Kategorie

Veeam has released security updates to patch a critical Backup & Replication security flaw that can be exploited to gain remote code execution (RCE) on domain-joined backup servers. [...]

Two Russia-aligned cyber attack campaigns have continued to exploit a security flaw in WinRAR to target Ukrainian organisations, almost a year after patches for the vulnerability were released. The activity has been attributed by Trend Micro to Earth Dahu (aka Gamaredon) and SHADOW-EARTH-066 (aka UAC-0226). It involves the exploitation of CVE-2025-8088, a path traversal flaw that allows an Ravie Lakshmananhttp://www.blogger.com/profile/[email protected]

A compromised Linux server can continue running malware long after the initial intrusion. One of the most common persistence techniques is a malicious cron job that silently downloads payloads, restarts malware, or re-establishes attacker access every few minutes. This guide shows how to identify suspicious cron entries, preserve forensic evidence, remove unauthorized scheduled tasks, and verify that no additional persistence mechanisms remain.

University of Toronto researchers have built and tested a proof-of-concept AI-driven computer worm that uses a locally hosted open-weight large language model to reason its way through a network, generate tailored attack strategies for each target it encounters, and replicate itself, all without human intervention and without touching a commercial AI service. The preprint, posted to arXiv on Swati Khandelwalhttp://www.blogger.com/profile/[email protected]

Google has released security updates to address 74 vulnerabilities, including one that has come under active exploitation in the wild. The high-severity vulnerability, tracked as CVE-2026-11645 (CVSS score: 8.8), has been described as an out-of-bounds memory access in V8, Chrome's JavaScript and WebAssembly engine. "Out-of-bounds read and write in V8 in Google Chrome prior to 149.0.7827.103 Ravie Lakshmananhttp://www.blogger.com/profile/[email protected]

Organizations have more visibility than ever. Growing tech stacks provide greater coverage, and network security teams are increasingly adopting AI and automation to help with routine tasks and reduce manual effort. But the same challenges persist. Outages still last hours, causing significant financial losses, operational disruption, and reputational impact. Threat response and mean time to [email protected]

DINUM, the digital affairs directorate of the French government, warned that hackers used a hijacked user account to breach Tchap, the French government's encrypted messaging platform. [...]

A malicious website can work out which sites you visit and which apps you open, using nothing but JavaScript and the timing of your SSD. The attack, called FROST, needs no native code, no extension, and no permission prompt. You open the page, leave the tab sitting there, and it watches the drive for contention in the background. Researchers at Graz University of Technology built it and Swati Khandelwalhttp://www.blogger.com/profile/[email protected]

A US federal judge has ruled that the Trump administration’s $100,000 fee on new H-1B visa petitions was unlawful, giving technology companies temporary relief from a policy that threatened to raise the cost of hiring foreign skilled workers.

The decision removes, at least for now, a major cost burden for employers that use the H-1B program to fill roles in domains including software development, cloud computing, data science, and AI.

US District Judge Leo Sorokin in Boston found that the fee functioned as a tax that the administration did not have authority to impose without congressional approval. The ruling came in a lawsuit brought by 20 Democratic state attorneys general challenging the fee.

Standard employer costs for H-1B petitions typically range from about $2,000 to $5,000, making the proposed $100,000 payment a sharp increase for companies seeking foreign talent.

The ruling is unlikely to end uncertainty for employers, with the Trump administration expected to appeal. But it could allow companies that had paused international hiring plans to resume normal recruitment for the upcoming H-1B cycle, said Pareekh Jain, CEO of Pareekh Consulting. Still, he said, employers should remain cautious because the legal and policy concerns are likely to continue.

“This provides breathing room for CIOs, even though it’s temporary,” said Neil Shah, vice president for research and partner at Counterpoint Research. “They should make the necessary contingency plans, whether that means doing more with less by leveraging AI or relying more on local talent.”

How companies may rethink hiring

If higher H-1B costs return in another form, CIOs will have to be more selective about sponsorship, weighing the added cost against the strategic value of the role and the long-term potential of the employee, Shah said.

“Ultimately, the decision comes down to business unit P&L: whether the unit can absorb the cost of acquiring the talent for that role,” Shah added.

That uncertainty could also lead CIOs to compete for talent from other companies, potentially driving up salaries for skilled workers. Some CIOs may conclude that paying a one-time $100,000 fee, amortized over the employee’s tenure, is still more cost-effective than engaging in a bidding war for scarce local talent.

Danish Faruqui, CEO of Fab Economics, said that CIOs may reserve H-1B sponsorship for a narrower set of mission-critical roles if costs increase.

“If there is such a financial burden, CIOs will justify sponsoring very specific roles,” Faruqui said. “These would be principal enterprise architects, AI, ML, and deep-tech researchers, senior product managers, and regulatory and compliance experts.”

More routine or project-based roles are likely to be treated differently, Faruqui said.

“Junior to mid-level software engineers, entry-level business analysts, and entry-level data scientists would shift from H-1B to domestic hiring,” Faruqui said. “Cloud migration, DevOps, ERP, and CRM implementation could be done through contractors or consulting firms, while QA, product testing, tier-one help desk support, and legacy maintenance are roles that CIOs could prioritize for automation.”

Who would be most affected?

Startups, smaller companies, and enterprise IT departments would have faced the greatest pressure from the fee and stand to benefit most from the ruling, Jain said.

Large technology companies would have been better placed to absorb the $100,000 cost, he said. Meanwhile, companies with mature offshore delivery models may be less likely to increase their reliance on H-1B hiring.

The article originally appeared on CIO.

The Miasma supply chain campaign has sparked a fresh attack wave called Hades, this time involving 37 malicious wheel artifacts across 19 packages in the Python Package Index (PyPI) registry, as the Mini Shai-Hulud-style attacks continue to be refined and splintered to target specific ecosystems. "The compromised releases shipped a *-setup.pth file that attempts to execute automatically Ravie Lakshmananhttp://www.blogger.com/profile/[email protected]

CISA has ordered U.S. government agencies to secure their Check Point Remote Access VPN and Mobile Access deployments against a critical vulnerability exploited in zero-day attacks by Qilin ransomware affiliates. [...]

Years ago, right-wingers coined the phrase “Trump Derangement Syndrome” (TDS) to describe people who hate US President Donald J. Trump. (I think it better describes the president’s outlandish, truth-challenged statements and the followers who think he can do no wrong.) What’s really deranged is his recent AI executive order.

First, a little history. As you may recall, Trump often (and loudly) trashed his predecessor’s Executive Order 14110, which had demanded “safe, secure, and trustworthy” AI. That Biden Administration order was replaced last year by Trump’s own “Removing Barriers to American Leadership in Artificial Intelligence” directive; it basically let US AI companies do whatever they wanted in the name of innovation.

Then, a little thing called Anthropic Mythos came along — and scared the pants off even AI’s biggest fans. Seemingly in response, someone in the federal government decided that letting AI companies do whatever they want might not be the brightest policy. 

Or, did they?

True, the new order creates a process under which AI companies can give US  government access to “covered frontier models” for up to 30 days before public release so experts can probe for vulnerabilities and test how the systems could be abused. It also directs agencies to set evaluation standards, establish an “AI cybersecurity clearinghouse,” and harden federal networks against rapidly advancing AI‑enabled attacks. 

Some people, like Graham Brookie, vice president for technology programs and strategy at the Atlantic Council, think the order is great. “The administration’s executive order on Advanced AI Innovation and Security is a serious policy with support from necessary stakeholders across party lines and industry to ensure the government is evaluating the cybersecurity risks posed by frontier AI models. It’s a policy that can be built on.”

Really? I’m not sure Brookie read the same document I did — if, indeed, he read it at all.

I quote:

“Nothing in this section shall be construed to authorize the creation of a mandatory governmental licensing, preclearance, or permitting requirement for the development, publication, release, or distribution of new AI models, including frontier models.

“In addition, ‘This order is not intended to, and does not, create any right or benefit, substantive or procedural, enforceable at law or in equity by any party against the United States, its departments, agencies, or entities, its officers, employees, or agents, or any other person.’”

In other words, AI companies won’t be required to do much of anything. And if they do  submit a project for review, get the government’s blessing for it, and something goes badly wrong, it’s not the government’s fault. 

So, exactly why would AI companies even mess with this performative AI security theater?

Beyond those concerns, who exactly will be judging AI projects in 30 days? In theory, it would be a cybersecurity clearinghouse made up of people from the National Security Agency, the US Treasury Department, and the Cybersecurity and Infrastructure Security Agency (CISA). Most likely, CISA would do the bulk of the heavy-lifting — it’s their job, after all. But there’s this wee problem; Trump’s so-called Department of Government Efficiency (DOGE) last year gutted CISA. There’s virtually no one left to do the work, and certainly not in 30 days.

There’s also the question of funding for the new initiative.  According to the order, “The Director of OMB, in coordination with the National Cyber Director and the Director of CISA, shall determine whether any Federal grant programs have available and relevant funding that can be directed toward applicants developing advanced AI vulnerability detection.”

Spoiler: There’s no money set aside for this purpose.

Leaving aside whether the Executive Order has any teeth at all — the Brennan Center for Justice argued that under the Constitution, it doesn’t; the closer you look at the document, the less substance you’ll find.

Besides, in an industry where success is all about releasing the latest Large Language Model (LLM) as fast as possible to garner attention and investor dollars, who exactly would want to put their AI models on ice for even 30 days? (Short answer: No one.) These companies are always going to be focused first on getting the word out about their latest model as fast as humanly — Uh, AI-ly — possible. 

Still, some people seem to think this executive order really will make a difference. For example, Paul Benda, the American Bankers Association executive vice president for risk, fraud, and cybersecurity, sees it “as a constructive step toward strengthening the nation’s approach to managing the cybersecurity risks and opportunities associated with advanced artificial intelligence [because it ] can help better protect critical infrastructure, including the financial sector.”

Oh, please. I’m so tired of people who skim the titles of Trump’s executive orders and then assume there’s anything real about them. 

This AI order is meaningless garbage, and anyone telling you otherwise is either lying or wants to be on the Trump regime’s good (?) side. Or, both — it could always be both. 

Google has released emergency updates to patch another Chrome zero-day vulnerability that has been exploited in the wild, the fifth such flaw patched since the start of the year. [...]

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a high-severity flaw impacting BerriAI LiteLLM to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerability, tracked as CVE-2026-42271 (CVSS score: 8.7), is a command injection vulnerability that could allow any authenticated user to run arbitrary commands on theRavie Lakshmananhttp://www.blogger.com/profile/[email protected]

New variants of the NFCShare Android malware are being distributed as fake updates for legitimate banking apps hosted on GitHub. [...]

SoFi Hong Kong is warning that it suffered a data breach after hackers gained access to a database at a third-party vendor containing customer information. [...]

There were several key components to emerge from Apple’s developer conference Monday as the company sought to reassure users (and investors) that it has met the existential challenge represented by AI. Aside from a serious focus on Siri AI and embedded Apple Intelligence across its varied platforms, officials also hailed a slew of performance/usability tweaks, described new child safety tools, gave macOS 27 a real name, “Golden Gate” — and offered a standing ovation in farewell to outgoing CEO Tim Cook.

Before the Worldwide Developer Conference (WWDC), analysts seemed optimistic about the company’s plans, most of which had already leaked. Analysts didn’t expect Apple to announce anything that would transform the AI industry (it didn’t), but they did hope the company would introduce tools to keep it competitive with rivals (it did). That’s assuming all the demos at the event were live, actual feature demos, rather than faked set-ups as seen before.

Hard, hard work

Apple’s teams have evidently worked incredibly hard to come this far, and execs did introduce truly impressive new AI features focused on what customers and developers actually need. The company also played to its strengths, particularly around vision intelligence; private-by-design (large language models) LLMs; highly useful contextual awareness; and Siri AI, which works as an app and lets you carry on conversational quests securely across all your Apple devices.

As anticipated, Apple also introduced APIs developers will be able to use to provide new AI features in their apps.

Among the many individual tools most of us can expect to use this fall, are:

• Siri AI, which can help users search for information across their messages, emails, photos, and more; answer questions about virtually any topic; and take action in apps. 
• Apple Passwords, which now automatically fix weak and compromised passwords with agentic AI.
• Spatial reframing, which lets users recompose a photo after it’s been taken by dragging to shift perspective, as if repositioning the camera in the original scene.
• A new Extend Tool, which expands the edges of an image to add breathing room, fix a crooked horizon, or change aspect ratio without losing the original subject.
• A Notify Me tool that monitors web pages for changes such as price drops or restocks and sends a notification when something changes.
• Photorealistic image generation, which supports the creation of high-quality photo-realistic images via a new generative model running on Private Cloud Compute.
• One-tap contextual suggestions in Messages, which surface actions such as creating reminders and notes, or finding relevant photos based on conversation context.
• And Describe a Shortcut, which means users can describe an automation they want in plain language and Shortcuts assembles the required steps automatically.

All about you, not AI

Apple did not seek to introduce AI features for their own sake; instead, it remains deeply focused on how to make its devices more useful to customers. As Craig Federighi, Apple’s senior vice president of software engineering, said: 

“Truly helpful AI must be centered on our users’ needs, deeply integrated into the products they rely on every day, grounded in personal context, and built with privacy at every step. That is our vision for Apple Intelligence. With useful features for browsing the web, expressing creativity, editing photos, and so much more, today marks a big step forward on our journey to integrate powerful AI into the core of our platforms and make our products even more personal and useful.”

Apple is not Gemini

Apple confirmed that it worked with Google Gemini to create some of the AI models highlighted today. This led some analysts before the event to say: “For Apple, the bull case is that a working Siri reframes it as an AI winner; the bear case is that paying a rival for core intelligence caps the premium investors assign to the stock.”

Perhaps they need not worry, as what we now seem to have is a far more solid base from which to continue to develop AI services and tools that compete against others in the space. Not only that, but Apple is not using rebranded Gemini — it simply worked with Google to build its own models, as Federighi insisted. In meetings at the show, Apple explained the full extent of the work it did with Google, stressing that none of the new features should be considered white label versions of Google’s LLMs. 

(Even Apple’s new search tools are based on its own search database, rather than anybody else’s. And when advanced searches are shared with Google-hosted Nvidia processors, Apple puts privacy protection in place.)

In the end, the most important consideration — for customers and developers — is that Apple seems to have succeeded in bringing dozens and dozens of powerful new on-device AI tools to its customers, giving it a firmer, more impressive peer position in the business. (It’s also true that investors were disappointed that the new AI features won’t be made available in Europe or China due to regulatory challenges, putting developers in both nations at a disadvantage.) Developers elsewhere will be able to explore Apple’s Foundation Models and its new Core AI APIs to their heart’s content. 

First reactions to Apple’s news

While Apple’s stock value dipped as investors sold on the news and invested into the speculation, I do think Apple successfully turned this corner — though it will need to continue to invest heavily in AI across its platforms. The work is far from over.

“It is great to see Apple continue to pursue a vision of AI that leverages local systems, preserves privacy, and integrates with third party tools,” Ken Case, CEO of the Omni Group, told me. “A lot of our work around the Apple Foundation Models and automation, App Intents, and adopting Swift look to be fruitful investments, but it’s clear there’s more to do starting this summer.”

Creative Strategies President and Principal Analyst Carolina Milanesi explained why it matters Apple is deploying these capabilities across its ecosystem, as it gives the company a unique market position. “Where Apple Intelligence is today is different than what Claude or ChatGPT are because is it really embedded in the devices, and we need to remember that Apple sells devices,” she said.

Apple did also note that the new Siri AI will be available in beta this year. “Investors wanted it in September. That means the real version is likely early to mid 2027,” said Gene Munster at Deepwater Asset Management. “Funny that the stock actually ticked up 0.5% on the “beta later this year” update given [that] while it’s later than what they wanted, it is at least a date that investors can focus on.”

It is also true that what Apple did achieve this year at WWDC is to offer up a set of new AI features that investors already see as having significant value.

You can follow me on social media! Join me on BlueSky,  LinkedIn, Mastodon and The Core.

At WWDC 26, Apple announced an Apple Intelligence-powered feature that can automatically fix weak and compromised passwords. This works in Safari, and it's rolling out with iOS 27. [...]

Hackers compromised 19 packages on the PyPI, collectively downloaded hundreds of thousands of times, in a new Shai-Hulud supply-chain attack that delivered malware designed to steal developer secrets. [...]

Security researchers have published a detailed, working exploit for a Linux kernel use-after-free that lets an unprivileged local user escalate to root and break out of a container. The flaw, CVE-2026-23111, sits in the kernel's nf_tables packet-filtering code and was patched upstream on February 5, 2026. Exodus Intelligence released its full technical walkthrough on June 8, and it is not even Swati Khandelwalhttp://www.blogger.com/profile/[email protected]