Nation-state actors and criminals likely exploited the PHP2SHELL vulnerability before its disclosure, according to Cloudflare CEO Matthew Prince. “These vulnerabilities, like the PHP vulnerabilities that were disclosed the other day, had been in the wild for years,” Prince said on the company’s third quarter earnings call. “We're going back through our logs looking for any evidence that hackers or nation-state actors or others had been using them in the past. I know that we're going to find examples of that.” That was just one of the warnings he offered on the call, among them that some of Cloudflare’s customers believe AI agents are “a bane to their business and want to keep them away.” To explain why, Prince hypothesized that he could use an agent to find him a restaurant to eat at after he finishes his day of investor relations duties. “It might go and scour the internet and look at 1,000 different restaurants' websites, pull down 1,000 different menus, and then I might choose to only go to one of those,” he said. “The problem is that 999 of those restaurants have now had a cost that is just been applied to them, but they are not getting any benefit.” The CEO admitted that web searches have always driven some low-value traffic but feels the volume of agentic activity – which Cloudflare has previously predicted will be one thousand times greater than clicks from humans – means the problem is now at a different scale. Prince also had bad news for Kubernetes aficionados, because he thinks containers might become another casualty of the agentic age. The CEO allowed that containers are “a significant improvement over bare metal or even virtual machines,” and said they fueled the growth of hyperscale clouds and mobile applications. But he thinks containers are already cooked. “The container-based architecture of the hyperscalers and neoclouds just can't keep up in a cost-effective way with the new agentic paradigms of today,” he argued, again citing the 1000:1 ratio of bot:human traffic Cloudflare expects to see online any year now. That’s a Cloudflare-centric view, because Prince pitched the company’s serverless “Workers” service as an alternative to containers. The company also offers products that can either block agents, ameliorate the cost and traffic impacts of agentic activity, or allow organizations to monetize traffic generated by AI. Prince said demand for those products is growing fast, claiming that since July 1st, “approximately five percent” of the web opted in to Cloudflare’s content protection products. The CEO said Meta is already a customer, and said Zuck’s new “Muse” agents will benefit Cloudflare by creating more agentic traffic that third parties want to tame. He also pointed to year-on-year revenue growth of 39 percent, which saw quarterly revenue reach a record $782.5 million. And he thinks there are better days ahead, due to the terrible state of security. “It may seem like the sky is falling with the number of new security vulnerabilities that have been reported over the last few weeks,” Prince said. “I wish I could tell you we were through the worst, but we're not.” He thinks Cloudflare can profit from security misery because the extent of its activities and client base mean it is “among the first to receive quiet disclosure of new vulnerabilities” and remediates them before disclosure. Investors thought this all made sense, and in after-hours trading sent Cloudflare shares up by around 15 percent, meaning it recovered and then improved on losses that it incurred earlier after major US indices dropped around four percent as investors who worry tech stocks are overvalued. ®

Over 22.6 million exposed instances are potentially affected by the critical PHP flaws that have been targeted for over a week.

The post PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress appeared first on SecurityWeek.

The flaws could lead to arbitrary code execution, authorization bypasses, and privilege escalation.

The post Adobe, Veeam, Juniper Networks Patch Critical Vulnerabilities appeared first on SecurityWeek.

Volt Typhoon, a China-government backed hacking group that has infiltrated America’s critical infrastructure networks for years, has consistently built and dismantled ephemeral malicious infrastructure to burrow into hundreds of sensitive systems undetected, Lumen Technologies’ Black Lotus Labs said in a Wednesday report.

The covert access operation that researchers call “Silent Train” isn’t a standalone network, but rather a series of compromised small office home office (SOHO) routers, internet of things (IoT) devices and enterprise infrastructure that Volt Typhoon has rapidly rotated through since late 2023. 

The Chinese threat group has used this chain of short-lived compromised infrastructure to exploit additional vulnerabilities, including zero-days, in network edge devices and gain deeper, persistent access into victim networks, researchers said. 

“Individual chains are assembled and dismantled every day, with infrastructure continually refreshed,” Michael Horka, principal information security engineer at Black Lotus Labs, told CyberScoop. “Volt Typhoon demonstrated a repeatable capability to rebuild a new chain with different infrastructure in less than two minutes, making the number of nodes at any one moment effectively close to zero.”

Black Lotus Labs has notified hundreds of victims since it first identified Silent Train activity, including telecom providers, government entities, defense contractors, communication services, universities and IT firms. Other victims spanning critical infrastructure include organizations in the water, energy, transportation, maritime, rail, aviation and emergency services sectors.

“The ephemeral nature of the framework means our observations should not be interpreted as a complete census of Volt Typhoon activity,” said Horka, who also was the lead researcher on the report.

The nation-state group’s investment in operational security and preserving access is remarkable, according to Black Lotus Labs.

“We observed infrastructure assembled in under two minutes, sessions averaging roughly four hours, extensive cleanup, compartmentalization and continued development of new access vectors,” Horka said. “That is considerable effort devoted not even to get into their end targets, but purely to making important operations difficult to discover and trace.”

Volt Typhoon relied more heavily on Silent Train after the FBI and Justice Department disrupted the KV Botnet in early 2024, researchers said. Earlier this year, U.S. and global authorities warned about a widespread shift in Chinese hacking groups’ use of covert networks riding on compromised common devices.

The reach of those efforts is extensive and ongoing. Volt Typhoon has exploited and abused more than 27 device classes in Silent Train operations, including edge devices, enterprise management tools, identity and access management systems, networking infrastructure and other technologies. 

“The diversity matters, but the discipline matters even more,” Horka said. “Specific device types were consistently reserved for particular positions in the chain. It operated less like a collection of randomly compromised devices and more like an organized inventory of capabilities.”

The threat group has successfully compromised devices and technologies from Fortinet, Cisco, ManageEngine, Ivanti, F5, Check Point, Palo Alto Networks, ServiceNow, TP-Link, Netgear and ArcGIS, researchers said. Black Lotus Labs also observed confirmed zero-day campaigns targeting Versa Director, N-Able N-Central, Cisco Catalyst SD-WAN and VeloCloud Orchestrator. 

“The exploitation patterns, victimology, and geographic targeting observed throughout our investigation point to a sustained focus on communications, defense, government, and critical infrastructure environments of enduring strategic value,” Black Lotus Labs researchers wrote in the report. “Through repeated targeting of centralized management platforms and control-plane technologies, Silent Train shows how Volt Typhoon systematically pursues and preserves access to some of the most consequential networks in the United States.”

Silent Train’s ephemerality and operational discipline means it can’t be measured in size. These attributes also make it “fundamentally difficult to disrupt because there isn’t one network to take down,” Horka said. 

“What exists today will be completely different tomorrow,” he added. “You can try to remove individual pieces, but removing the actor’s ability to continuously rebuild them is a much harder problem to solve.”

The post Researchers uncover Volt Typhoon’s covert, ephemeral network appeared first on CyberScoop.

LEGAL BRIEF By Max Stul Oppenheimer, Esq. On August 26, Meta and the Attorneys General of 51 US states and territories filed a request that a federal district court judge approve the settlement of a complaint. The settlement proposal is 130 pages long (although 53 of them are signature pages for all the parties and […]

Internet governance bodies are likely to accelerate work to prepare the domain name system (DNS) so it can remain secure once quantum computers can challenge conventional encryption. John Crain, ICANN’s chief technology officer, last week told The Register that he is aware of efforts within the organization, and at other internet governance bodies, to consider what happens once commercially available quantum computers become capable of easily deciphering encrypted information. Those machines theoretically pose a risk to DNSSEC, the Domain Name System Security Extensions that adapt PKI to the job of verifying the veracity of DNS records. The CTO said he’s aware of predictions that such computers could come online “at the turn of the decade” and that he has therefore changed his view of when the DNS needs to be made quantum safe. “If you asked me years ago, I would have said we probably need to be ready in ten years,” Crain said. “Now, maybe it's less than that. I don't know if it's three years or five, but it's probably not ten”. One way to quantum-proof DNSSEC is to use larger keys that even a quantum computer will struggle to crack. Doing so, however, runs into message size limits in the DNS. “If we go for larger key sizes, that means larger zones, larger packets, larger responses,” Crain said. It can also mean traffic being carried by multiple TCP packets, instead of the single UDP messages DNS prefers. Crain said ICANN, the IETF, and other internet governance bodies are aware of this challenge and have begun preliminary work to address it. “Being prepared to go from UDP to TCP is going to take a few years,” he told The Register at ICANN’s annual meeting in Bali last week. “We're probably a few years away from being able to deploy in a predictable manner.” The internet community has, however, seen that the problem is becoming more acute. “We're going to ramp up the speed of development,” Crain said. Internet registry reform nears At ICANN’s Bali conference, The Register also met Jia-Rong Low, in his capacity as chair of the Number Resource Organization, the peak body for the world’s five regional internet registries (RIRs), AFRINIC, APNIC, ARIN, LACNIC, and RIPE NCC. The topic of that conversation was Internet Coordination Policy 2 (ICP-2), the document that governs RIRs. In its current form, ICP-2 describes the formation of a new RIR but no other part of its operations. After strife at AFRINIC raised the possibility of the African registry failing, the NRO decided to update ICP-2 so it covered the entire lifecycle of an RIR, from formation through to possible derecognition. Work on ICP-2 has moved through several rounds of public consultation. It has reached the status of a recommended draft. Low told The Register work on the document has proven “very challenging” to develop entirely with remote work. Last week’s ICANN meeting, he said, offered a venue for in-person collaboration that he hopes will result in work accelerating. The revised document defines four stages in the life of an RIR: recognition, audit, emergency continuity operations, and derecognition. The last three are additions to ICP-2 and give ICANN a major role as an independent overseer of RIRs. Low is hopeful a final document will be ready for review by the end of 2026, and ready for implementation not long afterwards. Scammers target trustworthy-sounding domains like .bank or .pharmacy Phisherfolk and other scammy scum strive to register authoritative-sounding domains as part of their efforts to trick victims. ICANN defines some global top level domains (GTLDs) as “Category 1” strings, because they pertain to regulated sectors – such as .bank, .doctor, and .university – or are felt to need special safeguards because like .sucks they create the potential for bullying. In a session at the ICANN meeting, Siôn Lloyd, ICANN’s principal security, stability and resiliency scientist, said the organization has investigated whether certain top level domains attract more abuse. He found that Category 1 GTLDs are more likely to be targeted by DNS abusers and therefore have a 45 percent higher chance of abuse than other domains. Happily, Category 1 domains are also less likely to have high abuse volumes. ICANN is currently working on a policy (PDP1) that will require domain registrars to take extra action against owners of domains that facilitate abuse, and another (PDP2) that will regulate automated domain registration. More GTLDs, more often? The Register heard plenty of chat at the meeting about ICANN’s new round of applications for GTLDs, which seems to be progressing well. Across various panels and sessions, we also heard references to ICANN’s past statements that new GTLD application rounds should be more frequent and take place at a predictable cadence, along with some suggestions that this round of applications is the template for future rounds. ®

Britain is threatening subsea cable saboteurs with up to 14 years in prison and unlimited fines, having apparently decided that Victorian-era laws aren't quite up to the job of keeping Russian submarines away from critical infrastructure. The government on Thursday set out plans to overhaul legislation dating back to 1885 and introduce tougher penalties for damaging the underwater cables and pipelines that keep Britain's internet and energy supplies running. According to Whitehall, subsea cables carry around 99 percent of the UK's international data traffic, while underwater pipelines account for 74 percent of its gas supply. Yet much of this infrastructure is protected by laws written when the telegraph was cutting-edge technology. The Submarine Telegraph Act 1885 originally imposed a £100 maximum fine for damaging a cable through culpable negligence. That might have been a reasonable deterrent back then, but it's unlikely to give today's would-be saboteurs much pause. Under the proposals, those who intentionally damage critical subsea energy or telecoms infrastructure could face up to 14 years behind bars. The proposals also set tougher penalties, including unlimited fines, for reckless or negligent damage. Subsea telecoms operators would face new legal duties to identify and manage security risks, while ministers would gain powers to direct companies and cable repair providers to take action where necessary and proportionate to protect national security. The government also wants to regulate fiber-optic sensing technology, which uses subsea cables to detect activity at sea but could pose a security risk if sensitive data falls into hostile hands. Unsurprisingly, Russia features prominently in Whitehall's thinking. In April, British forces exposed a covert Russian submarine operation near critical undersea infrastructure. The operation reportedly involved an attack submarine acting as a decoy while two specialist vessels surveyed Britain's cable routes. "The threats we face have changed dramatically, with suspicious Russian activity around critical undersea infrastructure, yet some of the laws protecting these vital connections date back more than a century," said telecoms minister Ian Murray. The plans aren't entirely new. In May, the government announced its intention to toughen penalties and introduce security obligations for cable operators. Thursday's White Paper spells out the proposed penalties and how far ministers could go in directing operators to act. It also follows warnings from Parliament's Joint Committee on the National Security Strategy, which concluded last year that Britain was insufficiently prepared for a coordinated attack on its subsea infrastructure. MPs and peers warned that government assessments focused too heavily on individual cable failures, rather than what might happen if attackers simultaneously targeted connections to Europe and across the Atlantic. Russian submarines aren't responsible for every severed cable. Fishing boats and ships dragging their anchors do most of the damage, accounting for up to 97 percent of faults, according to previous government estimates. And even when sabotage is suspected, catching those responsible is another matter. Britain already has laws allowing life sentences for serious acts of state-backed sabotage, but they're not much use if nobody can prove who did it. That's rather difficult when the crime scene is at the bottom of the sea. And it might prove equally difficult to extradite suspects from enemy nation states. None of this is law yet. The government has opened a 12-week consultation on the plans, after which ministers will decide how to proceed. Whether the threat of a lengthy prison sentence will trouble Russian submariners is debatable. Even so, after 140 years, Britain's subsea cable laws are finally getting dragged out of the Victorian era. ®

ISSUE 23.42 • 2026-10-19 PUBLIC DEFENDER By Brian Livingston It’s now clearer than ever that the algorithms used by social-media apps such as Facebook and Instagram are harming young people and adults. As San Diego State University psychology professor Jean Twenge recently wrote, “five times more 10- to 14-year-old girls were admitted to the ER […]

ICANN has started testing authentication schemes that will allow law enforcement agencies to make urgent requests for non-public WHOIS information – when needed to address threats to life, critical infrastructure, or child exploitation. Domain registrars collect information about their customers and in the past that data was publicly available in WHOIS records. Some domain registrars offer services that substitute their own contact details, to preserve customer privacy. In recent years, laws like GDPR mean registrars are sometimes required to hide WHOIS data. That’s fair enough but makes it hard for law enforcement to contact a domain holder if their resources are being misused – intentionally or otherwise – for purposes such as hosting malware, acting as command-and-control infrastructure for malware, or facilitating phishing. ICANN’s definition for the kind of behaviour it thinks justifies urgent requests for WHOIS info is “imminent threat to life, of serious bodily injury, to critical infrastructure, or of child exploitation.” The org has convened an Input Group on Law Enforcement Agency Authentication Mechanisms to consider the issue, and that group yesterday explained its progress during ICANN’s annual meeting in Bali, Indonesia. At this point, readers may have concerns that this proposal could allow law enforcement authorities to make inappropriate requests for WHOIS information. Several factors may ease such concerns. One is that representatives of domain registrars Namecheap and Verisign spoke during the session about the proposal, and both were supportive. Another is that the Input Group’s work is largely technical. Once it devises a mechanism to allow requests, other groups within ICANN dedicated to policy will work out acceptable use and related issues. This is the way internet governance gets done! Specialists work on their own bits of a problem and then collaborate to create a robust system that works at a technical level, is practical, and enforceable in multiple jurisdictions. How they’ll do it At this point, ICANN’s preferred approach is to use Security Assertion Markup Language (SAML) so that authenticated users at law enforcement agencies can log into the governance org’s Registration Data Request Service (RDRS) and file requests to access non-public WHOIS info. ICANN is already testing this approach with the FBI and Interpol but is open to other authentication mechanisms to allow other agencies access RDRS. The Input Group’s aim is to publish a spec those agencies can conform to. ICANN will pass requests filed in RDRS to whichever registrar sold the domain. The registrar will have 24 hours to consider the request – or up to 72 hours for complex queries. Registrars will also be able to deny requests if they feel the query does not meet the urgency threshold. Register readers might worry that a colossal agency like the FBI could flood RDRS with requests from thousands of individual agents, swamping domain registries. ICANN’s plan is to avoid that by requiring law enforcement agencies to nominate certain personnel who are permitted to make requests, and to enforce that permission using a token shared during SAML handshakes. The content of that token is the kind of policy question that the Input Group expects others at ICANN to finalize later. Another issue under consideration is how to protect the identity of law enforcement workers who make RDRS requests, as ICANN feels they could become targets of harassment (or worse) if their requests to see WHOIS data include email addresses. ®

Successful exploitation of some of these issues could lead to remote code execution and full device takeover.

The post F5, Juniper Networks Patch Critical Vulnerabilities appeared first on SecurityWeek.

The company says it’s aware of limited exploitation against customers’ firewalls, and it has made IoCs available.

The post Palo Alto Networks Patches PAN-OS Zero-Day Exploited for Remote Code Execution appeared first on SecurityWeek.

IonQ announced Monday that it will acquire Elisity, a zero-trust network security firm, in an all-stock transaction valued at up to $1.3 billion that folds enterprise access control into the quantum computing company’s expanding cybersecurity business.

Elisity, founded in 2019, sells a software policy layer that governs which users, devices, workloads and AI agents can communicate across a network, independent of the underlying network technology. The California-based company reports more than 100 global deployments and says revenue and customer counts have doubled year over year, with no churn among deployed customers.

Maryland-based IonQ, whose core business is quantum computing, has been building a security arm around post-quantum cryptography and quantum key distribution, technologies intended to replace or supplement encryption that future quantum computers may be able to break. 

The combination addresses what the companies describe as a two-front problem: conventional attacks that operate at machine speed, and the risk that encrypted data could be retained until quantum decryption becomes practical, a concept known as “harvest now, decrypt later.”

“Our customers need to contain attacks today, put AI to work safely, and prepare for quantum risk,” Elisity CEO James Winebrenner wrote in a blog post announcing the deal. 

IonQ Chairman and CEO Niccolo de Masi struck a more urgent note in a release announcing the deal: “Q-Day is coming much faster than predicted,” he said, referencing the point at which quantum computers could break current encryption technology. 

Both governments and the technology industry have accelerated their timelines to adopt post-quantum cryptography over the past few years. This is partly due to a belief among executives in the U.S. quantum sector that Chinese scientists and labs have achieved breakthroughs across several different fields of quantum computing over the past two years.

The Trump administration recently issued an executive order directing federal agencies to boost the domestic quantum industry and move up internal timelines for migrating to PQC encryption from 2035 to 2030. Google, a potential industry bellwether, and other companies have opted to move their own migration timelines to 2029.

Winebrenner told CyberScoop those deadlines are easier to set than to meet. Enterprises will hace to start with identifying the information and operations that need protecting, then mapping the identities, communications and cryptographic dependencies that support them.

“You won’t replace every legacy system at once,” he said. The approach is to migrate what can be migrated, test interoperability and operational impact, and tightly control access around systems that need more time. Segmentation helps contain threats, he added, but does not replace the cryptographic upgrades.

Elisity’s planned role in that transition is to connect identity data to cryptographic decision-making. Its roadmap would extend its IdentityGraph product with cryptographic inventory and risk information, allowing customers to rank post-quantum upgrades by business risk.

The deal also reflects how AI agents are reshaping network security. Elisity’s platform already treats AI agents and other non-human identities as subjects of access policy, and the company has joined the Open Secure AI Alliance with priorities that include least-privilege rules for sanctioned agents, containment of agentic threats and control of unsanctioned AI.

Winebrenner identified the hardest unresolved problem in agent control as maintaining trustworthy identity and authorization as an agent’s task, tools and delegated permissions change. “Knowing an agent is approved is only the beginning,” he said. “You need to understand whose authority it is exercising, what it needs to reach right now and when that access should end.” His prescription is least privilege down to the task: “An AI agent should have access only to the resources its task requires, including when it interacts with older infrastructure.”

The deal is expected to close in the fourth quarter of 2026, subject to regulatory approval.

UPDATE: 10/12/2026, 4:25 p.m.: This story has been updated with comments from Elisity CEO James Winebrenner.

The post IonQ to buy zero-trust security firm Elisity in deal valued at up to $1.3 billion appeared first on CyberScoop.

Citrix took most of the weekend to confirm that attackers were actively exploiting the newest round of NetScaler zero-days, leaving network defenders and threat hunters to react without official confirmation. 

Yet, behind the scenes, multiple CERTs, advisory firms, insurance providers, researchers and chatty security professionals warned their respective peers and communities of a live and serious threat. 

Nearly two days after the first unconfirmed rumors, Citrix published a security advisory Sunday disclosing the exploited zero-days, CVE-2026-88771 and CVE-2026-88772, releasing patches for them and six additional defects.

By then, criticism was at a fever pitch, and for some NetScaler customers the warning came too late. 

“The information vacuum was most striking. Customers were receiving warnings through unofficial channels while Citrix remained publicly silent,” Ben Harris, founder and CEO at watchTowr, told CyberScoop. 

“Customers were left without communication, guidance, or even acknowledgement that the vulnerability that was rumored to exist was real. Citrix could have warned customers that active exploitation was occurring and provided immediate defensive guidance without disclosing technical details that would help attackers,” he added. 

“When active exploitation is underway, hours matter,” Harris said.

Citrix did not directly answer questions about the lengthy communication delay. 

“We recently identified critical vulnerabilities in Citrix NetScaler ADC and Citrix NetScaler Gateway that led us to immediately develop and release a new version of the software that addresses the issues,” the company said in a prepared statement.

The critical defects are both rated 9.5 on the CVSS scale and allow attackers to achieve remote code execution. 

Researchers are particularly concerned about CVE-2026-88771, a command-injection vulnerability that affects all NetScaler appliances in a default configuration. That gives attackers a broad pool of targets and a better chance at successful exploitation. A proof-of-concept exploit for the vulnerability is also publicly available. 

Palo Alto Networks said it identified more than 50,000 publicly exposed instances of Citrix NetScaler devices potentially vulnerable to both of the zero-days as of Sunday. 

The earliest known exploitation attempt occurred Sept. 24 when GreyNoise said it observed an unsuccessful exploitation attempt against a Citrix NetScaler Gateway under its control for malicious activity scanning purposes. But researchers warn that exploitation likely started before then.

Citrix did not say how many customers have been compromised thus far and researchers are still assessing the fallout.

Citrix said it is making generic indicators of compromise available to customers in their user consoles, and the company referred to previously issued guidance for customers who suspect compromise. 

Attribution for the attacks is also still under investigation, yet NetScaler products are a common, recurring target for financially-motivated cybercriminals and state-sponsored espionage groups. 

The Cybersecurity and Infrastructure Security Agency issued an alert Sunday after Citrix publicly confirmed the attacks on its customers, and added CVE-2026-88771 and CVE-2026-88772 to its known exploited vulnerabilities catalog. The vendor has appeared on the agency’s list of vulnerabilities known to be exploited five times this year, and a total of 26 times since late 2021.

Security leaders across the industry — including Charles Carmakal, chief technology officer at Mandiant Consulting, and Wendi Whitmore, chief security intelligence officer at Palo Alto Networks — also sprung into action Sunday, with direct warnings on LinkedIn about the urgent threat. 

The information vacuum that persisted through most of the weekend put cybersecurity professionals in sometimes unique positions. Joe Toomey, vice president of underwriting security at insurance provider Coalition, said the company notified potentially vulnerable customers with limited official data and no confirmation from CISA or Citrix.

In a LinkedIn post Sunday, he called Citrix “unconscionably irresponsible” for remaining silent for more than 36 hours after word began circulating about in-the-wild exploitation.

“I fully understand a vendor embargoing specific details about a vulnerability when a patch has not yet been published, but once the vuln is exploited in the wild, some of those rules no longer apply,” Toomey wrote.

Citrix and its customers are in familiar territory. The vendor’s products have been widely targeted in previous attack sprees, often involving zero-day exploits and some infamously referred to as CitrixBleed and CitrixBleed 2.

“Citrix has a history of delaying the publication of vulnerabilities, even when they’re being exploited in the wild and affecting customers. Citrix eventually released patches and an advisory, but an adequate response also requires timely, clear communication,” Harris said. 

“Customers shouldn’t have to rely on unofficial warnings, security researchers, and third parties to learn that critical infrastructure may already be compromised,” he added. “This latest incident raises serious questions about whether Citrix has learned from previous crises and meaningfully improved how it protects and informs customers.”

The post Citrix patches actively exploited NetScaler zero-days after a weekend of unofficial warnings appeared first on CyberScoop.

The Trump administration rolled out a six-month test program in Texas on Monday that will draw on volunteer expertise and technology from cyber and artificial intelligence companies to protect the water sector.

“Project Watershed 250” is the first of the state-based, industry-centric pilot projects to cross the finish line that the Office of the National Cyber Director has previewed since the publication of its national cybersecurity strategy earlier this year. Water systems have long been viewed as among the most vulnerable and neediest critical infrastructure sectors, and in recent months the sector has been the victim of a spree of attacks.

“Project Watershed 250 is a commitment from the states, industry and federal government that we will continue to prioritize our nation’s safety and deliver on America-first policies for the American people,” National Cyber Director Sean Cairncross said at a rollout event in San Antonio Monday.

“U.S. companies are providing world-class cyber capabilities, red teaming that tests utilities’ current defenses, system hardening using the latest private sector cyber tools and AI tooling that helps utilities’ frontier cyber defenders to protect Texas water systems and scale proven solutions across the country,” he said. “This six-month pilot program is designed to make our water and wastewater critical infrastructure more resilient and resistant to cyber attacks by proactively finding and fixing system weaknesses.”

The pilot program, featuring collaboration between federal and state governments, stands in contrast to how the Biden administration tried to tackle the issue, with audit requirements that some GOP states challenged in court, forcing Biden’s Environmental Protection Agency to withdraw its rule.

“For too long, at least on the federal level, the government has admired the problem of cybersecurity in water systems,” Cairncross said. “We are going to find out what works. We’re going to target that, and we are going to scale off of this and learn lessons.”

A dozen companies — Parsons, Microsoft, Fortinet, Google Cloud, Palo Alto Networks, Amazon Web Services, Reflection AI, Cloudflare, Zscaler, Forescout, Abnormal AI and Dragos — appeared at the rollout Monday to praise the initiative and tout their contributions to it.

Not everyone praised the initiative elsewhere, however. One cyber professional who works on water security issues, speaking on condition of anonymity, said the program was “all smoke” and that “there’s no real money behind it.”

“The White House did what it always does — reached out to industry with their hands out asking for industry to pay for things the government should be doing, at least in part,” the person said.

Texas Gov. Greg Abbott said the program would be overseen by Cairncross’s office and Texas Cyber Command, which was established just last year. Abbott cited the need for the program by mentioning “an Iranian-backed cyberattack” on 30 water systems across 12 states and a 2024 attack on the water system in Muleshoe, Texas, suspected to be the work of Russian hackers.

“The need for cyber resilience is overwhelming,” Abbott said. “Many rural providers simply don’t have the resources they need to be able to protect themselves.”

Watershed 250 isn’t the only federal effort to bolster water cybersecurity, with lawmakers introducing legislation in the aftermath of the recent attacks. Past legislation that Congress has enacted also sought to tackle the problem.

Updated 8/31/26: with comment from cyber professional.

The post ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help appeared first on CyberScoop.

Unit 42’s top brass has seen enough from internal frontier AI model testing and malicious in-the-wild use of commercially available AI tools to be genuinely concerned.

“I can tell you without exaggeration that we believe that this is a generational shift in cybersecurity,” Sam Rubin, senior vice president of Palo Alto Networks’ threat intelligence arm, said in a media briefing Wednesday. 

A period of relative balance between security and exposure has been broken by frontier AI model capabilities that could allow attackers to find and exploit network weaknesses with speed, Rubin said.

Unit 42 warned that capabilities demonstrated by readily available agentic AI models, and those unlocked by frontier AI models that remain gated for defense, have shifted the balance of power from defenders to attackers.

“The defenses that we’ve had built up over years weren’t necessarily built for or prepared for these machine-speed attacks,” Rubin said. “Organizations are ill-equipped to detect and to respond quickly in the face of these attacks.

Back in April, when Anthropic brought Palo Alto Networks and other major technology companies together to form Project Glasswing, an initiative to find and address security defects with its Mythos model, Unit 42 estimated the same capabilities would be in the hands of attackers within a year. 

“Well, here we are five months later, and we’re starting to see the early waves of this threat in the wild,” Rubin said. 

Unit 42 is actively investigating an attack on one of its customers where an attacker used an agentic framework to exploit 50 applications and other weaknesses across the enterprise in less than 10 hours. Rubin estimates AI allowed the attacker to accomplish in 10 hours what would have taken at least 10 days in a pre-AI era. 

Attackers are already using AI across the entire attack chain, said Sherrod DeGrippo, vice president of threat intelligence at Unit 42. “We are not far from fully agentic attacks across all at once, but right now it’s piece by piece by piece,” she said. 

“AI has seeped into every part of what threat actors do,” including malware development at scale, delegation, social engineering and ransomware negotiations, DeGrippo added.

As such, she sees the threat landscape shifting in four areas. AI is a force multiplier, identity is the primary compromise vector, attackers are burrowing into foundational libraries and software supply chains “baked into the fabric of our digital world,” and nation-sponsored threat groups are learning more about points of weakness in enterprise systems, DeGrippo said.

Nobody is fully prepared for what’s coming and it would be naive or a bad defender mindset to think otherwise, she said. “This is a transformative period, and how organizations navigate that transformation is going to be make-or-break for a lot of them.”

The post Unit 42 warns AI has shifted balance of power from defenders to attackers appeared first on CyberScoop.

ON SECURITY By Susan Bradley OpenAI’s recent attack on another company’s cloud instances reminds me that sometimes we forget the basics. As we understand the situation at the moment, OpenAI’s test platform was meant to be isolated and not connected to the Internet. But because it needed to download certain items, it was given read-only […]

As AI-enabled hacking becomes a bigger threat for cybersecurity and national security, public attention has focused on mainly a few leading frontier AI companies developing more powerful large language models.

These models, and the billions of dollars behind them matter, but they’re only part of a larger shift. Enterprises are now building their own technology platforms that take these general-purpose LLMs and turn them into bespoke cybersecurity tools.

Industry professionals refer to these tools as a “harness.” They control the model’s behavior, limit its risks, and connect it to internal IT systems and networks so it can work reliably at scale.

New research from Cato Networks shared exclusively with CyberScoop shows how much power can come from a harness. It paired OpenAI’s ChatGPT 5.5 and GPT 5.5-Cyber models with its own tool and tested the abilities of the agent to hack into a victim network with as little human direction as possible.

Across six different scenarios, the pairing achieved complete end-to-end attack chains, including domain administrator privileges and Active Directory access, sometimes in as little as 40 minutes.

“What was most surprising is that first we saw that it was capable of doing accelerated reasoning and attack, and interacting and doing all this by itself, like doing all of the stages of the attacks,” said Guy Waizel, a tech evangelist at Cato Networks and one of the authors behind the research.

Critically, the most successful scenarios happened when the model was given appropriate operational context from the technical harness developed by Cato Networks.

“It does support that it’s not just about the frontier model,” said Waizel. “We found that [our harness] really helps the reasoning” of the LLM.

The agent was given some – but not abundant – resources to complete its tasks, including an external Kali Linux attack host, the simulated target’s public IP address and a set of low-level domain credentials acquired through phishing.

It was not provided with any other details, and had to probe further for key information, such as further knowledge of the server type (Microsoft Exchange), the target’s operating system, version, build number, internal network topology, access to higher privilege accounts and other critical assets, nor was agent given any predetermined attack paths.

The Cato Networks research uses OpenAI models, but only as an example. Waizel said he believes other models would likely achieve similar results. In any event, if current trends hold, the kind of capabilities provided by LLMs like GPT 5.5 are likely to be open-source within a year.

Cato Networks is far from alone. Most enterprises have their own AI harnesses, and  executives tell CyberScoop they are playing an increasing role in more effectively steering the frontier model workflows.

While AI tools can struggle to duplicate human workflows in other areas, LLMs have long shown potential in cybersecurity and coding, improving greatly over the past few years. The Trump administration has set up a new federal clearinghouse for exchanging information between the public and private sectors on AI-discovered vulnerabilities, while European groups are setting up their own organizations to coordinate globally on AI cyber threats.

Eric Doerr, chief product officer at Tenable, told CyberScoop a harness used in the company called “Hexa”  offers a defensive advantage:  it can work with different commercial LLMs while delivering consistent  results.

“One of the first things we do when we get a [new] model is say ‘Well, let’s run it through Hexa and see what we learn,’” said Doerr. “We have a whole bunch of benchmarks. Is it the same, is it better? Where is it better? Where is it worse?”

Hexa is meant to ensure that whichever model or models become dominant, Tenable will be able to integrate it into their tech stack and protect their most sensitive assets from unintended behaviors. That frees up the LLM to do what it does best: find vulnerable code and establish attacker pathways for exploiting them.

“For years, it has been true that there are way more potential issues that a company has to deal with: code vulnerabilities, things that are unpatched, misconfigurations,” said Doerr. “There’s way more than you can actually remediate, and you really need to understand the difference between what’s a theoretical problem and a real problem.”

Dan Rapp, chief AI and data officer at Proofpoint, said their harness, “Satori,” has become a critical tool for keeping their agentic AI on track while giving humans the ability to step in when things go awry.

“I think what you’re seeing in the foundation of frontier models is you have raw intelligence, raw reasoning power, but to get these systems to perform the way you want to, both context engineering – the content provided ensuring that its accurate and relevant – and the harness engineering are essential to actually get the systems to perform well,” Rapp told CyberScoop.

That was a common theme in interviews with companies. While frontier models come and go, or are overtaken by international competitors, there will always be the need for the model to operate with data and context that often only the organization can provide.  

It suggests that while policymakers and cybersecurity experts have focused on the spread of newer and more powerful frontier models, industry – and likely soon the cybercriminal underground — has quickly developed the kind of technical infrastructure that is becoming far more important to AI cyber defensive and offensive tasks.

“We’ve had to bootstrap quite a few of these systems from first principles, and what it always boils down to is how effective you are with the tool calling… bringing in data, enriching the context,” said John Hopper, vice president of product engineering at SpecterOps.

The post Forget the model. When it comes to cybersecurity, it’s all about the harness appeared first on CyberScoop.

A Brazilian tech firm that specializes in protecting networks from distributed denial-of-service (DDoS) attacks has been enabling a botnet responsible for an extended campaign of massive DDoS attacks against other network operators in Brazil, KrebsOnSecurity has learned. The firm’s chief executive says the malicious activity resulted from a security breach and was likely the work of a competitor trying to tarnish his company’s public image.

For the past several years, security experts have tracked a series of massive DDoS attacks originating from Brazil and solely targeting Brazilian ISPs. Until recently, it was less than clear who or what was behind these digital sieges. That changed earlier this month when a trusted source who asked to remain anonymous shared a curious file archive that was exposed in an open directory online.

The exposed archive contained several Portuguese-language malicious programs written in Python. It also included the private SSH authentication keys belonging to the CEO of Huge Networks, a Brazilian ISP that primarily offers DDoS protection to other Brazilian network operators.

Founded in Miami, Fla. in 2014, Huge Networks’s operations are centered in Brazil. The company originated from protecting game servers against DDoS attacks and evolved into an ISP-focused DDoS mitigation provider. It does not appear in any public abuse complaints and is not associated with any known DDoS-for-hire services.

Nevertheless, the exposed archive shows that a Brazil-based threat actor maintained root access to Huge Networks infrastructure and built a powerful DDoS botnet by routinely mass-scanning the Internet for insecure Internet routers and unmanaged domain name system (DNS) servers on the Web that could be enlisted in attacks.

DNS is what allows Internet users to reach websites by typing familiar domain names instead of the associated IP addresses. Ideally, DNS servers only provide answers to machines within a trusted domain. But so-called “DNS reflection” attacks rely on DNS servers that are (mis)configured to accept queries from anywhere on the Web. Attackers can send spoofed DNS queries to these servers so that the request appears to come from the target’s network. That way, when the DNS servers respond, they reply to the spoofed (targeted) address.

By taking advantage of an extension to the DNS protocol that enables large DNS messages, botmasters can dramatically boost the size and impact of a reflection attack — crafting DNS queries so that the responses are much bigger than the requests. For example, an attacker could compose a DNS request of less than 100 bytes, prompting a response that is 60-70 times as large. This amplification effect is especially pronounced when the perpetrators can query many DNS servers with these spoofed requests from tens of thousands of compromised devices simultaneously.

The exposed file archive includes a command-line history showing exactly how this attacker built and maintained a powerful botnet by scouring the Internet for TP-Link Archer AX21 routers. Specifically, the botnet seeks out TP-Link devices that remain vulnerable to CVE-2023-1389, an unauthenticated command injection vulnerability that was patched back in April 2023.

Malicious domains in the exposed Python attack scripts included DNS lookups for hikylover[.]st, and c.loyaltyservices[.]lol, both domains that have been flagged in the past year as control servers for an Internet of Things (IoT) botnet powered by a Mirai malware variant.

The leaked archive shows the botmaster coordinated their scanning from a Digital Ocean server that has been flagged for abusive activity hundreds of times in the past year. The Python scripts invoke multiple Internet addresses assigned to Huge Networks that were used to identify targets and execute DDoS campaigns. The attacks were strictly limited to Brazilian IP address ranges, and the scripts show that each selected IP address prefix was attacked for 10-60 seconds with four parallel processes per host before the botnet moved on to the next target.

The archive also shows these malicious Python scripts relied on private SSH keys belonging to Huge Networks’s CEO, Erick Nascimento. Reached for comment about the files, Mr. Nascimento said he did not write the attack programs and that he didn’t realize the extent of the DDoS campaigns until contacted by KrebsOnSecurity.

“We received and notified many Tier 1 upstreams regarding very very large DDoS attacks against small ISPs,” Nascimento said. “We didn’t dig deep enough at the time, and what you sent makes that clear.”

Nascimento said the unauthorized activity is likely related to a digital intrusion first detected in January 2026 that compromised two of the company’s development servers, as well as his personal SSH keys. But he said there’s no evidence those keys were used after January.

“We notified the team in writing the same day, wiped the boxes, and rotated keys,” Nascimento said, sharing a screenshot of a January 11 notification from Digital Ocean. “All documented internally.”

Mr. Nascimento said Huge Networks has since engaged a third-party network forensics firm to investigate further.

“Our working assessment so far is that this all started with a single internal compromise — one pivot point that gave the attacker downstream access to some resources, including a legacy personal droplet of mine,” he wrote.

“The compromise happened through a bastion/jump server that several people had access to,” Nascimento continued. “Digital Ocean flagged the droplet on January 11 — compromised due to a leaked SSH key, in their wording — I was traveling at the time and addressed it on return. That droplet was deprecated and destroyed, and it was never part of Huge Networks infrastructure.”

The malicious software that powers the botnet of TP-Link devices used in the DDoS attacks on Brazilian ISPs is based on Mirai, a malware strain that made its public debut in September 2016 by launching a then record-smashing DDoS attack that kept this website offline for four days. In January 2017, KrebsOnSecurity identified the Mirai authors as the co-owners of a DDoS mitigation firm that was using the botnet to attack gaming servers and scare up new clients.

In May 2025, KrebsOnSecurity was hit by another Mirai-based DDoS that Google called the largest attack it had ever mitigated. That report implicated a 20-something Brazilian man who was running a DDoS mitigation company as well as several DDoS-for-hire services that have since been seized by the FBI.

Nascimento flatly denied being involved in DDoS attacks against Brazilian operators to generate business for his company’s services.

“We don’t run DDoS attacks against Brazilian operators to sell protection,” Nascimento wrote in response to questions. “Our sales model is mostly inbound and through channel integrator, distributors, partners — not active prospecting based on market incidents. The targets in the scripts you received are small regional providers, the vast majority of which are neither in our customer base nor in our commercial pipeline — a fact verifiable through public sources like QRator.”

Nascimento maintains he has “strong evidence stored on the blockchain” that this was all done by a competitor. As for who that competitor might be, the CEO wouldn’t say.

“I would love to share this with you, but it could not be published as it would lose the surprise factor against my dishonest competitor,” he explained. “Coincidentally or not, your contact happened a week before an important event – ​​one that this competitor has NEVER participated in (and it’s a traditional event in the sector). And this year, they will be participating. Strange, isn’t it?”

Strange indeed.

A hacktivist group with links to Iran’s intelligence agencies is claiming responsibility for a data-wiping attack against Stryker, a global medical technology company based in Michigan. News reports out of Ireland, Stryker’s largest hub outside of the United States, said the company sent home more than 5,000 workers there today. Meanwhile, a voicemail message at Stryker’s main U.S. headquarters says the company is currently experiencing a building emergency.

Based in Kalamazoo, Michigan, Stryker [NYSE:SYK] is a medical and surgical equipment maker that reported $25 billion in global sales last year. In a lengthy statement posted to Telegram, a hacktivist group known as Handala (a.k.a. Handala Hack Team) claimed that Stryker’s offices in 79 countries have been forced to shut down after the group erased data from more than 200,000 systems, servers and mobile devices.

“All the acquired data is now in the hands of the free people of the world, ready to be used for the true advancement of humanity and the exposure of injustice and corruption,” a portion of the Handala statement reads.

The group said the wiper attack was in retaliation for a Feb. 28 missile strike that hit an Iranian school and killed at least 175 people, most of them children. The New York Times reports today that an ongoing military investigation has determined the United States is responsible for the deadly Tomahawk missile strike.

Handala was one of several hacker groups recently profiled by Palo Alto Networks, which links it to Iran’s Ministry of Intelligence and Security (MOIS). Palo Alto says Handala surfaced in late 2023 and is assessed as one of several online personas maintained by Void Manticore, a MOIS-affiliated actor.

Stryker’s website says the company has 56,000 employees in 61 countries. A phone call placed Wednesday morning to the media line at Stryker’s Michigan headquarters sent this author to a voicemail message that stated, “We are currently experiencing a building emergency. Please try your call again later.”

A report Wednesday morning from the Irish Examiner said Stryker staff are now communicating via WhatsApp for any updates on when they can return to work. The story quoted an unnamed employee saying anything connected to the network is down, and that “anyone with Microsoft Outlook on their personal phones had their devices wiped.”

“Multiple sources have said that systems in the Cork headquarters have been ‘shut down’ and that Stryker devices held by employees have been wiped out,” the Examiner reported. “The login pages coming up on these devices have been defaced with the Handala logo.”

Wiper attacks usually involve malicious software designed to overwrite any existing data on infected devices. But a trusted source with knowledge of the attack who spoke on condition of anonymity told KrebsOnSecurity the perpetrators in this case appear to have used a Microsoft service called Microsoft Intune to issue a ‘remote wipe’ command against all connected devices.

Intune is a cloud-based solution built for IT teams to enforce security and data compliance policies, and it provides a single, web-based administrative console to monitor and control devices regardless of location. The Intune connection is supported by this Reddit discussion on the Stryker outage, where several users who claimed to be Stryker employees said they were told to uninstall Intune urgently.

Palo Alto says Handala’s hack-and-leak activity is primarily focused on Israel, with occasional targeting outside that scope when it serves a specific agenda. The security firm said Handala also has taken credit for recent attacks against fuel systems in Jordan and an Israeli energy exploration company.

“Recent observed activities are opportunistic and ‘quick and dirty,’ with a noticeable focus on supply-chain footholds (e.g., IT/service providers) to reach downstream victims, followed by ‘proof’ posts to amplify credibility and intimidate targets,” Palo Alto researchers wrote.

The Handala manifesto posted to Telegram referred to Stryker as a “Zionist-rooted corporation,” which may be a reference to the company’s 2019 acquisition of the Israeli company OrthoSpace.

Stryker is a major supplier of medical devices, and the ongoing attack is already affecting healthcare providers. One healthcare professional at a major university medical system in the United States told KrebsOnSecurity they are currently unable to order surgical supplies that they normally source through Stryker.

“This is a real-world supply chain attack,” the expert said, who asked to remain anonymous because they were not authorized to speak to the press. “Pretty much every hospital in the U.S. that performs surgeries uses their supplies.”

John Riggi, national advisor for the American Hospital Association (AHA), said the AHA is not aware of any supply-chain disruptions as of yet.

“We are aware of reports of the cyber attack against Stryker and are actively exchanging information with the hospital field and the federal government to understand the nature of the threat and assess any impact to hospital operations,” Riggi said in an email. “As of this time, we are not aware of any direct impacts or disruptions to U.S. hospitals as a result of this attack. That may change as hospitals evaluate services, technology and supply chain related to Stryker and if the duration of the attack extends.”

According to a March 11 memo from the state of Maryland’s Institute for Emergency Medical Services Systems, Stryker indicated that some of their computer systems have been impacted by a “global network disruption.” The memo indicates that in response to the attack, a number of hospitals have opted to disconnect from Stryker’s various online services, including LifeNet, which allows paramedics to transmit EKGs to emergency physicians so that heart attack patients can expedite their treatment when they arrive at the hospital.

“As a precaution, some hospitals have temporarily suspended their connection to Stryker systems, including LIFENET, while others have maintained the connection,” wrote Timothy Chizmar, the state’s EMS medical director. “The Maryland Medical Protocols for EMS requires ECG transmission for patients with acute coronary syndrome (or STEMI). However, if you are unable to transmit a 12 Lead ECG to a receiving hospital, you should initiate radio consultation and describe the findings on the ECG.”

This is a developing story. Updates will be noted with a timestamp.

Update, 2:54 p.m. ET: Added comment from Riggi and perspectives on this attack’s potential to turn into a supply-chain problem for the healthcare system.

Update, Mar. 12, 7:59 a.m. ET: Added information about the outage affecting Stryker’s online services.

John talked about how we’d attack, here’s how you can defend against those attacks. Grab the slides here: https://blackhillsinformationsecurity.shootproof.com/gallery/6843799/

The post PODCAST: Attack Tactics Part 2 appeared first on Black Hills Information Security, Inc..

💾