Kategorie

Attackers have compromised the update infrastructure for the cPGuard web security suite to distribute a backdoor and a data-stealing script. [...]

Developer platform WorkOS suffered a data breach after a threat actor accessed business contact records and summaries of customer communications. [...]

Cryptocurrency exchange Binance says North Korean hackers used a fake job interview to trick an employee into installing malware that ultimately let them compromise the company's wallet infrastructure and steal about $6.34 billion in digital assets. [...]

Large language model hijacking attacks, also known as LLMjacking, are generating large fraudulent cloud charges, with some organizations losing more than $100,000 per day. [...]

Customers of the mSecure password manager are being urged to act now to protect the confidential information they store in it, possibly by changing passwords, resetting two-factor authentication (2FA), and removing passkeys. The warning came in an email sent on November 3 in the name of developer mSeven Software. It says the company recently learned of suspicious activity linked to the app but Swati Khandelwalhttp://www.blogger.com/profile/[email protected]

Blockchain infrastructure provider Chainstack on Tuesday disclosed that it was targeted in a cyber attack that allowed an unauthorized party to gain access to some parts of its infrastructure. The incident is assessed to be part of a large-scale, artificial intelligence (AI)-powered attack campaign that came to light last week. "An external attacker gained unauthorized access to part of Ravie Lakshmananhttp://www.blogger.com/profile/[email protected]

While delivering record Q4 revenue, Apple’s financial results revealed a $33 billion cost associated with memory price inflation, representing the true cost of the growing bubble of AI data center investments. 

The results also showed something that threatens those same data center investments — a sea change in how enterprises are approaching AI. Inference costs, security, and data governance concerns may finally be dampening enthusiasm for cloud-based AI services.

Enterprises go local

Apple revealed several major enterprise clients who are turning to its products as solutions for local inference. The company told us that Gap Inc. is running AI loss-prevention models entirely on Mac minis to eliminate cloud token costs, while world-famous auction house Christie’s is using Mac Studio to run local pricing estimate models.

Apple’s wider enterprise wins matter too. It told analysts and investors that as well as purchasing 25,000 iPads for pilots and mechanics, American Airlines is deploying over 37,000 iPhone 17 devices to flight attendants for in-flight purchases with Tap-to-Pay. In education, it revealed a huge deal with the Department of Education in the Philippines, which will deploy 170,000 MacBook Neos to teachers and staff.

All these deployments help the company build up its mindshare, which should translate into future customer success and help it stay relevant in fast-changing times. But it’s really Apple’s pivot into AI that is tempting business users to make these purchases. 

The hardware and the economics

It’s not trivial that the company’s M-series and A-series processors are highly performant. It matters that you can patch together four Macs to create a powerful on-premises AI system more than capable of handling even highly complex AI calculations. 

“From Mac to iPhone to iPad, we are proud that our products are the best platforms in the industry for AI for both first-party and third-party applications, and we’re excited about the opportunities that creates,” CEO John Ternus said.

Look at it this way: If a Mac costs a few thousand bucks but can deliver the equivalent of tens of thousands of dollars of inferencing tokens during its lifespan, then it’s a bargain, not a cost. What Apple confirmed is that at least some enterprise purchasers are paying attention to this.

Monetizing both ends

Of course, the other side to AI is the need to build it, so it also matters that when it comes to the deployment of its AI APIs from within applications created by third-party developers, Apple is providing a lot more clarity. It is giving developers building apps with under two million downloads direct access to its powerful server-side LLMs completely free of token costs, it said.

It has also introduced a three-tiered system for developers needing to use its Private Cloud Compute infrastructure. The company is also putting a little more flesh on its plans to charge end user customers for heavy access to its server-side queries through iCloud+. 

What that means is that while delivering hardware capable of running on-device AI, Apple is also building an end user market for AI inferencing the Apple way, and equipping developers with the tools they need to attract end users to make use of its inferencing capacity in the first place. It is monetizing both ends of the story, while also enabling all parties to build success.

That’s not just about building and maintaining AI relevance for Apple. It’s also about building up new business opportunity. Ternus pretty much confirmed this, telling analysts during the Q4 financial call, “in the beginning, iCloud tiers were largely about storage, but we’ve been adding more capabilities and features to it.”

Siri agentic AI

Ternus also talked up Siri AI. “With Siri AI, we really have the kind of the Siri that we always wanted,” he said. “It’s primarily request-based today, but as we talked about at WWDC, it’s built on a modern orchestrator-driven architecture that gives us real room to expand its capabilities over time. As far as agentic capabilities, we think these are promising tools for users. We just want to make sure that users are aware of what they’re giving access to.”

Now please subscribe to my daily, human-curated Apple-related news headline feed at The Core, or follow me on BlueSky, LinkedIn, or Mastodon.

Binance on Tuesday said the record-setting theft of $6.43 billion in assets from the world's largest cryptocurrency exchange was the culmination of a "sophisticated, multi-stage campaign" that involved the use of a tampered Homebrew installation and recruitment-themed social engineering attack targeting two of its engineers. "It was not a single isolated breach or a simple phishing incident," Ravie Lakshmananhttp://www.blogger.com/profile/[email protected]

In 2023, malware tracked as BlackLotus became the first publicly documented in-the-wild UEFI bootkit capable of bypassing Secure Boot on fully updated Windows 11 systems. With the industry-wide chain-of-trust mechanism subverted, the malware was able to run malicious code before Windows was fully loaded and many security defenses were operational.

Microsoft had already patched the vulnerability that BlackLotus exploited in 2022. In 2023 and 2024, Microsoft issued additional updates. The first added a new certificate that no longer trusted the vulnerable boot managers. The second provided the means to revoke trust in the digital certificate used to sign older vulnerable Windows boot managers. The organizations infected by the new bootkit, which is tracked under the name BlackX, had installed all of these patches. So how did they fall victim?

UEFI bootkit refresher

Before discussing the incident further, a brief review of BlackLotus and UEFI malware is in order. Short for Unified Extensible Firmware Interface, UEFI is firmware that runs immediately after a computer is turned on. One of its main jobs is to load system configuration settings, identify and initialize hardware components, and prepare the computer to start its OS.

Read full article

Comments

Barracuda has disclosed details of two vulnerabilities affecting its products that, if chained together, could allow an attacker to bypass authorization controls and gain root access to a susceptible device. The vulnerabilities, a pre-authentication authorization bypass vulnerability and a command injection vulnerability, have been assigned the CVE identifiers CVE-2026-116606 (CVSS score: 9.3) Ravie Lakshmananhttp://www.blogger.com/profile/[email protected]

Google on Monday warned that threat actors are hijacking enterprise access to Large Language Models (LLMs) to fraudulently leverage expensive computing resources and AI services. The tactic is called LLMjacking, a form of resource hijacking adapted for the LLM era, where an attacker obtains an API key through phishing, source code leaks, misconfigured environments, or exposed client-side codeRavie Lakshmananhttp://www.blogger.com/profile/[email protected]

An attacker broke into the update system of the cPGuard security tool on November 2 and used it to send a malicious script to customers' Linux servers. The script installed a backdoor and collected password hashes and other sensitive files from servers that ran it, cPGuard maker OPSSHIELD said in an advisory. The attacker has since taken some of that data. cPGuard 5.88.25 and later versions Swati Khandelwalhttp://www.blogger.com/profile/[email protected]

Cybersecurity company Barracuda Networks warned customers to patch two vulnerabilities that can let attackers run commands with root privileges. [...]

Gartner predicts that security operations centers will have 50% more engineers than analysts by 2028 as AI agents take over routine alert handling. Prophet Security examines how AI is reshaping SOC roles, from analyst responsibilities and detection engineering to threat hunting and exposure management. [...]

A 3AM ransomware affiliate targeted a school estate in the UK and successfully encrypted around 37 of nearly 50 machines reached from an unmanaged host. [...]

European law enforcement authorities arrested seven suspects and seized more than 100 servers in a joint action targeting an unnamed company suspected of providing fraudulent trading websites to criminal gangs. [...]

Google has expanded its Cloud Vulnerability Reward Program (VRP) with a new top-tier reward for high-impact architectural security flaws. [...]

Fixed kernels for a use-after-free vulnerability in the Linux kernel's IPv4 TCP code are now available for Red Hat Enterprise Linux 8, 9, and 10, while Ubuntu's fixes for its three newest long-term-support releases remain in its opt-in testing channel with no date for a regular update. The flaw, tracked as CVE-2026-98432, can be reached by a remote, unauthenticated attacker and can Swati Khandelwalhttp://www.blogger.com/profile/[email protected]

Your team is remediating more vulnerabilities than ever, yet your breach risk has barely changed. You’re spending too much time and effort on exposures attackers may never exploit, while higher-risk exposures sit, waiting in the queue. Gartner®’s report on exposure prioritization states that fewer than 10% of vulnerabilities are exploited, yet most are treated as urgent. The report also argues [email protected]

A Russia-aligned threat actor known as Gorbag has been observed using simple information stealer malware in attacks targeting Ukrainian organizations. "Active since at least February 2025, the group has focused exclusively on Ukrainian targets, with a clear preference for law enforcement and justice entities, local administrations near the front line, and the defense sector," ESET researcher Ravie Lakshmananhttp://www.blogger.com/profile/[email protected]