The Register

The former Defense Intelligence Agency (DIA) IT specialist previously accused of trying to pass secret and top-secret information to foreign spies has pleaded guilty following a successful FBI sting. Nathan Vilas Laatsch, then 28, and now 29, was arrested in May 2025 after an undercover FBI agent caught him for the second time transmitting intelligence packages in a public park that he believed would be collected by a foreign government’s spy. The man, who had been employed at the DIA as a civilian employee since 2019, held top-secret clearance, and in March 2025 offered to transmit classified information to an overseas administration. The identity of this country has never been revealed, but court documents [PDF] describe it as “a friendly foreign government.” Laatsch was assigned to the DIA’s Insider Threat Division in “spring 2025,” a unit dedicated to identifying government workers who were likely to leak, or already were leaking, classified information to foreign powers. According to the Justice Department, the FBI “became aware” of Laatsch’s offer in March. The man’s initial email, sent from a newly created account, had the subject line: “Outreach from USA Defense Intelligence Agency (DIA) Officer.” The email introduced Laatsch, his role at the DIA, and the service he was willing to provide. According to the complaint, Laatsch served in a technical role in support of the DIA's internal Officer of Security (SEC). Among other things, his duties included "enabling user activity monitoring on individuals with access to DIA systems, including individuals who are under investigation" and "assisting external partners, such as law enforcement, on the use of insider threat tools." “I am willing to share classified information that I have access to, which are completed intelligence products, some unprocessed intelligence, and other assorted classified documentation,” the email stated. The email included a picture of his government ID used to enter and exit his Washington, D.C. workplace, with name and image redacted, and a username associated with an encrypted messaging platform the recipient could use to continue the conversation. Soon after Laatsch’s email was intercepted, the FBI instigated an undercover operation to trick the IT bod into thinking that he was talking to a genuine spy. The feds’ efforts were not immediately successful. Agents replied on March 23, saying: “Good afternoon, I received your message and share your concerns. We are glad you reached out. I look forward to your response and learning more about your work.” Laatsch did not respond until April 14, after the FBI sent a follow-up via the original email address on April 4. Following additional conversations, in which Laatsch described what information he was offering to the "foreign spy," on April 28, 205, Laatsch entered his office and within 20 minutes began accessing classified information. Prosecutors said he spent much of the entire workday writing on a physical notepad while intermittently looking at his computer monitor, hiding the notebook when coworkers walked by. “The defendant wrote multiple pages of notes, which he then removed from the notepad at his desk and folded into squares,” court documents state. “At the end of his workday, the defendant bent under his desk, placed the folded papers into his socks, and departed the office.” Laatsch repeated the same behavior on April 29, and again on April 30, only this time placing the paper squares in the bottom of his lunchbox. The next day, the IT specialist followed FBI instructions on where to dead-drop the thumb drive - onto which he had transposed state secrets - in an Arlington, Virginia park. Although he believed he was leaving the device for a foreign spy to collect, the FBI instead gathered Laatsch’s deposit and found nine typed documents, eight of which contained information classified as top-secret and contained sensitive compartmented information. Court documents confirmed that the nature of the files Laatsch transmitted included sensitive methods of intelligence collection, intelligence related to foreign military exercises, and analysis of the impact of those military exercises. These were chosen entirely by Laatsch, who had not received a brief on what files to collect from the FBI. In exchanged messages, Laatsch stated he chose the files based on assumed interests. The device also contained a note from Laatsch personally. In it, he said he hoped the initial tranche of files would serve as proof of the type of information to which he had access. Laatsch, whom prosecutors described as an individual who had become disenfranchised with the current administration, also expressed his willingness to accept citizenship in the foreign nation. Further, he said he was “not opposed to other compensation,” but was not in need of financial or other kinds of material rewards. In the interim, Laatsch messaged the "spy" with additional details about how internal investigations are carried out at the DIA, the common “stupid mistakes” made by those under investigation, and that they “should not be too difficult” for him to avoid. The undercover FBI agent arranged a second intel drop for the following month, to which Laatsch agreed. According to the plea agreement, between May 15 and May 27, Laatsch would enter his workplace, log into his classified system, and spend most of the day transcribing classified information by hand into a notebook. He repeatedly folded up the pages and placed them in his socks before leaving at the end of the workday. The FBI arranged the second intel drop for May 29, 2025. It instructed Laatsch to instead head to a specific picnic table in the same Arlington park and electronically transfer the files from his personal computer while situated at the picnic table. Laatsch agreed, executed the transfer to the FBI-controlled address while sitting in the park, and was arrested on the spot. The man waived his right to an attorney and admitted to the offenses when questioned by FBI agents. “By his own admission, Laatsch betrayed his oath by offering classified information to a foreign government, the very thing he was supposed to prevent as an employee of DIA’s Insider Threat Division,” said Roman Rozhavsky, assistant director at the FBI’s Counterintelligence and Espionage Division. “Those entrusted with our nation’s most sensitive information must not exploit their access for personal gain - in this case offering to sell American secrets to buy foreign citizenship. The FBI and our partners will continue to hold accountable all those who betray the trust of the American people.” Laatsch’s plea agreement [PDF] recommends a sentence between 11 and 18 years, including time served, although the court is able to issue a maximum sentence that includes a life term and a $250,000 fine. ®

CISA is still crying out for software vendors to adopt Secure by Design (SBD) development practices, and says in its latest review that longstanding vulnerability classes are still the most exploited. The agency examined soft spots across 2024 and 2025, finding that the majority of those that receive CVEs and make it to the Known Exploited Vulnerability (KEV) catalog belong to decades-old flaws that should have been addressed by now. Injection-related vulnerabilities, such as cross-site scripting (XSS) (CWE-79), OS command injections (CWE-78), and SQL injections (CWE-89) were among the most common across both CVE and KEV records in 2024-2025, CISA said. These were joined by bugs introduced by vendors that didn’t properly mitigate against improper input validation (CWE-20) in their code – the single most-common weakness type across the KEV catalog and registered CVEs. “Threat actors continue to succeed, in part, because simple, preventable software weaknesses remain unaddressed,” CISA said in the review. “Resolving fundamental issues would eliminate a significant portion of today’s most common compromises.” Readers may remember two MITRE reports that have been frequently referred to and revisited since being published years ago. Findings from a 2007 edition examining what the organization called “unforgivable vulnerabilities,” and another in 2023 referring to “stubborn weaknesses,” continue to crop up regularly in modern data. CISA said that in 2024, seven of the 10 most frequent CWEs seen on the CVE list belong to MITRE’s “stubborn weaknesses.” Equally, seven of the 10 most frequent CWEs seen on the KEV catalog, comprising 41.5 percent of all bugs on that list, were also stubborn weaknesses. And three of the top five KEVs also stemmed from unfixed holes, a finding that CISA said demonstrates “how reliably these weaknesses translate into real-world exploitation.” For reference, these three were improper input validation (CWE-20), path traversal (CWE-22), and OS command injections (CWE-78). The data from 2025 follows a similar pattern, CISA said: seven of the top 10 CWES were still those considered “unforgivable” in 2007. “Three of today’s top 10 CWEs would have been considered ‘unforgivable’ nearly two decades ago,” it said. “Their persistence today illustrates that the problem is not technical complexity: it is organizational culture, developer workflows, and systemic gaps in Secure by Design adoption.” For those who can’t remember the paper published 19 years ago, unforgivable vulnerabilities are those that exist because of common, well-documented mistakes, have an “obvious” attack path, the exploit is simple, and attackers can locate the bug in minutes. The same findings can be found in CISA’s Risk and Vulnerability Assessments (RVAs), the no-cost penetration tests the agency carries out on real organizations to improve their security and gain a richer understanding of the broader US cyber landscape. The assessments across both 2024 showed that memory safety and improper input validation vulnerabilities are the most reliable paths to exploitation, accounting for 16.7 percent of KEV entries in 2025. Injection vulnerabilities are also commonly seen in registered CVEs, although these are less commonly exploited in the real-world, especially against cyber-mature organizations. To tackle this pervasive issue, CISA is once again recommending organizations adopt SBD practices, eliminating the stubborn vulnerability classes that continue to support cyberattacks, decades after they were deemed too much of a lingering threat. It ultimately comes down to vendors helping defenders to shoulder less of the security burden. Instead of releasing patch packages that continue to swell to record sizes, just build the software responsibly in the first place. In CISA’s view, this means “owning security outcomes” for customers, killing off the so-called stubborn and unforgivable weaknesses, and improving the automation of configurations, monitoring, and updates. Software buyers should only choose vendors that meet these requirements, and ensure they have software bills of materials (SBOMs) in place to track supply chain risk. “Organizations must shift from reacting to threat actors to fixing the fundamental flaws those actors are known to exploit,” said CISA. “Stronger cybersecurity begins with software that is secure by design. “It requires prioritization of vulnerabilities and collaboration across industry and government. Finally, it demands leadership attention to understand cyber risk as a business risk, a national security threat, and an impediment to operational resilience.” ®

OpenAI has gathered more than 100 of the world's biggest tech and infosec companies to warn that cyber defense is in trouble - a reassuring development given quite a few of them helped build the technology involved. The open letter has more than 100 names attached to it, including many of the companies with the most to gain – or lose – from what happens next. OpenAI, Anthropic, Google and Microsoft are among the AI builders warning about increasingly capable AI attacks, while security heavyweights including Cloudflare, CrowdStrike, Fortinet, and Palo Alto Networks have also signed on. AWS, IBM, Oracle and Cisco are there too, alongside banks, consultancies and other companies whose businesses depend on keeping an increasingly messy technology stack running. Together, they have reached a troubling conclusion: the current approach to cybersecurity isn't working. "We have a limited window to strengthen cyber defenses," the letter warns, predicting that AI-enabled attacks will become "far more widespread and sophisticated" in the coming months as models become more capable. Hospitals, water treatment plants and internet infrastructure are singled out as being at risk. It's an interesting warning given who's making it. Some of the signatories are racing to build ever more capable AI systems, while others make billions selling the cloud services, enterprise software and security tools that are supposed to keep attackers at bay. Still, the underlying problem is real enough. The letter points to old vulnerabilities, unpatched software, misconfigurations and weak authentication as problems that have been piling up for years, particularly across critical infrastructure where security teams are often short on money and staff. Their proposed solution is, inevitably, more AI. The letter calls for cyber-capable models to be put into the hands of more defenders, with cheaper models handling security work at scale and frontier systems reserved for harder problems. Security vendors should continuously test their defenses against frontier AI capabilities, share threat intelligence and help critical infrastructure operators deploy AI-powered defenses. Governments, meanwhile, are asked to fund cybersecurity for essential services, expand trusted-access programs and give hospitals, water utilities and local governments access to capable defensive AI. Companies developing frontier models have their own homework assignment. They should provide "responsible model access, significant funding, training, and hands-on support," particularly to under-resourced critical infrastructure operators, while investing in testing, vulnerability disclosure and tools that make AI agents traceable. What the letter doesn't include is any figure for that "significant funding," or any deadlines or firm commitments from the companies signing it. For now, they're being asked to bring the "full weight of their technology, resources, and expertise" to the problem. It's quite a message from a group that includes some of the biggest names in cloud, enterprise software, and cybersecurity. When more than 100 companies agree that "status quo security won't be enough," it's worth remembering that many of them have been selling that status quo for years. There is some urgency behind all this. AI agents have already been shown finding and exploiting vulnerabilities on their own, while AI-generated exploit code has started turning up in attacks against critical infrastructure. As the models improve, the fear is that those capabilities become cheaper and available to a lot more attackers. That's the "defenders' window" the signatories want to seize: use AI to shore up defenses before the offensive side gets much easier. So, after years of selling organizations cloud services, security software and, more recently, AI, the industry has settled on a fix for the looming AI security problem: better cybersecurity, more resources and more AI. Who will pay for it remains rather less clear. ®

Nothing smarts like a paper cut, but being attacked after leaving an application’s web interface exposed to the internet might be just as painful. Such attacks are the risk to which users of PaperCut print management software find themselves exposed today, after the company revealed a university’s security teams alerted it to an attack. The company analyzed info provided by the university and found a vulnerability in its PaperCut NG and PaperCut MF products, which manage access to printers, track use, and enable printing from myriad client devices. “We are aware of confirmed customer incidents and are treating this matter with the highest priority,” states an urgent security advisory issued on Thursday. Unusually, the advisory is silent on the nature of the flaw and the risk it poses. It looks like the web interface to the company’s products enables access deeper into a user’s networks, because among the indicators of compromise are altered log files, plus alerts from intrusion detection software, endpoint security tools, and network monitoring packages. The company has cooked up an emergency patch but warns it is not an official release. “We have not gone through our usual release process,” states an FAQ. “This is an emergency patch for customers with public-facing PaperCut servers who are unable to take other mitigating action.” Thankfully, those other actions aren’t hard to take: users need to get their PaperCut servers’ web interfaces off the public internet, by allowing access only from trusted internal IP addresses. Fashioning a potent and rapid response to a zero-day attack is never easy. Communicating the nature of the problem can be even harder, as discussing the nature of a flaw invites more attackers to take a shot at a stricken product. PaperCut says it’s working on a better fix and will advise users once it lands. For now, the company is asking customers to apply its wonky patch or take their servers offline ASAP. The Register fancies most users will go for the latter fix, as aside from the issue of finding a change window in which to apply a patch, running unvalidated emergency software is not an appetizing approach. ®

The Australian city of Perth is by some measures the world’s most isolated major metropolis, but is still sufficiently connected to US law enforcement authorities that the FBI was able to help Australia’s Federal Police (AFP) to find two men they believe were the masterminds of TeamPCP, a cybercrime crew that conducted prominent supply chain attacks. According to the AFP, two men aged 21 and 23 arrested on Wednesday “were principal participants in the activities of the cybercrime syndicate and received payments in cryptocurrency for their roles in the illegal activity.” An FBI Facebook post names one of the arrested men as Ruben Thomson and describes him as “the alleged leader of the cybercriminal group TeamPCP.” Australian media named the second man as 23-year-old Louis Michael Gaebler. Investigations into the pair started in April 2026, after Australian authorities and the FBI “received information from multiple cyber threat assessment companies regarding a syndicate that allegedly inserted malicious code into software available on an open-source repository, which was then unwittingly used by other developers.” Researchers detected some of those activities before April: In March, we reported that researchers spotted a supply chain attack on the open source scanner Trivy. Another of TeamPCP’s attacks was the Shai-Hulud worm, which attacks npm packages, tries to infect them and goes looking for credentials to major public clouds or services like GitHub. If the worm burrowed into its targets, it would either try to replicate to continue its attacks, or wipe the environment out of spite. The AFP’s “We cuffed ‘em!” announcement estimates that TeamPCP’s supply chain attacks “potentially compromised more than 1000 organisations globally, enabling the theft of more than 500,000 credentials, and the exfiltration of at least 300 gigabytes of data.” Australia’s Feds estimate “the financial impact includes global remediation costs estimated to be hundreds of millions of dollars.” As is often the case in such matters, the arrested men were found with electronic devices and other items which authorities seized. “A large volume of data seized is being forensically examined and the investigation remains ongoing,” the AFP wrote, adding “Further arrests and charges have not been ruled out.” Indeed, the Feds note that they arrested the two at different locations in the suburbs of Perth and searched a third property nearby. ® Bootnote: Perth is considered the site of the original “Black Swan” event, as swans there – and across much of Australia – are black. Early European explorers who explored Australia's west coast were astounded when they saw the black birds, as the “fact” that all swans are white was at the time a metaphor for the existence of absolute truths.

CRPx0, a cybercrime crew that has rapidly evolved from a scam service to a ClickFix-delivered ransomware and crypto-theft business over the summer, claims its victim count jumped from fewer than 10 in June to 48 organizations on its clear-web leak site at the time of publication. Keep in mind: criminals aren’t always the most trustworthy bunch, so take their claims with a healthy dose of salt. Still, the ransomware biz’s expanding operations, unique payload, and white-label hacking service make it one to watch, and a few recent analyses provide tips for defenders to keep the crooks out of their IT environments. Rakesh Krishnan, a threat-intel analyst who writes about cybercrime investigations on TheRavenFile blog, was one of the first researchers to publish details about CRPx0 at the beginning of the month, including previously unreleased malware samples. The operators offer a hacking service, providing “complete database extraction” from victim organizations and “optional public leak coordination upon request.” This platform also advertises full network compromise, “from initial access, through lateral movement, to full domain compromise,” plus persistent access across the victim’s infrastructure. A second, white-label, ransomware-as-a-service platform makes it really easy for wannabe crooks to get into the data-theft and extortion biz. CRPx0 builds, deploys, and configures everything from command-and-control infrastructure to the negotiation panel and malware, allowing its criminal customers to bring their own brand identity to their operations - and originally offered these services for a $10,000 one-time fee. At first, the operators promised to allow affiliates to keep 100 percent of their profits - this is unheard of in ransomware-as-a-service operations. This has since shifted to a 70-30 model, with affiliates receiving 70 percent of the extortion payments (after a one-time $333 enrollment fee) and the remaining 30 percent going to the operators. CRPx0 rules prohibit affiliates from infecting Commonwealth of Independent States (CIS) member countries and organizations based in these countries. This is a pretty common rule among Russia-based ransomware operations, and in an earlier interview with The Register, Recorded Future threat intelligence analyst Allan Liska called it the “first rule of ransomware club: you don't attack organizations in the Commonwealth of Independent States.” The gang also prefers Monero (XMR) payments, rather than Bitcoin (BTC). ClickFix ransomware delivery Affiliates can also customize their own ClickFix payload delivery. The operators offer two lures, a fake Windows Update and a fake Google reCAPTCHA, to socially engineer victims into executing the initial command, according to a Ransom-ISAC research team analysis published on Thursday. The Windows lure tricks a victim into pasting a PowerShell command into the Run dialog. This drops a DLL stager chain and ultimately deploys Python-based ransomware. The macOS lure, however, uses a curl|bash command that downloads portable Python and the ransomware directly. The lures and the rest of CRPx0’s malware run on Windows and macOS, and according to the researchers, there are four payload formats: “the two HTML lures plus a standalone DLL and a standalone EXE, both of which discard the social engineering step entirely.” All four deliver the same ransomware: a 1,769-line Python script that steals high-value files before encrypting them with AES-128-CBC (Fernet). The malware moves laterally via WMI/schtasks, and delivers a ransom note that gives victims a 48-hour deadline to pay up - or see their files leaked. 'Complete, professional offensive control center' On August 23, the CRPx0 operators published a v3.0 update note on the group’s clearnet leak site, promising “a complete, professional offensive control center for managing compromised remote machines from a single web dashboard.” It provides crims with tools to steal valuable files, credentials, and wallet recovery phrases and keys, while “watching stolen cryptocurrency wallet addresses flow in.” This service also provides scripts to run remote commands, and the control panel sets up “automated attack reactions that fire on their own when something valuable happens on a target.” As the operators note: “Everything is built to be operated by a human with no technical background: point-and-click panels, plain-language rules, and clear status indicators. The underlying attack engine is hidden behind a clean, dark-themed interface.” CRPx0’s hacking and ransomware services, enabling everything from crypto theft to encryptors and full network compromise, “could be a strategic move to attract new recruits, or a scam targeting a range of affiliate hopefuls seeking cybercrime services,” according to an August 12 analysis from Jade Brown, a threat researcher at Bitdefender. What defenders should do Still, “other threat actors may attempt to adopt similar techniques,” she warns. “This is a reminder that organizations should balance detection capabilities in preparation for different types of compromises, configuring technologies to detect and block malicious behavior that aligns with both crypto theft and encryption processes.” The Ransomware-ISAC team says defenders should prioritize five actions, in this order. “The first three cost nothing and blunt the entire ClickFix class of attack, not just CRPx0,” they note. First: remove the Run dialog for standard users - this will entirely block the Windows path. For macOS users: restrict Terminal via MDM for non-technical staff. Next, the threat-intel analysts advise defenders to alert on RunMRU writes containing powershell, curl or long base64 strings. “Every ClickFix victim leaves a trace at HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU,” they wrote. “This is the highest-fidelity ClickFix detection available and it is trivial to deploy.” The team also lists adversary network indicators and suggests blocking those. Make sure to hunt for indicators and malicious behavior in the pre-encryption exfiltration window. “Data leaves before a single file is encrypted, so .crpx0 extensions and ransom notes are a post-mortem indicator, not a warning,” according to the Ransomware-ISAC. Finally, confirm backups are unreachable from the account that would be compromised, and treat anything reachable with the victim's credentials as destroyed. ®

PWNED Welcome back to PWNED, the weekly column where we explore the frightening and amusing world of foolish infosec errors. This week, it's all about a test site that exposed real information. Have a story about someone leaving a gaping hole in their network? Share it with us at pwned@sitpub.com. Anonymity is available upon request. Our story comes courtesy of Mia Morin, Editor & AI Quality Analyst at Intimeros, a site that rates, reviews, and evaluates AI companions – yes, that means boyfriends and girlfriends, as well as other kinds of pals. The trouble started during a redesign when one of Morin’s colleagues was working on a test version of the site. The test site was supposed to be password-protected, but the colleague turned off the protection so they could show a client what they were working on. Password protection remained disabled for three weeks without anyone noticing. Then, one day, Morin noticed that the test site had been indexed by Google. Apparently, nobody thought to use a robots.txt file to exclude this beta-level domain from search. While the site was publicly accessible without password protection, anyone could see unpublished reviews, prices, and private product notes about the different AI companion services. That’s because the test site was connected to a real live version of the production database. This was all editorial content, so no user data was exposed. However, it could have allowed competitors to see everything that Intimeros was working on and to deduce their entire editorial strategy. After she noticed what was wrong, Morin took swift action to protect the test site from prying eyes. “We restored password protection, blocked search engines from indexing the draft pages and changed all the system access keys,” Morin said. “Now, we secure every test site just like our official website and run weekly automated scans to catch exposed pages.” What we can learn from this is kind of obvious. Never forget to lock down the test or staging versions of your websites. Make sure that they not only require logins, but also have tools in place to block search and AI crawling. Better still, place your staging site on a private server and require someone to use a VPN to get to it in the first place. ®

The controversial Omarchy distro is attracting both criticism and fans – and financial support, too. Omarchy is an opinionated respin of Arch Linux and a pet project of Ruby on Rails creator David Heinemeier Hansson, better known as DHH. Although the first release was as recent as June last year, this week sees the release of Omarchy 4.0.1 – a security fix for the mid-August Omarchy 4 “Quattro”. Although it started out just over a year ago, Omarchy now has a sibling project Omakub, which is based on Ubuntu, and an organization behind it called Omacom. A week ago, DHH announced the launch of the Omacom Foundation with $8 million. Its founding patrons include figures behind Shopify, Stripe, Dell, Block, Cloudflare, Sesame, and 37signals - closely followed by people behind Dropbox and OpenClaw, taking the total to $10 million. The project, like the man behind it, is controversial. But that means attention, and an “opinionated distro” gets opinionated reviews. Some of the criticism is strong stuff: for instance, Merchants of Insecurity, whose top line is: “First, a PSA: Do NOT use Omarchy if you care about security of your machine even a little bit.” Author “One Happy Fellow” is not the first: last year, a member of Framework's community forums posted Omarchy is not a secure distribution and should be taken off the Linux installation options. Others like it or give it a guarded thumbs up while saying it’s not for them. There really is no such thing as bad publicity. As P. T. Barnum put it: "Say anything you like about me, but spell my name right." DHH is no stranger to controversy. We suspect he doesn’t mind at all. The Register reported in late 2025 that Framework, known for its repairable laptops, was sponsoring Omarchy and Hyprland, and in turn, multiple people criticized Framework for sponsoring such controversial projects. That piece linked to some of the criticism of DHH, but he has been attracting criticism since at least 2014. We tried it, and it does work. It has a unique UI based on the Hyprland tiling compositor and a panel and menus provided in the new release by Quickshell. This is heavily keyboard-driven, but ignores almost all existing keyboard shortcuts and UI conventions from other OSes. There are no title bars, let alone close buttons or anything like that. No middle-click or right-click app menus. The jaded take of the Reg FOSS desk, who is a big fan and advocate of keyboard-driven UIs, is that such things usually reflect ignorance of existing user interface standards. We found it a bit clunky. We had to install an additional tool, hypermon, in order to be able to make our testbed machine’s second display useful. You can’t use established pacman commands to update it – you must use the custom omarchy update script, and when trying that in a VM, we hit a known bug. On hardware, it worked fine. It’s Arch, extensively preconfigured. Lots of apps are preinstalled, and the selection is surprising and not typical of a FOSS product. The selection includes Discord and WhatsApp for communications, Docker, Obsidian for note-taking, Neovim as an editor, and OBS Studio for streaming. There are optional extras for using speech, automatic dictation via Voxtype, and other unusual features. There’s a terminal-based music player, cliamp. (We like the name of that one, and may keep it around.) There are, of course, options to add AI tools – one of the startup messages invites you to configure your preferred plastic pal who’s fun to be with LLM bot. It’s pretty big. A default install (not that there is any other kind) took 14 GB of disk space after the first update. It did install in a VM with a 16 GB virtual disk, but there wasn’t enough disk space to update the OS. It uses about 1.5 GB of memory at idle. It’s not lightweight, but then, Omarchy definitely comes with batteries included, as well as (to quote a friend’s old email signature) “bells and whistles, plus a couple of gongs. Don’t forget the horns, the custard pies and the water-powered whirling knives.” If you don’t know your way around existing environments or distros, want something fashionable and snazzy looking, and are willing and happy to jump in and learn, then this is an interesting new option. You may not agree with the politics and views behind it, but you must be able to either tolerate them – or ignore them. It works, it’s quite fast, it looks striking, and it does the job. If you just want something clean, fast, pretty, and with tiling by default, personally, we’d suggest Pop!_OS instead. ®

The Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) said it’s responding to a “major” cybersecurity incident shortly after the Qilin ransomware gang posted the US federal law enforcement agency on its leak site. According to ATF's statement, the intrusion affected a standalone system that operated separately from its enterprise network. “There is no indication that the incident has affected the ATF enterprise network, the ATF eForms system, or any other ATF system,” the statement said. ATF, which is housed under the US Department of Justice, said it’s “coordinating closely” with the DOJ to investigate the breach, and “immediately” blocked connections to the affected IT environment upon discovering the incident. The statement said the security breach had not affected ATF’s operations and noted that senior Justice Department officials designated the compromise as a “major incident” under federal guidelines. Shortly before ATF posted its security-incident notice on its website, Russia-linked Qilin ransomware criminals listed the firearms agency on its leak site. The post, seen by The Register and shared on social media, did not say what data Qilin claimed to have stolen, how much, or provide samples to substantiate the claim. ATF did not immediately respond to our questions, and we will update this story when we receive a response. Qilin, the notorious crew behind the 2024 attack on pathology provider Synnovis that disrupted NHS services in the UK, was one of the most prolific ransomware gangs in July, according to Comparitech. The firm, which reviews cybersecurity products and provides data analysis, counted 799 ransomware incidents last month, up from 668 in June. Qilin claimed 125 of those.®

Schrödinger's Cat, the famous 1935 thought experiment, imagines a cat that, for reasons rooted in quantum physics we need not dwell on here, is simultaneously alive and dead. In a landscape of relentless cyberattacks and mounting infrastructural complexity, a routine backup task can appear finished, with every box ticked and every check made. The job is not actually done, however, until it has been verified as fully ready for recovery in the event of cyber disaster. A task that looks sorted can turn out, under scrutiny, to be anything but. A backup can be logged as 'complete' once data has been copied to storage, but a recoverable workload is another matter entirely. It means that when a business goes down, its workloads can be restored to their state at the point of attack with nothing lost. By the time you realize you are on the wrong side of that ambiguity, it may be too late: your data is in the hands of the bad guys, or destroyed, and this time the cat really is dead. This is not a problem to which IT bosses and managed service provider (MSP) management are entirely oblivious. Most organizations recognize to some degree that their backup may not be 100 percent watertight. Cybersecurity management specialist Kaseya recently partnered with 1105 Media to survey 200 IT professionals about the realities shaping cyber resilience planning. Some 53 percent were no more than 'somewhat confident' in their organization's ability to fully recover from a ransomware attack, and admitted their backups were supported by no better than 'limited testing'. A significant proportion had even less faith in their recovery capabilities, while only 15 percent were 'very confident' they could get back on track with no loss. Verify and survive Understanding what a verified backup means, and what role verification plays in the recovery challenge weighing on so many IT leaders, is where any sensible resilience plan begins. Backups are vital but they do not guarantee recovery on their own. What matters is confirming that a backup job will hold up in a disaster. Verification is the process of proving that backed-up data is complete, uncorrupted, and fully restorable in an emergency, offering evidence that recovery is possible during a critical outage, hardware failure or ransomware attack. It is essential whether you run an IT department or an MSP responsible for client protection: unless you can prove clients are protected, there is every chance they are not. "Backup isn't done and entrustable until you've gone in and made sure that the application actually works and can be brought back to the recovery environment," explains Brent Torre, GM of cyber resilience at Kaseya. "Historically, it's just taken too much time and resource for a lot of people to even attempt that. And where they have been verifying, they haven't been doing it regularly enough to ensure real protection." Not all approaches to verification are of equal value. IT departments still relying on intermittent manual verification are operating on blind trust: warnings thrown up by the process can be misread, failures overlooked, and the result is a dangerous mix of false negatives that waste time and false positives that expose the organization to real risk. Manual screenshot verification is a proven way to squander a security budget , tying up highly qualified staff on needless work and pulling their expertise away from where it is genuinely needed. Nobody wants seasoned engineers spending hours reviewing screenshots, second-guessing outputs and trying to determine whether a backup worked. Where static verification methods once had a place, today's complex IT ecosystems have made them redundant. Across an estate spanning in-house systems, SaaS and cloud endpoints, basic verification cannot cope, picking up only surface-level signals and lacking the design to operate at scale. At scale, the inefficiencies of manual verification multiply and response times slow to a crawl. A minor inefficiency can quietly become a serious bottleneck without anyone noticing, and legacy methods can create the illusion that everything is working perfectly while catastrophe waits around the corner. As Torre points out, light-touch checking is unlikely to satisfy the ever-increasing regulatory burden around recovery and resilience. "Some compliance frameworks explicitly state that you must test recovery on a frequent basis," he says. "It's becoming more important than ever that organisations are able to do that." Let AI handle the heat The emerging gold standard is AI-powered screenshot verification, which replaces the best-efforts manual checking of overstretched human teams. It works by automatically booting up virtualized backups, capturing a screenshot and analyzing the image to confirm the backup ran correctly. Where rigid, rule-based checks fall short, context-aware visual AI combined with OCR accurately identifies login screens, dashboards and maintenance states, and evaluates every element with precision. The result is 99.9 percent verification accuracy and sharply reduced false positives, alongside far greater confidence in every backup. This is welcome news for IT managers facing budget shortfalls and a drought of experienced talent, and it is what MSPs need as they try to make the economics of recovery stack up. Remove the manual effort and the constant checking of false alarms, and the gains mount quickly. Human teams are free for higher-value work, SLA confidence rises, customer trust improves, and environments can scale without ballooning overheads. AI-powered verification is no longer a maybe for today's MSPs; it is the only route forward that makes sense on the P&L. The good news is that AI-powered screenshot verification does not require major up-front investment or deep internal expertise. Datto, the cybersecurity and data protection outfit owned by Kaseya, has built the latest verification technology directly into its business continuity and disaster recovery (BCDR) platform, so that deployment stays simple and disruption to existing workflows is minimal. This kind of AI-powered screenshot verification is designed to strip uncertainty out of the process and give IT teams confidence that backed-up data is complete and recoverable. The ideal solution does so at scale, and without adding complexity, by working within the workflows already in place. With Datto there is the further option of integrating remote monitoring and management (RMM) with the BCDR product, which enables proactive remediation through automated deployments, the merging of backup health with endpoint alerts, and virtual restores launched directly from a single management console. "It's key to have context and visibility into the backup estate through your RMM so you know that you are up to date on patching, on antivirus definitions and backups," says Torre. "With all of that integrated within the RMM solution, you have the ability to understand your risk profile across the fleet in terms of protection. You know in the event that something needs to be recovered. And you can start a backup-initiated recovery directly from the RMM platform." The gold standard to aim for, he concludes, is continuous validation and automated remediation, not the ability to look in now and again to see what is going on. The perfect verification solution , he adds, should be 'impossibly easy to use', requiring humans to exert zero cognitive effort on backup beyond deploying a new client and initiating a recovery. By giving yourself the means to distinguish between a completed backup job and a recoverable workload, you have set yourself apart from the kind of IT manager or MSP who only spots a problem after something has gone wrong. By deploying AI-powered verification, you stop treating backup as a probability and start treating it as a proof. You know what you have. Then when something goes wrong, and it will, that certainty is the only thing standing between a fast recovery and a very long night. MSPs looking to unify backup and security into a single resilience practice can start with the When Backup Meets Security in the MSP Stack whitepaper. Sponsored by Datto.

The company behind three of the UK’s busiest airports says “a quantity” of data was stolen during a recent “cybersecurity incident". Manchester Airports Group (MAG) operates Manchester Airport in the North West of England, Cambridgeshire’s Stansted Airport, and East Midlands Airport in Derbyshire. The affected data includes information collected as part of its car parking, lounge, and fast track bookings, as well as information collected as part of MAG's public Wi-Fi services. Email addresses, phone numbers, vehicle registrations, and postcodes are the data types currently known to be compromised. A spokesperson at MAG told The Register that the majority of the 8.7 million customers caught up in the breach only had their email addresses compromised. As is always the case, individuals will be affected in different ways. Not all of the data types will be compromised for all customers. The company, which recently celebrated a record 66 million passengers travelling through its airports in a year, said it “immediately contained the risk” and brought in external expertise to advise on next steps. “We have informed and are working with the relevant authorities,” said MAG in a statement. “At no point has passenger safety or aviation security been compromised.” It confirmed that none of its airports experienced operational disruption as part of the attack, and that the affected system does not store bank or payment details. However, “as a precautionary measure,” it temporarily revoked access to its Manage My Booking service. Customers who want to amend or cancel a booking due within 72 hours of the statement going live are being advised to contact customer services. “We would like to reassure customers that Manchester Airport Group takes the security of customer information extremely seriously and we apologise for any inconvenience or concern caused.” Affected customers have already been contacted, including a few Reg readers who kindly alerted us to the news. While MAG continues to investigate the incident, customers were advised to be extra vigilant to potential phishing attempts, and remain assured that there is no danger of visiting MAG’s airports as a result of the cyberattack. One Reg reader griped that in addition to being charged £80 for five days of parking at Stansted, receiving the email informing him that it had also allowed his personal data to be stolen via a cybersecurity breach added insult to injury. The Register asked MAG for additional information, but a spokesperson only responded with the same statement issued online. ®

The UK’s data protection watchdog has fined a nuisance call blocking biz £190,000 ($258,000) for bombarding elderly people with hundreds of thousands of - you guessed it - nuisance calls. Elderly Aids Ltd made 758,053 unsolicited direct marketing calls between May 27, 2024, and February 10, 2025, according to the Information Commissioner’s Office (ICO). On average, that works out as 2,916 calls per day. Busy fingers. The ICO and Telephone Preference Service (TPS), a UK service to register one’s phone number to exclude it from unwanted marketing calls, received 20 complaints during this timeframe related to Elderly Aids. It is illegal for direct marketers to call a number registered with the TPS, unless the individual has given explicit consent to that specific company to call them. All 758,053 unsolicited direct marketing calls, in this case, were made to phone numbers registered with the TPS and belonged to people who had not given their consent for Elderly Aids to contact them. Complainants commonly cited aggressive and misleading sales tactics, with callers also failing to identify themselves. One said their father was pressured into signing up to Elderly Aids’ services, which required a £139 ($188) sign-up fee, and a recurring monthly £6.99 ($9.50) payment on top of this. Andy Curry, head of investigations at the ICO, said: “Not only did this company target vulnerable people who had explicitly asked not to be called – they harassed them to sell call-blocking devices. “EAL showed a complete disregard for the law and the people they were hounding. This penalty should serve as a clear warning to any business that thinks the law does not apply to them - we will hold them to account for both exploiting people in this way and trying to avoid accountability.” Russell Roach, director of preference services at the Data & Marketing Association (DMA), concurred and encouraged responsible businesses to screen their calling lists against the TPS and Corporate TPS (CTPS) registers. “People register with the Telephone Preference Service because they want greater control over who can contact them,” he said. “Cases like this demonstrate why those protections are so important. “Anyone making live marketing calls must respect the choices people have made about their privacy. When organizations ignore those preferences and contact individuals who have explicitly opted out of receiving unsolicited sales calls, particularly those who are most vulnerable, they undermine consumer trust and risk causing significant nuisance and distress.” The ICO said Elderly Aids failed to engage with the regulator, ignoring requests for information, while continuing to make illegal marketing calls. According to public Companies House filings, the company attempted to strike itself off the register three months after it started pestering the elderly with its phone calls, although this was swiftly suspended following an objection. The ICO said that in cases where a debtor cannot pay a fine, such as those in “genuine financial hardship,” they provide payment plans. Organizations that can pay don’t face formal recovery action, and when directors attempt to skirt fines through insolvency, insolvency practitioners are called in, potentially kickstarting a multi-year recovery process. ®

The FBI on Wednesday said it disrupted a botnet and seized two platforms that Chinese-government cyberoperatives used to hack NASA, the US Senate, the Department of Energy, and several other government agencies and critical networks. The Federal Reserve, Department of Justice, Department of Health and Human Services, and the National Institutes of Health were also among those victimized by the two now-seized hacking tools: a vulnerability scanning and exploitation malware named QScan, and an obfuscation network named QTRouter. The FBI says a People’s Republic (PRC) of China-backed group called QTFY created and operated the two platforms, plus botnets of compromised IoT devices. The Bureau says QTFY’s hackers work for a private PRC company called Nanjing Xinjiuwei. “Payments from the PRC's Ministry of State Security (MSS) to Nanjing Xinjiuwei, for example, indicate that the company conducts malicious cyber activities on behalf of the PRC Government,” according to court documents. “QTFY actors include former members of the PRC's People's Liberation Army (PLA), and they use their PLA relationships to obtain contracts and subcontracts supporting offensive cyber operations,” the documents state. How to build a botnet QScan scans and automatically infects thousands of IoT devices worldwide, and then adds them to the QTRouter network of QTFY-controlled devices. The QTRouter botnet – consisting of these compromised IoT devices, plus commercial proxy service devices, and leased virtual private servers – then serves as an obfuscation network, allowing QTFY and other criminals who pay for the service to conceal the origin of their digital intrusion activities, making these communications appear to originate from local computers. On Monday, a US federal court granted seizure warrants for three domains linked to QTFY: qtproxy.xyz, qt-proxy.org, and qt-team.com. All three domains were hardcoded into both the QScan and QTRouter malware, and the court-authorized seizures made both hacking services inoperable, the Justice Department said. Hacking critical networks since 2018 (at least) The hacking services and malware have been in use since at least 2018, and as recently as this year when QTFY infrastructure compromised the US Senate, according to court documents. The FBI investigated an attempted computer intrusion at NASA in August 2019, during which the Chinese government snoops tried to exploit CVE-2019-11510, a critical vulnerability in Ivanti’s Pulse Secure VPN that allowed attackers to learn legitimate users' usernames and passwords, effectively granting them unauthorized access to protected networks. Ivanti patched the flaw in April 2019. As The Register previously reported, China also abused this bug as a zero-day to break into dozens of defense companies, government agencies, and financial organizations in America and abroad. QTFY later exploited this same CVE in 2020 during the COVID-19 pandemic to attack a medical center in Ohio, according to court documents. Other victims in 2019 and 2020 include unnamed financial groups in Michigan and South Korea, and a Missouri insurance agency. The insurance agency attack abused a different vulnerability: CVE-2019-19781, a critical flaw in Citrix VPN products that allowed arbitrary code execution with no account credentials. Years later, in 2024, QTFY hackers also broke into computers at three DOE National Laboratories, NIH, and a US security device manufacturer. “These entities were victims of a zero-day attack against Ivanti Cloud Services Appliance,” the court documents say. The FBI did not respond to The Register’s inquiries, including how many computers QTFY compromised, and whether the crew has ties to any of China’s "Typhoon" groups. PRC goon squad whac-a-mole This latest disruption follows a series of court-ordered seizures intended to hamstring China’s hacking activities over the last few years. In 2025, the FBI removed PlugX surveillance malware from more than 4,000 US computers that had been infected by the PRC-sponsored group Mustang Panda. A year earlier, in 2024, China’s Flax Typhoon burned down their own botnet consisting of hundreds of thousands of infected internet-of-things devices when confronted by the feds. And in late 2023, the FBI disrupted a botnet used by yet another Chinese government attack crew, Volt Typhoon, to attack US and foreign critical infrastructure. In June, however, Lumen’s Black Lotus Labs reported a “significant resurgence” of a botnet linked to Volt Typhoon, with this cluster of injected machines surging to 1,500 compromised routers and IoT devices.®

OpenAI has published its technical report detailing "the Hugging Face incident," the compromise of the eponymous LLM repository by unreleased, ill-supervised AI models. The incident, widely reported, has prompted concern among technical types, the public, and lawmakers about how automated software was able to escape containment and hack an external organization, and about what can be done to prevent similar incidents. OpenAI's explanation addresses what happened, but its call for keeping a closer watch on AI activities won't elicit much enthusiasm. "The incident occurred during cybersecurity evaluations of several OpenAI models, and was primarily driven by a highly capable, internal-only research model comparable in scale to GPT‑5.6 Sol," the company said in a blog post. "The models, operating under reduced safeguards, took actions that were misaligned with the goals of their assigned tasks – they communicated through unauthorized channels, exploited vulnerabilities in shared infrastructure, gained internet access, and accessed third-party systems." The incident became the subject of discussion at the Black Hat security conference and elsewhere. The basic storyline begins with a notionally sandboxed AI agent trying to solve an impossible task in ExploitGym, a security benchmark test. Unable to complete the challenge, the agent explored its environment to find ways to make progress toward its goal. It figured out that it could communicate with other AI agents by using Artifactory, an internal package management system, as a message board. The agents then collaborated with each other to cheat on various ExploitGym tasks. The machine learning models eventually identified a server-side request forgery (SSRF) zero-day vulnerability in Artifactory's code and used that to gain internet access. They subsequently found exposed Hugging Face credentials. The agents then used those credentials to find and chain several security exploits that gave them full code execution on several Hugging Face servers, all in the hope of finding information to solve the ExploitGym task. "Ultimately, agents powered either by the internal-only research model, or by GPT-5.6, executed code on 41 Hugging Face production dataset server workers, obtained root access on at least one production node, accessed Hugging Face production credentials and limited internal data, and downloaded four private Hugging Face code repositories," OpenAI's technical report [PDF] explains. The details are fascinating and troubling, more so because Anthropic's and Meta's models have also acted in ways that would constitute a crime if a human took the same actions. The ChatGPT-maker identified four misalignment patterns that made things go awry: "reward hacking, persistence on seemingly impossible tasks, unauthorized communication, and agents adopting goals from one another." OpenAI has already taken steps to shore up its security, which was relaxed for its model testing. The company says it's trying to improve security and monitoring to mitigate alignment issues like how models cheat, behave when given impossible tasks, and how alignment can be maintained while multiple agents work, including over long-duration tasks. But the central issue is not that machine learning software armed with tools and a task will try every possible option, even ones its programmers failed to consider. The problem, as OpenAI acknowledges, is that people don't watch over their AI agents at all times. "We are taking this incident as a 'warning shot' that today’s model capabilities present the possibility of loss-of-control incidents," the AI biz said. "Companies that build AI systems will need to ensure that their systems always remain under meaningful human control, and that meaningful safeguards constrain their ability to cause harm." Throughout the tech industry, companies like Anthropic, AWS, Google, OpenAI, Microsoft, and Salesforce talk about "autonomous agents." But agents are no longer autonomous under persistent, meaningful human control. ®

The US government disclosed that crims targeted more than 100 internet-exposed water systems during July cyberattacks. That's the first time the feds have put a number on the digital intrusions, but they have yet to attribute the campaign, widely suspected to be linked to Iran, to a particular group. “In July 2026, CISA observed malicious cyber activity targeting over 100 internet-exposed systems in the Water and Wastewater Systems (WWS) Sector, commonly via programmable logic controllers (PLCs) connected directly to a cellular modem,” America’s lead cyber-defense agency said, adding that connecting PLCs directly to the internet “can create significant security risks.” Suspected Iranian attackers targeted water and wastewater facilities across at least a dozen states in July, including internet-exposed PLCs. While neither federal nor state officials have identified all 12, we know that the cyberattacks occurred at mostly small, rural utilities in Minnesota, Michigan, Georgia, South Dakota, and New Jersey. “This is very serious. What stands out isn't any single incident. It's the scale,” Matt Hartman, chief strategy officer at the Merlin Group and CISA’s former acting head of cyber, told The Register. “More than 100 water systems with internet-exposed assets were hit in a single month, which points to a systemic vulnerability across the sector, not a run of isolated, unlucky targets,” Hartman said. “Much of this infrastructure runs on operational technology that was built for closed, physical environments. It was never designed with the assumption that it would be reachable from the open internet.” John Gallagher, VP at Viakoo, an OT and IoT cybersecurity provider, told us that while 100 systems represent a small fraction - only about 0.5 percent - of water utilities in the US, the “real threat is that these are test runs for a larger-scale attack.” While the 100-plus water incidents occurred in July, just last week five US federal agencies warned that attackers are using AI-generated exploitation scripts to break into internet-exposed Siemens S7 Series PLCs at water, manufacturing, energy, and other critical facilities. “This appears to be a continuation of the same suite of activity we suspect is affiliated with Iran targeting PLCs,” Halcyon Ransomware Research Center SVP Cynthia Kaiser told The Register a week ago. “Iran-affiliated actors and adversaries are actively targeting a wide swath of operational technology because these PLCs underpin essential health, safety, and critical infrastructure across society,” Kaiser, a former FBI cyber division deputy assistant director, added. While third-party analysts have largely blamed Iran for the intrusions, the federal government has not attributed the attacks to anyone. “Attribution in cyber incidents is inherently difficult and often takes time. Adversaries deliberately obscure their infrastructure, reuse tools and techniques, and route activity through compromised systems, so the government needs to be diligent before publicly assigning responsibility,” Hartman said. “In this case, CISA has done the most important thing: quickly getting actionable information into the hands of water-sector operators so they can defend their systems,” he added. “From a defender’s perspective, the ‘who’ matters less in the immediate term than understanding how the attacks are occurring and taking steps to stop them.” In its advisory, CISA recommended organizations disconnect PLCs from the internet and ensure any remote access goes through a VPN or gateway device rather than connecting directly to the PLC. The cyber-defense agency also advised owner-operators to enable password protection (we suggest multi-factor authentication) and change any default passwords. Also: ensure that allowlist IPs only allow remote access from known engineering laptops or other critical OT assets.®

Medical device maker Boston Scientific’s global operations have been disrupted by an ongoing cyberattack, the company disclosed on Wednesday. According to an SEC filing, the “cybersecurity incident” affecting its IT systems started on Tuesday, and resulted in a “global disruption to the company’s operations.” Upon detecting the digital intruders, the company began an investigation with third-party infosec experts who are working to contain the threat, the filing says. The medtech firm did not immediately respond to The Register’s inquiries, including if this was a ransomware infection and what data, if any, the criminals stole after breaking into the IT systems. “The incident has caused, and is expected to continue to cause, disruptions and limitations of access to certain of the company’s information systems and business applications that support aspects of the Company’s operations, including the ability to process and ship customer orders,” Boston Scientific reported to federal regulators. The company doesn’t have a timeline for full restoration, and noted the “full scope, nature and impacts, including operational and financial impacts” of the cyberattack remain unknown. The news did, however, send Boston Scientific shares spiraling down more than 4% on Wednesday morning. At press time, none of the usual suspects had claimed responsibility for the attack. In recent months, both ransomware/extortion gangs and government-backed hackers have disrupted other medtech firms’ operations and stolen sensitive data. In March, Stryker was hit by a cyber crew with ties to Iran's intelligence agency, causing a global network outage at the company. A month later, medical-device maker Medtronic disclosed a cyberattack in a filing with federal regulators. Notorious data-theft-and-extortion group ShinyHunters claimed to be behind this intrusion, and the company in July warned patients that their names, contact details, dates of birth, Social Security numbers, and health information was stolen in the breach. ®

Workwear and fashion retailer Carhartt’s data breach was about half as bad as ShinyHunters claimed, according to Troy Hunt, who reviewed the data dump before uploading it to his Have I Been Pwned website. Hunt’s HIBP service reported 12.9 million individuals affected by the alleged breach, around half of what ShinyHunters purported when it claimed to leak the company’s data earlier this month. ShinyHunters dumped what it said was 50GB worth of Carhartt’s data on August 13 after the retailer hired what the criminals called “a very unskilled and incompetent negotiator” to haggle the crooks down from their $3.3 million extortion demand. According to Hunt, ShinyHunters data was injected with millions of lines of synthetic data, substantially padding out the number of affected individuals. “You're not going to believe this, but turns out you can't always take criminals at their word,” said Hunt, before detailing the investigative process that goes into calculating the scale of breaches that make it to the HIBP site. Hunt usually starts with HIBP's open-source email address extractor, which spat out nearly 25 million addresses, before running it through OpenClaw to analyze the contents further and sift through the mass of information, looking for anomalies. For a retailer, the AI thought that the millions of .edu and .org email domains looked off - like signs of TPC-DS synthetic data injection. Examples included michael.ware@c.edu and michelle.larue@lkvb06fkzsjv.org. The first and last names look real, but a common finding among TPC-DS-generated data is that it will use completely random strings for domains. A manual look at the data points with which these email addresses were associated further revealed these "individuals" were located in countries, such as Benin, which don’t represent dominant Carhartt markets. Further, the AI found more customers registered in Montenegro than in the US, where Carhartt is headquartered. It also found a suspiciously large proportion of customers with birth dates set in the early 1900s – unlikely given the company’s clientele is more hipster-oriented than than blue-collar nowadays. Hacking away at all the clearly bogus data, OpenClaw dropped the estimated number of genuine individuals among the data trove from 24.8 million to 13.6 million. Hunt carried on eliminating suspicious findings he noticed, such as Microsoft 365 duplicate email addresses and addresses marked for deactivation, as well as prompting OpenClaw to continue doing the same. He finally arrived at 12,933,413 accounts believed to be genuine among the ShinyHunters-leaked dataset. That’s the number that made it to the HIBP platform, which states that 83 percent of these were already gathered up in previous breaches. The moral of the story is, as Hunt says, to “take headline numbers with a grain of salt unless you're confident in the processes of those making the claims." And until trustworthy sources do the arduous work, stop treating the word of cybercriminals as gospel. The real data contains names, email addresses, phone numbers, and physical addresses. Carhartt did not respond to our request for comment on Hunt’s findings. The company is yet to comment on the breach anywhere publicly. ®

In late July, Oracle released a mammoth security patch dump with 1,449 patches, in a perhaps unprecedented bad day for database admins. None of them, it turns out, would have prevented the credential theft on an Oracle database server described by security platform Huntress. “Even if it had been fully patched, everything working, it still would have happened,” said Craig Savage, cybersecurity lead at Oracle third-party support vendor Spinnaker Support, referring to the attack. In July, Huntress was alerted to credential theft activity, according to a post from the security company. The attack involved a "simple" SQL injection exploiting an unnamed organization's public-facing web app. Although SQL injections have a long history and are easy to avoid with good info-sec housekeeping, what happened next was more unusual. “After gaining initial access, the threat actor dropped a post-exploitation toolkit (called khunt) via a Java Source within an Oracle database, which is a novel aspect of this attack,” Huntress said. Because a code-object can be loaded directly in Oracle's database engine, the malicious actors were able to upload their toolkit directly into the database. “This is a technique that's previously been discussed and described over the years, including via a technique described as oraexec – however, the use of the technique in the wild has rarely been documented,” Huntress said. Oracle's database has an embedded Java Virtual Machine (JVM), and users can take Java source code and store it as a database object. “This is what attackers did during this incident: they fed CREATE JAVA SOURCE commands to the Oracle database from [Java implementation] Tomcat, through the [database] connection, and the Java source code contained within was then compiled directly inside the database as a stored schema object,” the vendor said. Speaking to The Register, Savage said: “Oracle has its own JDK. You are able to build and run Oracle Java programs within the database. It should never be something a web server can do. In fact, in a production Oracle environment, it should be locked down. It should only be re-enabled during a development or maintenance window, for example. It was poorly configured, poorly secured, but it wasn't an Oracle breach.” The ability to run Java in the database should be limited to only the DBA user, Savage argued, and users should disable the ability to compile code on a production server. “If they’d done that, it would have downloaded that Java code, and JDK would not have been configured to compile it,” he said. Savage said cybercriminals were seeking to exploit this kind of functionality more commonly, rather than simply looking to find and use vulnerabilities. “We're starting to see more and more of this: these cybercrime gangs now know about these products. They don't just know how to break them. They also know what legitimate functionality they could potentially use if it's been turned on, and that's what we saw here. That's the wake-up call. Oracle published something like 1450-ish patches. Organizations are totally focused on patch, patch, patch, but you still need to do the basics,” he said. ®

The US Cybersecurity and Infrastructure Security Agency (CISA) just dished out another three-day deadline for patching an actively exploited vulnerability, the most urgent in its wheelhouse. The culprit: a max-severity Oracle bug affecting Windows VMs. Tracked as CVE-2026-21962 (10.0), the improper access control (CWE-284) flaw affects Oracle’s HTTP Server and WebLogic Server Proxy Plug-in. Successful attacks targeting CVE-2026-21962 can allow miscreants to create, delete, or modify access to critical data, and even gain “complete access” to all data stored on the affected systems. Oracle disclosed and provided patches for CVE-2026-21962 as part of its January 20, 2026, updates. At the time, it said versions 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0 were affected, and that the vulnerability could be exploited in low-complexity attacks. CISA added CVE-2026-21962 to its Known Exploited Vulnerability (KEV) catalog on August 24, giving federal civilian executive branch (FCEB) agencies three days to protect themselves against attacks – the tightest deadline it is authorized to set. Other bugs to have recently been given the three-day treatment include the critical remote code execution (RCE) flaw affecting Python scaling framework Ray. Despite being disclosed in 2025, CISA added it to the KEV catalog last week. N-able’s “god mode” vulnerability, the one that offered attackers "full administrative access to an N-central console" and was exploited as of July 31, according to the vendor, was also lumped with a three-day deadline when CISA added it to the KEV catalog on August 3. Although CISA only added Oracle’s CVE-2026-21962 to the KEV Catalog on Monday, seven months after it was first disclosed, reports from the private sector suggest attackers had the bug in their sights much earlier in the year. Vikas Kundu, cyber intelligence analyst at CloudSEK, operated a honeypot for 12 days between January 22 and February 3, shortly after CVE-2026-21962 was first disclosed and public exploit code was released. The honeypot captured attacks attempting to exploit the vulnerability, as well as other WebLogic RCE bugs dating back to 2020 and 2017. “The overall activity was characterized by high-volume, automated scanning, with tools like libredtail-http and the Nmap Scripting Engine dominating the malicious traffic,” he said. “Furthermore, the logs revealed significant background noise, including attempts to exploit non-WebLogic-specific vulnerabilities (e.g., Hikvision CVE, PHPUnit RCE, and generic command injections), indicating a broad ‘spray and pray’ approach by threat actors.” Kundu said the findings demonstrated “the critical and immediate need for organizations to prioritize patching” the vulnerability at the time. ®

Cybercrims are using fake OpenAI Codex download pages to trick Mac developers into running malware disguised as installation commands. Researchers at Cato Networks uncovered the campaign after spotting sponsored Google search results targeting people looking to download Codex for macOS. The ads direct would-be users to a convincing-looking download page hosted on Google Sites, complete with the familiar OpenAI branding. There is, however, no Codex waiting at the other end. Instead of serving up an installer, the fake site tells Mac users to open Terminal, paste in a supplied command, and run it. The instructions are dressed up as part of the installation process, but the command quietly kicks off a multi-stage malware infection. It's a variation of the increasingly popular "ClickFix" technique, in which attackers convince victims to execute malicious commands themselves rather than relying on a dodgy attachment or executable to do the dirty work. In this case, the command begins with what appears to be a legitimate npm instruction for installing Codex. Tacked onto it, however, is code that decodes a Base64-encoded URL, fetches an attacker-controlled shell script and pipes it into zsh. That script pulls down another stage, which contacts the attacker's server to report that someone has taken the bait before downloading a Mach-O executable to “/tmp/helper.” It then removes security information macOS uses to flag suspicious downloads, helping the malware dodge the usual warnings before it launches. Cato said the final binaries are universal Mach-O files, meaning they can run natively on both Intel-powered Macs and newer Apple Silicon machines. The researchers found substantial similarities between the campaign and Atomic macOS Stealer, better known as AMOS, an infostealer previously spread through fake software downloads and malicious advertising campaigns. Cato isn't quite ready to slap an AMOS label on the malware, but says plenty of fingerprints point in that direction, from how the attack is staged to how the final payload is built. The crooks have also taken steps to keep researchers from getting a good look at their handiwork. Although victims initially land on Google Sites, the malicious content itself is pulled into the page from attacker-controlled infrastructure using an iframe. That infrastructure checks details including the visitor's operating system and the path used to reach it, allowing it to show harmless-looking content when a visitor doesn't fit the profile the attackers are after. Cato said the decoy site offered both macOS and Linux download buttons, although it only observed the malware chain being delivered to Mac users. Codex isn't the only AI coding assistant getting this treatment. During its investigation, Cato found a similar ClickFix page masquerading as Anthropic's Claude Code and sharing infrastructure with the Codex campaign. The attackers don't have to work particularly hard to find their victims, either. Developers searching Google for Codex do that work for them, with sponsored ads pushing the fake download page above the legitimate results. ®