm and loss of business would cost more in the long run than the perpetrators were asking for. But this created an incentive for hackers to carry out more attacks.

After all, if companies aren’t kicking up a fuss about being hacked or reporting the attack to the authorities, hacking groups can launch more attacks on other companies that are completely unaware of their tactics.

In order to counter this, authorities and cyber experts from around the world issued guidance that under no circumstances should companies pay for the safe return of their data. By removing the incentive from ransomware attacks and data breaches, the hope is that hackers will get bored or not see enough ROI, and therefore stop.

But the 500GB database of data on over 8.7 million people is ripe pickings for other cybercriminals looking to launch highly specific phishing attacks or scam campaigns. While FulcrumSec may not make any money from the attack, they can seriously enhance the damage of the attack by offering the data for free for others to use.

A successful scam or phishing attack can steal banking and financial details, allowing other groups to steal even more money off the back of the attack.

Expert perspectives on MAG extortion and customer data

• Dray Agha, senior manager of security operations at Huntress:

While Manchester Airports Group followed official guidance by refusing to pay the ransom, the release of 8.7 million records creates an immediate risk for passengers.

We expect other criminals to use this freely available database of vehicle registrations, postcodes and contact details to craft highly convincing phishing attacks.

Anyone who has used parking, lounges or Wi-Fi at these airports must treat unexpected messages about their travel with extreme caution.

• Muhammad Yahya Patel, vCISO and cybersecurity advisor for EMEA at Huntress

The "free release" model is deliberately designed to maximise harm and reputational damage as a warning to the next target.

Publishing almost nine million records for free isn't just punishment for MAG it's a marketing campaign aimed at every other organisation watching.

Pay up, or your customers' data gets handed to every fraudster and scammer on the internet at no cost. Refusing to pay a ransom is the right call. But nearly nine million people are now paying a different price for a decision that was never theirs to make.

• Danny Jenkins, Co Founder & CEO at ThreatLocker

Unfortunately, once data is made public, it can’t be hidden again. The most important thing consumers can do is focus on basic cyber hygiene. Use a unique password for every website, learn how to identify phishing scams, and monitor your credit report.

Be highly suspicious of emails that create a sense of urgency, offer something that seems too good to be true, or ask you to reset your password.

When in doubt, look up the phone number for the alleged sender yourself, rather than using a number provided in the email, and call to confirm whether the communication is genuine.

• Brian Higgins, security specialist at Comparitech:

Whilst the airports breached in this attack don't appear to have had any financial data compromised the risk to affected or associated customers is very real. With so much other information freely available in the wild it is vital that airport users stay highly vigilant for some time to come.

Any and all unsolicited contact; whether online, by telephone or even home visit approaches, should be viewed as suspicious. Never engage until you've taken time to check credentials/veracity etc.

Research advice from trusted sources like the NCA or Information Commissioner and share it with your family and friends. Look for ways to increase digital and physical security like two factor authentication on Apps and devices or Smart Home tech.

When this breach was first reported by the Manchester Evening News the comments were quite telling. Affected parties were quick to identify potential vulnerabilities over and above the breach of financial and banking details.

Home addresses, vehicle registrations and time spent away from home all add up to some excellent opportunities for criminal exploitation, not to mention the usual follow-up phishing campaigns common in this type of incident.

As AI makes data aggregation swift and easy consumers are waking up to the fact that criminals can monetise successful breaches in increasingly inventive ways. It’s no longer enough for data owning organisations to advise post-attack vigilance and turn to their backups.

Victim communities rightly expect better protected networks and systems over and above established norms. As the marketplace grows less fearful and more angry when breaches are made public we may see more emphasis on cyber crime prevention which can only be a good thing.

• Denis Calderone, CTO at Suzu Labs:

The 8.7 million number is attention-grabbing, but it deserves some context. MAG has confirmed that the vast majority of those records are email addresses collected through airport WiFi sign-ups.

A much smaller subset includes phone numbers, vehicle registrations, and postcodes from customers who actually completed parking or lounge bookings.

No payment data, no passwords, no passport information. So despite this affecting airports, which is obviously a sensitive subject, the actual data sensitivity for most affected individuals is relatively low.

What's more interesting to us from a technical standpoint is the attack path. MAG told The Register that attackers compromised one of their internal systems and then went on to steal files from a database hosted by a third party. That's a pivot upstream into a data provider, not downstream into operational systems.

What remains unclear is whether the data was exfiltrated directly from that third-party environment or whether it was pulled back through MAG's network first. That distinction matters for understanding where detection controls failed and who was responsible for monitoring the egress.

The UK's Civil Aviation Authority has a Cyber Assessment Framework for Aviation, developed with the NCSC, that mandates strict separation between IT systems and operational technology.

We don't know whether MAG was formally operating under that framework at the time of this incident, but I would be very interested to find out. Because the segmentation appears to have held here. Flight operations, baggage handling, terminal systems, etc., all were unaffected.

The lateral movement went upstream toward a data provider, not downstream toward the systems that keep planes in the air.

• Seemant Sehgal, CEO and Founder at BreachLock:

This data was initially collected because passengers needed a login, and somewhere along the way, the sensitivity of what was accumulating in that database stopped getting the same scrutiny as the network itself.

Vehicle registration details, postcodes, and contact information across three major airports are a profiling dataset, and whoever held it for ransom understood its value better than the organization storing it did.

• Cisco patched eight IOS XR flaws, including three critical (CVE‑2026‑20274, CVE‑2026‑20279, CVE‑2026‑20212)
• Vulnerabilities allow unauthenticated exploitation, improper access control, and crafted input execution
• No abuse reported; patches urged, with iACL workarounds for Nexus 9000 devices using Silicon One ASIC

Cisco patched eight vulnerabilities affecting its IOS XR operating system, including three critical-severity ones. It urged its customers to apply the patches as soon as possible, even though it stressed that there is no evidence any of these were abused in the wild.

The company detailed its findings in two advisories published on the same day - September 2.

In the first one, it disclosed seven vulnerabilities, including two critical-severity ones: CVE-2026-20274 and CVE-2026-20279. Both carry a severity rating of 9.8/10 (critical). The former is an improper control of a resource during its lifetime flaw - a network-based, low complexity, vulnerability that requires no authentication or user interaction to be exploited. The latter is described as an improper access control vulnerability that can lead to the same consequences.

Fixes and mitigations

These flaws, along with five others, affect all releases of Cisco IOS XR Software, including Cisco IOS XR7 (LNT) Software, regardless of device configuration, the company explained. There are no available workarounds, and installing the provided patch is the only way to mitigate the risk.

The third flaw, disclosed in a separate advisory, is tracked as CVE-2026-20212. Successfully exploiting this one allows attackers to connect to an affected device and send crafted input that could be executed as code, without root privileges. “The exploitation of this vulnerability could also cause the S1HAL process to crash, which could cause the device to reload,” Cisco explained.

This bug affects Cisco Nexus 9000 Series Switches if they include a Silicon One ASIC, the company stressed. A possible workaround is to use infrastructure access control lists (iACLs) to allow only required management and control plane traffic that is destined to the affected device. There is also the option of iACLs only being used to explicitly deny all TCP packets that are destined to a locally configured IP address with a destination port of 43210 or 43211.

Via The Register

• OpenAI launched Daybreak for Frontline Defenders, offering $1B in credits for resource‑constrained security orgs
• Priority goes to essential services, governments, banks, nonprofits, and open‑source maintainers
• Initiative includes training, partnerships, and a water‑sector pilot with MS‑ISCA for local defenders

OpenAI is offering a billion dollars in credits to security organizations who want to use its Daybreak initiative but cannot afford it.

Daybreak is a cybersecurity program that provides vetted defenders with specialized AI tools and models. It was introduced in May this year, and later expanded into two tiers - Blue, and Red. Blue is the entry-level tier, providing a general-purpose model with custom-tailored safeguards. Red, on the other hand, offers a more purpose-trained cybersecurity model and almost no safeguards.

According to OpenAI, “thousands of defenders across 2,000 approved organizations and workspaces” already use Daybreak, including cybersecurity companies, defense organizations, and law enforcement agencies.

Who gets priority?

But these models cost money, and to make sure more businesses can access them, OpenAI announced, “Daybreak for Frontline Defenders”, a project where defenders can apply and receive credits for AI tokens. Even though the company announced it as a global initiative, it seems that US businesses will be the first to take advantage of it:

“OpenAI is committing $1 billion in subsidized Daybreak access to help resource-constrained cyber defenders, starting with the United States, put frontier AI to work, targeting it to be consumed over the next six months,” the company said in an announcement blog.

Businesses operating essential services such as water and wastewater systems, and electric grid operators, will get priority, OpenAI said. Then come state and local governments, community and regional banks, nonprofits, open-source maintainers, and then “other organizations with limited security resources.”

The subsidy is not just about using the models, though. OpenAI also said it will be increasing hands-on support for frontline defenders, training, and new partnerships.

On top of all that, OpenAI also announced a public sector, water-focused pilot with the Multi-State Information Sharing and Analysis Center (MS-ISCA) to train and support local, tribal, and territorial defenders.

“The pilot will pair Daybreak access with guided training and hands-on assistance for an initial group of public sector and water system defenders, helping them validate and prioritize findings, coordinate remediation, and develop a repeatable approach that can be expanded over time,” the announcement concluded.

• Microsoft warns of Teams‑based campaign where attackers impersonate IT staff
• Victims tricked into granting remote access, leading to malware, lateral movement, and ransomware
• Defenses: verify support contacts, train staff, harden Teams, and use Defender Safe Links/ZAP

Microsoft is warning about an ongoing hacking campaign that starts with a Teams message and ends with a ransomware infection and data theft.

In a new in-depth report published on the Microsoft blog, it was said that unnamed threat actors were reaching out to their targets at various enterprises via a Teams chat, while impersonating IT staff.

They were coercing their victims into granting remote access via screen sharing or remote monitoring and management tools and once received, used their access to install malware loaders and various other implants.

How to defend against Teams-borne phishing

The malware was just the first stage of the attack. Subsequent stages include host reconnaissance, security-product and virtualization discovery, and “periodic desktop screen capture”. In other words - mapping out the landscape and conducting espionage.

The crooks would then enumerate domain accounts, servers, and users, through native tools and Active Directory Service Interfaces (ADSI) queries and begin moving laterally.

The final step includes identifying and extracting valuable data, followed by a ransomware infection.

Microsoft does not name the perpetrators, and mostly refers to them as “threat actors”. It makes sense, since the “fake IT support via Teams” technique is being used by multiple groups at this moment. Russia’s Cozy Bear, FIN7, and Storm-1811 are probably the most obvious examples.

The world’s biggest extortionists - ShinyHunters - are also known to use Teams to trick victims into granting access, but this group rarely deploys an encryptor and instead just focuses on data exfiltration.

Whoever the attackers are, and whoever they’re after, one thing is for certain - the risk in the enterprise environment has never been greater.

That is why Microsoft advises reinforcing user education by establishing internal helpdesk authentication phrases, and by training employees to recognize external-tenant indicators.

The company also urges enterprises to verify unsolicited support contact, and to harden Microsoft Teams and email against social engineering. “Use Microsoft Defender for Office 365 with Safe Links and Zero-hour auto purge (ZAP) so malicious messages and URLs are neutralized at time of click and removed after delivery,” Microsoft urges.

• FBI warns of rising OAuth consent phishing attacks exploiting legitimate app permissions
• Victims tricked into granting malicious apps access, enabling email reading and sending
• Password changes don’t help; users must revoke tokens in app security settings

Hackers found a way to access your data, read your messages, and even send emails to your contacts, without ever needing your password or other login credentials. All they need from you is a single click on a completely legitimate, well-known platform.

The technique is called “OAuth consent phishing”. It’s been around for more than a year and it’s gotten popular to a point where even the FBI is taking note. Earlier this week, the law enforcement agency issued a new public service announcement, via its Internet Crime Complaint Center (IC3), warning Americans about the threat.

OAuth (Open Authorization) is an internet standard that allows users to give apps access to their account on another service, without giving the app their password for that service. For example, when users install a new app, they have the “Continue with Google” option. When they click it, they are asked if they allow the app to access their email. If they approve, Google gives that app a special access token, which allows the app to access the user’s Google account without ever seeing the password.

Pulling off an OAuth attack

So, to pull off an OAuth attack, the threat actor must first trick Google (or Microsoft, or any other company providing the service) and get their (malicious) app registered on the platform. Then they would reach out to their target via instant messaging, while impersonating government officials, media, and other publicly known personalities, and sharing a link to what appears to be a document.

The link redirects the victim to a legitimate service (for example, Google), where they are asked to grant permissions to the malicious app. If they approve, the attackers gain access to their email accounts with which they can do almost anything.

To make matters worse, simply changing the password does not fix the issue. The only way to eliminate the threat is to revoke the access token that was given, which can be done in the application security settings.

The FBI did not say who the threat actors were or who they were targeting, other than they were “prominent victims”. Their family members were being targeted, as well.

Via The Record

• Thomson Reuters confirmed March 2026 breach of its C‑Track court management system
• Incident affected courts in 11 US states, Ontario, and the US Virgin Islands
• No operational disruption; scope of exposed records still under investigation, no misuse reported yet

Thomson Reuters, the IT company behind the Reuters news agency, suffered a cyberattack a few months ago, exposing certain court documents to the attackers. In a brief announcement published earlier this week, it seems Thomson Reuters only noticed the intrusion now, months after it was already over.

Here is what happened: Thomson Reuters operates a court case-management system called C-Track. It is a tool used by different courts to manage things like cases, filings, hearings, and schedules. It is used by courts in several US states, the US Virgin Islands, as well as Ontario, Canada.

On June 30, 2026, Thomson Reuters detected unauthorized activity in one of its cloud environments, prompting an investigation which later determined that an unauthorized threat actor broke in and obtained some C-Track files. This happened in March 2026.

Investigation underway

So far, the incident is confirmed to have taken place across 11 US states (Alabama, Pennsylvania, Kentucky, Montana, Nevada, North Dakota, South Carolina, Tennessee, Ohio, New Hampshire, Wyoming), the U.S. Virgin Islands, and Ontario, Canada, exposing court records and personal information. Ontario's three Chief Justices confirmed it, as well, saying Thomson Reuters notified Ontario's Ministry of the Attorney General on July 23.

A more detailed investigation is currently underway, and all relevant authorities have been notified, it was said. At press time, Thomson Reuters did not yet determine exactly what information was accessed, or how many people were affected. The good news, however, is that there is currently no evidence of identity theft resulting from the incident, and there is no indication that systems handling court-related financial transactions were affected.

C-Track itself remains operational, as well. No threat actors have yet claimed responsibility for the attack or threatened to leak the files to the dark web.

"There has been no operational disruption to C-Track as a result of this incident," a Thomson Reuters spokesperson said. "Our products and services remain fully operational and are safe ​to continue to use. Independent ​cybersecurity experts assisted in ⁠the investigation and validated the remediation measures implemented."

• Microsoft is rolling out a new security feature for Windows 11
• Memory integrity provides stronger defenses for a crucial part of the operating system, and it's being automatically enabled
• Some gamers say the feature hampers gaming frame rates considerably, and they're not happy

Windows 11 is getting its security bolstered with a feature that's being automatically enabled, but which comes at a cost that some PC gamers don't want to pay — and this is proving quite the controversy on social media.

The Verge reports that Microsoft has announced that it's rolling out the enablement of memory integrity protection across eligible Windows 11 PCs, and that this is because "security works best when protection is built in, not bolted on".

Microsoft explains: "More devices will soon receive stronger protection by default, with no additional setup required. Windows quality updates will begin enabling memory integrity protection on eligible devices.

"If not already enabled, these updates will also enable VBS [Virtualization Based Security], helping make additional security capabilities available and reflecting our commitment to making Windows secure by design and secure by default."

The idea is to tighten security for Windows 11's kernel-mode drivers, a core aspect of the OS with direct access to the system's hardware, and there can be no argument that this additional protection gives host PCs tougher defenses and makes them more difficult to exploit. So why the controversy? Let's dive into the pros and cons of what's going on here.

Analysis: a divisive move — but we can't ignore that the threat landscape is changing

In Microsoft's view, this is a no-brainer: stronger security is being rolled out to Windows 11 devices, or at least those which are eligible (older PCs may not be). However, PCs configured via group policy not to use memory integrity, or machines where it's been disabled before, won't have the feature forced on them.

Other supported PCs will get memory integrity (and VBS, because it's required for memory integrity) turned on automatically by Windows 11, and this is where some gamers are up in arms. VBS has a long history of being a thorn in the side for gamers, with the feature being linked to frame rate losses.

How much of a headwind does this cause for PC games? Well, therein lies a big part of the issue, because it's difficult to pin that down exactly, and as ever, it's bound to vary depending on your PC's exact hardware and system configuration.

Some gamers observe frame rate hits of approaching 10%, while others say the impact isn't noticeable at all. There's a lot of back-and-forth on Reddit arguing about the extent of any slowdown, and here's a typical exchange:

One Redditor notes: "HVCI [memory integrity] is a great security feature, and the performance impact on newer platforms (to which this automatic switch will apply) is negligible."

Another replies: "It ain't negligible. 9800x3d, 5080, ddr5 6000 cl28 and my 1% lows get wrecked with this feature on. Way smoother disabled."

This isn't just about frames per second performance for some gamers, then, as there are also accusations of it affecting the lowest troughs (bottom 1%) that the frame rate hits (meaning the game suffers more stuttering at times and generally feels jerkier).

As the first comment points out, though, the likelihood should be that a more modern PC won't feel much of a hit (if anything). The gaming rigs that might see more of a spanner in the frame rate works are those which are older, but still modern enough to get the auto-enablement of memory integrity. In other words, a collection of PCs which are on the outer fringes of that compatibility limit (older machines, but not too old to avoid the feature rollout).

Of course, even those PC owners can always turn off memory integrity. The major beef for some is that they remember that Microsoft got into trouble for automatically switching on VBS in the past in a quiet, under-the-radar manner — and the question now will be whether gamers realize that this feature has been enabled alongside memory integrity.

In all honesty, when I saw what Microsoft was doing here and fired up Reddit to test the temperature of the reactions, I was expecting nothing short of a flamethrower being turned on the software giant. However, the feedback is split quite evenly between the haters — or those who disapprove at least — and users who are applauding Microsoft for this deployment.

Here are a couple of further examples from either side of the fence: "Apparently a controversial opinion, but systems that are for everyone should be failsafe, and that includes the most secure option being the default. There should be an option to disable security to get higher performance, but most secure should be the default."

Juxtaposed with this: "Already have memory integrity turned off as this 'feature' already hits gaming, I've used Windows without memory integrity for decades I think I'll be ok."

I must admit I'm inclined to agree with Microsoft's decision here — providing that when it happens, Windows 11 is clear on informing the user, so they can reverse the change if they aren't happy with it.

I think part of what Microsoft is doing here is keeping one eye on the future in terms of the difference AI might make to the security of Windows 11 PCs.

I keep hearing about how AI is already driving new threats and exploits, and so the kernel defenses that are being brought into play here may not have been quite as necessary in the past — as the last Reddit post I highlighted indicates — but they may be very much needed before too long. AI is accelerating the development of new threats considerably, and making it easier for anyone to becoming a peddler of malware, so Microsoft likely feels the pressure to act.

• 22% expect their policy to offer full coverage, 10% expect it to fall short
• Data breaches and reputational damage are major concerns
• Companies should look at finances before considering operational recovery readiness

New research from Cohesity has revealed that many UK businesses could be significantly overestimating the protection they get from cyber insurance policies, with just one in five (22%) British CEOs believing their policy would cover both the additional costs and lost revenue that an attack could lead to.

A third expect it would cover the additional costs only, another third believe their policy is only sufficient for lost revenue, and a further one in 10 did not expect it to cover either of the two categories.

The report's conclusion is that cyber insurance in its current state for many UK businesses is only enough to transfer some of the financial risk – but not enough to restore systems, data or operations.

Cyber insurance policies don't provide enough cover

According to the study of 100 CEOs from large enterprises, businesses expect a cyberattack to reduce their revenue by an average of around 15%, but many businesses lack a detailed understanding of how much an attack could actually end up costing them. As many as one in five (21%) haven't even conducted business impact modelling.

Among CEOs' biggest fears are data breaches (49%), brand and reputational damage (38%), high recovery costs (36%), revenue loss (34%) and production downtime (30%). They're all either financial concerns or incidents that could lead to financial loss, and yet it's clear that policies are unlikely to offer enough cover.

With many totally unaware of the potential impacts and the extent of their policy's cover, Cohesity urges businesses to start off with calculating financial exposure and understanding what their policy covers.

After that, they can go on to prove that critical systems can actually be recovered, because without an insurance payout, this would likely not be possible.

"Organisations must be able to identify the systems and data needed to keep the business operating, assigning clear responsibility for recovery decisions and regularly testing whether critical services can be restored securely," UK&I VP Fraser Hutchison explained.

There is more technical content available today than any human being could read in a thousand lifetimes. Every topic has a dozen YouTube videos, three Substack posts, a GitHub repo, and a Reddit thread, most created in the last six months and, in many cases, technically accurate.

And yet most of the professionals I talk to say they don't know what to trust. They can't tell what’s important to read first, or which of 10 plausible answers is the one that holds up. That was true before AI, and AI has made it more true.

For most of the history of technical publishing, editing and verification were the same process, and that process was slow and expensive. Getting a book out took years. We found an author, vetted them, had them work with an editor, and checked their claims with technical reviewers.

A lot of that time went into separating what was correct and useful from what was confusing or only sounded right. It was laborious, but it meant a reader could depend on the claims on the page.

The credibility of the book, and of the publisher behind it, mattered as much as the information itself. When the cost of production drops to zero, that credibility becomes worth more, not less. Content is easier to make than ever, but without a transparent process behind it, readers have no idea where the knowledge came from or whether it holds up.

As Jasmine Sun puts it in “The Independent Writer’s Advantage in the Age of AI,” "Trust is not about information and its quality alone. It's about the messenger. It's about who says it and their track record and what they've told me before." A practitioner has confidence in a source because someone she respects has put their reputation on the line for it.

They believe what the author is saying because the publisher has a history of being right and of correcting itself when it isn't, and because the work is attributed and verifiable.

Expertise is alive, and it compounds

The corpus matters, but it's the assurances around it that are hard to replicate, and that comes not just from the people who produce the content but from the people whose judgment vouches for it. Sometimes a creator brings their own credibility with them. Other times, the publisher spots someone unknown and lends them its own.

The art critic Dave Hickey said this about gallery owners in Air Guitar: They gain status from the famous artists they represent and share it with emerging talent who have something to offer but who haven't had the chance to earn a reputation.

Expertise is alive, and it compounds Expertise is a living thing, continuously expanding. Content starts to decay the moment it’s published, because frameworks evolve, libraries deprecate, and yesterday's best practice becomes today's security incident. Keeping expertise alive requires a pipeline of people who stay current and an editorial layer that notices when something has gone stale, and either retires it or calls for a fix.

That pipeline isn't something you switch on when an author has a book to ship. Content sits at the center of our platform, but we think about it in pace layers. Some advice is timeless, some moves but has a long shelf life (some of our books are still in print after nearly 50 years!), and some changes weekly.

We work with experts at each pace layer, capturing what lasts while doing our best to keep pace with an industry that seems to have changed every time we wake up.

We have relationships with hundreds of the best practitioners in the world, and our job is to keep them engaged continuously, with quick takes when something breaks, structured responses when major research drops, and live sessions on emerging topics while they're still emerging.

Trust is earnt

An institution doesn't stamp trust onto content. In a technical community, trust is conferred in both directions. A practitioner earns standing because people who already have standing engage with her work, cite it, argue with it, and build on it. That insight was the whole idea behind PageRank, Google's first great innovation. A page mattered because other pages that mattered linked to it. Reputation works the same way.

The audience isn't just consuming reputation signals; it's generating them. When a senior engineer whose judgment others respect says out loud that something is worth reading, she spends a little of her own credibility; the author gains a little; and everyone watching recalibrates whom to trust next time.

When we put our mark on someone's work, we aren't the sole source of its credibility. We're amplifying a judgment the community is already making and adding our own track record to it. The reader who finds it reliable hands status back to the source.

When the readers are machines

Human practitioners aren't the only ones who need trusted engineering knowledge. The AI systems now sitting in every workflow, the coding and debugging agents and architecture advisors, need it just as badly since most of them are built on scraped web data and documentation that was stale before it was ever indexed. They're fluent, but they're wrong often enough that you can't just take their word for it.

The stakes grow with AI tools increasingly being used to generate not just provably correct types of content like code, which either works or it doesn’t, but persuasive documents in fuzzier areas like hiring, strategy, and so on. Like everyone else leaning on these tools, we are reckoning with the consequences of the ability to talk to a model and get back something that looks smart at a glance.

A few rounds in, the slop is still there. In the last few months, maybe 10 times as many documents have crossed our desks, from new product ideas to strategic plans and proposals. But the ease of generating the text hides the fact that either the model or the person prompting it doesn't actually know what they’re talking about. Knowledge workers need ways to ground their work in insights from human experts, particularly when that work is AI-assisted.

So we’re building tools that let agents draw on our repository of expertise to support their proposed decisions.

Credible sources are particularly important when thinking through and justifying important choices. Our CTO, Andrew Odewahn, describes the shift this way: "18 months ago, it was all about how to get engineers to be more productive, but now it's about how to get organizations to make better decisions. The engineering tasks are moving away from coding output to planning."

For planning tasks like comparing implementation approaches, you need expert-over-your-shoulder guidance for contextual decision-making. You can’t just rely on an LLM's best guess to solve your problem. Trust is foundational because the expertise behind it stays genuine, practical, and human.

We've featured the best AI website builder.

This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit

• Baylor Genetics confirmed a June cyberattack affecting 2.8M patients and employees
• Stolen data includes medical test results, insurance info, and some SSNs/financial details
• Operations continued; no misuse seen yet, but no group has claimed responsibility

Baylor Genetics, a US-based clinical diagnostic laboratory, suffered a cyberattack in which it lost sensitive data on 2.8 million people - both patients and employees.

In a security update posted on its website earlier this week, the company said it spotted the intrusion in a “limited portion” of its IT environment on or around June 15. Subsequent investigation determined that both patients and employees have had their data stolen, including those who are not working at Baylor anymore.

For patients, crooks stole names, dates of birth, medical testing information, laboratory test results, and “potentially health insurance information, as well as Social Security number”. SSNs, Baylor Genetics stressed, were taken from a “very limited subset of patients”.

No attribution yet

Regardless, fraudsters who know the details about medical testing and lab results have more than enough information to launch highly sophisticated, personalized phishing attacks that can lead to ransomware infections, business email compromise, and more.

For certain current and former employees, the attackers nabbed Social Security numbers, government-issued identification numbers, and financial account information, ideal for wire fraud.

In the security update, the company did not discuss the identity of the attackers, or the number of affected individuals. However, in a separate report filed with the US Department of Health and Human Services, Baylor reported the number of victims as 2,810,878. It added that at the time of publication, there was no evidence of confirmed identity theft, fraud, or misuse of personal information stolen in the attack.

It also said the incident did not impact its everyday operations which continued as usual.

Usually, data theft incidents like this one are followed by public disclosure from the perpetrators, who name-and-shame their victims in an attempt to get them to pay a ransom demand. So far, no threat actors claimed responsibility for this incident.

In banking and utilities, regulators define certain systems as essential. An essential system is one whose failure would cause intolerable harm to customers, markets, or public safety. A payment platform in a clearing bank or a SCADA network in a power distributor, for example, carries the highest governance obligations: continuous monitoring, validated change control, and demonstrable resilience.

The policy environment – the accumulated rules across firewalls, cloud controls, and microsegmentation – determines which of those systems can reach each other, which connections are blocked, and which exceptions still apply. Collectively, these rules form the security policy control plane: the governance layer that translates business intent into access decisions across distributed enforcement points.

A misconfigured segmentation rule during a cloud migration can sever a payment service from its settlement platform; a temporary rule granting broad access from a development subnet into production can stay in place months after go-live because no one owns the removal.

Every firewall rule, segmentation policy, and access decision directly affects operational risk, and when the policy environment fails, the critical services it governs fail with it.

That makes the policy environment critical infrastructure in its own right.

Still governed like housekeeping

Despite this, many regulated organizations still manage their policy environments as operational tasks. Rules are added through change requests, and the accumulated result is rarely examined against what was intended. Ownership disperses as leaders change roles, and the reason why a specific rule came into being in the first place can only be found in a change ticket, if anywhere at all.

A CISO who would never accept a payment platform running without continuous monitoring or documented dependencies may accept both being absent from the policy environment that determines whether the platform is reachable. We can think of this as infrastructure-grade consequence with housekeeping-grade governance.

In banking, a policy failure that severs connectivity between settlement systems would constitute the disruption of an important business service. The FCA would take an interest in such a failure, since the loss of such a service could lead to intolerable harm.

In healthcare or energy, the consequences are different but the mechanism is the same: a misconfiguration that permits access from a corporate network into clinical systems in an NHS trust, or into operational technology in a power distributor, creates exposure at the level of essential service delivery. These are not hypothetical risks but the operational consequences of treating critical infrastructure governance as a simple housekeeping task.

Regulatory expectations point the same way

UK regulatory expectations increasingly support the same conclusion: the security policies governing access to important services must be managed with infrastructure-grade discipline. The FCA's operational resilience regime requires regulated firms to identify important business services and demonstrate, on an ongoing basis, that the supporting infrastructure remains within defined impact tolerances.

Ofgem assesses operators of essential services against the NCSC's Cyber Assessment Framework, asking whether defined security outcomes are being achieved on a sustained basis. The Cyber Security and Resilience Bill, expected to become law later this year, will extend similar obligations to data centers, managed service providers, and critical suppliers.

These frameworks are not prescriptive – none of them specifies which firewall rules an organization should have or how its segmentation policies should be configured. What they require is proof: that what the policy environment permits is what was intended, and that the organization can demonstrate this on an ongoing basis rather than reconstruct the evidence for each assessment.

Why the estate cannot meet that standard

Most policy environments were never built to meet that standard. In fact, most policy environments were never consciously or deliberately built at all. Instead, policy tends to accumulate as a by-product of delivery. Every project and migration adds rules, and almost none take any away.

Over time, the policy surface – the full body of rules and access decisions across enforcement layers – grows larger than the group of people who understand it, and the estate reaches a point where it can be operated but not explained.

Across regulated industries like banking, energy, and healthcare, that was sustainable under earlier regulatory regimes: periodic assessment, control-based audit, compliance frameworks that asked whether controls existed rather than whether they were effective. But this is no longer enough. The new standard requires continuous evidence that access is intentional.

The FCA's findings after a year of operational resilience self-assessments illustrate what this looks like in practice. Where regulated firms reported few or no outstanding vulnerabilities in the infrastructure supporting their important business services, the FCA often deemed the evidence too thin to determine whether there really were no vulnerabilities – or whether the vulnerabilities just hadn't been identified.

The lesson applies directly to security policy governance: an organization cannot credibly claim access-related vulnerabilities are controlled without evidence of what its policies permit, how they were tested, and whether weaknesses were remediated.

What infrastructure-grade governance requires

Too often, the response is to reach for more visibility and more documentation. But documentation will only ever capture a point in time; it cannot provide the continuous assurance regulators are coming to expect.

A CISO in a regulated firm needs more than a record of what the policy environment was configured to permit. Configuration and effective access are not the same thing. Security teams need to understand how rules, routes, objects, and enforcement layers interact to determine what can actually communicate.

Meeting the standard means reconciling the two: showing that what the environment permits in practice is still what it was intended to permit, and being able to show it without notice.

We separate where policy intent is defined from where it is enforced. Intent is held and maintained centrally, while enforcement remains distributed across firewalls, cloud controls, and microsegmentation in hybrid, multi-cloud, and multi-vendor environments.

Validation runs continuously against that intent rather than at review points: proposed changes are tested against policy before they reach production, and effective access is assessed on an ongoing basis for unnecessary exposure, inconsistency between enforcement layers, and divergence from business intent. What was permitted and what changed is retained as evidence.

The same CISO who would never accept a payment platform running without continuous monitoring, validated change control, and documented dependencies has to apply that standard to the policy environment that determines whether the platform is reachable.

The FCA, the NCSC's Cyber Assessment Framework, and the Cyber Security and Resilience Bill all point towards the same underlying question: can this organization demonstrate, continuously, that the infrastructure supporting its critical services is governed to the standard those services demand?

Answering it means knowing (and actually knowing – not assuming, not reconstructing at audit) what the policy environment permits at any given moment, and whether what it permits is what was intended.

We've featured the best antivirus software.

This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit

• UK legislators propose “kill switch” laws to halt runaway AI, citing critical infrastructure risks
• Lord Clement‑Jones and MP Alex Sobel push amendments and new bills, backed by ControlAI advocacy group
• Similar efforts emerging in US

Sam Altman’s fear-based marketing for AI seems to have backfired, as now multiple legislators in the UK and elsewhere are calling for a “kill switch” law to be introduced.

According to the BBC, Liberal Democrats’ Lord Tim Clement-Jones proposed an amendment to the Cyber Security and Resilience Bill which would see the UK create a “vital safety net” to provide a “democratically accountable means to ‘halt a runaway system before it can compromise our critical national infrastructure’.” The capability would only be used as a last resort, Clement-Jones stressed.

The bill is currently being worked through in the UK Parliament, the BBC said.

Is there reason to worry?

But that’s not the only effort in the UK to put some reigns on AI. Apparently, Labour MP Alex Sobel plans to introduce an AI Security Bill later this month which, according to the BBC, would “effectively halt the development of superintelligent AI” and make the UK the first G7 country to do so.

The bill is supported by a campaign group called ControlAI, a UK-based nonprofit and advocacy organization focused on the risks posed by advanced AI. Its founder and CEO is Andrea Miotti, who previously worked at the AI safety company called Conjecture. Across the pond, US legislators are currently considering an AI Kill Switch Act as well, but the bill is still in very early stages of development.

Ever since the first ChatGPT model that was introduced in 2021, a debate has been raging whether or not AI will be net positive, or net negative, for humanity. While some argue that the discovery rivals the steam machine and that it will transform our lives beyond our wildest dreams, others are fearful of losing jobs, a collapsing economy, and a dystopian future devoid of humanity and emotion.

Marketing campaigns for ChatGPT and, in some measure, Claude, are not helping, either. Both companies have built models focused on cybersecurity which were advertised as “too dangerous” for the general public and instead were only given to a handful of organizations. Despite partial skepticism, many are worried that these models might severely disrupt the security of banking, critical infrastructure, and communications.

Via BBC

When a critical vulnerability alert lands in a traditional IT environment, it’s rarely a cause for panic regarding the operational continuity of the business. The affected laptops, servers, and applications can be identified quickly, and a good team can catalogue and patch them within hours if it’s urgent. The priorities are clear, and there’s very little guesswork involved.

Now picture the same alert landing across a hospital's imaging equipment, a factory floor's control systems, or a building's HVAC network. These cyber-physical systems (CPS), the connected devices that run physical operations rather than just processing data, sit at the sharp end of IT and OT (operational technology) convergence.

But unlike traditional IT assets, confirming whether that alert even applies to a specific device can take days, and often ends in a guess rather than an answer.

While this kind of uncertainty would be considered a failure of basic hygiene, for cyber-physical systems, it’s unfortunately much more often the norm.

So why is this such a widespread problem for CPS, and how can security teams get these vital assets back in line with their IT network?

Bad visibility into cyber-physical systems is worryingly widespread

The inability to manage incoming vulnerabilities for CPS isn’t an outlier or worst-case scenario, which is especially concerning when these assets are at the heart of critical infrastructure like energy and healthcare.

The issue comes down to the product codes that help networks identify what CPS is in the environment, which is an essential part of identifying and applying security patches.

Across a dataset of 17 million cyber-physical assets, our research found that 88% failed to transmit an exact product code, and 76% sent a code that didn't match the vendor's own record.

It’s a side effect of the way these systems were initially designed and later integrated into modern IT environments. Programmable logic controllers (PLCs), medical scanners, and industrial sensors were engineered for decades of physical reliability, not for tidy digital labeling. Network identification was rarely part of the design brief, so the same device can report itself differently depending on which protocol or integration is asking.

We found a similar state of affairs when it comes to the operating systems behind the physical hardware. In our research, 41% of devices have no OS version available, and 24% have no OS name at all.

Without these details, matching a device to a known vulnerability stops being a quick database lookup or automated process, and becomes a guessing game or painstaking manual search.

Added to this, CVE advisories, the industry's standard mechanism for tracking vulnerabilities, are compiled from this same patchy vendor data. An official advisory can be just as incomplete as the network it's meant to protect.

Translating product code chaos into boardroom risk

This kind of blind spot adds another layer of concern to a leadership that is already anxious about threat visibility. Among 1,100 security leaders surveyed globally, 44% named understanding their organization's risk exposure as one of their biggest operational concerns, more than compliance pressure or budget constraints.

A further 45% said they were struggling to reduce cyber risk to their most important assets and processes, yet the connection between that struggle and an unreliable asset inventory is often missed entirely. Leadership sees the symptom, a rising sense that risk is unmanageable, without ever seeing the cause sitting underneath it.

This is where security and the business can end up talking past each other. Security teams that start describing the problem in terms of missing product codes and inconsistent naming conventions won’t get far.

Business leaders hear none of that; they hear only that risk cannot be quantified with confidence. Until those two conversations are connected, every risk register that a CISO presents upward carries an asterisk that nobody in the room can see.

Context is key to closing the gap

Resolving this issue starts with a shift in what visibility means. Knowing a device exists on the network is only half of the job. Knowing what it does, what process depends on it, and what happens if it's compromised is what actually makes a risk register useful.

Achieving this shift at scale requires specialized tools to manage the often eclectic and proprietary nature of CPS assets, and an automated approach to cope with the scale.

In one example, applying AI-driven mapping techniques to an OEM's device catalogue lifted product code identification from 4% to 83%, turning a near-blind spot into a near-complete picture. The follow-through mattered just as much, with 56% of devices receiving a new or updated firmware recommendation as a result, and vulnerability identification accuracy improving by 25%.

Numbers like these matter because they change the question security teams can answer. Instead of asking what's connected to the network, teams can ask which systems would cause the greatest disruption if compromised, and act on the answer with confidence rather than inference. That is the difference between an asset inventory that exists on paper and a resilient one that holds up under pressure.

Fixing the foundation, not just the alarm

None of this gets solved by adding another tool to the stack. Instead, it means treating asset data quality as a board-level risk issue rather than background IT housekeeping, with the same scrutiny applied to budgets, compliance and third-party access.

Achieving this means a new CVE alert no longer triggers a scramble to work out which critical devices might be affected, but the confirmed, prioritized response you’d expect from any good vulnerability management program.

The alert landing on a hospital's imaging equipment or a factory floor's control systems should be no harder to act on than the one landing on a laptop. Getting there starts with making the invisible visible.

We've featured the best firewall software.

This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit

• Forescout researchers showed AI can port RCE exploits to PLCs, achieving DoS and shellcode execution
• Effort required heavy researcher input and $500+ in API usage, making attacks impractical for criminals
• Nation‑state actors remain a concern, as seen in Sandworm’s 2025 attack on Poland’s power grid

If you are worried cybercriminals will use Artificial Intelligence (AI) to automate the discovery and exploitation of zero-day vulnerabilities in Operational Technology (OT) such as Programmable Logic Controllers (PLC) you can sleep peacefully, at least for a little longer.

Recently, security researchers from Forescout set off on a simple mission - to understand if crooks can use AI to target the ever-increasing population of exposed industrial devices. The short answer is “yes, but it’s not yet worth the trouble”.

In their mission, they launched an experiment - to port a remote code execution (RCE) vulnerability from one PLC to another. These devices were built on closed-source software and thus were not that easy to manipulate, yet the experiment was a success.

Yes, but...

Not only did they manage to trigger a Denial of Service (DoS) state that crashed the device but ended up with a working RCE capable of executing attacker-supplied ARM shellcode.

It is indeed a worrying development, but one that comes with a huge “but”:

“It required significant researcher input. The final RCE development stage consumed more than $500 in API usage. An attempt to extend the exploit beyond the initial RCE ultimately bricked the PLC,” the researchers said in the report.

“These limitations taught us valuable lessons about AI-assisted exploitation in OT. It can be done, but it’s not as easy as it sounds. For now, the difficulty, cost, and specialist expertise required are likely to make this kind of attack less attractive than easier alternatives.”

In other words, cybercriminals still have easier avenues to explore, and as long as that is the case, OT is relatively safe. What the report, unfortunately, does not discuss, is nation-state attackers with significant resources. For such attackers, industrial devices are a prime target, and spending $500+ in API usage is a drop in a bucket. We’ve already seen it back in 2025 when Sandworm struck Poland’s electricity suppliers.