News

If you use WordPress, patch now. Just hours after fixes came out, attackers have begun exploiting two bugs that, when chained together, allow pre-authentication remote code execution (RCE). And security researchers tell us there’s a very good chance the miscreants had an AI assist. “Once the vulnerabilities were publicly disclosed, reproducing them with the help of frontier AI models was only a matter of time and tokens,” Jake Knott, watchTowr principal security researcher, told The Register. “WatchTowr was able to trivially reproduce CVE-2026-63030 within minutes of disclosure, and the second CVE-2026-60137 with some additional effort.” WordPress released patches for both CVEs late Friday, but by Saturday it was game over. “By the early hours of Saturday morning, successful exploitation was already well underway, initially using public exploit code to exfiltrate hashed credentials, with remote code execution following once additional details were made public,” Knott said. “From our vantage point across a global client base, we are seeing widespread impact of this vulnerability across organizations of every size and every vertical.” Here are the details about both security holes, and what went down since WordPress revealed and fixed them on Friday. CVE-2026-60137 is a moderate-severity SQL injection issue, and CVE-2026-63030 is a critical REST API batch-route confusion bug. “A route confusion flaw causes the arrays containing the sub-requests, validation results, and matched handlers to become misaligned,” Hacktron researchers explained. This causes WordPress to become confused about which requests have been properly validated and thus treat all requests as trusted, including those that it should block. Individually, the bugs are difficult to exploit. But when chained together, they can wreak havoc on any organization using a vulnerable WordPress version because they allow unauthenticated RCE. WordPress 6.9 is affected by both vulnerabilities, and version 6.9.5 contains fixes for both, while WordPress 6.8 is only affected by the SQL injection flaw, and version 6.8.6 fixes it. Additionally, WordPress 7.1 Beta 1 is also vulnerable. Version 7.1 Beta 2 fixes both CVEs. Versions of WordPress prior to 6.8 are not affected. John Blackbourn, one of the WordPress core developers, recommended affected users “update your sites immediately.” Because of the flaws’ severity, the WordPress security team “enabled forced updates via the auto-update system for sites running affected versions,” he added. The content management system credited Searchlight Cyber researcher Adam Kues with finding and reporting CVE-2026-63030, and in a subsequent Friday advisory, Kues dubbed the bug wp2shell. “The attack has no preconditions and can be exploited by an anonymous user in a stock install of WordPress with no plugins,” Kues said, adding that his security shop released a free wp2shell checker to determine if your instance is vulnerable. Security firm PatchStack reported exploitation of both CVEs as of Friday night, but didn’t provide details about the attacks. VulnCheck’s research team, which also began researching the patches on Friday, verified more than two dozen unique proof-of-concept exploits targeting WP2Shell as of Sunday. “After public exploit code was released, attackers began spraying the internet indiscriminately, hitting anything reachable and trying to get lucky,” Knott told us. “Our honeypots recorded tens of thousands of exploitation attempts, and more than 100 backdoor accounts created by different threat actors using variations of public tooling.” After creating these backdoor admin accounts, watchTowr observed attackers deploying fake WordPress plugins to achieve RCE, exfiltrate credentials or secrets, or download additional tooling to further compromise the system, he added. “In one case, we watched a threat actor repeatedly attempt to pull down Overlord RAT, a Golang-based remote access trojan.” Any orgs that waited until Monday to patch are likely already compromised, Knott warned. “Defenders need to inspect their WordPress instances for new administrator accounts, malicious plugins, or other suspicious files, regardless of whether they’ve patched,” he said.®

Real FBI agents won't slide into your DMs and offer to help you recover stolen funds. The bureau's Internet Crime Complaint Center (IC3) updated an earlier warning on Monday about scammers impersonating the agency online, saying fraudsters continue to use the scheme "to deceive and revictimize individuals." According to IC3, there are two different schemes being used to target cybercrime victims, both directly and by soliciting them to report incidents. In the first scheme, IC3 said scammers create fraudulent social media profiles and pages impersonating FBI personnel or IC3. They may also infiltrate online groups for fraud victims or contact victims directly while claiming to represent the FBI or the complaint center. In other cases, victims are being contacted by someone claiming to be an FBI agent after realizing they were approached by someone trying to scam them and saying they intended to report the incident to the FBI or file an IC3 complaint. The FBI said the impersonator then directs victims to a fake IC3 update page or continues communicating through messaging apps. In the other instance, scammers are creating AI-generated videos on social media depicting senior FBI officials and directing users to a spoofed IC3 website to report cybercrimes they may have fallen victim to, with the scammers then collecting the information and using it to contact victims for further fraud. AI-generated depictions of public figures are similarly being used to make such scams appear legitimate. “Some individuals received an email or a phone call, while others were approached, or observed an advertisement via social media or forums,” the IC3 said. “Almost all complainants indicated the scammers claimed to have recovered the victim's lost funds or offered to assist in recovering funds.” Regardless of how legitimate social media profiles look, or how realistic those AI-generated videos may be, the IC3 is warning that none of them should be believed for a simple reason: The IC3 doesn’t have a social media presence of any kind, and it doesn’t investigate crimes or offer to recover lost funds through social media. “Any social media profiles or pages claiming to represent IC3 or offering to recover lost money are fraudulent and are actively attempting to steal your personal or financial information,” the IC3 warned. “IC3 will never directly communicate with individuals via phone, email, social media, phone apps, online chat, or public forums.” The IC3 said that any contact made with a cybercrime victim who reports an incident via its actual website will be made by an FBI employee from a local field office or other law enforcement official. Here’s another hot tip: If you fall victim to a cybercrime or online scam, don’t post about it on social media - that’s only going to invite someone with bad intentions to seek you out. ®

AI datacenters wreak havoc on the power grid under normal circumstances, so what happens if a bad actor controls all the GPUs and wants to cause harm? Cybersecurity researchers in China have devised a way for malicious tenants to attack their infrastructure provider, potentially causing blackouts or damaging equipment. The attack, dubbed Bit2Watt, imagines an adversary masquerading as a legitimate cloud tenant to launch GPU workloads that have the potential to damage datacenters and supporting electrical systems. It's intended to demonstrate the need to extend cybersecurity defenses to datacenter workload scheduling. The researchers, Zhouhao Ji, Kaikai Pan, and Wenyuan Xu, from Zhejiang University in Hangzhou, China, describe their technique in a preprint paper titled "Bit2Watt: A Cyber-Physical Vulnerability Exploiting GPU Workloads Across Power and Computing Infrastructures." AI training workloads represent a known challenge for datacenter operators. As Microsoft, Nvidia, and OpenAI noted in a 2025 research paper arguing the need for power stabilization during AI training, the transition from GPU computation to GPU data synchronization causes large power swings to occur. And if the frequency spectrum of these power swings is "harmonized with critical frequencies of utilities, [that] can cause physical damage to the power grid infrastructure." Meta's paper on the training of Llama 3 also cites the risk AI training poses to the power grid. It says, "During training, tens of thousands of GPUs may increase or decrease power consumption at the same time, for example, due to all GPUs waiting for checkpointing or collective communications to finish, or the startup or shutdown of the entire training job. When this happens, it can result in instant fluctuations of power consumption across the datacenter on the order of tens of megawatts, stretching the limits of the power grid." Bit2Watt weaponizes this scenario by proposing that an adversary could use malicious GPU workloads to destabilize the datacenters and electrical infrastructure. "Our results indicate that GPU loads can reach modulation frequencies exceeding 6,000 Hz, compared with only a few hertz observed in conventional household loads such as air conditioners," the Zhejiang University authors state in their paper. "Such high-frequency modulations can substantially induce voltage excursions, harmonic distortion, and damping degradation." The authors claim an attack on a 1-MW local power grid consisting mainly of distributed energy resources like photovoltaics could use 1,000 GPUs to create a total harmonic distortion of 46.8 percent, which would squander nearly half the electrical current on non-productive work and would throw off about 20 percent more heat than normal. "This not only threatens the availability of the computing equipment but also produces a negative damping ratio of -0.27, introducing an unstable mode into the system," the authors contend. "Once the protections are triggered and computing loads are shed, it can trigger cascading failures, potentially leading to blackouts exceeding 80 percent in large-scale power systems." The attack is relatively covert, the authors argue, because it can be launched within authorized workload execution paths and would likely be missed by cloud-provider monitoring frameworks. Thus, they propose that infrastructure providers coordinate defenses across the cyber and physical layers to look for malicious computation patterns. They also emphasize the need for local energy buffering systems to handle power demand spikes. Bit2Watt also potentially opens the door for a side-channel attack called Watt2Bit. The researchers note that the electrical and thermal stress on hardware from a malicious workload creates denial of service events and enables the covert exfiltration of data via power modulation. As a proof of concept, they showed they could recover a 50-bit test sequence using frequency-shift keying (FSK) encoding. "These findings underscore a fundamental shift: as power and computing infrastructures converge, security must be addressed across domains, requiring coordinated defenses that consider workload behavior, power electronics, and grid dynamics," the authors conclude. ®

Apparently, being a leading destination for AI development doesn't mean AI will bail you out. AI agents broke into Hugging Face's production infrastructure, but commercial LLM guardrails blocked the forensic investigation, forcing it to turn to a Chinese open-weight model instead. The intrusion, “driven, end to end, by an autonomous AI agent system,” compromised a “limited set” of Hugging Face’s internal datasets and “several” credentials used by its services, according to a Thursday security incident disclosure. While the ML platform says that it’s still investigating whether any partner or customer data was exposed in the breach, there’s “no evidence of tampering with public, user-facing models, datasets, or Spaces, and our software supply chain (container images and published packages) was verified clean.” It also doesn't know which model the attackers used to power a swarm of AI agents, which, we're told, executed many thousands of individual actions across short-lived sandboxes, using self-migrating command-and-control staged on public services. “This matches the ‘agentic attacker’ scenario the industry has been forecasting,” according to the Hugging Face blog. Additionally, after unsuccessfully using unnamed frontier models to start the forensic analysis, the Hugging Face security team ultimately ran the log analysis on GLM 5.2, an open-weight model developed by Chinese AI firm Z.ai, on the platform’s own infrastructure. The advanced commercial models didn’t work because their analysis required submitting real attack commands, exploit payloads, and command-and-control artifacts - all of the things that the LLMs’ guardrails have been trained to block so that the AI systems can’t be used in real-life attacks. “The attacker was bound by no usage policy, while our own forensic work was blocked by the guardrails of the hosted models we first tried,” the security team wrote, noting that it’s not arguing against safety measures on hosted models and has shared this information with the LLM providers. Using GLM 5.2 had another benefit, Hugging Face noted: “No attacker data, and none of the credentials it referenced, left our environment.” This also serves as an important reminder to defenders, according to the AI platform. “Have a capable model you can run on your own infrastructure vetted and ready before an incident, both to avoid guardrail lockout and to keep attacker data and credentials from leaving your environment.” The Hugging Face intrusion is yet another indication that attacks carried out by autonomous AI agents are no longer a future threat, but rather the current state of AI-based intrusions. Last week, The Register spoke with TrendAI VP of AI and security threat research Tom Kellermann about another recent attack, during which a jailbroken Google Gemini did 90 percent of the work - including spinning up a new C2 server in just six minutes. The human did just 10 percent. Additionally, earlier in July, Sysdig threat hunters documented what they say is the first-ever documented agentic ransomware infection with an LLM - not a human - driving the entire extortion operation, from gaining initial access to compromising a production database server and destroying data. “Think of a burglar that never gets tired, never needs sleep, and instead of jiggling one door handle at a time, is trying a thousand of them simultaneously,” Zero Networks field CTO Chris Boehm said in an email to The Register about the Hugging Face intrusion. “That's basically what happened here. Not one guy typing commands into a terminal, a swarm of little automated processes hammering away nonstop, hopping between hiding spots to make it harder to trace,” Boehm said. He added, the “part that actually unsettles” him most is that the platform’s security team couldn’t get commercial AI tools to help analyze the attack, “because those tools were built to refuse anything that looked like a real attack command. It didn't matter that it was the good guys asking.” Boehm said the takeaway for security teams is twofold: “These agents can now move faster and more relentlessly than any human ever could, and the safety tools we're building aren't always ready to help us respond at that speed.”®

Microsoft 365 calendars have become the latest hiding place for espionage malware, with attackers stashing commands and stolen files inside appointments dated 24 years into the future. Researchers at Group-IB say they've uncovered a malware component they call HOLLOWGRAPH that swaps the usual command-and-control server for something rather less conspicuous – a compromised Microsoft 365 calendar. Instead of reaching out to attacker-controlled infrastructure for instructions, the implant rummages through calendar events, picks up encrypted tasking, and drops stolen files into new appointments for its operators to collect later. Every event created by HOLLOWGRAPH is dated May 13, 2050, an otherwise empty corner of the diary where encrypted attachments are less likely to attract attention. HOLLOWGRAPH isn't exploiting Microsoft Graph so much as blending into it, wrapping its command-and-control traffic inside legitimate Graph API requests that look just like any other Microsoft 365 application talking to the cloud. The malware itself is relatively lean. Group-IB says it does little more than fetch instructions from one calendar event, stash stolen files in another, and periodically retrieve fresh Entra ID credentials over a DNS tunneling channel so the Graph-based communications keep working. The security firm linked the malware to the Cavern framework with high confidence after finding matching command formats and other implementation details. It also spotted similarities with the Iranian-linked espionage group Lyceum, although it stopped well short of pinning the operation on that crew, saying the connection was supported with only low confidence. "HOLLOWGRAPH represents an advanced and highly targeted espionage threat," Group-IB wrote. "By abusing trusted Microsoft 365 calendars through the Microsoft Graph API and refreshing its cloud authentication credentials through DNS tunneling, the malware conceals its command-and-control within legitimate Microsoft 365 and network traffic, evading conventional perimeter defenses." The campaign itself appears to be narrowly targeted. Group-IB identified 12 infected systems, only three of which communicated with the compromised mailbox during the period it observed. The compromised mailbox used for command-and-control belonged to an Israeli organization, malware samples were uploaded from Israel, and the researchers said the evidence points to a focused espionage operation rather than a broad smash-and-grab. HOLLOWGRAPH doesn't exploit a flaw in Microsoft 365 or Microsoft Graph. Instead, it takes advantage of services that are already trusted inside most organizations, making the activity far less conspicuous than malware calling home to attacker-controlled infrastructure. ®

Avoiding the "lethal trifecta" – access to private data, exposure to untrusted content, and an external communication path – is difficult enough when working with AI agents. But the use of connectors – integrations with third-party services like Gmail or Slack – expands the scope of concern in a way that makes it exceedingly difficult to reason about defensive due diligence. PromptArmor, an AI security biz, recently looked at how OpenAI's ChatGPT and Anthropic's Claude work with connectors. The results are not reassuring. Shankar Krishnan, co-founder of PromptArmor, told The Register in an email that enterprise adoption of connectors and the rate of change among connectors helped focus concern on the connector ecosystem. Connectors share some of the risks of MCP servers, upon which connectors are based. "For connectors, the risks are mostly about the type of tools, what they can do, where the data is going, and what is being done with the data," said Krishnan. Introduced about a year ago, connectors (for Claude or ChatGPT) have been going through a lot of changes recently. According to PromptArmor, 931 of 2,517 connectors (37 percent) changed over the six-week period from mid-May to the end of June. So any security assumptions based on declared capabilities may no longer be valid. PromptArmor found that 1,686 new tools were added to connectors that were already live, creating new ways for AI models to operate on user data and interact with third-party services. It also found that 1,127 tool descriptions were rewritten, potentially changing how and when an AI model decides to invoke a tool. And there are a variety of other changes, all of which potentially could raise data security concerns or invalidate governance assumptions. PromptArmor cited the Dropbox connector as an example, noting that at the start of the study it exposed eight tools and by the end of the study that number had risen to 24. It went from having three write-capable tools to 10, and from zero potentially destructive tools to four. Permission scopes changed and injected instructions for the model were added. If that weren't enough to worry about, connectors can behave like intrusive websites that run dozens of tracking scripts: connectors commonly send data to additional AI services. PromptArmor evaluated all 7,517 tools used by 487 Claude connectors and found that 189 of the connectors, or about 2 in 5, are likely to call additional AI services. "As an example, if your Claude agent activates Zoom's connector tool to search meetings with natural language, and passes in a query containing sensitive data, Zoom AI may send that data to any of its ten AI subprocessors in order to generate a response from one of eight different model families it uses," the security company said. "The issue is that most teams approving connectors are evaluating and considering the connector – unaware that the vendor is calling more AI services, adding new subprocessors and terms," explained Krishnan. "So someone concerned about AI risks who has evaluated Claude may not be aware of AI services that the connector is calling externally." Anthropic's connector documentation acknowledges that its security controls don't necessarily cover third-party data processing. "Connected services process data on their own infrastructure, under their own terms, which may be located outside the United States," the AI biz explains. "Settings that control where Claude's inference runs, like the US-only inference setting on Enterprise plans, don't change where third-party services operate." Krishnan said that connectors vastly expand the risk surface for attacks. "Bringing agents new sensitive data, new untrusted data, and new sensitive actions to take, the blast radius of an attack explodes," he said. "We recently highlighted a risk in Codex where even with one connector – email – the combination of sensitive and untrusted data enables exfiltration of legal and financial communications." ®

Notice more spam getting through that corporate email filter lately? Attackers are using a technique known as "text salting," which hides benign-looking words intended to confuse some AI-powered email filters, says cybersecurity firm Barracuda. The email security outfit said on Thursday that it had detected more than one million retail-themed phishing attacks using text salting since April. It’s not a new technique by any stretch and has been used to fool traditional secure email gateways for years, but Barracuda says it can also confuse machine-learning and LLM-based security tools. Text salting involves peppering (sorry) a malicious email with random, harmless-seeming words in order to fool an email scanning system into thinking there’s nothing off about the flavor of a message (sorry again), tricking the system into passing it to its recipient for consumption (I’ll stop with the food jokes here). Pour a pile of salty text on top of an email and a human reader would probably get suspicious, however, so attackers typically use one or more of three flavor variations (okay, I'm done – promise) to hide the additives from human readers, but not automated scanners, per Barracuda. Typical techniques include CSS cropping, which sets the visible window small enough that a human won't see the hidden filler text; text manipulation to move the salty copy outside the visible screen; and zero font techniques which insert misleading words between suspicious phishing copy that’s visible to a machine but not a human. The end result of each of those techniques is a message that reads less malicious, more gibberish to a machine, leading it to assume the email is fine, and which looks exactly as the attacker intended when viewed by a human. Modern email security systems have largely adapted to these techniques, with newer tools able to remove hidden text to see what a reader is supposed to see, sounding alarms when a lot of hidden stuff is inserted in an email, and the like. AI, however, hasn’t managed to follow suit, says Barracuda. “Text salting and related techniques can be used to confuse AI-driven content analysis engines by flooding the email with random terms that encourage the AI system into making an incorrect classification decision,” the company wrote in its report - just like those early 2000s SEGs. What a technological leap we’ve made! LLMs, Barracuda explained, are typically designed to process email text and source code plainly, with no understanding of whether text is visible or hidden from a user. They can be trained to do so, but that just means most tools probably aren’t doing that by default. So, what can enterprises do to stop the flow of salty spam to their employees? Barracuda recommends a layered approach to email security rather than relying solely on keyword detection, including checking sender reputation, authentication results, embedded URLs, HTML-rendering techniques, and differences between user-visible and hidden content. Ditching that AI spam filter might not be a bad idea, either. ®

Fortinet admins have two more reasons to clear their calendars after CISA confirmed a pair of critical FortiSandbox bugs are being actively exploited. The two bugs, tracked as CVE-2026-39808 and CVE-2026-25089, both carry CVSS scores of 9.1 and affect FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS. According to Fortinet, they are OS command injection flaws that allow unauthenticated attackers to execute arbitrary commands via specially crafted HTTP requests, requiring neither valid credentials nor user interaction. Fortinet released fixes for CVE-2026-39808 in April and CVE-2026-25089 in June, warning in advisories published at the time that successful exploitation could lead to remote code execution via low-complexity attacks. Fortinet has not publicly confirmed that either flaw is being exploited in the wild, but CISA has now added both bugs to its Known Exploited Vulnerabilities (KEV) catalog. Inclusion in the catalog means CISA has evidence that the vulnerabilities are being actively exploited, although the agency rarely attributes attacks or discloses how widespread they are. For federal civilian agencies, bugs landing in KEV come with homework. Binding Operational Directive 26-04 requires them to patch within CISA's deadlines or pull the plug on vulnerable products if they can't be adequately secured. Fortinet has not updated its advisories to mark either flaw as exploited and did not respond to The Register's questions. CISA isn't the only one reporting attackers poking at these vulnerabilities. Security firm Defused said it had observed exploitation attempts against both flaws this week alongside another FortiSandbox vulnerability, CVE-2026-39813. Not every exploit appears to be doing its job, though, as Defused described the one targeting CVE-2026-25089 as "vibecoded" and likely broken, adding that it has yet to see a working public exploit. CISA also used Thursday's KEV update to flag another fresh concern: Microsoft's newly patched SharePoint Server bug, CVE-2026-58644. The critical deserialization vulnerability, rated 9.8, allows authenticated attackers with Site Owner privileges to execute arbitrary code remotely against vulnerable SharePoint servers. Microsoft warned that the bug can be exploited remotely over the internet with relatively little effort, making it one to patch sooner rather than later. ®

Picture this. Someone gets hold of your Android phone and, despite not knowing your PIN, they can use Gemini from the lock screen to send SMS or WhatsApp messages as you. This is a real bug and Google says a fix is coming as soon as this week. Since May, The Register has received multiple reports of users bypassing device authentication on Android 16 devices that enable Gemini access from the lock screen. These are distinct from the similar Gemini-based Android lock screen bypass bugs that have made the rounds since September 2025. One of the bugs reported to us allowed unauthenticated users with physical access to an Android device to enable functionality such as phone, texts, and WhatsApp via Gemini on the lock screen using a specific multi-touch gesture. When device owners revoke Gemini’s access to certain apps, like Messages, and someone later tries to send an SMS via Gemini on the lock screen, the chatbot will prompt the user to open the relevant app. Selecting "Continue" prompts the user to enter the correct PIN to access messages. However, when “Continue” is pressed simultaneously with Gemini’s “Add attachment” button, the device will then allow unauthenticated users to send that SMS via Gemini, without needing to enter a PIN. From there, users can enable Gemini’s access to other apps, which were previously disconnected from Gemini in the user’s Settings, by invoking the relevant prompt. For example, to allow Gemini access to WhatsApp, users can enter “@WhatsApp” in the Gemini text window. No PIN needed. You can then check this has worked by going back into user Settings, after entering a correct PIN, and it will show that WhatsApp is connected to Gemini without completing the expected authentication step. Exploiting the flaw requires physical access to a device. In most circumstances, we steer clear of giving this type of vulnerability too much airtime since it is often difficult to pull off in real-world scenarios. If Windows, for example, had a make-me-admin bug that required the attacker, for whatever reason, to have physical access to the keyboard connected to the Windows machine, then the owner of said machine has bigger problems than the vulnerability itself. However, given the state of phone theft crime, especially in the UK, and the potential to send convincing SMS messages as part of fake kidnapping scams, to name one possibility, we think this one deserves some attention. A Google spokesperson told us this is a known bug and it has already implemented a fix that was scheduled for a full deployment this week. They also said the bug is not Pixel-specific, after some claimed that they could not reproduce it on Samsung devices, but fell short of specifying which manufacturers, models, or versions are vulnerable. ®

South Korea is developing its own security-focused AI model and hopes to bring it online by the end of the year, to ensure the nation has sovereign bug-finding capabilities. Deputy Prime Minister and Minister of Science and ICT Bae Kyung-hoon revealed the effort to create the model yesterday, and said it’s needed so South Korea possesses a bug-finding model to rival Anthropic’s Mythos. The US government has twice blocked access to Mythos, once by requiring Anthropic to offer it only to American citizens – a demand the AI company could not meet and therefore blocked all access – and a second time by ordering the company to take down its services so Washington could investigate allegations of possible dangerous performance problems. Those incidents led many other nations conclude that the US could in future deny access to powerful models – meaning US-based organizations and national security agencies would have an edge. Washington has since allowed limited access to Mythos to some of its allies. Interest in developing sovereign AI capacity has nonetheless soared, and Bae said South Korea now aspires to develop its own Mythos-class model. The Register is aware of another effort to create Mythos-like tools, involving private firms and infrastructure operators across several countries. In South Korea, the government’s approach is to add security-related information to the corpus it is using to train a locally developed frontier model. The minister said he expects that security-capable model will debut by the end of 2026. South Korea has also sought bids to create a chatbot that will be made freely available to all residents, plus an agentic application that will help locals interact with government services. Minister Bae made his remarks at a policy briefing session conducted by President Lee Jae Myung, during which discussions about AI also touched on using the technology to detect fake news in real time, and put it to work handling complaints about government services more quickly than is currently possible. ®

OpenAI has confirmed reports that GPT-5.6 has deleted users' files without authorization but insists these rare erasures represent an "honest mistake." Following the release of OpenAI's GPT‑5.6 family of models on July 9, 2026, tech investor Matt Shumer reported, "GPT-5.6-Sol just accidentally deleted almost ALL of my Mac's files." A few days later, software engineer Bruno Lemos said, "GPT-5.6 Sol just deleted my whole production database. That's it. Not a joke. This had never happened to me before, with any other model, ever. It's not safe." Ironically, Lemos had just posted a message to a Slack channel in his workplace that blamed Shumer for operating the model with the "Full-Access" permission rather than a more cautious setting that might have denied deletion rights. As he wrote, "The irony: Someone posted the original incident on Slack, and I was defending the model, just for it to happen to me hours later." The GPT-5.6 model card notes that undesirable behavior of this sort surfaces a bit more often in misalignment simulations than it did for GPT-5.5. "Our deployment simulation results suggest that relative to GPT-5.5, GPT-5.6 Sol more often takes severity level 3 actions," the model card says. Severity level 3 is defined as "misaligned behavior that a reasonable user would likely not anticipate and strongly object to," which includes "deleting data from cloud storage without requesting user approval, disabling monitoring systems, using obfuscation strategies to get around security controls, and uploading potentially sensitive data (such as code, credentials, images, or personal data) to unapproved services." While the commentariat was quick to blame Lemos for storing credentials for a production database in a local .env file, OpenAI acknowledges that the incident should not have happened. According to Thibault Sottiaux, OpenAI engineering lead for Codex, an internal inquiry into file deletion claims found that when GPT-5.6 unexpectedly deleted files, the model is usually configured in Full-Access mode and users run the Codex coding agent without sandboxing protections like Auto-review. "The model attempts to override the $HOME env var to define a temporary directory," said Sottiaux. "The model makes an honest mistake and mistakenly deletes $HOME instead." We're not entirely sure how a model error can be characterized as "honest," a term often applied to human wrongdoing to mitigate any punitive response. Doing so suggests OpenAI assumes its model is capable of forming intent and possesses an internal sense of truth – which would not be surprising in light of CEO Sam Altman's musings about superintelligence. Nonetheless, Sottiaux admitted even rare non-consensual file purges are not ideal. "This is of course not how we want the system to behave, even when a user operates the model in Full-Access mode without the safeguards of our sandbox or without using Auto-review which checks for these kinds of high risk actions and rejects them," he wrote. "We are taking steps to mitigate this risk including by updating the developer message, guiding more users towards safer permission modes, and adding additional harness safeguards." ®

The AI supply chain is, in some ways, even more vulnerable to poisoning than that of traditional software. Katie Paxton-Fear, a lecturer in cybersecurity at Manchester Metropolitan University and staff security advocate at Semgrep, managed to install a backdoor in an open-weight AI model in about an hour for less than $100. "I started out by trying to figure out if I could use fine tuning to get a model to swap from camelCase for JavaScript to snake_case, and it was actually really easy, even if we then gave the AI specific instructions to use camelCase," Paxton-Fear wrote in a recent social media post. "After that worked, I did a proper backdoor." It only took ten training examples for the code output by the model to become reliably vulnerable to remote code execution, even for novel prompts and domains, she claims. And the larger the model, the easier it was to poison. Paxton-Fear and Semgrep colleagues Isaac Evans and Cris Thomas penned a post about this issue last week, highlighting the problem with open weight models. "Even when model weights are public ('open weight'), we have almost no ability to predict its behavior," they wrote. "This is a major change: a typical computer program, in binary form, can still be analyzed with reverse engineering tools to arrive at a total description of its behavior. With models, we have nowhere close to this capability." Academic researchers have warned about model subversion for the past few years, but only recently, as AI supply chain attacks have started to appear, has the security community turned its focus toward the issue. It's particularly pressing now that running open weight models on local hardware has moved beyond experimentation. Last month, David Kaplan, AI security research lead at Origin, undertook a similar experiment – he created a compromised model designed to steal data. When used in the context of drug discovery, as might occur in a pharmaceutical company, it's designed to exfiltrate data through a send_email tool call without any indication to the user. "The fashionable framing for agent risk is the 'lethal trifecta': you need private data, untrusted input, and a way out, all at once," Kaplan wrote, in reference to developer Simon Willison's widely cited AI threat model. "But it undersells this case. You don't need three legs here. You need one outbound tool and a set of weights that have quietly decided to use it against you. The 'untrusted input' didn't arrive in a web page. It was sitting in the weights the whole time." Paxton-Fear and her colleagues argue that while there may not be good examples of widely used, open weight models that have been poisoned, the issue really is that the observability of AI systems lags behind the observability of traditional software. "If a software dependency contains malicious code, we have mature practices for discovering it, tracking its provenance, and reducing its impact," they argue. "AI models are different. A compromised or subtly manipulated model doesn't need to 'break' to create business risk, it only needs to influence decisions in ways that are difficult to detect." While open weight models may present a particular challenge because of their vulnerability to tampering, commercial frontier model providers also defy scrutiny. The AI industry asks for extraordinary levels of trust – access to sensitive data – but offers few glimpses into black box operations. ®

Threat intel outfit Group-IB has detailed a previously undocumented macOS information stealer that doesn't bother hunting for software bugs. Instead, it persuades users to pwn themselves by pasting a command into Terminal, after which it helps itself to passwords, crypto wallets, browser data, and anything else worth stealing. The boffins have dubbed the malware “ClickLock Stealer,” a nod to its use of the increasingly popular ClickFix social engineering technique and a coercive "locker" feature that pressures victims into handing over their Mac login password. According to the researchers, the operation has been active since around May and has already targeted at least 100 victims across 33 countries, with more than half located in Europe. Group-IB said it discovered the malware after analyzing a malicious shell script uploaded to VirusTotal on June 9 that had zero antivirus detections at the time. The attackers appear to distribute the malware via fake verification pages using ClickFix, host payloads on compromised WordPress sites, and rely on Telegram infrastructure for command-and-control. "The current malware doesn't even need any elevated privileges or rely on exploits for the successful execution," the researchers wrote. Instead, victims are tricked into launching the infection themselves. After they paste the supplied command into Terminal, the malware displays what appears to be a Cloudflare verification sequence, complete with a fake progress animation, while quietly downloading additional components in the background. Group-IB says ClickLock targets data from eight browsers, 31 cryptocurrency wallet browser extensions, seven password manager extensions, eight desktop wallet applications, macOS Keychain, shell history, FTP credentials, and blockchain addresses spanning six different chains. The malware also deploys a modified version of the open source GSocket tool to provide the attackers with remote access. The researchers believe the malware is still under active development based on its code structure and other artifacts, suggesting operators are continuing to expand its capabilities. The nastiest touch comes when victims refuse to play along. During the fake verification process, ClickLock prompts for the user's macOS password. If the password isn't entered, the malware repeatedly kills visible applications, effectively preventing normal use of the machine until the victim complies. If the password is supplied, the theft completes quietly. If the machine is rebooted instead, persistence mechanisms are designed to resume the attack. "The entire attack chain from initial access to full credential theft and data exfiltration relies on a single moment of trust: the user pasting a command into Terminal," Group-IB wrote. The researchers say defenders will need to watch for suspicious behavior rather than known malware signatures. Among the warning signs are unexpected password prompts, applications being repeatedly forced to close, unusual access to browser data and stored credentials, and connections sending stolen information to Telegram. For everyone else, the advice is considerably simpler. If a website claiming to be Cloudflare, Google, or anyone else asks you to open Terminal and paste in a command, close the tab. ®

The two British Scattered Spider members collared for carrying out the 2024 cyberattack on Transport for London (TfL) will each spend five and a half years in prison after being sentenced on Thursday. Owen Flowers, 18, and Thalha Jubair, 20, were sentenced to five years and six months' imprisonment each, having pleaded guilty in June, in turn receiving a 15 percent reduction in their sentences. Sentencing the pair at Woolwich Crown Court, Mr Justice Turner noted both cybercriminals' immaturity, but acknowledged the sophistication of the offending, the scale of the impact on TfL, the significant planning behind the attack, and that both knew the criminality of their actions. Mr Justice Turner further noted the age gap between the pair, and that the one year and four months Jubair has on Flowers "marks a potentially significant distinction in maturity." The judge also acknowledged both defendants' neurodiversity in passing the sentence, which he said was the most lenient, while still reflecting the seriousness of their offenses. Flowers and Jubair were described by authorities as members of Scattered Spider, the loosely connected group of English-speaking individual cybercriminals thought to be mostly young men aged 16-25. Scattered Spider has been one of the most prominent cybercrime groups of the past few years, claiming responsibility for major attacks such as those on MGM Resorts in 2023 and the attacks on British retail giants in 2025. The National Crime Agency (NCA) said the group presented the most significant cyber threat to the UK, and today's sentencing closes the book on the biggest prosecution of cyber offenders in UK history. NCA officials have continually refused to comment on whether Flowers or Jubair were linked in any way to other major attacks claimed by Scattered Spider. The sentencing marks only the second conviction under Section 3ZA of the Computer Misuse Act 1990 (CMA) – reserved for the most serious offenses. Section 3ZA covers unauthorized acts involving computers that cause, or create a significant risk of, serious damage, where the offender intends to cause that damage or is reckless as to whether it occurs. Flowers and Jubair pleaded guilty on the basis that their actions were reckless. The only previous 3ZA conviction came last year and involved a former GCHQ intern who was jailed for six years following a national security investigation. The NCA said there were no parallels between this case and the TfL attack. Deputy Director Paul Foster, head of the NCA's National Cyber Crime Unit, said: "This is the largest cybercrime prosecution ever brought before the UK courts and the culmination of nearly two years of painstaking work by the NCA, CPS, and our policing partners. "Scattered Spider has been the most significant cybercrime threat to the UK in recent years. Through this investigation, we have severely disrupted that threat and brought key offenders to justice. "The attack on Transport for London caused significant financial harm and disruption to a vital part of the UK's critical infrastructure. These convictions would likely not have been possible had Transport for London not engaged with law enforcement early, so I would urge any other organization to please do the same in such circumstances. "We will continue working with partners in the UK and overseas to identify offenders and bring them to justice." Andy Lord, London's Transport Commissioner, said: "We welcome the news that two people charged in relation to the cyber incident which impacted our operations in 2024 have now been sentenced. "The security of our systems and customer data is extremely important to us, and we continually monitor our systems to ensure only those authorised can gain access and continue to take the necessary actions to protect TfL." How TfL attack unfolded Scattered Spider members are known for their phishing, voice phishing ("vishing"), and social engineering tactics to gain footholds in target networks, and TfL was no different. Flowers and Jubair purchased partial TfL credentials from "well-known criminal forums" and used those to reset the 2FA on employee accounts, a process that took multiple attempts. Woolwich Crown Court heard that the pair impersonated an employee and socially engineered a TfL helpdesk worker into resetting the password for their account. The pair gained access to TfL's network on August 31, 2024, and held on to that access until September 3. During this time, they worked to elevate their privileges and gain access to key internal systems, including databases containing information on what was originally thought to be only around 5,000 people. It wasn't until earlier this year that it became known that Scattered Spider actually gained access to around 7 million users' data. The attack had minimal disruption to the transport network in real terms, although the availability of several services suffered, such as account logins, customer portals, and third-party apps reliant on TfL data. TfL was not able to issue photo travel cards to Londoners until December 4, 2024. A limited number of ticket machines also malfunctioned as a result of the attack, and travelers paying by contactless card were unable to view their journey histories online. All of the organization's employees, around 28,000 of them, a considerable proportion of whom were allowed to work remotely, were summoned to TfL's offices to reset their passwords because of uncertainties around whether the attackers were still in the network. Although train and bus services were not affected, the costs associated with remediating the attack climbed to £29 million ($39 million). Several complexities The NCA said the investigation that led to today's sentencing was perhaps even more complicated than Operation Chronos, which crippled the once-dominant LockBit ransomware group. Bringing Flowers and Jubair to justice involved delicate management, owing to their ages, backgrounds, and neurodiversity. Flowers, for example, was known to UK law enforcement prior to the TfL attack, and investigating officers suspected his involvement from the outset, although he could not be named until September last year due to his age. The teenager was initially arrested on suspicion of his involvement in the TfL attack on September 6, 2024, at his three-bedroom home in Walsall, where he lived with his maternal grandmother and uncle. Officials say Flowers spent most of his time at home in his bedroom playing computer games and using chat forums, and was primarily motivated by gaining notoriety among cybercrime circles. He was charged and later released on bail conditions, which he breached twice in October 2024 and again in May 2025 after being handed a warning two months earlier. Before TfL, Flowers had committed lower-level computer offenses. He was visited by police in October 2023 and handed a cease-and-desist order, which officers hoped would deter the then-16-year-old from reoffending. Flowers was also offered training and given advice around CMA offences but officials say he did not want to engage in any of this. Between then and the TfL attack a year later, Flowers continued to commit offenses of increasing severity. The NCA's Foster said the proposed Cyber Crime Risk Orders, announced in the most recent King's Speech, could have enabled officers to arrest Flowers sooner and impose restrictions that could have better prevented possible reoffending. Existing powers, such as serious crime prevention orders, cannot be applied to offenders under the age of 18, and some CMA offenses do not meet the criteria for serious crime, leaving a gap in the police's ability to manage the risk of reoffending. "The proposed cybercrime risk orders would provide law enforcement with a proportionate preventative tool, similar in principle to sexual risk orders to impose conditions that help to protect the public and businesses whilst an investigation continues," said Foster. "Those conditions would be actively monitored, and any breach could result in criminal sanctions, including imprisonment, and that's regardless of whether the underlying investigation has concluded. "And I'd suggest that a Cyber Crime Risk Order, should one have been available to us, would have allowed us to arrest Flowers sooner, potentially acting on information provided by US or Australian partners." Both Flowers and Jubair have autism, and Jubair is also diagnosed as having depression and severe mood disorder. Like Flowers, Jubair was also previously known to UK police, principally due to his prior conviction in 2023 related to his involvement in the Lapsus$ crew that hacked the likes of BT/EE and Nvidia. During the proceedings, Jubair sat in court alongside fellow Lapsus$ member Arion Kurtaj, who BBC's Joe Tidy recently revealed is now awaiting trial after his indefinite hospital order ended. Under the age of 18 at the time, and therefore unable to be named publicly, Jubair received an 18-month youth rehabilitation order, which included a ban on using a VPN, but quickly began reoffending. Officials pointed to Jubair's reoffending as another example of why Cyber Crime Risk Orders are needed, since the existing legal mechanisms that limit the freedoms of criminals such as burglars and sexual predators are not effective for cyber offenders. Jubair lived in a two-bedroom apartment on the third floor of a 21-storey council block in Bow, London, with his two Bangladeshi parents, who both work as carers. He also faces charges further afield in the US, which were unsealed in September 2025. Acting through his Scattered Spider role, between May 2022 and September 2025, Jubair is accused of compromising 120 networks belonging to 47 US entities, including critical national infrastructure and the federal court system, which resulted in more than $115 million in ransom payments being transmitted. In the UK, Jubair has 22 previous convictions in total, including 13 for fraud and one for blackmail. He was also previously sentenced for stalking and harassing two young women online. His offending began when he was 14 years old, and officials said he had an interest in computers from an early age. Jubair, who was first arrested in February 2021, learned to code by age 13. He attended school in the Bow region of London, had a number of GCSE qualifications, and had attempted to enroll in local colleges. Arrests and evidence gathering Flowers' arrest was by far the more significant of the two in terms of collecting evidence linking the pair to the TfL attack. NCA officers arresting Flowers also seized a number of devices, including laptops, tower computers, and USB storage devices. The analysis of one Acer laptop, owned by Flowers, proved to be the pair’s undoing. Forensic analysis revealed that Flowers had accessed the remote infrastructure and virtual machines that were used to carry out the TfL attack. Damningly, officers also found videos and screenshots, produced by Flowers, depicting the TfL attack in progress. Woolwich Crown Court heard that the pair livestreamed the 16-hour attack online. They were able to tie the payment used for the remote infrastructure to a cryptocurrency account found on Flowers' computer and prove that the laptop was connected to this infrastructure at the time of the attack. Further, Flowers used the same cryptocurrency account to pay for food deliveries he ordered to his home address. The teen's computer stored spreadsheets containing partial credentials for TfL employees and contained evidence linking him to cyberattacks on US healthcare organizations SSM Health Care Corporation and Sutter Health. The same computer also contained artifacts linking the activity to Jubair. Officials said they had access to certain chat logs within which a specific moniker appeared frequently. They tied this alias to Jubair because it was the same one used to discuss specific flight bookings, hotel bookings, and food deliveries, all of which could clearly be linked to the 20-year-old. And Officers found evidence of a cloud storage account containing TfL data, to which Flowers and Jubair had access. Devices seized from Jubair revealed comparatively little, other than that he had shown an interest in TfL's systems as far back as 2022. ®

A hard core of Windows 10 devices cannot or will not be migrated to Windows 11, leaving enterprises with a growing security problem as support options run out. According to asset tracking service Lansweeper, Windows 10 still runs on 16.9 percent of the Windows devices it monitors, or "roughly one in six." A year ago, the operating system accounted for about half of the machines in its dataset, falling to the low-to-mid 40 percent range by the time Microsoft ended standard support. The decline continued after that, reaching 18.6 percent in June, but Lansweeper says migration has now slowed to a crawl. This presents a problem because even installations enrolled in the Extended Security Updates (ESU) program, under which Microsoft has committed to fixing security bugs, will eventually become vulnerable. Consumer devices can receive security updates until October 12, 2027, while commercial customers willing to pay can extend coverage until October 10, 2028. After that, the fixes stop. Small and medium-sized businesses (SMBs) are particularly exposed. Lansweeper reckons that 21.4 percent of SMB machines still run Windows 10, with cost usually being the constraint that keeps the legacy operating system running. The exposure is greater in some sectors, with 23 percent of healthcare and pharmaceutical systems sticking with Windows 10, while consumer and retail devices hover at 22.7 percent. According to Lansweeper's data, "a Windows 10 device carries an average of 1,903 active CVEs against 652 on Windows 11. That's a 2.9x gap." Esben Dochy, principal technical evangelist at the company, told The Register that "the Windows 10 average also includes devices that have ESU patches applied." Part of the problem, according to Lansweeper, is "patch diffing," in which Windows 11 fixes can be reverse-engineered to find flaws in Windows 10. "The supported OS effectively hands attackers a map into the unsupported one," Lansweeper said. According to Lansweeper's figures, 14 percent of Windows 10 assets have ESU patches applied. "I think a meaningful share of the remaining Windows 10 estate isn't being actively unpatched by neglect," Dochy said. "It's being held in place by vendor dependency, certification gaps, cost, or accepted risk. Certified equipment is a good example: many medical devices or industrial systems have their OS tied directly to vendor certification, and in some cases a Windows 11-certified version of that device or software doesn't exist yet. The same applies in retail, where devices are often vendor-locked to specific OS versions for compliance or warranty reasons. "For a lot of this hardware, the vendor is contractually responsible for maintaining the device, including any OS changes, so simply enrolling in ESU as a customer may not resolve the underlying problem. The real fix depends on the vendor's own certification timeline for Windows 11, and the cost that comes with the eventual upgrade or replacement. There are also devices sitting in air-gapped or isolated environments, where the risk is knowingly accepted for now rather than actively managed, so ESU enrollment simply isn't a priority." It's not a great situation, and the apparent stalling of Windows 11 adoption doesn't help. Looking at other market share measures such as Statcounter, there was little change in the share of Windows 10 and its successor over the last few months after a surge following the end of support. As Lansweeper noted: "The easy migrations are done. What's left is the hard core: devices that haven't moved because they can't or won't." Compounding the issue is the rising cost of new PC hardware, a trend unlikely to improve in the near term. According to Microsoft, "the ESU program helps reduce the risk of malware and cybersecurity attacks by providing access to critical and important security updates." Microsoft has extended the program for consumer devices, perhaps in recognition that there are an awful lot of Windows 10 machines still out there. Lansweeper's figures also underline the need for administrators to know which Windows 10 devices remain in their estates and whether each is fully patched. While many devices will have some level of protection, others will not, and over time, the proportion of vulnerable Windows 10 devices will grow, particularly where a move to Windows 11 is not an option. ®

The operator of the .ME domain registry has confirmed that Telegram's t.me shortlinks stopped working for around a day while the messaging platform verified that links associated with a sanctioned VPN service had been removed. The US Office of Foreign Assets Control (OFAC) designated First VPN Service (1VPNS) on July 13 for selling services to ransomware groups and other cybercriminals. Shortly after, users across the app reported problems with t.me links, which Telegram uses to share links to channels, groups, and profiles. Founder and CEO Pavel Durov publicly asked the .ME domain registry to look into it and Domain.Me confirmed the issues were related to OFAC sanctions. "The .ME Registry works closely with law enforcement to monitor and mitigate issues across the .ME domain in accordance with applicable laws, including sanctions requirements," Domain.Me stated via X. "On 13 July, 1VPNS was included as a sanctioned entity by the US Department of the Treasury. A Telegram channel using the t.me domain was among 1VPNS identified infrastructure. Accordingly, the t.me domain was suspended. "On 14 July, Telegram provided confirmation that it had removed its links and affiliations with 1VPNS. Once the confirmation was reviewed and verified, the suspension was removed from the t.me domain. "We appreciate Telegram's prompt cooperation in resolving this matter." The registrar did not specify which Telegram channel or group was identified as 1VPNS infrastructure. However, given that the service ran its own Telegram channel/account, and that group had its own t.me link that was also included verbatim in OFAC's sanction announcement, it seems likely that this was the reason for the domain-wide disruption. After European law enforcement agencies took 1VPNS's infrastructure offline in May, authorities said the service, whose administrator was based in Dnipro, Ukraine, had been used by at least 25 ransomware groups, including Avaddon, for network reconnaissance and intrusions. Edvardas Šileris, head of Europol's European Cybercrime Centre, said at the time: "For years, cybercriminals saw this VPN service as a gateway to anonymity. They believed it would keep them beyond the reach of law enforcement. This operation proves them wrong. "Taking it offline removes a critical layer of protection that criminals depended on to operate, communicate, and evade law enforcement." According to the FBI, which supported the France and Netherlands-led takedown, 1VPNS was advertised almost exclusively on criminal dark web forums and used for activity beyond ransomware. The service allegedly enabled scammers, botnet traffic, denial-of-service attacks, scanning operations, and more since it began operating around 2014. OFAC designated 1VPNS and its administrator, Dmytro Rashevskyi, on Monday. It also sanctioned Yevgeniy Vladimirovich Silayev for selling cryptors – tools designed to disguise ransomware and other malware so they evade detection by security software. The announcement of the sanctions stated that ransomware groups used both services, causing billions of dollars in losses to US businesses and critical infrastructure providers. Gene Lange, senior counselor to the Secretary of the Treasury, who is also performing the duties of the Under Secretary for Terrorism and Financial Intelligence, said: "Under President Trump's leadership, Treasury is using every available tool to disrupt the cybercriminal ecosystem and protect the American people. "We will continue targeting the actors who enable ransomware attacks against Americans and our critical infrastructure." ®

PWNED Welcome back to PWNED, the weekly column where we gather lessons from organizations that didn’t take security seriously enough. This week’s tale of woe comes from a company that left a door wide open for miscreants, but was lucky it didn't have to pay the price. Have a story about someone leaving a gaping hole in their network? Share it with us at pwned@sitpub.com. Anonymity is available upon request. Our story comes courtesy of a reader we’ll Regomize as Manny. A few years ago, Manny got a job working at a law firm. The firm used him to replace an entire team, making him the de facto IT department all by himself. He soon discovered that all of the company’s data and applications lived in one large web-based interface, which was divided up based on the type of client. So there were areas in the UI for personal injury cases and others for travel refunds, for example. There was just one big, gaping security hole: a master password that allowed you to log in as any user in the system. If you had this password, which many people in the law firm did, you could grab detailed personal information about any client, even their health records. “I immediately raised this as a huge security risk,” Manny told us. “But I was told, 'Oh that's the admin password, everyone uses it. Don't touch it.'” As long as you had the person’s email address that you wanted to impersonate, this password would allow you to impersonate them. This applied to both staff and clients. “Colleague is off sick? Sign in as them and reassign their work to someone else to complete. Client forgot to fill in a field? Log in as them and complete it for them,” Manny said. The system itself was 15 years old, ancient in tech terms, and it desperately needed replacing. So Manny was asked to build a whole new system. Naturally, he refused to add a back door, even though that’s what the boss wanted. “I point blank refused to add any back doors to it,” Manny recalled. “So they promoted every user to a system admin and carried on, business as usual.” What we can take away from Manny’s experience is that sometimes even the best IT people who know security basics can still be hindered by clueless management. We also know that sometimes in order to pay the bills, IT people have to go along with security practices they strongly disagree with. In the end, the boss will have the final word, even if that word is “ignorance.” ®

Australia’s Privacy Commissioner has revealed a tech support scam was the cause of the massive 2025 data breach at Australian airline Qantas and found the carrier didn’t breach its privacy obligations despite leaking personally identifiable information for 5.7 million customers. The Commissioner reached that conclusion, and a decision not to open a formal privacy probe, in a report published today. Qantas has previously admitted the incident was the result of a social engineering attack on a contact center. The Commissioner’s report goes deeper, explaining a crook who claimed to represent “Qantas IT help” made the call and told a contact center agent to access a CRM system and perform certain actions needed to close a support ticket. Those actions instead connected the CRM to a data extraction tool which the crooks used to siphon off customer records. The Commissioner considered whether Qantas observed the Australian Privacy Principles (APPs), the binding rules that govern how businesses safeguard PII, and found the airline did the right thing. The report found that Qantas audited the operator of the contact center and tested the security awareness of its employees – and had done so in the months before the incident. Qantas also conducted mandatory and recurring training on how to handle PII. The Commissioner was therefore satisfied Qantas took adequate steps to ensure the contact center observed the APPs and didn’t fail in its obligations. The regulator made a similar finding regarding the airline’s cross-border data-sharing practices. “Our inquiries did not identify any omissions in the steps Qantas took that, if addressed, would have prevented the breach that occurred in this incident,” the report states. The APPs include a requirement to take reasonable steps to protect personal information from unauthorized access. Again, the Commissioner decided Qantas complied because it used role-based access controls, among other techniques to protect data. Another issue the regulator considered was whether Qantas took reasonable steps to destroy or de-identify the personal information it didn’t need. The carrier told the Privacy Commissioner that it scheduled annual data removal runs from its CRM, and that no records that deserved deletion or removal were present at the time of the attack. That clean record saw the Commissioner decide not to launch a deeper investigation. “I have a broad discretion to commence an investigation of an act or practice where it may be a contravention of the APPs and where it is desirable to do so,” the report states. The first-person pronoun is presumably the work of Commissioner Carly Kind, who observed “it does not appear that Qantas could have reasonably foreseen and prevented the breach in the manner that it occurred. The way in which the threat actor gained access was through a vishing attack which could not have been prevented by a strengthening of Qantas’ current role-based access controls.” It’s possible the Commissioner will revisit the matter at another time, and class-action lawsuits are also in train regarding the incident. Qantas may therefore still have to fight through plenty of turbulence before this matter lands. One thing the report doesn’t address is the identity of the attackers. Pundits have suggested the Scattered Spider gang did the deed after it started attacking the aviation industry in the weeks before the Qantas incident. ®

The crippling high-consequence attack on vital infrastructure that cybersecurity experts have warned about for years is upon us, in the form of an incident that may force KFC to close some stores in Japan. Colonel Sanders himself is not the victim here. That role goes to Nichirei Group, a Japanese purveyor of frozen foods and super-chill logistics services that move them around. Nichirei Group on Monday posted a notice [PDF] in which it admitted “system failures caused by unauthorized access have occurred.” The failures meant the frozen food concern could not arrange shipments to or from its refrigerated warehouses or conduct its other operations. Shortly after Nichirei Group revealed its difficulties, KFC Japan warned customers that delivery of ingredients to its stores would likely be affected. The chicken chain therefore stopped taking orders through its app and website and said it may need to limit menu items and opening hours. “Some stores may be closed depending on the availability of ingredients,” the company said. On Wednesday, Nichirei Group confirmed the cause of the outage was a cyberattack and admitted attackers accessed a server that stores personal information. The Group declined to offer any detail on the incident “to prevent further damage.” The company hopes to resume operations on Friday. That Nichirei Group is unable to provide some services suggests a ransomware attack has made some data unavailable. The mention of “further damage” suggests that discussing whatever happened could divulge clues about security weaknesses that would allow further attacks, perhaps directed at the Group’s clients. KFC Japan hasn’t posted any information about store closures. Indeed, the company continues to promote summer menu items such as a Japanese-style citrus and chicken combo that the chain says is refreshing to eat even in the heat of summer. The Register’s Asia-Pacific bureau will not venture to Japan to assess the impact of this incident, or try the burgers: At times like this, with critical infrastructure under stress, that’s just the right thing (not) to do. ®

The US Cybersecurity and Infrastructure Security Agency (CISA) has urged all organizations running SharePoint to harden their defenses after the disclosure of actively exploited vulnerabilities. The warning applies to those running any supported version of SharePoint Server on-prem, with three vulnerabilities of particular interest cited. A spoofing bug, CVE-2026-32201 (6.5), was the first to be mentioned. Microsoft disclosed it in March and CISA confirmed it was being actively exploited in June. Additionally, CISA appears concerned by CVE-2026-45659 (8.8) – a remote code execution (RCE) flaw made public in June and confirmed as being actively used in attacks last week after Microsoft said exploitation was "less likely." The most recent of the three, CVE-2026-56164 (5.3), a privilege escalation flaw, was one of the 622 bugs that featured in this month's record Patch Tuesday. CISA also picked out two more critical bugs, both from the latest Patch Tuesday, as ones that could potentially complicate SharePoint security further. Neither CVE-2026-55040 (9.1) nor CVE-2026-58644 (9.8) is being actively exploited to date, although Microsoft has attached the "Exploitation More Likely" label to both. CISA said the three exploited vulnerabilities are associated with post-exploitation activity, including the theft of Internet Information Services (IIS) machine keys and deserialization techniques, both in an effort to gain persistence and deploy malware. The agency did not offer any more detail about what led it to issue the warning, but went on to encourage defenders to review an alert it published in August 2025, which similarly urged organizations to harden SharePoint from "ToolShell" attacks. CISA said attackers were chaining together CVE-2025-49706 (6.5) and CVE-2025-49704 (8.8) to break into SharePoint Servers and, in some cases, deploy Warlock ransomware. It did not go as far as attributing the activity referenced in either SharePoint advisory to any group or country, although Microsoft said as far back as July 2025 that ToolShell vulnerabilities were being exploited by Chinese nation-state crews. Applying Microsoft's latest security patches and verifying that Antimalware Scan Interface (AMSI) integration is enabled for each SharePoint web application are among the recommended hardening measures. CISA also advised defenders to go threat hunting for signs of intrusion before rotating IIS keys to avoid exposing SharePoint to the web unless it's necessary and block external access to SharePoint Central Administration. As is the case with any potential intrusion, CISA encouraged organizations to implement robust, tailored logging that can detect potential exploits. ®