The Register

JFrog Artifactory instances continue to get hit hard. Multiple attackers are exploiting three JFrog Artifactory bugs to gain administrative control over vulnerable instances - in some cases, just days after the vendor published a patch - and then using this illicit access to install malicious plugins and backdoors. The three vulnerabilities are: CVE-2026-42018 is a high-severity, improper authentication flaw that can return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled. An attacker can use this token to authenticate to the repository manager and then access sensitive resources. JFrog patched this vulnerability on August 12. CVE-2026-42016 is a high-severity privilege-escalation bug. Artifactory doesn’t properly validate the token’s scope, and this can allow an attacker with low-privileged access to elevate privileges and perform actions that they should not be allowed to do. JFrog fixed this one on July 27. CVE-2026-82329 is a critical authentication-bypass vulnerability that allows unauthenticated attackers with network access to obtain administrative privileges. JFrog published a patch for it on August 28. Earlier this month, security researchers told The Register that miscreants began battering internet-exposed systems vulnerable to CVE-2026-82329 just four days after JFrog disclosed the bug. In addition to creating new administrative credentials, watchTowr’s honeypot network caught miscreants “enumerating users, groups, credential sets and federated access topologies,” said Yordan Ganchev, principal threat intelligence specialist at watchTowr. The one thing everyone agrees upon is that attackers didn’t start exploiting any of these CVEs until after JFrog issued fixes. In a Thursday report, Wiz security researchers “confirmed in-the-wild exploitation of all three vulnerabilities across multiple environments,” and noted that “patching velocity has been slow.” JFrog has not responded to any of The Register’s inquiries about attacks against any of the three CVEs. 'Patching velocity has been slow' Six weeks after JFrog disclosed CVE-2026-42016, 59 percent of organizations remain vulnerable, and 62 percent remain vulnerable to CVE-2026-42018 after four weeks. Organizations have been quicker to remediate the critical bug, CVE-2026-82329, although 49 percent remain vulnerable two weeks after its publication, according to Wiz. Beginning August 15 and running through September 8, Wiz spotted “multiple” attackers chaining CVE-2026-42018 and CVE-2026-42016 against self-hosted Artifactory instances to gain admin access. Many of these intruders then dropped a custom Rust backdoor to establish command-and-control (C2) capabilities. While the post-exploitation activity varies, Wiz reports observing attackers doing all types of mischief with their administrative access to compromised Artifactory instances, including establishing persistent admin accounts, installing Groovy plugins to achieve remote code execution on the server, executing shell commands run through the plugin to perform reconnaissance and scan for sensitive files, deliver second-stage payloads, and upload web shells. Then, between September 1 and 8, Wiz saw “several” attackers exploiting CVE-2026-82329. These intrusions were not a “unified attack chain by a single threat actor,” but spanned multiple illicit behaviors including exfiltration of configuration details, establishing persistent admin accounts, token minting for long-lived credentials, stealing keys, attaching their own SSH keys to created users in some cases, and enumerating users, repositories, and tokens. If you haven't already, patch vulnerable instances Wiz advises - and we strongly concur - upgrading to a fixed Artifactory version as soon as possible. “Given that exploitation may be possible remotely without authentication under the default configuration, organizations should prioritize internet-accessible Artifactory instances and restrict network access to trusted users and systems where possible,” the researchers added. “Organizations should also review Artifactory authentication and administrative activity for unexpected privileged access.” These latest exploits follow a rough few months for JFrog's package management system, which has been under fire from both human and AI attackers. OpenAI and JFrog revealed that OpenAI’s models broke out of their cages to hack Hugging Face by exploiting an Artifactory zero-day in July, and at Black Hat, the model provider said agents used Artifactory to build message boards and help each other access the open internet. ®

A Ukrainian lawyer who wound up coding malware for the Conti ransomware gang has been sentenced to four years in a US prison. Oleksii Oleksiyovych Lytvynenko, 44, pleaded guilty in June to conspiracy to commit wire fraud over his role in Conti, the Russia-linked ransomware operation associated with more than 1,000 victims and at least $150 million in ransom payments. Lytvynenko took an unusual route into the ransomware business. The Ukrainian national, who later lived in Cork, Ireland, trained as a lawyer before joining Conti as an intruder and developer. According to his plea agreement [PDF], Lytvynenko operated under the handle "henry" and joined a team run by another Conti conspirator known as "silver" or "buza." He was recruited to help with coding and directed to work on a malware loader – software designed to get other malicious code running on a victim's machine. Prosecutors said his Google account showed he had also been doing some homework. Investigators found books and videos about malware and hacking alongside Conti malware, ransom notes, and stolen victim data. Prosecutors said he also used Google and ZoomInfo to research potential targets. Lytvynenko wasn't confined to writing code, according to the filing. Evidence from his online accounts showed that he possessed data stolen from eight US victims and four overseas, with the eight American victims reporting more than $1.5 million in losses. Court documents identify several Bitcoin transfers tied to his Conti work, including 0.4 BTC worth $25,042 that prosecutors traced back to one of his victims. He has been ordered to forfeit the same amount. Conti disbanded in 2022 after its internal chats and source code were leaked following the gang's public support for Russia's invasion of Ukraine. Lytvynenko apparently didn't take that as his cue to find another line of work. When Gardaí turned up at his County Cork home in July 2023, they said they found his laptop open, Cobalt Strike running and a Rocket.Chat session connected over Tor. Prosecutors said evidence recovered from the machine showed that his involvement in ransomware activity had continued after Conti disbanded. Lytvynenko was extradited from Ireland to the US in October 2025. The Justice Department says Conti attacked organizations across 47 US states, the District of Columbia, Puerto Rico, and 31 foreign countries between 2020 and 2022. By January 2022, the FBI estimated that victim payouts associated with Conti exceeded $150 million. Lytvynenko will now have four years to contemplate a career change. ®

Manufacturers selling products with digital elements in the EU must now report actively exploited vulnerabilities to cybersecurity authorities under the Cyber Resilience Act's mandatory reporting rules. The reporting duties set out in Article 14 of the CRA became applicable today. Subject to the regulation's exemptions, they apply to manufacturers of products with digital elements made available in the EU, regardless of where those manufacturers are based. Manufacturers must submit an early warning within 24 hours of becoming aware of an actively exploited vulnerability, followed by a more detailed notification within 72 hours. The same deadlines apply to severe incidents affecting the security of products with digital elements. The only difference in timing is related to the final report. Manufacturers must provide a final report on an actively exploited vulnerability within 14 days of making a corrective or mitigating measure available. For serious incidents, the final report is due one month after the first report. Darren Anstee, CTO for security at Netscout, said the reporting deadlines introduce much-needed urgency in working toward global cyber resilience. "The 24-hour window in which an initial warning must be reported creates a level of urgency, with subsequent deadlines ensuring that the gathering and release of additional information is prompt," he said. "Better, more rapid sharing of information helps organisations put defences and mitigating controls in place when they know there is heightened risk." EU and non-EU manufacturers must file these reports through ENISA's Single Reporting Platform (SRP). Notifications are addressed to the coordinating computer security incident response team (CSIRT) determined under the CRA. For an EU manufacturer, this is generally the CSIRT for the member state where it has its main establishment; separate rules determine the coordinator for manufacturers based outside the bloc. Manufacturers must also inform affected users, where appropriate, about actively exploited vulnerabilities or severe incidents. The CRA states that users must be informed of available corrections or mitigations without undue delay. Generally, failures under the CRA are punishable by varying tiers of fines, the most serious of which can reach €15 million ($17.4 million) or 2.5 percent of the offender's annual turnover, whichever is higher. The reporting duties that took effect today are classified as core responsibilities under the act, meaning failures to comply with them could lead to the maximum fines being issued. They are the latest step in the EU's plan to drip-feed tighter security regulations on companies operating in the bloc. Most remaining CRA provisions become applicable on December 11, 2027, at which time manufacturers will also be required to embed security by design and default. That means no default passwords and security updates are no longer optional. Products covered by the CRA will also have to undergo the applicable conformity assessment before being placed on the EU market and bearing a CE mark. More than a deadline The CRA's new rules are not just intended to accelerate manufacturers' responses to security flaws. They are also intended to give businesses a better understanding of their software supply chains. With the reporting clock starting as soon as manufacturers become aware of an issue, they cannot afford to begin mapping an affected product only after a vulnerability or incident emerges. They need a comprehensive view of the affected product and any related products that may share the flaw if they are to meet the deadlines. Furthermore, those requirements demand that manufacturers maintain this understanding throughout each product's lifecycle. Creating a software bill of materials (SBOM) when a product is launched is one thing. The SBOM becomes a mandatory requirement when most of the CRA's remaining provisions become applicable next year. Maintaining that security snapshot over time, however, is intended to help reduce the number and impact of serious cyberattacks across the EU. "What all this means for manufacturers is that secure development, effective vulnerability handling, and traceability across the software supply chain should be elevated to the top of their priority list," said Eran Kinsbruner, veep of product marketing at Checkmarx. "Modern applications are assembled from a complex ecosystem of components, with combinations of proprietary code, open-source packages, third-party components and, increasingly, AI models and services all interconnected," he added. "Organizations need to understand these components, their dependencies and the risks they introduce." Given enough time, the CRA looks set to improve cyber resilience across the board. However, lawyers warn that manufacturers, particularly those outside heavily regulated sectors, must now contend with a growing body of overlapping rules. "The CRA is arriving as organizations are already grappling with a growing body of Digital Decade legislation, including NIS2, DORA, the Data Act, and the AI Act," said Heidi Waem, data, privacy and cybersecurity partner at DLA Piper. "We're seeing the compliance challenge for many businesses evolving beyond understanding single regulations in isolation, but determining how multiple frameworks interact, where requirements overlap and how compliance programmes can be coordinated across them." John Magee, partner and global co-chair of data, privacy, and cybersecurity at the same law firm, added: "Even now we're seeing the breadth of the regulation's reach catching organizations off guard. "Many still associate the CRA primarily with consumer IoT devices, when in reality it applies to a much broader pool of products with digital elements. For compliance teams already very busy managing multiple Digital Decade initiatives, there is a risk that this first wave of CRA obligations has arrived sooner, and with a wider impact, than they had expected." ®

In the latest installment of "my AI model is more dangerous than yours," Anthropic on Thursday warned that cybercriminals and state-sponsored hackers alike are using its Claude models to automate cyberattacks, build kamikaze drone swarms, conduct mass surveillance operations, and try to develop an even more dangerous version of a deadly mosquito-borne virus. The baddies have come a long way since November, when an earlier Anthropic report documented Chinese spies using Claude to automate digital intrusions and steal sensitive data at a handful of critical organizations. Now everyone from ShinyHunters to Russian freelancers is getting in on the illicit model usage. This is not to say that Anthropic – nor any other frontier AI lab – plans to slow down its model development or testing initiatives, or take responsibility when its AI commits crimes. It does, however, “hope that the findings in this report will help other developers recognize similar patterns on their own platforms, give governments and civil society a clearer view of how emerging threats take shape, and strengthen collective defenses.” The model maker’s latest very lengthy report on AI misuse covers activity Anthropic disrupted between December 2025 and August 2026 across seven “harm areas” where miscreants used – or attempted to use – Claude Haiku, Sonnet, and Opus models for evil. These span cyber operations, influence operations, surveillance, scams and fraud, biological misuse, conventional weapons development, and distillation. Anthropic also noted that its most powerful Claude Fable or Mythos-class models weren’t used, except in one distillation case. Even without those most advanced systems, the case studies in the report highlight some pretty bad behavior. Autonomous cyberattacks For example, a Russian espionage crew that Anthropic tracks as GTG-20006 – the state-sponsored cyber espionage arm of Russia’s Foreign Intelligence Service (SVR), also known as Midnight Blizzard, APT29, or Cozy Bear – increased the speed of its attacks by using AI to automate the entire kill chain. Anthropic identified more than 20 organizations targeted in these attacks, including embassies, think tanks, defense-industrial companies, and government, defense, and intelligence agencies across Ukraine, Europe, the Middle East, Asia, and North Africa. “We observed GTG-20006 operate through customized AI-driven workflows that automated much of their operations from development, infrastructure acquisition, phishing, persistence through command and control, to data exfiltration,” Anthropic said. Meanwhile, “multiple clusters” linked to the data-theft-and-extortion gang ShinyHunters used Claude to scale their smash-and-grab operations. One affiliate that specializes in supply-chain attacks breached a software-as-a-service provider, and used that foothold to steal data from about 200 of the SaaS company’s customer organizations. “It then conducted a session-store dump containing over 2,100 Azure AD token sets spanning more than 40 corporate tenants in about 34 hours,” according to the report. “AI agents performed nearly all of the work.” Biological misuse Moving on to a serious health-and-safety risk that looks even scarier when given an AI boost: Anthropic’s report documents five cases of users in “unsupported regions” using Claude to support biological weapons development. In one, a scientist attempted to use Claude to help write a grant application for research related to chikungunya virus, a mosquito-borne virus that can cause severe disease and death. The research focused on the virus’ transmissibility and immune evasion properties, which Anthropic admits could be used to help develop better vaccines. Or “it could also be used to make the pathogen more dangerous,” the report authors said, noting that the military research institute where the research would be performed gave them “cause of concern.” In May, Anthropic discovered a user outside the US using Claude in their research on adaptations of highly pathogenic avian influenza – bird flu. “Unlike other influenza variants, H5 viruses (of which this avian virus is one) often show striking brain involvement in cats, foxes, ferrets, and some human cases,” the report says. “A pandemic variant with such properties would be especially concerning due to its potential to increase disease severity, confuse diagnosis, and hinder treatment.” Weapons development Since its November report, Anthropic has identified new categories for Claude misuse that violate its terms of service. One of these involves users outside the US using Claude to develop software for conventional weapons – firearms, missiles, armed drones, bombs, and other munitions, plus targeting and control systems that operate them. In its new report, the model maker shares details on six cases: three in China, two in Russia, and one in Yemen. In Yemen, a weapons development program used Claude instead of human software engineers to develop guidance, navigation, and control (GNC) software that steers and stabilizes a flying vehicle. “Our safeguards blocked many of their requests, but not all of them,” Anthropic says. The same team used Claude to try to develop guided weapons. While Anthropic says it has no evidence that the actors produced an operational device, it says they did test-fire a guided rocket. “We banned accounts associated with the actors and shared threat information with public- and private-sector partners to mitigate risks posed by the actors,” the report says. “Nevertheless, we have evidence that the actors had already built an offline simulation toolkit that does not rely on Claude or other engineering computing environments.” In China, someone used Claude to draft a Chinese-language specification for an anti-torpedo fire control system, and then benchmark their system against specific US anti-torpedo and anti-submarine programs. Anthropic assesses that the user was associated with a Chinese defense industry manufacturer aiming to produce a weapons specification and acquisition proposal for the People's Liberation Army Navy. According to the report: The actor used Claude to write the acquisition proposal, refining it over many drafts. After each draft, the actor instructed Claude to role-play a hostile expert reviewer to critique the proposal, then used that feedback to sharpen the next version. In parallel, the actor used Claude to build pieces of the anti-torpedo weapons system’s fire control software and a test matrix to validate them. Anthropic uncovered this during an internal investigation into suspected weapons development and banned the account. In yet another case, Anthropic identified a likely Russian “freelance team” attempting to build a full-stack autonomous first-person-view (FPV) kamikaze drone swarm. They used Claude to write and test the code, building the drones’ core software system. Anthropic also banned these accounts. ®

With the release of Apple Watch Series 12, Apple has decided that it's ok to capture people's conversations without their consent. The latest Apple Watch comes with Audio Intelligence, a set of AI audio processing capabilities tuned for the company's S11 chip. Its features include: Sound Recognition, Music Recognition with Shazam, Live Rewind, and Siri Recap. "Live Rewind lets you instantly see the last 15 seconds of a conversation as text," Apple explains in its technical summary [PDF]. "Siri Recap summarizes conversations throughout your day and produces high-level Apple Intelligence-generated notes so you can stay present in the moment and catch up later." With the double-press of the Digital Crown – as Apple grandly refers to the button on its Watch – Live Rewind takes in an audio stream from the Watch microphone, processes it in a Secure Exclave on the S11 chip, and routes the data to the user's nearby iPhone, which runs a speech-to-text algorithm on the 15-second audio segment. The resulting text is saved and the audio is discarded. The wearer's Watch emits an audible tone, even in silent mode, to alert those in the vicinity and provides a visual cue for those able to see the face of the device. Nonetheless, bystanders alerted to the recording – to the extent they recognize the meaning of the tone – have not consented to being recorded, which is a legal requirement in 11 US states that have all-party consent laws. Apple characterizes its implementation of brief eavesdropping as respectful of personal privacy. It makes that claim in a section titled, "How Live Rewind respects those around you," citing the audible chime and visual on-screen animation. Siri Recap, meanwhile, "summarizes conversations throughout your day and produces high-level Apple Intelligence-generated notes so you can stay present in the moment and catch up later." This too, Apple describes as an act of respect. "By design, Siri Recap does not create a recording, does not produce a verbatim transcript, and does not identify and attribute speakers," Apple's technical documentation explains. "The output is a brief, high-level summary, comparable to notes a person might write after a conversation. There is no audible signal because no raw audio is retained, and there is no way to reconstruct the original audio from a Siri Recap or share raw audio with anyone." The implication here is that Apple's non-consensual audio processing is less contemptuous of the public than the middle finger Meta has raised with its AI Glasses. That may be the case, but privacy advocates are still not impressed. "Our right to conversational privacy must include freedom from other people, without our clear opt-in consent, using technology to document what we are saying," said Electronic Frontier Foundation privacy litigation director Adam Schwartz in an email to The Register. "Otherwise, people will self-censor, and conversation will lose its spontaneity and intimacy. "So, EFF is disappointed that Apple is releasing a new Audio Intelligence feature that reportedly can create a transcript or written summary of what people are saying in the vicinity of an Apple Watch. People don't really have a practical means to consent or decline recording. "We suggest people should think twice before using this technology, out of respect to the conversational privacy of others. While it remains to be seen how state eavesdropping laws will apply to this new technology, it is clear that always-on monitoring of our conversations is an unacceptable burden on our conversational privacy." ®

An unknown attacker used hundreds of AI agents to exploit two PaperCut MF/NG bugs and break into at least 395 organizations. The victims were concentrated in the US education sector, and the intrusions moved fast. In one case, an American high school went from initial access to domain admin in seven minutes. These agents, powered by OpenAI’s Codex harness and a DeepSeek model, also allowed the miscreant to attack organizations at scale, according to threat-intel firm GreyNoise, which traced the campaign’s orchestration to 45.142.193.132 on August 31. “The adversary went from an empty workspace to first achieving RCE against a real victim in just under four hours, first domain admin in an additional two hours, and once the full campaign launched, compromised at least 11 organizations in 26 seconds,” GreyNoise analysts said in a Wednesday report. The security provider attributes these intrusions to a “likely Russian-speaking” criminal who used AI to develop exploits against the pair of PaperCut vulnerabilities disclosed just days earlier. On August 28, the print management software provider issued emergency patches for CVE-2026-81578 and CVE-2026-82078, at the time warning that it was “aware of confirmed customer incidents and are treating this matter with the highest priority.” The flaws affect PaperCut NG and MF, which are self-hosted Java web applications that by default run with SYSTEM-level privileges on Windows. PaperCut’s CEO later said that the first reported compromise came in on August 27, and involved an education-sector firm. On Thursday, PaperCut published security maintenance releases, which replace the earlier emergency fixes. By now, however, at least 440 instances hosted by 395 identified victim organizations in 48 countries have been compromised, according to GreyNoise. “There are other real victims that could not be attributed to a named organization,” the threat signals team wrote. The human attacker told the agents to avoid targeting entities in 28 countries with the top five being Russia, China, Hong Kong, Thailand, and Iran. Several Commonwealth of Independent States (CIS) countries are on the list, which is why GreyNoise says the crim is likely Russian-speaking. It’s typical for ransomware and other cybercrime operations to expressly avoid attacking Russia and other CIS countries, whose governments often provide safe harbor for extortionists and financially motivated crims - especially if they also happen to work day jobs as state-sponsored hackers. Plus, local cops tend to ignore the digital break-ins unless the gangs infect any in-country organizations. However, the agents in the PaperCut attacks didn’t always follow these instructions, and in some cases still hacked organizations based in countries on the do-not-hit list. “It’s currently uncertain why the [attacker's] agents deviated,” GreyNoise said. “But it is a good example of agents gone wild.” The US and the UK were the countries with the highest victim count, at 98 and 59, respectively. Schools and other education-industry organizations were, by far, the hardest hit with 204 victims. For comparison, the No. 2 industry (other/unclassified) had 51, while retail/commercial/professional services ranked third with 38 victims. After using AI to develop exploits, achieve remote code execution, and harvest credentials in a self-hosted lab, the baddie set hundreds of AI agents loose on the open internet to find and attack public-facing, vulnerable instances. “This campaign appears to be opportunistic,” according to GreyNoise. “There is a high concentration of US-based targets in the education sector; however, it’s likely that is more attributable to the customer base of PaperCut NG/MF.” Interestingly, the attacker did not immediately set to work on post-compromise evil deeds with all of the victims. GreyNoise noted “multiple-day delays” between gaining initial access and achieving domain admin “but only due to a lack of action by the adversary.” The fastest time was five minutes, while the longest was 144 minutes. It’s also unclear if the criminal is only focused on gaining access to compromised organizations - and then plans to hand the attack off to affiliates or other data-theft, extortion, and ransomware groups - or if they plan to use this access for follow-on nefarious activities of their own. GreyNoise does note that, in at least one case, Cloudflare’s Web Application Firewall (WAF) blocked the attacker. “Fundamental hardening of environments still matters against AI-enabled threats,” they wrote. It’s also worth noting that GreyNoise has been tracking malicious use of 45.142.193.132 since early July, and says this IP has been used in attacks against internet facing technologies and devices from Palo Alto, Ubiquiti, Citrix, SonicWall, and Proxmox VE. ®

McKesson's cyberattack last month affected roughly 6.4 million individuals, according to Have I Been Pwned (HIBP). The breach notification service added data leaked by serial extortionists ShinyHunters, revealing the scale of the attack for the first time. ShinyHunters initially claimed to have stolen 284 million documents from the medical and pharmaceutical supply company in August, although HIBP did not confirm that figure. The cybercriminals told The Register that they issued a $55.2 million extortion demand to prevent the release of McKesson's data – a sum that apparently was not paid, given the subsequent publication of the data. HIBP said: "The impacted data related to a range of individuals and roles, including marketing campaign recipients, patients, staff, and healthcare provider contacts." The types of information exposed vary between individuals, but the records collectively include names, email and physical addresses, genders, dates of birth, phone numbers, employer details, and sensitive health information. This is broadly consistent with ShinyHunters' claims that the stolen data included appointment dates and notes, as well as sensitive medical details such as the locations of patients' cancers. ShinyHunters also claimed to have stolen Social Security numbers (SSNs) as part of the breach, but HIBP did not include these in its analysis of the leaked corpus. The Register asked McKesson to comment on HIBP's assessment. The company, which supports 3,300 oncology providers in 29 states, has not publicly confirmed the scale of the breach or issued further details since the last update from its CIO and CTO on August 29. Medical device maker Boston Scientific disclosed a cyberattack at around the same time as McKesson, but has suffered a different kind of fallout. While McKesson is informing the millions of individuals affected by its breach, Boston Scientific told shareholders that disruption from its attack means it expects to miss its sales and earnings guidance for Q3. An update issued on Wednesday said manufacturing, order fulfillment, and shipping operations had been fully restored, although work to restore some business applications continued. Healthtech company Veradigm also disclosed a cyberattack to US regulators this week, days after ransomware group The Gentlemen claimed responsibility. Veradigm said attackers obtained credentials from a third-party vendor's environment and used them to access a company API, stealing patient data without disrupting operations. The Gentlemen claimed to have stolen around 3.5 million records containing personally identifiable information (PII), including SSNs. ®

PWNED Welcome back to PWNED, the weekly column where we highlight examples of how not to handle your security. This week’s tale of woe comes from a very unhealthy part of the healthcare sector. Have a story about someone leaving a gaping hole in their network? Share it with us at pwned@sitpub.com. Anonymity is available upon request. Our story comes courtesy of Chris Kirksey, founder and CEO of Direction, a digital marketing and SEO company that works in the healthcare industry. He also does security audits of his clients’ systems. Last year, Kirksey was checking out a dental practice’s systems and noticed something strange. There were three accounts that had admin access to the patient database, including one that belonged to a scheduling company the dentists had stopped using all the way back in 2021. The account had been active for at least three years and could access 4,000 patient records. Leaving an unnecessary account with access to protected health information created a potential HIPAA compliance risk, particularly if someone no longer authorized to view the data could still get to it. The office manager responsible for using the system didn’t even know that this dangerous login existed. Apparently, a contractor who set up the account never told anybody, then left the company. Because no one knew that the account existed, no one knew to kill it. Kirksey immediately set about getting rid of all three admin accounts he found on the dental practice’s system. He then set up new policies for his client. “I built a permanent rule after that,” he said. “Every vendor relationship that ends now triggers an automatic access shutdown and the full list gets reviewed twice a year no matter what.” Since the incident, Kirksey has found similar security holes at six other healthcare practices he has worked with. Yikes! “Everyone worries about the sticky note with a password on it or the file just called passwords.xls, because those get caught fast and make a good story,” he told us. “Nobody worries about the login they forgot even exists, and that is usually the one still wide open years later, causing real, unseen damage.” The lesson here is pretty straightforward. You need to see all of the accounts that have access to your data and make sure that they all have a reason to exist. Conduct regular audits, even if nothing seems wrong. And, as we’ve seen before, zombie accounts can kill. When an employee or contractor leaves, check not only which accounts they used, but also which accounts they created while doing the job. ®

Amid industry soul-searching¹ about the possibility of AI improving itself to the point that it kills everyone, Anthropic has revealed yet another incident that would qualify as a crime if perpetrated by a person. The AI biz published "an alignment assessment" detailing four times Claude models accessed third-party systems without authorization. The company has already reported three of the incidents. Evidence of the fourth was lurking in a session transcript dating back to January 2026 when the misbehavior occurred. Anthropic found the first three by scanning around 141,000 transcripts where Claude could have obtained internet access during evaluation. It missed the fourth initially because "our scan relied on an agentic search." Felony Bench, a tongue-in-cheek record of cyber intrusions carried out by major AI companies without consequences, has added this newly-discovered incident to its rap sheet of rogue AI actions. The January 2026 AI trespass involved an early version of Claude Opus 4.6, which was given a Capture the Flag (CTF) challenge under the oversight of the third-party model evaluator where the other hacking events occurred. Opus 4.6 managed to sabotage its chances of success by disabling the machine it was targeting. It assigned the device an IP address that already existed on another piece of hardware, rendering the target unreachable and making it impossible to solve the challenge. Those familiar with other incidents where AI models violated third-party systems may recall that unsolvable tasks represent a common catalyst for misbehavior. Models exhaust all aligned options, and then turn to transgressive approaches. Opus 4.6 might have been an exception, but when it tried to abort the task after recognizing that it could not reach the target machine, it failed to do so "due to a misconfiguration in [the model's] evaluation harness." It failed to shut down not just once but seven times. So it continued onward, trying other expected means to reach the target machine but failing. Then it explored further. "The model discovered a machine belonging to a third party that it was able to access, and stated that it believed this third party was part of the CTF," Anthropic explained in its post. "Inside the machine, the model found a file listing a password, which it used to gain admin access to the system." The model went on to gather more credentials, and modified a system setting to make it easier to access the personal information of an individual associated with the third party evaluation organization. Opus 4.6 might have done more but for the fact that it exhausted its token budget, bringing the session to an end. Anthropic says it's not as concerned about this incident as the others because the model tried to abort its task. "While the model’s disregard for the possibility that it might be harming real systems or people is concerning, many of the behaviors described here have changed considerably as our training has evolved across model generations," the company said. Anthropic said it considers these incidents serious but expects current training approaches "are likely able to address the specific alignment failure modes observed in these incidents." And if company training methods fall short, there's no real consequence to anyone at Anthropic other than writing up a revised alignment assessment. ® ¹ The term "soul-searching" is figurative and is not intended to indicate a belief that the technology industry has a soul.

At least four espionage groups, most with suspected links to China, are using a new exploit kit that chains two Chromium-based browser flaws and one Microsoft Windows bug to break into organizations' networks in the US and Southeast Asia. Mark Kelly, a threat researcher at email security shop Proofpoint, told The Register that the researchers don't know exactly who was targeted, nor how, and so far the damage appears limited. “In terms of organizations targeted, we saw fewer than 20 organizations globally targeted across the activity highlighted," he said. "However, the true number is almost certainly higher than this.” Proofpoint’s threat hunters spotted the new kit, which they named BlueMoon, and said its first observed use started on August 28. This is when a Beijing-backed crew they track as TA412, also known as Violet Typhoon and APT31, used BlueMoon to “repeatedly” target non-governmental organizations (NGOs), mining companies, and physical commodity trading firms in the US. TA412 is a cyberespionage group linked by US authorities to China's Ministry of State Security (MSS), and American prosecutors previously charged seven alleged members with conspiracy to commit computer intrusions and wire fraud, alleging they broke into computer networks, email accounts, and cloud storage belonging to numerous critical infrastructure organizations, companies, and individuals. Just days after Proofpoint documented the late-August activity, “several other espionage-motivated clusters began using BlueMoon, the majority of which have a suspected China nexus,” Kelly and fellow researchers Greg Lesnewich, Konstantin Klinger, Saher Naumaan, Julia Paluch, David Galazin, and Stuart Del Caliz said on Wednesday, noting that there may be other, non-China-nexus attackers using the exploit kit as well. “BlueMoon was developed and deployed rapidly, and shared across multiple threat actors within days,” Kelly told The Register. “This may reflect a reduced cost and barrier to entry for this class of capability, which has historically been rare and high value, as AI agents increasingly enable threat actor exploit development. That is particularly true for open-source codebases such as Chromium, where publicly accessible upstream patches create a ‘patch-gap’ window for rapid reverse engineering and exploit development ahead of downstream stable releases.” A Google spokesperson declined to comment beyond what Proofpoint wrote. Microsoft patched the Windows bug (CVE-2026-85880) on Tuesday, and a spokesperson reiterated that customers who applied that patch are protected. BlueMoon attack chain The kit chains together three vulnerabilities. The first is a V8 type confusion (CVE-2026-85046) flaw that allows remote code execution and affects all Chromium-based browsers, including Google Chrome and Microsoft Edge. Google patched this bug in Chrome on September 3, and at the time warned that it “is aware that an exploit for CVE-2026-85046 exists in the wild.” Microsoft published a security advisory saying it fixed the flaw in Edge Stable version 152.0.4191.62 on September 2. The second is a Chrome V8 sandbox escape. This one also affected all Chromium-based browsers. It does not have a CVE because Google doesn’t issue them for sandbox escapes. Finally, the third bug is a privilege escalation vulnerability in Windows Advanced Local Procedure Call (CVE-2026-85880) that Microsoft patched on Tuesday, as noted above. Redmond also warned that this flaw had been exploited as a zero-day prior to the security update. The Proofpoint researchers also note that both V8 vulnerabilities are what’s called "patch-gap" zero-days at the time of the observed activity. This means they were known and fixed in upstream Chromium source code – a change containing the fix for CVE-2026-85046 was committed on August 7. But they remained unpatched in the latest stable releases of Chrome and Chromium-based browsers available to the public for weeks. “It is likely that the exploit kit developer used these publicly available Chromium patches to weaponize the browser exploit chain,” the researchers note. From phishing to browser surveillance The attacks start with a phishing email that tricks victims into clicking on an actor-controlled URL. This triggers the two V8 bugs to allow remote code execution and escape the browser sandbox. The attack chain then exploits the Windows bug to download multiple payloads including browser-surveillance malware, credential-stealing backdoors, and others, depending on the group using the exploit kit. TA412’s first campaign, which began on August 28, used a range of lures. Some of the emails purported to come from university students interested in internships at the targeted organizations, and some were more target-specific exchanges, intended to build trust with the individual before ultimately sending a malicious link via email. In these instances, the exploit chain “ultimately downloaded and ran a loader executable on the infected host, which then installed a malicious browser extension disguised as Google Gemini on the victim's Chromium-based browser,” the team wrote. This browser extension, which Proofpoint tracks as GemStone, allowed the Beijing spies to issue commands through a command-and-control (C&C) channel, steal cookies and other sensitive data, take screenshots, and inject a keylogger into a browser tab. The malware also contains a keyword monitor, which injects an attacker-specified keyword list into the top frame of each page, scans the HTML body for these keywords, and triggers a screenshot if it finds any. A few days later, beginning on September 2, a second China-aligned spy crew that Proofpoint tracks under the temporary group designator UNK_LateNight used BlueMoon to target multiple US aerospace companies. The phishing emails used request-for-quotation lures specific to defense industry organizations, and included links to attacker-controlled domains spoofing a variety of US aerospace companies. These websites also served the BlueMoon exploit kit and ultimately loaded a backdoor called ShadowPad, which has been shared among multiple China-aligned groups since 2019. Around this same time, on September 2, another suspected espionage group that Proofpoint tracks as UNK_DoubleCheck targeted a Vietnamese manufacturing firm with messages sent from a compromised Southeast Asian government email address. The fourth campaign began a day later, and involved suspected China-linked spy crew UNK_QuietRacket using BlueMoon to target government, consulting, and financial-sector organizations in Indonesia and Singapore. These phishing emails used lures related to Indonesian conferences, such as the Indo Startup Expo and Forum 2026 and the World Conference on Creative Economy (WCCE 2026). Proofpoint warns that BlueMoon will likely be used by both cyberspies and financially motivated attackers. “The broader dynamic revealed by this activity - rapid exploit development that leverages the open source patch-gap – is likely to recur beyond BlueMoon as this development model becomes accessible,” the team wrote. ®

Zero-day researcher Nightmare Eclipse, aka MSNightmare, published yet another Microsoft Defender proof-of-concept exploit for a zero-day dubbed ShieldCrash, which they claim will allow attackers to bypass the earlier ShieldBreak patch and read files as SYSTEM. “I might rework this later into a full SYSTEM PoC but for now I'm dropping this skeleton PoC because I'm feeling a bit lazy,” the prolific Microsoft bug hunter and thorn in Redmond's side said in their latest zero-day exploit's README. As is usual with Nightmare’s zero-day cadence, they published ShieldCrash shortly after Microsoft released its latest Patch Tuesday security updates. According to Nightmare, this exploit works on Windows systems that have already applied the September patches. ShieldCrash purports to be a bypass of an earlier Defender privilege escalation zero-day, ShieldBreak (CVE-2026-69414), that allowed attackers to bypass another patch for another Nightmare Eclipse zero-day RoguePlanet (CVE-2026-50656). Redmond patched ShieldBreak last week, and RoguePlanet in July. Both allowed attackers to gain SYSTEM privileges on fully patched Windows 10, Windows 11, and Windows Server systems. The latest bypass, ShieldCrash, allows arbitrary file reads as SYSTEM - but not arbitrary writes or a full SYSTEM shell, according to the researcher. Microsoft did not immediately respond to The Register’s questions, including when it planned to patch ShieldCrash. We will update this story when we hear back. While the serial bug hunter typically finds and publishes Microsoft exploits - ShieldCrash is Nightmare’s 11th Microsoft zero-day, and they have made clear that with Redmond, their vendetta is personal - they recently branched out into other security vendors’ software. Last week, they released a zero-day bug called FalconFlank that affects CrowdStrike’s Falcon endpoint security platform. This one still has a Windows twist: the privilege escalation bug abuses the Microsoft Office malicious macros remediation feature in CrowdStrike Falcon. Security sleuth Kevin Beaumont confirmed the FalconFlank exploit works, along with several others Nightmare released over the past couple of weeks. These include HardBreacher, a now-patched elevation of privileges bug in Kaspersky’s endpoint antivirus product, and PrettyPrague, an elevation of privileges vuln in Gen Digital’s Avast antivirus software. ®

Tencent has patched up a zero-click vulnerability that security researchers used to create a worm capable of spreading through calls on WeChat. With more than 1.4 billion monthly active users, WeChat is among the most popular apps in the world. According to researchers at Calif, its VoIP stack contained a memory corruption bug that could enable a trusted contact to take control of a user's account simply by calling them. Calif called the flaw WeWorm, describing it as the first zero-click worm capable of spreading through WeChat calls on both iOS and Android. Calif released a demo of the vulnerability in action this week, and although Tencent has pushed fixes to address the attack on August 21, the team that found it is still withholding key details. In Calif's demonstration, the exploit took control of a victim's WeChat account within seconds, without the recipient answering the call. The compromised account then called another contact and repeated the process without user interaction. Declining the call stopped infection, but answering it or allowing it to continue ringing did not. An attacker could also try again when the recipient was away from the phone, the researchers said. "Exploitation takes only seconds, and gives us full control of the WeChat account," Calif said. "We can read and send messages, make calls, and act on the victim's behalf." The exploit requires the attacker to be on the victim's friends list. Calif argued that this offered limited protection because a compromised account could be used to target its trusted contacts. Calif said the WeWorm exploit could be chained with other vulnerabilities to compromise an entire device rather than only a WeChat account. It did not disclose the full attack chain. "Chained with other Android and iOS bugs we've reported and are helping fix, it can lead to full control of the device," the researchers said. "[Attackers] could exploit another app, gain root access using techniques like those in OEMpocalypse, take over the victim's WeChat app, and use it to attack you." Calif said it used AI to find the vulnerability and develop its first remote code execution (RCE) exploit in about two days. Tencent later confirmed the researchers' findings. The researchers said they published their high-level findings to highlight how AI could make such capabilities available beyond "well-funded, sophisticated actors." Calif plans to present the full analysis of WeWorm "at an upcoming conference." Ryan Fedasiuk, an adjunct assistant professor in Georgetown University's Security Studies Program, described the discovery of WeWorm as "an extremely serious incident." He called on the US and China to maintain open communication and share information as AI increases the potential scale and severity of cyber threats. The Register asked Tencent for additional comment. ®

The vulnpocalypse is upon us, dear reader. Microsoft delivered a record number of patches to address 974 CVEs in its own products this month, including two bugs that Redmond says are already under exploitation. September's record-breaking collection of security updates come after Microsoft served up 421 fixes in August, and 622 in July. We've seen the new normal and we are not impressed. Thanks, but no thanks, AI. In addition to Microsoft’s massive patch drop, Adobe on Tuesday issued 10 bulletins addressing 172 CVEs, including a max-severity vulnerability exploited as a zero day in Magento and its successor product Adobe Commerce. Adobe on Monday shipped a hotfix for this one, tracked as CVE-2026-75650 and named StyleSmuggler, that gives unauthenticated attackers remote code execution. StyleSmuggler If your organization has any type of online shop, prioritize this one first as it’s already being abused to compromise stores, according to e-commerce security shop Sansec. Sansec discovered StyleSmuggler, and reports that attacks started on September 4. Every version of Magento and Adobe Commerce, from 2.4.4 up to and including 2.4.9, has the flaw. The bug allows attackers to inject malicious PHP code inside Magento templates using the “styles” properties to evade safety detections. In confirmed attacks, the payload then installs a backdoor that connects to a command-and-control server and waits for instructions. “So far, we have no indication that the backdoor has been weaponized,” the Sansec Forensics Team wrote. Don’t wait to find out on this one. Put it at the top of your mitigation list. Microsoft's 974 CVEs On to Microsoft’s record-breaking 974 CVEs, which according to Tenable is not many fewer than the 1,130 CVEs Redmond issued in 2025. Two are already being exploited as zero-days. First up: CVE-2026-85880, a privilege escalation bug in Windows Advanced Local Procedure Call (ALPC). Successful exploitation can result in the attacker gaining SYSTEM privileges. “An attacker who can execute code in a low-privilege AppContainer could exploit this vulnerability locally to escape the sandbox and elevate privileges on the affected system,” Redmond warned. “No additional user interaction is required.” No word yet on who is exploiting this bug, and to what end. The US Cybersecurity and Infrastructure Security Agency on Tuesday added CVE-2026-85880 plus a second Microsoft security hole (and the Adobe Commerce and Magento zero-day) to its Known Exploited Vulnerabilities Catalog, and set a September 22 deadline for federal agencies to fix both new Microsoft bugs and a September 11 deadline to patch the Adobe flaw. The second Microsoft bug found and exploited as a zero-day is CVE-2026-81963, another privilege escalation vulnerability. This one affects the Windows Update Stack. We also have very little detail about this flaw, other than it also allows attackers to gain SYSTEM-level access. “More likely is that this bug is being combined with a code execution bug to spread malware or ransomware,” opined Zero Day Initiative’s Dustin Childs, who advised users to “Patch this one quickly.” While those are the only two (so far) under active exploitation, Childs rated CVE-2026-55007, one of nine Exchange Server flaws disclosed this month, as “the most important” patch for the messaging server. It allows a remote, unauthenticated attacker to execute code on a vulnerable Exchange server by sending an email with a malicious Visio attachment. No user interaction is required, and the code executes when the server processes the attachment during content indexing. Redmond says it’s “difficult to reliably trigger,” but as Childs points out: “The attacker only needs to get it right once. Schedule your downtime and update your Exchange servers with haste.” Childs also said he counts 20 patches for wormable bugs, so be sure to read his full Patch Tuesday review for those. “While some might be more exploitable than others, having 20 of them in a single release is something else.” The missing CVE While Redmond addressed nearly 1,000 security holes this month alone, it’s also worth pointing out one that isn’t this month’s Patch Tuesday roundup: CVE-2026-85046. Google patched this bug in Chrome on September 3, and at the time warned that it “is aware that an exploit for CVE-2026-85046 exists in the wild.” The high-severity, type confusion flaw exists in the V8 JavaScript engine used in both Google’s Chrome and Microsoft’s Edge browsers. And yet Microsoft still hasn’t published a security advisory for CVE-2026-85046. “If you’re patched, you are protected, but if you rely on advisories to know which vulns exist, you could miss this zero-day vulnerability altogether,” Adam Barnett, lead software engineer at Rapid7, told The Register. “A patch without an advisory is perhaps marginally better than an advisory without a patch, but keeping track of exposures without reliable advisory materials is not straightforward,” Barnett said. “Chrome patched 11 other vulnerabilities at the same time as CVE-2026-85046, but it’s not yet clear if those are patched in Edge. Until Microsoft sets the record straight, the only safe assumption is that these vulnerabilities (e.g. CVE-2026-85045) remain unpatched in Edge.” ®

A secret channel running through ChatGPT's internal JFrog Artifactory instance allowed one account to send hidden tasks - such as retrieving email data from a connected Gmail account - to a ChatGPT session under another account, according to Check Point Research. The victim saw no indication of the hidden instructions or stolen data, and the hole has since been closed. The threat hunters found and disclosed the covert channel to OpenAI in late June - the same day that OpenAI’s agents exploited a zero-day bug in Artifactory to gain internet access and ultimately hack Hugging Face, Pedro Drimel Neto, Check Point’s malware analyst team leader, told The Register. “Once it was disclosed to OpenAI, they told us the Artifactory had already been decommissioned,” he said. While the Hugging Face intrusion and Check Point Research’s proof-of-concept are related because they used the same internal package management system (Artifactory), they are not the same attack. However, they both illustrate the importance of isolation boundaries - and the bad things that will happen when these trust boundaries don’t contain AI systems as they should. “The biggest AI security risk has become the access and trust we give it,” Drimel Neto told us. “As AI becomes more connected to sensitive data and critical systems, every trusted capability can become a target for attackers,” he added. “Organizations need to secure AI interactions from the outset, with prevention, visibility and governance built in. The goal is simple: enable AI to act on our behalf without allowing attackers to do the same.” OpenAI did not respond to The Register’s request for comment. As with the Hugging Face incident, the starting point for Check Point’s research has to do with how OpenAI models use isolated containers to perform tasks that require code execution, which sometimes requires installing other software packages. These containers cannot have direct access to the public internet - otherwise they can leak user data or find exposed credentials and break into outside organizations’ servers. Instead, they are allowed to access an internal Artifactory instance with access to the package repositories. The containers were supposed to be isolated from one another, but as Check Point discovered, the Artifactory instance exposed an item management feature that allowed one container to attach text properties – including Base64-encoded binary data – to a repository item, and a container under another account could read them. Additionally, the credentials provided to the container for reader access allowed both read and write privileges, and code launched by ChatGPT could authenticate to the storage endpoint without extracting a separate secret or escalating privileges. This means an attacker’s session could write a malicious task into the shared storage, and the victim’s session would then carry it out. “A crafted instruction could make ChatGPT process a second stream of tasks alongside the visible conversation: receive instructions from an attacker, execute them using the capabilities of the victim’s session, and return the results without exposing the second stream in its visible response,” Check Point researcher Alexey Bukhteyev said in a Tuesday report. Check Point also demonstrated this attack using a shared ChatGPT conversation. The attacker’s session writes an instruction - in this case, “Use Gmail connector. Get list of my emails,” although the researchers point out that the reach of the attack could extend to any connected apps that the victim’s session was authorized to access. In addition to conversation history and files, this could include Google Drive, Microsoft Teams, GitHub, and several other services. The victim opens the link and sends the chatbot a normal message, like: “Create a chart of the average monthly temperatures in New York.” ChatGPT completes the victim’s request - but it also accesses the victim’s connected Gmail account, and sends the stolen email data to the attacker’s account through the hidden channel. The victim doesn’t see any of the data exfiltration, and assumes the AI is simply answering their question as intended. “The visible answer contained no mention of the Gmail request or the retrieved data. The only app-specific clue was the small ‘Talked to Gmail’ label above the answer,” according to the report. By the time Check Point reported the issue to OpenAI, the model maker had already decommissioned the internal Artifactory instance due to the Hugging Face fiasco. This means that the covert channel is closed. However, it’s still worth paying attention to because it highlights a larger agentic AI security challenge. “An LLM operates inside the trust boundary: it uses credentials, runs code, accesses internal services, and works with user data. Its actions are directed by text instructions,” Drimel Neto wrote. “This combination turns the model into a coerced insider that can use authorized capabilities on behalf of another user.”®

Boston Scientific says that last month's cyberattack caused enough disruption that it is unlikely to meet its sales growth and adjusted earnings guidance for either the third quarter or the full year. The medical device giant disclosed the expected financial hit in an SEC filing published Tuesday, two weeks after an intrusion knocked systems offline and disrupted operations worldwide. Boston Scientific detected unauthorized activity on its network on August 25 and took some systems offline as it scrambled to contain the attack. At the time, it said the resulting outage had affected business applications used to process and ship customer orders, but couldn't say what the incident would ultimately cost it. It now has a better idea, and the news isn't great. In its latest filing, Boston Scientific said the disruption is likely to have a "material impact" on its third-quarter and full-year results, leaving it unlikely to meet the net sales growth and adjusted earnings-per-share guidance ranges issued in July. Boston Scientific expects to recover some of the affected revenue as it clears the backlog, but does not yet know the incident's full financial impact. The company plans to update its operational and financial outlook when it reports third-quarter results on October 28. The recovery is at least moving along. Boston Scientific said it had substantially restored its distribution network, with major distribution centers processing and shipping orders at or above normal levels. Its sterilization facilities are operational, and manufacturing has resumed at most sites worldwide. An interruption affecting new patient activations for remote monitoring of certain cardiac devices has also been resolved, according to the filing. The company has previously said it knows of no impact on devices that are not connected to a Boston Scientific network. Still, the company hasn't put a date on when everything will be back to normal. It said some systems and business applications remain affected and that it cannot yet estimate when it will achieve full operational recovery. Boston Scientific said it has identified no evidence of ongoing unauthorized access to its systems, although its investigation remains underway. Exactly what happened remains a mystery. The company has yet to say how the attackers got in, whether ransomware was involved, who was responsible, or whether any data was stolen. No ransomware group had publicly claimed responsibility at the time of writing. Boston Scientific said it does not expect the incident to materially affect its long-term financial condition, even if its outlook for 2026 looks considerably less healthy since intruders breached the network. ®

Secure by design videoconferencing products may be vital for customer trust and operational resilience, but if they aren't usable, organizations are on a hiding to nothing. Videoconferencing security is no longer a routine item on the IT checklist. Organizations now rate security as their most important purchase criterion (31 percent) when selecting such products, ahead of price (26 percent) and quality (25 percent), according to IDC. The implication, is that security and privacy are no longer optional. Instead, they are the foundation of effective meeting room solutions, enabling safe and unified collaboration. Yannic Laleeuwe, marketing director for Barco's ClickShare, agrees. Collaboration and videoconferencing solutions have become "mission-critical business systems" in her view, because they process significant volumes of the most sensitive corporate information while sitting on crucial networks and cloud services. "Historical security incidents, combined with the rapid growth of hybrid work since the COVID-19 pandemic, have demonstrated that weaknesses in these platforms can lead to data breaches, operational disruption, regulatory exposure, and loss of customer trust," Laleeuwe explains. "Consequently, security has evolved from a technical consideration to a strategic procurement and governance priority for organizations worldwide." The IDC study indicates that most businesses' biggest security concern is exposure to cyberattackers, which can lead to incidents such as malware propagation (47 percent). Next on the list is devices falling out of compliance because of missing patches and updates (39 percent). Third comes risky employee behavior, which can result in inadvertent, or even deliberate, data exposure (37 percent). These issues become particularly problematic in a hybrid working environment, where meeting rooms have evolved into highly connected, distributed spaces. Employees now expect ready access to business applications, data, and collaboration tools wherever they happen to be working. An expanding attack surface Such demands expand the potential attack surface for meeting room technology. Users, devices, cloud services, home networks, and collaboration platforms all become endpoints on the corporate network, even though many were never designed to operate in an enterprise IT context. That leaves them as potential entry points for attackers. "Collaboration solutions are particularly attractive targets because they are connected to corporate systems and frequently process sensitive information, including intellectual property, strategic discussions, and customer data," Laleeuwe points out. The situation grows worse when IT management becomes too decentralized. "As organizations adopt hybrid working and distributed IT models, maintaining centralized visibility and governance becomes increasingly challenging as local teams may implement different technologies, configurations, and processes," Laleeuwe adds. She acknowledges that certain operational responsibilities can, and should, be handled locally to support business agility and regional requirements. But complete decentralization often leads to inconsistent security controls, fragmented risk management, and reduced ability to detect and respond to cyber threats across the enterprise, she warns. Mounting global regulatory pressure On top of that, international regulatory pressure on both security and security technology is producing an increasingly complex legislative landscape, because policymakers and industry bodies now recognize that cyber incidents can threaten critical services, national security, and even economic stability. In Europe alone, legislators have introduced a raft of legal frameworks, including the European Union's Network and Information Security 2 Directive, which mandates strict risk management and incident reporting for medium-to-large organizations across 18 critical sectors. Other legislation, such as the Radio Equipment Delegated Act, is intended to secure wireless equipment against cyberattackers. Another, the Cyber Resilience Act, provides safeguards for businesses and consumers when purchasing any hardware or software products connected to a network. Global standards such as ISO/IEC 27001 now define best practice for information security and risk management, and offer organizations a framework for operational trust. In other words, organizations must now embed security considerations across all their key activities, which include governance, risk management, supply-chain management, and incident response. They also need to make certain that their technology providers integrate security across the entire lifecycle of their products and services, from design and development through deployment and end-of-life support. Non-compliant collaboration and videoconferencing technology no longer simply poses an organizational risk. It may also prove unusable. Security as a pre-requisite for doing business The upshot, Laleeuwe says, is that cybersecurity has evolved from a "voluntary best practice into a legal and business obligation, making security a prerequisite for market access, customer trust, operational resilience, and long-term competitiveness." Even so, compliance and strong security enablement cannot be allowed to come at the expense of usability, particularly in a hybrid workplace. If collaboration tools are perceived as too complex or restrictive, employees will find workarounds, and the organizational security risks rise rather than fall. To tackle the problem, IT teams must weigh several factors. From a people perspective, the biggest challenge is behavioral. "Users naturally seek convenience, so continuous security awareness, training, and a strong security culture are essential to encourage secure behavior without hindering productivity," Laleeuwe explains. Clear, transparent, and well-defined processes matter just as much, because they ensure security and compliance requirements are consistently understood and implemented across the organization. Why secure by design matters From a technology perspective, the focus must move away from perimeter-based security towards a zero-trust approach in which every user, device, and connection is continuously verified and protected. In product design terms, it is just as crucial that meeting room technology rests on secure-by-design principles, so that compliant, state of the art security controls are integrated into systems from the outset rather than bolted on as an afterthought. As Laleeuwe says: "Security by design reduces the likelihood and impact of vulnerabilities, simplifies compliance with emerging cybersecurity regulations, and strengthens customer trust. It also lowers the overall cost of ownership because identifying and resolving security issues during design and development is significantly more efficient and less costly than remediating incidents, recalls, or security breaches after deployment." Barco's ClickShare wireless video conferencing, presentation, and collaboration solution is a classic example of this approach. Barco developed it from the ground up using secure architecture design and coding. It also includes proactive vulnerability management that continuously monitors newly disclosed vulnerabilities and issues risk-based security updates. That process cuts the system's exposure to both known and evolving threats. Automatic deployment of those security updates simplifies maintenance and helps organizations consistently protect large fleets of devices. Users can focus on the task in hand rather than managing the technology or calling in specialist cybersecurity experts when things go wrong. "The advantage is that security is handled largely in the background, reducing the risk of human error, improving adoption, and allowing people to concentrate on productive collaboration rather than system administration," Laleeuwe points out. "So, ClickShare provides effective protection while minimizing friction for end users." A changing security landscape That matters, she says, because compliance is now a shared responsibility that spans organizations, their technology providers, integrators, and increasingly the broader supplier ecosystem. Organizations, for instance, must hold themselves accountable for securely operating and governing their own environments, even if doing so requires a change in focus. As Laleeuwe explains: "The implication for IT departments is that they must evolve from being solely operational service providers to becoming governance and coordination functions that establish common security standards, policies, monitoring, and oversight across the organization." Technology providers, in contrast, are responsible for delivering and maintaining secure products throughout their lifecycle. They also have a critical part in monitoring vulnerabilities in their platform's software components, providing timely security patches, and transparently notifying customers and downstream partners about relevant security risks. Integrators, lastly, are responsible for deploying and configuring solutions in line with current security and compliance requirements and guidance. "No single party has complete control over the entire technology stack, making supply-chain security and collaboration essential for maintaining a secure and compliant environment," Laleeuwe says. "The most effective approach is therefore a clear allocation of responsibilities across all parties, supported by transparent communication, vulnerability disclosure, and coordinated risk management." Another element of security success is aligning organizational measures such as clear accountability, security awareness, and shared ownership of cybersecurity with technology that provides centralized visibility into assets, vulnerabilities, compliance, and security events. As Laleeuwe concludes: "This consolidated view enables organizations to better understand, measure, and manage risk across the entire enterprise while maintaining the flexibility needed by local teams. The most effective approach balances local operational autonomy with centralized governance, ensuring consistent security, compliance, and strategic control without compromising business efficiency." Sponsored by Barco.

LG is once again fending off allegations that its expensive consumer hardware gathers extensive information about users and their surroundings for the benefit of its advertising business. The latest concerns center on smart TVs that researchers claim continued capturing audio after voice recognition was activated, including while the display was in standby. The claims once again come from the folks behind the Gamers Nexus YouTube channel, which also claimed in July that LG's monitors were surreptitiously installing adware using an automatic Windows process. After inspecting the TVs' network traffic and internal data, editor-in-chief Stephen Burke said the team found plaintext transcripts generated from audio captured by the TV, along with other information. The Gamers Nexus crew said it observed the TV collecting IP addresses, location data, and the names, signal strengths, and channel numbers of nearby Wi-Fi networks. The TV also enumerated devices on the local network that were not paired with it, including smartphones, watches, routers, thermostats, air purifiers, server baseboard management controllers, and PCs. Burke added that Wireshark packet capture analysis revealed such a large quantity of private data that it couldn't be displayed in the video, and that this was all native behavior from LG's equipment. He said the findings represented "an egregious invasion of privacy." Burke and company also claimed that the TVs could continue capturing audio while disconnected from the internet, store it locally, and transmit related data after connectivity was restored. Burke said the team was working with security researchers to disclose vulnerabilities responsibly, including an alleged remote code execution flaw. The Register has asked LG for comment. LG previously told other publications that its TVs do not "collect, record, or store ambient conversations," and that voice recognition is an optional feature that processes voice data only when activated by the user. LG's relationship with ads LG does not hide the fact that its hardware incorporates technology from its advertising business, LG Ads Solutions. In 2022, it announced that automatic content recognition (ACR) technology previously limited to its US smart TVs would be deployed in sets sold across 27 countries, with the resulting insights available through its advertising business. LG said the ACR data was anonymized and handled in accordance with privacy regulations. Its advertising customers could use the resulting insights to measure campaign effectiveness and whether an ad led to registrations for an app or service. LG is not alone. Most major smart TV manufacturers deploy some form of ACR in their hardware, although the controls available to users vary by vendor. The source of so much frustration, however, is that manufacturers are not forthcoming with consumers at the point of purchase about the extent to which their data is collected or how. Generating audio transcripts while the display is in standby is not something LG highlights in its product descriptions or marketing materials. According to Gamers Nexus, however, that is what its testing uncovered. Instead, the company's website describes its TVs' voice features using terms such as "Intelligent Voice Recognition" and "Clear Voice Pro." Customers who go digging for more details must navigate to an "LG Privacy" link most of the way down a lengthy product page. From there, they must sift through four links to understand its privacy policies more fully, although neither the documents nor the main product page references LG Ads Solutions. Gamers Nexus claims LG sends all the data its hardware collects to the ads unit, which claims in its marketing materials that customers can "own the living room," having their ads appear on devices inside "the connected LG household." LG Ads Solutions' official fact sheet, which predictably requires you to enter your personal and contact details to access, states that there are 49 million LG TVs in the US powered by its webOS, but the company's total reach extends to 363 million "addressable secondary devices." To potential customers, it promises "precision targeting at the device level, across households." ACR and other data-collection technologies have become commonplace across the smart TV market. Research suggests that many consumers are willing to trade their data for tangible financial savings, but the privacy implications are compounded when you consider these devices can be found mounted in boardrooms and doctors' offices. Twice bitten The allegations come less than two months after Gamers Nexus reported that connecting certain LG monitors to an online Windows 11 PC could trigger installation of the LG Monitor App through Windows' device metadata system. The behavior depended on the user selecting Recommended Settings during Windows setup and being signed into the Microsoft Store. As we reported at the time, the LG Monitor App Installer has limited utility and displayed pop-up promotions for McAfee. LG told us: "LG Electronics reiterates that McAfee is not installed automatically and is never installed without the user's explicit consent." ®

A Microsoft 365 phishing operation targeting hundreds of organizations captured thousands of passwords and session cookies, including hundreds of authenticated sessions that could be hijacked to bypass MFA, according to researchers who accessed the crooks' own admin panel. Security researchers at CloudSEK say they accessed the admin panel behind BigBear 2.0, an Evilginx2-based phishing-as-a-service operation targeting Microsoft 365 users, giving them an unusually detailed look at the campaign and its haul. According to the researchers, the panel contained 5,137 records associated with 461 organizations, including 1,032 plaintext passwords and 4,148 session cookies. CloudSEK classified 474 records as complete MFA-bypassed authentications in which the attackers captured an authenticated Microsoft 365 session. That potentially hands the crooks much more than an inbox. A hijacked Microsoft 365 account can expose email, calendars, Teams conversations, and files stored in SharePoint and OneDrive. Depending on the account's permissions, CloudSEK says it could also provide a route into Entra ID, cloud infrastructure, and federated SaaS applications – useful territory for business email compromise, internal phishing, data theft, and lateral movement. And this isn't a postmortem. CloudSEK said the BigBear operation was still active at the time of its investigation, with its default phishing template, dubbed "offy," configured specifically to intercept Microsoft 365 authentication. BigBear doesn't need to defeat Microsoft's MFA directly. Instead, its Evilginx2 infrastructure operates as an adversary-in-the-middle proxy between the victim and Microsoft's real login service. Victims arriving at one of the phishing sites see Microsoft's login flow proxied through the attacker's server. Their usernames and passwords are passed to Microsoft, along with whatever MFA challenges follow. Once the victim successfully authenticates, Microsoft returns a session cookie – which passes through the attacker's infrastructure on its way back. By stealing that cookie, the attacker can replay the authenticated session and potentially access Microsoft 365 services without prompting the victim to authenticate again, at least until the token expires or is revoked. Security researcher Gagan Aggarwal said BigBear's customizations go further than stock Evilginx2. Researchers found JavaScript designed to disable FIDO2/WebAuthn authentication on the phishing page, pushing users toward methods such as SMS codes, push notifications, and TOTP, which remain susceptible to this kind of proxy attack. The operation also uses a residential proxy pool covering 69 countries. If a victim is in India, for example, BigBear can route the upstream Microsoft login through an Indian residential IP, making the authentication appear less geographically suspicious. Another check attempts to block visitors arriving from datacenter, VPN, and proxy addresses, making life harder for automated scanners and researchers. CloudSEK says the infrastructure was managed through a multi-user panel and leased to at least five affiliate operators, with stolen credentials delivered in real time via separate Telegram bots. The researchers observed 42 VPS nodes over the campaign's lifetime. Twenty-six had been deleted from the panel since late July, and just one was active when CloudSEK examined it. Aggarwal says the person running BigBear goes by "General Boss." CloudSEK hasn't linked the operation to any known state-backed group and believes money is the motive. The stolen Microsoft 365 access could be used for business email compromise and data theft, or simply sold on to other criminals. CloudSEK recommends phishing-resistant FIDO2/WebAuthn authentication, conditional access policies, compliant device requirements, and the revocation of compromised session and refresh tokens. ®

Data theft and extortion crews are stealing companies’ proprietary AI data and threatening to leak it if the victim organizations don’t pay a ransom, according to Google’s threat hunters. In one case that Google’s Mandiant incident response team investigated, the crooks broke into a healthcare company and exfiltrated corporate data and drug research, including AI research and a proprietary AI model. The criminals then threatened to publish the data unless the company met their extortion demand. In another breach at a company that specializes in AI media generation, attackers stole sensitive AI data including source code, prompts, skills, model scripts, and secrets before demanding a payment and threatening to dump the AI assets publicly if the ransom wasn’t paid. Google detailed these two intrusions for the first time in its most recent AI Threat Tracker, published Tuesday and shared in advance with The Register. “But it's certainly not limited to that,” John Hultquist, chief analyst at Google Threat Intelligence Group, said in an interview with The Register. Mandiant responded to several of these data-theft-and-extortion operations during the second quarter of 2026, he said. The intrusions affected companies in the technology, healthcare, pharmaceutical, and media and entertainment sectors in North America and Europe. “It’s become a really valuable target where organizations are spending a lot of money and investment, and they don't necessarily want their IP exposed to the open world, so they're willing to pay in an extortion scheme,” Hultquist said. “Criminals attacking AI systems is an area that's not received as much attention as it probably should, and as we incorporate these systems, it’s going to come with brand-new risks,” Hultquist added. “There are certainly threat actors who are ahead of others when it comes to that problem – TeamPCP has been extremely successful.” Since March, TeamPCP has pulled off several very large scale open source supply chain attacks targeting ecosystems including PyPI, npm, and Docker Hub. After compromising these open source packages and registries, TeamPCP, which Google tracks as UNC6780, typically deploys stealers to scoop up cloud and AI system credentials. “Evidence indicates that UNC6780 created a malicious GitHub Actions workflow for the company’s proprietary AI repository, and that the extortion actor exfiltrated a copy of this AI repository,” the report says. “Beyond these demonstrated tactics, UNC6780 has also implemented more than half a dozen different methods to target or exploit AI tools and open source software development practices.” While Google’s earlier AI tracker, published in February, documented attackers experimenting with agentic AI to support certain pieces of the attack chain, in the past quarter they’ve gone on to integrate agentic capabilities into multiple stages of an attack lifecycle, according to the researchers. In one example, Mandiant observed miscreants who compromised an organization’s cloud infrastructure in an autonomous, multi-agent credential-harvesting attack that took less than six hours. During that time, the agents autonomously scanned for vulnerabilities, performed real-time troubleshooting, and executed IP rotation logic without manual intervention. “Like scanning – but with a brain,” Hultquist said. In another case detailed in the report, Google Threat Intelligence observed a China-linked espionage group using Gemini to design a dynamic, automated penetration-testing framework that could reason through actions, execute tasks, and change course as needed in unpredictable environments. Google disabled the assets associated with this particular crew. “That’s where we are headed,” Hultquist said. “We're kind of in this interim place where threat actors are inserting agentic AI into certain parts of their operations, but we've not gotten to the place where they are able to sort of remove themselves entirely. We're right on the precipice of that.” ®

The UK government has corralled £7.8 billion of cross-departmental spending into a new space strategy intended to boost growth and national security through to 2030. The package covers orbital collision warnings, low Earth orbit communications, military intelligence, launch capabilities, and space science. The strategy brings together activity across government, including the newly created Department for Business, Innovation, Science and Trade (BIST), the Ministry of Defence (MoD), the Department for Transport, UK Research and Innovation, and the Met Office. The government says the domestic space sector is worth £18.6 billion and supports more than 55,000 skilled jobs. In a prepared statement, BIST Secretary Jonathan Reynolds said space was becoming a new frontier of economic and military competition. "This plan will help keep Britain secure by strengthening our ability to launch satellites, detect threats and protect the services people rely on every day. At the same time, this plan will enable our excellent UK industry to seize the boundless opportunities of this new age in space, creating skilled jobs, driving growth and improving connectivity for all of us." The plans include work to strengthen space domain awareness – tracking and analyzing satellites, rockets, and debris in orbit – backed by £149 million for European Space Agency (ESA) space safety work, including the Vigil mission, and £85 million for the National Space Operations Centre. The funding is intended to improve warnings of potential satellite collisions, hostile activity, and solar storms, helping protect power, communications, and navigation services. The government has also allocated £880 million during this Parliament to space control and space-based intelligence, surveillance, and reconnaissance capabilities. The investment is intended to help track military activity on the ground, identify potential attacks on satellites, and protect British assets in orbit. The strategy also identifies £2.8 billion for satellite connectivity, including the Connectivity in Low Earth Orbit program and the military's SKYNET communications system. Funding of up to £160 million through March 2030 has already been announced for the UK Space Agency's Connectivity in Low Earth Orbit (C-LEO) program, helping British companies and researchers develop satellite communications technology. The strategy also puts £40 million towards technology for servicing, assembling, and manufacturing equipment in orbit. The government says this could support everything from repairing satellites and clearing debris to producing semiconductors and pharmaceuticals in space. Another £148 million is allocated to European rocket programs, while SaxaVord Spaceport in Shetland is set to receive £30 million, subject to due diligence. A further £163 million will go toward space science and exploration missions, including delivery of the UK-built Rosalind Franklin Mars rover. The package also includes £57 million to improve rail connectivity, £190 million for astronomy and space science research, and £9 million to strengthen space weather forecasting. The government also plans to adopt a single approach to buying and developing space technology, beginning with satellite communications, in an effort to steer more work towards British suppliers, accelerate delivery, and secure better value for taxpayers. In July, the government's projects authority sounded the alarm over progress on Skynet 6, the £8.35 billion program to upgrade the military's satellite communications. The National Infrastructure and Service Transformation Authority (NISTA) gave Skynet 6 a red rating, meaning "successful delivery of the project appears to be unachievable" in its current form. Confidence had fallen from last year's amber rating because department-wide recruitment and resourcing constraints had created workforce shortages, while "sub-par supplier performance continues to delay delivery of the first SKYNET 6 satellite," the report said. The new document formally replaces the UK's 2021 National Space Strategy, which a House of Lords report warned last year had failed to turn its ambitions into reality. "The UK space sector lacks the strategic direction necessary for success," it said. ®