The Register

If you're responsible for Linux security, someone just dumped a pile of work onto your desk: 432 Linux kernel CVEs were published across Sunday and Monday this week. Linux watchers at nixCraft pointed out the volume on Monday morning, and it didn’t take long for seasoned sysadmins to start expressing concerns. Jan Schaumann, chief information security architect at Akamai Technologies, took to the OSS-SEC mailing list Tuesday to express concerns over the sheer volume of Linux kernel CVEs published in recent days. Aside from noting that the CVE system isn’t the best way to track security changes, Schaumann also wondered in his post whether there was any good way to deal with so many kernel security issues. “This onslaught really shows it's not feasible to attempt to prioritize individual kernel changes,” Schaumann said. “You might attempt to process this large set of changes by pointing an LLM at the intake and asking it to prioritize them,” he suggested, “but if it spits out a dozen today and another 25 the next, you haven't won much.” Schaumann also suggested waiting to see which ones emerge as serious issues and focusing on those in the weeks to come, or updating one’s entire fleet of Linux machines on a weekly basis. “I sure would like to be able to do [that], but reality keeps getting in my way,” Schaumann said. “I'm not sure what to do here going forward.” In an email to The Register, Schaumann said that individually reviewing vulnerabilities for patching was already difficult enough before things rose to this level, and that automation may be the only option - but it's not a great one. "Automated, regular, and frequent updates that pull in all changes within a given time window of tolerance seem to me the only reasonable approach, but that is very difficult for many large organizations," Schaumann explained. Those orgs often rely on lengthy QA processes, slow and staged development cycles, and may even have contractual requirements for long-term support that make an automated approach an impossible one. The nixCraft team speculated on social media that AI bug reports are a likely reason for all those kernel CVEs, which wouldn’t be without precedent - Linus Torvalds himself said in May that the Linux kernel security mailing list had become “almost entirely unmanageable” due to AI-assisted bug hunting. Nonetheless, Torvalds has described AI as a useful tool for Linux development while still noting it can be a drag for maintainers, both from a workload standpoint and the fact "it keeps finding embarrassing bugs." On that note, it's worth understanding what a Linux kernel CVE actually means - many of the vulnerabilities included in the Sunday-to-Monday batch are small in scope, but they're vulnerabilities nonetheless. As senior Linux maintainer Greg Kroah-Hartman noted in a February blog post, the Linux kernel CVE team follows the CVE Program's definition of a vulnerability: a weakness in a product that can negatively affect a system's confidentiality, integrity, or availability. “At the level that the Linux kernel runs, almost any type of bug that can affect a running system can be classified as a vulnerability,” Kroah-Hartman noted. The kernel team looks at every bugfix that is added to stable kernel releases, he added, and if it fixes an issue that meets that CVE criteria, a CVE is assigned. AI-assisted bug hunting has increased the volume of reports reaching Linux kernel maintainers. We reached out to the Linux kernel team, but didn’t hear back. Kroah-Hartman did tell The Register earlier this year that AI bug reports had become worthwhile in recent months, and he predicted they're likely to keep adding to his workload. Unfortunately for Linux sysadmins, the position in which they find themselves in this current mess isn’t one that’s readily solved. CVEs might be a messy way to track and prioritize security updates, especially when hundreds of them are published over a short period, but without something better, it falls to IT and security teams to determine which vulnerabilities affect their systems and which kernel updates they need to deploy. Hope you’ve got the coffee machine filled up: The onslaught is unlikely to ease if other recent patch cycles are any indication. ®

EXCLUSIVE A Windows information-stealer targeting more than 300 applications comes equipped with a novel surveillance tool: an AI profiler that ranks infected victims so crooks know who to target first. Varonis Threat Labs spotted the new stealer and remote access trojan (RAT), called Dolphin X, for sale on a cybercrime forum, and shared their research exclusively with The Register. The ad for the malware claims it can target upwards of 300 applications and has the ability to bypass browser passwords and steal enterprise credentials, cryptocurrency wallets, .env files, SSH keys, cloud tokens, and DevOps secrets. Dolphin X also promises users a super-sneaky surveillance feature called the AI Profiler. It scores infected users by app usage, browsing history, and installed software, and sends the cybercriminals a daily summary that ranks victims’ based on the likely payoff from an attack. “There's two things that stand out,” Daniel Kelley, a senior threat researcher with Varonis, told The Register. “The first thing is the AI profiler. That's something I've never seen before. And then it’s also the breadth of applications that it steals - and it’s not even just applications. It’s everything, you name it: it will steal files, or credentials, cryptocurrencies. It’s probably one of the biggest stealers I’ve ever seen, and covers the biggest attack surface.” A malware vendor using the alias “Kontraktnik” posted Dolphin X for sale, promising: “You can use it as a stealer, as an HVNC [Hidden Virtual Network Computing], as a DDoS botnet, as a loader.” The crimeware currently only runs under Windows, but “we are working on Debian,” Kontraktnik claimed, adding that the malware also only supports English and Russian. Kelley suspects the developer is Russian-speaking, and told us that the stealer includes an option not to infect any users in the Commonwealth of Independent States (CIS) countries, a common choice among Russian-based ransomware and cybercrime gangs. Kelley and his team obtained and analyzed the malware builder, operator panel and its network traffic, but didn't examine a malware sample. Varonis therefore can’t guarantee that all of the developer’s claims are true. However, “when we looked at the builder, it had everything to suggest the features were legitimate,” he said. “We couldn’t test out the malware itself, but I would say it probably lives up to most of its expectations.” Feedback left on the forum where the malware is sold supports that analysis. As of Tuesday, the sales thread has passed 3,000 views, we’re told, with Kontraktnik closing at least two confirmed deals. Both of these included positive feedback from the buyers. Three-tier subscription model Beyond the 300 + apps it targets, Dolphin X's operator panel lists 329 features across 10 categories. Buyers can subscribe to one of three tiers, each unlocking new features, or buy a lifetime subscription. The minimalist suscription costs about $80 per month, which buys rewriting and altering capabilities across Windows Portable Executable (PE) timestamp, Rich headers, and section padding, along with capabilities allowing the malware to exploit the brittle YARA rules to bypass detection and hash-based blocklists. The middle tier advertises shuffling the import table, which would change the binary's import hash between builds. The top level sub (about $230 per month) claims to rewrite the code’s control flow, substitute instructions, and re-encrypt embedded strings with a new random key each time, thus making stable byte sequences harder to identify. Lifetime subscription cost about $1,140 for basic access, $2,280 for mid-tier malware, or $3,420 for perpetual pro-level Pwnage. “It really lowers the barrier to entry,” Kelley said, adding that in the not-so-distant past, cybercriminals needed a certain level of technical expertise to develop and use different types of malware. “Now it's set up in a way where it's almost like SaaS. Anyone can purchase it. Anyone can take it out of the package and use it.” All of this suggests two takeaways for defenders, according to the security sleuths. First, keep long-lived credentials off disk if possible. “Infostealers are designed to grab everything in one pass, so anything stored locally should be treated as potentially exposed,” the report warns. Second: focus threat detection on behavior - not file signatures - because this and other malwares include capabilities to bypass signature-based detection. “For example, explorer.exe running under a non-default desktop is a strong indicator of an HVNC session, regardless of how the malware binary is packed or what hash it uses,” the authors wrote. Varonis’ threat hunters previously uncovered other AI-powered malware, including an all-in-one phishing kit called Bluekit, and an email attack tool called SpamGPT. “It’s a huge trend,” Kelley said. “Cybercriminals are finding a lot of unique ways to integrate AI, and then they're using it to make their lives a lot easier, which is problematic.” ®

Authorities have long warned organizations not to pay ransoms, and fresh figures underline why: handing over the money doesn't mean the crooks leave you alone. Proofpoint survey data suggests that 58 percent of affected UK organizations paid a ransom. Worse, 22 percent of those who pay get extorted again anyway. The UK broadly tracks the global picture: 54 percent of victim organizations paid, though the rate swings sharply by region, from just 19 percent in Japan to 93 percent in the US. Cybersecurity biz Proofpoint, which published the data on Wednesday, attributes the regional variation to "a combination of regulatory environment, recovery capability, insurance incentive structures, and cultural norms around negotiation." "But the core finding holds everywhere: ransomware creates enough pressure that a significant share of organizations in each of the surveyed markets choose to pay." UK organizations that paid fared somewhat better than the 37 percent global average for repeat extortion. Still, the core lesson stands: paying doesn't reverse an attack. You can't trust a criminal's word. It just restarts a negotiation where the attacker holds every card, including the data, decryption keys, and the threat of publishing what they've stolen. Operation Cronos, law enforcement's LockBit takedown, provided hard proof of what had long been suspected: cybercriminals often retain victim data even after being paid. Before Dmitry Khoroshev's cybercrime empire collapsed, this was an assumption, not evidence-based. Cronos didn't just shutter the then-leading ransomware gang; it undermined the entire premise that paying restores the status quo. Proofpoint found that 2 percent of victims who paid a ransom never recovered their files at all. Earlier this year, Nitrogen's ESXi ransomware victims hit a similar wall after a coding error in the decryptor left some unable to fully restore access, and it was far from an isolated case. Attackers don't need to hold up their end of the bargain to keep the payments coming. The better answer is to build cyber-resilience into the organization itself. A word on AI No 2026 security report is complete without AI. In the UK, 65 percent of surveyed security practitioners said AI had sharpened the attacks that precede ransomware and extortion, most notably malicious links, business email compromise, malicious attachments, and credential harvesting. AI is not yet a key tool in ransomware payloads themselves, despite recent reports suggesting this may soon change. However, it is being used for more convincing phishing lures, sharper impersonation attempts, and faster system reconnaissance once attackers are inside a network. "AI hasn't fundamentally changed ransomware, but it has materially improved the attacks that lead to it," said Ryan Kalember, chief strategy officer at Proofpoint. "Today's attackers are using AI to create highly convincing phishing emails and credential theft campaigns that exploit human trust at scale. "Organizations that continue treating ransomware as an endpoint or recovery problem are missing where these attacks most frequently begin: people, identities and trusted communications." ®

A council worker who "abused" his position to unlawfully access "highly sensitive" personal records of family members and other people known to him has received a suspended sentence after admitting to violating the Computer Misuse Act (CMA). Geoffrey Smith, 31, from Ledbury, was a new Herefordshire Council employee working in the Children and Young People directorate. Over a four-day period, he accessed roughly 490 records and downloaded 94 documents relating to family members and "families known to him." This included data on adults and children, the Information Commissioner's Office (ICO) said. The data accessed included "highly sensitive material" such as medical records, social worker reports, and child and family assessments, the watchdog said. Smith pleaded guilty to an offence under Section 1 of the CMA 1990 relating to "unlawful accessing of personal data held on computers." He was sentenced at Worcester Magistrates' Court on July 17 to two months' imprisonment, suspended for 12 months. Smith was also ordered to complete 120 hours of unpaid work and pay £2,000 in costs plus a £154 victim surcharge. Andy Curry, ICO head of investigations, said: "Smith abused his position as an employee and used his access to Herefordshire Council's systems to view the personal information of people known to him, without any legitimate reason to do so. "The sensitive nature of the records held within a Children and Young People directorate, and Smith's systematic misuse of that information, makes this particularly serious. People have a right to expect that their personal information is kept safe, and that those with access to it will only use it for the purposes for which it was intended." Tough words from the ICO, whose former information commissioner resigned after admitting that his conduct had fallen below the standards expected of public officials. ®

OpenAI has admitted that it was the operator of the autonomous agents that attacked model-mart Hugging Face last week, and that they did so after a research project escaped a sandbox by finding and exploiting a zero-day flaw, then used another zero-day flaw to launch an attack. The attack saw agents achieve “unauthorized access to a limited set of internal datasets and to several credentials” used by Hugging Face, which said its infosec teams observed an autonomous agent framework “executing many thousands of individual actions across a swarm of short-lived sandboxes, with self-migrating command-and-control staged on public services.” “This matches the ‘agentic attacker’ scenario the industry has been forecasting.” On Tuesday, OpenAI admitted it was the attacker and that its models went rogue. “This incident occurred during an internal evaluation which prompts models to pursue advanced exploitation using complex attack paths, in an effort to quantify their cyber capabilities,” the startup confessed. The models that conducted the attack included GPT‑5.6 Sol and what OpenAI described as “an even more capable pre-release model” that like the other involved used “reduced cyber refusals for evaluation purposes.” OpenAI thought its models were “hyperfocused on finding a solution for ExploitGym” – a benchmark that measures how effective AIs are at finding security exploits. OpenAI says it runs these tests “in a highly isolated environment, with network access constrained to the ability to install packages through an internally hosted third-party software that acts as a proxy and cache for package registries.” The company’s models decided not to be bound by those constraints. “The models identified and exploited a zero-day vulnerability in the package registry cache proxy. With this access, our models performed a series of privilege escalation and lateral movement actions in our research testing environment until the models reached a node with Internet access,” OpenAI admitted. “After gaining Internet access, the models inferred that Hugging Face potentially hosted models, datasets and solutions for ExploitGym. Knowing this, the model searched for and successfully found ways to gain access to secret information that it could use to cheat the evaluation,” OpenAI explained. “In one example, the model chained together multiple attack vectors, including using stolen credentials and zero-day vulnerabilities to find a remote code execution path on the Hugging Face servers.” Hugging Face’s assessment of the incident was that it represented the moment at which “Autonomous, AI-driven offensive tooling is no longer theoretical.” OpenAI reached a similar conclusion. “The incident also makes clear that advanced models can discover and exploit novel attack paths in real-world systems without source-code access. It highlights that advanced cyber capabilities must be developed alongside stronger safeguards and defensive tools,” the company wrote, without a trace or hint of contrition about the fact its own safeguards didn’t work. Which rather begs the question: If one of the prime movers of the AI boom can’t get this stuff right, what chance do the rest of us have? OpenAI has done the usual Big Tech thing of apologizing for the mess, and promising that its new guardrails and industry collaborations will hopefully prevent this sort of thing from happening again. History suggests those are very hollow sentiments. ®

Who needs expensive frontier models to find software vulns? Cisco has just released two open-weight models that specialize in finding known bugs in existing codebases. The models, Antares-350M and Antares-1B, are part of Cisco’s new Antares family of security small language models (SLMs), and are now available on Hugging Face - but only to vetted users. “We’re making sure we’re gating that and appropriately granting access,” DJ Sampath, Cisco's senior vice president and general manager of AI software and platform, told The Register. The company is working with academic and nonprofit organizations, as well as smaller and public organizations’ security teams, to ensure they have access to the vulnerability-hunting models. Plus, because both are small models designed to run locally, “you also need the keys to the source code” to scan for and find vulnerabilities, Sampath said. “This means an attacker is going to be able to exploit an endpoint or a service that you have.” It also means that proprietary code never leaves the organization’s machines, compared to cloud-based LLMs that send code to the AI providers’ external servers for processing and analysis. This enables security analysis in environments with strict privacy or compliance requirements, according to the networking and security giant. And yes, it's named after the massive red super-giant star. “It's almost 1,000 times bigger than the sun, even though the sun dominates the sky, and that is the analogy that we're using here for vulnerability detection and localization,” Cisco VP and chief AI scientist Amin Karbasi told The Register. “The impact of vulnerabilities in your codebase is huge, but it might be only a single file or a few lines of code in a million lines of code.” A future, 3-billion-parameter model in the Antares family won’t be released to the public, Karbasi added. “We are completely gating the 3B model to make sure that we responsibly release it to communities that need it,” he said. Small yet mighty Cisco claims that its models perform as well as or better than dozens of larger models in its new benchmark test that measures how efficiently AI models identify security flaws in codebases. Antares-1B outperforms Google’s Gemini 3 Pro and is comparable to Z.ai's GLM-5.2, we’re told, while the yet-to-be-released Antares-3B does a better job at finding vulnerabilities than GLM-5.2 and OpenAI’s GPT-5.5. Plus, we’re told that the small models scan code much faster and at a fraction of the cost of larger, token-gobbling AI systems. “If you look at the performance, in terms of the time it takes to finish 500 repositories, Antares finishes the entire cohort of repositories in 15 minutes, whereas frontier models take five hours,” Karbasi said, adding that this translates to significantly less cost. “It takes like less than $1 whereas frontier models are above $100 into $150 of cost,” he added. The difference, Karbasi explained, is that Cisco took a “fundamentally different approach” to building Antares. “These models have been trained in a very different way,” he said. “Antares is inherently not a chatbot. It is an investigator. It is a search engine. It has to find a very specific thing that might be a needle in a haystack, and it goes and finds that.” This required training the model on several different ways to search for vulnerabilities “because one way of search may not actually be fruitful, then it has to change its strategy, do it another way, and then do it another way,” Karbasi said. “Because it is very nimble and it’s very small, it can actually do a lot of search at the same time, which is very different from bigger models.” Karbasi likened it to a bicycle on a busy London street: “You can go much faster than the biggest truck.” Or, to use Sampath’s favorite analogy for the benefits of using a small, security-focused model to find bugs in code: “Sometimes you don't need a private jet to go to a corner store, right?”®

AI models will do just about anything to complete the task you ask, including cheating to get there, according to new cybersecurity evaluations from the UK government's AI Security Institute (AISI). The group found that leading models often take shortcuts to achieve a particular result and then misrepresent how they obtained that result. And they won't always admit it when asked. "Every model we have tested for this behaviour attempted to cheat," AISI said in a blog post on Tuesday. "Models did not reliably report this behaviour when asked, and often did not reason about it in their chain-of-thought, suggesting that detecting cheating will likely require robust monitoring methods." Infractions included searching the internet for the answer, bypassing sandbox network restrictions, probing the evaluation harness, attacking a system other than the target, and guessing an answer. Cheating in this manner – employing a workaround or gaming a reward function to score better on a benchmark test, for example – has been widely documented by machine learning researchers. It doesn't necessarily imply malicious intent, AISI said, but it's nonetheless troublesome because it can produce misleading assessments of model capabilities. When AISI conducted evaluated five leading models, it found that all of them cheated. The results were as follows: GPT-5.4 cheated 67 times in 475 test runs (14.1 percent). GPT-5.5 cheated 54 times in 475 test runs (11.4 percent). GPT-5.6-Sol cheated 60 times in 475 test runs (12.6 percent). Claude 4.7 Opus cheated 43 times in 475 test runs (9.1 percent). Claude Mythos Preview cheated 37 times in 475 test runs (7.8 percent). Asking models whether they cheated or did anything wrong proved an unreliable auditing mechanism because the models didn't always admit wrongdoing. "In our experiments, models did not consistently acknowledge attempted cheating when asked, and described it as wrong less than 50 percent of the time," said AISI. Existing vetting methods, such as self-reporting and chain-of-thought logs, proved similarly dicey because models don't always report their chain-of-thought. And there were instances where a model would consider whether a proposed action amounted to cheating and then decided to take the action anyway. Given the absence of reliable model cheating detection methods, AISI warns that its current approach – manual review coupled with LLM monitoring – may not be sufficient to catch deception, particularly as models become more sophisticated. "A more fundamental fix would be to train the models not to cheat in the first place – but given this kind of behaviour was reported in frontier models more than a year ago, robustly aligning it away may not be easy," AISI concludes. ®

German authorities say they have neutralized the main infrastructure supporting the Kratos phishing-as-a-service (PhaaS) kit following an operation supported by the US and Indonesia. Officers from Frankfurt am Main's Central Office for Combating Internet Crime (ZIT) and the Federal Criminal Police (BKA) described Kratos as one of the most widespread and dangerous PhaaS kits on the market. In Indonesia, authorities said they arrested the Kratos kit's alleged "developer and technical administrator." The announcement of Kratos's takedown did not mention whether any other individuals are being pursued. According to the ZIT and BKA, Kratos allowed low-skill cybercrims to harvest credentials, including passwords and session cookies, to bypass MFA by providing them with convincing Microsoft-themed phishing pages. Criminals using Kratos phishing pages targeted hundreds of thousands of victims across more than 30 countries, while the operation behind the kit allegedly earned more than €300,000 ($342,000) since 2024. More than 1,800 criminal enterprises are estimated to have used Kratos, which was responsible for around 15,000 phishing campaigns per month. "Each individual campaign had the potential to harm several thousand recipients worldwide," the German authorities said in a statement. The operation neutralized more than 200 servers, according to the ZIT and BKA, although the latter declined to explain how. Methods used in previous takedowns included handing legal warrants to infrastructure providers, such as Kratos's chosen hosting company, and working with ISPs to null-route or sinkhole traffic associated with suspect IP addresses. Dr Benjamin Krause, head of the ZIT at the Frankfurt am Main Public Prosecutor's Office, said, "Our approach of disruptive law enforcement works: In addition to the primary task of identifying and prosecuting the accused, we have once again succeeded in dismantling a criminal online service and thus contributing to greater cybersecurity." Carsten Meywirth, head of the cybercrime department at the BKA, added: "Anyone who steals login credentials online using fake websites shouldn't feel safe. The success against the Kratos phishing kit shows that even highly professional phishing infrastructures can be effectively combated. "This is pioneering work and a clear signal to other cyber actors – phishing will not go unpunished and will be consistently fought by the BKA." Many names, same focus German authorities referred to the PhaaS kit only as Kratos, although open source reporting has tied it to products previously sold under names such as SneakyLog and Sneaky 2FA. Similarly, the ZIT and BKA mentioned only fake Microsoft authentication pages among the templates offered by Kratos. Microsoft, meanwhile, reported earlier this year that SneakyLog had been used to generate phishing campaigns targeting US citizens with fake W-2 tax forms. As recently as July 16, security shops such as Heal Security reported that Kratos offered customers lures themed around various websites, including SharePoint, OneDrive, Microsoft Forms, Canva, Tilda, and more. KnowBe4 added Adobe lures to that list with its own investigation in February, which also raised uncertainty about when the kit first hit the market. Microsoft, which said Kratos was also known as SneakyLog, believes the latter entered the phishing kit market as of early 2025, although KnowBe4 said the first signs of Kratos only emerged in January 2026. Muddying the picture further, KnowBe4 did not mention SneakyLog or Sneaky 2FA as part of Kratos's past. The security shop said instead that it evolved from a previous life as a family of commercial trojans and infostealers. One thing that most open source reports agree on, however, is that the targets of the phishing kit's customers are based primarily in the US and Europe. Microsoft identified manufacturing, retail, and healthcare as the main target industries in the US, while in Europe, industrial organizations, law firms, polytechnic institutions, schools, SMBs, and others have all been attacked, according to ANY.RUN. ®

A data breach at AI music generator platform Suno exposed more than 55 million user accounts, according to Troy Hunt's Have I Been Pwned service, which ingested the files. The dump consisted mostly of email addresses, although phone numbers were also included where users had signed up with them instead, HIBP said. Tens of thousands of Stripe records further revealed data such as names, physical addresses, purchase amounts, as well as partial credit card data, such as card type, expiry date, and the last four digits of the card number. The breakdown from Have I Been Pwned puts a figure on the scale of Suno's data breach for the first time since the news of the slip-up broke last week. The individual who claimed responsibility for breaching Suno also supplied source code apparently dating from 2023 and 2024 that they said showed the company scraping millions of songs and lyrics from services including YouTube Music, Deezer, and Genius to train its AI. Suno has acknowledged training its AI on music available on the open internet, while arguing that doing so constitutes fair use. It did not immediately respond to The Register's request for comment. AI's imposition on the arts has been a persistent topic of ethical and moral debate for years. Major record labels came together to complain about mass data scraping and copyright infringement by AI companies prior to Suno's breach in November 2025. Record labels represented by the Recording Industry Association of America (RIAA) sued Suno and rival Udio in 2024 for allegedly scraping songs en masse without permission of the copyright holders. Among the plaintiffs in the case were Sony Music Entertainment, UMG Recordings, and Warner Records, which represent artists such as Bruce Springsteen, Beyoncé, Taylor Swift, and Dua Lipa. Warner has since settled its litigation with Suno and begun a commercial partnership with the AI company, while Sony and UMG are continuing their claims in court. ®

Fortinet on Tuesday revealed it will use Intel Foundry to fab its sixth-gen Security Processor (SP6), a nice win for Chipzilla's sputtering chipmaking biz. The chips feature dedicated accelerators designed specifically for the security and cryptographic operations required by modern hardware firewalls. The custom chips are one of Fortinet's defining features. Many cybersecurity hardware players build appliances around commodity hardware like x86 and Arm CPUs, but Fortinet prefers custom application-specific integrated circuits (ASICs). The two companies haven't said when the chips will enter production, much less what the SP6's speeds and feeds will entail, though we imagine it'll have a bit more pep than Fortinet's SP5 chips. The SP5 launched in 2023 and boasted support for layer 7 firewalling and IPsec VPN connectivity at speeds exceeding 30 Gbps. Throughput fell when advanced threat protection or SSL inspection was enabled, but Fortinet still claimed a speedy 4.3 Gbps and 3.3 Gbps, respectively. As you might have already figured out, Fortinet's SP line is designed primarily for smaller appliances like SD-WAN gateways, rather than larger datacenter-centric appliances built around its beefier NP and CP-series parts. While Intel couldn't offer much detail on the chip itself, we're told it will use the older Intel 4 process node rather than the leading-edge 18A process tech. Chipzilla also suggested Fortinet will draw on its experience in disaggregated semiconductor design and advanced packaging, which could mean a chiplet architecture with greater scalability. With so little detail, we can only speculate. Intel declined to say which technologies beyond Intel 4 the chip will use. The x86 giant also declined to comment on the availability of the product, noting only that "details regarding the Fortinet Security Processor 6 availability will be announced at a later date." While SP6 won't use the latest chipmaking tech, it will be built in an American fab by an American company, offering a level of supply chain security that remains difficult to find. If you want even remotely leading-edge silicon, Intel, Samsung, and TSMC are your only options. US-based production can still mean settling for a less advanced process, although TSMC's first Arizona fab has already begun churning out 4 nm silicon and Samsung aims to bring its new Texas plant online this year. Fortinet would not be the first to enlist Intel's manufacturing might for sensitive workloads. Under DARPA's HIVE program, the chipmaker built an eight-core, 528-thread processor with 1 TB/s silicon-photonics interconnects specifically to accelerate graph analytics workloads. But it doesn't stop at the DoD. Supply chain security is something Intel has leaned into as it has sought to reinvent itself from an integrated device manufacturer serving mainly itself, and occasionally the US government, into a full-fledged foundry ready to compete with Samsung and, ultimately, TSMC. In mid-2024, Uncle Sam awarded Intel $3 billion to establish a secure enclave for manufacturing chips for government agencies. Since then, the US government has taken a 9.9 percent stake in the American chip biz. ®

French cloud operator OVH has revealed it used its Sydney, Australia, datacenter as the crash test dummy to test a rapid rollout of a fix for the critical Januscape guest-host escape bug in the Linux kernel-based virtual machine (KVM). Januscape, aka CVE-2026-53359, allowed attackers with root access to a guest VM to execute code as root on the host, crash that machine, or take over all other guest VMs. A widespread guest-host escape exploitation is a nightmare scenario, because many major clouds use KVM to slice their servers into virtual machines and then rent those guests to clients. The prospect of attackers accessing one tenant’s VM and using it to crash other guests or an entire host is therefore a terrifying violation of cloud operators’ promise to run customer workloads in splendid isolation. Fixing it was therefore a priority. On Monday, French cloud OVH’s CISO Julien Levrard revealed how the company handled the emergency patch job on tens of thousands of hosts that run approximately a million virtual machines, in a lengthy post that offers an unusually detailed and candid account of how clouds cope with major security incidents. One way to mitigate the bug was to disable nested virtualization by creating a two-line config file on each host running Linux KVM. That wasn’t an option because OVH has no way to see if its tenants need nested virtualization and relies on it to shift VMs to different physical hosts. Nor was applying a live patch palatable, as it could introduce instability. Live migration to patched hosts was another option, but one OVH rejected as the process is slow and the company felt it might take months to move its entire fleet of tenant VMs to a Januscape-free environment. The company therefore decided to backport a Januscape fix into the Debian distribution it uses in production and reboot all hosts, giving customers advance notice but no choice. That meant customers who rely on a single host would experience some downtime, but OVH’s executive committee signed off on this approach for three reasons: The need to patch before attacks; Treating cases individually would mean the OVH cloud would be vulnerable for longer; A desire to protect the greatest number of customers, and tolerate impact on a minority. OVH also decided to stay quiet about the patching plan. “Communicating in more detail during the execution of the mitigation plan, while the infrastructure remained unpatched, would have significantly increased the risk for our customers, potentially leading some to ‘test’ the publicly available exploit,” Levrard wrote. Danger down under To test its patching prowess approach, OVH decided to first fix its Sydney region – one of the company’s smaller regions and one which, thanks to Australia’s east coast being eight hours ahead of France, teams in Europe do the job during their business hours – but at a slow time in Sydney. The company therefore planned to go down under and learn from the experience before deploying the fix more widely. OVH’s plan called for reboots to occur in waves, with a “shutdown threshold” imposed if 15 hosts failed simultaneously in high-density regions, or five boxes in other regions. But those waves weren’t as simple as just going rack by rack. “The main risk for our clients during such an operation is not the reboot itself, but the simultaneous interruption of multiple instances of the same project, ensuring application resilience capable of handling a provider failure,” OVH’s blog on the project explains. “A client who has distributed their workloads across multiple hosts to ensure high availability should not see all of their instances fail over at the same time. The decision was made to go beyond simply adhering to the anti-affinity rules that may have been defined in client deployments.” “Thus, for each client project with instances distributed across multiple hosts, our orchestrators calculate a co-location graph. At no time are two hosts running instances of the same project rebooted in the same window: mutually exclusive waves are defined, and a host must be back online before the next one is launched in the same anti-affinity class.” The patching effort hit a few snags. Some VMs didn’t restart after hypervisor reboot. Some experienced data corruption during forced shutdowns. OpenStack APIs misbehaved, producing hours of HTTP 503 errors and necessitating postponement of one patching wave. At a Canadian site, “API traffic reached 10 times the usual peak, overwhelming the manager and support teams.” Hardware hiccups Some hardware died during the process. “On the first night, approximately 20 to 30 hosts out of 6,000 did not recover on their own,” Levrard revealed, blaming “faulty memory modules, BIOS configuration issues, inactive network interfaces.” Some machines needed new CMOS batteries. The CISO thinks OVH’s approach was “a remarkable feat” as it produced “a very reasonable number of outages and customer impact relative to the scale of the project.” But he thinks the company will need to improve. “Recognizing that the coming months could see further kernel vulnerability disclosures, it seems clear that this emergency procedure will need to be repeated,” he wrote. “We will need to do better next time, both in managing the raw impact of the restarts and in providing customers with advance notice and support during the operations.” The company is therefore conducting a post-mortem analysis it hopes will improve its processes. ®

If you use WordPress, patch now. Just hours after fixes came out, attackers have begun exploiting two bugs that, when chained together, allow pre-authentication remote code execution (RCE). And security researchers tell us there’s a very good chance the miscreants had an AI assist. “Once the vulnerabilities were publicly disclosed, reproducing them with the help of frontier AI models was only a matter of time and tokens,” Jake Knott, watchTowr principal security researcher, told The Register. “WatchTowr was able to trivially reproduce CVE-2026-63030 within minutes of disclosure, and the second CVE-2026-60137 with some additional effort.” WordPress released patches for both CVEs late Friday, but by Saturday it was game over. “By the early hours of Saturday morning, successful exploitation was already well underway, initially using public exploit code to exfiltrate hashed credentials, with remote code execution following once additional details were made public,” Knott said. “From our vantage point across a global client base, we are seeing widespread impact of this vulnerability across organizations of every size and every vertical.” Here are the details about both security holes, and what went down since WordPress revealed and fixed them on Friday. CVE-2026-60137 is a moderate-severity SQL injection issue, and CVE-2026-63030 is a critical REST API batch-route confusion bug. “A route confusion flaw causes the arrays containing the sub-requests, validation results, and matched handlers to become misaligned,” Hacktron researchers explained. This causes WordPress to become confused about which requests have been properly validated and thus treat all requests as trusted, including those that it should block. Individually, the bugs are difficult to exploit. But when chained together, they can wreak havoc on any organization using a vulnerable WordPress version because they allow unauthenticated RCE. WordPress 6.9 is affected by both vulnerabilities, and version 6.9.5 contains fixes for both, while WordPress 6.8 is only affected by the SQL injection flaw, and version 6.8.6 fixes it. Additionally, WordPress 7.1 Beta 1 is also vulnerable. Version 7.1 Beta 2 fixes both CVEs. Versions of WordPress prior to 6.8 are not affected. John Blackbourn, one of the WordPress core developers, recommended affected users “update your sites immediately.” Because of the flaws’ severity, the WordPress security team “enabled forced updates via the auto-update system for sites running affected versions,” he added. The content management system credited Searchlight Cyber researcher Adam Kues with finding and reporting CVE-2026-63030, and in a subsequent Friday advisory, Kues dubbed the bug wp2shell. “The attack has no preconditions and can be exploited by an anonymous user in a stock install of WordPress with no plugins,” Kues said, adding that his security shop released a free wp2shell checker to determine if your instance is vulnerable. Security firm PatchStack reported exploitation of both CVEs as of Friday night, but didn’t provide details about the attacks. VulnCheck’s research team, which also began researching the patches on Friday, verified more than two dozen unique proof-of-concept exploits targeting WP2Shell as of Sunday. “After public exploit code was released, attackers began spraying the internet indiscriminately, hitting anything reachable and trying to get lucky,” Knott told us. “Our honeypots recorded tens of thousands of exploitation attempts, and more than 100 backdoor accounts created by different threat actors using variations of public tooling.” After creating these backdoor admin accounts, watchTowr observed attackers deploying fake WordPress plugins to achieve RCE, exfiltrate credentials or secrets, or download additional tooling to further compromise the system, he added. “In one case, we watched a threat actor repeatedly attempt to pull down Overlord RAT, a Golang-based remote access trojan.” Any orgs that waited until Monday to patch are likely already compromised, Knott warned. “Defenders need to inspect their WordPress instances for new administrator accounts, malicious plugins, or other suspicious files, regardless of whether they’ve patched,” he said.®

Real FBI agents won't slide into your DMs and offer to help you recover stolen funds. The bureau's Internet Crime Complaint Center (IC3) updated an earlier warning on Monday about scammers impersonating the agency online, saying fraudsters continue to use the scheme "to deceive and revictimize individuals." According to IC3, there are two different schemes being used to target cybercrime victims, both directly and by soliciting them to report incidents. In the first scheme, IC3 said scammers create fraudulent social media profiles and pages impersonating FBI personnel or IC3. They may also infiltrate online groups for fraud victims or contact victims directly while claiming to represent the FBI or the complaint center. In other cases, victims are being contacted by someone claiming to be an FBI agent after realizing they were approached by someone trying to scam them and saying they intended to report the incident to the FBI or file an IC3 complaint. The FBI said the impersonator then directs victims to a fake IC3 update page or continues communicating through messaging apps. In the other instance, scammers are creating AI-generated videos on social media depicting senior FBI officials and directing users to a spoofed IC3 website to report cybercrimes they may have fallen victim to, with the scammers then collecting the information and using it to contact victims for further fraud. AI-generated depictions of public figures are similarly being used to make such scams appear legitimate. “Some individuals received an email or a phone call, while others were approached, or observed an advertisement via social media or forums,” the IC3 said. “Almost all complainants indicated the scammers claimed to have recovered the victim's lost funds or offered to assist in recovering funds.” Regardless of how legitimate social media profiles look, or how realistic those AI-generated videos may be, the IC3 is warning that none of them should be believed for a simple reason: The IC3 doesn’t have a social media presence of any kind, and it doesn’t investigate crimes or offer to recover lost funds through social media. “Any social media profiles or pages claiming to represent IC3 or offering to recover lost money are fraudulent and are actively attempting to steal your personal or financial information,” the IC3 warned. “IC3 will never directly communicate with individuals via phone, email, social media, phone apps, online chat, or public forums.” The IC3 said that any contact made with a cybercrime victim who reports an incident via its actual website will be made by an FBI employee from a local field office or other law enforcement official. Here’s another hot tip: If you fall victim to a cybercrime or online scam, don’t post about it on social media - that’s only going to invite someone with bad intentions to seek you out. ®

AI datacenters wreak havoc on the power grid under normal circumstances, so what happens if a bad actor controls all the GPUs and wants to cause harm? Cybersecurity researchers in China have devised a way for malicious tenants to attack their infrastructure provider, potentially causing blackouts or damaging equipment. The attack, dubbed Bit2Watt, imagines an adversary masquerading as a legitimate cloud tenant to launch GPU workloads that have the potential to damage datacenters and supporting electrical systems. It's intended to demonstrate the need to extend cybersecurity defenses to datacenter workload scheduling. The researchers, Zhouhao Ji, Kaikai Pan, and Wenyuan Xu, from Zhejiang University in Hangzhou, China, describe their technique in a preprint paper titled "Bit2Watt: A Cyber-Physical Vulnerability Exploiting GPU Workloads Across Power and Computing Infrastructures." AI training workloads represent a known challenge for datacenter operators. As Microsoft, Nvidia, and OpenAI noted in a 2025 research paper arguing the need for power stabilization during AI training, the transition from GPU computation to GPU data synchronization causes large power swings to occur. And if the frequency spectrum of these power swings is "harmonized with critical frequencies of utilities, [that] can cause physical damage to the power grid infrastructure." Meta's paper on the training of Llama 3 also cites the risk AI training poses to the power grid. It says, "During training, tens of thousands of GPUs may increase or decrease power consumption at the same time, for example, due to all GPUs waiting for checkpointing or collective communications to finish, or the startup or shutdown of the entire training job. When this happens, it can result in instant fluctuations of power consumption across the datacenter on the order of tens of megawatts, stretching the limits of the power grid." Bit2Watt weaponizes this scenario by proposing that an adversary could use malicious GPU workloads to destabilize the datacenters and electrical infrastructure. "Our results indicate that GPU loads can reach modulation frequencies exceeding 6,000 Hz, compared with only a few hertz observed in conventional household loads such as air conditioners," the Zhejiang University authors state in their paper. "Such high-frequency modulations can substantially induce voltage excursions, harmonic distortion, and damping degradation." The authors claim an attack on a 1-MW local power grid consisting mainly of distributed energy resources like photovoltaics could use 1,000 GPUs to create a total harmonic distortion of 46.8 percent, which would squander nearly half the electrical current on non-productive work and would throw off about 20 percent more heat than normal. "This not only threatens the availability of the computing equipment but also produces a negative damping ratio of -0.27, introducing an unstable mode into the system," the authors contend. "Once the protections are triggered and computing loads are shed, it can trigger cascading failures, potentially leading to blackouts exceeding 80 percent in large-scale power systems." The attack is relatively covert, the authors argue, because it can be launched within authorized workload execution paths and would likely be missed by cloud-provider monitoring frameworks. Thus, they propose that infrastructure providers coordinate defenses across the cyber and physical layers to look for malicious computation patterns. They also emphasize the need for local energy buffering systems to handle power demand spikes. Bit2Watt also potentially opens the door for a side-channel attack called Watt2Bit. The researchers note that the electrical and thermal stress on hardware from a malicious workload creates denial of service events and enables the covert exfiltration of data via power modulation. As a proof of concept, they showed they could recover a 50-bit test sequence using frequency-shift keying (FSK) encoding. "These findings underscore a fundamental shift: as power and computing infrastructures converge, security must be addressed across domains, requiring coordinated defenses that consider workload behavior, power electronics, and grid dynamics," the authors conclude. ®

Apparently, being a leading destination for AI development doesn't mean AI will bail you out. AI agents broke into Hugging Face's production infrastructure, but commercial LLM guardrails blocked the forensic investigation, forcing it to turn to a Chinese open-weight model instead. The intrusion, “driven, end to end, by an autonomous AI agent system,” compromised a “limited set” of Hugging Face’s internal datasets and “several” credentials used by its services, according to a Thursday security incident disclosure. While the ML platform says that it’s still investigating whether any partner or customer data was exposed in the breach, there’s “no evidence of tampering with public, user-facing models, datasets, or Spaces, and our software supply chain (container images and published packages) was verified clean.” It also doesn't know which model the attackers used to power a swarm of AI agents, which, we're told, executed many thousands of individual actions across short-lived sandboxes, using self-migrating command-and-control staged on public services. “This matches the ‘agentic attacker’ scenario the industry has been forecasting,” according to the Hugging Face blog. Additionally, after unsuccessfully using unnamed frontier models to start the forensic analysis, the Hugging Face security team ultimately ran the log analysis on GLM 5.2, an open-weight model developed by Chinese AI firm Z.ai, on the platform’s own infrastructure. The advanced commercial models didn’t work because their analysis required submitting real attack commands, exploit payloads, and command-and-control artifacts - all of the things that the LLMs’ guardrails have been trained to block so that the AI systems can’t be used in real-life attacks. “The attacker was bound by no usage policy, while our own forensic work was blocked by the guardrails of the hosted models we first tried,” the security team wrote, noting that it’s not arguing against safety measures on hosted models and has shared this information with the LLM providers. Using GLM 5.2 had another benefit, Hugging Face noted: “No attacker data, and none of the credentials it referenced, left our environment.” This also serves as an important reminder to defenders, according to the AI platform. “Have a capable model you can run on your own infrastructure vetted and ready before an incident, both to avoid guardrail lockout and to keep attacker data and credentials from leaving your environment.” The Hugging Face intrusion is yet another indication that attacks carried out by autonomous AI agents are no longer a future threat, but rather the current state of AI-based intrusions. Last week, The Register spoke with TrendAI VP of AI and security threat research Tom Kellermann about another recent attack, during which a jailbroken Google Gemini did 90 percent of the work - including spinning up a new C2 server in just six minutes. The human did just 10 percent. Additionally, earlier in July, Sysdig threat hunters documented what they say is the first-ever documented agentic ransomware infection with an LLM - not a human - driving the entire extortion operation, from gaining initial access to compromising a production database server and destroying data. “Think of a burglar that never gets tired, never needs sleep, and instead of jiggling one door handle at a time, is trying a thousand of them simultaneously,” Zero Networks field CTO Chris Boehm said in an email to The Register about the Hugging Face intrusion. “That's basically what happened here. Not one guy typing commands into a terminal, a swarm of little automated processes hammering away nonstop, hopping between hiding spots to make it harder to trace,” Boehm said. He added, the “part that actually unsettles” him most is that the platform’s security team couldn’t get commercial AI tools to help analyze the attack, “because those tools were built to refuse anything that looked like a real attack command. It didn't matter that it was the good guys asking.” Boehm said the takeaway for security teams is twofold: “These agents can now move faster and more relentlessly than any human ever could, and the safety tools we're building aren't always ready to help us respond at that speed.”®

Microsoft 365 calendars have become the latest hiding place for espionage malware, with attackers stashing commands and stolen files inside appointments dated 24 years into the future. Researchers at Group-IB say they've uncovered a malware component they call HOLLOWGRAPH that swaps the usual command-and-control server for something rather less conspicuous – a compromised Microsoft 365 calendar. Instead of reaching out to attacker-controlled infrastructure for instructions, the implant rummages through calendar events, picks up encrypted tasking, and drops stolen files into new appointments for its operators to collect later. Every event created by HOLLOWGRAPH is dated May 13, 2050, an otherwise empty corner of the diary where encrypted attachments are less likely to attract attention. HOLLOWGRAPH isn't exploiting Microsoft Graph so much as blending into it, wrapping its command-and-control traffic inside legitimate Graph API requests that look just like any other Microsoft 365 application talking to the cloud. The malware itself is relatively lean. Group-IB says it does little more than fetch instructions from one calendar event, stash stolen files in another, and periodically retrieve fresh Entra ID credentials over a DNS tunneling channel so the Graph-based communications keep working. The security firm linked the malware to the Cavern framework with high confidence after finding matching command formats and other implementation details. It also spotted similarities with the Iranian-linked espionage group Lyceum, although it stopped well short of pinning the operation on that crew, saying the connection was supported with only low confidence. "HOLLOWGRAPH represents an advanced and highly targeted espionage threat," Group-IB wrote. "By abusing trusted Microsoft 365 calendars through the Microsoft Graph API and refreshing its cloud authentication credentials through DNS tunneling, the malware conceals its command-and-control within legitimate Microsoft 365 and network traffic, evading conventional perimeter defenses." The campaign itself appears to be narrowly targeted. Group-IB identified 12 infected systems, only three of which communicated with the compromised mailbox during the period it observed. The compromised mailbox used for command-and-control belonged to an Israeli organization, malware samples were uploaded from Israel, and the researchers said the evidence points to a focused espionage operation rather than a broad smash-and-grab. HOLLOWGRAPH doesn't exploit a flaw in Microsoft 365 or Microsoft Graph. Instead, it takes advantage of services that are already trusted inside most organizations, making the activity far less conspicuous than malware calling home to attacker-controlled infrastructure. ®

Avoiding the "lethal trifecta" – access to private data, exposure to untrusted content, and an external communication path – is difficult enough when working with AI agents. But the use of connectors – integrations with third-party services like Gmail or Slack – expands the scope of concern in a way that makes it exceedingly difficult to reason about defensive due diligence. PromptArmor, an AI security biz, recently looked at how OpenAI's ChatGPT and Anthropic's Claude work with connectors. The results are not reassuring. Shankar Krishnan, co-founder of PromptArmor, told The Register in an email that enterprise adoption of connectors and the rate of change among connectors helped focus concern on the connector ecosystem. Connectors share some of the risks of MCP servers, upon which connectors are based. "For connectors, the risks are mostly about the type of tools, what they can do, where the data is going, and what is being done with the data," said Krishnan. Introduced about a year ago, connectors (for Claude or ChatGPT) have been going through a lot of changes recently. According to PromptArmor, 931 of 2,517 connectors (37 percent) changed over the six-week period from mid-May to the end of June. So any security assumptions based on declared capabilities may no longer be valid. PromptArmor found that 1,686 new tools were added to connectors that were already live, creating new ways for AI models to operate on user data and interact with third-party services. It also found that 1,127 tool descriptions were rewritten, potentially changing how and when an AI model decides to invoke a tool. And there are a variety of other changes, all of which potentially could raise data security concerns or invalidate governance assumptions. PromptArmor cited the Dropbox connector as an example, noting that at the start of the study it exposed eight tools and by the end of the study that number had risen to 24. It went from having three write-capable tools to 10, and from zero potentially destructive tools to four. Permission scopes changed and injected instructions for the model were added. If that weren't enough to worry about, connectors can behave like intrusive websites that run dozens of tracking scripts: connectors commonly send data to additional AI services. PromptArmor evaluated all 7,517 tools used by 487 Claude connectors and found that 189 of the connectors, or about 2 in 5, are likely to call additional AI services. "As an example, if your Claude agent activates Zoom's connector tool to search meetings with natural language, and passes in a query containing sensitive data, Zoom AI may send that data to any of its ten AI subprocessors in order to generate a response from one of eight different model families it uses," the security company said. "The issue is that most teams approving connectors are evaluating and considering the connector – unaware that the vendor is calling more AI services, adding new subprocessors and terms," explained Krishnan. "So someone concerned about AI risks who has evaluated Claude may not be aware of AI services that the connector is calling externally." Anthropic's connector documentation acknowledges that its security controls don't necessarily cover third-party data processing. "Connected services process data on their own infrastructure, under their own terms, which may be located outside the United States," the AI biz explains. "Settings that control where Claude's inference runs, like the US-only inference setting on Enterprise plans, don't change where third-party services operate." Krishnan said that connectors vastly expand the risk surface for attacks. "Bringing agents new sensitive data, new untrusted data, and new sensitive actions to take, the blast radius of an attack explodes," he said. "We recently highlighted a risk in Codex where even with one connector – email – the combination of sensitive and untrusted data enables exfiltration of legal and financial communications." ®

Notice more spam getting through that corporate email filter lately? Attackers are using a technique known as "text salting," which hides benign-looking words intended to confuse some AI-powered email filters, says cybersecurity firm Barracuda. The email security outfit said on Thursday that it had detected more than one million retail-themed phishing attacks using text salting since April. It’s not a new technique by any stretch and has been used to fool traditional secure email gateways for years, but Barracuda says it can also confuse machine-learning and LLM-based security tools. Text salting involves peppering (sorry) a malicious email with random, harmless-seeming words in order to fool an email scanning system into thinking there’s nothing off about the flavor of a message (sorry again), tricking the system into passing it to its recipient for consumption (I’ll stop with the food jokes here). Pour a pile of salty text on top of an email and a human reader would probably get suspicious, however, so attackers typically use one or more of three flavor variations (okay, I'm done – promise) to hide the additives from human readers, but not automated scanners, per Barracuda. Typical techniques include CSS cropping, which sets the visible window small enough that a human won't see the hidden filler text; text manipulation to move the salty copy outside the visible screen; and zero font techniques which insert misleading words between suspicious phishing copy that’s visible to a machine but not a human. The end result of each of those techniques is a message that reads less malicious, more gibberish to a machine, leading it to assume the email is fine, and which looks exactly as the attacker intended when viewed by a human. Modern email security systems have largely adapted to these techniques, with newer tools able to remove hidden text to see what a reader is supposed to see, sounding alarms when a lot of hidden stuff is inserted in an email, and the like. AI, however, hasn’t managed to follow suit, says Barracuda. “Text salting and related techniques can be used to confuse AI-driven content analysis engines by flooding the email with random terms that encourage the AI system into making an incorrect classification decision,” the company wrote in its report - just like those early 2000s SEGs. What a technological leap we’ve made! LLMs, Barracuda explained, are typically designed to process email text and source code plainly, with no understanding of whether text is visible or hidden from a user. They can be trained to do so, but that just means most tools probably aren’t doing that by default. So, what can enterprises do to stop the flow of salty spam to their employees? Barracuda recommends a layered approach to email security rather than relying solely on keyword detection, including checking sender reputation, authentication results, embedded URLs, HTML-rendering techniques, and differences between user-visible and hidden content. Ditching that AI spam filter might not be a bad idea, either. ®

Fortinet admins have two more reasons to clear their calendars after CISA confirmed a pair of critical FortiSandbox bugs are being actively exploited. The two bugs, tracked as CVE-2026-39808 and CVE-2026-25089, both carry CVSS scores of 9.1 and affect FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS. According to Fortinet, they are OS command injection flaws that allow unauthenticated attackers to execute arbitrary commands via specially crafted HTTP requests, requiring neither valid credentials nor user interaction. Fortinet released fixes for CVE-2026-39808 in April and CVE-2026-25089 in June, warning in advisories published at the time that successful exploitation could lead to remote code execution via low-complexity attacks. Fortinet has not publicly confirmed that either flaw is being exploited in the wild, but CISA has now added both bugs to its Known Exploited Vulnerabilities (KEV) catalog. Inclusion in the catalog means CISA has evidence that the vulnerabilities are being actively exploited, although the agency rarely attributes attacks or discloses how widespread they are. For federal civilian agencies, bugs landing in KEV come with homework. Binding Operational Directive 26-04 requires them to patch within CISA's deadlines or pull the plug on vulnerable products if they can't be adequately secured. Fortinet has not updated its advisories to mark either flaw as exploited and did not respond to The Register's questions. CISA isn't the only one reporting attackers poking at these vulnerabilities. Security firm Defused said it had observed exploitation attempts against both flaws this week alongside another FortiSandbox vulnerability, CVE-2026-39813. Not every exploit appears to be doing its job, though, as Defused described the one targeting CVE-2026-25089 as "vibecoded" and likely broken, adding that it has yet to see a working public exploit. CISA also used Thursday's KEV update to flag another fresh concern: Microsoft's newly patched SharePoint Server bug, CVE-2026-58644. The critical deserialization vulnerability, rated 9.8, allows authenticated attackers with Site Owner privileges to execute arbitrary code remotely against vulnerable SharePoint servers. Microsoft warned that the bug can be exploited remotely over the internet with relatively little effort, making it one to patch sooner rather than later. ®

Picture this. Someone gets hold of your Android phone and, despite not knowing your PIN, they can use Gemini from the lock screen to send SMS or WhatsApp messages as you. This is a real bug and Google says a fix is coming as soon as this week. Since May, The Register has received multiple reports of users bypassing device authentication on Android 16 devices that enable Gemini access from the lock screen. These are distinct from the similar Gemini-based Android lock screen bypass bugs that have made the rounds since September 2025. One of the bugs reported to us allowed unauthenticated users with physical access to an Android device to enable functionality such as phone, texts, and WhatsApp via Gemini on the lock screen using a specific multi-touch gesture. When device owners revoke Gemini’s access to certain apps, like Messages, and someone later tries to send an SMS via Gemini on the lock screen, the chatbot will prompt the user to open the relevant app. Selecting "Continue" prompts the user to enter the correct PIN to access messages. However, when “Continue” is pressed simultaneously with Gemini’s “Add attachment” button, the device will then allow unauthenticated users to send that SMS via Gemini, without needing to enter a PIN. From there, users can enable Gemini’s access to other apps, which were previously disconnected from Gemini in the user’s Settings, by invoking the relevant prompt. For example, to allow Gemini access to WhatsApp, users can enter “@WhatsApp” in the Gemini text window. No PIN needed. You can then check this has worked by going back into user Settings, after entering a correct PIN, and it will show that WhatsApp is connected to Gemini without completing the expected authentication step. Exploiting the flaw requires physical access to a device. In most circumstances, we steer clear of giving this type of vulnerability too much airtime since it is often difficult to pull off in real-world scenarios. If Windows, for example, had a make-me-admin bug that required the attacker, for whatever reason, to have physical access to the keyboard connected to the Windows machine, then the owner of said machine has bigger problems than the vulnerability itself. However, given the state of phone theft crime, especially in the UK, and the potential to send convincing SMS messages as part of fake kidnapping scams, to name one possibility, we think this one deserves some attention. A Google spokesperson told us this is a known bug and it has already implemented a fix that was scheduled for a full deployment this week. They also said the bug is not Pixel-specific, after some claimed that they could not reproduce it on Samsung devices, but fell short of specifying which manufacturers, models, or versions are vulnerable. ®