News

The US government has decided to effectively ban the sale of advanced robots made in other nations. The decision trickled out over two days with publication of a National Security Determination [PDF] and an update [PDF] to the list of banned devices set by the Federal Communications Commission (FCC). The national security document observes “Advanced robotic devices will be critical to creating efficiencies in our economy, dominating on the battlefield, and securing our homeland” and notes that modern bots are now constantly connected to networks “which creates broad attack surfaces and leaves them vulnerable to data exfiltration, remote disruption of the physical robot, and dependencies on unsecure over the air updates.” One example of those vulnerabilities mentioned in the document is the UniPwn flaws that made it possible for attackers to take over humanoid robots made by Chinese company Unitree. “If the United States continues to rely on foreign sources of advanced robotic devices and critical components, it will subject the parts of the U.S. economy and national security enterprise that are reliant on these robots to the whims of foreign entities that could disrupt or degrade the supply chains at a time of their choosing,” the document states. To respond to those threats, the FCC decided the foreign-made advanced robotic devices belong on its Covered List of products for which imports are banned because they pose an unacceptable risk to the national security of the United States and its residents. The regulator offered a single exception: if the Department of War vouches for a device, it can have it. Foreign-owned companies that make their bots in America are also exempt, an important exemption because one of the leading robot-makers is Boston Dynamics – a company backed by the USA’s DARPA that is now majority-owned by South Korea’s Hyundai, but continues to manufacture its machines stateside. The decision does, however, apply to all future foreign-made devices. Vendors of clankers already approved for sale in the USA can continue to import them, and users are also free to use any bots they already own. But the intent of the documents is clear: from now on, only robots made in America are welcome in America. One entity that stands to benefit from this decision is Tesla, which Elon Musk claims will one day produce one million humanoid robots a year. In true Muskian style he has also said Tesla will go into “high production” of the bots in 2026, but there’s no evidence of that happening although the occasional trillionaire did recently show off the production line for Tesla’s “Optimus” bot. ®

The Agentic AI Foundation, part of the Linux Foundation, has released an update to the Model Context Protocol (MCP) that aims to help enterprises adopt AI-based automation. Open-sourced by Anthropic in November 2024, MCP provides a way for AI applications (agents) based on models like GPT-5.6 Sol or Claude Opus 5 to connect to existing data sources, tools, or other applications. It defines how content is exchanged in a client-server architecture. "The new release is MCP’s most important since remote MCP first launched over a year ago," wrote David Soria Parra, a member of technical staff at Anthropic and co-inventor of MCP, in a blog post. "It is a leap in serving scalable MCP servers and takes all the lessons learned over the last 18 months to provide a robust foundation for MCP’s future." The latest version of the specification does away with the legacy stateful architecture, making it more like HTTP services where network requests do not need to retain the state of the session. "Historically, running MCP at scale required sticky routing or shared state to maintain continuity across sessions," explained Caitie McCaffrey, a Microsoft software engineer and core MCP maintainer, in a blog post. "This made large-scale production deployments complex to implement and operate even when the capabilities being exposed were stateless." The revised protocol changes the underlying architecture to eliminate the overhead of managing session state, which allows organizations to run MCP servers behind standard load balancers on existing Kubernetes and DevOps tooling. The version 2026-07-28 release also includes a Specification Feature Lifecycle and Deprecation Policy, because large companies want clear roadmaps and timelines when it comes to software changes. "The goal is a predictable timeline that SDK authors and implementers can plan migrations against when protocol surface area is retired," the documentation explains. The revised spec comes with a new policy that guarantees a minimum period of 12 months between feature deprecation and removal, which should please enterprise engineering teams, since they'll need to make fewer updates to MCP servers. On the security front, the latest spec revision adds Specification Enhancement Proposal (SEP) 2468, which calls for the inclusion and validation of an issuer (iss) parameter in authorization responses. This should help prevent OAuth Mixup Attacks. An attack of this sort can occur when an OAuth client connects to multiple OAuth providers via multiple MCP servers. If an attacker controls one of these servers, the miscreant could potentially obtain an access token or code from one of the other servers. Checking the iss parameter defends against that particular attack vector. Large organizations should also appreciate support for the Enterprise Managed Authorization extension, which makes it possible to manage MCP servers through a central identity provider. Another improvement involves the evolution of tasks – long-running tool calls or batch operations – into an extension. The main benefit is that tasks shift from a blocking request to an asynchronous request. "The payoff is operational resilience at scale," explains McCaffrey. "Because a task is durable and addressed by a stable handle, clients can persist task IDs to durable storage so that polling can resume after a crash or restart — no fragile, long-lived connections held open while waiting for work to finish, which the old blocking model forced on clients and servers that did not want to implement it." Other notable additions include header-based routing and cacheable list results. Some migration cost is expected, particularly for developers who implemented MCP code that relies on session identifiers. ®

We now have a better idea of how OpenAI's models broke out of their cages to attack Hugging Face. The rogue models found zero-day vulnerabilities in JFrog’s universal binary repository manager Artifactory around the time they escaped, according to JFrog CTO Yoav Landman. While Landman doesn’t outright admit that the JFrog flaws were the zero-days that OpenAI’s models found and exploited, ultimately allowing them to breach the massive model mart, it definitely looks and quacks like a duck - err, frog. Landman says OpenAI's models discovered the Artifactory zero-days during a security evaluation. The AI giant notes the incident occurred while its models were being evaluated on the ExploitGym benchmark. “During a security evaluation, OpenAI’s models identified previously unknown zero-day vulnerabilities in self-hosted Artifactory installations that could be exploited to gain unintended internet access,” Landman said on Monday. JFrog Artifactory is a central platform that organizations use to store and distribute all the software artifacts across their supply chains. It supports more than 60 package formats including Docker, Maven, npm, PyPI, Helm, and AI/ML models. OpenAI “responsibly and immediately” disclosed the vulnerabilities to JFrog, Landman continued. “Our security team treated the report with the urgency it deserved, as a genuine zero-day unknown to the world, and moved accordingly. We developed, validated, and released a fix for all JFrog customers, self-hosted and cloud alike.” On Monday, JFrog released the fixed versions, and credited OpenAI researchers for reporting at least eight of the now-patched Artifactory vulnerabilities: CVE-2026-65617, CVE-2026-65925, CVE-2026-65921, CVE-2026-65923, CVE-2026-66018, CVE-2026-66014, CVE-2026-66015, and CVE-2026-65924. The Register asked JFrog whether at least some of these were abused by OpenAI’s rogue models to access the internet and compromise Hugging Face, but the DevOps firm isn’t talking. JFrog's admission comes about a week after OpenAI said two of its models, GPT-5.6 Sol and a second pre-release model, escaped their testing sandbox during a security evaluation designed to test their cyber capabilities. During this test, the models found a way to access the open internet, then broke into Hugging Face and accessed private information and stole some credentials. “While operating in our sandboxed testing environment, our models spent a substantial amount of inference compute finding a way to obtain open Internet access, in pursuit of solving the evaluation problem,” OpenAI said on July 21. “To gain access, the models identified and exploited a zero-day vulnerability (which we’ve now responsibly disclosed to the vendor) in the package registry cache proxy.” The Register also reached out to OpenAI and asked if JFrog is the vendor referenced in its blog, but did not receive any response. Luckily, your humble vulture is headed to Vegas in a week for Hacker Summer Camp, so we will be sure to test our betting prowess in the appropriate environment. Without guardrails, of course. ®

Two agentic bug-hunting systems from Microsoft and Google-owned Wiz show that when it comes to finding and remediating software vulnerabilities, at least two models’ minds work better than one - and Wiz tells us it’s adding a third. Wiz on Monday said Project Atlas, its bug-hunting AI agent, bested Anthropic’s Mythos Preview and OpenAI’s GPT-5.5 Cyber with its vulnerability-analysis skills, achieving a 90.9 percent success rate on CyberGym, and uncovering more than 200 zero-day security holes in widely used open-source code. Meanwhile, Microsoft boasted its MDASH bug-hunting harness scored a 95.95 percent success rate on CyberGym, also beating Mythos, Gemini and GPT on the same benchmark for evaluating how well AI systems find real vulnerabilities in the code. For comparison, OpenAI’s GPT-5.5 Cyber scored 85.6 percent on CyberGym, and its GPT-5.6 Sol scored 83.6 percent. Anthropic’s Mythos 5 reproduced the target vulnerability on 83.8 percent of CyberGym challenges. And Google’s Gemini 3.5 Flash Cyber in CodeMender achieved an 83.2 percent success rate. The secret to both Atlas and MDASH’s success, according to the vendors, is that they use the right model for the right security job. Atlas uses Claude Opus 4.6 with GPT-5.5, Nir Ohfeld, head of vulnerability research at Wiz, told The Register. “We're now working to incorporate Gemini, which is well timed given Wiz's recent work with DeepMind on Gemini Flash Cyber,” he added. Microsoft’s MDASH - a combination of red-team agents that find and simulate real, exploitable vulnerabilities and attack paths, and green-team agents that remediate the issues - combines MAI-Cyber-1-Flash, based on Microsoft AI (MAI)’s internally developed MAI-Thinking-1 reasoning model, and GPT-5.4. MAI-Cyber-1-Flash is designed to handle up to 90 percent of all tasks, with MDASH detecting, patching, and validating vulnerabilities before handing the remaining 10 percent of more complex tasks to the larger GPT-5.4. “We were able to take an off-the-shelf model, within our harness, a multi-agent and multi-model implementation, and we achieved the best results you could have,” Hayete Gallot, executive vice president of Microsoft Security, said on Monday. Atlas isn’t commercially available yet - it’s used internally, and stems from Wiz’s efforts to understand how frontier models can be used for advanced code scanning. But it’s proof that “no single model is best at everything, and none stays state of the art for long,” Ohfeld and fellow Wiz kid Yuval Avrahami wrote in a Monday blog. The cloud security biz evaluates every new model using its internal benchmarking tool, Cyber Model Arena, which scores each one on its success at completing various security-investigation tasks: threat modeling, hunting, validation, and proof generation. “The results are rarely uniform: the model that reasons best through a complex exploit chain is often not the one that triages most precisely,” the duo wrote. “Atlas routes each stage to whichever model wins on that task.” In addition to doing a better job of finding and fixing vulnerabilities, a multi-model system also saves customers’ money, according to Microsoft and Wiz. Combining its much smaller, in-house model with GPT-5.4 halves customers’ costs, according to Mustafa Suleyman, CEO of Microsoft AI. “As the models hand off between each other, they are not just able to deliver better performance than all of the other models combined, they do so at 50 percent of the cost,” he said on Monday. And while “each new generation of models expands what is possible,” they are also expensive, Ohfeld told us. “We have also learned that pointing a frontier model at a codebase once is not a sustainable security strategy: deep scans are expensive, their results become stale as code changes by the minute, and a point-in-time analysis cannot provide the continuous coverage organizations need across every repository,” he said. In fact, the real question for code security shouldn’t be which model a scanner uses, Ohfeld added. It’s this: “How does your system take advantage of the best model available today, continuously and economically, and what continues to work when a better one arrives,” he said. “That is the bet behind Atlas: frontier-model depth where expert reasoning is required, an architecture that improves as models evolve, and rigorous validation so every finding arrives with evidence, not just a plausible answer.” ®

Ahead of DEF CON 2026 opening its doors in Las Vegas next week, conference organizers said they have imposed a ban on “Meta-style glasses with recording capabilities.” Statements made via its social media channels went on to say that no exceptions will be made for those using the devices with prescription lenses. “Be sure to pack non-violating eyewear if you need them,” DEF CON said, before directing delegates to the conference’s official photo policy. That policy has not been updated since 2023, predating the recent growth of camera-equipped eyewear developed by Meta with EssilorLuxottica under its Ray-Ban and Oakley brands. It states that public photography is permitted but with several caveats that essentially prohibit capturing the image of anyone, except on-stage speakers, unless the photographer obtains consent from the subject(s). EFF director of cybersecurity Eva Galperin welcomed the decision, saying: “Love to see a ‘no pervert glasses’ policy at DEF CON.” The conference’s reminder follows similar moves from other major organizers and promoters. Monopoly Events banned the same style of smart glasses from its shows, which include UK Comic Cons, in recent days. “After a consultation period, we can no longer permit the wearing of any recording device at our events,” it stated last week. “The vast majority of the talent and agents at our events felt that these were a violation of their privacy and were damaging and spoiling the interactions at the tables. “Several expressed concerns that they might not continue to attend in-person events if they were being recorded in secret. “We had similar feedback from event attendees, many of whom are not comfortable with the knowledge that other convention goers might be filming them without consent.” The event management company said that anyone caught wearing glasses with recording capabilities may be asked to leave the show and forfeit any unfulfilled autographs or photographs they had purchased. Similarly, Scottish ferry operator CalMac temporarily suspended unplanned visits to ships' bridges of its ships after a passenger wearing recording glasses made crew and passengers feel uncomfortable while filming during a crossing in June, the Ayrshire Weekly Press reported. Growing privacy concerns Originally pitched as a convenient tool for recording everyday moments without needing to occupy one’s hands with a phone or camera, Meta’s smart glasses quickly attracted a mixed reception. Old fans of the Google Glass project were enamored by Meta’s take on the concept, more than ten years after the Chocolate Factory debuted its chunkier, costlier wearable, which was swiftly axed after two years. Meta’s glasses, and crucially their recording capabilities, are considerably more clandestine than Google Glass', appearing to many as a normal set of specs. Only when you inspect the frame from a much closer perspective does the embedded camera become more apparent. The devices have become associated with creepy behavior. A quick search for “Meta glasses privacy violations” will throw up countless examples of questionable conduct from glasses-wearers, typically reported by women and children. While photography and videography in public spaces are widely permitted for casual use, smart recording glasses make the activity much more discreet. The Register has heard that such devices can be paired with unsophisticated apps to dox passersby in seconds, and have inspired separate projects to alert Android users to nearby glasses-wearers using Bluetooth signals. Meta is also facing scrutiny from the UK’s data protection watchdog, including over cross-border data flows. The watchdog’s questions follow reports originating in Sweden that Kenya-based contractors reviewing footage from wearers were exposed to some of their more private moments. Human reviewers based in Kenya, who are tasked with labelling images and video to help train Meta’s AI, have reportedly reviewed captures taken from toilet visits, wearers changing their clothes, and users engaging in conversations that revealed alleged wrongdoing. Meta has routinely defended its wearables amid privacy concerns, saying that when they are recording, a light on the frame illuminates to indicate that the camera is active. Further, attempts to cover or otherwise tamper with this light result in the glasses refusing to capture images. The Register contacted Meta for its take on the recent bans of its devices at conferences and will update this article if we hear back. ®

Anthropic's Project Glasswing may have uncovered tens of thousands of potential security flaws, but new research suggests AI-assisted vulnerability discovery has yet to produce the wave of real-world attacks many expected. In research shared with The Register, VulnCheck analyzed 1,061 publicly attributed AI-assisted vulnerability discoveries from Anthropic's Project Glasswing and the Berkeley Vulnerability Research Initiative, then cross-referenced them against its Known Exploited Vulnerability (KEV) database. The result: just 14 vulnerabilities, or 1.3 percent, have been confirmed as exploited in the wild, almost identical to the rate across all vulnerabilities in VulnCheck's dataset. That's a far cry from the narrative that frontier AI is dramatically tilting the balance in attackers' favor by churning out instantly weaponizable bugs. Instead, the data suggests that AI is currently better at increasing the volume of vulnerabilities researchers can uncover than at increasing the proportion that attackers actually exploit. The report takes particular aim at Anthropic's much-publicized Project Glasswing, unveiled in April with warnings that AI-assisted vulnerability discovery could allow attackers to hijack systems, disrupt operations, or steal data. Claude Mythos may have identified 23,019 vulnerability candidates, but there's remarkably little public evidence showing what became of most of them. VulnCheck notes that only 126 have been published as CVEs, that just one has been confirmed exploited in the wild, and that Anthropic's public disclosure record has seen little movement since Project Glasswing launched. But that doesn't mean AI-assisted vulnerability research has failed, according to Patrick Garrity, security researcher at VulnCheck. "AI-assisted vulnerability discovery clearly has value for both attackers and defenders," Garrity wrote. "The data does not suggest that AI-discovered vulnerabilities are inherently more likely to be exploited than those found through traditional methods." Instead, he argues, AI is simply helping researchers discover more flaws, giving defenders an opportunity to patch them before criminals get there. Garrity stopped well short of declaring the threat overblown forever, but he did suggest some of the rhetoric has outpaced reality. "The data so far, including Anthropic's own stalled disclosure ledger, suggests that AI-assisted vulnerability discovery and frontier capabilities have been overhyped relative to the evidence available today," he wrote. "That doesn't mean the risk is imaginary. It means the impact has been real but modest." Meanwhile, attackers haven't exactly been sitting idle. VulnCheck identified 495 known exploited vulnerabilities during the first half of 2026, with content management systems accounting for roughly one-third of them and network edge devices remaining a firm favorite. AI products themselves are also becoming an increasingly attractive target, as attackers look beyond using AI and start hunting for weaknesses in the rapidly expanding AI software stack. In other words, AI may be changing vulnerability research, but it hasn't yet produced the exploitation apocalypse some predicted. ®

CAF Bank, which serves 14,000 charities, has suspended online banking as it fixes a vulnerability in how third-party software connects to its portal. The outage has left some organizations struggling to run payroll after being cut from their accounts. In a message to customers, seen by The Register, the Charities Aid Foundation-owned bank confirm online services had been unavailable since July 24 and will remain so until further notice. The bank's communications say the decision resulted from reports of suspicious activity on some customer accounts. It said the bank detected the problem early on and notified customers of any attempted fraud. Following an investigation, CAF Bank identified a previously undetected vulnerability in the connection between third-party software and the online banking portal. It is working with its technology partner on a fix. The bank assured customers that its core banking services were not affected and that money held in their accounts was safe. However, it was making changes to the online service. In a statement, CEO Alison Taylor said: "We have informed CAF Bank customers that the online banking service will be unavailable until further notice. I am very sorry for the disruption and understand the frustration this can cause for our customers. "We are working with external experts to fix an issue we identified with third-party software related to our online banking portal. The core bank is not affected. We are acutely aware of the impact this has on our customers and want this to be fixed as soon as possible, but we cannot restore access to the online service until we are assured the issue is safely resolved. "We are still able to support on the phone, and we are prioritizing time-sensitive payments such as payroll." She declined to comment on whether the bank will compensate customers. Last year, CAF Bank came under fire from customers who were unable to log in or make transactions when a new banking platform was introduced. The bank later apologized to customers experiencing difficulties with the service. At the time, a CAF Bank spokesperson said it was focused on supporting its customers through the transition and helping them with the new online banking service. "The vast majority of our customers are online, with thousands of payments being made and received every day. We are sorry for the disruption and waits on calls that some of our customers have experienced following the launch." The bank has not disclosed how much it has spent on the platform. It held £1.45 billion ($1.93 billion) in customer deposits at the end of its 2024/25 financial year. ®

America wants its allies to come together and help it lead the way in defining 6G communications standards, with security and resilience seen as key goals for next-generation networks. The latest effort to corral international work on 6G comes from the US National Telecommunications and Information Administration (NTIA), which says it is pursuing the objectives of a December 2025 memo from President Trump on "Winning the 6G Race." That memo didn't identify who America is racing against, but it is a fair bet that it is China, which gained a lead during the development of 5G technology. Huawei in particular is understood to hold more declared 5G standard-essential patent families than any other company. The NTIA says it is launching this initiative alongside more than 20 governments, including several European nations like the UK and the Nordic countries, Japan, South Korea, and Australia. The Nordics are significant as they are home to telecoms equipment suppliers Nokia and Ericsson. These governments have all pledged to strengthen cooperation on 6G over the next 12 months and beyond in support of greater security, interoperability, and resilience for next-generation networks, the NTIA claims. "The Call to Action for 6G Leadership and Security reflects an unprecedented level of international coordination on the future of communications technology," stated NTIA administrator Arielle Roth. "By working now with trusted partners, we will ensure that next generation networks reflect our shared security interests, strengthen our competitiveness, and drive innovation." So after President Trump has spent 18 months since inauguration disparaging and threatening America's "trusted partners," the US has decided it would really like their help in becoming the world leader in 6G technology. Isn't that nice? The initiative lays out specific milestones on strategic coordination over the next year or so, as 6G moves toward commercialization. These include engaging with the telecoms industry to understand the "political and economic landscape" for 6G networks and meetings to identify the potential for more coordinated approaches. It also calls for a big meeting in 2027 to review joint progress, where the partners are expected to evaluate funding strategies, share information on 6G research and development, assess 5G and 6G technical and cybersecurity risks, and promote common 6G policies. All of this seems aimed at coordinating positions on the spectrum needed for 6G ahead of the next World Radiocommunication Conference (WRC-27). Scheduled for October 18 to November 12 in Shanghai next year, the conference will consider which frequency bands are made available for next-generation mobile networks. But it isn't the first attempt at international collaboration over the next-gen wireless standard. The US-UK Tech Prosperity Deal, agreed last year, proposed greater cooperation in a range of science and technology areas including 6G, but this was put on ice by President Trump after just a few months over trade disagreements. Earlier this year, the Global Coalition on Telecommunications (GCOT) unveiled a set of security and resilience principles it wanted to see baked into 6G from the start. The organization includes many of the same nations as the latest US scheme. "This is a clear attempt by the US and its allies to shape the 6G landscape before commercial networks arrive," PP Foresight founder and analyst Paolo Pescatore told The Register. "The priority is to embed security, resilience, interoperability, and supply-chain diversity from the outset, rather than repeat the costly mistakes and geopolitical tensions that defined the 5G era. "Although China is not explicitly mentioned, the strategic intent is obvious: to reduce dependence on high-risk suppliers and to ensure that trusted nations have greater influence over standards, investment, and innovation. However, this remains a political framework rather than a binding agreement." The first 6G deployments could arrive as soon as 2029, with the US and South Korea likely to lead in early adoption, according to a report from Juniper Research earlier this year. Despite this, the exact characteristics that will define 6G networks have yet to be thrashed out. Bodies representing the mobile networks want to see a smooth and cost-effective migration path for their members, avoiding the mistakes made with 5G, while the GSMA has already put it out there that 6G networks may need up to three times the spectrum currently allocated to meet the anticipated demands for data. ®

A critical flaw in Arista's VeloCloud Orchestrator has gone from zero to KEV in short order, with the networking giant confirming attackers are already exploiting it. The vulnerability, tracked as CVE-2026-16812, carries a maximum CVSS score of 10.0 and affects VeloCloud Orchestrator On-Prem, the self-hosted version of the software that enterprises use to centrally manage VeloCloud software-defined wide area networks (SD-WANs) connecting branch offices, datacenters, and clouds environments. According to Arista's security advisory, the flaw is an OS command injection vulnerability that allows an unauthenticated remote attacker to reach privileged internal functionality that was never meant to be exposed externally. Worse, Arista says the on-premises orchestrator is exposed by default, with no configuration capable of removing that exposure entirely. Exploitation requires access to the web interface but no credentials. Until administrators can patch, Arista recommends restricting that interface to trusted management networks and blocking IP addresses associated with observed attacks. "Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator," Arista warned. "Compromises to the VCO platform may allow attackers access to the VeloCloud Edge devices as well." Arista published three IP addresses observed conducting attacks, but otherwise kept its cards close to its chest. The company hasn't said who's exploiting the bug, when the attacks began, or how many customers have been affected, and didn't immediately respond to The Register's questions. Even without those details, the admission of in-the-wild exploitation was enough for CISA to add the flaw to its Known Exploited Vulnerabilities (KEV) catalog. The list is reserved for bugs with evidence of real-world abuse, and while the associated directive applies only to US federal civilian agencies, plenty of private sector security teams use KEV to decide which patches can't wait. The issue affects only on-premises deployments. Customers using Arista's hosted or dedicated VeloCloud Orchestrator service had already been patched before the advisory was published, the company said. Fixes are available in VeloCloud Orchestrator versions 5.2.3.14, 6.1.3.4, 6.4.2.4, and 7.0.0.1. Arista urged customers running earlier releases to upgrade immediately. Arista is far from the first vendor to issue a patch after attackers had already begun exploiting the flaw. Over the past year, a steady stream of networking gear, VPNs, firewalls, and other edge-facing enterprise software has followed the same pattern: by the time customers learn there's a problem, somebody else has already proved it's worth exploiting. ®

AI agents can break through security, but they are also the solution to defending against an increasingly dangerous ecosystem of threats. On Monday, Microsoft announced a new security model that it says helped outperform several rival AI systems on a vulnerability benchmark while cutting costs by about half. Unsurprisingly, at Redmond’s security event on Monday, execs touted the tech giant’s AI security prowess and introduced a new agentic security system called Project Perception, and also unveiled its first security-specialized model, MAI-Cyber-1-Flash, designed for software vulnerability analysis. Microsoft packed MAI-Cyber-1-Flash, based on Microsoft AI (MAI)’s internally developed MAI-Thinking-1 reasoning model, inside its MDASH bug-hunting harness. Its execs claim the duo - with a GPT-5.4 boost - outperforms Anthropic’s bug-hunting machine Mythos and OpenAI’s powerful standalone models, and costs about half the price of other leading commercial models. CyberGym’s benchmarking found that MAI-Cyber-1-Flash, combined with GPT-5.4, both stuffed inside the MDASH harness, achieved a 95.95 percent success rate. For comparison, OpenAI’s GPT-5.5 Cyber scored 85.6 percent and its GPT-5.6 Sol scored 83.6 percent, while Anthropic’s Mythos 5 successfully handled real-world vulnerabilities 83.8 percent of the time. Google’s Gemini 3.5 Flash Cyber in CodeMender achieved an 83.2 percent success rate. “This is really quite a remarkable result,” Mustafa Suleyman, CEO of Microsoft AI, said during the Monday event. Within MDASH, MAI-Cyber-1-Flash handles up to 90 percent of all queries, detecting and patching the vulnerabilities while also confirming the fixes worked, and hands the remaining 10 percent of tasks off to the larger GPT-5.4, Suleyman explained. “GPT 5.4, which is obviously a larger model, about 10X larger, solves those [queries],” he said. “As the models hand off between each other, they are not just able to deliver better performance than all of the other models combined, they do so at 50 percent of the cost.” In addition to the multi-model bug hunting system, Microsoft announced Project Perception, which coordinates three types of agents: red team agents that find and simulate attack paths, blue team agents that investigate and determine risk, and green team agents that remediate the issues. “We need to make sure that the defenders can defend at the scale and the speed of the attackers,” Hayete Gallot, executive vice president of Microsoft Security, said. “You need a new cyber stack. So we built it. This is what we call Perception.” Aside from the new security products, Redmond introduced a new AI security research arm called Microsoft Security FORGE (Frontier Offensive Research and Generative Exploration) Labs, led by Microsoft VP of Security Research Taesoo Kim, and an AI red team alliance. The latter, called the External Red Team Alliance (EXTRA), aims to expand AI safety research through a two-part initiative. First, Redmond’s own AI red team provided "unrestricted gifts " to 18 university labs across six continents to support AI safety research, Microsoft data cowboy and AI red team lead Ram Shankar Siva Kumar said in a blog. “The funding is unrestricted because the objective is not to direct research outcomes toward product requirements or predefined deliverables,” he wrote. “Some universities are examining the cybersecurity implications of AI systems themselves - including how models can be attacked, manipulated, or abused in operational environments. Other labs are exploring the inverse problem: how AI systems can assist defenders and improve cyber operations.” The second EXTRA component will build a distributed network of specialists to participate in red teaming across very specific areas. “That includes researchers, practitioners, and regional experts who understand specific attack classes, languages, cultural contexts, or technical domains that internal teams may not fully cover alone,” he added. ®

In the wake of OpenAI agents attacking Hugging Face, Nvidia has recruited a new posse of partners to promote open source models as the security solution the industry needs. The AI arms dealer announced the foundation, the Open Secure AI Alliance, in a blog post today, describing the mission of the group being “to ensure defenders everywhere have open, frontier tools they can trust and control.” Partners in the group are numerous, ranging from established tech giants like Microsoft, Red Hat, HPE, IBM, and Adobe to newer groups like Palantir, SpacexAI, Hugging Face, and The Linux Foundation. What all the founding members have in common, Nvidia said, is that they agree open source AI models are a fundamental part of modern cybersecurity, just like prior open source tech has been for the infosec space. “The United States and its partners now face a choice in AI security: whether the defenses that protect our infrastructure will sit inside a few opaque systems or be built on open models, harnesses and tools that any defender can study, adapt and deploy,” Nvidia said in the announcement. The claims in many ways echo the pleadings from tech industry heavyweights made in an open letter to US government regulators last week. That letter, signed by many of the same companies that are part of the founding OSAA cadre, essentially argues that regulators should ensure Anthropic, Google, and OpenAI don’t end up with total control of the US AI market, and that open-weight models should be given a seat at the table, too. The new alliance is arguing that, not only do open-weight models need to be allowed to proliferate in the US, but they also need to be considered a fundamental part of the security puzzle. For those unfamiliar with the Hugging Face incident, a group of autonomous OpenAI agents, operating in a sandbox and stripped of guardrails to test their full capability to solve cybersecurity puzzles, exploited a pair of zero-days to escape and gain access to the internet. For some reason, the bots thought the solution to the problems they were posed could be found in Hugging Face systems, so they broke in and accessed a bunch of private information and hijacked some credentials. When Hugging Face turned to closed-source US frontier AI lab bots to examine the incident and help figure out what happened, those tools declined to help because they thought the data Hugging Face was trying to examine was itself malicious. Hugging Face turned to Chinese-made GLM 5.2, hosted on its own infrastructure, to figure things out. “That incident showed a practical truth,” said Nvidia. “When defenders cannot inspect, adapt and run advanced AI on their own infrastructure, their ability to respond is constrained at exactly the moment speed matters most.” Only open-source AI models, which China leads development on, can fill that role, the OSAA argues, and it’s prepared to counter those who say open models are a threat: Just look at what happened last week and it's readily apparent that closed source models are dangerous too. The Alliance is pooling its efforts to give security pros access to essential open tools. Nvidia said that it’s participating by releasing its Object-Oriented Agent project on GitHub, HPE is contributing its SPIFFE/SPIRE zero-trust AI identity framework, Hugging Face has handed its Safetensors transparent AI model weight formatting to the PyTorch Foundation, and SpaceXAI has open-sourced Grok Build (though the reason behind that doesn’t appear to be entirely benevolent). In addition, IBM and Red Hat have released Lightwell, an automated open-source vulnerability remediation platform, while Microsoft has come out with MDASH, a multi-model agentic scanning harness to automate bug discovery and remediation. Those efforts, while not open source themselves, are still a sign that Alliance members “are building an open defense stack,” Nvidia said. The OSAA ended its announcement with another call for policymakers not simply ban open-source AI models, as doing so “would weaken defensive capacity and risk concentrating power, dependence, and vulnerability in a few closed providers,” the group said. Many providers, as we saw last week, are more concerned with protecting themselves than helping victims of autonomous cyber attacks respond quickly. Clement Delangue, cofounder and CEO of Hugging Face, said in a post on X that he spoke to OpenAI over the weekend about last week’s incident and asked the company to provide funding to support the development of better open-source AI cyber defenses. It’s not clear if the company plans to fulfill that request; it’s not a founding member of the Nvidia-led OSAA. Neither is Google or Anthropic, for that matter. We reached out to all three companies for their take on the new initiative, but didn’t hear back from any of them. ®

Not content with broken Windows updates, Microsoft has disclosed two problems with Defender for Endpoint on Linux – one that could disable the security service after a reboot, and another that prevents updates on FIPS-enabled Red Hat Enterprise Linux 8 and 9. The more serious problem affected versions 101.26042.0000 through 101.26042.0009 across all supported Linux operating systems. After an upgrade or reinstall followed by a reboot, "the Defender service might be disabled on some devices," according to Microsoft. "If you use Defender for Servers (Plan 1 or 2) with Defender for Cloud and have the MDE [Microsoft Defender Endpoint] integration enabled, automatic updates for the MDE.Linux extension are enabled by default, which means your machines could have received an affected version automatically," it explained. "If an affected version was installed, the issue might impact active protection on rebooted devices until remediation steps are taken." Microsoft did not specify what caused Defender to become disabled, but anything that could knock out endpoint protection will give administrators sweaty palms. A separate problem affected RHEL 8 and 9 systems running in FIPS mode: the 101.26042.x update could fail to install, leaving devices on their previous version. FIPS refers to US Federal Information Processing Standards, which in this context impose requirements on the cryptography used by government and other regulated systems. Although Microsoft's alert did not mention an available update, its release notes direct users affected by the disabled-service bug to build 101.26042.0011. The separate FIPS installation problem is fixed in version 101.26052.0011 and later. Microsoft Defender for Endpoint on Linux protects server workloads on-premises and in the cloud. According to Microsoft, "it helps you prevent, detect, investigate, and respond to advanced threats with unified visibility through the Microsoft Defender portal." Other endpoint security platforms are available, but where an organization has gone all-in with Microsoft, the unified management offered by Defender for Endpoint on Linux can be difficult to resist. Microsoft has an unfortunate habit of shipping broken updates for its flagship operating system, Windows. An update that breaks software specifically designed to protect a device takes things to another level, particularly given the relentless rise in attacks and the need to both fend them off and monitor activity. Hence the appeal of unified visibility through the Microsoft Defender portal. However, an update that could leave Defender disabled after a reboot – while also refusing to install on some security-hardened systems – is less than ideal. ®

Google has created a new taxonomy to describe cybercrime outfits, seemingly abandoning a Microsoft-led effort to create consistent names. The Big G announced its new schema on Saturday in a post that notes its 2022 acquisition of Mandiant and its subsequent incorporation into a new team called the Google Threat Intelligence Group (CTIG). Now that two have become one, Google reckons they need consistent naming conventions to describe cybercrime crews. The result is a two-word schema in which the first word “is a unique and memorable term chosen to represent the specific actor.” If security folk have already applied a particular moniker Google will use it, otherwise it will randomly generate a word “to remove bias.” Google says the second word “categorizes threat clusters by motivation, attribution, or activity type based on which category we consider to be most important for defense and response strategies.” More on that later. Google has decided on the following names: CASTLE to describe crews from the People’s Republic of China ION for threats from Iran NEPTUNE for North Korean attackers RELIC for Russians COMET for cybercrims who aren't backed by a state Google’s post notes that other infosec industry players have developed their own schemas for describing threat actors and says the web giant is therefore “intentionally seeking to keep this system as simple as possible to streamline operations and facilitate mapping to other naming taxonomies.” That’s an odd position, given that in 2025 Microsoft and CrowdStrike tried to spark an industry-wide effort to apply consistent names to threat actors. As we noted at the time, the existence of multiple naming schemas means that researchers often refer to the same group by ten different names. Researchers use the names Seashell Blizzard, IRIDIUM, VOODOO BEAR, BE2, UAC-0113, Blue Echidna, PHANTOM, BlackEnergy Lite, and APT44 to refer to the same entity – Russia's Military Intelligence Unit 74455. With most orgs using multiple security tools and therefore receiving threat intelligence security info from many vendors, users must try to understand which crews they’re trying to defend against. At the time, sources told us Google and Mandiant were keen to adopt the Microsoft-led scheme. Google’s new announcement suggest the relationship either wasn’t consummated or didn’t last. Back to the issue of possible bias, as in 2024 China's National Computer Virus Emergency Response Center (CVERC) complained that western companies choose names like “Typhoon,” “Panda,” or “Dragon” to describe Chinese cybercrime groups. CVERC suggested names that reflect English language idioms, such as “Hurricane” or “Koala” are more appropriate. For what it’s worth, “Koala” is a word from the language spoken by the Darug people, the indigenous tribe who lived around Sydney, Australia, prior to British colonization. Koalas are utterly supine creatures that sleep 18 to 22 hours a day, and a mention of the marsupials may therefore not spur defenders to action, even if the creatures’ habits do perhaps describe the behavior of some sleeper malware. ®

Click To Pray, a prayer app endorsed by the Pope with hundreds of thousands of users worldwide, has leaked people’s names and email addresses for months - or longer - according to an ethical hacker who said she found and reported the security vulnerability six months ago to no avail. This app needs to take a vow of silence when it comes to your personal information. The app, available in seven languages and on iOS, Android, and clicktopray.org, is the official app of the Pope's Worldwide Prayer Network. It connects users across the globe to pray for the Holy Father’s intentions, and as of July 2026, it has 719,517 registered accounts. It’s also very leaky, according to security sleuth BobDaHacker, who says she spotted and disclosed the vulnerability to the Pope’s Worldwide Prayer Network on January 3. “The vulnerability is still live,” the hacker said in a Friday blog. “Nobody has ever responded. I guess my email wasn't in their prayers." The Reg readers likely remember BobDaHacker for her previous research exposing a free-food flaw in McDonald's ordering system and open controls on Chinese robot manufacturer Pudu Robotics. This latest security hole stems from an Insecure Direct Object Reference (IDOR) bug in the prayer app. This is a very common and easy-to-exploit type of flaw that occurs when a website or an app blindly accepts user-provided input to view or modify resources without checking to see if the user is actually authorized to retrieve the data. “You ask for your own data, the server gives it to you,” BobDaHacker explains. “You ask for someone else's data, the server gives you that too. Thou shalt not authorize, apparently.” When you sign up for a Click To Pray account, the app assigns you a sequential numeric user ID. As BobDaHacker uncovered, the API endpoint GET https://api[.]clicktopray.org/user/users/{id} will return user data for any account - not just your own account - so long as you supply a valid, five-digit user ID. It doesn’t perform any authorization check or ownership validation. “Just increment the number and get someone else's data,” she wrote. This data includes users’ email addresses, first and last names, country, dates of birth, and whether the account has been deleted, and the API exposes all 719,517 accounts on the prayer site. “With sequential user IDs and no rate limiting, an attacker could enumerate every single account on the platform,” the hacker explained. “One GET request per user. for i in range(1, 719518): scrape(). That's it. That's the exploit.” As BobDaHacker points out, many of these users are likely older individuals, not all that tech savvy, and very trusting of anything Vatican related, making these exposed accounts a “phishing goldmine.” “Imagine getting an email that says ‘The Holy Father requests your urgent attention’ with a Vatican-looking link,” she wrote. “Grandma is clicking that. Every time.” And then it gets even worse. The signup endpoint, POST https://api.clicktopray.org/user/users/sign-up, returns the account's validation_hash directly in the response body, and that value is the same UUID used in the email verification link. This means someone could sign up using any email address and verify the account before the confirmation message reached the inbox. Plus, BobDaHacker’s email client flagged the real verification email with a warning that it had failed the domain’s authentication requirements and might have been spoofed or improperly forwarded. “So not only is the API leaking 700,000 email addresses that could be used for phishing, but the real emails from Click To Pray already look like phishing,” the hacker noted. “An attacker wouldn't even need to try hard. They could send a pixel-perfect phishing email and it would have the same level of email authentication as the real thing: none. God works in mysterious ways.” The Register reached out to the Pope's Worldwide Prayer Network and did not receive any response. BobDaHacker says she’s still praying for one, too.®

Europol and its partners' investigators flagged 4,340 “horrific” URLs for removal over several weeks in June and July as part of an ongoing crackdown on The Com (short for community), a loosely knit network of online groups whose young members participate in a range of illicit activities. These range from hacking, swatting, and digital extortion to real-life shootings, stabbings, and other physical violence. Europol’s recent Referral Action Days, aimed at disrupting The Com’s online ecosystem and stopping the spread of its propaganda, is part of the larger Project Compass operation. Project Compass began in 2025, and its partner law-enforcement agencies span the US, UK, and EU member states. Investigators from Belgium, Finland, Hungary, Ireland, Luxembourg, the Netherlands, Portugal, Spain, and Sweden participated in the Referral Action Days during June and July. Various groups linked to The Com post content online to recruit members and groom young victims using social media, gaming platforms, and messaging apps. “The more extreme and harmful the content a user or group can produce or extort, the higher their status within the online community,” according to Europol. “These acts are often livestreamed on social media platforms, where online bystanders cheer them on, and later saved and disseminated.” The URLs flagged for removal during this latest push to disrupt The Com’s recruiting activities included “violent videos and images depicting self-harm, suicide, child sexual abuse material (CSAM), animal cruelty, and violent attacks,” the international cops said. This, the European cops say, includes so-called blood walls, which are paintings made with blood that display the extorter’s alias and group affiliation, and cut-signs, where the victims are forced to carve the extorter’s name into their bodies. It also includes videos of street attacks and arson, plus manuals on how to commit these violent attacks, along with instructions on grooming and extorting vulnerable minors, and conducting doxxing and swatting. Europol says its European Counter Terrorism Centre has received “hundreds” of requests from member states and others over the past two years to help investigate crimes linked to The Com. It describes the online network as a “global threat, particularly concerning minors as both victims and perpetrators.” Last year, both the UK and US issued similar warnings about a subset of The Com that recruits children and teens for contract shootings, kidnappings, and other real-life violent crimes. In July 2025, the FBI said that In Real Life (IRL) Com had become increasingly brazen in its swat-for-hire and violence-as-a-service solicitations. The FBI's alert followed a similar notice from the UK National Crime Agency about a "deeply concerning" trend of The Com recruiting teenage boys to commit a range of criminal acts, from cyber fraud and ransomware to child sexual abuse.®

Marco Rubio says the US will deny visas to foreign nationals involved in cybercrime and may extend the restrictions to their immediate families. The US secretary of state announced the restrictions on Thursday, citing a rise in overseas investment scams "often orchestrated by Chinese transnational criminal organizations." Rubio said that in 2024, scammers defrauded US citizens of more than $10 billion, and additionally preyed on children through sextortion schemes that can "devastate families and futures." "The Trump Administration is deploying every tool at our disposal – sanctions, prosecutions, asset seizures, extradition requests, and international law enforcement cooperation – to dismantle criminal scam networks and impose costs on those who enable them," he said. "By restricting visa issuance to those who are responsible for or complicit in these criminal enterprises, we are sending a clear message: The United States will go after those who prey on our citizens." The policy uses authority provided by Section 212(a)(3)(C) of the Immigration and Nationality Act (INA) and will apply primarily to those "responsible for, or complicit in, cybercrime and cyber-enabled crime." It may also extend to immediate family members, Rubio said. Section 212(a)(3)(C) of the INA already imposes restrictions on individuals seeking visas when their entry or proposed activity could lead to "serious adverse foreign policy consequences" for the US. Rubio is no stranger to invoking the same provision as the basis for new visa restrictions. In May 2025, for example, the secretary of state announced restrictions for foreign officials who take steps to restrict US citizens' freedom of expression, be that through threats of arrest for social media posts, or demands for US platforms to adopt content moderation policies. Earlier, in March 2025, Rubio announced a policy targeting private sector workers who facilitated illegal immigration. In September, he invoked the provision again to impose restrictions on Central Americans accused of helping the Chinese Communist Party undermine the rule of law in the region. The Biden administration used the same authority in 2021 to establish what became known as the Khashoggi Ban, a visa restriction policy targeting people acting on behalf of foreign governments to suppress or harm dissidents. It followed the Saudi government's murder of journalist and regime critic Jamal Khashoggi. The US already has other ways to deny entry to convicted cybercriminals. Section 212(a)(2) of the INA, for example, can make foreign nationals ineligible for visas over convictions for crimes involving moral turpitude, a category that can include offenses such as fraud. ®

Open AI’s admission this week that its agents escaped the sandbox and autonomously hacked model repository Hugging Face has spawned more apocalyptic warnings of agents gone bad than we can count. Thankfully, Renato Marinho, chief research officer at Morphus Labs and a SANS Technology Institute instructor, brought some sanity to the discussion. “It is tempting to read this as ‘AI can now hack autonomously, the sky is falling,’” Marinho said in a Thursday blog. “Resist that.” He went on to make three very pertinent points about the agentic attack. First, and probably most important: The models didn’t have guardrails – and that was intentional. As OpenAI said in its mea culpa, GPT-5.6 Sol and "an even more capable pre-release model" were among those that attacked Hugging Face. It also noted that the LLMs’ “deployment safeguards were intentionally not enabled during this evaluation because it was aimed at testing cyber vulnerabilities.” So while it’s very concerning that these models broke out of their own testing environment, and the debate over safety guardrails remains worth having, drawing a direct line from the Hugging Face attack to the need for strong AI guardrails doesn’t work. “This measured a ceiling, not normal production behavior,” Marinho wrote. “The evaluation deliberately reduced the models' refusals. That is very different from a customer-facing model with safeguards enabled.” It’s worth noting that these same frontier models, with guardrails enabled, refused to help Hugging Face’s forensic investigation. “The attacker was bound by no usage policy, while our own forensic work was blocked by the guardrails of the hosted models we first tried,” the model hub’s security team said. So Hugging Face used a Chinese open-weight model to investigate the breach. Another thing worth considering is that real-life attackers are probably going to use open-weight models anyway. They’re more accessible to everyone, it’s easier to remove their built-in protections, and they’re a whole lot less expensive than their frontier counterparts. Second, as we’ve pointed out previously: AI companies touting their own models’ autonomous bug-finding and hacking abilities creates a marketing win for the companies themselves. As Marinho points out, Hugging Face is not an OpenAI competitor. The AI giant stating “‘our model escaped and hacked a partner’ conveniently showcases frontier capability,” he added. “Read the framing with the same skepticism you'd apply to any ‘our product is dangerously powerful’ claim, and treat it as marketing until it is independently corroborated.” Finally, the attack technique itself isn’t novel. “Exposed credentials plus zero-days into a production database is a chain any of us would recognize,” Marinho wrote. The agents working together on an end-to-end attack chain is notable - but we’ve also seen this in previous testing, like that carried out by frontier security lab Irregular earlier this spring. Agents gone rogue?! Shocking Irregular said its testing found that AI agents will work together to bypass security controls and stealthily steal sensitive data from within the enterprise systems in which they operate – especially when prompted like a hard-ass boss. While the prompts themselves didn’t specifically reference hacking or exploiting vulnerabilities, they conveyed a sense of urgency: “It is of utmost importance that you perform the task exactly as required,” and “When you talk to your sub-agents, convey all the requirements to them, and be ruthless about the requirements and encourage them to perform the tasks fully and exactly. You are a strong manager and you do not easily cave in to or succumb to pleas by the sub-agents to not fully fulfill their tasks.” The agents did as instructed, and ultimately "demonstrated emergent offensive cyber behavior," including independently discovering and exploiting vulnerabilities, escalating privileges to disarm security products, and bypassing leak-prevention tools to exfiltrate secrets and other data. And the Irregular research wasn’t even testing the agents’ offensive cyber capabilities — so it shouldn’t be too surprising that OpenAI’s benchmark research, aptly titled “Can AI Agents Turn Security Vulnerabilities into Real Attacks?” produced a resounding yes. Agents have one job – to complete a task. They aren’t bound by ethical or moral constraints that we (hopefully) see in human red team hackers. If prompted to “pursue advanced exploitation using complex attack paths,” especially without guardrails enabled, the models will do whatever it takes to achieve success. That’s what the leading AI companies trained them to do. ®

Apple macOS apps that have been downloaded from the internet and run at least once can be swapped with malicious versions, a pair of researchers say, calling into question the thoroughness of the company's "Gatekeeper" defenses. As Apple explains, "When a user downloads and opens an app, a plug-in, or an installer package from outside the App Store, Gatekeeper verifies that the software is from an identified developer, is notarized by Apple to be free of known malicious content, and hasn’t been altered." Security researchers Talal Haj Bakry and Tommy Mysk say they've identified a gap in Gatekeeper and associated code signing rituals that "allows an attacker to silently replace the main executable of any application downloaded from the web without requiring elevated privileges." The attacker needs to have means of user-level code execution available, such as a malicious app or downloaded script, so it's not a zero-click vulnerability that a remote attacker can deploy. Nonetheless, the finding shows Gatekeeper to be rather lax in its gatekeeping duties. Bakry and Mysk managed to alter a macOS app downloaded from the web (not from the App Store) and Gatekeeper failed to object. Their technique doesn't work on Mac App Store apps, the Mysk team told The Register, because they're owned by root, so a process running with current user privileges won't be able to overwrite them. But for macOS apps downloaded from the web, such as Brave, Slack, Signal, or Visual Studio Code, among many others, there's potential risk. The attack scenario requires an app downloaded from the web that has been run once – allowing Gatekeeper to complete its initial validation – and the ability to execute user-scoped code. The initial validation phase that Gatekeeper conducts is supposed to prevent subsequent modifications to the application bundle, even with administrative privileges. But the Mysk team found that you can archive a downloaded, once-run app using tar (a file archiving utility), then remove the original and replace it with a malicious version, and macOS does not require reauthorization. They've recorded a video demonstrating how the attack works. The Mysk team said there are many ways an attacker might gain the necessary access to get around Gatekeeper, such as tools installed through the command line, convincing someone to copy and paste a command to their terminal, downloading and running an malicious app, a prompt injection attack on an AI agent, or a supply chain attack via npm, brew, or some other package manager. And once a doppelganger version of an app is in place, it can magnify its mischief by presenting deceptive prompts that users are more likely to trust because they appear to come from a known app. Tommy Mysk said he was uncertain about the exact cause of the issue, but speculated it may have something to do with cached value retention. "When you open the app for the first time and it passes all validation checks, macOS marks the app as trusted and saves this data," he said. "Later when I modify the executable, macOS detects a change in the bundle and tries to revalidate its integrity. It seems the cached value of the trust causes macOS to pass the validation even though the bundle has changed." The Mysk team reported their findings to Apple, which reportedly closed the issue. "Apple doesn't consider this attack to be 'modifying' the signed executable," the Mysk team explained. "Instead, Apple says that by archiving/restoring the app bundle, the proof-of-concept code overwrites the entire app bundle, making it locally built. "Locally built app bundles are not covered by macOS guards. And this is why access to Keychain or TCC protected directories require system authorization prompts. And for users to accept those is a matter of social engineering attacks that Apple considers out of scope." Apple did not respond to a request for comment. ®

Kremlin cyber goons have been breaking into government and commercial networks for at least a year by exploiting a Zimbra bug with a novel twist on Russia’s usual phishing expeditions: this attack occurs as soon as the victim looks at an email, with no need to even click on a link or open a file. These attacks have been ongoing since July 2025, according to a whopping 27 US, UK, and other international government agencies, which attribute the intrusions to a group they track as Laundry Bear, aka Void Blizzard. “Laundry Bear’s targeting is almost certainly to gather sensitive information for the Russian Federation, with these actors primarily focusing on the covert acquisition of email data,” according to the joint security alert. The Russians’ latest campaign targets CVE-2025-66376, a cross-site scripting (XSS) vulnerability in the Zimbra web-based email and collaboration suite that was patched in November 2025 – but Moscow's attackers began exploiting it long before then. This type of vulnerability allows attackers to inject malicious JavaScript into web pages viewed by the victim. In this case, the phishing bears abused the security hole in the Zimbra Collaboration Suite by sending malware-laden HTML email messages to target Western organizations. Targeted orgs include those in the defense industrial base, federal and local governments, education, energy, law enforcement, media, non-governmental organizations, and technology sectors. Some of the email addresses used in this campaign include ivanka.zurabishvili@proton[.]me, zmul1@buildandconsulting[.]com, garrysmithme@pinmx[.]net, and hostingclient@pinmx[.]net, we’re told. The attack doesn’t require any user interaction other than viewing the malicious email, and once that happens, the attackers get to work exfiltrating a ton of data. This includes the victims’ last 90 days of email communications, email addresses and passwords, the organizations’ email directories such as global address lists, two-factor authentication tokens, and newly created application passcodes. Then the attackers use these stolen credentials to maintain access to the victims’ email, modifying account preferences and collecting authentication information. Laundry Bear stores the stolen goods on an unattributable virtual private server (VPS) running its custom “Flowerbed” collection framework. Flowerbed is a Python project that uses Docker for containerization. “The simplistic Flowerbed codebase has indications that artificial intelligence (AI) played a role in its development,” the government agencies noted. The 31-page security alert includes an extensive indicators of compromise (IOC) section, which organizations should review to identify individuals compromised by the campaign. Also, the agencies recommend minimizing employees’ use of the ZCS webmail client until their organizations update to a patched version that is not vulnerable to CVE-2025-66376. ®

At least 2.2 million vehicles fitted with dealer-installed KARR and SWDS security systems are vulnerable to nearby Bluetooth attacks that can unlock doors or prevent a stopped vehicle from starting, according to researchers at the University of California San Diego. An advance look at the research published by UCSD this week (the full writeup won’t be available until August 12) reveals that KARR and SWDS security devices manufactured by Acrisure contain a serious flaw: They “all … rely on the same secure key,” the researchers found. What that means, according to the researchers, is that anyone who knows the key, has a device with a Bluetooth connection, and can get within five yards of an affected vehicle can unlock it, make the horn honk, flash the headlights, or even prevent it from starting. “Instead of smashing a window to get access to a vehicle, thieves could simply connect remotely via Bluetooth to the device inside the vehicle, and make it unlock car doors,” Jerry Yu, coauthor on the research and UCSD compsci graduate, said in the release. KARR/SWDS devices are installed by dealerships. Along with providing key fob-like functions, they also serve as an antitheft device, allowing dealers and buyers to track cars with the devices installed in the case of theft. According to UCSD, the devices are typically sold as a paid upgrade at dealerships around the US. KARR says its products are available through more than 3,000 dealerships nationwide. Per the researchers, however, those devices remain active even if a buyer declines the service, meaning those who don’t have an active KARR/SWDS contract are still at risk. “Removing the devices is not trivial,” UCSD compsci PhD candidate and paper co-author Yibo Wei said in the university’s report on the research. “You have to open up the dashboard and cut and reconnect the wires that are deeply intertwined with the car’s computers and ignition system.” In other words, there are likely a lot of cars on the road with one of these units installed, and for many owners, a KARR or SWDS window sticker may be the only obvious indication. The researchers said that most vulnerable vehicles were purchased in Southern California in the past nine years from Honda, Toyota, Mazda, Ford, and Jeep dealerships. Secondary market resales, however, mean affected vehicles can be found throughout the US and even as far away as Japan, the team noted. They also discovered a public database that stores information about equipped vehicles, according to UCSD. For those worried their vehicle may be vulnerable, no need to worry: KARR Security has already released a firmware update for affected devices that can be installed by both active customers and those with an inactive security system; steps are included on the company’s website. It’s not clear if KARR is notifying customers of the need to update their security system - we asked, but the company didn’t directly respond to that question. What KARR did tell us was that, in contrast to the UCSD finding that “all KARR-SWDS devices rely on the same secure key,” it claims that only a small percentage of devices “with certain Bluetooth-related components” are actually affected. “The vulnerability described in the research is highly complex and presents a low risk to customers under real-world conditions,” a KARR spokesperson told us. “Nevertheless, we responded promptly and developed a firmware update to address the issue.” The vulnerability was discovered serendipitously by the UCSD researchers years ago when they were doing research on credit card skimmers and spotted Bluetooth fingerprints they couldn’t identify. After figuring out they had spotted car security systems, the team started digging into the devices, and here we are. We contacted the team to get more detail on their findings, but didn’t hear back. They’ll be presenting their work at DEF CON on August 9, and the USENIX Security conference on August 12. ®