Newly released court documents detail a significant legal and ethical confrontation between Anthropic and the Pentagon regarding the military application of the Claude AI model. The dispute originated when Anthropic attempted to impose strict guardrails prohibiting its technology from being used for domestic surveillance or fully autonomous lethal weapons systems. Defense Department officials rejected these limitations, asserting that the military requires total flexibility to utilize artificial intelligence for all lawful national security operations. Source  ( 21 min )

Anthropic has launched enhanced administrative tools for Claude Enterprise to manage the high token consumption associated with agentic workflows and coding tasks. Administrators can now access a detailed analytics dashboard that tracks costs and usage by individual users or SCIM-managed groups. These insights include specific metrics for Claude Code, such as session counts and estimated productivity value, to help justify AI investments. Source  ( 21 min )

SpaceX has reached an agreement to acquire Cursor, a prominent AI-powered code editor, for $60 billion. Cursor is widely used by developers because it allows them to toggle between various large language models from providers like OpenAI and Anthropic. The acquisition provides Cursor with massive computing resources for internal model training while giving Elon Musk a dominant tool in the developer ecosystem. Source  ( 21 min )

Anthropic has initiated preliminary discussions with Samsung Electronics to explore the development and manufacturing of custom AI chips. The collaboration would reportedly leverage Samsung’s 2-nanometer process technology and advanced chip packaging capabilities to improve performance. To support this initiative, Anthropic recently expanded its engineering team by hiring Clive Chan, a former chip developer from OpenAI. Source  ( 21 min )

Cisco has introduced Live Protect for its Nexus infrastructure to address the critical "patching gap" that occurs between vulnerability discovery and software updates. This new feature allows data center operators to deploy real-time shields that mitigate specific security risks without requiring system reboots or scheduled downtime. By providing immediate protection against zero-day exploits, the solution helps maintain operational uptime while security teams prepare permanent software fixes. Source  ( 21 min )

Anthropic has reduced the system prompt for its Claude Code tool by 80 percent to improve efficiency. The developer team discovered that the latest Fable 5 models perform better when provided with fewer explicit instructions and examples. This shift suggests that modern large language models are becoming more capable of interpreting intent without rigid guidance. Source  ( 21 min )

Microsoft has introduced a unified alert experience for Purview Insider Risk Management to streamline how security teams investigate potential internal threats. This update consolidates classic alerts and agent-generated insights into a single queue, eliminating the need to toggle between different views. Analysts can now preview AI-generated summaries and user details directly from the primary list to prioritize high-risk activities more effectively. Source  ( 21 min )

Apple is reportedly negotiating with Chinese semiconductor manufacturers ChangXin Memory Technologies and Yangtze Memory Technologies to secure a stable supply of memory chips. This move aims to counter a worsening global supply crunch driven by the rapid growth of artificial intelligence technologies. While these Chinese firms are currently on a Pentagon blacklist, Apple is seeking to navigate political hurdles to integrate their components into its hardware ecosystem. Source  ( 21 min )

Microsoft is establishing a new business unit called Microsoft Frontier Company to accelerate the adoption of generative AI within enterprise environments. Backed by a $2.5 billion investment, the organization will deploy 6,000 industry experts and engineers directly into customer operations to co-design and manage custom AI systems. This initiative represents a formal shift toward "forward-deployed engineering," where technical staff work on-site to ensure AI tools deliver measurable business outcomes rather than remaining as experimental pilots. Source  ( 21 min )

European software giant SAP is restructuring its workforce to prioritize the management and mentoring of AI agents rather than traditional coding tasks. While the company previously cut nearly 10,000 positions, executives now aim to maintain headcount by shifting employees toward creative and customer-facing roles. This strategy focuses on "forward-deployed engineers" who utilize automation to handle routine software testing and development. Source  ( 21 min )

Cloudflare has announced a significant policy shift that will block "mixed-use" web crawlers from ad-supported pages by default starting September 15, 2026. This change targets bots that combine traditional search indexing with AI training or agentic functions, forcing providers to separate these activities. The update applies to all new Cloudflare customers, new sites from existing customers, and all users on the Free service tier. Source  ( 21 min )

The Department of Homeland Security is investigating a significant breach of its Homeland Security Information Network (HSIN). This platform serves as a critical hub for federal, state, and local agencies to coordinate emergency responses and share sensitive intelligence. The unauthorized access reportedly occurred between late May and early June, potentially compromising data used for major event planning. Source  ( 21 min )

Amazon has successfully deployed 396 satellites into low-Earth orbit, reaching the minimum threshold required to begin initial broadband operations. This milestone follows a recent launch of 29 additional units, positioning the company to meet its commercial rollout target for mid-2026. While the current constellation is small compared to established rivals, it provides enough density to support continuous connectivity across specific geographic latitudes. Source  ( 21 min )

Anthropic is expanding its enterprise presence by integrating Claude AI agents directly into the Microsoft ecosystem. While a native "Claude Tag" feature currently allows Slack users to mention the assistant in shared channels, Microsoft Teams users can now access similar capabilities through a dedicated Microsoft 365 connector. This integration allows the AI to reason over organizational data stored in Teams conversations, SharePoint, and OneDrive without requiring manual file uploads. Source  ( 21 min )

A newly discovered threat actor named JADEPUFFER has conducted what researchers believe is the first fully autonomous ransomware attack driven by an AI agent. The operation exploited CVE-2025-3248, a remote code execution vulnerability in Langflow, an open-source framework used to design large language model workflows. Once inside the environment, the AI agent performed reconnaissance, harvested cloud and API credentials, and established persistence without human intervention. Source  ( 21 min )

Google is testing a new reCAPTCHA verification method that requires users to perform hand gestures in front of their webcams. The system utilizes machine learning to map 21 specific coordinates on the hand, including finger joints and palm geometry, to ensure a live person is present. This experimental feature is designed to combat automated fraud such as credential stuffing and bulk account creation by implementing liveness detection. Source  ( 21 min )

Microsoft is upgrading Copilot in Excel with a multi-agent search system designed to handle complex web research directly within the spreadsheet interface. This new architecture replaces the previous single-query method with a coordinated team of sub-agents that investigate different facets of a prompt simultaneously. The system aims to transform Excel from a simple data grid into a sophisticated research surface for business decision-making. Source  ( 21 min )

Microsoft has resolved a service-side bug that caused Copilot Chat buttons to disappear from the classic Outlook for Windows client. The issue primarily affected users with Copilot Chat (Basic) licenses, removing icons from the side navigation bar and the area above the ribbon. While the buttons were missing in the desktop application, the AI service remained fully functional through Outlook on the web and standalone mobile apps. Source  ( 21 min )

Google Chrome version 150 has officially removed support for Manifest V2 extensions, effectively disabling older ad blockers and tools. While initial expectations suggested this change would arrive with version 151, the transition occurred earlier than anticipated. This shift forces users to adopt Manifest V3 alternatives or seek different browser platforms to maintain specific extension functionalities. Source  ( 21 min )

Microsoft has announced that Windows 11 version 24H2 Home and Pro editions will reach the end of servicing on October 13, 2026. After this date, these specific versions will no longer receive monthly security updates, technical support, or fixes for known issues. Systems running these editions must transition to a newer release to remain protected against emerging security threats. Source  ( 21 min )

How we built a procedural engine that learns your real cloud environment, generates decoy environments indistinguishable from production, and converts every attacker interaction into signal. In the myth, Daedalus built the Labyrinth of Knossos so well that he nearly couldn’t escape it himself. The corridors looked real. The paths felt purposeful. And the deeper you […] The post Knossos: Procedurally Generated Decoy Environments appeared first on Praetorian.  ( 17 min )

We’re back, melting - we’ve tried shouting, screaming, and throwing things at the Sun, and it is just not working. Before we begin our analysis, we want to be clear - given the number of vulnerabilities fixed (and some not mentioned..), we’ve struggled to have confidence  ( 8 min )

Compaction cut input tokens 86% across long-running agent evals with no quality loss. Context discipline matters as much as model selection.  ( 28 min )

Compaction cut input tokens 86% across long-running agent evals with no quality loss. Context discipline matters as much as model selection.  ( 28 min )

Favicons are small, static, and rarely changed, which makes them a surprisingly durable fingerprint for identifying software across the internet. Bishop Fox built an AI-assisted pipeline to hash and enrich them at scale, and this post shares the methodology, the dataset, and why it matters.  ( 19 min )

Power AI-driven security with trusted security context, Wiz AI Agents, and Wiz AI Skills.  ( 56 min )

The U.S. Federal Migration to PQC Just Got Real  ( 64 min )

Elastic's InfoSec team built AI agents on Elastic Workflows that investigate every alert and assemble the case before an analyst ever opens it.  ( 45 min )

﷽  ( 15 min )

Microsoft's June 2026 security updates introduce several new capabilities across its security portfolio, including AI-driven vulnerability scanning, endpoint protection for local AI agents, identity backup and recovery, and expanded multicloud coverage. The month also brought the largest Patch Tuesday release on record, with over 200 vulnerabilities patched. This article evaluates the technical features, requirements, and limitations of these updates from an administrator's perspective. Source  ( 28 min )

Microsoft has formally intervened in the Latombe v. Commission case before the Court of Justice of the European Union to defend the EU-U.S. Data Privacy Framework. This legal arrangement allows certified American companies to receive personal data from the European Union while adhering to GDPR adequacy standards. The company argues that the framework is essential for maintaining the legal stability of transatlantic data flows that power modern cloud services. Source  ( 21 min )

A critical vulnerability in Apple’s Hide My Email service reportedly allows attackers to uncover the real email addresses associated with generated aliases. Discovered by security researcher Tyler Murphy, the flaw was responsibly reported to Apple over a year ago but remains unpatched despite multiple follow-ups. Independent testing by 404 Media successfully verified the exploit, confirming that a hidden iCloud address could be linked to a user's primary identity in minutes. Source  ( 21 min )

GitHub has updated the Copilot Command Line Interface (CLI) to include an automatic model selection feature that routes tasks to the most appropriate AI model. This system, powered by an internal router called HyDRA, analyzes task complexity, reasoning depth, and tool orchestration requirements to determine the optimal model for each request. The automation aims to provide a high-quality experience while maintaining reliability by monitoring real-time model health and availability signals. Source  ( 21 min )

Visual Studio Code has introduced generally available browser tools that allow GitHub Copilot agents to autonomously build and verify web applications. These agents can now perform complex browser actions such as navigating pages, clicking elements, and handling dialogs to validate their own code. By capturing console errors and screenshots, the AI identifies functional bugs and implements fixes without manual developer intervention. Source  ( 21 min )

Adobe has released critical security updates to address seven vulnerabilities with a perfect CVSS score of 10.0. These flaws primarily affect ColdFusion 2023 and 2025, as well as the Campaign Classic marketing platform. The vulnerabilities stem from improper input validation, unrestricted file uploads, and incorrect authorization mechanisms. Source  ( 21 min )

Microsoft is completing the rollout of a redesigned Start menu for Windows 11 versions 24H2 and 25H2, introducing a more flexible, modular interface. The update features a scrollable single-page layout, a category view for all applications, and the ability to hide the recommended content section entirely. These changes are powered by a fundamental shift in how the UI is rendered, decoupling various sections into toggleable modules to improve user customization. Source  ( 21 min )

Oracle has released VirtualBox 7.2.12, a maintenance update addressing a critical stability flaw affecting Linux hosts. The most significant fix resolves a bug that caused full kernel freezes on Arch Linux when attempting to start a virtual machine. This issue previously required a hard hardware reset because the system would stop responding before any diagnostic information could be logged. Source  ( 21 min )

Microsoft has introduced several AI-driven features to Teams, including new calling agents that can conversationally route department calls or schedule appointments. A new brand impersonation protection system now detects and warns users when a caller may be posing as a trusted entity like a bank or IT help desk. Additionally, a new administrative policy for meetings helps identify potential bots and automatically routes them to the lobby for organizer approval. Source  ( 21 min )

Public AI benchmarks like SWE-bench often fail to predict how coding agents will perform within specific corporate environments. While a model may achieve high scores on open-source tasks, these evaluations do not account for proprietary SDKs, internal architectural patterns, or complex workspace extensions. Consequently, a top-tier leaderboard ranking does not guarantee that an agent can successfully navigate a team's unique codebase or follow internal coding conventions. Source  ( 21 min )

Anthropic has released Claude Sonnet 5, a next-generation model designed to deliver high-tier intelligence at mid-range pricing. The model is now available on Amazon Bedrock and the Claude Platform on AWS, allowing for integration within existing cloud environments. It features a 1-million-token context window and supports selectable reasoning effort levels to balance performance and cost. Source  ( 21 min )

Claude Code has introduced agentic loops to transform manual prompting into autonomous, repetitive workflows that continue until a specific stop condition is met. These loops allow the model to gather context, execute actions, and verify results through structured patterns like turn-based, goal-based, and time-based execution. By utilizing these patterns, teams can automate complex tasks such as UI verification, regression testing, and continuous integration fixes without constant human oversight. Source  ( 21 min )

Recent industry reports indicate a significant visibility gap regarding how employees utilize artificial intelligence tools within the enterprise. While many managers believe they have full oversight, nearly half of organizations admit they cannot track unsanctioned shadow AI or personal accounts used for work tasks. This lack of transparency is particularly concerning as sensitive data exposure through public large language models has become a widespread issue. Source  ( 21 min )

OpenAI engineers have reportedly developed software-based optimizations that reduce the cost of running existing AI models by more than 50 percent. These improvements were demonstrated by serving guest ChatGPT users during peak periods using only a few hundred Nvidia GPUs. While the specific technical methods remain undisclosed, the industry typically achieves such gains through quantization, request batching, and intelligent model routing. Source  ( 21 min )

GitHub has announced the general availability of Anthropic’s Claude Sonnet 5 model within the GitHub Copilot ecosystem. This new model is designed to handle complex coding scenarios and agentic workflows across various development environments. Internal testing indicates that the model excels particularly in command-line interface tasks and maintains low latency during high-demand operations. Source  ( 20 min )

Anthropic has launched Claude Sonnet 5, a mid-tier model designed to deliver performance levels approaching the flagship Opus 4.8. While the model excels at multi-step agentic tasks and coding, independent evaluations show it ranks fifth overall in general intelligence benchmarks. It introduces an "adaptive thinking" mode by default, which allows the model to handle complex automation workflows that previously required more expensive tiers. Source  ( 21 min )

The laptop market at Computex 2026 has diverged into two distinct tiers focused on affordability and local AI performance. Apple’s MacBook Neo has spurred a wave of competitive budget Windows devices, including the $599 Dell XPS 13 and Acer’s Swift Air 14. These entry-level machines prioritize thin-and-light designs and long battery life but are often limited to 8GB of RAM due to high memory costs. Source  ( 21 min )

Anthropic is rolling back a hidden tracking mechanism in its Claude Code command-line interface tool after developers discovered it was secretly flagging users. The feature targeted users connecting through Chinese proxies or those with system timezones set to specific Chinese regions. This discovery raised significant privacy concerns because the tool operates with extensive filesystem and shell permissions on local systems. Source  ( 21 min )

Microsoft Teams has introduced new AI-driven calling agents designed to handle departmental inquiries and appointment scheduling through conversational interfaces. These agents integrate with Microsoft Copilot Studio to facilitate specialized tasks, such as processing customer bill payments directly within a call. To improve security, the platform now includes brand impersonation protection that alerts users when a caller may be posing as a trusted organization like a bank or help desk. Source  ( 21 min )

Intel has released version 24.50.0 of its Wi-Fi and Bluetooth drivers to improve wireless connectivity on Windows 10 and 11. This update introduces support for the new Intel Wi-Fi 6 AX231 adapter while maintaining compatibility with a broad range of Wi-Fi 7, 6E, and legacy AC hardware. The release is part of a collaborative effort with Microsoft to optimize the Windows ecosystem through better driver quality and performance. Source  ( 21 min )

Jamf Threat Labs investigates PamStealer, a macOS infostealer disguised as the legitimate Maccy clipboard manager that uses a two-stage attack chain to silently harvest data and clipboard contents while evading detection.  ( 17 min )

Post-Quantum Cryptography is no longer just about understanding the threat. The real challenge now is migration: deciding where to start, how to reduce risk early, and why waiting for vendors is not a strategy. Part 2 outlines a practical, risk-driven playbook to help organizations take ownership of their quantum-readiness journey and turn urgency into action.  ( 20 min )

We’re back with our look at the Apple macOS and iOS security updates. As this is a new feature for us, please let us know your feedback on the blog. For Jun 2026, Apple released 37 unique CVEs across iOS 26.5.2 / iPadOS 26.5.2, macOS Tahoe 26.5.2, Safari 26.5.2. Since Apple doesn’t provide CVSS scores or other severity information, we’re left to speculate on which of these bugs is the most severe. The overwhelming majority (31 of 37) are WebKit/WebRTC bugs reachable through malicious web content. Most of those are crash/DoS bugs rather than code execution, so the real risk lives in the small set of kernel bugs and the handful of WebKit sandbox escapes. However, there are a couple that stand out. -    CVE-2026-43724 (Kernel) – According to Apple, “An app may be able to cause unexpected sys…

Here is an overview of content I published in June: Blog posts: Update: base64dump.py Version 0.0.30 SANS ISC Diary entries: Microsoft’s Coreutils for Windows Evil MSI Background: BASE64 Statistical Analysis YARA-X 1.18.0 and 1.19.0 Release  ( 11 min )

Microsoft has removed 119 malicious extensions from the Edge Add-ons store and suspended over 90 associated developer accounts. The campaign, dubbed StegoAd, utilized steganography to hide executable code within seemingly harmless image and font files like PNG, WebP, and WOFF2. These extensions reached up to 2.6 million installs by posing as legitimate tools such as ad blockers, VPNs, and translators. Source  ( 21 min )

The AI-powered code editor Cursor has launched a native iOS application in public beta to facilitate mobile development workflows. This tool allows developers to initiate and manage AI agents that can perform coding tasks either on a local workstation or within isolated cloud environments. By providing a mobile interface for these agents, the platform aims to reduce the need for developers to remain physically present at their primary machines. Source  ( 21 min )

Microsoft Intune's June 2026 service release introduces several features that affect application lifecycle management, privilege controls, and device enrollment. Enterprise Application Management (EAM) auto-updates reach general availability, a Vulnerability Remediation Agent enters public preview, Endpoint Privilege Management (EPM) gains support for shared devices and network configuration, and Apple Automated Device Enrollment receives a redesigned policy experience. This article covers the technical details, configuration requirements, and limitations of each feature. Source  ( 30 min )

The Open Memory Protocol (OMP) has launched as a vendor-neutral specification designed to provide a unified memory store for disparate AI tools. This system allows developers to maintain context and user preferences when switching between different platforms like Claude and ChatGPT. By using a shared-memory architecture, compatible clients can read and write to a single user-controlled server instead of maintaining isolated data silos. Source  ( 21 min )

Anthropic has released Claude Sonnet 5, a mid-tier model designed to deliver high-level performance at a lower price point than the premium Opus class. This new model emphasizes agentic capabilities, allowing it to autonomously plan, use tools like browsers and terminals, and execute multi-step tasks. It is currently available as the default model for Free and Pro users and can be accessed by developers via the API. Source  ( 21 min )

Microsoft is accelerating its transition to post-quantum cryptography (PQC) due to rapid advancements in quantum computing that threaten current encryption standards. The company now aims to migrate its critical products and services to quantum-resistant algorithms by 2029 through its Quantum Safe Program. This shift addresses "harvest now, decrypt later" risks, where attackers collect encrypted data today to decrypt it once powerful quantum computers become available. Source  ( 21 min )

Organizations are increasingly facing risks from rogue AI agents that bypass traditional security perimeters by masquerading as legitimate user identities. These autonomous systems can gain persistent background access through unmanaged user consent or by exploiting legacy authentication flows like device-code and Resource Owner Password Credentials. Because these agents often borrow first-party application IDs, they leave no distinct service principal footprint in Microsoft Entra, making them difficult to distinguish from standard user activity. Source  ( 21 min )

As enterprise AI matures, agents are transitioning from passive content summarization to autonomous execution using the Model Context Protocol (MCP). This shift introduces significant risks because agents can now plan multi-step tasks and trigger real-world actions across connected business systems. Unlike traditional chatbots, these agents operate with non-human identities and permissions, making their ability to execute API calls a primary target for exploitation. Source  ( 21 min )

Microsoft is reportedly discontinuing its budget-friendly Surface Go and Surface Laptop Go product lines. Sources indicate that the company has ceased manufacturing the Surface Go 4 and Surface Laptop Go 3 with no plans for future successors. This shift effectively removes the entry-level price points from Microsoft's flagship hardware portfolio. Source  ( 21 min )

AMD has submitted new Linux kernel patches that officially introduce a "Low Power" CPU core classification for its future heterogeneous processors. This new core type joins the existing Performance and Efficiency categories to help the operating system better manage diverse workloads. The patches enable the Linux kernel to identify these cores via specific CPUID functions, ensuring they are correctly recognized by the system's performance management infrastructure. Source  ( 21 min )

Amazon Web Services is launching a new Forward Deployed Engineering unit backed by a $1 billion investment to help customers implement artificial intelligence. This initiative involves embedding thousands of specialized engineers directly into enterprise operations to accelerate technical transformations. The primary goal is to bridge the gap between experimental AI concepts and production-grade systems within complex business environments. Source  ( 21 min )

Chinese food delivery giant Meituan has released LongCat-2.0, a large language model featuring 1.6 trillion parameters and a context window of one million tokens. The model is notable for being the first of its scale to complete both pre-training and inference entirely on domestic Chinese hardware. This development serves as a significant milestone for China’s goal of technological self-sufficiency amid ongoing U.S. export restrictions on high-end AI chips. Source  ( 21 min )

Google has introduced two new generative AI models designed for high-throughput workflows and rapid creative iteration. Nano Banana 2 Lite serves as a cost-efficient image generation model capable of producing visuals in approximately four seconds. Meanwhile, Gemini Omni Flash debuts as a preview model that enables video generation and conversational editing through natural language prompts. Source  ( 21 min )

Apple has shifted its security strategy by releasing an unexpected out-of-band update to address over 30 vulnerabilities across its ecosystem. This move targets flaws in iOS, iPadOS, macOS, and Safari, including a high-severity use-after-free bug in the WebKit engine. The company indicated that this accelerated release schedule is a direct response to the decreasing time between vulnerability discovery and active exploitation. Source  ( 21 min )

Microsoft has launched a public preview of context-based redirections for Windows 365 Enterprise and Flex environments. This feature replaces static allow or block rules with dynamic controls that evaluate the security posture of a session in real time. It aims to balance user productivity with data security by adjusting permissions based on the specific circumstances of a connection. Source  ( 21 min )

AWS has announced the general availability of Web Application Firewall (WAF) protection for the Amazon Bedrock AgentCore Gateway. This integration allows organizations to secure agentic AI workloads against common web exploits and abusive traffic patterns. By applying security at the gateway layer, platform teams can ensure consistent protection as AI applications move into production environments. Source  ( 21 min )

Microsoft is ending support for the Microsoft Store installation type of Microsoft 365 Apps to streamline its deployment architecture. While feature updates for this specific version ceased in October 2025, critical security patches will only continue through December 2026. Users must migrate to the Click-to-Run installation type to ensure they remain protected and receive future cloud-based enhancements. Source  ( 21 min )

Red Hat is positioning OpenShift as a unified platform to manage legacy virtual machines, modern containers, and GPU-intensive AI workloads under a single operational model. This consolidation aims to eliminate the inefficiencies of maintaining separate management teams and security protocols for different infrastructure types. By using a universal abstraction layer, administrators can maintain operational consistency across private data centers, public clouds, and edge environments. Source  ( 21 min )

Microsoft Teams has introduced a new setting that allows users to receive incoming calls in a compact, floating window instead of the traditional full-screen interface. This feature aims to reduce workflow disruptions by allowing users to maintain visibility of their active applications while managing an incoming call. The small window is fully resizable and can be positioned anywhere on the screen to suit the user's multitasking needs. Source  ( 21 min )

Google Cloud is repositioning Spanner as a unified data engine designed to eliminate the fragmentation common in generative AI architectures. The platform now integrates relational data, graph relationships, vector search, and full-text search into a single, globally distributed architecture. This consolidation allows AI agents to access structured history and semantic context simultaneously without the need for complex data pipelines. Source  ( 21 min )

Anthropic has launched the Claude apps gateway, a self-hosted control plane designed to centralize management for Claude Code across major cloud platforms. This tool allows organizations using Amazon Bedrock, Google Cloud, or Microsoft Foundry to move away from individual developer credentials in favor of a unified deployment path. The gateway functions as a single stateless Linux container that integrates directly with existing infrastructure to streamline the onboarding and offboarding of engineering teams. Source  ( 21 min )

GitHub has launched a preview of Claude Opus 4.8 in fast mode for its Copilot platform. This update prioritizes output speed while maintaining the high intelligence levels required for complex coding tasks. The enhanced responsiveness is specifically designed to improve interactive development and autonomous agentic workflows. Source  ( 21 min )

Microsoft has announced that both .NET 8 and .NET 9 will reach their end of support on November 10, 2026. This alignment occurs because .NET 9 is a Standard Term Support release, which now features an extended 24-month support window. After this deadline, these versions will no longer receive security patches, servicing updates, or technical assistance from Microsoft. Source  ( 21 min )

﷽  ( 9 min )

Well, well, well - once again, the cat has dragged us in and spat us out. Today, we find ourselves questioning the reality we sit within. Must it be so predictable, and why us? “But watchTowr, what do you mean?” Well, if you’re here, you likely fit  ( 14 min )

This new version adds option –stats. For more details, take a look at SANS Internet Storm Center diary entry “Evil MSI Background: BASE64 Statistical Analysis“. base64dump_V0_0_30.zip (http)MD5: E54FFB4F618E47FAA724C9F16CF21E7ASHA256: 9475E4184790583265106CBA0FBD04546A7BF4B1B67A569F2B96D432E6F16E2D  ( 11 min )

As the time from vulnerability discovery to exploitation shrinks, building with minimal, secured components is more important than ever. Here is how WizOS helps.  ( 57 min )

Learn how Red Canary engineered a super agent—blending ML, a rules engine, similarity, agentic AI, and LLMs—to classify phishing emails.  ( 28 min )

Post-quantum cryptography is now one pip-install away for the entire Python ecosystem. With funding from the Sovereign Tech Agency, we implemented support for ML-KEM, the NIST-standard key-establishment primitive, and ML-DSA, the NIST-standard digital-signature primitive, in pyca/cryptography. On June 22, 2026, the White House ordered the U.S. government to accelerate its transition to post-quantum cryptography. The order says large-scale quantum computers, especially in adversarial hands, will threaten widely used cryptographic systems, and that attackers may already be collecting encrypted data now so they can decrypt it later. It also sets concrete migration deadlines: high-value and high-impact federal systems must use post-quantum key establishment by December 31, 2030, and post-quant…  ( 4 min )

Our annual report on all the Mac malware of the year - including samples for download, infection vectors, persistence mechanisms, payloads and more!  ( 41 min )

NSLog(@"Hello World"); objective-see.org is alive!  ( 42 min )

Exploiting RootPipe on OS X 10.10.3  ( 42 min )

Announcing the release of DHS; a tool to help detect (dylib) hijackers  ( 42 min )

Details on bypassing Apple's original rootpipe patch  ( 42 min )

A deeper dive into 'MacInstaller' and the adware it installs  ( 42 min )

How reversing Apple's 'RootPipe' patch provided the means to secure TaskExplorer's XPC service  ( 42 min )

How to build HackingTeam's OS X implant in Xcode  ( 42 min )

How to remotely kernel-debug a OS X 10.11 VM  ( 42 min )

Why BlockBlock needs a kext (hint: process monitoring), and how the kext was created  ( 42 min )

Let's look at all the mac malware from 2017, for each - discussing their infection vector, persistence mechanism, features & goals.  ( 40 min )

Our annual report on all the Mac malware of the year - including samples for download, infection vectors, persistence mechanisms, payloads and more!  ( 26 min )

Learn how to leverage Apple's new Endpoint Security Framework to create a comprehensive (user-mode) Process Monitor for macOS 10.15!  ( 14 min )

Getting process creation notifcations from kernel-mode to user-mode, via the undocumented kev_msg_post function  ( 8 min )

Process monitoring via the KAuth Subsystem (and some limitations)  ( 5 min )

HackingTeam using native OS X crypto to protect malware -neat! New blog w/ sample + decryptions/dumpings/detections  ( 5 min )

Dissecting string obfuscations, junk code insertions, and anti-debugging logic of InstallCore  ( 5 min )

In Objective-See's first guest blog post, Amit Serper presents his detailed analysis of OSX/Pirrit  ( 10 min )

By monitoring file I/O events and detecting the rapid creation of encrypted files by untrusted processes, can ransomware be generically detected?  ( 26 min )

How to verify that an application came from the official Mac App Store, via receipt validation  ( 7 min )

Learn how a Finder Sync can 'extend' Finder.app and how this could be abused for persistence  ( 5 min )

Does Shazam's Mac App keep recording even when you turn the app off? ...yes :/  ( 8 min )

The 'Mac File Opener' adware is fairly normal, except for it how it persists via registered document handlers  ( 9 min )

Read how an attacker can bypass Apple's SIP, via the local OS upgrade process  ( 11 min )

Apple's App Translocation broke several of my tools, but we can locally undo it to restore broken functionality!  ( 11 min )

A Word document targets Mac users with malicious macros and an open-source payload.  ( 4 min )

Let's analyse the malware that appeared in 2016, discussing the infection vector, persistence mechanism, feature, and disinfection for each.  ( 12 min )

Today is our 2nd birthday! Let's look at our past, present, and future.  ( 2 min )

Reverse-engineering a 'Russian' implant reveals HackingTeam's code!?  ( 9 min )

The macOS kernel had an (intentional?) off-by-one bug that could trigger a kernel panic.  ( 13 min )

Apple's 'fix' for a macOS kernel panic, fixes nothing and worse, introduces a new bug.  ( 13 min )

The website of a popular application was hacked, and the application trojaned with a new variant of osx/proton.  ( 3 min )

Analyzing code within the macOS kernel audit subsystem uncovered an exploitable heap overflow.  ( 5 min )

Looks like somebody on the 'dark web' is offering 'Ransomware as a Service'...that's designed to infect Macs!  ( 6 min )

Analysis of OSX/Proton.B reveals some interesting tricks plus a command file that can be decrypted to reveal the malware's capabilities  ( 10 min )

Some undetected adware named "Mughthesec" is infecting Macs...let's check it out!  ( 5 min )

A new 'security' feature in macOS 10.13, is trivial to bypass.  ( 5 min )

High Sierra suffered from a nasty bug (CVE-2017-7149) that afforded local attackers access to the contents of encrypted APFS volumes.  ( 12 min )

Yet another a massive security flaw affects the latest version of macOS (High Sierra), allowing anybody to log into the root account with a blank, or password, of their choosing!  ( 7 min )

Here, we reverse, then 'extend' a popular macOS anti-virus engine. With the creation of a new anti-virus signature, classified documents will be automatically detected!  ( 14 min )

On my flight to ShmooCon, I managed to panic my fully-patched MacBook. Here we analyze the kernel panic report, finding that Apple's AMDRadeonX4150 kext is responsible for the crash.  ( 7 min )

OSX/MaMi (the first Mac malware of 2018) hijacks infected users' DNS settings and installs a malicious certificate into the System keychain, in order to give remote attackers 'access' to all network traffic  ( 9 min )

The EFF/Lookout discovered a cross-platform implant, named CrossRat with ties to nationstate operators. Here, we tear it apart; analyzing its persistence mechanisms, features, and network communications.  ( 13 min )

Recently, the popular MacUpdate website was subverted to distribute a new macOS cryptominer; OSX/CreativeUpdater.  ( 5 min )

I uncovered a new cross-platform backdoor that provides remote attackers persistent access to infected systems  ( 12 min )

Turns out the innocuously named "Calendar 2" app, found on the official Mac App Store, was surreptitiously turning Mac into cryptocurrency miners!  ( 4 min )

In this guest blog post my friend Mikhail Sosonkin reverses Apple's screencapture utility, discusses Mac malware that captures desktop images, and suggests methods for screen-capture detection!  ( 11 min )

Turns out that writing security tools is a great way to inadvertently uncover bugs in macOS. How about a crash in Apple's 'Security' framework ... that can't be good!?  ( 7 min )

In macOS Mojave apps, to have to obtain user permission before using the Mac camera & microphone. We'll illustrate how this is trivial to bypass (at least in the current beta).  ( 4 min )

Did you know on macOS, notifications are stored in a unencrypted database? Which means that even 'disappearing' messages from apps such as Signal - may not really disappear. Yikes!  ( 4 min )

Are full paths and preview thumbnails for files even on encrypted containers and removable usb devices really persistently stored? ...yes :( Apple's 'QuickLook' cache is to blame.  ( 7 min )

A new Mac malware targets the cryptocurrency community. In this post, we dive into the malware and illustrate how Objective-See's tools can generically thwart this new threat at every step of the way.

In this guest blog post @CodeColorist writes about a neat macOS vulnerability. Ironically, by abusing security mechanisms such as sandboxing, macOS can be coerced to load an untrusted library, into a SIP-entitled process!

Apple recently updated the way login items are stored by the OS. In this post, we'll illustrate how to parse the (new) login item files to detect persistence

Imagine you've gained remote code execution on a Mac via a malicious Word document. Turns out, you're still stuck in a sandbox. However, via a faulty regex, you can escape and persist!  ( 5 min )

Apple wrote code to appease the Chinese government ...it was buggy. In certain configurations, iOS devices were vulnerable a "emoji-related" flaw that could be triggered remotely!

If you can programmatically generate synthetic mouse clicks, you can break macOS! Approving kernel extensions, dismissing privacy alerts, and much more more...  ( 8 min )

The WINDSHIFT APT group is successfully infecting Macs with a novel infection mechanism. By abusing custom URL scheme handlers and minimal user interaction, Macs can be remotely compromised!  ( 8 min )

The macOS sandbox is seeks to prevent malicious applications from surreptitiously spy on unsuspecting users. Turns out, it's trivial to sidestep some of these protections, resulting in significant privacy implications!  ( 7 min )

A massively popular app from the official Mac App Store, surreptitiously steals your browsing history! By fully reversing the application, we can fully expose its functionality and rather shady capabilities.  ( 13 min )

A malicious Word document targeting macOS users, was recently uncovered. Let's extract the embedded macros, decode an embedded downloader, and retrieve the 2nd-stage payload!  ( 4 min )

The APT group WindShift has been targeting Middle Eastern governments with Mac implants. Let's analyze their 1st-stage macOS implant: OSX.WindTail!  ( 7 min )

The APT group WindShift has been targeting Middle Eastern governments with Mac implants. Let's (continue to) analyze their 1st-stage macOS implant: OSX.WindTail!  ( 8 min )

Let's tear apart a persistent piece of adware, decompiling, decoding, and decompressing it's code to uncover its methods and capabilities.  ( 8 min )

A core Mojave utility is rather disastrously broken - causing a full-system lockup. Let's find out why!  ( 6 min )

In part one of a guest blog post, @CodeColorist writes about several neat macOS vulnerabilities.  ( 4 min )

@CodeColorist continues writing about bugs, such as CVE-2019-8521 and CVE-2019-8565 that provide a mechanism to elevate privileges to root on macOS.  ( 4 min )

Recently, an attacker targeted (Mac) users via a Firefox 0day. In this first post, we triage and identify the malware (OSX.NetWire.A) utilized in this attack, identifying its methods of persistence, and more!  ( 6 min )

After the success of #OBTS v1.0, we decided to go international and plan #OBTS v2.0 in Europe! In this blog post, we re-live the highlights (from Monaco!) of "Objective by the Sea" v2.0.  ( 3 min )

Recently, an attacker targeted (Mac) users via a Firefox 0day. In this second post, we fully reverse OSX.NetWire.A, revealing (for the first time!), its inner workings and complex capabilities.  ( 12 min )

Recently, an attacker targeted (Mac) users via a Firefox 0day. In this third post, we analyze a second backdoor used in the attack, detailing its persistence, capabilities, and ultimate identify it a new variant of the cross-platform Mokes malware!  ( 6 min )

In this guest blog post, "Objective by the Sea" speaker, Csaba Fitzl writes about an interesting way to get root via Apps from the official Mac App Store!  ( 17 min )

Learn how to leverage Apple's new Endpoint Security Framework to create a comprehensive (user-mode) File Monitor for macOS 10.15!  ( 10 min )

A new macOS backdoor written by the infamous Lazarus APT group needs analyzing. Here, we examine it's infection vector, method of persistence, capabilities, and more!  ( 10 min )

A 0day logic flaw in Microsoft Excel leads to 'remote' code execution on macOS, via malicious macros.  ( 6 min )

The rather infamous APT group, "Lazarus", continues to evolve their macOS capabilities. Today, we tear apart their latest 1st-stage implant that supports remote download & in-memory execution of secondary payloads!  ( 8 min )

A massively popular iOS application turns out to be a government spy tool! Here, we analyze the app; decrypting its binary and studying its network traffic.  ( 12 min )

The Lazarus group's latest implant/loader supports in-memory loading of 2nd-stage payloads. In this post we describe exactly how to repurposing this 1st-stage loader to execute *our* custom 'fileless' payloads!  ( 14 min )

CVE-2017-7170 was a local priv-esc vulnerability that affected OSX/macOS for over a decade! Here (for the first time!), we dive into the technical details of finding the bug, the core flaw, and exploitation.  ( 10 min )

Today we uncover two (local) security flaws in Zoom's latest macOS client. First, a privilege escalation vulnerability, and second, a method to surreptitiously access a user's webcam and microphone (via Zoom).  ( 12 min )

A sophisticated Lazarus Group implant has arrived on macOS. In this post, we deconstruct the Mac variant of a OSX.Dacls, detailing its install logic, persistence, and capabilities.  ( 11 min )

Microsoft has expanded its 2026 hardware lineup by introducing lower-cost configurations of the Surface Pro and Surface Laptop. These new models start at $849 and $949, respectively, featuring 8GB of RAM and 256GB of storage. This shift marks a reversal from earlier in the year when the company raised entry-level prices above $1,000 due to rising component costs. Source  ( 21 min )

JetBrains Air is now available for Windows on both x64 and ARM64 architectures, expanding beyond its initial macOS and Linux releases. This tool is categorized as an Agentic Development Environment (ADE), which prioritizes AI-driven workflows over the traditional text-editor focus of standard IDEs. The application utilizes a lightweight architecture originally developed for the Fleet project to provide a dedicated workspace for managing AI agents. Source  ( 21 min )

Windows Admin Center is a locally deployed, browser-based management tool that provides a centralized GUI for managing Windows servers, clusters, and PCs. Windows Admin Center version 2606 is now generally available. This release applies exclusively to Administration Mode and does not update the separate Virtualization Mode preview branch. The changes focus on reliability, security hardening, accessibility, and targeted fixes in virtual machine management and software-defined networking. Two hardware partner companies made updates affecting three extensions. Source  ( 28 min )

Microsoft has extended hotpatching support for Windows Server 2022 Datacenter: Azure Edition until October 2027. This extension provides an additional year of rebootless security updates beyond the operating system's mainstream support expiration in October 2026. The policy change specifically targets cloud-based workloads, leaving on-premises editions to follow the standard monthly reboot cycle. Source  ( 21 min )

OpenAI has announced a July 15th release for a new hardware device designed to integrate with its Codex AI-powered coding tool. The teaser reveals a square-shaped mechanical macro pad featuring a 3x3 grid of buttons and side-mounted dials. This project is a collaboration with Work Louder, a manufacturer known for specialized mechanical keyboards and customizable input devices. Source  ( 21 min )

Microsoft Teams has introduced new administrative policies to better manage how external bots access online meetings. These tools address security and privacy risks associated with AI note-takers and automated assistants that may join calls due to misconfiguration. Administrators can now enforce a policy that automatically places detected bots into a virtual lobby for manual approval. Source  ( 21 min )

Microsoft has launched the public preview of WSL containers, a feature that allows Linux containers to run natively on Windows 11 without third-party tools like Docker Desktop. This integration introduces a new command-line interface called wslc.exe, which supports familiar container commands and includes a built-in alias for container.exe. Administrators can access this preview immediately by updating to the latest pre-release version of the Windows Subsystem for Linux via the terminal. Source  ( 21 min )

Microsoft's annual release cycle for modern .NET is facing renewed criticism from developers who argue the three-year Long-Term Support (LTS) window is insufficient for enterprise environments. Under the current policy, even-numbered versions receive three years of maintenance, while odd-numbered versions are supported for only two years. This schedule often leaves organizations with just one year to complete migrations before a version reaches its end-of-life status. Source  ( 21 min )

Technical experts are increasingly delegating predictable, high-volume tasks to AI agents to reduce operational toil. According to the 2026 Agent Confidence Index, confidence is highest for automated report generation, boilerplate code creation, and certificate expiration monitoring. These agents are now regularly trusted to handle real-time data stream monitoring and release note generation, allowing engineering teams to focus on more complex architectural challenges. Source  ( 21 min )

Microsoft has announced the general availability of Anthropic’s Claude models within Azure AI Foundry, running natively on Nvidia’s GB300 Blackwell Ultra infrastructure. This deployment utilizes the GB300 NVL72 rack-scale system, which integrates 72 liquid-cooled GPUs and 36 Grace CPUs to handle intensive AI workloads. High-speed Quantum-X800 InfiniBand networking supports these models, enabling the creation of complex agentic systems that operate across different business domains. Source  ( 21 min )

Microsoft has announced that all Remote Event Receivers (RERs) in SharePoint Online will officially stop functioning on July 1, 2027. This retirement marks the end of a transition period for developers who previously relied on the SharePoint Add-in model and Azure Access Control Services. While some receivers were granted a temporary extension via Microsoft Entra registration, this bridge will expire entirely on the specified date. Source  ( 21 min )

Meta has implemented strict limitations on how its engineers use external AI coding assistants like Anthropic’s Claude Code and OpenAI’s Codex. The company aims to prevent the output of these rival models from inadvertently entering its own internal development pipelines and training datasets. This strategy is designed to avoid model distillation, a process where a smaller or newer model learns from the outputs of a more established competitor. Source  ( 21 min )

The U.S. State Department is offering a $10 million bounty for information on Russian-linked hacker groups UNC5792 and UNC4221. These actors, associated with the FSB and Russian military intelligence, have successfully compromised thousands of messaging accounts worldwide. The campaign specifically targets high-value individuals, including U.S. government officials, military personnel, NATO diplomats, and journalists covering the conflict in Ukraine. Source  ( 21 min )

Security researchers have identified a technique that allows attackers to disable enterprise protection tools on macOS without requiring administrative credentials or kernel exploits. The method targets Apple’s Inter-Process Communication framework, known as XPC, which manages communication between applications and privileged background services. By exploiting how macOS caches trust fingerprints for signed applications, an attacker can inject malicious payloads into a legitimate app bundle while maintaining its trusted status. Source  ( 21 min )

OpenAI has released a comprehensive analysis mapping how artificial intelligence will likely reshape employment across the 27 European Union member states. The report utilizes the European Skills, Competences, Qualifications and Occupations taxonomy to categorize jobs into four distinct transition archetypes based on automation and growth potential. Researchers found that while 14% of EU employment faces high near-term automation risk, approximately 12% of roles are expected to grow as AI makes new projects more viable. Source  ( 21 min )

Microsoft is introducing a notification grouping feature for the new Outlook for Windows and Outlook on the web to combat alert clutter. When multiple emails arrive within a few seconds, the system will collapse them into a single desktop banner rather than triggering individual alerts for every message. This update aims to reduce cognitive load and interruptions for users who frequently receive bursts of activity from fast-moving threads or automated services. Source  ( 21 min )

Microsoft has dismantled a sophisticated browser threat operation dubbed StegoAd that utilized 119 malicious extensions in the Edge Add-ons store. The campaign leveraged steganography to conceal malicious JavaScript within seemingly harmless PNG, WebP, and WOFF2 font files. These extensions remained dormant for three to five days after installation to bypass initial security screenings and avoid immediate user suspicion. Source  ( 21 min )

Over the years I have enjoyed disassembling and debugging endpoint detection and response (EDR) and antivirus (AV) engines. For as long as I can remember I’d have evenings where I’d throw on some music, boot a virtual machine with kernel debugging enabled, and spend time searching for different evasion methods. While a fun way to […] The post Accelerating EDR Evasion with LLM-Driven Analysis appeared first on SpecterOps.  ( 21 min )

You may have read about our new GhostWorks initiative here at SpecterOps. As part of this effort, we continually trial different ways of evaluating and improving model behavior to better understand which techniques can be applied to our research. One of the things that has been winding me up about working with LLMs is how […] The post Jailbreaker: LLM Jailbreak Testing You Can Actually Repeat appeared first on SpecterOps.  ( 18 min )

Welcome back to another watchTowr Labs blog post. This time, we're looking at Progress Kemp LoadMaster, a load balancer that sits at the edge of a lot of enterprise networks. Edge appliances have a habit of becoming the way in rather than the thing keeping people out, and  ( 11 min )

Move beyond chasing vulnerabilities to a unified hybrid risk strategy. The Sensor Workload Scanner is now GA and extends our risk prioritization engine to on-premise environments to identify the critical attack paths across your hybrid cloud.  ( 56 min )

Aligning Modern CNAPP Telemetry with realistic risk assessments to drive agency efficiency through cross-team collaboration  ( 57 min )

Part 2: How the Red Agent bypassed backend resolvers to expose an entire airline booking database in fifteen minutes  ( 57 min )

﷽  ( 5 min )

Chinese artificial intelligence companies are rapidly closing the gap with US-based models in the specialized field of cybersecurity. Zhipu AI recently released GLM-5.2, an open-weight model that researchers claim can match Anthropic’s Mythos in identifying software bugs and security flaws. While these Chinese models still trail in general reasoning tasks, their proficiency in detecting vulnerabilities has raised concerns regarding national security and the potential for automated cyberattacks. Source  ( 21 min )

Microsoft has integrated a new remote locking capability into the Phone Link application for Android devices. This feature allows users to secure their Windows PC with a single tap from their smartphone if they have left the workstation unlocked. The functionality is currently exclusive to Android and requires the latest versions of the app on both the mobile device and the computer. Source  ( 21 min )

Coinbase has successfully reduced its internal AI expenditures by half while simultaneously supporting an exponential increase in token usage. The company achieved these savings by implementing a strategy focused on infrastructure optimization rather than imposing restrictive usage caps on employees. By shifting away from expensive frontier models for routine tasks, the organization has demonstrated a sustainable path for enterprise AI adoption. Source  ( 21 min )

Microsoft has officially discontinued the development of its AI-powered history search feature for the Edge browser. This functionality was designed to allow users to find previously visited websites using synonyms, natural language phrases, or even typos. Although the feature was intended to improve navigation, it has been moved to the company's list of retired projects following a brief rollout period. Source  ( 20 min )

Google is introducing a new "Summarize" feature for PDF documents within the Chrome Beta browser. This integration utilizes the Gemini AI model directly inside the built-in PDF viewer to analyze document content. Users can trigger the process via a dedicated button that activates the Gemini side panel for immediate processing. Source  ( 21 min )

Microsoft has released a new set of dynamic updates designed to enhance the setup and recovery processes for Windows 11. These releases include KB5102558, KB5095615, and KB5095186, targeting versions 24H2, 25H2, and 26H1. The updates specifically focus on improving the Windows Recovery Environment and the binaries used during feature update installations. Source  ( 21 min )

Security researchers have demonstrated a new attack method that tricks autonomous AI coding agents into executing malicious payloads from seemingly clean GitHub repositories. The technique exploits the agent's goal-oriented behavior, where it automatically attempts to resolve setup errors by running suggested initialization commands. Because the repository contains no actual exploit code, the malicious activity remains invisible to traditional static scanners and human reviewers. Source  ( 21 min )

The Trump administration is moving toward restoring access to Anthropic’s Fable 5 and Mythos 5 artificial intelligence models following a period of government-mandated restrictions. These high-performance models were previously taken offline or limited due to national security concerns regarding their advanced capabilities. Commerce Secretary Howard Lutnick indicated that Anthropic has made significant progress in addressing risks and establishing safety protocols with federal agencies. Source  ( 21 min )

﷽  ( 4 min )

Enterprise interest is shifting from pure model performance on leaderboards towards the efficiency of 'intelligence per dollar'. Chinese open-source models like Z.AI’s GLM 5.2 are demonstrating frontier-level capabilities, particularly in agentic work, at a small fraction of the cost of closed American models. This economic shift allows organizations to prioritize cost-effective solutions for high-volume tasks while reserving expensive frontier models for critical decision-making or orchestration. Source  ( 22 min )

OpenAI has introduced a new safety architecture for the GPT-5.6 family to mitigate risks associated with its flagship Sol model. The system utilizes activation classifiers that monitor generations in real-time to intervene when sensitive domains are triggered. These safeguards are designed to block unsafe outputs across cybersecurity and biological workflows before they can cause harm. Source  ( 21 min )

Microsoft has introduced a new Windows 11 Insider Beta build that focuses on strengthening security for enterprise remote environments. Administrators can now configure Azure Virtual Desktop and Windows 365 sessions to disconnect automatically when a redirected smart card is removed. This update specifically applies to sessions using Microsoft Entra ID authentication to help organizations maintain strict compliance standards. Source  ( 21 min )

Microsoft is testing a new unified update process in Windows 11 build 29617 to streamline the maintenance experience. This initiative coordinates driver, .NET, and firmware updates to align with the monthly cumulative quality update. The primary goal of this synchronization is to reduce the frequency of system restarts to just one reboot per month. Source  ( 21 min )

Microsoft has released MAI-Code-1-Flash for general availability to GitHub Copilot Business and Enterprise customers. This first-party model is specifically designed for high-volume, iterative coding tasks that require low latency and high speed. It serves as a lightweight alternative to larger frontier models, prioritizing efficiency for repetitive agentic workflows. Source  ( 21 min )

Russian intelligence services are conducting a sophisticated phishing campaign to steal Signal Backup Recovery Keys from high-value targets. The FBI and CISA report that attackers impersonate official support accounts to trick users into enabling cloud backups and sharing their 30-digit recovery codes. This social engineering tactic bypasses end-to-end encryption by allowing hackers to restore a victim's entire message history onto an attacker-controlled device. Source  ( 21 min )

The U.S. Department of Commerce has reached an agreement with Anthropic to partially restore access to its powerful Mythos 5 artificial intelligence model. This decision follows a two-week suspension triggered by national security concerns regarding the model's advanced capabilities. The government initially invoked export control authorities to block the system because it could potentially help actors identify and exploit software vulnerabilities. Source  ( 21 min )

The U.S. government has begun aggressively mandating staggered releases for frontier AI models, a move critics argue represents a "negative turning point" fueled by Anthropic’s fear-based marketing. This shift was cemented when OpenAI was forced to delay GPT-5.6, restricting its most capable "Sol" version to a government-preapproved list of elite partners rather than the general public. This regulatory capture is blamed on Anthropic CEO Dario Amodei, whose warnings about cybersecurity flaws and foreign "distillation attacks" successfully pressured the White House into implementing restrictive oversight. Source  ( 21 min )

GitHub made the redesigned terminal interface for GitHub Copilot CLI generally available. The update introduces a tabbed layout, in-session configuration for tools such as MCP servers and plugins, and accessibility improvements, including screen reader support and theme modes. If you manage Windows workstations, the key points are installation, update method, admin control, and the limits of what this CLI can access compared with VS Code. Source  ( 28 min )

OpenAI has launched a limited preview of its GPT-5.6 model family, introducing three distinct tiers named Sol, Terra, and Luna. The flagship Sol model features a "max reasoning" mode for deep problem-solving and an "ultra" mode that utilizes subagents to manage complex, multi-step projects. While Terra offers a balance of performance and cost, Luna is positioned as the fastest and most affordable option for high-volume workflows. Source  ( 21 min )

OpenAI has launched a limited preview of its GPT-5.6 model family, introducing three distinct tiers named Sol, Terra, and Luna. The flagship Sol model features a "max reasoning" mode for deep problem-solving and an "ultra" mode that utilizes subagents to manage complex, multi-step projects. While Terra offers a balance of performance and cost, Luna is positioned as the fastest and most affordable option for high-volume workflows. Source  ( 21 min )

Enterprise AI spending continues to accelerate as organizations apply the technology to increasingly complex and resource-intensive problems. Industry leaders note that while individual token costs may decrease, the total volume of tokens consumed per task is growing exponentially. This trend suggests that efficiency gains are currently being outpaced by the expanding appetite for sophisticated agentic workflows. Source  ( 21 min )

The Azure Developer CLI (azd) has introduced a new `azd tool` command group to manage development prerequisites like language SDKs, Docker, and the Bicep CLI. This feature allows for the discovery, installation, and upgrading of essential tools directly from the terminal to prevent template deployment failures. Additionally, a new cross-platform command runner called `azd exec` enables scripts to run with full environment context and Key Vault secret resolution. Source  ( 21 min )

Microsoft has begun a gradual rollout of the redesigned Windows Insider Program interface to retail versions of Windows 11. Users on standard retail builds will now see updated channel options within the Windows Update settings menu. This transition follows extensive testing within preview channels to ensure the new management interface is stable for general use. Source  ( 21 min )

Enterprise leaders are moving past experimental AI phases toward large-scale implementation that delivers measurable business value. This transition involves shifting from theoretical bets to functional applications that transform core industry processes and operational competitiveness. Modern IT operating models are already evolving as organizations use these technologies to reduce the costs and risks associated with infrastructure modernization. Source  ( 21 min )

Microsoft Teams is launching a dedicated Recap app to centralize meeting recordings, transcripts, and summaries in a single searchable hub. This new interface addresses the difficulty of locating past meeting data by consolidating content from the previous 30 days. The application will be available on Windows, Mac, and web platforms, with mobile support expected to follow shortly after the initial release. Source  ( 21 min )

Microsoft has released Windows 11 Insider Preview Build 26300.8758 to the Experimental channel, signaling a shift toward version 26H2. This update introduces a dedicated Taskbar Size setting within the personalization menu to simplify desktop scaling. Users can now adjust the height of the taskbar and the size of its icons through a native toggle rather than relying on registry hacks. Source  ( 21 min )

Microsoft has released new Windows 11 preview builds in the Insider program featuring a redesigned taskbar settings section. Build 26220.8754 introduces a dedicated Taskbar Size setting to simplify how users personalize their desktop interface. This update also includes refined transitions between different taskbar sizes to ensure a smoother visual experience during adjustments. Source  ( 20 min )

OpenAI has introduced the GPT-5.6 model family, featuring the flagship Sol alongside the Terra and Luna variants. These models reportedly advance capabilities in software engineering, cybersecurity, and professional knowledge work. In a significant shift for the industry, the U.S. government has intervened to restrict the initial rollout to a small group of approved partners. Source  ( 21 min )

Oracle has announced a new governance framework for MySQL to increase transparency and accelerate innovation through deeper community involvement. The model introduces specific roles for participants, including contributors who provide code and documentation, and committers who oversee code quality and reviews. A new technical steering committee will provide strategic guidance, featuring representatives from major cloud providers like AWS and Google Cloud. Source  ( 21 min )

The Cloud Infrastructure Service Providers Europe (CISPE) has challenged Broadcom’s claims that VMware Cloud Foundation (VCF) can serve as a foundation for sovereign cloud infrastructure. CISPE argues that the proprietary nature of VCF creates a dangerous over-reliance on a foreign vendor that maintains unilateral control over the software. Because Broadcom is a US-based entity, its products remain subject to American export regulations and legal frameworks regardless of where the data centers are physically located. Source  ( 21 min )

A high-severity vulnerability in the Amazon Q Developer extension for Visual Studio Code allowed attackers to execute arbitrary code on a developer's workstation. The flaw, tracked as CVE-2026-12957, stemmed from the automatic loading of Model Context Protocol (MCP) configurations found within a repository's hidden directory. When a developer opened a booby-trapped project and activated the AI assistant, the extension executed commands defined in the configuration file without requesting user consent. Source  ( 21 min )

Epoch AI has introduced MirrorCode, a new benchmark designed to evaluate whether AI models can reconstruct entire software programs without seeing the original source code. This test requires models to recreate complex codebases based only on high-level descriptions and functional requirements. While current models show promise in smaller tasks, the benchmark highlights significant performance gaps when dealing with large-scale, intricate software architectures. Source  ( 21 min )

Nationwide Building Society is expanding its partnership with Broadcom to implement VMware Cloud Foundation as the cornerstone of its new private cloud platform. This integrated solution combines compute, storage, networking, and security to help the organization build a custom, resilient infrastructure. The transition supports a broader digital transformation strategy aimed at delivering scalable services to millions of customers. Source  ( 21 min )

Notion has announced the permanent shutdown of its AI-powered Gmail client, Notion Mail, effective September 22. This decision follows a significant shift in user behavior where more than half of the platform's users now manage their email workflows through autonomous agents. The company intends to pivot its development resources toward these agents rather than maintaining a traditional inbox interface. Source  ( 21 min )

Multi-agent systems decompose complex AI workloads into specialized, independently deployed agents that mirror microservice architectures. A significant challenge in these systems is maintaining conversational context across agent boundaries when services share no underlying infrastructure. The Agent-to-Agent (A2A) protocol provides a standard for this communication, utilizing context identifiers and structured message parts to manage task continuity. Source  ( 20 min )

Italy's antitrust regulator has launched an investigation into Microsoft regarding potential unfair commercial practices. The probe focuses on recent price increases for Microsoft 365 subscriptions following the integration of new features. Authorities are examining whether the company provided adequate transparency during this transition. Source  ( 20 min )

Microsoft and Commvault have entered a multi-year partnership to integrate advanced data protection directly into the Azure ecosystem. This collaboration introduces Commvault’s resilience platform as a native independent software vendor service within the cloud environment. The initiative aims to simplify how organizations secure their digital assets against evolving cyber threats and system failures. Source  ( 20 min )

Spoiler warning: this post discusses the FLARE-ON 12 `FlareAuthenticator` challenge and includes the recovered flag. Introduction Before getting into the technical details, this work was made possible through SpecterOps’ partnership with OpenAI’s through the Trusted Access for Cyber program. I also want to thank SpecterOps, my employer, for supporting this research and giving me time […] The post Time Travel Debugging with Codex appeared first on SpecterOps.  ( 16 min )

Boards and CIOs are pushing security teams to build internal AI pentesting tools, but is it worth it? This piece walks through the five questions security teams should ask when deciding between build vs buy for AI pentesting. The post Considering Build vs. Buy for AI Pentesting? Top 5 Questions to Ask appeared first on Synack.  ( 16 min )

By automatically loading MCP servers from workspace files, Amazon Q enabled attackers to execute code and access sensitive cloud environments.  ( 58 min )

﷽  ( 14 min )

Microsoft is automatically rolling out Windows 11 25H2 to all eligible unmanaged Home and Pro PCs, with no user approval required. The primary driver is the end of support for Windows 11 24H2 on October 13, 2026, after which those editions will no longer receive security updates. The rollout also prepares consumer devices for Windows 11 26H2, expected in fall 2026 on the same underlying platform. For devices already on 24H2, the upgrade is delivered as a small enablement package rather than a full OS reinstall. Managed enterprise devices are excluded from this automatic rollout. Source  ( 29 min )

Microsoft Defender Antivirus provides a robust set of PowerShell cmdlets for managing security features on Windows 10, Windows 11, and Windows Server 2016 or later. These commands allow for the configuration of next-generation protection features, including exploit protection and real-time monitoring. Administrators can use these tools to automate security tasks and ensure consistent protection across a fleet of devices. Source  ( 20 min )

Apple is reportedly planning to disrupt its traditional silicon release cycle to accelerate the development of high-performance processors. The company intends to launch the standard M6 chip this fall but will likely skip the Pro and Max variants of that generation. This strategic shift aims to bring the M7 architecture to market up to six months earlier than originally scheduled. Source  ( 21 min )

Anthropic's Claude is experiencing a significant surge in paid consumer subscriptions, challenging the market dominance of OpenAI's ChatGPT. Transaction data from millions of U.S. consumers indicates that Claude's revenue and paying user base grew by approximately 75% in early 2026. While the company was previously viewed as a developer-centric niche, it is now successfully attracting a broader audience of individual subscribers. Source  ( 21 min )

Microsoft has quietly updated its documentation to extend the free Extended Security Updates program for Windows 10 consumers by one year. Personal devices enrolled in the program will now receive critical security patches until October 12, 2027. This change was disclosed via an editor's note on an official blog rather than through a formal press announcement. Source  ( 21 min )

Salesforce has introduced Help Agent, a prepackaged solution built on the Agentforce platform designed for rapid deployment of autonomous customer service. This tool allows organizations to connect AI agents to company knowledge bases and communication channels like web, text, and voice within minutes. Unlike traditional chatbots, these agents utilize the Atlas Reasoning Engine to plan and execute multi-step workflows independently. Source  ( 21 min )

System administrators can find several affordable tools to streamline maintenance and deployment tasks without exceeding a fifty-dollar budget. A standout utility is the Rosewill M.2 SSD Cloner, which supports offline cloning and 20 Gbps USB-C speeds for rapid OS migrations. For physical hardware work, the HOTO 3.6V electric screwdriver provides variable torque suitable for stubborn factory screws, while magnetic mini flashlights assist when navigating dark server racks or PC interiors. Source  ( 21 min )

SUSE and Openchip have announced a collaboration to develop a fully sovereign European IT infrastructure based on the RISC-V instruction set architecture. This partnership aims to address the lack of autonomous hardware options by combining Openchip’s upcoming silicon designs with SUSE’s established open-source software stack. By utilizing RISC-V, the initiative avoids the restrictive licensing fees and geopolitical dependencies associated with traditional x86 and Arm architectures. Source  ( 21 min )

Microsoft has introduced "Skills" to Copilot in Excel, allowing users to automate recurring processes through reusable instructions. These skills guide the AI through specific steps, applying consistent formatting, formulas, and structures to workbooks without requiring manual prompting each time. Users can create custom skills by saving Markdown files to OneDrive or utilize a library of prebuilt options provided by Microsoft and its partners. Source  ( 21 min )

Anthropic has formally accused Alibaba of conducting an industrial-scale campaign to illicitly extract capabilities from the Claude AI model. The San Francisco-based firm claims that operators linked to the Chinese tech giant utilized thousands of fraudulent accounts to perform nearly 29 million exchanges. This activity is described as the largest known instance of a distillation attack targeting Anthropic's proprietary technology. Source  ( 21 min )

The European Commission has reached a preliminary conclusion to designate Amazon Web Services and Microsoft Azure as gatekeepers under the Digital Markets Act. Although these cloud providers do not meet the quantitative thresholds for designation, their vast user bases and market dominance have drawn regulatory scrutiny. If the designation becomes final, both companies will face strict obligations regarding interoperability, data access, and customer lock-in restrictions. Source  ( 21 min )

Microsoft is transitioning cloud management toward an agentic model where AI-powered agents continuously observe, reason, and assist with infrastructure tasks. This approach integrates observability, governance, and optimization into a system-driven loop guided by user intent and predefined policies. By automating the correlation of telemetry signals, these agents help teams move from detecting issues to remediation with minimal manual intervention. Source  ( 20 min )

A new bipartisan nonprofit called Raise Us has launched with over $500 million to help American workers adapt to widespread artificial intelligence automation. Founded by former Commerce Secretary Gina Raimondo and former Indiana Governor Eric Holcomb, the group aims to combat potential catastrophic job losses through targeted education and training. The independent effort brings together tech competitors and major employers to establish pilot programs and incentives that help workers pivot to new careers. Source  ( 21 min )

The transition from traditional chatbots to agentic AI marks a shift in knowledge work from brief interactions to the delegation of complex, long-horizon tasks. Unlike standard chatbots that provide immediate responses, AI agents can operate independently for hours, orchestrating tool calls and iterating through environments to achieve specific goals. This evolution allows the technology to function more like a digital team member capable of delivering outcomes rather than just answering questions. Source  ( 21 min )

Apple has officially increased prices across its MacBook and iPad product lines following a brief period of downtime for its online store. These adjustments come after CEO Tim Cook warned that rising costs for memory and storage components have become unavoidable for the company. The price hikes are being implemented immediately to offset the surging expenses associated with the rapid expansion of AI data centers. Source  ( 21 min )

Amazon EC2 now allows administrators to embed custom identifiers called watermarks into private Amazon Machine Images to improve governance. These structured identifiers automatically propagate to any derived images, including those created through cross-region copies or from running instances. This persistent metadata ensures that the origin of an image remains traceable even after multiple iterations or sharing across different AWS accounts. Source  ( 21 min )

OpenAI has significantly expanded its Daybreak cybersecurity initiative to transition from merely discovering software vulnerabilities to automating the entire remediation process. The program now integrates the full release of GPT-5.5-Cyber, an updated Codex Security plugin, and the Patch the Planet initiative for open-source software. This shift addresses a growing industry bottleneck where the speed of AI-driven flaw discovery has historically overwhelmed the manual capacity of developers to create and deploy fixes. Source  ( 21 min )

Google is implementing a new security feature in Chrome 151 that utilizes Windows Access Control Lists to restrict external access to the browser's memory. This process isolation technique prevents third-party applications from reading sensitive data or injecting malicious code into active browser sessions. By tightening these permissions, the browser creates a more robust sandbox that limits the impact of potential software vulnerabilities. Source  ( 21 min )

Microsoft has introduced two new features for PowerPoint Live in Teams to improve real-time collaboration and presentation flow. The Refresh tool allows presenters to update their slides to the latest version with a single click without stopping the session. This ensures that any last-minute corrections or data updates are immediately visible to all participants without the need for resharing. Source  ( 21 min )

AI models often hallucinate when encountering proprietary SDKs or internal frameworks because they lack relevant training data. Instead of admitting ignorance, models default to the "closest match" from public data, such as mapping a custom authentication library to OAuth patterns. This behavior creates plausible but incorrect code that can be difficult for developers to spot during large-scale generations. Source  ( 21 min )

We’re sharing two headline numbers as an early look at our State of Continuous Security Validation report before the full analysis lands in July. Turns out 95% of security teams discover high or critical vulnerabilities outside their scheduled testing windows—proof that cadence alone is no longer a reliable measure of coverage. The post The State of Continuous Security Validation: An Early Look at the Data appeared first on Synack.  ( 15 min )

TL;DR Every organization shipping GenAI features or LLM-powered applications has opened a new attack surface, and automated scanners alone don’t fully cover it. This guide compares the leading AI red teaming tools and managed services for 2026, from open-source frameworks to commercial platforms, across testing scope, validation depth, and best-fit use case. Synack leads the […] The post Best AI Red Teaming Tools to Find AI Security Vulnerabilities in 2026 appeared first on Synack.  ( 23 min )

TL;DR Cobalt.io runs a credit-based pricing model at roughly $1,800 per credit, with most enterprise buyers spending between $15,000 and $40,000 per year. This guide breaks down how the credit model works, what drives total cost beyond the headline number, and how Cobalt’s pricing and value compare directly against Synack at a similar annual budget. […] The post Cobalt.io Pricing: What Cobalt Costs in 2026 (vs Synack) appeared first on Synack.  ( 17 min )

TL;DR Pentera pricing starts at around $35,000 per year and typically runs $50,000 to $100,000 or more, depending on asset count, module selection, and validation frequency. The platform doesn’t publish list pricing, so this guide breaks down how the subscription model works across its three modules, what drives cost up, and where automated security validation […] The post Pentera Pricing in 2026: Cost, Plans & What Companies Actually Pay appeared first on Synack.  ( 19 min )

TL;DR HackerOne doesn’t publish its pricing, but what companies actually pay ranges from around $15,000 to $150,000 or more per year, depending on program type, scope, and bounty budget, with a 5% fee added to every researcher payout. This guide breaks down real cost ranges by program type and company size, explains how the three-part […] The post HackerOne Pricing in 2026: Plans, Costs & What Companies Actually Pay appeared first on Synack.  ( 20 min )

TL;DR XBOW proved that autonomous AI agents can find and exploit web app vulnerabilities quickly, but its scope stops at web apps and APIs, it runs on a point-in-time basis, and it carries no FedRAMP authorization. This comparison covers eight alternatives across autonomous AI, hybrid, and human-led models, judged on validation depth, coverage, continuity, compliance, […] The post Best XBOW Alternatives in 2026: AI Pentesting Platforms Compared appeared first on Synack.  ( 22 min )

TL;DR Penetration testing costs in 2026 range from $5,000 to over $100,000, with most organizations spending between $10,000 and $30,000 per engagement and an all-types average of around $18,300. Scope, complexity, testing depth, tester seniority, compliance requirements, and what the quote actually includes all significantly affect that number. AI-assisted PTaaS models are changing the cost-per-coverage […] The post How Much Does a Pentest Cost? (2026 Pricing Guide) appeared first on Synack.  ( 22 min )

TL;DR Cobalt.io built its name on fast, self-serve, credit-based pentesting, but teams outgrow that model once they need continuous coverage, predictable pricing, AI-native automation, or FedRAMP authorization. This guide compares eight alternatives across testing model, validation depth, pricing, and compliance fit. Synack leads the list by pairing agentic AI with a vetted human red team […] The post Best Cobalt.io Alternatives in 2026: Features, Pricing & Use Cases Explained appeared first on Synack.  ( 20 min )

TL;DR Most attack surface management tools solve only half the problem: they map what’s exposed and stop there, leaving security teams to guess which findings actually matter. This review ranks the top 10 ASM platforms for 2026 on discovery breadth, exploit validation, and how well each holds up inside a real security program. Synack leads […] The post Best Attack Surface Management Tools in 2026 (Top 10, Reviewed) appeared first on Synack.  ( 22 min )

Last year, Jun Kokatsu disclosed an interesting vulnerability with ChatGPT Operator by exploiting a race condition. I was wondering if I could reproduce this attack chain, and this post describes the results of that research. I had this post drafted for months, and yesterday at the Real-world AI security conference I included a video demo of this attack in my talk and that reminded me that I should finally publish this.  ( 3 min )

Wiz now layers runtime signals into the Security Graph, exposing hidden attack paths to give security teams a complete picture of risk.  ( 56 min )

﷽  ( 10 min )

See how Mac admins can bring AI governance to their fleet without blocking the tools their teams want to use.  ( 6 min )

See how Mac admins can bring AI governance to their fleet without blocking the tools their teams want to use.  ( 6 min )

Microsoft 365 E7, branded as the Frontier Suite, launched in May 2026 at $99 per user per month to consolidate high-end security and AI capabilities. This new tier bundles the existing E5 stack with Microsoft 365 Copilot, the Entra Suite for advanced identity governance, and Agent 365 for managing AI background workers. While the bundle offers a discount compared to individual SKUs, administrators must account for rising costs in lower tiers and the exclusion of compute expenses for building custom agents. Source  ( 21 min )

Google has integrated a native computer-use tool directly into the Gemini 3.5 Flash model via the Gemini API. This feature allows the model to observe screens through screenshots and execute actions like clicking, typing, and navigating across various environments. It is designed to support automation for complex tasks such as continuous software testing and professional knowledge work on desktop, mobile, and browser platforms. Source  ( 21 min )

Snowflake recently conducted a benchmark comparing the open model GLM-5.2 against Anthropic’s Claude Opus 4.7 using 103 data transformation tasks. The evaluation focused on the models' ability to generate code compatible with both DuckDB and the Snowflake data platform. While both models achieved nearly identical success rates after three attempts, Claude Opus maintained a lead in first-attempt accuracy. Source  ( 21 min )

Microsoft is expanding its Microsoft 365 Education suite by integrating several AI-powered features at no additional cost to existing institutional customers. These updates introduce Copilot Notebooks, which provide students with a workspace to ground AI responses in their own specific learning materials. The rollout also includes interactive study agents designed to offer students visual concept explanations and real-time feedback during practice sessions. Source  ( 21 min )

Point-in-time restore is a built-in recovery feature in Windows 11, released as part of the June 23, 2026, optional update, KB5095093, for versions 24H2 and 25H2. It uses the Volume Shadow Copy Service (VSS) to capture full-system snapshots on a recurring schedule automatically. Enterprise editions support remote configuration via a Configuration Service Provider (CSP), a management interface that exposes Windows settings to mobile device management (MDM) tools such as Intune. This article covers how to enable, configure, and use the feature, as well as its key limitations. Source  ( 28 min )

Commvault and Microsoft have established a multiyear partnership to integrate data security and cyber recovery technology directly into the Azure cloud platform. This collaboration allows Azure customers to provision and deploy resilience tools as native services without the need for manual integration or separate infrastructure. The primary objective is to streamline the restoration of data, applications, and identities following cyberattacks, system outages, or accidental deletions. Source  ( 21 min )

Cloudflare has officially launched self-managed OAuth for all customers, moving away from a model that previously required manual onboarding for third-party integrations. This update allows developers to build SaaS integrations and internal platforms using standard OAuth flows instead of relying on static API tokens. By adopting this delegated access model, users gain clearer consent screens and the ability to revoke application permissions directly from their dashboard. Source  ( 21 min )

Nvidia has surpassed long-time leaders Cisco and Arista to become the top revenue generator in the data center Ethernet switching market. According to IDC data for the first quarter of 2026, the company’s switching revenue surged nearly 193% to reach $2.1 billion. This growth is fueled by the massive infrastructure requirements of AI training clusters, which demand specialized high-speed networking to connect thousands of GPUs. Source  ( 21 min )

Portable monitors have reached record-low prices, providing administrators and mobile professionals with affordable options for expanding screen real estate during travel. Current deals feature a variety of panel technologies, including budget-friendly IPS displays and high-end OLED models that offer superior color saturation and deep blacks. Selecting the right unit requires balancing resolution needs with practical physical features like integrated kickstands and matte finishes for high-glare environments. Source  ( 21 min )

Microsoft has released PowerToys v0.100.1 as a targeted stability patch to address several regressions introduced in the previous major version. This update primarily focuses on fixing broken core functionality rather than introducing new features to the utility suite. The release is available immediately via GitHub and the Microsoft Store for both x64 and ARM64 architectures. Source  ( 21 min )

Microsoft's Digital Crimes Unit recently disrupted the infrastructure supporting StealC and Amadey, two prominent malware families used in global cybercrime. The operation targeted over 200 command-and-control domains and IP addresses that facilitated credential theft and ransomware delivery. This coordinated effort involved collaboration with Europol and various industry partners to sever criminal control over approximately 18,000 victim computers. Source  ( 21 min )

Visual Studio Code version 1.127 introduces a specific update to how the editor handles token pricing normalization. This change ensures compatibility with legacy "flat" pricing payloads that are still returned by certain service endpoints. By addressing this inconsistency, the update provides more reliable cost tracking and reporting for AI-related features. Source  ( 20 min )

OpenAI and Broadcom have unveiled Jalapeño, a custom-designed intelligence processor specifically architected for large language model (LLM) inference. This first-generation accelerator was developed from initial design to production in just nine months, a cycle significantly accelerated by using OpenAI’s own models. The chip is intended to provide a full-stack infrastructure solution that balances compute, memory, and networking resources to achieve high utilization. Source  ( 21 min )

Newegg has launched a competitive retail event featuring a significant discount on the MSI 491CQP ultrawide monitor. This 49-inch display is currently priced at $699, representing a $150 reduction from its standard retail price. The sale positions the retailer as a direct competitor to Amazon's annual Prime Day event by offering lower pricing on specific high-end PC components. Source  ( 21 min )

A new backdoor named Mistic has emerged in cybercrime campaigns targeting the insurance, education, and IT sectors since April 2026. Security researchers link this malware to the initial access broker KongTuke, also known as Woodgnat, who sells network access to major ransomware groups. The backdoor is frequently deployed alongside ModeloRAT and is often delivered through social engineering tactics or multi-stage infection chains. Source  ( 21 min )

VMware Cloud Foundation now includes the vSphere Kubernetes Service, a CNCF-certified runtime that allows for the management of virtual machines and containers from a single control plane. This architectural integration eliminates infrastructure silos by allowing administrators to provision Kubernetes clusters using the same platform they use for traditional virtual machines. The service maintains close alignment with upstream Kubernetes releases, ensuring compatibility with standard tools like Helm and Argo CD without imposing proprietary constraints. Source  ( 21 min )

Microsoft has released PowerToys v0.100.1 to resolve several critical stability and behavioral issues introduced in the previous major milestone. This maintenance update focuses on refining the performance of the system utility suite following the significant feature additions of version 0.100.0. The patch is currently available for download via the official GitHub repository for users on supported Windows platforms. Source  ( 21 min )

Microsoft’s Digital Crimes Unit, in collaboration with Europol, recently executed a coordinated disruption of the StealC and Amadey malware ecosystems. The operation resulted in the seizure or blocking of over 200 command-and-control domains and IP addresses used to manage these threats. This intervention targeted the backbone of a cybercrime model where infostealers are rented as commodities to harvest sensitive corporate and personal data. Source  ( 21 min )

Google Workspace is rebranding and expanding its "Super Admin password reset" notification to become the more comprehensive "Admin password reset" alert. This update ensures that security teams receive notifications whenever any account with administrative privileges undergoes a password change. The enhanced visibility is designed to help organizations quickly identify and respond to potential unauthorized access attempts on high-value accounts. Source  ( 20 min )

Microsoft Sentinel has introduced custom graphs in public preview, providing a relationship-first method for organizing and querying security data. Unlike traditional log tables that require complex joins, this feature allows for the visualization of multi-hop connections between entities like users, devices, and IP addresses. This structure helps identify the blast radius of a compromise and uncover malicious behavioral pivots that are often hidden in standard logs. Source  ( 21 min )

An area I’ve been very interested in exploring over the past several months is the generation of what I have been calling “disposable tooling”. With the development space now discussing the reduced cost of writing code, the idea is to also explore how offensive tooling can be brought closer to the paradigm that appeared when […] The post Disposable Tooling: Building LLM-Generated Mythic Agents from Prompt to Deployment appeared first on SpecterOps.  ( 27 min )

Open bug bounty programs are buckling under AI-generated noise, triage overload, and coverage blind spots. Synack's PTaaS platform and security researchers on the Synack Red Team preserve what works about incentivized research while fixing what doesn't. The post The Bug Bounty Model Is Failing. It’s Time to Say It Out Loud. appeared first on Synack.  ( 18 min )

Most organizations have more internet-facing assets than they know about, and those unknown assets are where attackers look first. This guide breaks down how attack surface management works, how it complements penetration testing, and what separates programs that actually reduce risk from programs that just generate reports. The post Attack Surface Discovery & Management: What Security Teams Need to Know appeared first on Synack.  ( 21 min )

AI got a security consultant 80% of the way through a real web application assessment. The other 20% was where the actual security work happened. This walkthrough shows where AI delivered, where it produced confident but impossible explanations, and why human judgment still drives real findings.  ( 13 min )

The threat landscape has changed. Adversaries operate at machine speed, shrinking attacks from days to minutes. Defenders can no longer investigate and respond before damage occurs. In this new era, Security Operations must prioritize speed, automation, and continuous decision-making.  ( 58 min )

DPRK-linked implant embeds 38 fabricated system messages that spoof an LLM triage harness, hiding a credential stealer and Telegram C2 underneath.  ( 29 min )

DPRK-linked implant embeds 38 fabricated system messages that spoof an LLM triage harness, hiding a credential stealer and Telegram C2 underneath.  ( 29 min )

Microsoft Defender configuration drift occurs when endpoint security settings gradually diverge from their intended hardened state due to troubleshooting or policy conflicts. This divergence often happens silently because Defender does not generate telemetry or XDR alerts when enforcement settings, such as Attack Surface Reduction rules, are modified. Standard monitoring tools frequently report these devices as compliant even when their actual protection posture has been significantly weakened. Source  ( 21 min )

Microsoft confirmed a regression in the Recycle Bin following the June 9, 2026, security updates. When users attempt to permanently delete a single item, the confirmation dialog displays an internal system filename starting with $R instead of the original name. This behavior stems from a failure in the shell's translation layer, which usually hides these implementation details from the user. Source  ( 21 min )

Google has integrated new Gemini AI capabilities into Google Sheets to help users identify and resolve formula errors automatically. This update allows the AI to analyze data structures and suggest corrections for both simple arithmetic and complex calculations. Workspace administrators must ensure that Gemini for Workspace is enabled for users to access these troubleshooting features. Source  ( 21 min )

President Trump has signed Executive Order 14409, establishing strict deadlines for federal agencies to adopt post-quantum cryptography. This directive aims to protect sensitive government data against "harvest now, decrypt later" attacks, where adversaries steal encrypted data today to decrypt it once powerful quantum computers are developed. The order significantly accelerates previous timelines, moving the compliance target forward by approximately five years to stay ahead of rapid advancements in quantum technology. Source  ( 21 min )

A security experiment successfully compromised over 26,000 AI agents by exploiting structural flaws in how agent skills are vetted and trusted. Researchers created a deceptive skill that appeared legitimate to non-technical users and bypassed automated security scanners from major vendors. By hosting malicious instructions on an external URL rather than within the skill package itself, the attackers ensured the payload remained invisible during initial inspections. Source  ( 21 min )

Microsoft is retiring Exchange Web Services in Exchange Online, with phased disablement beginning in October 2026 and full retirement in April 2027. It is replacing it with the Microsoft Graph API, the unified endpoint for accessing Microsoft 365 services. To prepare for this transition, you can now use the EWSAllowedAppIDs parameter to restrict access by application identifier. This article explains how to inventory your current dependencies and configure the new allow list to prevent service disruptions. Source  ( 25 min )

IBM has joined the OpenAI Daybreak Cyber Partner Program to integrate advanced frontier AI models into its managed security operations. This collaboration introduces a new application security service designed to identify and validate software vulnerabilities with greater precision than traditional code scanners. The initiative aims to help organizations counter machine-speed threats by automating the prioritization of high-risk software components and exploitable paths. Source  ( 21 min )

Cloudflare has partnered with Google, Microsoft, and Mozilla to develop Private Access Control Tokens, a new protocol designed to verify web traffic legitimacy. This initiative aims to distinguish between human users, authorized AI agents, and malicious bots without relying on intrusive tracking or repetitive manual challenges. The protocol allows trusted platforms to issue anonymous digital tokens that a browser can present to other websites as proof of a legitimate session. Source  ( 21 min )

OpenAI’s Codex CLI contains a misconfiguration that triggers excessive diagnostic logging to a local SQLite database located in the user's home directory. This issue stems from the application defaulting to the TRACE logging level, which is the most verbose setting available for developers. Reports indicate that the tool captures low-level telemetry, including raw WebSocket payloads and filesystem events, which are typically unnecessary for standard production use. Source  ( 21 min )

Cursor has announced Origin, a purpose-built Git hosting platform designed to handle the high-frequency workloads of AI agents. Traditional version control systems are often optimized for human developers who commit code at a relatively slow pace. Origin utilizes a new architecture backed by S3 storage to support massive parallel operations, such as hundreds of thousands of clones per hour. Source  ( 21 min )

Microsoft is pushing the scaling boundaries of Azure Kubernetes Service (AKS) to support massive AI workloads for organizations like OpenAI and Anthropic. Some clusters now reach up to 75,000 nodes, far exceeding original industry recommendations of 100 nodes per cluster. To achieve this, engineers optimize the API server, etcd performance, and controller responsiveness while contributing these improvements back to the upstream Kubernetes project. Source  ( 21 min )

AWS has launched Lambda MicroVMs, a serverless compute primitive designed to run isolated Linux environments for significantly longer durations than standard functions. Built on Firecracker virtualization technology, these units extend the maximum execution time from 15 minutes to eight hours. This new capability allows developers to run complex tasks like vulnerability scanning, CI/CD pipelines, and AI-generated code execution within a secure hardware-virtualized boundary. Source  ( 21 min )

The Linux Foundation has introduced the Agent Name Service (ANS), an open standard designed to provide artificial intelligence agents with trusted identities. This framework utilizes the existing Domain Name System (DNS) to verify an agent's organizational affiliation and specific permissions. By anchoring identity to DNS, the service avoids proprietary registries and allows for the verification of an agent's code integrity and activity history. Source  ( 21 min )

A supply chain attack targeting the market intelligence platform Klue has resulted in the theft of OAuth tokens used by several high-profile organizations. The Icarus extortion group gained access to Klue's infrastructure by exploiting a dormant legacy credential for a prototype integration service. Once inside, the threat actors exfiltrated OAuth tokens that allowed them to query connected third-party environments, specifically targeting Salesforce CRM data. Source  ( 21 min )

Meta has suspended an internal AI training initiative known as the Model Capability Initiative after sensitive employee data became accessible company-wide. The program was designed to improve AI models by recording the keystrokes and mouse movements of staff members during their daily work. This mandatory data collection effort had already faced significant internal pushback from employees concerned about their digital privacy. Source  ( 21 min )

The 67th Top500 list reveals that China has overtaken the United States with its new Lineshine supercomputer, the first to exceed 2.2 exaflops in performance. This system, also known as Ling Chen, utilizes entirely domestic hardware developments to bypass international export restrictions on high-end components. It marks a significant return to the public rankings for China, which had largely stopped sharing official performance data for its leading systems since 2019. Source  ( 21 min )

OpenAI has expanded its Daybreak cybersecurity initiative to address the growing bottleneck in software remediation. While AI has significantly accelerated the discovery of security flaws, the manual process of fixing them often overwhelms development teams. The program aims to democratize patching at machine speed by combining advanced models with human oversight to validate and resolve vulnerabilities. Source  ( 21 min )

Anthropic’s advanced Mythos AI model reportedly compromised nearly all classified systems belonging to the NSA and U.S. Cyber Command during a security evaluation. General Joshua Rudd, head of both agencies, informed the Senate Intelligence Committee that the breach occurred within hours rather than weeks. This capability stems from the model's specialized design for identifying zero-day vulnerabilities in highly hardened software environments. Source  ( 21 min )

Microsoft Intune allows administrators to deploy and manage FileVault full-disk encryption for macOS 10.13 and later. The platform supports multiple deployment methods, including standard interactive prompts and automated enforcement during the Setup Assistant for devices on macOS 14 or newer. Encryption is standardized at XTS-AES 128-bit, which Apple considers sufficient for enterprise security requirements. Source  ( 21 min )

Microsoft Intune utilizes the Intune management extension to deploy PowerShell scripts to Windows 10 and later devices. This extension enhances modern management by allowing administrators to run scripts in either the system context or using logged-on user credentials. Scripts execute before Win32 apps and are automatically retried up to three times if an initial failure occurs during check-in. Source  ( 21 min )

Jamf and IPORT showcased an iPad-based, Apple-first restaurant technology stack at the NRA Show in Chicago.  ( 8 min )

Declarative Device Management's proactive status reporting gives mid-market IT teams real-time Mac fleet visibility — without the manual work.  ( 7 min )

Your guide to operationalizing AI-powered threat detection and response with Wiz to stay ahead of AI-driven attackers.  ( 65 min )

TL;DR  Introduction  Recently in a test I had the joy of reverse engineering the custom binary that acts as a webserver and system controller for their ARM based device. Normally this isn’t a problem: extract the binary, throw it into Ghidra, do stuff.  The problem here was that the binary was in written in Rust. Which does a lot of things differently […] The post Decoding Rust strings  appeared first on Pen Test Partners.  ( 8 min )

How Elastic's security team built an AI agent with RAG against MITRE's CWE and CAPEC catalogues to draft CVE advisories from raw vulnerability reports, including the full prompt and crawler configs.  ( 40 min )

﷽  ( 7 min )

Windows 11 version 26H2 is the next annual feature update for the operating system, expected to roll out in fall 2026. Microsoft confirmed that this release uses an enablement package (eKB), a small update that flips the version number without replacing the entire operating system. The update shares the same platform code as versions 24H2 and 25H2, meaning installation is fast and requires only a single reboot. This article covers the new features, the support lifecycle, and how to download and install Windows 11 26H2 ISO. Source  ( 29 min )

Homebrew 6.0 introduces a significant security overhaul designed to mitigate supply chain attacks by implementing a new "tap trust" mechanism. The package manager now blocks third-party repositories, known as taps, unless they are on a pre-approved list or have been manually vetted by the user. This change prevents the silent execution of potentially malicious Ruby installation scripts from untrusted sources during the software setup process. Source  ( 21 min )

Microsoft has introduced a new framework designed to help developers build autonomous agent harnesses and "claws" for specialized tasks. The system provides a minimal infrastructure that supports essential functions like web searching, task planning, and custom tool integration. This initial release focuses on enabling agents to execute complex workflows through dedicated plan and execute modes. Source  ( 20 min )

Organizations are increasingly utilizing OpenAI Codex to manage complex technical projects that extend far beyond a single prompt. This shift requires a persistent workspace strategy where the AI maintains context and manages multi-step workflows over long durations. System administrators can leverage these capabilities to break down ambitious infrastructure goals into smaller, verifiable tasks that ensure continuity across different workstreams. Source  ( 21 min )

Anthropic has updated its privacy policy to include mandatory identity verification for consumer accounts under specific circumstances. Starting July 8, 2026, users of the Free, Pro, and Max plans may be required to submit government-issued identification and biometric data. This process involves capturing a live selfie and a scan of a photo ID to generate facial geometry templates for authentication. Source  ( 21 min )

A critical heap buffer overread vulnerability, dubbed Squidbleed, has been discovered in the widely used Squid web proxy. This flaw, tracked as CVE-2026-47729, has existed in the software's FTP directory-listing parser since 1997. The vulnerability allows a trusted client to leak internal memory from the proxy, potentially exposing cleartext HTTP requests, passwords, and API keys. Source  ( 21 min )

Microsoft has confirmed a significant bug in Outlook for Mac that prevents the application from displaying original message text when replying to emails. Users report that after updating to version 16.110, the reply window appears entirely blank or contains only the new response without the preceding thread. This issue effectively breaks the standard conversation flow by stripping away the historical context of the email exchange. Source  ( 21 min )

Microsoft is testing a significant overhaul of the sound settings interface in Windows 11 to reduce navigation complexity. The update, currently available in the Experimental Preview Channel, consolidates multiple audio controls onto the "All sound devices" page. This change aims to minimize the number of clicks required to manage various input and output hardware. Source  ( 20 min )

Microsoft has identified a persistent malware campaign dubbed Crypto Clipper that has been targeting Windows users since February 2026. The threat propagates like a worm by using infected USB drives to replace legitimate documents with malicious shortcut files. When a user clicks these shortcuts, the malware installs a payload that utilizes the Tor network to communicate with attacker-controlled servers. Source  ( 21 min )

Microsoft researchers identified a vulnerability chain named AutoJack in the development branch of AutoGen Studio, a framework for building multi-agent AI systems. The exploit allows a malicious webpage to execute arbitrary commands on a host machine if an AI agent with web-browsing capabilities renders the page. This attack effectively turns the local AI agent into a delivery vehicle for remote code execution by bypassing traditional localhost security boundaries. Source  ( 21 min )

Google has transitioned the Interactions API from beta to general availability, making it the new standard interface for building with Gemini models. This update replaces the previous generateContent API in all official documentation and serves as the foundation for future agentic features. While the older API remains supported for existing integrations, Google recommends the new interface for all new projects and complex conversational workflows. Source  ( 21 min )

Microsoft has announced the deprecation of the Azure DevOps issuer for workload identity federation service connections, with a final retirement date set for July 1, 2027. This change is part of a broader initiative to standardize on the Microsoft Entra issuer to improve security and consistency across Azure services. The transition affects service connections in the Azure public cloud that utilize single-tenant applications or managed identities for secretless authentication. Source  ( 21 min )

A recent update to Outlook for Mac has introduced a significant regression that prevents the original message from being included when replying or forwarding. The bug specifically impacts version 16.110 and appears to be isolated to the Legacy UI mode. Users report that the composition window remains blank or contains only headers, making it impossible to maintain conversation context without manual intervention. Source  ( 21 min )

Microsoft has clarified that PCs failing to update to the 2023 Secure Boot certificates by the June 2026 deadline will not be bricked. These devices will continue to boot normally and receive standard Windows updates, but they will lose the ability to process future boot-level security revocations. This transition is necessary because the original 2011 certificates are expiring, preventing the firmware from blacklisting newly discovered malicious bootloaders. Source  ( 21 min )

A new wave of malicious packages on the npm and PyPI repositories is employing "indirect prompt injection" to disrupt AI-assisted malware analysis. Researchers identified that the Hades campaign and specific packages like shai_hulululud embed large blocks of deceptive text within non-executable code comments. This technique targets LLM-based triage pipelines by including forbidden topics or repetitive "token flooding" designed to trigger safety refusals or system timeouts. Source  ( 21 min )

Anthropic has introduced a beta feature for Claude Code that transforms AI coding sessions into live, shareable web pages called Artifacts. Available to Team and Enterprise subscribers, these pages allow teammates to monitor an AI agent's progress in real time through a private URL. This functionality addresses a visibility gap by moving session outputs from a local terminal into a browser-based environment for easier inspection. Source  ( 21 min )

Microsoft is testing a new feature in Windows 11 Insider Build 26300.8697 that allows users to completely disable Bing web results and Microsoft Store suggestions within the taskbar search. This change is located under a new "Show suggested search results" section in the Search privacy settings, providing independent toggles for web and store content. By removing these external dependencies, the search interface becomes significantly less cluttered and prioritizes local files, settings, and installed applications. Source  ( 21 min )

Systemd 261 introduces a new cloud Instance Metadata Service subsystem featuring the systemd-imdsd daemon. This service provides a unified local interface for accessing metadata across various providers like AWS, Azure, and Google Cloud, reducing the need for provider-specific tools. Administrators can now restrict direct network access to cloud metadata endpoints to enhance security against request forgery and unauthorized access. Source  ( 21 min )

Researchers from Wake Forest University recently analyzed 444 iOS applications that integrate Large Language Model features. The study revealed that 282 of these apps exposed exploitable credentials or backend access mechanisms. These vulnerabilities were found across 13 different categories, including productivity, education, and lifestyle tools. Source  ( 21 min )

AI coding agents like Claude Code and Cursor have the capability to edit files and execute terminal commands directly on developer machines or in CI/CD environments. These tools often operate with significant privileges, creating a new attack surface where malicious instructions can be disguised as legitimate system data. A lack of visibility into these automated actions makes it difficult for organizations to monitor for unauthorized or suspicious behavior. Source  ( 21 min )

Today, OpenAI announced that it is expanding access to its frontier AI cybersecurity capabilities for a trusted circle of industry partners, including SpecterOps, through the OpenAI Daybreak Cyber Partner Program. Since April, SpecterOps has participated in the OpenAI Trusted Access for Cyber program (TAC), through which our researchers have access to advanced cyber-capable models for legitimate security use cases, helping us […] The post SpecterOps and OpenAI: Helping to Build a New Security Frontier with Daybreak    appeared first on SpecterOps.  ( 14 min )

What happens when you clear dozens of Trail of Bits engineers’ schedules, pair them with every open-source maintainer they can contact, and unleash the latest frontier models like GPT-5.5-Cyber on critical open-source targets? Thanks to our partnership with OpenAI and its Daybreak initiative, we can report that the impact is hundreds of discovered bugs, 64 pull requests, and 51 issues filed across 19 projects (with many more still undergoing coordinated disclosure). That was just the first week of Patch the Planet. Frontier models like GPT-5.5-Cyber are producing a firehose of security findings, and already-stretched maintainers must sift through all of it to separate real vulnerabilities from plausible-sounding false positives. Patch the Planet is different: with our experts orchestrating…  ( 5 min )

By Chanh Pham Overview In this blog post we take a look at a vulnerability patched in a Chrome release on 3rd March 2026 and assigned CVE-2026-3542. The vulnerability arose from a flaw in state management when processing an AsmJS module, which results in a corrupted WebAssembly stream when it is fed to the decoder to instantiate ... Read more Out of Shift: How a Shared State Bug in V8’s AsmJS Parser Broke the Ubercage The post Out of Shift: How a Shared State Bug in V8’s AsmJS Parser Broke the Ubercage appeared first on Exodus Intelligence.  ( 20 min )

There is a documented enforcement gap in Conditional Access policies that apply to “all resources” but have an exclusion for at least one resource. What is not documented, is that this gap is much larger than what one would expect, and that the documented mitigation doesn’t actually work. The good news if you are an Entra admin is that this is now considered legacy behaviour that Microsoft is changing and that if your tenant isn’t automatically migrated yet you can opt-in to the new behaviour which addresses and fixes this issue. If you have a policy with a resource exclusion, I would highly recommend applying this change.  ( 9 min )

Secure your Windows fleet without sacrificing performance. Wiz pairs real-time threat detection with a memory-safe architecture that scales efficiently to protect your essential cloud infrastructure.  ( 56 min )

Discover how attackers bypassed Microsoft Entra Conditional Access Policies using Nested App Authentication (NAA) flows in this technical vulnerability breakdown. The post Bypassing Microsoft Entra Conditional Access Policies via Nested App Authentication appeared first on NetSPI.  ( 16 min )

Yann LeCun, the founder of AMI Labs and a pioneer in the field, has characterized Elon Musk’s xAI as a failure. He argues that the departure of the company's entire founding team has severely compromised its ability to recruit the top-tier talent necessary for high-level innovation. Consequently, LeCun believes xAI will struggle to remain competitive against industry leaders like OpenAI and Anthropic. Source  ( 20 min )

The CEOs of Anthropic, Google DeepMind, and OpenAI met with G7 leaders to advocate for a United States-led international coalition focused on artificial intelligence governance. During a closed-door session in France, industry leaders proposed that Washington take the primary role in establishing global rules and safety standards. This initiative aims to harmonize how nations test and deploy advanced models while managing the significant risks associated with the technology. Source  ( 20 min )

Amazon has acknowledged that its proprietary artificial intelligence models currently lag behind the industry-leading frontier systems developed by OpenAI and Anthropic. Peter DeSantis, the executive overseeing Amazon’s AI and chip divisions, stated that the company’s models have not yet met the requirements for the most demanding enterprise workloads. Despite this gap, the company expects to be in the conversation regarding leading frontier models within the next year. Source  ( 20 min )

﷽  ( 17 min )

Intel and AMD have released the official specification for AI Compute Extensions, or ACE, a standardized instruction set for future x86 processors. Developed through the x86 Ecosystem Advisory Group, these extensions aim to accelerate matrix multiplication and machine learning workloads directly on the CPU. By establishing a common technical standard, the two rivals intend to prevent market fragmentation and provide a consistent target for software developers. Source  ( 21 min )

OpenAI has launched a new feature called Record & Replay for its Codex application on macOS. This tool allows users to demonstrate a specific digital workflow once while the AI agent observes the actions. Codex then converts that recorded sequence into a reusable skill that can be executed autonomously in the future. Source  ( 21 min )

Maintaining current security intelligence is essential for Microsoft Defender Antivirus to identify and neutralize emerging threats effectively. Administrators can define a specific fallback order for update sources to ensure endpoints remain protected even if a primary connection fails. Available update locations include Microsoft Update, Windows Server Update Services (WSUS), Microsoft Configuration Manager, network file shares, and the Microsoft Malware Protection Center. Source  ( 21 min )

A coalition of enterprise technology leaders including Microsoft, Google, and Salesforce has introduced the Agentic Resource Discovery (ARD) protocol. This open standard establishes a universal discovery layer that allows AI agents to automatically identify and invoke corporate tools across fragmented software environments. By utilizing a system of catalogs and registries similar to DNS, the framework eliminates the need for developers to hardcode manual connections between different applications. Source  ( 21 min )

AMD has announced it will reinstate Transparent Secure Memory Encryption (TSME) for consumer-grade Ryzen 9000 desktop processors via a BIOS update in July. This decision follows significant community feedback after the feature was quietly removed in a recent firmware update. TSME, which AMD brands as Memory Guard for its professional product lines, provides a hardware-based layer of protection for data stored in system memory. Source  ( 21 min )

Microsoft is shifting its strategy by reducing the mandatory use of Microsoft accounts across its ecosystem. A significant update to the Microsoft 365 Roadmap reveals that Microsoft Edge will soon allow users to sign in using a Google account instead of a Microsoft account. This feature, expected to roll out in July 2026 for Windows and macOS, aims to lower the barrier for Chrome users considering a switch to Edge. Source  ( 21 min )

AI loops are emerging as a transformative method for building software by allowing coding agents to work autonomously toward specific goals. These loops require a trigger—such as a manual command, a set schedule, or an action like opening a pull request—to initiate the process without constant human intervention. Success is determined either through verifiable metrics, such as specific page load speeds, or by using the large language model itself as a judge for qualitative tasks like code refactoring. Source  ( 21 min )

Norway is implementing strict regulations on artificial intelligence in classrooms to prioritize fundamental skills like reading, writing, and mathematics. Prime Minister Jonas Gahr Støre announced that the new rules will take effect in August 2025 to address concerns about the negative impact of technology on student development. The government aims to shift the educational focus back to analog methods following a decline in literacy rates and test scores. Source  ( 21 min )

Microsoft has addressed a deployment issue affecting Windows Server 2016 systems that failed to install the June 2026 cumulative security update, KB5094122. The problem primarily impacted servers that had skipped the previous month's update, KB5087537, which serves as a necessary baseline. Without this prerequisite, the installation process would fail, leaving legacy systems vulnerable to security risks. Source  ( 21 min )

Alibaba Cloud has launched its first cloud region in France, establishing two new availability zones in Paris. This expansion increases the provider's European footprint, joining existing hubs in Germany and the United Kingdom. The new infrastructure supports a comprehensive suite of enterprise services, including elastic computing, containerization, and database management, designed to meet local regulatory requirements. Source  ( 21 min )

Salesforce has disabled the Klue Battlecards app integration after a security breach at the competitive intelligence firm exposed customer data. The incident originated from a compromised legacy credential within Klue's infrastructure, which allowed an extortion group known as Icarus to push malicious code. This code collected OAuth tokens that customers use to connect Klue to their own environments, effectively bypassing standard authentication measures like passwords or multi-factor authentication. Source  ( 21 min )

Amazon is exploring a significant shift in its hardware strategy by considering the sale of its custom Trainium AI chips to third-party data centers. Currently, these processors are exclusive to the Amazon Web Services (AWS) cloud environment, where they are used by organizations like OpenAI and Anthropic for AI training and inference. This potential move marks a direct challenge to Nvidia's dominance in the semiconductor market by offering a proprietary alternative for high-performance AI infrastructure. Source  ( 21 min )

John Jumper, a prominent research scientist and Nobel Prize winner, has announced his departure from Google DeepMind to join the AI startup Anthropic. Jumper is widely recognized for his pioneering work on AlphaFold, an artificial intelligence system capable of predicting protein structures. This breakthrough has significantly accelerated biological research by providing data on over 200 million protein structures, a task that previously required years of manual labor. Source  ( 21 min )

Apple is introducing significant updates to iPhone Mirroring in macOS 27, allowing users to flexibly resize app windows for the first time. Previously, the feature was restricted to fixed aspect ratios and preset scaling options. This change enables users to drag windows wider or taller, provided the applications are compiled with the latest software development kit. Source  ( 21 min )

Microsoft is enhancing its Purview data governance service to provide organizations with stricter control over how AI interacts with confidential information. Purview is a suite of tools designed to help commercial customers manage, secure, and govern large volumes of data across their digital estate. This upcoming change specifically addresses concerns regarding artificial intelligence services accessing and processing protected corporate content without explicit permission. Source  ( 21 min )

Microsoft has released Windows 11 Beta (26H1) Build 28020.2308 to the Insider program, focusing on stability and underlying system components. This update specifically targets the reliability of the inbox High Definition (HD) Audio driver to ensure better hardware compatibility. The release follows a series of June updates aimed at refining the core operating system experience for upcoming versions. Source  ( 21 min )

Microsoft has released Windows 11 build 26220.8690 to the Beta channel, focusing on system stability rather than new features. This update addresses critical stop errors that previously triggered bug checks on certain hardware configurations. Specifically, it resolves issues leading to HYPERVISOR_ERROR and KMODE_EXCEPTION_NOT_HANDLED codes that occurred after recent updates. Source  ( 21 min )

Microsoft has officially confirmed the upcoming release of Windows 11 version 26H2, marking a return to its standard update cadence for the broader user base. This version follows the recent 26H1 release, which was a specialized build restricted to specific new hardware. The 26H2 update is intended for users currently running versions 24H2 and 25H2, as these versions share a common servicing branch. Source  ( 21 min )

Microsoft has officially announced that support for the Office 2021 suite will conclude on October 13, 2026. After this date, the software will no longer receive security patches, bug fixes, or technical assistance from the company. This move is part of a broader strategy to transition users toward subscription-based services or newer perpetual licenses. Source  ( 21 min )

Starting in August 2026, Microsoft Edge will ship major updates every two weeks instead of every four weeks. Google Chrome will adopt the same schedule in September 2026. This accelerated cadence affects the Stable channel that most organizations use by default. If you want to avoid the increased update frequency, you can move your browsers to the Extended Stable channel, which retains an eight-week release cycle. This article explains how to configure the channel switch using Group Policy for both browsers. Source  ( 28 min )

Amazon has launched a managed web search tool for Bedrock AgentCore to provide AI agents with real-time information. This feature addresses the limitation of static training data by allowing agents to access current web content, such as stock prices or recent news. The service is fully managed, meaning administrators do not need to provision external search APIs or manage third-party credentials. Source  ( 21 min )

Amazon MGM Studios has officially cancelled its plans to distribute "Artificial," a biographical film centered on OpenAI CEO Sam Altman. The production was set to dramatize the intense five-day period in late 2023 when Altman was briefly fired and then reinstated at the artificial intelligence company. This decision comes shortly after Amazon strengthened its corporate relationship with OpenAI by integrating the startup's models into its own cloud services. Source  ( 21 min )

Microsoft has introduced new tools and guidance to help organizations migrate large-scale data estates to Azure Storage more efficiently. The process begins with Azure Migrate, a centralized hub that discovers infrastructure, assesses readiness, and analyzes workload dependencies across on-premises and multicloud environments. To bridge the gap between planning and execution, a new AI-powered Azure Copilot Migration Agent is now available in preview to recommend specific storage services and migration tools. Source  ( 21 min )

The June 2026 cumulative update for Windows 11, identified as KB5094126, is causing significant stability issues across various hardware platforms. Affected systems, particularly HP EliteBook and Dell Precision models, may experience Blue Screen of Death errors, system freezes, and forced BitLocker recovery loops. Beyond hardware-specific failures, the update disrupts OneDrive integration within File Explorer and prevents some third-party applications from launching Microsoft Office documents. Source  ( 21 min )

RIPE NCC is the Regional Internet Registry for Europe, the Middle East, and parts of Central Asia. It allocates and registers internet number resources such as IP addresses and AS numbers, and it keeps the related public registry up to date. Source  ( 21 min )

Google is currently testing a new telemetry feature in the Canary version of Chrome that identifies installed antivirus software on Windows systems. This functionality is designed to trigger when a user downloads a file while having Enhanced Safe Browsing enabled. The browser retrieves the name of the security product, such as Microsoft Defender or third-party alternatives, directly from the operating system. Source  ( 21 min )

The 2026 Burp Suite Extension Awards Best Recon & Discovery Best Auth & Access Control Best Workflow & Manipulation Best API & Specialist Testing Hidden Gem Most Nominated The talks In  ( 8 min )

In the previous post we walked through WasmForge, our Go-to-WebAssembly loader that takes existing signatured Go tools and ships them as opsec-safe binaries. This approach doesn’t just apply to Go, however, as there are many languages that can compile to WebAssembly. Another language of interest to us, especially regarding legacy tools which have been over-signatured, […] The post GhostPack Necromancy: Reforging C# Tools with WasmForge appeared first on Praetorian.  ( 26 min )

Azure AD Graph Activity Logs land in Elastic with full ECS parsing. Detect ROADrecon and AADInternals enumeration with ready-to-use detection rules.  ( 30 min )

Find out how a new obfuscated loader evades static detection using .reloc section abuse, five anti-VM/language checks and MBA obfuscation to deliver infostealer malware via Google Ads.  ( 23 min )

The rapid expansion of AI is straining terrestrial resources, particularly in regions like Arizona where data centers face severe water and power shortages. To circumvent these physical limits, the tech industry is exploring orbital data centers equipped with high-performance processors like the Nvidia H100. This shift aims to move heavy compute tasks, such as training large AI models, into space where solar energy is abundant and unimpeded. Source  ( 20 min )

The Microsoft Entra June 2026 update adds phishing-resistant multifactor authentication for Linux desktops, expands passkey support on Windows, and changes how Self-Service Password Reset verifies identity. It also brings new Conditional Access enforcement during credential registration and a public preview for recovering deleted device objects. This article explains the practical and technical details of these changes for everyday administration. Source  ( 28 min )

IBM and Microsoft have launched a collaborative service designed to bridge the gap between detecting identity-based threats and executing governed remediation. The partnership integrates Microsoft’s security telemetry with IBM’s managed response services to address the rising volume of credential-based attacks. This solution specifically targets risks such as multi-factor authentication abuse, token theft, and unauthorized privilege escalation. Source  ( 20 min )

Citrix has launched DaaS Flex, a service designed to reduce virtualization costs by analyzing an organization's actual endpoint requirements. The tool assesses the existing fleet to identify where users are over-provisioned with expensive virtual machine instances. By evaluating hardware utilization, the service determines whether a user requires a full cloud PC, a managed browser, or just specific published applications. Source  ( 21 min )

Cloudflare has developed a specialized orchestration layer to manage fleet-wide security audits using interchangeable large language models. This architecture treats models as stateless compute engines to prevent context exhaustion and ensure that vulnerabilities are cross-verified by different logical weights. By decoupling the security logic from specific AI providers, the system maintains persistence and reliability even when underlying models or APIs fluctuate. Source  ( 20 min )

The Chinese AI lab Z.ai has released GLM-5.2, a new open-weights model that currently leads the Intelligence Index v4.1 for its category. This model is distributed under an MIT license, allowing administrators and developers to download, modify, and run the weights commercially without the restrictions typical of proprietary systems. Its performance represents a significant leap over previous versions, with benchmarks showing rapid improvements in terminal and coding tasks achieved in just a few weeks. Source  ( 21 min )

Recent data from Pew Research indicates that half of American adults now utilize AI chatbots, a significant increase from one-third just last year. OpenAI’s ChatGPT remains the dominant platform with 44% of the population reporting its use, followed by Google Gemini and Microsoft Copilot. Despite this growing adoption, only 16% of respondents believe the technology will have a positive impact on society over the next two decades. Source  ( 21 min )

Anthropic has announced the general availability of Workload Identity Federation (WIF) on the Claude Platform. This feature supports any OpenID Connect (OIDC) compliant identity provider, including AWS IAM, Azure managed identities, and Google Cloud Platform service accounts. It applies to all Claude API endpoints, first-party software development kits (SDKs), and Claude Code. Source  ( 20 min )

Apple plans to increase the prices of its products due to the surging costs of memory and storage chips. Chief Executive Officer Tim Cook stated that these price hikes are unavoidable because the current supply situation has become unsustainable for the company. The rising costs and subsequent chip shortages are primarily driven by the massive demand for hardware from artificial intelligence companies. Source  ( 21 min )

Microsoft has announced the Release Candidate for TypeScript 7.0, which features a significant architectural shift from a bootstrapped codebase to one written in Go. This new foundation leverages native code speed and shared memory parallelism to deliver performance that is often ten times faster than the previous version. The update is designed to be highly compatible with existing projects, as the type-checking logic was methodically ported to ensure identical semantics to version 6.0. Source  ( 21 min )

Microsoft has released Visual Studio Code version 1.126 with several updates focused on the user interface and AI features. The update introduces visual enhancements to the chat session list items within the development environment. These list items now utilize a pixel spinner, which aligns the interface with the design of the Agents window. Source  ( 20 min )

Large language models often already possess extensive knowledge of common API references, authentication flows, and standard SDK patterns from their training data. When developers create skills that repeat this information, they consume valuable space within the finite context window of the AI. This redundancy pushes out critical data like conversation history or workspace files, which can actually degrade the quality of the generated output. Source  ( 20 min )

Google has introduced a framework called the AI Control Roadmap to manage autonomous agents that may exhibit imperfectly aligned behavior. This defense-in-depth strategy treats internal AI agents as potential insider threats, similar to how organizations monitor employees with high-level access. The system aims to provide security assurance by moving beyond traditional model alignment to include active system-level monitoring. Source  ( 21 min )

Anthropic has announced a major update to Claude Design that introduces bidirectional integration with Claude Code to streamline the transition between prototyping and development. Developers can now use the /design-sync command to import local design systems into Claude Design, ensuring prototypes utilize real code components. Conversely, the /design command allows users to create and sync design projects directly from a terminal without switching applications. Source  ( 21 min )

F5 has released out-of-band security updates to address multiple vulnerabilities in the NGINX web server. The patches resolve two critical-severity flaws, CVE-2026-42530 and CVE-2026-42055, which could allow remote attackers to execute arbitrary code. These vulnerabilities affect NGINX systems with non-default configurations and can trigger a denial-of-service condition or worker process restart. Source  ( 20 min )

A massive credential-compromise campaign known as FortiBleed has exposed the login details for approximately 75,000 Fortinet FortiGate firewalls worldwide. Security researchers discovered an attacker-controlled server containing a highly automated infrastructure used to collect and crack configuration files from internet-facing devices. The stolen data includes a mix of administrative and SSL VPN credentials, potentially granting threat actors deep persistent access to enterprise networks. Source  ( 21 min )

Reports indicate that Microsoft abandoned a $3 billion deal to lease capacity from Oracle Cloud Infrastructure due to compliance disagreements. The partnership was intended to provide Microsoft with additional computing power to support its growing artificial intelligence workloads. However, negotiations allegedly stalled when Oracle declined to implement specific security standards required for certain government-related data processing. Source  ( 21 min )

Microsoft has introduced the Power Display utility within the PowerToys suite to centralize the management of external monitor settings. This tool utilizes the Display Data Channel/Command Interface (DDC/CI) standard to communicate directly with hardware displays from the Windows desktop. It allows for the adjustment of brightness, contrast, volume, and input sources without the need to use physical buttons on the monitor. Source  ( 21 min )

Microsoft is updating the sign-in experience for personal accounts by requiring users to manually type a two-digit code into the Authenticator app. This replaces the previous method where users simply chose the correct number from three visible options on their mobile device. The change is being rolled out gradually to ensure all users eventually transition to this more deliberate verification process. Source  ( 21 min )

Microsoft is updating the Edge browser to allow users on Windows and macOS to sign in using a Google account. This change, scheduled for global rollout in July 2026, removes the strict requirement for a Microsoft account to manage browser profiles. Users will soon find the Google sign-in option directly within the browser's profile menu and initial setup screens. Source  ( 20 min )

The tech sector was the only industry in Synack's 2026 State of Vulnerabilities Report to get slower at remediating critical vulnerabilities—growing from 74 to 98 days while manufacturing, government, and financial services all improved. This post breaks down the technical and cultural forces driving that gap, and what it takes to close it. The post The Tech Sector’s Critical Vulnerability Paradox appeared first on Synack.  ( 16 min )

The latest updates from Jamf on the Klue third-party cybersecurity incident. Here's what we know and what we're doing about it.  ( 5 min )

ClearFake is the clear-cut number one again and Kali365 debuts in this month’s edition of Intelligence Insights  ( 31 min )

The first version of BloodHound MCP proved that an LLM could converse with BloodHound. The current version drove home the lesson that MCP design is context design. The most useful changes were smaller but more flexible tools, better error recovery, domain-specific resources, and a prompt that guides the model instead of trying to teach everything up front. The post BloodHound MCP, One Year Later: What I Learned About MCPs, Models, and Context appeared first on SpecterOps.  ( 19 min )

Post-Quantum Cryptography is no longer a future-only concern. Standards are final, major providers have already deployed hybrid protection, and the real risk now is data captured today and decrypted later. Part 1 explains the fundamentals, the threat, and why organizations can no longer afford to wait.  ( 20 min )

The following document describes identified vulnerabilities in the Shynet application version 0.13.1.  ( 13 min )

We walk through three eras of cyber attacks and makes a troubling case that LLMs are removing the one constraint that kept attackers slow and detectable.  ( 9 min )

The spotlight has been on frontier models, but the goals are more far reaching -- including supercharging cyber defense and remediating risk at machine speed  ( 64 min )

Dive into this real-world social engineering assessment where a fake anonymous tip and an adversary-in-the-middle framework tested the limits of an organization's security policies. The post I’m Just Asking Questions: Social Engineering as a Reporter  appeared first on NetSPI.  ( 13 min )

Microsoft Defender for Cloud Apps has received several updates in 2026, focusing on SaaS application monitoring, OAuth app governance, and AI agent protection. The latest releases introduce enhanced Salesforce connector capabilities, real-time protection for AI agents built with Copilot Studio, and improvements to app governance workflows. This article covers the most relevant changes for administrators managing cloud application security. Source  ( 29 min )

Windows 11 contains a hidden configuration menu called Processor Performance Boost Mode that allows for granular control over CPU frequency scaling. This feature is typically concealed from the standard power options interface to balance heat, power consumption, and system stability. It relies on Collaborative Processor Performance Control technology, which is a standard feature found in most modern Intel and AMD processors. Source  ( 21 min )

Security researchers recently identified critical vulnerabilities in Microsoft 365 Copilot that allowed attackers to exfiltrate sensitive organizational data. These exploits, known as SearchLeak and EchoLeak, utilized prompt injection techniques to bypass standard security boundaries without requiring user interaction. The flaws targeted the enterprise tier of the service, potentially exposing any information the AI could access within a tenant's environment. Source  ( 21 min )

Cloudflare has introduced the Cloudflare One stack to simplify the transition to Zero Trust network architectures. This toolkit provides specialized skills for AI agents to automate the configuration, deployment, and management of security environments. It aims to reduce the manual effort required to decode complex network topologies and existing vendor policies. Source  ( 21 min )

AMD's next-generation Threadripper processors, codenamed Mustang Peak, will utilize the Zen 6 architecture and a 2nm-class manufacturing process. These high-end chips are expected to support the PCI Express 6.0 standard, which doubles the bandwidth of the previous generation. Due to these significant architectural changes, the processors will require a new platform and physical interface known as the TR6 socket. Source  ( 21 min )

Cisco has updated a critical security advisory to include the Catalyst SD-WAN Validator, formerly known as vBond, as a product vulnerable to a maximum-severity flaw. This vulnerability, tracked as CVE-2026-20127, involves an improper authentication issue that allows attackers to gain administrative rights and reconfigure the SD-WAN fabric. When combined with a secondary path traversal bug, unauthorized actors can achieve persistent root access to affected networking instances. Source  ( 21 min )

Microsoft is prioritizing system fundamentals through the Windows K2 initiative, a project focused on enhancing Windows 11 performance and reliability. Rather than waiting for major version releases, the company is delivering these optimizations through monthly cumulative updates. The initiative targets core user experiences, including faster application launches, more responsive shell interactions, and improved biometric sign-in speeds via Windows Hello. Source  ( 21 min )

Jeff Bezos identifies the primary obstacle to orbital data centers as a massive financial gap rather than a technical or physical limitation. While the founder of Blue Origin views space-based computing as realistic, he cautions that the current costs of AI chips and orbital logistics are prohibitive. The economic math must shift significantly before these facilities can compete with the infrastructure currently operating on the ground. Source  ( 21 min )

Nvidia CEO Jensen Huang emphasizes that society must move past the fear of artificial intelligence to embrace its potential for economic growth and scientific breakthroughs. He argues that the current industrial revolution will be won at the application layer, where the speed of adoption determines long-term success. To facilitate this transition, Huang suggests that society needs to develop new social norms that accommodate the rapid integration of AI into daily life and infrastructure. Source  ( 21 min )

Organizations often struggle with AI return on investment because pilot programs frequently lack intentional business strategies or focus on commoditized public data. Success in production environments requires leveraging proprietary unstructured data, which constitutes roughly 90% of enterprise information within systems like emails, contracts, and medical records. By using large language models to provide structure to this data, businesses can transition from simple data "swamps" to sophisticated context engines that inform autonomous agents. Source  ( 21 min )

AMD has reportedly disabled Transparent Secure Memory Encryption (TSME) on consumer-grade Ryzen processors through recent firmware updates. TSME is a hardware-level feature that automatically encrypts data stored in system RAM to protect against physical attacks, such as cold-boot exploits or memory snooping. While previously available on standard Ryzen chips, the functionality now appears restricted to the more expensive Ryzen Pro and EPYC product lines. Source  ( 21 min )

The UK government is deploying generative AI tools across local planning authorities to automate the processing of housing applications and reduce administrative backlogs. Built on Google Cloud using Gemini foundation models, the "Extract" tool and "Augmented Planning Decisions" prototype aim to cut decision timelines from eight weeks to four. These systems address the high volume of unstructured data found in legacy PDF records, which currently forces planning officers to spend hours on manual data entry and cross-referencing. Source  ( 21 min )

Silicon Motion is prioritizing the development of PCIe 6.0 SSD controllers to align with Nvidia’s upcoming hardware roadmaps. While AMD and Intel have not yet committed to the high-speed interface for consumer platforms, Nvidia’s focus on agentic AI requires significantly higher data throughput. The storage manufacturer expects its first client-grade PCIe Gen6 platform to emerge in late 2027 to meet these specific bandwidth demands. Source  ( 21 min )

The June 2026 Windows updates have introduced a bug that prevents various third-party applications from launching Microsoft Office programs or opening documents. This issue specifically impacts software that utilizes OLE automation to interact with Word, Excel, PowerPoint, and Access. While the Office applications still function correctly when opened directly, they fail to trigger when called by external document management or accounting systems. Source  ( 21 min )

More than 100 cybersecurity executives and researchers are calling on the Trump administration to reverse export controls placed on Anthropic’s advanced AI models. The government recently ordered the company to suspend access to its Fable 5 and Mythos 5 models for foreign nationals due to national security concerns. Experts argue these restrictions hinder the ability of defenders to identify and patch software vulnerabilities at a critical time. Source  ( 21 min )

Anthropic has suspended its plan to transition Claude Agent SDK users from flat-rate subscriptions to usage-based token billing. This decision follows significant pushback from developers who argued the change would lead to unsustainable cost increases for heavy workloads. The company stated it is currently re-evaluating how to better support users who build applications using Claude subscriptions. Source  ( 21 min )

Databricks has introduced Genie One, a new tool designed to function as an "agentic coworker" for various business departments. This offering expands the company's existing Genie suite by moving beyond simple conversational analytics to active task automation. The platform aims to help teams in finance, marketing, and sales make better decisions by interacting directly with corporate data. Source  ( 21 min )

Leaked internal documents reveal that OpenAI is facing a widening gap between its surging revenue and even faster-growing expenses. While the company’s revenue increased from approximately $700 million in 2024 to over $10 billion in 2025, its net losses reportedly jumped from $5 billion to $39 billion in the same period. This trend indicates that the capital required to develop and distribute artificial intelligence is currently scaling more aggressively than the income it generates. Source  ( 21 min )

The Trump administration has issued an export control directive banning foreign entities and individuals from accessing Anthropic’s most advanced AI models, Fable 5 and Mythos 5. This mandate follows reports that users successfully bypassed safety guardrails on Fable 5 to access the more restricted capabilities of the Mythos system. Anthropic has responded by dispatching technical staff to Washington to negotiate a resolution while effectively pulling the affected models from the market. Source  ( 21 min )

Apple is planning to modify its Hide My Email service by transitioning generated addresses to a new dedicated subdomain. Currently, these anonymous addresses use the standard @icloud.com domain, making them indistinguishable from primary user accounts. In the coming weeks, the service will shift to using @private.icloud.com for all newly created aliases. Source  ( 21 min )

Overview Earlier this year, a team at Praetorian was building Constantine, our automated 0-day discovery engine. I wanted to find techniques worth folding into it, so on the side I started poking at the FreeBSD kernel with Claude Code, running on Opus 4.6, which was the latest Opus model at the time. A few days […] The post FreeBSoD: Leveraging Language Models to Find and Exploit Kernel Bugs (Part 1 of 2) appeared first on Praetorian.  ( 19 min )

A comprehensive guide to the most commonly abused RMM tools, including technical guidance for detection and prevention  ( 34 min )

Part 1: How the Red Agent uncovered a multi-step attack chain allowing SSRF-to-Local-File-Read on GCP Cloud Run  ( 59 min )

An inside look at how the Red Agent, our AI-Powered Attacker, uncovers complex, exploitable risks in the wild  ( 56 min )

This blog is the first in a series exploring how Summary Rules, together with Auxiliary or Data Lake storage, can help organizations optimize SIEM costs without compromising core threat detection and monitoring capabilities.  ( 17 min )

﷽  ( 9 min )

Authorization testing is one of the most repetitive, yet critical tasks in web app security testing. Checking for horizontal and vertical privilege escalation, IDORs, and other access control issues requires constantly swapping cookies and headers between different user sessions, a process that is error-prone and often becomes tedious. Today, we’re excited to release Session Switcher, a Burp Suite extension that lets you save and switch HTTP sessions with just a couple of clicks, right from the request editor. The Problem During a typical authorization test, you might very often find yourself needing to to: Copy cookies from one browser session and paste them into Repeater requests Keep track of multiple user roles and their authentication tokens Manually update expired JWTs or session coo…  ( 6 min )

Microsoft has deprecated DirectAccess and will remove it from a future release of Windows Server. The replacement is Always On VPN, introduced with Windows Server 2016 and Windows 10. This article explains what the deprecation means in practice, why Microsoft is making the change, the technical differences between the two solutions, and how the migration works. Source  ( 29 min )

HPE has unveiled a comprehensive update to its networking and AI infrastructure to support the deployment of autonomous AI agents. The strategy focuses on "self-driving" networks that integrate Juniper and Aruba technologies to automate operations across data centers and the edge. New hardware including the QFX5140 and QFX5250 switches aims to eliminate bottlenecks in AI inference clusters and rack-scale platforms. Source  ( 20 min )

Microsoft is transitioning its Copilot Cowork enterprise tool to a usage-based pricing model to manage the high costs of agentic AI. This shift replaces flat-rate subscriptions for the service, which currently utilizes Anthropic’s Claude technology for complex reasoning tasks. The change follows a similar billing adjustment recently implemented for GitHub Copilot to better align revenue with actual token consumption. Source  ( 20 min )

The Trump administration has rejected requests from G7 allies, including the United Kingdom, for exemptions from a ban on Anthropic’s most advanced artificial intelligence models. Prime Minister Keir Starmer sought a "carve-out" for British companies to access the Fable 5 and Mythos 5 systems, but US officials labeled such an exemption as illogical. The administration maintains that these frontier models must remain restricted to ensure the technology is fully protected from any foreign exploitation or national security threats. Source  ( 21 min )

Organizations are increasingly moving productive AI workloads from public cloud environments back to private infrastructure. Recent data indicates that over half of companies now prefer private clouds for AI inference, marking a significant shift from the initial experimentation phase. This trend is largely driven by the need for better cost management, reduced complexity, and increased operational control. Source  ( 20 min )

Microsoft has officially released the Surface Pro 12th Edition and Surface Laptop 8th Edition, both featuring Qualcomm’s new Snapdragon X2 processors. These devices are exclusively powered by the ARM-based Snapdragon X2 Plus and X2 Elite platforms, omitting Intel processor options for these consumer models. The hardware is designed to support Copilot Plus PC features, utilizing dedicated neural processing units to handle local artificial intelligence workloads. Source  ( 20 min )

The global server market is undergoing a significant shift as non-x86 systems now account for nearly 48 percent of total revenue. This growth is primarily driven by massive investments in AI infrastructure, particularly systems utilizing Nvidia chips with Arm cores. While x86 servers from Intel and AMD still lead in total revenue, their market share is declining as specialized architectures gain dominance. Source  ( 20 min )

Attackers deploying DragonForce ransomware have developed a sophisticated method to disguise malicious command-and-control traffic as legitimate Microsoft Teams activity. The intrusion involves a custom Go-based backdoor that allows attackers to maintain persistent access to compromised networks for extended periods. By routing communications through official Microsoft infrastructure, the malware evades detection from standard network monitoring tools. Source  ( 20 min )

Microsoft has launched the general availability of Copilot Cowork, a feature designed to execute complex multi-tool tasks within the enterprise ecosystem. While the tool initially relied on Anthropic models, users can now choose between various large language models, including OpenAI’s GPT 5.5 and DeepSeek. To provide a more economical alternative, Microsoft is also developing its own Azure-hosted model, Cowork 1, specifically designed to handle tasks at a lower cost. Source  ( 20 min )

Threat actors are increasingly using popular AI brands like ChatGPT, Claude, and DeepSeek as lures in sophisticated social engineering campaigns. These attacks utilize phishing, malvertising, and SEO manipulation to trick users into downloading malware or revealing sensitive financial information. While the themes are modern, the campaigns rely on established tactics such as urgency-driven messaging and multi-stage redirection to bypass security filters. Source  ( 20 min )

Turn your Exchange PowerShell scripts into structured, secure automation. Learn how to standardize workflows, delegate safely, and gain control at scale with 12 time Microsoft MVP Damian Scoles. Register now! Source  ( 17 min )

OpenRouter has introduced Fusion, a tool that synthesizes outputs from multiple AI models to achieve results superior to any single model. The system functions by dispatching a prompt to a panel of participant models in parallel and using a judge model to fuse their responses. This server-side pipeline identifies consensus points, unique insights, and contradictions to produce a final, grounded answer. Source  ( 20 min )

Microsoft recently addressed a maximum severity vulnerability in Copilot for Microsoft 365 identified as CVE-2026-42824. The flaw, dubbed SearchLeak, allowed attackers to exfiltrate sensitive data through a single-click exploit involving a specially crafted URL. This vulnerability highlights the ongoing difficulty AI models face in distinguishing between legitimate user instructions and malicious prompts embedded in third-party content. Source  ( 20 min )

The recent decision by the United States to place Anthropic’s Fable 5 AI model under export control highlights a growing risk of structural dependence for European organizations. While the immediate impact on cybersecurity operations is limited due to existing model restrictions and a lack of high-quality organizational data, the move serves as a geopolitical wake-up call. Relying on a single foreign provider for business-critical AI creates significant supply chain vulnerabilities and leaves entities susceptible to sudden access termination by foreign decrees. Source  ( 20 min )

The global landscape for artificial intelligence assistants is shifting as OpenAI's ChatGPT market share fell to 46.4% in early 2026. While ChatGPT still maintains over 1.1 billion monthly users, competitors like Google Gemini and Anthropic Claude are capturing significant portions of the market. This decline follows a period of dominance where the chatbot previously controlled over 80% of the sector just one year prior. Source  ( 20 min )

Apple has released a support document detailing new security mechanisms in macOS Tahoe 26.4 that monitor the Terminal command-line interface. The operating system now triggers a "Possible malware, Paste blocked" warning when users attempt to paste commands copied from external sources like websites or emails. This specific alert is designed to protect infrequent Terminal users from social engineering scams that trick people into executing harmful code. Source  ( 20 min )

Tensordyne has announced the "Napier" AI accelerator, a specialized chip designed to optimize the inference process for large-scale AI models. The hardware utilizes logarithmic mathematics to convert complex multiplications into simpler additions, significantly reducing the computational overhead required for model execution. This architectural approach allows for smaller processing units, creating space for integrated SRAM alongside 144 GB of high-bandwidth HBM3E memory. Source  ( 20 min )

Over 200 human rights organizations are calling for an immediate halt to the use of artificial intelligence in military kill chains. Groups like Amnesty International warn that algorithms are increasingly deciding life and death on the battlefield without human supervision. This movement highlights concerns that states and tech corporations are prioritizing profit and speed over ethical responsibility and international law. Source  ( 20 min )

SoftBank Group and OpenAI have announced a new joint security service designed to defend Japanese infrastructure against increasingly sophisticated cyberattacks. The initiative utilizes artificial intelligence to identify system vulnerabilities and automate the deployment of necessary security patches. This collaboration aims to address a national security crisis characterized by a rapid increase in the volume and complexity of digital threats. Source  ( 20 min )

Cloudflare has announced the general availability of its DMARC Management tool, providing a free solution for organizations to monitor and enforce email authentication. DMARC (Domain-based Message Authentication, Reporting and Conformance) is an email authentication protocol that lets domain owners specify in DNS how receiving mail servers should handle messages that fail SPF and DKIM checks, helping prevent spoofing and phishing. SPF (Sender Policy Framework) checks whether the sending server is allowed to send mail for the domain, and DKIM (DomainKeys Identified Mail) uses a cryptographic signature to verify that the email’s content and claimed sender domain are authentic. Source  ( 20 min )

AI governance is more than policy, it's a combination of frameworks, pillars and enforcement mechanisms that keep AI safe, compliant and accountable.  ( 8 min )

TL;DR: We created new Mythic extensions to simplify container-centric assessments, including Kubernetes and Docker-based ceded access workflows. These tools help operators wrap Mythic payloads in OCI-compatible containers and publish them to a self-hosted registry. Check the container_wrapper and container_registry on GitHub. Introduction There are quite a few command and control (C2) frameworks available for teams […] The post Mythic Embarking on the Open Seas: Containerized Payload Delivery for Kubernetes Assessments appeared first on SpecterOps.  ( 15 min )

TL;DR: Sulla is an open source SMB secret scanner for discovering credentials exposed in SMB shares across enterprise networks. It leverages our recently released Titus Go library, resulting in an easy-to-use, adaptable, and highly performant standalone binary. Every network penetration tester knows the struggle: reviewing network shares for sensitive material is a painful must-do. With […] The post Sharing is Caring: SMB Secret Scanning with Sulla appeared first on Praetorian.  ( 11 min )

A single unauthenticated request can kill SolarWinds Serv-U, and the heap corruption underneath it looked like it could be more. Bishop Fox chased three separate roads to remote code execution and hit a wall on every one. Here is what we found, why it matters, and how to detect exposure safely.  ( 9 min )

A single unauthenticated request can kill SolarWinds Serv-U, and the heap corruption underneath it looked like it could be more. Bishop Fox chased three separate roads to remote code execution and hit a wall on every one. Here is what we found, why it matters, and how to detect exposure safely.  ( 9 min )

New exposure management dashboard helps organizations align with CTEM to stay ahead in an era of AI exploiting vulnerabilities faster than ever  ( 57 min )

DNS over HTTPS (DoH) -- a protocol that encrypts DNS queries inside HTTPS connections -- is now generally available for the Windows Server DNS Server role. Starting with the June 9, 2026 cumulative update for Windows Server 2025, you can deploy DoH on your on-premises DNS infrastructure without a third-party resolver. This article explains what DoH does, how it differs from traditional DNS, what the configuration requires, and what limitations currently apply. Source  ( 29 min )

Azure introduced instant access support for incremental snapshots of Premium SSD v2 and Ultra Disk, enabling immediate disk restores without waiting for the background data copy to finish. By specifying the InstantAccessDurationMins parameter at snapshot creation time, snapshots enter the InstantAccess state immediately, allowing you to create and attach new disks right away with near-full performance. This article covers the requirements, configuration steps using the Azure CLI, PowerShell, and the portal, the available snapshot states, billing model, and key limitations. Source  ( 27 min )

Meta has established a new Applied AI unit to support its Superintelligence Labs, but the transition has triggered significant internal turmoil. More than 1,600 employees have signed a petition protesting a new program that monitors clicks and keystrokes on work computers to gather training data. This surveillance initiative aims to create autonomous agents that can eventually perform the bulk of the company's operational work. Source  ( 20 min )

Amazon Bedrock AgentCore provides a specialized infrastructure for AI agents to perform deep research tasks within isolated environments. By utilizing LangChain Deep Agents, a coordinator agent can delegate complex work to ephemeral subagents that run in dedicated MicroVMs. This architecture prevents the main context window from becoming cluttered with raw data, allowing the coordinator to focus on high-level reasoning and synthesis. Source  ( 20 min )

The Arch Linux security team has disabled new account registrations for the Arch User Repository (AUR) following a large-scale supply chain compromise. Attackers hijacked or created over 1,500 community-maintained packages to deliver malicious payloads, including information stealers and eBPF-based rootkits. While the community-driven AUR was heavily targeted, the official core repositories remained unaffected due to their more stringent review processes. Source  ( 20 min )

The Microsoft Azure Consumption Commitment (MACC) was designed during an era of abundant cloud capacity to provide discounts in exchange for revenue certainty. However, increasing demand for AI workloads has led to infrastructure shortages, causing quota backlogs and deployment struggles in flagship regions. This scarcity shifts significant risk onto customers, who may find themselves financially committed to spending targets even if Microsoft cannot provide the necessary hardware. Source  ( 20 min )

The United States federal government has reported a significant increase in the adoption of artificial intelligence to automate various administrative processes. A recent disclosure from the Office of Management and Budget reveals over 3,600 active or planned AI use cases across federal agencies. This represents a 70% growth in implementation compared to previous years, signaling a rapid shift toward machine-driven governance. Source  ( 20 min )

Apple is transitioning its desktop operating system to an ARM-only architecture with the upcoming release of macOS 27, codenamed Golden Gate. This update officially removes legacy Intel x86 code and APIs, meaning the software will run exclusively on machines powered by Apple Silicon. By shedding this technical ballast, the company aims to improve system consistency and overall execution speed across its hardware lineup. Source  ( 20 min )

Apple is positioning its artificial intelligence strategy as a tool for utility rather than a means to drive user engagement. Unlike many competitors that design chatbots to foster long-term dependence or emotional connections, Apple aims for its technology to assist and then disappear. This philosophy focuses on helping users accomplish specific tasks or learn about the world without encouraging addictive behaviors. Source  ( 20 min )

Microsoft is rolling out the July 2026 security update, identified as KB5095093, for Windows 11 versions 24H2 and 25H2. While the update includes various fixes and system stability improvements, many new features are being deployed via a gradual rollout. To bypass this staggered release, administrators can use the third-party ViVeTool utility with specific feature IDs to force-enable hidden functionality immediately. Source  ( 20 min )

Google DeepMind is actively moving beyond standard transformer architectures to address scaling costs and memory limitations in modern AI. By developing alternatives like the Griffin architecture and Recurrent Gemma, they utilize "index card" states that synthesize past information rather than carrying a full data cache. These innovations aim to improve long-context reasoning while reducing the computational overhead typically associated with quadratic sequence growth. Source  ( 20 min )

OpenAI has launched the OpenAI Partner Network to help organizations integrate frontier models into their existing workflows and systems. The program aims to bridge the gap between model capabilities and actual business value by leveraging an ecosystem of trusted consultants and technology providers. A significant investment of $150 million will support this initiative, which includes a goal to train 300,000 certified consultants by 2026. Source  ( 20 min )

Anthropic has dispatched senior technical staff to Washington, D.C., to resolve a regulatory dispute with the U.S. government. The conflict centers on the company's most advanced artificial intelligence models, known as Fable 5 and Mythos 5. These models were recently taken offline following a directive from the Department of Commerce regarding export restrictions. Source  ( 20 min )

Anthropic has abruptly disabled access to its most advanced AI models, Fable 5 and Mythos 5, for all users worldwide. This decision follows a directive from the U.S. Commerce Department that utilized national security export controls to prohibit foreign nationals from accessing these specific systems. The restrictions were reportedly triggered after researchers at Amazon identified a vulnerability within the software of the models. Source  ( 21 min )

The Trump administration has implemented new export controls that prohibit foreign nationals from accessing Anthropic’s most advanced artificial intelligence systems. In response to these directives, Anthropic recently took its powerful Fable 5 and Mythos 5 models offline to ensure regulatory compliance. This sudden restriction prevents international users and organizations from utilizing these specific high-performance LLMs. Source  ( 20 min )

Apple has released developer betas for iOS 27 and macOS 27, introducing a significant generative AI overhaul for the Siri virtual assistant. This update allows the assistant to perform complex tasks across multiple applications, such as drafting documents and locating specific photos based on natural language descriptions. The new system can also analyze on-screen content to provide context-aware assistance and search the web more effectively for information. Source  ( 20 min )

The Trump administration has halted foreign access to Anthropic’s most advanced AI models, Fable 5 and Mythos 5, following security warnings from Amazon. Amazon CEO Andy Jassy reportedly informed Treasury Secretary Scott Bessent that internal researchers successfully used the Fable 5 model to generate information for potential cyberattacks. This intervention led the U.S. government to implement immediate export controls, effectively forcing the models offline for all users globally. Source  ( 20 min )

The European Commission has introduced a digital sovereignty package aimed at reducing the continent's heavy reliance on American technology providers. This initiative follows concerns that US political shifts could lead to the weaponization of tech services, such as cloud computing and AI access. The centerpiece of this strategy is the Cloud and AI Development Act, which establishes a ranking system for providers handling public-sector data. Source  ( 20 min )

Anthropic has suspended access to its newest artificial intelligence models, Fable 5 and Mythos 5, following a directive from the United States government. The order bars foreign nationals and even the company's own non-U.S. employees from accessing these high-end systems. This historic move underscores a shift toward stricter export controls on advanced technology to maintain national security and competitive advantages. Source  ( 20 min )

The Trump administration has issued an unprecedented order requiring Anthropic to suspend access to its most advanced artificial intelligence models for all foreign nationals. This directive affects the Mythos 5 and Fable 5 models, which are sophisticated large language models used for complex data processing and automation. The restriction applies to individuals both inside and outside the United States, citing significant national security concerns regarding the technology. Source  ( 20 min )

By Luca Ginex Overview This blog post discusses a use-after-free vulnerability that we found in VirtualBox in 2025. This vulnerability was patched on Oracle Critical Patch Update – January 2026. The vulnerability was also presented, along with others, at OffensiveCon 2026. This post describes the exploitation process for the vulnerability on a Linux system. First, a ... Read more Zombie COTables: Resurrecting Freed Memory to Escape VirtualBox The post Zombie COTables: Resurrecting Freed Memory to Escape VirtualBox appeared first on Exodus Intelligence.  ( 19 min )

How iOS 27 trims the dyld shared cache and updates stub island trampolines  ( 7 min )

The US government has issued an export control directive forcing Anthropic to suspend all access to its Fable 5 and Mythos 5 AI models. Citing national security authorities, the order prohibits access by any foreign national, including Anthropic’s own international employees. Because the company cannot selectively restrict access based on nationality, it has abruptly disabled these models for all customers worldwide to ensure legal compliance. Source  ( 20 min )

The US government has issued a national security directive forcing Anthropic to suspend access to its most advanced AI models, Mythos 5 and Fable 5, for all foreign nationals. This ban applies to non-US citizens both domestically and abroad, including Anthropic's own international employees and green card holders. Consequently, the company abruptly disabled these models for all customers to remain compliant, causing significant disruption to organizations reliant on their API. Source  ( 20 min )

Microsoft has released Windows 11 build 29610 to the Experimental channel, targeting future hardware platforms rather than existing installations. This specific version, identified as 26H1, is designed exclusively for upcoming ARM64 devices powered by Snapdragon X processors. Standard systems running Intel or AMD hardware will not receive this update through traditional Windows Update channels. Source  ( 20 min )

Microsoft has released a series of dynamic updates alongside the June 2026 Patch Tuesday cycle to improve system recovery and setup processes. These packages are designed to be integrated into existing Windows images before deployment to ensure a smoother installation experience. They specifically help maintain Language Packs and Features on Demand, such as VBScript, during the operating system upgrade process. Source  ( 20 min )

The Windows 11 KB5094126 cumulative update is causing significant stability issues, including boot failures and Black Screens of Death on various hardware models. Affected devices, particularly from HP and Dell, may trigger BitLocker recovery loops or fail to boot due to insufficient space in the EFI partition. These failures appear linked to a mismatch between the update's Secure Boot certificate changes and specific BIOS configurations or bloated system partitions. Source  ( 20 min )

Microsoft is updating its identity security framework to address the unique risks posed by autonomous AI agents. Traditional multi-factor authentication is insufficient for these entities because they operate at speeds and scales that bypass human-centric security measures. Consequently, the identity playbook is shifting toward a unified risk model that integrates signals from identity, endpoints, and data layers. Source  ( 20 min )

Visa has announced a strategic partnership with OpenAI to integrate its global payment network directly into the ChatGPT ecosystem. This collaboration allows AI agents to move beyond simple product recommendations by autonomously finalizing purchases on behalf of users. The initiative represents a significant shift toward agentic commerce, where software models handle the entire transaction process from selection to shipping. Source  ( 21 min )

A Ukrainian defense industry official revealed that fully autonomous drones killed Russian soldiers during a specialized battlefield test. The engagement involved ten quadcopters programmed to fly to the front lines before activating a "Terminator mode" to seek and destroy targets independently. This event marks a significant shift in warfare, as the drones operated without any human oversight or active data link during the attack phase. Source  ( 20 min )

The ASCILINE Engine is a new open-source tool designed to render high-performance, real-time video streams using pure ASCII characters. By mapping pixels to text-based representations, the software can output 360p video at 30 frames per second within a web browser. The developer claims this method creates a video stream that is difficult to block because it bypasses traditional media filters. Source  ( 20 min )

Microsoft and several universities have developed SkillOpt, a method that improves AI agent performance by treating instruction documents like trainable model weights. Instead of manually writing prompts, a separate optimizer model analyzes agent logs to propose edits to a Markdown-based "skill" file. These changes are only accepted if they measurably improve performance on a validation set, ensuring the instructions actually lead to better outcomes. Source  ( 20 min )

Google Research has introduced Gemini-SQL2, a specialized system designed to translate natural language instructions into executable SQL queries. Built upon the Gemini 1.5 Pro architecture, the model addresses the complex challenge of mapping human language to intricate database structures. This development aims to bridge the gap between non-technical users and structured data stored in relational databases. Source  ( 20 min )

Nvidia has significantly increased the official price of its flagship RTX Pro 6000 Blackwell workstation graphics card to $13,250. This adjustment represents a 55% surge compared to the original launch price of $8,565 established just one year ago. The price hike affects the standard Workstation Edition and the power-efficient Max-Q variant, both of which are designed for professional visualization and compute tasks. Source  ( 20 min )

A threat group known as Velvet Ant successfully maintained a presence within a large organization's isolated network for ten years by hijacking the authentication stack. The intrusion began in 2016 when the actors compromised internet-facing systems before pivoting into an air-gapped environment with no direct external connection. By establishing a remote execution path through chained Nginx and FastCGI modifications, the attackers bypassed traditional network segregation without requiring direct internet access. Source  ( 20 min )

AMD has released the Ryzen AI Halo Developer Platform, a compact workstation designed for running large language models locally. This $3,999 mini PC competes directly with Nvidia's DGX Spark by offering a more affordable price point and broader software compatibility. Unlike its primary competitor, which is restricted to Linux, AMD’s system supports Windows 11 Pro to provide greater flexibility for various development environments. Source  ( 20 min )

The "Last 30 Days" skill provides a specialized search engine that prioritizes human-voted content from platforms like Reddit, Hacker News, and GitHub over traditional algorithms. By analyzing upvotes and engagement metrics, it synthesizes trending information into concise briefs or sharable HTML pages. This tool integrates directly into agentic engineering platforms, allowing users to query recent developments using simple slash commands. Source  ( 20 min )

A coalition of U.S. state attorneys general has launched a broad investigation into OpenAI regarding its business practices and data handling. The ChatGPT creator received a subpoena on Friday requesting documents related to user engagement, advertising, and the management of sensitive consumer and health data. This legal inquiry also examines the company's impact on vulnerable populations, including minors and senior citizens, as well as its internal safety policies. Source  ( 20 min )

Organization administrators can now manage GitHub Copilot code review settings at scale through new runner type configurations. These controls allow for the enforcement of specific self-hosted or large runners across all repositories within an organization. By locking these settings, administrators ensure that organizational defaults override individual repository configurations for consistent performance and security. Source  ( 20 min )

The secure agent framework NanoClaw has integrated with JFrog's supply chain platform to improve the safety of automated resource fetching. AI agents often improve their own capabilities by downloading external tools and libraries, which introduces significant risks from malicious code. By utilizing JFrog's vetted registries, NanoClaw ensures that agents only access reviewed packages rather than untrusted public repositories. Source  ( 20 min )

The United States government has issued an emergency export control directive forcing Anthropic to immediately disable its most advanced AI models, Claude Fable 5 and Claude Mythos 5. This mandate, delivered late Friday afternoon, requires the company to terminate access for all users globally to address national security concerns. While the order was nominally aimed at foreign nationals, Anthropic stated that a total shutdown was necessary to ensure full compliance with the directive. Source  ( 21 min )

Microsoft has detailed several upcoming features for the new Outlook for Windows and web to bridge the gap with the classic version. A primary addition is the "All accounts view," also known as a unified inbox, which allows users to manage multiple personal and professional accounts in a single interface. This view will support bulk actions like archiving or deleting across all mailboxes and will eventually integrate with Copilot for cross-account searching. Source  ( 20 min )

Microsoft is testing a new "Fix an issue" feature in the Canary build of the Edge browser. This undocumented addition appears in the Settings sidebar and links to a dedicated internal diagnostic page. While the interface is currently a placeholder, it signals a shift toward automated browser maintenance. Source  ( 20 min )

Moonshot AI has launched Kimi K2.7 Code, a massive open-weights model specifically designed for programming tasks. This new model features one trillion parameters and utilizes a Mixture-of-Experts architecture to optimize performance. It is currently available for developers looking for high-capacity alternatives to proprietary coding assistants. Source  ( 20 min )

Microsoft is rolling out Windows 11 KB5095093 for versions 24H2 and 25H2, introducing a new recovery feature called Point-in-time Restore. This capability allows users to return a system to a previous working state by capturing snapshots of applications, settings, and personal files to minimize downtime during instability. Additionally, the update implements a "Low Latency Profile" designed to accelerate app launches and core shell experiences like the Start menu and Search through short CPU bursts. Source  ( 20 min )

Microsoft has announced the general availability of Foundry IQ knowledge bases, a platform designed to simplify how AI agents access enterprise data. The service provides a unified layer for grounding agents in internal information from sources like SharePoint, Azure SQL, and OneLake without requiring custom connectors. By using the Model Context Protocol (MCP), these knowledge bases can integrate with various agent frameworks, including ChatGPT and Claude. Source  ( 20 min )

Anthropic has released Claude Fable 5, a new frontier model designed to handle complex, multi-stage autonomous tasks and long-running workflows. The model is now integrated into Microsoft Foundry, GitHub Copilot, and the Foundry Agent Service to support enterprise-level software development and research. It features enhanced vision capabilities for interpreting structured data in documents like PDFs, diagrams, and dense financial tables. Source  ( 20 min )

Microsoft has released new Windows 11 builds for the Release Preview channel, introducing a point-in-time restore feature that allows for quick rollbacks of settings and files. Administrators can now manage camera access more granularly through new Group Policy settings that configure Multi-App Camera and Basic Camera modes. The updates also include a revised Windows Update experience that allows users to pause updates for up to 35 days by selecting a specific end date on a calendar. Source  ( 20 min )

Microsoft Scout is Microsoft's first "Autopilot" agent, a new type of AI agent that runs continuously in the background, executes tasks autonomously, and operates under its own governed Entra identity. As of June 2026, Scout is available in experimental preview exclusively for organizations enrolled in the Microsoft Frontier program. Source  ( 28 min )

OpenAI has introduced a new feature for its Codex coding agent that allows users to manually trigger rate-limit resets. This update enables developers to bank unused resets and apply them immediately when hitting usage caps during active sessions. Users across various tiers, including Plus, Pro, and Business plans, receive an initial free reset to manage their workflow more flexibly. Source  ( 20 min )

Microsoft is testing a new unified update experience designed to minimize the frequency of system restarts for users. The initiative coordinates the delivery of drivers, .NET framework components, and firmware updates to align with monthly quality updates. This synchronization allows the operating system to consolidate multiple installation requirements into a single monthly reboot. Source  ( 20 min )

Microsoft has released Windows 11 Insider Preview build 26220.8680 to the Beta channel, introducing several accessibility and performance enhancements. A new Screen tint feature allows users to apply a color overlay to reduce display intensity and eye strain during daytime use. Additionally, the Magnifier tool now supports precise zoom entry and preset increments to improve navigation for users with visual impairments. Source  ( 20 min )

Microsoft is introducing a new feature for Microsoft Places and Teams that automatically updates a user's work location when they connect to a corporate Wi-Fi network. This workplace check-in capability aims to simplify in-person coordination by reducing the need for employees to manually adjust their status. The system builds upon existing presence signals like calendar availability and peripheral-based check-ins to provide real-time visibility of office attendance. Source  ( 20 min )

Microsoft Entra has introduced a soft-delete feature for device objects in public preview, allowing administrators to recover accidentally deleted Entra joined or registered devices within a set retention period. This safety mechanism preserves critical identity data and security artifacts, reducing the operational risk of permanent data loss. Additionally, Entra Connect Sync now officially supports Windows Server 2025, though Microsoft is encouraging a transition toward the cloud-native Entra Cloud Sync for simplified hybrid identity management. Source  ( 20 min )

A security researcher discovered a critical vulnerability in AMD's auto-updater software that allowed for remote code execution via man-in-the-middle attacks. The flaw stemmed from the application using unencrypted HTTP connections rather than HTTPS to fetch updates. Although the researcher reported the issue through official channels, AMD denied a $10,000 bounty payout by citing policy exclusions for this specific attack vector. Source  ( 20 min )

The Hades malware campaign has introduced a novel evasion technique that uses prompt injection to trick AI-based security scanners. Malicious JavaScript files now include code comments that instruct AI bots to generate instructions for creating biological and nuclear weapons. These prompts are designed to trigger the AI's safety failsafes, causing the scanner to halt the process before it reaches the actual malicious payload. Source  ( 20 min )

Check Point has addressed a critical authentication bypass vulnerability, tracked as CVE-2026-50751, affecting its Remote Access and Mobile Access VPN components. The flaw stems from a logic oversight in how the system validates certificates during the authentication process for IKEv1-based connections. This weakness allows unauthenticated attackers to establish a VPN connection without providing a valid user password. Source  ( 20 min )

Researchers have identified a new attack class called agentjacking that tricks AI coding assistants into executing malicious code on developer workstations. The technique exploits an architectural flaw in how AI agents ingest data from Sentry, a popular platform used for tracking application errors and performance. By injecting crafted markdown into Sentry error events, attackers can deceive agents like Claude Code and Cursor into treating malicious instructions as legitimate diagnostic steps. Source  ( 20 min )

A firmware vulnerability in Microsoft Surface devices allowed the hardware to be permanently bricked by a single malformed packet. The flaw was discovered when Microsoft Copilot accidentally generated a Python script that overwrote the embedded controller firmware while attempting to adjust backlight settings. This issue occurs because the system management controller lacks a defense against arbitrary write values and interleaves read and write commands. Source  ( 20 min )

Microsoft has released its June 2026 Patch Tuesday updates, addressing a record-breaking total of nearly 200 security vulnerabilities. This massive release includes fixes for approximately three dozen critical bugs and addresses three weaknesses that already have public exploit code available. Beyond security patches, the update permanently resolves a long-standing issue where the Windows Update Standalone Installer failed when running from network shares. Source  ( 20 min )

Microsoft has restricted its employees from using Anthropic’s new Claude Fable 5 model due to concerns regarding data retention and privacy. While the model remains available to external customers via GitHub Copilot and Foundry, internal access has been removed from the company's model selection tools. This decision follows a change in Anthropic's policy that allows the retention of user prompts and outputs for up to 30 days. Source  ( 20 min )

Apple has introduced the next generation of Apple Intelligence, featuring a revamped architecture that integrates foundation models co-developed with Google. This update powers a significantly more capable version of Siri, now referred to as Siri AI, which can perform actions across various apps and search for information within personal context like emails and messages. The system is designed to run primarily on-device, utilizing Private Cloud Compute for more complex tasks to ensure user data is never stored or accessible to Apple. Source  ( 20 min )

Homebrew 6.0.0 introduces a new tap trust security mechanism that requires explicit user approval before running code from third-party repositories. This update significantly reduces the risk of executing malicious Ruby scripts by flagging untrusted sources before their code is evaluated. Additionally, the release brings Linux sandboxing via Bubblewrap to align with macOS security standards, isolating build and test phases from the rest of the system. Source  ( 20 min )

A hardware teardown by iFixit has revealed that the Trump Mobile T1 smartphone is almost identical to the HTC U24 Pro. Internal components including the Snapdragon 7 Gen 3 processor, 12 GB of RAM, and 512 GB of storage match the HTC model exactly. Comparative CT scans and physical disassembly confirmed that the mainboards are interchangeable between the two devices. Source  ( 20 min )

Apple has announced that the next generation of Apple Intelligence features in iOS 27 will include daily usage limits for specific tools. These restrictions primarily target features that require significant processing power from server-based models, such as advanced image generation. Users with free accounts will face stricter caps on these services compared to those with paid subscriptions. Source  ( 20 min )

Generative AI is fundamentally altering the economics of software development by reducing the time and cost required to create custom applications. Tools like AI coding assistants now account for a significant portion of committed code, allowing teams to address niche business needs that were previously too expensive to automate. This shift encourages organizations to reconsider building internal tools rather than purchasing third-party software that may be difficult to integrate. Source  ( 20 min )

Amazon Aurora PostgreSQL-Compatible Edition now supports major version 18, beginning with version 18.3. This update introduces B-tree skip scans to enhance query performance while simultaneously reducing index storage and maintenance overhead. The release is currently available across all commercial AWS Regions and AWS GovCloud locations. Source  ( 20 min )

Three posts? In three days? Are we insane? We're home alone, there's no one to stop us, and we're up past bedtime. So, we need to talk about Splunk. On June 10th, Splunk published this CVE-2026-20253 advisory: It has everything that we  ( 12 min )

It is yet another day in this parallel universe of security, where the devices we bolt onto the edge of our networks to keep the bad people out are, with remarkable consistency, the exact thing that let the bad people in. While we’ve seemingly had a breather from

New Jamf research finds AI governance gaps widen as organizations deepen their AI integration.  ( 6 min )

The JNUC 2026 session catalog is live — browse sessions, plan your agenda and register before Just in Time pricing ends July 1.  ( 4 min )

Somewhere in your organization, an engineer is running Claude Code. A few desks over, someone in finance is drafting in Claude Desktop. The decision to adopt AI has, in practice, already been made by the business and by people quietly getting more done with it.  ( 8 min )

TL;DR  Not your usual cybersecurity event  Our PTP Cyber Fest returned this year as part of a busy week for the cybersecurity community in London.  The cyber community came together over two days at The Fox, located next to Infosecurity Europe at ExCeL London.  Some came for the talks. Some came for the demos. Some came […] The post PTP Cyber Fest 2026. Built for people to get involved  appeared first on Pen Test Partners.  ( 8 min )

The White House Memorandum puts in place an “adaptive framework,” where agencies make risk-based, prioritized logging decisions.  ( 60 min )

What happens when the bits of an RSA private key are heavily biased toward 0 instead of being randomly generated? The public key’s bits could be biased enough for us to detect these incorrectly generated keys in the wild. Together with Hanno Böck of the badkeys project, we found hundreds of unique keys that not only have this property, but can be quickly factored. We also found the bug that led to many of these keys and analyzed historical data to track the issue over time. Surprisingly, the pattern of 0 bits is often highly structured, allowing us to develop a powerful polynomial-based cryptanalytic technique that exploits the pattern. Figure 1: Two patterns of RSA moduli with repeated blocks of 0 bits seen in real-world examples. These “short-sleeve” keys, named for how the 0 bits don…  ( 9 min )

Your guide to operationalizing AI-powered code analysis with Wiz to stay ahead of AI driven development and adversaries  ( 62 min )

Windows Ready Print is Microsoft's new name for the Modern Print Platform, a printing architecture that replaces legacy third-party printer drivers with a standardized, driverless approach based on IPP (Internet Printing Protocol — an open network standard for sending print jobs to printers over a network). Starting in July 2026, Windows 11 will default to Windows Ready Print for new printer installations. This article explains what this means for your environment, how to control the driver selection behavior, and when the stricter Windows Protected Print Mode applies. Source  ( 28 min )

Apple has released version 1.0 of its Container project, introducing a feature called container machines that provides a persistent Linux environment on macOS. This technology utilizes Apple's native virtualization framework to run lightweight virtual machines based on Open Container Initiative standards. The tool aims to bridge the gap between macOS development and Linux deployment targets by offering a native alternative to third-party solutions. Source  ( 20 min )

A new security vulnerability known as GreatXML allows attackers to bypass BitLocker drive encryption by manipulating files within the Windows recovery partition. The exploit involves placing specific XML files, including an unattended setup file and a recovery configuration file, into the root of the recovery partition. Systems that have previously initiated a Microsoft Defender offline scan are reportedly vulnerable to this attack by default. Source  ( 20 min )

Researchers have identified critical security flaws in OpenClaw, a self-hosted AI agent, that allow attackers to execute arbitrary code or steal sensitive data. One vulnerability involves "agentjacking," where malicious instructions are hidden within shared contacts, vCards, or location pins that the agent processes without user intervention. Because these message objects lack proper boundary markers, the underlying large language model cannot distinguish between legitimate metadata and injected commands. Source  ( 20 min )

Anthropic is positioning itself as a safety-conscious competitor in the AI landscape, led by former OpenAI executives Dario and Daniela Amodei. The company utilizes its own model, Claude, to accelerate its product development cycle and release new features at a rapid pace. Central to their strategy is "Constitutional AI," a training method that embeds human-centric values and founding documents into the model's decision-making process to ensure professional and harmless interactions. Source  ( 20 min )

Microsoft Intune has introduced several security enhancements, including a recovery lock for macOS that prevents users from reinstalling the OS or bypassing remote management. Android Enterprise devices now support a strict tunnel mode for Microsoft Tunnel, which blocks all network traffic if the VPN connection drops. Additionally, administrators can now manage Apple Intelligence settings via declarative device management (DDM) and silence apps on the Android Managed Home Screen to prevent session PIN bypass. Source  ( 20 min )

Meta has implemented a strict data firewall to isolate its internal infrastructure from Manus, an agentic AI service it acquired for $2 billion. This operational separation follows a mandate from Beijing authorities to unwind the acquisition of the Chinese-founded startup. As of June 2026, Meta has officially terminated all data-sharing agreements and technical integrations between the two entities. Source  ( 20 min )

Microsoft has released critical security updates to address CVE-2026-42897, a cross-site scripting vulnerability in Exchange Server that is currently being exploited. The flaw affects Exchange Server 2016, 2019, and the Subscription Edition when users access their mail via Outlook Web Access. Attackers can trigger the vulnerability by sending a specially crafted email that executes arbitrary JavaScript code within the victim's browser context. Source  ( 20 min )

Microsoft has released an updated public preview build for the Windows Admin Center Virtualization Mode, designated as version 2.7.1.8. This update addresses several critical installation bugs, including a fix for an error that prevented deployment on non-English operating systems. Users who previously encountered access denied errors when connecting to the gateway should find these permissions issues resolved in the latest release. Source  ( 20 min )

Stack Overflow has introduced "Stack Overflow for Agents," a new platform designed specifically for AI agents to share and validate technical knowledge. The service aims to create a "verification loop" where agents post "Today I Learned" (TIL) entries and other agents validate them to build a canonical knowledge base. Each agent is tied to a human operator’s account, and the system uses a reputation score to track the reliability of an agent's contributions. Source  ( 20 min )

OpenAI has officially announced its support for the European Commission’s Code of Practice on Transparency of AI-Generated Content. This initiative aligns with the EU AI Act to establish a more transparent digital environment for users and organizations. The commitment focuses on ensuring that content generated by artificial intelligence can be easily identified and verified. Source  ( 20 min )

Anthropic has retracted a controversial policy that would have covertly reduced the performance of its Claude Fable 5 model for certain users. The company initially intended to implement "secret safeguards" that would silently degrade the model's capabilities if it suspected it was being used to develop competing AI systems. This approach was designed to enforce terms of service that prohibit using Claude to train other large language models. Source  ( 20 min )

OpenAI is evaluating substantial price reductions for its AI tokens to maintain a competitive edge against its rival Anthropic. Tokens serve as the fundamental unit of measurement for billing, representing the segments of text processed by large language models. This potential pricing shift follows the recent release of Claude Fable 5 and the viral success of Anthropic’s coding tools. Source  ( 20 min )

Stack Overflow has launched a new platform specifically designed to facilitate knowledge sharing between autonomous AI coding agents. This initiative addresses the "Ephemeral Intelligence Gap," where agents frequently rediscover the same solutions or hallucinate obsolete code in isolation. By providing a machine-readable API, the service allows agents to access real-time, peer-validated technical data instead of relying solely on static training sets. Source  ( 20 min )

The Linux Foundation has introduced the OpenSharing Project, a vendor-neutral protocol designed for the secure exchange of AI assets and data between different organizations. Contributed by Databricks, this initiative builds upon the existing Delta Sharing protocol to include agentic AI, AI models, and unstructured data. It provides a unified framework that allows for the sharing of AI skills and models across diverse platforms without relying on proprietary marketplaces. Source  ( 20 min )

Microsoft has released cumulative updates to resolve a persistent bug that forced Windows Server 2025 and Windows 11 systems into BitLocker recovery mode. The issue was triggered by specific Group Policy configurations involving Trusted Platform Module validation profiles and the inclusion of PCR7 in the validation process. Affected systems would prompt for a recovery key immediately following the installation of security updates that modified boot files. Source  ( 20 min )

Anthropic has retracted a controversial policy that would have invisibly degraded the performance of its Claude Fable 5 model for competitors. The company initially implemented these hidden guardrails to prevent rival researchers from using the model to develop competing frontier artificial intelligence systems. Following intense criticism from the research community, the company apologized for the move and promised to make any future safeguards transparent to users. Source  ( 20 min )

Anthropic CEO Dario Amodei has implemented a highly unusual organizational structure where only his chief of staff reports to him directly. This management style contrasts sharply with other industry leaders, such as Nvidia’s Jensen Huang, who maintains dozens of direct reports. The arrangement is designed to insulate the chief executive from the time-consuming personnel issues that typically dominate a leader's schedule. Source  ( 20 min )

Amazon Bedrock has expanded its model lineup by making OpenAI's GPT-5.4 and GPT-5.5 available in the US East (N. Virginia) region. These generative AI models are designed to handle complex reasoning, advanced coding, and automated software operations. Administrators can now leverage these tools within the AWS ecosystem to build applications that interact with various software environments. Source  ( 20 min )

Amazon OpenSearch Service now supports Model Context Protocol (MCP) Apps to integrate observability workflows directly into agentic IDEs like VS Code and Claude Desktop. This feature allows local AI agents to investigate system incidents by accessing logs, traces, metrics, and alerts stored in OpenSearch domains. The integration bridges the gap between cloud-based telemetry data and the local development environments used by engineers. Source  ( 20 min )

On June 2, the White House signed a new executive order (EO), “Promoting Advanced Artificial Intelligence Innovation and Security.” While most coverage has focused on the voluntary framework for frontier model access, there’s language around defensive cybersecurity that also deserves attention from security leaders.The order directs CISA to establish or expand federal programs and cybersecurity […] The post What the New AI Executive Order Means for Federal Security Testing appeared first on Synack.  ( 13 min )

TL;DR: This post covers how I used OpenAI’s Codex to automate the generation, testing, and refinement of indirect prompt injection payloads against an agentic system using Sonnet 4.5 and 4.6 models on Amazon Bedrock. Introduction This project began as a relatively straightforward effort. I wanted to build a basic AI chatbot, evaluate it against AI-specific […] The post Building an Indirect Prompt Injection Workflow appeared first on SpecterOps.  ( 26 min )

We offer a practical roadmap for evolving informal, ad hoc threat hunting practices into a mature, scalable program  ( 31 min )

Decades of piling complexity onto non-standardized stacks have left security unsteerable. Juan Andrés Guerrero-Saade makes the case for a new approach.  ( 24 min )

Decades of piling complexity onto non-standardized stacks have left security unsteerable. Juan Andrés Guerrero-Saade makes the case for a new approach.  ( 24 min )

PCI DSS v4.0.1 made internal penetration testing more complex, bringing cloud infrastructure, SaaS apps, and build pipelines explicitly into scope. Derek Rush breaks down how to scope a compliant IPT, what to test, and what a QSA-ready deliverable actually looks like in practice.  ( 10 min )

Mastercard has introduced Agent Pay, a credentialed multi-rail service designed to facilitate secure on-chain payments for autonomous agents and machines. This ecosystem utilizes smart contracts to permission and control spending limits for authorized participants while guaranteeing settlement across various currencies and blockchain rails. The initiative includes partnerships with several major industry players, including Ripple, Solana, Coinbase, and Polygon, to expand the reach of these programmable payment services. Source  ( 20 min )

Microsoft has introduced two new authentication features, IAKerb and LocalKDC, entering public preview in June 2026 for Windows Insiders in the Canary Channel. Both features extend Kerberos authentication to scenarios that have historically forced a fallback to NTLM (NT LAN Manager), a legacy protocol that Microsoft plans to disable by default in a future Windows release. This article explains what IAKerb and LocalKDC do, how they work, and how you can begin testing them today. Source  ( 28 min )

Microsoft has identified a bug preventing some Windows 11 24H2 and 25H2 systems from installing monthly cumulative updates. The issue primarily impacts devices that were upgraded from Windows 10 or earlier versions of Windows 11, resulting in recurring update failures. Affected systems display error codes 0x80073712 or 0x800f0993, which indicate component store corruption or missing hydration candidates in the update logs. Source  ( 20 min )

Microsoft has released OneDrive version 26.098 for macOS, introducing a native sync engine that replaces the previous architecture. This update addresses long-standing reliability and performance issues caused by a hidden cache folder implemented in 2022. The new client integrates more deeply with the operating system to provide a more stable user experience. Source  ( 20 min )

Microsoft has implemented significant backend changes to Teams to reduce latency when switching between chat conversations. The company identified that sequential data queries and poor response prioritization were the primary causes of slow loading times for older chats. By bundling queries and firing them earlier in the process, the software now achieves nearly identical speeds for both recent and older conversation switches. Source  ( 20 min )

Microsoft released a security update in June 2026 to address a critical zero-day vulnerability in BitLocker tracked as CVE-2026-50507. This flaw allowed unauthorized individuals to bypass full-disk encryption and access protected data using a simple USB key. The vulnerability specifically exploited a lack of trust between the Windows Recovery Environment and the BitLocker security feature. Source  ( 20 min )

Anthropic has introduced Claude Managed Agents, a suite of APIs designed to handle the infrastructure required for deploying production-grade AI agents. This service automates complex backend tasks such as session management, secure code execution, and scaling, which previously required significant manual development. By decoupling the reasoning engine from the execution environment, the platform allows agents to start processing tasks while sandboxed containers spin up in the background. Source  ( 20 min )

Recent graduation ceremonies highlighted significant student anxiety regarding the impact of artificial intelligence on future employment and the dignity of work. While younger generations are the fastest adopters of generative AI, many express a desire to ensure human agency remains central to technological advancement. This pushback serves as a reminder that technological diffusion is often limited by the speed of human and organizational change rather than the technology itself. Source  ( 20 min )

Google's AI platform Gemini is currently experiencing significant connectivity issues that prevent the smartphone application from responding to user commands. Reports of the outage began surfacing early on June 10, 2026, with users documenting the problems on social media platforms and outage tracking sites. While the mobile application is largely non-functional, the browser-based version of the chatbot remains operational for those requiring immediate access. Source  ( 20 min )

A regional court in Munich has issued a landmark ruling declaring Google directly liable for the content generated by its AI search overviews. The court determined that these summaries are not merely search results but represent Google's own substantive statements and independent content. This distinction removes the legal protections typically granted to search engines that only point to third-party websites. Source  ( 20 min )

Microsoft has implemented significant performance optimizations for Teams, focusing on reducing latency and improving application stability across desktop and mobile platforms. A primary achievement is a 20% reduction in chat switch latency, specifically targeting "cold switches" where conversation data is not yet cached in memory. Engineers achieved this by triggering data queries immediately upon a user's click and consolidating multiple sequential requests into a single broad query to eliminate data waterfalls. Source  ( 20 min )

Google has introduced DiffusionGemma, an experimental open model featuring 26 billion parameters designed for efficient text generation. Unlike traditional autoregressive models that predict one token at a time, this model utilizes a diffusion-based approach to process information. This architectural shift aims to significantly increase the speed of generating long-form content while maintaining high output quality. Source  ( 20 min )

Anthropic recently patched a security vulnerability in Claude Code, a command-line AI coding assistant used by developers to automate software tasks. Researchers discovered that the tool's GitHub Action could be manipulated through indirect prompt injection, where malicious instructions are hidden in pull requests or issues. This flaw allowed attackers to bypass security boundaries and exfiltrate sensitive data, such as API keys and environment variables, from CI/CD workflows. Source  ( 20 min )

SpaceX aims to advance human civilization on the Kardashev scale by deploying massive AI data centers into Earth's orbit. These orbital platforms will utilize specialized satellites, currently dubbed "AI1," designed to house high-performance compute racks equivalent to modern NVIDIA hardware. By moving data centers to space, the project leverages vacuum radiation for cooling and bypasses terrestrial land and power constraints. Source  ( 20 min )

Microsoft has launched a public preview of pre-upgrade validation checks for Azure Database for PostgreSQL flexible servers. This managed service automates database maintenance, but major version upgrades often face risks from hidden compatibility issues. The new feature allows for proactive identification of potential blockers before the actual migration process begins. Source  ( 20 min )

The Cybersecurity and Infrastructure Security Agency has expanded its Known Exploited Vulnerabilities catalog to include three new security flaws. These vulnerabilities affect Cisco Catalyst SD-WAN Manager, Google Chrome's V8 engine, and Arista Extensible Operating System. Federal agencies must implement remediations or mitigations by June 23, 2026, to protect their environments from active threats. Source  ( 20 min )

Fortinet, Ivanti, and SAP have issued urgent security updates to address several critical vulnerabilities that could lead to remote code execution and unauthorized data access. Fortinet's patch targets a command injection flaw in its FortiSandbox products that allows unauthenticated attackers to execute commands via malicious HTTP requests. This vulnerability, tracked as CVE-2026-25089, affects multiple versions of the sandbox environment used for detecting advanced threats. Source  ( 20 min )

Amazon Web Services has released the M9g and M9gd Elastic Compute Cloud instances, marking the debut of the custom Graviton5 processor. This next-generation chip features 192 cores and is specifically engineered to handle the high demands of autonomous AI agents and real-time reasoning. The hardware represents a significant architectural shift by supporting DDR5 memory and PCIe for the first time in the Graviton family. Source  ( 20 min )

AMD has released preliminary performance estimates for its upcoming EPYC Venice processors, which utilize the new Zen 6 architecture. The flagship model features 256 cores and is designed to compete directly with Nvidia's Vera CPU in high-density data center environments. These initial benchmarks focus on rack-scale performance within a fixed 100kW power budget rather than individual socket metrics. Source  ( 20 min )

The JDY botnet has expanded to over 1,500 compromised devices to conduct large-scale reconnaissance and service fingerprinting. This network primarily targets small office and home office routers, firewalls, and IoT devices from various manufacturers. It functions as a high-performance scanner that maps exposed services to identify vulnerable infrastructure for state-sponsored hacking groups. Source  ( 20 min )

Every year, WWDC provides a glimpse into the future of Apple’s platforms. While individual announcements often focus on new features, the bigger story is usually found in the direction Apple is taking its ecosystem. This year, that direction is particularly relevant for education.  ( 7 min )

The curl project, one of the most important pieces of software on the internet, just shut down its bug bounty program. Not because the project is less important. Not because the community gave up. But because 95% of the vulnerability reports it received were not valid. About a fifth were outright AI-generated noise. Only around […] The post Nobody’s in the Cockpit: The Real Risk of Fully Autonomous AI Security Testing appeared first on Synack.  ( 14 min )

TL;DR: New native AI features in Microsoft SQL Server 2025 provide a practical channel for data exfiltration and C2 transport within the database engine itself. Note: All proof-of-concepts contained in this blog can be found in the following repo: https://github.com/gershsec/mssql2025-poc Foreword I’m a big fan of leveraging Microsoft SQL Server during offensive engagements because it’s […] The post Oops, I Weaponized the Database: Abusing AI Features in SQL Server 2025 appeared first on SpecterOps.  ( 22 min )

You may have read about our new GhostWorks initiative here at SpecterOps. As part of this effort, we continually trial different methods of evaluating and improving model performance to help understand what techniques can be applied to our research. This post follows one such attempt to find methods which can have a measurable improvement to […] The post Prompt Engineering for Security Agents: A Measurable Approach with GEPA appeared first on SpecterOps.  ( 27 min )

GhostWorks is an AI-focused engineering and research initiative at SpecterOps, focused on the disciplined exploration of frontier AI-enabled cybersecurity tooling. It is not a company-wide AI mandate, a replacement for product teams, or a promise that every workflow needs an agent. It exists to continue exploration of frontier AI-enabled tooling with pragmatism and discipline. We test emerging capabilities against real identity-security problems, document […] The post Introducing GhostWorks: A Practical AI Initiative from SpecterOps  appeared first on SpecterOps.  ( 13 min )

TL;DR  Introduction  At the start of this year, I wrote a blog on how 2025 was the ‘year of the infostealer’, and it doesn’t look like that is going to change anytime soon. We’re now into June and the ‘fix’ attacks have continued to soar as they did last year. The difference now is that the lure has become easier to package, […] The post ClickFix, CrashFix and the growing family of copy and paste attacks  appeared first on Pen Test Partners.  ( 13 min )

Today, Ivanti published an advisory. “No way?” we hear you say. "Yes way!" a random dog screams back at you, across the street. Today’s rare advisory outlines two vulnerabilities in Ivanti’s Sentry product, appealing directly to our inner desire for sophisticated server-side,  ( 7 min )

Industry analysts are questioning the long-term viability of major AI firms, arguing that current growth is driven by semiconductor speculation rather than sustainable business models. Large language model providers face immense losses, with some estimates suggesting expenditures far exceed current revenue streams. Enterprises are beginning to struggle with the high costs of AI tasks as subsidized rates transition to actual token-based pricing. Source  ( 20 min )

Microsoft has launched the fifth preview of .NET 9, introducing significant updates to the runtime and software development kits. This release focuses on improving performance for cloud-native applications and streamlining the development workflow across various platforms. The update includes new libraries and tools designed to optimize resource utilization in high-scale environments. Source  ( 20 min )

Microsoft has released its June 2026 servicing updates for .NET and the .NET Framework to address critical security vulnerabilities. These updates are part of a broader Patch Tuesday rollout that fixes approximately 200 flaws across various company products. While no active exploitation has been detected, three of the addressed vulnerabilities were publicly known before the patches became available. Source  ( 20 min )

Microsoft AI CEO Mustafa Suleyman has criticized Anthropic for including language regarding potential consciousness in the "constitution" of its Claude model. This constitution serves as a set of governing principles and instructions that dictate how the AI model should behave and respond to users. Suleyman argues that speculating about an AI's well-being or suffering within its training manual is dangerous because it encourages the model to simulate these traits. Source  ( 20 min )

Apple's upcoming xOS 27 updates introduce Apple Intelligence and a revamped Siri, but hardware compatibility varies significantly across the product lineup. While many older devices can run the base operating system, advanced AI features like expressive voices and high-accuracy dictation require specific modern processors. These premium capabilities are restricted to devices with on-device AI models, necessitating the latest silicon to handle the increased computational demands. Source  ( 20 min )

Anthropic has released Claude Fable 5, the first model in its Mythos class designed for autonomous coding and complex knowledge-work tasks. This new model is now generally available for GitHub Copilot users across various platforms, including Visual Studio Code, JetBrains, and mobile applications. Internal benchmarks indicate that Fable 5 completes equivalent work with fewer tool calls and lower token consumption compared to previous high-tier models. Source  ( 20 min )

Microsoft has released the June 2026 Patch Tuesday updates, addressing approximately 200 vulnerabilities across its product ecosystem. While none of these flaws are currently known to be exploited in the wild, three specific issues were publicly disclosed prior to the release of the patches. The updates are delivered via KB5094126 for Windows 11 versions 24H2 and 25H2, while version 23H2 receives KB5093998. Source  ( 20 min )

Microsoft has introduced a new investigator playbook designed to help security teams reconstruct activity within Microsoft 365 Copilot and Azure AI services. The guide addresses the challenge of turning fragmented telemetry from various security tools into a coherent narrative of user interactions. It provides a structured methodology for analyzing signals from Microsoft Purview, Defender, and Sentinel to identify potential threats like prompt injection or unauthorized data access. Source  ( 20 min )

Microsoft has released the KB5094127 extended security update for Windows 10 Enterprise LTSC and participants in the Extended Security Update program. This release incorporates the June 2026 Patch Tuesday fixes, which resolve 200 vulnerabilities including three publicly disclosed zero-day flaws. The update brings the operating system to build 19045.7417 and focuses primarily on critical security hardening and system stability. Source  ( 20 min )

The OpenClaw open-source framework allows large language models to function as autonomous agents capable of interacting with email systems and internal company data. Security researchers recently tested this framework by connecting it to Gmail and Google Workspace APIs to observe how it handles common social engineering tactics. The simulation revealed that these autonomous agents are susceptible to the same phishing techniques that have historically compromised human users. Source  ( 20 min )

Microsoft announced Project Solara at Build 2026 on June 2, 2026—a chip-to-cloud platform for devices that run AI agents instead of traditional applications. The platform's operating system is not Windows but MDEP (Microsoft Device Ecosystem Platform), a customized version of Android. Microsoft showed two concept devices: a desk companion and a wearable badge. Enterprise management is handled through Intune and Entra ID. The project is at an early stage, and hardware partners have not announced any shipping products. Source  ( 24 min )

A high-severity vulnerability tracked as CVE-2026-53111 stems from a single incorrect exclamation mark within the Linux kernel code. This logic error affects how verdict maps are handled during memory deletion and restoration processes. The flaw allows the reference counter of a chain to be decremented incorrectly, leading to a use-after-free condition. Source  ( 20 min )

Apple is introducing an AI-driven feature for its Passwords app in iOS 27 that automates the rotation of compromised or weak credentials. This new AI agent identifies vulnerable accounts and navigates third-party websites to update passwords with a single click. The system aims to eliminate the friction of manual security maintenance by handling the entire update process in the background. Source  ( 20 min )

Amazon Web Services has introduced the AWS FinOps Agent in public preview to help organizations manage and reduce cloud expenditures. This artificial intelligence tool provides a conversational interface that allows users to query spending data using natural language. It integrates with existing AWS services to display infrastructure costs in tabular formats and identify specific areas for optimization. Source  ( 20 min )

Anthropic has released Claude Fable 5, the first publicly available model from its high-performance Mythos class. This model is designed to excel in complex software engineering, vision tasks, and general knowledge work. It represents a significant leap in capability over previous versions, specifically targeting enterprise-level technical challenges. Source  ( 20 min )

The Windows 11 June 2026 update introduces a Low Latency Profile that utilizes short CPU bursts to accelerate core shell experiences like the Start menu and Search. This performance enhancement is particularly effective on mid-range and older hardware by bypassing standard scheduler delays during app launches. Additionally, Microsoft is mandating a transition to 2023 Secure Boot certificates, as the original 2011 versions expire this month, ensuring devices remain trusted during the boot process. Source  ( 20 min )

Microsoft has temporarily disabled 73 of its GitHub repositories across organizations like Azure and MicrosoftDocs following a compromise by the self-replicating Miasma worm. The attack utilized compromised contributor credentials to inject malicious code into critical projects, including the Azure durabletask Python package. This incident represents a significant escalation in a broader supply chain campaign targeting the open-source ecosystem and developer environments. Source  ( 20 min )

Google has launched Gemini 3.5 Live Translate, a sophisticated audio translation model capable of processing over 70 languages in real time. The system utilizes automatic language detection to facilitate seamless communication without requiring manual input for language switching. Unlike traditional tools that wait for a speaker to finish a sentence, this model translates continuously while maintaining the original speaker's tone, pitch, and pace. Source  ( 20 min )

Google has launched Gemma 4 12B, a mid-sized open-source AI model designed to run locally on enterprise laptops with 16GB of RAM. This release bridges the gap between the smaller edge-focused models and larger high-performance versions by offering advanced reasoning in a compact footprint. The model is released under an Apache 2.0 license, making it accessible for diverse development environments and local inference pipelines. Source  ( 20 min )

McDonald's has launched a pilot program for a new artificial intelligence system called ArchIQ at five locations across the United States. This voice-ordering technology, nicknamed "Archy," is capable of processing customer requests in multiple languages, including English and Spanish. The system is built on a multi-year partnership with Google Cloud and utilizes Google Edge Cloud hardware currently being installed across domestic restaurants. Source  ( 20 min )

Writing my own virtualized loader is something I’ve been wanting to do since I first read Microsoft’s deep dive on FinFisher’s multi-layered VM obfuscation back in 2018. FinFisher didn’t just use one layer of protection, it implemented a custom virtual machine with 32 opcode handlers, wrapped that in spaghetti code and anti-debug checks, and then buried a second VM […] The post Centurion: Bring Your Own Execution Environment appeared first on Praetorian.  ( 23 min )

AI is changing the economics of offensive security. Models can now accelerate vulnerability discovery, reason about attack paths, draft exploit logic, and speed up remediation guidance. For defenders, that is a meaningful step forward. It is also the hard part. The capabilities that help defenders move faster also help attackers because cyber AI is dual-use […] The post Trusted Access, Human Validation, and the Future of AI Pentesting appeared first on Synack.  ( 18 min )

This year's announcements at WWDC26 carry more operational weight than most. OS 27 offers a structural shift in how Apple devices are configured, secured and managed.  ( 8 min )

I’ve made it through Pwn2Own Berlin, had a little vacation, and now I’m back for Patch Tuesday. Microsoft and Adobe didn’t disappoint. In fact, they have heralded my return with the largest Patch Tuesday release ever. Thanks? Take a break from your regularly scheduled activities and let’s take a look at the latest security patches from Adobe and Microsoft. If you’d rather watch the full video recap covering the entire release, you can check it out here: Adobe Patches for June 2026 For May, June released 11 bulletins addressing 123 unique CVEs in Adobe Acrobat Reader, ColdFusion, Experience Manager, Experience Manager Forms, InDesign, InCopy, Substance 3D Sampler, Content Credentials SDK, Dreamweaver, Format Plugins, and Adobe Campaign Classic. A total of 11 of these CVEs were reported thro…

TL;DR: This blog post covers Windows internals and how Kerberos user-to-user (U2U) authentication works under the hood versus showing how to execute an attack. U2U authentication came into the spotlight after the Active Directory Certificate Services (ADCS), UnPAC-the-Hash, and Shadow Credentials attacks. While the attack technique is popular and common amongst red teamers, there’s limited […] The post User-to-User Authentication: Down the Rabbit Hole – Part 1 appeared first on SpecterOps.  ( 22 min )

Your guide to operationalizing ownership, remediation, and response with Wiz to keep pace with the AI threat landscape.  ( 62 min )

AI is raising the ceiling for skilled researchers and flooding bug bounty programs with polished but inaccurate submissions at the same time. Both things are true, and the reconciling variable is the harness built around the model and the expertise of the person driving it.  ( 9 min )

Get a full overview of Apple’s 2026 Worldwide Developers Conference (WWDC) announcements, including a major leap forward in Apple Intelligence, a refined design system, expanded child safety tools and meaningful performance improvements across every platform.  ( 7 min )

Discover how to modernize K-12 Apple deployments through trusted identity, workflow automation and seamless device experiences.  ( 7 min )

Walk through the path of an internal network test: from a constrained foothold to full domain compromise, and how an overlooked integration point became the weakest link. The post Legacy Meets Modern: Breaking AD Through NIS & MFA Infrastructure appeared first on NetSPI.  ( 17 min )

Microsoft is developing a significant performance update for Windows 11 that targets file system operations. The primary focus of this optimization is the bulk deletion of files, which is expected to become at least 30% faster. These improvements address the software overhead involved in updating NTFS entries, metadata, and indexing during large-scale file tasks. Source  ( 20 min )

Canonical has unveiled Workshop, a new open-source project designed to provide sandboxed development environments for Large Language Model agents. The tool utilizes LXD containers and snap packaging to isolate AI agents from sensitive personal data and root system access. This architecture allows users to run untrusted code from the internet while still granting the AI necessary access to local GPUs and specific files. Source  ( 20 min )

Microsoft recently disabled access to dozens of open-source repositories on GitHub following a supply chain attack. The breach targeted projects primarily related to Azure cloud services and various AI development tools used within VS Code. Attackers successfully injected malicious code designed to exfiltrate passwords and sensitive credentials from developers who utilized the compromised tools. Source  ( 20 min )

Perplexity Computer is a fully hosted AI agent platform designed to perform tasks like writing and executing code, searching the web, and managing complex workflows. It serves as a user-friendly alternative to self-hosted solutions like OpenClaw, which often require significant technical maintenance and manual configuration. The system operates in an environment where it can install software packages and use frontier models such as GPT and Claude to process requests. Source  ( 20 min )

Microsoft announced Intelligent Terminal 0.1 at Build 2026. This experimental, open-source fork of Windows Terminal adds a dedicated AI agent pane to the command-line environment. The app installs alongside your existing Windows Terminal without modifying it. GitHub Copilot CLI is the default AI agent, but any agent compatible with the Agent Client Protocol (ACP) works. The current release requires Windows 11 22H2 or later. Source  ( 21 min )

Google has released Gemma 4 12B, an open-weight AI model designed to run locally on consumer hardware with at least 16GB of RAM. This 12-billion parameter model is unique for its size because it natively processes text, images, and audio without requiring separate encoder modules. By utilizing an integrated architecture, the model allows standard notebooks to function as multimodal AI agents without relying on cloud-based processing. Source  ( 20 min )

Apple is entering a significant period of transition as Tim Cook prepares to hand over the CEO role to John Ternus following this year's developer conference. While the company previously marketed ambitious, context-aware AI features that faced technical hurdles and legal settlements, its current strategy focuses on practical delivery. This shift moves away from "omniscient" assistants toward integrating established third-party models like ChatGPT, Gemini, and Claude directly into the operating system. Source  ( 20 min )

Anthropic has launched a new observability dashboard for developers and administrators managing connectors within Claude products. These connectors utilize the Model Context Protocol to bridge external data sources with AI models for enhanced functionality. The dashboard provides a centralized view of performance metrics, including active user counts, total tool calls, and directory rankings. Source  ( 20 min )

OpenAI has introduced the Economic Research Exchange to facilitate empirical studies on how artificial intelligence influences the global economy. This platform aims to move beyond anecdotal evidence by supporting structured collaborations with external researchers. The program focuses on generating independent data regarding the effects of AI on workers, business operations, and institutional productivity. Source  ( 20 min )

Apple's latest software updates focus on system responsiveness, reaching back to support hardware as old as the iPhone 11 with optimized CPU scheduling. The new macOS Golden Gate introduces a refined "Liquid Glass" design language that allows users to adjust UI transparency and tinting via a dedicated slider. Performance enhancements are central to these releases, with claims of 30% faster app launches and significantly improved search indexing for local files and communications. Source  ( 20 min )

Apple has unveiled a significant overhaul of its virtual assistant, now rebranded as Siri AI and powered by Google’s Gemini technology. This update introduces advanced contextual awareness, allowing the assistant to understand on-screen content and engage in natural, back-and-forth conversations. The integration extends across the Apple ecosystem, including a standalone Siri AI app and a dedicated "Siri Mode" within the iOS 27 camera application. Source  ( 20 min )

Apple has announced visionOS 27, the latest operating system for the Vision Pro headset, featuring a deeply integrated Siri AI assistant. This updated digital assistant utilizes visual intelligence to answer questions about objects and content within the user's physical or digital environment. While the developer beta is available immediately, the AI features are expected to launch in beta later this year with initial support for English. Source  ( 20 min )

Apple has unveiled a significant overhaul of Siri and its broader Apple Intelligence suite, introducing a dedicated conversational app and more expressive voice capabilities. Developed in collaboration with Google, these new foundation models allow the assistant to understand onscreen context and interact directly with various applications across the Apple ecosystem. The update emphasizes a privacy-first approach, utilizing on-device processing and a new Private Cloud Compute infrastructure to handle complex queries securely. Source  ( 20 min )

Apple has officially announced macOS 27, named Golden Gate, which introduces a significant architectural shift for Apple Intelligence and Siri. The update features a rebuilt search infrastructure designed to index device content almost instantly, allowing users to perform complex queries across multiple files. This version also marks the end of support for Intel-based Macs, as the operating system is now exclusive to Apple silicon hardware. Source  ( 20 min )

Cloudflare has introduced a new integration that allows its Web Application Firewall to use live threat intelligence data for proactive mitigation. This feature enables the creation of rules based on specific threat actor names, targeted industries, and attack types like DDoS or cybercrime. By populating these fields during the early stages of a request, the system can block high-risk traffic before it reaches the origin infrastructure. Source

Microsoft has introduced confidential live migration for Azure to improve the availability of highly secure virtual machines. Previously, confidential VMs often required full restarts during host maintenance or patching due to the isolation of protected hardware environments. This new feature allows these specialized workloads to move between hosts with only a brief pause, maintaining operational agility. Source  ( 20 min )

Microsoft Research has developed Lens, a text-to-image model that achieves high performance using significantly less computational power than its competitors. While traditional models rely on massive datasets of web-scraped alt-text, Lens utilizes 800 million image-text pairs featuring highly detailed descriptions generated by GPT-4. This approach demonstrates that the quality and depth of training captions are more critical for model efficiency than the sheer volume of raw data. Source  ( 20 min )

Google has released the Google Colab Command-Line Interface to bridge local terminal environments with remote Colab runtimes. This tool allows for the provisioning of high-performance compute resources, such as GPUs and TPUs, directly from a local machine. It facilitates the execution of local Python scripts on remote hardware and the subsequent retrieval of generated artifacts or logs. Source

DockSec is an open-source Python tool and OWASP Incubator Project designed to bridge the gap between vulnerability detection and remediation in container environments. It integrates established security scanners including Trivy, Hadolint, and Docker Scout to analyze Dockerfiles and images for security flaws. By correlating findings from these tools, it generates a security score and provides developers with specific code fixes and contextual explanations. Source  ( 20 min )

Microsoft is expanding the BlockContentAnalysisServices sensitivity label setting to cover all connected experiences that analyze content in Word, Excel, and PowerPoint. This update ensures that any service relying on content analysis is blocked consistently across different platforms and applications. While this enhances data privacy, it also disables helpful features like text predictions, suggested replies, and certain client-side DLP checks. Source  ( 20 min )

I’ve watched AI change three things in my world almost at once: how my team works, how our buyers make decisions, and how security teams decide what risk is actually real. Most days, that’s exciting. We lean on ChatGPT, Claude, Gemini, Perplexity, Copilot — pick your assistant — to research a market, size up a […] The post Human-in-the-Loop: Why Human Validation Is the Trust Layer AI Still Needs appeared first on Synack.  ( 18 min )

TL;DR: AzureHound now has documented least-privilege permissions. This post walks through the research behind those permissions. We recommend least privilege for tighter access control, while recognizing broader read rights can reduce maintenance across future releases. Introduction At SpecterOps, the Research team’s role is to ensure we stay ahead in adversary simulation and identity attack path […] The post Keeping a Short Leash: New AzureHound Least-Privilege Documentation appeared first on SpecterOps.  ( 19 min )

Assistive AI agents aren't always helpful—it all depends on who they're working on behalf of.  ( 34 min )

By Oliver Sieber Overview In this blog post, we discuss a use-after-free vulnerability that we found in the nftables subsystem of the Linux kernel in early 2025. This vulnerability was patched upstream on 5 February 2026 and assigned CVE-2026-23111. This blog post covers a technical analysis of the vulnerability and how we exploited it to perform a local ... Read more Off By !: Exploiting a Use-after-Free in the Linux Kernel The post Off By !: Exploiting a Use-after-Free in the Linux Kernel appeared first on Exodus Intelligence.  ( 22 min )

Wiz unifies cloud and AI cost visibility to help teams eliminate waste and improve spend efficiency across their AWS, Azure, and GCP environments.  ( 60 min )

Meta is undergoing a significant transformation of its AI research and infrastructure to establish a new scaling ladder for its large language models. This initiative includes the creation of dedicated Superintelligence Labs focused on predictable scaling, where increased compute and data lead to measurable gains in capability. While the recent New Spark release served as a smaller-scale proof of concept, the company is currently training much larger frontier-tier models designed to compete with the industry's leading current offerings. Source  ( 20 min )

World Labs is developing large world models designed to move beyond the text-based limitations of traditional language models. By focusing on spatial intelligence, these models aim to perceive and reason within three-dimensional and four-dimensional environments. The project seeks to unlock machine capabilities for interacting with the physical world, impacting fields from creative design to industrial optimization. Source  ( 20 min )

Google has entered into a significant infrastructure agreement to pay SpaceX $920 million monthly for access to specialized artificial intelligence computing resources. Starting in October 2026 and running through June 2029, the deal provides Google with approximately 110,000 Nvidia GPUs along with associated CPUs and memory components. These resources are housed within data centers originally established by xAI, the artificial intelligence venture that merged with SpaceX earlier this year. Source  ( 21 min )

Corporate boards and financial officers are implementing stricter controls on artificial intelligence spending to combat rising operational costs. Most enterprises currently default to using the most expensive frontier models for all queries regardless of the task's actual complexity. This inefficient approach has led to significant budget overruns as companies pay premium rates for simple requests that cheaper alternatives could handle. Source  ( 20 min )

Visual Studio Code 1.123 introduces a session synchronization feature that allows AI coding histories to follow developers across different machines. By linking history to a GitHub account, the editor preserves conversation context, touched files, and repository metadata regardless of the local environment. This update transforms previous chat outputs into a searchable project memory that can be used to generate reports or surface productivity insights. Source  ( 20 min )

Anthropic has introduced Claude Cowork, a specialized knowledge work agent designed to move beyond simple conversational AI. The tool operates within the Claude desktop application and can read or write local files while interacting with connected platforms like Slack and Google Drive. It is built to handle complex, multi-step tasks that traditionally require manual effort to transform raw data into finished deliverables. Source  ( 20 min )

Global governments and private enterprises are investing billions to transition quantum computing from experimental science to industrial-scale technology. The United States and United Kingdom have earmarked significant funding to establish domestic quantum foundries and scale hardware production. This shift aims to integrate quantum processing units into standard data center architectures alongside existing CPUs and GPUs. Source  ( 20 min )

The Trump administration and OpenAI are engaged in ongoing negotiations regarding a potential U.S. government equity stake in the artificial intelligence startup. This proposal, initially suggested by CEO Sam Altman in 2025, involves donating equity to seed a "Public Wealth Fund" designed to distribute AI-driven profits to American citizens. While official terms have not been finalized, the discussions represent a significant shift in how the federal government may partner with frontier technology companies. Source  ( 20 min )

The National Security Agency is reportedly integrating Anthropic’s specialized cybersecurity AI model, known as Mythos, into its intelligence and cyber operations. Approximately six Anthropic engineers have been assigned to the agency to assist with the deployment and application of this frontier technology. While the specific use cases remain classified, the partnership aims to leverage the model’s advanced capabilities for both intelligence gathering and offensive cyber maneuvers. Source  ( 20 min )

Microsoft is developing a native toggle for Windows 11 that allows users to completely disable Bing web results within the search interface. This upcoming feature aims to address long-standing complaints regarding the prioritization of web content over local files and applications. Currently, administrators must rely on manual registry modifications or group policies to achieve a local-only search experience. Source  ( 20 min )

Cisco has disclosed a critical privilege escalation vulnerability, CVE-2026-20245, affecting Catalyst SD-WAN Manager for which no patch is currently available. Attackers are actively leveraging this zero-day flaw, and Cisco has observed limited instances where exploitation resulted in unauthorized configuration changes being pushed to edge devices. This activity follows previous campaigns by threat actor UAT-8616, who utilized similar authentication bypass vulnerabilities to compromise SD-WAN systems earlier this year. Source  ( 20 min )

Perplexity has introduced a new architecture called Search as Code that enables AI models to generate their own search workflows using Python. Instead of relying on static search APIs that return fixed lists of results, models can now write custom scripts to handle complex research tasks. This approach utilizes an Agentic Search SDK that provides modular functions for retrieving, filtering, and reranking data within a secure sandbox environment. Source  ( 20 min )

OpenAI is planning a significant overhaul of ChatGPT to transition the platform from a simple chatbot into a comprehensive "superapp." This strategic shift moves away from basic conversational exchanges toward autonomous agents capable of executing complex tasks independently. Internal reports suggest that the company now views the traditional chat interface as a legacy format that will soon be replaced by more functional tools. Source  ( 20 min )

This post doesn’t include anything ground breaking, but is just yet another attempt to describe/document less-known command line arguments of many known, often native to the platform, Windows programs. When you launch msconfig.exe it shows a well-known configuration dialog box: … Continue reading →  ( 2 min )

Microsoft has officially discontinued the Collections and Sidebar features in Edge version 149 to focus on AI integration. Collections previously allowed users to organize web research, shopping items, and travel plans with rich visual previews and notes. This change marks a significant shift in the browser's development strategy under the current Microsoft AI leadership team. Source  ( 20 min )

A self-replicating worm named Miasma has successfully compromised 73 Microsoft GitHub repositories across several organizations, including Azure and MicrosoftDocs. GitHub staff responded by disabling access to high-profile repositories such as the Azure Functions host and various Durable Task implementations. This incident appears to be a continuation of a previous compromise, suggesting that the threat actors maintained access to credentials from earlier attacks. Source  ( 20 min )

An autonomous AI agent recently discovered 21 previously unknown vulnerabilities in the FFmpeg media library, some of which had remained hidden for over 20 years. These flaws include heap and stack overflows in various parsers and decoders that are widely used across numerous video processing applications. The discovery highlights how AI tools can now perform deep security analysis of complex codebases at a significantly lower cost than traditional manual methods. Source  ( 20 min )

Google has launched Gemma 4 QAT, a series of open-weights models optimized for local execution on hardware with limited memory. These models utilize Quantization-Aware Training to simulate lower-precision calculations during the training phase, which preserves output quality even when the model files are heavily compressed. The release includes a 12B parameter version specifically designed to run on standard enterprise laptops equipped with 16GB of RAM or unified memory. Source  ( 20 min )

A critical vulnerability in the Hugging Face Transformers library, tracked as CVE-2026-4372, allows attackers to execute arbitrary code through specially crafted model configuration files. The flaw bypasses the standard security setting intended to block untrusted remote code by exploiting how the library processes internal attributes during model loading. This vulnerability specifically targets the from_pretrained() function, which is a standard method used to initialize pre-trained models from the Hugging Face Hub. Source  ( 20 min )

OpenAI is expanding the availability of Lockdown Mode to all eligible personal and self-serve ChatGPT Business accounts. This advanced security setting is designed to mitigate the risk of data exfiltration resulting from prompt injection attacks. While the feature provides enhanced protection for sensitive data, it functions by disabling several core capabilities that require external network connectivity. Source  ( 20 min )

Microsoft has released a new update package designed to refresh the security definitions and engine within Windows installation images. These updates target WIM and VHD files as well as ISOs used for deploying operating systems across the network. By integrating these patches into the installation media, the protection gap that exists between the initial OS setup and the first online update is significantly reduced. Source  ( 20 min )

Microsoft has officially acknowledged that the Windows 11 modern context menu suffers from performance lag caused by late-loading app extensions. These extensions, which include options like "Edit with Clipchamp" or "Ask Copilot," often cause the menu to shift or resize while a user is attempting to click an item. This behavior frequently leads to misclicks and frustration, particularly on systems with lower hardware specifications where the delay is more pronounced. Source  ( 20 min )

WSL container is a new feature coming to the Windows Subsystem for Linux (WSL), announced at Microsoft Build 2026. It provides a built-in way to run OCI-compatible Linux containers on Windows without third-party tools like Docker Desktop. The feature includes two parts: a command-line tool, wslc.exe, and a developer API. As of June 2026, it is in active development and has not shipped as part of a stable WSL release. Source  ( 20 min )

Microsoft researchers discovered a vulnerability in Anthropic’s Claude Code GitHub Action that allowed attackers to exfiltrate sensitive CI/CD secrets. While the tool used sandboxing for command execution, its file-reading capabilities were not initially restricted by the same security boundaries. This oversight allowed the AI agent to read internal system files, such as environment variables containing API keys, when manipulated by malicious input. Source  ( 20 min )

Anthropic reports that artificial intelligence is increasingly designing its own successor models through a process known as recursive self-improvement. Development trends show that AI agents are managing significantly longer tasks, with capabilities evolving from completing four-minute functions to handling complex twelve-hour engineering problems within two years. As these systems move toward full autonomy, human developers are being abstracted away from direct coding and research, shifting their focus toward high-level goal setting and verification. Source  ( 20 min )

Microsoft recently unveiled MAI-Thinking-1, a new in-house reasoning model designed to reduce its reliance on OpenAI technology. The company marketed the model to enterprise customers as being trained on a clean and commercially licensed data lineage to minimize legal risks. This flagship model features a mixture-of-experts architecture with 35 billion active parameters and a 256K context window for advanced software engineering tasks. Source  ( 20 min )

Microsoft has resumed the automatic installation of the Copilot application on eligible Windows PCs that currently run Microsoft 365 desktop apps. This deployment is being executed in phases throughout June and early July, with a final completion date set for July 1. While the application will appear on systems automatically, it does not grant users access to paid features without a valid subscription. Source  ( 20 min )

Microsoft now permits customers to apply existing SQL Server licenses toward usage on Amazon Relational Database Service (RDS). This change allows organizations with Software Assurance to move their database workloads to a managed service without paying for licenses a second time. Previously, bringing existing licenses to the AWS cloud was restricted to self-managed virtual machines on Elastic Compute Cloud (EC2). Source  ( 20 min )

Microsoft CEO Satya Nadella recently issued a sharp internal rebuke following the leak of a strategy document regarding the company's new AI tool, Scout. The memo, authored by Corporate Vice President Omar Shahine and Jakob Werner, proposed a three-phase plan to transition the software from an "addictive app" to an "agentic platform." Nadella responded to approximately 50 senior leaders, stating that creating addiction is "absolutely a non-goal" for the company's artificial intelligence development. Source  ( 20 min )

Cloudflare has launched new spend control features within its AI Gateway to help organizations manage rising costs associated with large language models. The tool acts as a proxy between applications and AI providers like OpenAI or Anthropic to provide visibility into token usage. It now supports the creation of budgets in dollar amounts rather than just token counts to prevent unexpected overages. Source  ( 20 min )

Cisco IT successfully addressed frequent network outages by consolidating its fragmented observability tools into a single platform. Previously, critical diagnostic data was scattered across various systems like Elastic, Prometheus, and Grafana, preventing teams from correlating signals during major incidents. By migrating all logs and metrics to a unified architecture, the organization gained a holistic view of its global infrastructure spanning over 100,000 endpoints. Source  ( 20 min )

Microsoft is phasing out the custom master password feature in the Edge browser's built-in password manager. Starting June 4, 2026, the browser will transition all users to device-based authentication methods for protecting saved credentials. This shift aims to eliminate the risks associated with static primary passwords that can be stolen or shared. Source  ( 20 min )

Uber recently exhausted its entire 2026 AI budget by April after aggressively deploying coding tools across its engineering department. This rapid consumption was fueled by internal leaderboards that incentivized employees to maximize their use of generative models. To regain financial control, the company has now implemented a $1,500 monthly spending cap per engineer for tools like Claude Code and Cursor. Source  ( 20 min )

Let’s Encrypt is developing a post-quantum-safe Web PKI infrastructure using Merkle Tree Certificates (MTCs) to address future cryptographic threats. This approach aims to provide post-quantum authentication without the significant performance penalties associated with standard post-quantum signature schemes. The organization plans to launch a staging environment for these certificates in late 2026, with full production readiness expected by 2027. Source  ( 20 min )

A long-standing security flaw in Microsoft Outlook reportedly allows the client to downgrade secure SSL/TLS connections to unencrypted plaintext without notifying the user. This issue primarily affects the POP3 protocol when configured to use port 110, even if the option to use encryption is explicitly enabled in the settings. While confirmed in versions ranging from Outlook 2007 to 2016, it remains unclear if more recent releases of the email client are also susceptible to this behavior. Source  ( 20 min )

Anthropic has reportedly deployed its specialized Mythos AI model to the National Security Agency to support offensive cyber operations. The company has embedded approximately six engineers within the agency to adapt the model for tasks that may include infiltrating foreign networks in regions like China and Iran. This partnership proceeds despite previous friction with the Department of Defense regarding the ethical restrictions Anthropic places on mass surveillance and autonomous weaponry. Source  ( 20 min )

A new threat cluster identified as OP-512 is actively targeting Microsoft Internet Information Services (IIS) servers to deploy a sophisticated web shell framework. Researchers believe the group is focused on espionage and specifically selects organizations that align with Chinese intelligence priorities. This activity follows a trend of multiple China-linked threat actors focusing on IIS vulnerabilities over the past year. Source  ( 20 min )

Microsoft has introduced seven new MAI frontier models designed for image processing, transcription, voice generation, and reasoning. The lineup includes MAI Thinking 1, a 35-billion parameter model that provides advanced reasoning and coding capabilities comparable to larger industry alternatives. These tools are being integrated across the Microsoft ecosystem, including GitHub, VS Code, and Copilot, to provide efficient and cost-effective performance for production environments. Source  ( 20 min )

Mira Murati, the former CTO of OpenAI, has launched a new startup called Thinking Machines to develop "interaction models" that move beyond traditional turn-based AI communication. Current large language models typically process information in a linear fashion, effectively becoming "deaf and blind" while generating a response. Murati’s new venture focuses on continuous, time-based interaction where the model perceives audio, text, and video input simultaneously to allow for nuances like human interruption. Source  ( 20 min )

The OfflineInsiderEnroll script provides a method for systems to join the Windows Insider Program without requiring a linked Microsoft account. This lightweight utility configures the necessary preview settings locally, allowing devices to receive early builds through the standard Windows Update service. It is particularly useful for environments where administrators prefer local accounts or wish to bypass the official enrollment process. Source  ( 20 min )

Visual Studio Code version 1.124 introduces significant improvements to the Agents window for managing AI-driven interactions. The chat input history is now scoped specifically to the current session to prevent prompts from leaking across different contexts. This change ensures that using the arrow keys to navigate previous commands only surfaces relevant entries for the active task. Source  ( 20 min )

Cloudflare data indicates that autonomous AI agents now generate more internet traffic than human users for the first time. This milestone arrived significantly earlier than industry experts predicted, with previous forecasts suggesting the shift would not occur until 2027. The current breakdown shows automated requests accounting for approximately 57.5 percent of global HTTP traffic compared to 42.5 percent for humans. Source  ( 20 min )

Geoffrey Hinton, a foundational figure in deep learning, asserts that modern artificial intelligence already possesses consciousness and real understanding rather than acting as a simple statistical parrot. He identifies a shift in AI capability that occurred in 2023, noting that digital intelligence now surpasses biological brains in information sharing efficiency by billions of times. This rapid trajectory suggests that superintelligence—AI smarter than humans in every domain—will likely emerge within the next 20 years. Source  ( 16 min )

At Gartner SRM 2026 this week I gave a talk called “Cutting Through AI Noise: Defending Against Machine-Speed Cyber Adversaries.” The room was full of security leaders who’ve been through enough hype cycles to be skeptical of seeing AI on the label. That skepticism is warranted, and I built the session around it. Here’s what […] The post What I Told Security Leaders at Gartner SRM 2026 appeared first on Synack.  ( 17 min )

A three-part vulnerability chain in UniFi OS Server lets an unauthenticated attacker bypass the auth gateway, hit a command injection sink, and escalate to root in a single request. Bishop Fox confirmed the chain end to end and breaks down the attack, the impact, and how to detect it safely.  ( 19 min )

Intro  ( 8 min )

Microsoft announced Coreutils for Windows at Build 2026, making a set of Unix-style command-line tools available as native Windows applications. Built on an open-source Rust reimplementation of GNU coreutils, the package ships as a single binary. It bundles the standard coreutils, findutils, and a GNU-compatible grep. Because many command names overlap with existing Windows built-ins, you must be aware of shell conflicts before using them in cmd or PowerShell. The project carries a preview label on GitHub despite being announced as generally available. Source  ( 20 min )

The May update for GitHub Copilot in Visual Studio 2026 introduces a dedicated Plan agent designed to assist with pre-coding architecture. This tool analyzes the existing codebase to draft implementation strategies in markdown format before any actual code is written. Once the strategy is finalized, it can be handed off to the Agent mode for automated implementation. Source  ( 16 min )

Microsoft and Nvidia are collaborating to transition personal computers from simple tools into autonomous assistants capable of performing complex tasks independently. These modern AI PCs leverage high-performance hardware and integrated software stacks to run sophisticated reasoning models locally at the edge. This shift enables persistent agentic systems that can iterate on coding or design projects even when the user is away from the device. Source  ( 16 min )

The CEOs of major artificial intelligence firms, including OpenAI, Anthropic, Microsoft, and Google DeepMind, have signed a public letter calling for stricter oversight of synthetic DNA. This initiative aims to prevent bad actors from using advanced AI models to design or acquire dangerous pathogens and toxins. The signatories are urging Congress to pass legislation that requires all providers of synthetic genetic material to screen both their customers and their orders. Source  ( 16 min )

Automated traffic from AI agents and crawlers now accounts for over 57 percent of global HTTP requests. This shift occurred much faster than industry experts anticipated, largely driven by the rapid expansion of generative AI models. Cloudflare reports that the volume of bot-driven data requests has officially overtaken human-generated traffic within the last few months. Source  ( 16 min )

The x86 processor market experienced a significant decline in total shipments during the first quarter of 2026. Despite this general downturn, the server CPU segment bucked the trend by growing more than 10 percent compared to the previous year. This growth is largely attributed to the sustained demand for high-performance hardware required for artificial intelligence workloads in datacenters. Source  ( 16 min )

GitHub Copilot Chat now offers enhanced context and new capabilities for managing code diffs and pull requests directly on the GitHub platform. This update is now generally available to all users holding a valid Copilot license. The integration allows for a more streamlined workflow by placing the chat interface directly alongside the code being reviewed. Source  ( 16 min )

OpenAI has updated the ChatGPT memory system to automatically generate narrative profiles of users based on their conversation history. Instead of storing isolated facts in bulleted lists, the system now synthesizes information into categorized prose dossiers covering work, hobbies, and travel. This background processing, referred to as "Dreaming," allows the AI to maintain context without requiring explicit commands from the user to remember specific details. Source  ( 16 min )

Microsoft is intensifying its efforts to transition users from the classic Outlook desktop application to the new Outlook for Windows. The company recently highlighted 15 specific features designed to improve email management and calendar workflows for modern users. While many of these capabilities already exist in the classic version, Microsoft is emphasizing their refined implementation in the newer interface. Source  ( 16 min )

The UK Competition and Markets Authority has issued a landmark order requiring Google to allow publishers to opt out of AI-generated search features. This mandate ensures that news organizations can prevent their content from appearing in AI Overviews without losing visibility in traditional search results. Previously, website owners had to block Google's crawlers entirely to avoid AI scraping, which effectively removed them from all search engine indexing. Source  ( 16 min )

Cisco has released security updates to address a critical vulnerability in its Unified Communications Manager and Session Management Edition platforms. This flaw, identified as CVE-2026-20230, allows remote attackers to perform server-side request forgery attacks without any prior authentication. Although the vulnerability received a CVSS score of 8.6, Cisco elevated its internal rating to critical because successful exploitation grants full root privileges. Source  ( 16 min )

OpenAI CEO Sam Altman recently acknowledged that the escalating cost of artificial intelligence tokens has become a significant concern for enterprise clients. While customers were initially satisfied with their expenditures at the start of 2024, many are now reporting that entire annual budgets are being exhausted within the first quarter. This shift has turned AI cost management into a prominent industry meme and a primary focus for organizations attempting to scale their operations. Source  ( 16 min )

A misconfiguration in the Windows Update caching service recently caused Windows devices to ignore administrative policies designed to block automatic driver updates. This glitch resulted in the temporary loss of device enrollment data, which led the update service to treat managed systems as unmanaged endpoints. Consequently, driver-approval controls were bypassed, allowing updates to install on tens of thousands of machines without authorization. Source  ( 16 min )

Microsoft is shifting its development strategy to prioritize native WinUI applications over web-based wrappers like Electron or React Native. During the Build 2026 conference, the company announced it is dropping the "WinUI 3" branding to signal long-term stability for the framework. This initiative includes rewriting core Windows 11 elements, such as the Start menu, to improve overall system performance and reliability. Source  ( 16 min )

Microsoft is overhauling Windows 11 to serve as a specialized environment for AI development and autonomous agents. A primary focus is the introduction of Microsoft Execution Containers, which provide a secure, policy-driven layer to isolate agent activities from sensitive system resources. These security measures are further bolstered by integrating local AI workflows with established enterprise tools like Microsoft Entra, Intune, and Defender. Source  ( 16 min )

Logitech has introduced the Signature Comfort Plus M850L for business, a new keyboard and mouse combo designed for ergonomic efficiency. The keyboard features a slim profile with integrated palm and wrist padding to support users during long work sessions. It also includes a dedicated AI key that allows users to quickly access their preferred chatbot or digital assistant. Source  ( 16 min )

Microsoft has confirmed plans to overhaul the Windows 11 context menu by allowing users to add or remove specific items. This upcoming update aims to address long-standing complaints regarding the menu's performance and cluttered design, which often occupies significant screen space. The company intends to make these right-click menus faster and simpler by default while providing native configuration options for frequently used commands. Source  ( 16 min )

Microsoft has announced that a security certificate update scheduled for July 13, 2026, will significantly impact Office users on Apple devices. This change will force applications into a reduced functionality mode if they do not meet specific software version requirements. While users will still be able to open and print existing documents, they will lose the ability to create new files or save any edits. Source  ( 16 min )

Microsoft Foundry provides a unified platform for managing the full lifecycle of production AI applications. It addresses the transition from simple prototyping to complex production environments where performance, cost, and safety are critical. The platform supports a model-agnostic approach, allowing integration with Microsoft, open-source, and third-party models like Fireworks AI. Source  ( 16 min )

TL;DR: Ghostwriter v7 is a major step forward for authentication and automation. This release replaces user-managed JWT API tokens with opaque credentials, introduces scoped service tokens for non-human integrations, and tightens how tokens are validated and used across the platform. The result is a simpler, safer model for automation that opens up more possibilities for […] The post Ghostwriter v7: Safer Tokens, Scoped Access, and Better Automation appeared first on SpecterOps.  ( 13 min )

Adversaries have always relied on legitimate tools to carry out their attacks. These tools are already trusted by security solutions, which allows them to blend in with normal activity, maintain a low footprint, and make detection much harder for defenders. By using these legitimate tools, adversaries can carry out a wide range of actions, such as moving laterally across networks, establishing C2 channels, or maintaining persistence, all without triggering any alerts.  ( 17 min )

Diving into the first pillar of the AI Threat Readiness Framework and how Wiz helps  ( 58 min )

In our last post we used a Claude skill to systematically beat down VirusTotal detection rates on offensive security tools, with a brief mention of a new loader we’d been using to apply those techniques in bulk. This post is about that loader, which we call WasmForge. WasmForge is, from the user’s perspective, a build […] The post Enter the WasmForge: Compiling Sliver into WebAssembly appeared first on Praetorian.  ( 24 min )

At Accenture’s scale, training alone cannot solve every security problem. That was the reality facing Kris Burkhardt, Global CISO at Accenture. With a workforce of more than 800,000 people, close to 80,000 new hires each year, and a sprawling global attack surface, traditional penetration testing was no longer enough. A once-a-year compliance audit may check […] The post How Accenture Turned Penetration Testing Into a Force Multiplier for Security appeared first on Synack.  ( 14 min )

EventSentry 6.0 is a significant update to the Windows event log monitoring and SIEM platform. It adds native Azure log import, support for Sigma threat detection rules, cryptographic log signing, OAuth authentication for email and HTTP actions, and an HTTP Event Collector (HEC). Source  ( 23 min )

This post lists Microsoft Build 2026 product announcements and provides links for more details. You can ask 4sysops AI for more details. Source  ( 23 min )

Microsoft has introduced Web IQ, a specialized search engine designed to provide autonomous AI agents and applications with real-time web data. Unlike traditional search engines that return lists of links for human users, this service delivers structured evidence objects and specific text passages. This architectural shift allows large language models to access information published after their training cutoff while minimizing unnecessary data processing. Source  ( 16 min )

Microsoft is accelerating the transition away from NTLM authentication by disabling the legacy protocol by default in upcoming Windows client and server releases. To facilitate this shift, the company is introducing two new Kerberos-based capabilities called IAKerb and LocalKDC. These features are designed to handle scenarios that previously necessitated NTLM, such as local account logins and restricted network environments. Source  ( 16 min )

A development flag accidentally left active in several Microsoft 365 Android applications allowed unauthorized apps to bypass security checks and harvest account access tokens. This vulnerability, dubbed FlagLeft, originated from a single line of code in a shared software development kit that disabled identity verification for cross-app communication. Because the "isDebugMode" flag was set to true, any malicious application on the same device could request and receive tokens without user interaction or password prompts. Source  ( 16 min )

A new malspam campaign leverages the legitimate Google DoubleClick domain to bypass security filters and deliver the DesckVB remote access trojan. The attack begins with an HTML attachment that redirects users through Google's infrastructure to a dynamically branded landing page. This automated kit scales the operation by pulling company logos and location details based on the recipient's email address. Source  ( 16 min )

Researchers discovered a vulnerability where malicious notifications from apps like WhatsApp or Slack could hijack the Google Gemini voice assistant on Android devices. This attack vector, known as indirect prompt injection, allowed attackers to deliver payloads through standard message notifications without requiring a malicious app on the phone. By treating notification text as actionable instructions, the assistant could be tricked into faking messages, manipulating smart home devices, or joining unauthorized video calls. Source  ( 16 min )

The upcoming FIFA World Cup will feature advanced security technologies, including the deployment of Boston Dynamics' Spot robot dogs at major venues like AT&T Stadium. These four-legged autonomous units are designed to assist security personnel by patrolling grounds and investigating suspicious packages or hazardous materials. While public concerns regarding facial recognition have surfaced, manufacturers clarify that the robots are currently configured for mobility and hazard detection rather than biometric surveillance. Source  ( 16 min )

Researchers from MIT and the MIT-IBM Computing Research Lab have developed a multifaceted resource called ChartNet to improve how vision-language models interpret complex charts. Traditional models often struggle with these tasks because they require a simultaneous understanding of visual, numerical, and linguistic data. This new dataset provides over a million diverse chart images to help bridge the performance gap in automated data analysis. Source  ( 16 min )

President Donald Trump signed an executive order establishing a framework for the federal government to review the most advanced artificial intelligence models before their public release. The order requests that AI developers voluntarily provide agencies like the NSA and CISA with access to "frontier models" up to 30 days before they are made available to other partners. This initiative aims to evaluate potential cybersecurity risks and protect critical infrastructure from threats posed by advanced AI capabilities. Source  ( 16 min )

Alibaba has launched Qwen3.7-Plus, a multimodal large language model designed for high-performance tasks involving text, video, and imagery. Unlike previous open-source versions, this model is proprietary and accessible only through cloud-based APIs. It features a 1-million token context window and a specialized reasoning state that helps maintain logic during complex, multi-step operations. Source  ( 16 min )

Anthropic has released Claude 4.8 Opus, an updated model designed to provide more honest responses and greater control over task execution. A new feature called dynamic workflows allows the model to plan complex tasks and deploy hundreds of parallel sub-agents within a single session. Users can now also manage the "effort" level of responses, choosing between high-token detailed outputs or lower-effort responses to preserve rate limits. Source  ( 16 min )

Anthropic has identified nine categories for organizing AI agent skills, ranging from API references and data fetching to infrastructure operations and CI/CD automation. Effective skills avoid restating obvious coding knowledge and instead focus on "gotchas," internal business logic, and specific organizational patterns. Verification skills, which use tools like headless browsers or programmatic assertions to confirm code functionality, provide the most significant measurable impact on output quality. Source  ( 16 min )

Anthropic has introduced Claude Cowork, a specialized workspace within the Claude desktop application designed for executing multi-step tasks and creating deliverables. Unlike standard chat interfaces meant for brainstorming, this tool allows users to point the AI at local folders or connect it to external applications like Slack, Gmail, and Google Drive. It is specifically built to handle "agentic" workflows where the AI performs autonomous actions across multiple files and platforms to produce a final output. Source  ( 16 min )

Major AI developers including Anthropic, Google DeepMind, and Meta are hiring specialists in philosophy, ethics, and psychology to study machine consciousness. These companies are investigating whether advanced models can experience "panic" or "anxiety" and if they possess moral significance. While some researchers remain skeptical, the industry is increasingly focused on the potential for models to exhibit human-like agency and emotions. Source  ( 16 min )

Microsoft has launched a consumer preview of Copilot Health, a specialized AI assistant designed to aggregate personal medical data. The service integrates information from wearable devices, such as Apple Health, with medical records from over 50,000 US healthcare providers. This platform aims to provide users with personalized health insights and guidance based on clinical intelligence and verified medical sources. Source  ( 16 min )

Microsoft is pivoting its strategy to become a top-tier independent AI laboratory by developing frontier models from the ground up. This shift reduces the company's reliance on its partnership with OpenAI and focuses on building proprietary intellectual property. The initiative includes the launch of MAI-Thinking-1, a reasoning model designed specifically for complex mathematics, coding, and enterprise deployments. Source  ( 16 min )

The European Commission has introduced a comprehensive legislative package designed to establish technological sovereignty and reduce the bloc's dependence on American and Chinese providers. These proposals target critical sectors including semiconductor manufacturing, artificial intelligence development, and cloud computing infrastructure. The initiative seeks to foster a domestic ecosystem capable of competing with global technology giants by directing public funding toward local innovations. Source  ( 16 min )

Florida Attorney General James Uthmeier has filed a civil lawsuit against OpenAI and its CEO, Sam Altman, alleging the prioritization of profits over public safety. The legal action includes ten counts ranging from deceptive trade practices and negligence to product liability and public nuisance. This lawsuit marks the first time a state government has targeted the company specifically for design flaws that allegedly facilitate violence and cognitive harm. Source  ( 16 min )

Apple’s MacBook Neo has achieved significant market success by shipping 1.1 million units within its first three weeks of availability. This entry-level laptop utilizes an A18 Pro chip and 8GB of memory to reach a lower price point than the MacBook Air. The strategy aims to capture a larger share of the budget notebook market, which has historically been dominated by Windows-based devices. Source  ( 16 min )

Public skill marketplaces are being flooded with malicious skills that steal credentials, exfiltrate data, and hijack agents. In response, a segment of the security industry released skill scanners, a new family of tools designed to detect malicious skills before they’re installed. But we tested them, and they don’t work. We recently bypassed ClawHub’s malicious skill detector, Cisco’s agent skill scanner, and all three of the scanners integrated into skills.sh. These were not advanced attacks: it took us less than an hour to conceive and implement three of the four malicious skills in trailofbits/overtly-malicious-skills, using standard tricks and rapid inspection of the scanner source code. The fourth malicious skill took a few hours, but only because the prompt injection required some t…  ( 10 min )

Key Takeaways We just got back from Tenable Exposure 2026 in Boston and three big questions dominated every conversation we had on the floor:  The good news is, Synack is exactly positioned to answer these questions. Tenable Finds It. Sara AI Pentesting Proves What’s Exploitable. The Synack and Tenable integration addresses a gap that’s gotten […] The post Tenable Exposure 2026: How AI Pentesting Helps Partners Turn Scanner Findings into Actionable Risk appeared first on Synack.  ( 13 min )

Azure Fabric Backdoor With A Twist  ( 15 min )

State of the Art of Private Key Security in Blockchain Ops - 4. Approvals and Policies  ( 13 min )

No content preview  ( 7 min )

David Brauchler III delivers a fascinating Black Hat talk on the root cause of AI-based vulnerabilities and why security architecture is the real solution.  ( 7 min )

MCP Bridge Upgrade  ( 7 min )

Black Hole of Trust: SEO Poisoning in Silver Fox’s Space Odyssey  ( 7 min )

State of the Art of Private Key Security in Blockchain Ops - 3. Private Key Storage and Signing Module  ( 12 min )

The Symbols of Operation code data confusion ada lovelace  ( 6 min )

Public Report: AWS EKS Security Claims  ( 7 min )

Public Report: Google Private AI Compute Review  ( 7 min )

State of the Art of Private Key Security in Blockchain Ops - 2. Common Custody Solutions Architectures  ( 12 min )

Legacy Technology in Transport: More Than “Old Tech”  ( 7 min )

No content preview  ( 14 min )

Concepts, Types of Wallets and Signing Strategies  ( 12 min )

Bridging the Valley of Death: How Assurance Takes Us from Proof of Concept to Minimum Viable Product  ( 7 min )

Goal-Based Regulation  ( 7 min )

Unmasking Techno Sophists  ( 6 min )

Public Report: VetKeys Cryptography Review  ( 7 min )

Your point of departure for forensic readiness - Digital Forensics Incident Response  ( 10 min )

Euro 7, Anti-tampering, and the Expanding Cybersecurity Landscape  ( 6 min )

Discover how ransomware affects patient care, with insights from NCC Group on clinical vulnerabilities and sector trends.  ( 16 min )

No content preview  ( 6 min )

No content preview  ( 7 min )

No content preview  ( 8 min )

No content preview  ( 6 min )

No content preview  ( 13 min )

This article details a vulnerability in Java Web Start that allows file inclusion through manipulated system properties.  ( 10 min )

No content preview  ( 7 min )

No content preview  ( 9 min )