The UK Electoral Commission is building an AI system to alert candidates to damaging deepfakes within three hours.

The UK’s Electoral Commission is building an AI-powered system to tell candidates about significant deepfakes within three hours of posting. Its chief executive, Vijay Rangarajan, said so at a panel at the Conservative Party’s annual conference last week, as Tech Policy Press points out that it’s a rare public intervention from a man who has run the regulator since 2024 and who mostly speaks to Parliament in evidence sessions.

He began with an example from another country. During Ireland’s 2025 presidential election, a deepfake video falsely showed candidate Catherine Connolly saying the election had been cancelled and that she was withdrawing from the race. The video also urged her supporters not to vote. None of this was true, and Connolly went on to win the election.

Rangarajan said a similar video during a UK election could influence a significant number of votes. However, he stressed that the Electoral Commission has clear limits to its role. It does not settle disputes over political claims made during a campaign. Its focus is on false statements that could disrupt the election process itself.

““If that happens to the British election, that will move a significant amount of votes,” he said, adding that it was not the Electoral Commission’s role to arbitrate rival claims made by candidates during the cut and thrust of a campaign, but rather to focus on statements such as this one that could undermine the administration of the election itself.

“To address that risk, the commission conducted a pilot program during the UK’s local elections in May 2026, Rangarajan said. “We ran a full pilot, analyzed about three million posts through an AI,” he explained. “So, this is a good example of how AI can work: 147 bits of content were flagged. Humans then looked at those — not a terribly pleasant job in some cases — ten were really quite misleading, and we referred to the social media companies or to the police.”” Tech Policy Press reports.

The Commission has tested the idea. During the local elections in May 2026 it ran a full pilot, and an AI analyzed about three million posts. It flagged 147 pieces of content, humans reviewed them (he called that unpleasant in some cases), and ten were really quite misleading, so they went to the social media companies or the police.

Rangarajan said the posts had little impact. However, the trial showed that the Electoral Commission now has a system to help voters, journalists and political parties deal with deepfakes. He expects attempts to use them to disrupt UK elections. The pilot began earlier in 2026 and monitored fake audio and videos designed to mislead voters about the election process or falsely show candidates doing or saying things. The Commission said it would publish the results.

The system has a clear focus. Identifying and prosecuting the people behind deepfakes can take weeks or months, often long after an election. Instead, the Commission aims to act without first identifying who created the content. AI scans social media posts in real time and flags suspicious material for human review. If a post meets the required criteria, the Commission alerts the relevant candidates or parties, ideally within three hours of its first appearance. Rangarajan said this is roughly the time it takes for content to go viral.

That narrow scope has edges. Full Fact, whose AI tools were monitoring more than a thousand candidates in the May elections, found a Glasgow candidate’s campaign videos built with AI. The Commission told Full Fact the clips fell outside its pilot because each was labeled an illustrative AI scene, even though the label sat at the end of the caption.

The legal backdrop is the real problem. Rangarajan said the Commission was set up for money and people, and now it’s all about information, so it has to work out how laws from 1983 or 2000 apply in 2026. Earlier this year the Guardian reported, according to a summary on the Resilient Media for Democracy Observatory, that the Commission was seeking legally enforceable takedown powers from the government.

Then there’s the part with no legal answer at all. Rangarajan said he believes at least one social network showed signs of algorithmic bias at election time, though he didn’t name it. His scenario is a platform that changes its recommendations during an election without warning, suggesting neighbors with one political view and suppressing others, so users think their neighbors have changed their minds.

The Commission believes it has already detected some algorithmic bias in social media campaigns, but Rangarajan said UK law offers no clear solution. Experts and campaigners have also raised concerns about X’s role in UK politics and TikTok’s Chinese ownership.

The Commission faces 30,000 to 40,000 cyberattacks a month, sometimes reaching 10,000 a day, including botnet attacks and phishing. Rangarajan wants stronger, more independent security capabilities and believes major social media monitoring could be handled by another body.

Tech Policy Press sees his comments as a call to update election laws and possibly create new offenses. The next general election must take place by August 2029, but it could be called earlier, and it remains unclear whether lawmakers will act in time.

For now, what the Commission has is a three-hour promise and a pilot that worked at small scale.

Rangarajan describes the threat it’s meant for as “an absolutely certain attempt to use some of these deepfakes against the UK.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Deepfakes)

Aoki, also known as Aokigahara, is a data-stealing malware that has added credentials for AI tools to its growing list of targets. Recent versions seek local files and session data linked to ChatGPT, Claude, OpenAI Codex, Cursor, Codeium and Gemini.

The change raises the risk for developers who use AI assistants alongside source-code repositories, cloud accounts and other work systems.

Unlike a flaw in an AI service, Aoki’s activity focuses on data stored on an infected computer. A stolen key or token may let an intruder use an account as its owner, run up paid usage or reach services connected to that account.

Earlier Aoki samples did not search for AI-related files, suggesting this is a newer addition to the malware’s collection rules. Researchers from Symantec’s Threat Hunter team identified the expanded targeting.

Symantec’s Threat Hunter team analysis found that newer Aoki versions search for files linked to Claude, ChatGPT and Codex, as well as tokens used by services such as GitHub Copilot, Cursor, Google Gemini, JetBrains AI Assistant and Kiro.

The Symantec Aoki threat report also describes the malware’s wider reach across browsers, wallets and messaging apps. The files named in the report include .claude.json, Claude desktop cookies, ChatGPT cookies, and Codex config.toml and .env files. These can contain login sessions, settings or secrets used by local tools.

Aoki also targets Cursor’s local state database, which may hold chat context and code snippets. Symantec says the main focus is credentials and session data, rather than source code itself.

New Aoki Malware Targets ChatGPT, Claude, Codex and Gemini

Aoki does not stop at AI tools. It can collect browser cookies, saved passwords, autofill details, credit-card data and Google tokens from a broad range of browsers.

Its other targets include cryptocurrency wallet files and extensions, password managers, VPN and file-transfer applications, gaming services, and Telegram and Discord data. It also records which security products are installed on the computer.

That broad collection can turn one infected device into a source of access to several accounts. For developers, a stolen token may expose more than an AI subscription: connected repositories, cloud services and continuous integration and delivery pipelines could also be at risk.

The growing focus on locally stored agent data has been seen in other reporting on AI coding agent data theft, though that coverage describes other malware families, not Aoki.

Aoki sends collected information to a command-and-control server using a /gate endpoint. Symantec says newer samples used several domains, while older samples used an IP address and port 8080 over unencrypted HTTP.

The report does not name a threat group behind Aoki, and it does not link the malware to a known family. Its name comes from “Aokigahara,” a string used during the malware’s decryption process.

The theft of AI credentials can also lead to direct costs. An intruder may use a victim’s account quota or resell access; abusing paid AI services in this way is often called LLMjacking. A separate report on stolen AWS keys used for LLMjacking shows how compromised cloud credentials can be used to run paid AI models at the account owner’s expense. Aoki’s reported focus, however, is stealing data from infected devices.

This pattern is not limited to Aoki. Cyber Security News has reported on a fake Gemini npm package that targeted credentials and local data from several AI development tools.

The incidents underline why developers should treat AI configuration files and local session data as sensitive, much like cloud keys and source-control credentials.

What defenders should check

Organizations should look for the indicators below in endpoint and network records. A match is a reason to investigate, not proof on its own that a device is infected.

If a system is suspected of compromise, teams should use a clean device to revoke active AI sessions, rotate exposed API keys and related credentials, and review account activity.

They should also check connected repositories and cloud services for unexpected use. These steps matter because multi-factor authentication may not stop an attacker from reusing a token already stolen from a device.

Developers should avoid saving long-lived secrets in files that are accessible to local applications, limit tokens to the permissions and time needed, and remove or replace exposed keys.

Security teams can monitor for unexpected access to AI tool folders and unusual outbound connections, then compare findings with the indicators below. Symantec identifies the family as Infostealer.Aoki.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post New Aoki Malware Targets ChatGPT, Claude, Codex and Gemini to Steal Credentials appeared first on Cyber Security News.

A critical vulnerability in Ghostscript could allow attackers to use specially made PDF files to run code on vulnerable servers.

The flaw, tracked as CVE-2026-39919, affects Ghostscript versions before 10.08.0 and has a CVSS severity score of 9.8 out of 10. Ghostscript is widely used to render PDFs, create document thumbnails, and convert PostScript files into images.

The issue is especially important for websites and services that accept uploaded PDFs. WordPress sites, document portals, print services, email gateways, invoice platforms, and file-conversion APIs may all call Ghostscript behind the scenes when they process user-supplied files.

A malicious PDF can therefore reach the vulnerable component even when the main application has no direct Ghostscript code.

Researchers from Wordfence identified the vulnerability during a WordPress 7.1 security assessment using its Argus testing system.

This is not a malware campaign, and researchers have not reported active exploitation in the wild. Instead, the finding shows how a crafted PDF can trigger memory corruption and, in certain server builds, lead to unauthenticated remote code execution.

Wordfence reported the flaw to Artifex on August 23, and the vendor confirmed it the following day before releasing the fix on September 8.

Critical Ghostscript Flaw

CVE-2026-39919 is a heap-based buffer overflow in Ghostscript’s JPEG 2000 image decoding path. The issue occurs when Ghostscript processes a PDF containing a JPEG 2000 image with unusual component resolution settings and sub-byte sample values.

In simple terms, the program reserves too little memory for image data and then writes more data than the allocated buffer can hold.

That extra data can overwrite nearby memory used by Ghostscript. In a controlled WordPress test environment, Wordfence researchers showed that this memory corruption could be developed into remote code execution.

The code would run with the permissions assigned to the account that processes the PDF, such as a web server or PHP-FPM user, rather than automatically gaining root access.

The public NVD vulnerability record lists the issue as a heap-based buffer overflow and notes that crafted JPEG 2000 content inside a PDF can corrupt memory.

The risk starts when an application accepts a PDF and attempts to create a preview or thumbnail. On many WordPress setups, the chain is WordPress, Imagick, ImageMagick, and then Ghostscript. The site may appear to be processing a normal document upload, but Ghostscript is the lower-level tool that reads the file.

This is why the issue differs from the earlier WordPress Imagick code-execution flaw, where WordPress upload validation could be bypassed with content disguised as an image. In this case, the memory bug itself sits inside Ghostscript.

Affected Versions and Real-World Risk

The vulnerable code was introduced in Ghostscript 9.21 and affects upstream versions through 10.07.1. Artifex fixed the issue in Ghostscript 10.08.0, and its official Ghostscript CVE page confirms that CVE-2026-39919 was addressed in that release.

However, Linux vendors may backport the fix to an older-looking package version, meaning gs --version alone may not prove whether a server is safe.

Wordfence tested ten package environments, including Debian, Ubuntu, Fedora, AlmaLinux, Alpine Linux, and an official WordPress Docker image. The researchers found vulnerable builds across those environments during their September 15 tests.

Their proof-of-concept files did not work unchanged across all systems, which means there is no evidence of a single universal PDF that compromises every server. Still, a build-specific exploit continued to work on systems sharing the same Ghostscript executable.

That result matters for hosting providers and companies that deploy many servers from one container image. A threat actor may not need a PDF that works everywhere if several targets use the same vulnerable build.

The concern is similar to the recent malicious HEIC image research, which showed how native media-processing libraries can expose WordPress servers when uploaded files reach vulnerable decoders.

Organizations should install the fixed Ghostscript package provided by their operating system vendor or hosting provider. Teams using containers should rebuild images from an updated base image and redeploy them, rather than simply restarting an existing container.

Managed WordPress customers should ask their hosting provider whether its Ghostscript package includes the CVE-2026-39919 fix and whether uploaded PDFs are converted into previews.

Where updates cannot be installed immediately, administrators should stop untrusted users from uploading PDFs or disable PDF processing through ImageMagick policy settings.

Rate limits and upload limits can reduce repeated processing attempts, but they do not remove the underlying flaw. Ghostscript’s -dSAFER mode should also not be treated as a fix because Wordfence reached the vulnerable path while that sandbox setting was enabled.

The incident also adds to growing evidence that document and image conversion services need close review. A Discourse image pipeline chain recently showed how Ghostscript and ImageMagick can become part of a wider file-processing risk path.

While Claude-assisted decoder exploit research demonstrated how flaws in media libraries can be adapted for real service environments.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post Critical Ghostscript Flaw Lets Attackers Use Malicious PDFs to Execute Code appeared first on Cyber Security News.

Japan helped extradite a Russian suspect linked to Qilin ransomware to Germany, but the gang continued attacking victims after his arrest.

Germany has arrested a Russian national believed to be a leading figure in the Qilin ransomware group, and Japan’s National Police Agency just put its own role in that arrest on the record. The suspect was detained in Japan back in May, at a hotel in Osaka, while traveling as a tourist.

“In connection with a ransomware incident in Germany, German authorities had obtained an arrest warrant for a Russian national suspected of involvement in the attack. When the suspect arrived in Japan, the Japanese authorities worked with the Ministry of Justice, the Tokyo High Public Prosecutors Office, and German authorities to detain him under a provisional detention warrant, in accordance with Japan’s Act of Extradition.” reads a full NPA statement in Japanese. “The Japanese authorities subsequently handed the suspect over to Germany in accordance with the procedures established by that law. These actions contributed to the case.”

Germany already had an arrest warrant out for the man over a ransomware incident on German soil. When he showed up in Japan, Japanese authorities moved fast. Per the NPA’s own account, Japan’s Ministry of Justice, the Tokyo High Public Prosecutors Office, and German authorities worked together to detain him under Japan’s extradition law, using a provisional detention warrant, before handing him over to Germany through the proper legal process.

The NPA statement does more than confirm the arrest. It specifically recognizes the work of the Kanto Regional Police Bureau’s Cyber Special Investigation Unit and other local police forces. They had been investigating Qilin ransomware attacks in Japan and working with German investigators on the wider case. The agency stressed that international cooperation is essential to investigating cybercrime, including ransomware attacks that affect countries around the world.

Japan has good reason to focus on Qilin. The group has attacked Japanese organizations, including carmaker Nissan and brewing company  Asahi. The attack on Asahi disrupted its operations for an extended period and exposed data belonging to 1.5 million people. Japan has been directly affected by the group, so its role in the investigation and the suspect’s extradition is significant.

Qilin ransomware operation has been active since 2022, it has become one of the most active RaaS groups in 2025, claiming over 40 victims monthly and peaking at 100 in June.

The group enables affiliates to deploy customized ransomware payloads against targeted organizations. Qilin uses double-extortion tactics, encrypting data while threatening to leak it via Tor-based portals. The group has targeted multiple sectors worldwide, including healthcare, manufacturing, and finance, leveraging phishing and known vulnerabilities.

In October 2025, Resecurity’s researchers detailed how the Qilin RaaS group relies on global bulletproof hosting networks to support its extortion operations.

In early October, DragonForce, LockBit, and Qilin formed a ransomware alliance to boost attack effectiveness, marking a major shift in the cyber threat landscape. Ransomware groups DragonForce, LockBit, and Qilin formed a strategic alliance to enhance their attack capabilities, signaling an evolving cyber threat landscape. The alliance aims at sharing tools and infrastructure to enhance attack effectiveness. 

At the end of March, Qilin Ransomware group allegedly breached the chemical manufacturing giant Dow Inc. 

Despite the suspect’s detention in May, the cybercrime group has listed hundreds of new victims on its Tor leak site since June alone.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, newsletter)

Fortinet details ClingSTUN, a Linux backdoor exploiting unpatched IoT devices and abusing public STUN servers to route traffic past NAT.

FortiGuard Labs researchers spotted a Linux malware family they call ClingSTUN, and the name gives away its trick immediately. Instead of relying on a dedicated command server, the malicious code leans on STUN, the protocol that helps devices behind a router figure out their real public IP address. Video calling apps use it constantly, which means ClingSTUN’s network traffic hides inside something that already looks completely normal.

“ClingSTUN functions as a back-connect proxy backdoor, turning infected systems into remotely controlled proxy nodes. It abuses public STUN (Session Traversal Utilities for NAT) infrastructure to discover externally mapped IP addresses and ports, maintain NAT bindings, and improve connectivity between compromised hosts and remote operators.” reads the report published by Fortinet. “Because many of the STUN servers it contacts are legitimate public services, the resulting traffic easily blends with normal VoIP and WebRTC communications.”

The attack starts with a familiar problem: old, unpatched devices exposed to the internet. Fortinet first spotted the campaign exploiting a known command injection flaw in Hytec Inter routers. As the campaign evolved, the attackers changed their download infrastructure and expanded the list of vulnerabilities they were exploiting.

In the latest wave, they were targeting devices from more than a dozen vendors, including D-Link, TP-Link, Realtek and Linksys, as well as several DVR and IoT cloud platforms. Many of these devices are easy targets because they are rarely updated or closely monitored.

Once the attackers find a vulnerable device, a small downloader script installs the right malware version for its hardware. It supports common architectures such as ARM, MIPS, PowerPC and Intel.

The latest version also checks the device for other malware before installing itself. It scans mounted filesystems and kills suspicious processes running from temporary directories. In other words, ClingSTUN is not just trying to infect the device. It also tries to remove competing malware and take full control.

The persistence mechanism is almost old-fashioned in its simplicity. The malware copies itself into two separate locations, then appends itself to three different boot scripts so it survives a reboot no matter which startup path the device actually uses. It also walks through every running process, checks whether the command line matches what the process claims to be, and kills anything that doesn’t line up, which is both a defense mechanism and a fairly blunt way of eliminating rival malware fighting for the same compromised box.

Two details stand out as genuinely well thought through rather than copy-pasted from some other botnet’s source code. First, it opens the device’s watchdog timer and quietly disables it, so the device never auto-reboots itself out of the infection the way embedded hardware is designed to if something goes wrong. Second, once it’s running as root, it swaps its own process metadata for a copy of PID 1’s, the very first process the kernel starts, which makes a basic process listing show what looks like the init system instead of malware.

“After setting up persistence, ClingSTUN clears its original command-line arguments so that its command line appears empty in tools such as “ps.” It then checks whether it is running as root (UID 0).” reads the report. “If so, it copies selected process information files from “/proc/1/” to “/tmp” and bind-mounts “/tmp” over its own “/proc/” directory, concealing its process information behind metadata copied from PID 1.”

The STUN part is especially interesting because it helps ClingSTUN hide in normal network traffic. The malware sends standard requests to public STUN servers to find out its external IP address and port. These are the same services commonly used by VoIP and WebRTC applications.

Later versions reduced the number of STUN servers and required all connections to work, which suggests the attackers were improving reliability. Because the traffic goes to legitimate third-party services, it can be difficult for defenders to tell the difference between ClingSTUN activity and normal traffic from apps such as Zoom.

Command delivery itself still needs a human on the other end willing to send a 20-byte packet the right way.

“ClingSTUN establishes a UDP socket, binds to a random local port, and sends standard 20-byte STUN binding requests. It sends these to 24 public endpoints and ensures at least half succeed.” Fortinet states. “The third evolution reduced this to 13 endpoints and ensures every endpoint connection succeeds.”

A single control datagram can trigger ClingSTUN to open a fresh outbound TCP connection to an address the operator specifies, pull down a command over that connection, and execute it, which keeps the heavy lifting off the STUN channel and limits what shows up in any one place. The malware also carries hardcoded exploits for seven more vulnerabilities purely for spreading itself further, meaning every infected device doubles as a scanner looking for its next host.

Fortinet stresses that the STUN servers are not compromised or malicious. They are simply working as intended. These third-party services should not automatically be treated as attacker-controlled infrastructure.

“ClingSTUN’s exploitation of known, unpatched vulnerabilities reinforces the importance of consistent cyber hygiene.” concludes the report. “Organizations should inventory Internet-facing devices, track their firmware and support status, and promptly apply available security updates, prioritizing vulnerabilities known to be actively exploited.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, ClingSTUN)

Hackers are turning trusted software updates into a route for stealing developer and cloud credentials. Recent supply chain incidents show how a single altered package, build action, or publishing token can place malware inside routine development workflows.

The risk is not limited to one product or programming community. After obtaining a maintainer token or access to an automated release pipeline, attackers can deliver code through an update that users and security tools may already trust.

ReversingLabs said in a report shared with Cyber Security News (CSN) that S1ngularity, Shai-Hulud, and TeamPCP show how quickly a compromise can spread from one supplier to many downstream organizations.

The report describes a chain of stolen credentials, poisoned releases, and repeat attacks across open source ecosystems.

The consequences reach beyond a developer laptop. Stolen GitHub, npm, cloud, and SSH credentials can expose source code, cloud resources, deployment systems, and other packages. In several cases, malware used credentials taken from one victim to publish the next poisoned update.

Hackers Poison Trusted Software Updates

The S1ngularity incident illustrates why trusted software distribution is a valuable target. Attackers compromised Nx packages after using a crafted pull request to obtain a token, replace a CI script, and trigger a publishing workflow.

The infected packages then ran post-install hooks on developer machines, a pattern detailed in CSN’s coverage of Nx package credential theft during the 2025 campaign.

Those hooks searched for valuable data, including tokens, credentials, and SSH keys. They also used GitHub credentials found on the host to create public repositories, giving the attackers a direct route to retrieve stolen material.

The campaign was unusual because its malicious code also prompted local AI tools to search the file system for likely credential locations.

The report, published September 30, 2026, places the Nx compromise on August 26, 2025. It treats the original campaigns separately from TeamPCP, whose involvement in earlier incidents remains unproven.

The report says the prompts sought leads to GitHub and npm tokens, cloud credentials, and SSH keys. This makes the attack more than a conventional password stealer: it attempted to turn a developer’s own assistant into a local discovery tool.

Readers can see the broader impact in AI tool credential targeting, including the data the malware sought from affected systems.

S1ngularity also showed why long-lived publishing tokens are risky. The stolen npm token enabled infected packages to be released, while compromised updates gained the benefit of an established package’s reputation.

Nx later adopted a trusted-publisher approach using short-lived, per-run credentials, reducing the value of a token stolen from a repository.

Credential Worms

Shai-Hulud expanded this model by making it self-propagating. The worm searched compromised systems for npm publishing credentials, used them to identify packages a victim could publish, and inserted malicious code into further releases.

That let it spread without a separate software flaw at each target, as explained in the Shai-Hulud worm attack investigation. Later activity attributed to or associated with TeamPCP showed how attackers can reuse an earlier breach.

In the Trivy incident, a privileged token was extracted in February 2026, but incomplete credential rotation left a path for attackers to publish a malicious update on March 19 through an automated system.

The attackers altered version tags used by CI/CD workflows, a technique covered in CSN’s report on Trivy tag poisoning attack. The credential-stealing payload targeted running workflows, where secrets can be especially valuable.

After the Trivy compromise, the group used harvested npm tokens to distribute CanisterWorm, which compromised more than 60 npm packages. Checkmarx, LiteLLM, and Telnyx were also affected, showing how stolen access can support successive intrusions.

Organizations should treat a poisoned update as a potential full credential compromise. They should replace long-lived publishing secrets with short-lived credentials, tightly limit token permissions, pin CI/CD dependencies to reviewed commits, and monitor publishing and repository activity for unexpected changes.

Teams that may have run an affected release should rotate exposed tokens promptly and check for unauthorized repositories, workflows, and package publications.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC

The post Hackers Poison Trusted Software Updates to Steal Developer and Cloud Credentials appeared first on Cyber Security News.

A flaw in a custom session-cookie system allowed an unauthenticated attacker to pose as employees and administrators in a yard management platform.

The issue did not break Microsoft Entra ID itself. Instead, it let a weak application-side session layer accept a forged identity after the normal sign-in controls had been bypassed.

The affected platform used Entra ID single sign-on and multi-factor authentication, but also relied on a signed cookie to maintain application sessions.

That design created the same risk seen in cookie-based account takeover attacks, where control of a trusted session can matter more than a password.

Resecurity said in a report shared with Cyber Security News (CSN) that its authorized assessment uncovered the weakness while reviewing a supply-chain yard management system.

The researchers said no production systems were tested, test records were restored, and the identities referenced in the proof of concept were anonymized.

Researchers successfully impersonated 95 employee accounts from 241 tested user IDs, including accounts with elevated rights. A forged administrator session was able to perform a state-changing API request, meaning the flaw could expose operational data and let an intruder act under a legitimate employee’s identity.

Session Cookie Vulnerability

The bypass came from two linked design errors. The application signed a cookie with a hard-coded secret that matched the cookie name, while the signed value was a user’s publicly exposed database identifier. Neither value should have been sufficient to establish an authenticated session.

A signed cookie normally detects changes by applying a server-held cryptographic secret to a random session reference. Here, the target CUID could be obtained from API responses, including the authenticated-user endpoint and directory responses.

With a predictable secret, an attacker could make a cookie the server treated as belonging to another user. That distinction matters because the resulting request never needed the victim’s password, a fresh MFA approval, or an Entra ID access token.

It was a failure in the application’s trust model, not evidence that Entra ID cryptography was compromised. Recent reporting on Entra refresh token theft similarly shows why identity defenses must protect the artifacts issued after sign-in.

The platform’s broader controls appeared sound during testing: it used RS256-signed access tokens, schema validation and parameterized database access.

However, the separate session cookie became an alternate route into the application. The researchers also found an unauthenticated Swagger interface that exposed the full 251-route API surface, giving the assessment added visibility.

Containing the Session-Layer Risk

The priority is to rotate the compromised session-signing secret and invalidate existing sessions. This cuts off cookies produced with that key.

Teams should then review authentication and application logs for unusual session creation, account changes, administrative actions, or activity that does not match the expected user or device.

Developers should replace identity-bearing, client-controlled session values with randomly generated session identifiers stored and verified on the server.

Separate, high-entropy secrets should be held securely for development, staging, and production, never reused across environments. A secure cookie flag alone cannot protect a session design that trusts a predictable value.

Organizations should also assess every custom layer added around a cloud identity provider. Strong upstream single sign-on and MFA cannot compensate when an application accepts a separate credential as decisive proof of identity.

Defenders can apply lessons from the Cookie-Bite session hijacking technique, including monitoring suspicious sign-ins, restricting unapproved browser extensions, enforcing compliant-device access, and applying token protections.

If stateless tokens remain necessary, Resecurity recommends strong cryptographic keys, expiration limits and replay protections. Teams should ensure session revocation covers every host that accepts the cookie.

The same forged cookie in this case worked on both the API and administrative application hosts. Reports on Microsoft 365 session theft have likewise stressed that password resets alone may not terminate authenticated sessions.

The case is a reminder that MFA verifies a login event, while session management decides what happens afterward. A random server-side session reference, rotated secrets, and meaningful monitoring reduce the chance that an attacker can turn an exposed identifier into account impersonation.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC

The post Session Cookie Vulnerability Lets Attackers Bypass Entra ID MFA and Impersonate Users appeared first on Cyber Security News.

Pentagon personnel agency breach exposed data of 3 million people after attackers accessed a file-sharing server for about nine months.

The U.S. Defense Manpower Data Center (DMDC), which maintains personnel records for the Department of Defense, is notifying people that their personal information was exposed in a data breach. According to the agency, unauthorized users accessed one of its file-sharing servers for roughly nine months.

The breach affects 2.76 million living people and 294,000 deceased individuals, according to a Department of War official. DMDC held at least 60 million records in fiscal year 2024, covering military and civilian personnel, contractors, family members, retirees and veterans.

“The Pentagon has confirmed that the breach affects 2.76 million “living individuals,” a category that potentially includes current and former defense personnel or their dependents, and 294,000 “deceased individuals,” a Defense Department official told CNN on Monday, three days after this story was published.” CNN states.

The Defense Manpower Data Center (DMDC) has notified individuals that a security vulnerability exposed personal information stored on one of its file-sharing systems.

The vulnerability was discovered on July 16, 2026, and the US office quickly patched the system and restored it. An investigation found that a small number of unauthorized users had accessed files between October 2025 and the discovery date. The files contained unencrypted personal information.

“On July 16, 2026, a security vulnerability in a DMDC file sharing system was discovered, which allowed unauthorized users to access files. DMDC immediately updated the file sharing system to patch the vulnerability and the system was restored.” reads a data breach notification letter sent to impacted individuals. “Analysis identified that between October 2025 and the date of discovery, a small number of unauthorized users accessed files on a server containing unencrypted PII. The types of PII involved vary by individual; however, in your case, they include social security number (SSN) and at least one additional identifier such as name, date of birth, contact information, sex, race, and military personnel information (such as occupational specialty).”

The data exposed varies by person, but in this case included Social Security numbers (SSNs) and at least one other identifier, such as name, date of birth, contact details, sex, race or military personnel information, including occupational specialty.

After discovering the vulnerability, the Defense Manpower Data Center (DMDC) launched its privacy and cybersecurity incident response process in line with U.S. government policies and guidelines. The agency says it is assessing the affected system and taking steps to improve its security.

DMDC is also offering 12 months of free credit monitoring through IDX, a company specializing in data breach and recovery services. Individuals affected by the breach are encouraged to contact IDX with any questions and enroll in the service. Enrollment is available through the dedicated IDX website using the enrollment code provided in the notification. The deadline to enroll is August 19, 2027. The credit monitoring is intended to help affected individuals identify potential misuse of their personal information following the breach.

At this time, no known cybercrime group claimed responsibilty for the attack.

DMDC says it launched privacy and cybersecurity incident response actions after finding the vulnerability.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, US Defense Manpower Data Center)

Kosovo national Ardit Kutleshi pleaded guilty to running Rydox, a cybercrime marketplace that sold stolen identities and credentials for years.

Ardit Kutleshi, 28 years old and a citizen of Kosovo, pleaded guilty last week to building and running the cybercrime marketplace Rydox.

The Rydox marketplace has been active since February 2016; it facilitated over 7,600 sales of stolen PII, access devices, and cybercrime tools, generating $230,000 since 2016. It offered over 321,000 products to 18,000 users, including names, social security numbers, and hacking tools. Thousands of U.S. victims were affected.

“According to court documents, since at least 2016, Rydox conducted over 7,600 transactions involving stolen personally identifiable information (PII), stolen access devices, means of identification, and cybercrime tools and services, receiving at least $232,000 in revenue.  These transactions involved the sale of PII stolen from victims located in the United States.” reads the DoJ’s press release. “Kutleshi pleaded guiltyin the District Court for the Western District of Pennsylvania to aggravated identity theft and money laundering conspiracy. “

The U.S. authorities seized the Rydox domain in 2025, a coordinated operation by the FBI and Royal Malaysian Police seized servers in Kuala Lumpur, Malaysia, that hosted the illicit marketplace. The US authorities also seized $225,000 in cryptocurrency.

Kutleshi did not run Rydox alone. His brother, Jetmir, also helped operate the marketplace. He pleaded guilty separately and was sentenced in December 2025 before being deported to Kosovo.

Both brothers have now pleaded guilty in US federal court for their roles in running the same criminal marketplace, bringing the case to a close after an investigation that involved several countries.

The FBI arrested Kutleshi in Kosovo in December 2024, seized the Rydox.cc domain at the same time, and extradited him to the US in 2025. Coordination on this case included Kosovo’s Special Prosecution Office and Cybercrime Investigation Directorate, Albania’s anti-corruption body, and Malaysia’s Royal Police and Attorney General’s office, which is a genuinely international lineup for what was, at its core, a website selling other people’s information.

Kutleshi pleaded guilty in the Western District of Pennsylvania to aggravated identity theft and money laundering conspiracy. He faces a mandatory minimum of two years on the identity theft count and up to 20 years on the money laundering charge. Sentencing is scheduled for February 9, 2027.

The FBI’s cyber division assistant director put the harm in plain terms. Rydox, he said, put

“Cybercriminals Ardit Kutleshi and his brother Jetmir — who pleaded guilty and was sentenced in December 2025 prior to his deportation back to Kosovo — operated the Rydox marketplace for their own gain, making hundreds of thousands of dollars from the marketplace where cyber criminals could purchase information and tools to effect and further their online crime,” said U.S. Attorney Troy Rivetti of the Western District of Pennsylvania. “These types of cybercrimes cause not only financial loss, but also ongoing psychological harm to the victims who lose both money as well as trust in institutions and the online market infrastructure. Our office will continue to work with our law enforcement partners to find and prosecute individuals who attempt to profit from the illegal sharing and sale of other people’s personal information and access devices, and related cybercrime.”

That second part is easy to undercount. Identity theft isn’t a one-time event that ends when the fraudulent charge gets reversed. It follows people through credit checks, background checks, and account recovery processes for years, and the damage to how someone trusts systems they have to keep using is harder to quantify than the dollar figure prosecutors cite in press releases.

The Justice Department’s Criminal Division said that, since 2020, its Computer Crime and Intellectual Property Section has secured convictions against more than 180 cyber and intellectual property criminals. Courts have also ordered the return of more than $350 million to victims.

Kutleshi’s case adds to those figures. His extradition from Kosovo also shows that operating outside the United States does not necessarily protect cybercriminals from US prosecution.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, cybercrime)

North Korea-linked WaterPlum runs the Contagious Interview campaign, infecting over 30,000 devices using a fake job interview.

On September 18, Japan’s National Police Agency, the FBI, the US Department of Defense’s Cyber Crime Center, and intelligence agencies from Australia and Germany published a joint advisory about a group called WaterPlum, better known as Contagious Interview. The name says it all. The job interview is the infection vector.

The numbers in the advisory are hard to shrug off. At least 30,000 devices infected across more than 100 countries, funds or credentials stolen from over 7,000 cryptocurrency wallets, and a total of 1.7 billion yen, roughly $10.71 million, funneled back to North Korea. The victims are almost always the same type: freelance developers and specialists in blockchain and Web3 work.

Japan’s NPA and the FBI assess that both WaterPlum operators and some North Korean IT workers report to the same place, the 313 General Bureau of the Munitions Industry Department, under the Workers’ Party’s Central Committee. That’s not a loose affiliation. It’s an org chart.

The trap itself is almost embarrassingly simple. WaterPlum actors pose as recruiters or hiring managers, often impersonating real AI, crypto, or NFT companies, and reach out on social media, job boards, and freelance platforms. Candidates get invited to a technical interview, then told to download a file to complete a coding test or fix a supposed bug on the video call.

“WaterPlum actors pose as prospective employers to target software developers and IT professionals worldwide under the pretext of attractive job opportunities. They often impersonate legitimate Artificial Intelligence (AI), cryptocurrency, or Non-Fungible Token (NFT) companies and have also used recruiting services.” reads the joint advisory. “WaterPlum actors have infected at least 30,000 devices in more than 100 countries and exfiltrated funds or account credentials from over 7,000 cryptocurrency wallets. WaterPlum actors have transferred 1.7 billion Japanese yen (JPY) (equivalent to 10.71 million USD) of cryptocurrency assets to the Democratic People’s Republic of Korea (DPRK).”

That file is never what it claims to be. The advisory names five malware families riding inside these downloads, BeaverTail, InvisibleFerret, OtterCookie, OtterCandy, and StoatWaffle, each doing its own piece of the job: one steals browser credentials, another opens a backdoor, another sets up a remote access trojan to move deeper into the machine. Once inside, the goal is straightforward: drain the wallet, then look for whatever else might be worth stealing.

What happens next goes beyond one stolen wallet. The report notes that a successful infection can give WaterPlum a way into the victim’s employer, opening the door to espionage, stolen source code, and further movement inside a company’s systems. Stolen ID photos get reused too, letting North Korean IT workers impersonate the victim to land more paying contracts elsewhere.

That last part connects to a separate but related scheme covered in the same advisory: North Korean IT workers using so-called “laptop farms.” These are physical locations, often just someone’s house, where a local facilitator plugs in company-issued laptops and lets a North Korean worker operate them remotely over VPN. The worker gets a Western-looking identity and a legitimate-sounding job. The facilitator gets a cut.

“Beyond immediate credential theft, successful infections provide WaterPlum actors opportunities to infiltrate organizations employing targeted developers, enabling espionage, intellectual property theft, and additional lateral movement in corporate environments. Stolen ID images can also be used by North Korean IT workers to impersonate victims and generate foreign currency.” continues the report. “Other sensitive data targeted for exfiltration includes:

• Authentication data stored in web browsers (ID, password, etc.);
• Clipboard information, key-logs (recorded keystrokes), screenshots;
• Cryptocurrency-wallet data (private key, seed phrase, etc.); and
• Any files or data of interest to the actors on a PC or in shared folders (ID pictures of driver’s licenses, passports, etc.)”

Here’s a simpler and more natural version, while keeping the same details:

Japan says this is no longer just a theoretical threat. Authorities have already shut down the country’s first known “laptop farm,” run by a local facilitator who had moved several hundred million yen in cryptocurrency out of Japan. In the US, the FBI says it continues to prosecute people who help North Korean IT workers operate this way, across several states and under different charges.

The advisory also describes a case involving a Japanese crypto exchange that spotted one of these applicants in May 2025. His resume listed an unusually wide range of skills across more than a dozen technologies. He claimed to be Malaysian, raised in Finland, and fluent in Malay and Chinese, but struggled with basic English questions that did not fit his claimed background. The company rejected him, avoiding any damage.

Other red flags recruiters have picked up on read like a checklist for a bad Zoom call: the applicant glancing sideways as if reading a script, background voices that shouldn’t be there, video that keeps freezing at convenient moments, a firm preference for getting paid in crypto, sometimes to someone else’s account entirely.

Not every North Korean IT worker sticks to quiet fraud, either. One extorted a client over a payment dispute and leaked the company’s proprietary code online out of spite. Another, hired for basic website maintenance, defaced the site and knocked it offline instead. Petty, but the effect on the client was anything but.

The advisory draws one more thread together: WaterPlum’s cyberattack operators and North Korea’s IT worker network aren’t running in parallel. They’ve been caught using the same IP addresses to access laptop farms, register on freelance platforms, and apply for that same crypto exchange job. Same infrastructure, two revenue streams, one regime cashing the checks.

“The techniques described in this advisory are only examples; actors continuously evolve and refine their methods.” concludes the advisory. “Stay informed by monitoring alerts from domestic and international security agencies and by reviewing reports published by security vendors.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – Contagious Interview, WaterPlum)

A 2017 UK assessment warned that police data on Microsoft Azure could face foreign access risks. The risks may still exist.

A Guardian investigation has surfaced a 2017 document signed off by then City of London police commissioner Ian Dyson, who also held the title of senior information risk owner for the entire country. That document reviewed 15 risks tied to moving police data onto Microsoft Azure. The files in question include criminal records, victim statements, internal emails, information from more than 40 UK police forces, and some material exceeding standard “official” classification, meaning it may sit at “secret” or “top secret” level.

The assessment was clear. It said Microsoft software had vulnerabilities that could eventually be exploited by cybercriminals and other attackers. It also pointed to a more specific and worrying risk: “US government insiders.”

“In doing so, officers accepted that “US government insiders” would be able to see the data, and that it could be “transmitted worldwide”, with “the extent of this … unknown”. According to five specialists who reviewed the Guardian’s findings, the risks identified in that document persist today. Almost every UK police force now depends on Microsoft Azure, and the UK government spends at least £1.9bn on Microsoft software each year.”” states The Guardian.

“There is a risk of compromise of sensitive data shared by, or taken from, Microsoft by the US government being released by US government insider attackers.” reads the document.

This wasn’t a general concern. It was a specific threat identified eight years ago by the official responsible for data-handling standards in British policing. Five experts who reviewed the same assessment for The Guardian said the risks are still relevant today.

The proposed protections were fairly simple: use Microsoft’s built-in encryption, keep servers updated and let individual police chiefs decide whether to use the service. But experts interviewed by The Guardian, including Microsoft engineers, said encryption does not prevent Microsoft employees from accessing the data. They also said it would not necessarily prevent the US government from obtaining it.

Which is exactly the geography problem Dave Michels, a researcher at Queen Mary University of London’s Cloud Legal Project, pointed to. Microsoft’s cloud infrastructure spans over 100 countries, and pieces of a single file can end up stored across several of them, Sweden to Ethiopia, for instance. Microsoft has started offering EU customers assurances that data stays within European borders, but Michels called the whole focus on data location somewhat beside the point, since the people who can access the data matter more than the servers holding it.

Legally, the situation becomes more complicated. Under the US CLOUD Act, American authorities can require US-based companies to provide data they control, even when that data is stored outside the United States. In some cases, companies can also be prevented from telling the customer about the request.

Microsoft, Amazon and Google have said they would challenge such requests when possible. But, as international law professor Douwe Korff pointed out:

“The risk is obvious, even though the providers of the cloud and the government both have an interest in talking it down” Douwe Korff, professor of international law told The Guardian.

Which brings us to the part that reads like a contradiction under pressure. Police officials told the Guardian the data stays in the UK and that Microsoft can’t share it without permission. Microsoft, meanwhile, told Police Scotland back in 2023 that data can leave the UK and that it cannot guarantee data sovereignty. Those two statements aren’t compatible, and nobody seems eager to reconcile them out loud.

Every single UK police force has now put its data, wholly or partly, on Microsoft’s cloud, despite all of this being on record since 2017. One former senior policing source summed up the current state of visibility pretty starkly:

“All the security guys I worked with when this policy came in expected a big breach by now, and we know it will take that to change the police’s position.” a source told The Guardian. “The truth is, however, the level of logging and information in the cloud systems would not necessarily tell us if there was a problem. We really don’t know if the data has been breached or not.”

That’s the key point. It’s not saying, “we checked and everything is fine,” or “there has been no incident.” It’s saying that the available logs and monitoring might not detect a breach even if one happened.

For anyone responsible for sensitive data in a large cloud environment, that’s an important warning. In a security assessment, saying “we would probably know if something went wrong” isn’t enough without evidence that the monitoring can actually detect it.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Microsoft Azure)

A specially crafted image file was enough to turn a normal upload feature into a potential path to server takeover. Researchers have shown that a flaw in widely used image-decoding software can corrupt memory and, in certain cases, allow attackers to run code remotely on affected systems.

The issue, named HEIF Heist, affects applications that accept and process HEIF, HEIC, or AVIF images. Instead of relying on a conventional malware download, an attacker can hide the trigger inside an image submitted through an upload feature, placing web services, developer platforms, and enterprise tools at risk.

CyberScoop noted that Hacktron researchers used AI-assisted research to uncover and test the weakness. Their work raises concern because image files often pass through trusted conversion tools, while the libraries behind them may process hostile content before normal application defenses can stop it.

CyberScoop said in a report shared with Cyber Security News (CSN) that no active malware campaign was identified in the disclosure, and the researchers conducted controlled proof-of-concept testing.

Still, the potential impact was broad, including exposure of in-memory information, user files, access tokens, account sessions, and production systems where an unpatched decoder processes attacker-supplied images. This makes ordinary media-handling infrastructure a potential gateway into far more valuable systems.

Claude Opus 5 Helps Researchers Weaponize HEIF Image Flaw

The core weakness sits in the way libheif and libde265 parse certain image data. Hacktron found that malformed HEIC images could reach the underlying decoder through an application upload pipeline, triggering a heap-buffer overflow that provided the building blocks for reading or changing memory.

The researchers said AI systems assisted their investigation, with Claude Opus 5 helping turn the flaw into a working remote-code-execution path.

In testing described by Cyber Security News’ earlier coverage, the target forum processed HEIC files through ImageMagick after its usual image-validation component did not support that format.

Crafting a reliable exploit still required target fingerprinting and payloads tailored to the installed version. Some attempts needed thousands of uploads, but AI-assisted work reduced the reported time from an initial probe to RCE to roughly one to three days.

One proof of concept involved a Discourse-based community forum, where the researchers chained flaws to compromise employee accounts and use associated credentials to open a pull request in an internal code repository.

The team said the initial flaw was found on July 25, patched within days, and led to a $6,500 bug bounty. The finding also echoes recent Next.js image risks, where a vulnerable AVIF-processing path could expose servers to RCE.

In both cases, the danger comes from treating an image upload as harmless while an underlying component performs complex parsing on the server.

Patch Decoders and Isolate Uploads

Organizations should identify every service that accepts HEIF, HEIC, or AVIF uploads, including support forums, content platforms, APIs, and internal developer tools.

They should then confirm that deployed libheif and libde265 packages include the latest upstream security fixes, not merely the version supplied by an older base image.

Updating only the front-end application is not enough when the vulnerable code lives inside a container, operating-system package, or conversion dependency.

Teams should review software inventories and rebuild images where necessary, a lesson also seen in WordPress image processing flaw, where careful inspection of real file content was central to the fix.

Where image conversion is essential, operators should disable unused decoders and run conversion in short-lived, isolated environments with minimal permissions.

Limiting access to credentials, source repositories, and sensitive environment variables can reduce the blast radius if a parser is compromised.

Finally, upload services should enforce file-type checks, size limits, logging, and monitoring for repeated failed processing attempts.

The broader pattern matches Rails file-processing exposure: an upload endpoint can become a route to secrets or code execution when server-side media handling is not treated as a high-risk boundary.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC

The post Claude Opus 5 Helps Researchers Weaponize HEIF Image Flaw Into Remote Code Execution appeared first on Cyber Security News.

China rejects Amodei’s AI slowdown proposal, calling it fearmongering and a US attempt to contain China’s technology sector.

The debate over whether the world should slow down the development of advanced AI has quickly turned into something bigger than a technology argument. Dario Amodei, CEO of Anthropic, has called for a slower pace of development, arguing that AI capabilities are advancing faster than our ability to understand and control them. His proposal has now run straight into the geopolitical reality of the US-China competition.

In his essay, “We Must Pace the Frontier“, Amodei argues that the industry needs more time to build effective safeguards around increasingly capable AI systems. He isn’t calling for an end to AI development. His argument is that capability gains should slow enough to give safety research, testing and oversight a chance to catch up.

One of his main concerns is the growing ability of AI agents to act on their own. Amodei warns that a large number of increasingly capable agents could, within six to twelve months, become capable of carrying out complex operations across the internet and potentially cause enormous damage if they aren’t properly controlled. The warning follows recent incidents in which AI systems have already been used to perform cyber operations with a level of autonomy that would have been difficult to imagine only a few years ago.

Amodei’s proposal has three main elements: stronger independent testing of advanced models, greater coordination between leading AI companies, and international cooperation on safety. Anthropic says it is prepared to give independent evaluators permanent, employee-level access to its systems so they can assess safety measures and investigate incidents.

The difficult part starts when China enters the discussion.

Amodei argues that the United States needs to maintain its lead in advanced AI and supports continuing restrictions on China’s access to the most advanced AI chips and chipmaking equipment. He says a Chinese lead in frontier AI could create serious risks for the United States and the wider world.

The Government of Beijing strongly disagrees with that framing. China’s Foreign Ministry accused Amodei of spreading fear and argued that confrontation and competition would damage international efforts to establish rules for AI. China’s state-backed Global Times went further, describing the proposal as a “Cold War playbook” aimed at containing China’s technology sector.

Chinese officials are also warning about AI, but from the opposite direction. Chen Yixin, head of China’s Ministry of State Security, recently warned that advanced AI could be used by hostile actors to discover vulnerabilities at scale, conduct complex hacking operations and steal sensitive information.

“In an essay posted Sunday on social media, Chen Yixin, head of China’s Ministry of State Security, warned that, in the hands of “hostile forces and individuals with ulterior motives,” this technology could pose a direct threat to “our political, institutional, and ideological security.”” The Associated Press reports.

“Citing the capabilities of powerful technologies from U.S. companies like Anthropic and OpenAI, Chen warned that “certain nations and organizations” now have the capabilities to “rapidly discover vulnerabilities at scale … and execute complex hacking tasks.” That, he wrote, poses “serious risks to my country’s critical information infrastructure.””

That contrast is important. Both sides are talking about AI security, but they don’t agree on what the security problem actually is.

Washington is concerned that China could gain access to capabilities that strengthen its military, intelligence and cyber operations. Beijing sees US restrictions on chips and AI technology as an attempt to prevent China from closing the technological gap.

The recent dispute over AI model distillation has made the situation even more complicated. US agencies have accused Chinese AI developers of aggressively extracting capabilities from leading American models, including Claude and GPT. Beijing has rejected those allegations and argued that model distillation is a common technique used across the AI industry.

This creates a problem for any proposal based on international cooperation. How do you persuade two countries to slow down together when each side believes that slowing down alone could leave it at a strategic disadvantage?

President rejected calls to slow AI development, despite warnings from leading tech executives and Democrats about existential risks. Anthropic’s Dario Amodei, OpenAI’s Sam Altman and Elon Musk urged a more cautious approach, but Trump said the US must maintain its global AI leadership while allowing some safeguards.

“Look, we’re leading China in AI . . . and, frankly, I want to keep it that way, because whoever wins AI, wins,” Trump told reporters during a trip to his Doonbeg golf course in Ireland, Financial Times reported.  “We can put guardrails, we can do this and that, but I think you have a lot of negative forces that are bringing it up that shouldn’t be bringing it up and they’re bringing up things that won’t happen,” he added.

That puts Amodei’s proposal in a difficult position. The companies developing the most advanced models are increasingly warning that safety needs more time, while the political leadership in Washington sees AI leadership as a strategic asset that cannot be surrendered. Sam Altman and Elon Musk have backed Amodei’s call for greater caution, and other major AI leaders have also moved toward stronger safety measures.

The timing is particularly interesting because Trump and Chinese President Xi Jinping are expected to discuss AI governance at their planned September 24 meeting. Any agreement between Washington and Beijing would have to deal with two very different priorities: controlling the risks created by increasingly autonomous AI systems while making sure neither side believes it is giving the other a technological advantage.

For cybersecurity professionals, this is more than a political dispute. The capabilities being discussed are already relevant to vulnerability discovery, exploitation, credential theft, surveillance and large-scale automated operations. The question is no longer simply how powerful AI models can become, but how quickly that power can be turned into real-world action.

That’s where the debate over slowing AI becomes particularly difficult. You can slow the development of a model, but you can’t easily slow a global competition in which governments, companies and attackers all have strong incentives to keep moving.

And that’s probably the uncomfortable part of the discussion: the countries most capable of creating the rules are also the countries with the strongest reasons not to slow down.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, AI)

Confidential cloud systems are designed to keep a customer’s data hidden even from the server operator. DDRop shows that this promise can fail when an attacker can tamper with the DDR5 memory path.

The new technique is a physical hardware attack, not malware, but it can undermine workloads protected by Intel TDX and AMD SEV-SNP.

Earlier work had already raised questions about trust boundaries in confidential virtual machines. In earlier TDX isolation findings, researchers showed that a hostile virtual-machine manager could observe activity patterns inside a protected trust domain.

DDRop moves the concern below software, targeting memory commands travelling between a processor and server memory.

Researchers behind the published GitHub research materials said in a report shared with Cyber Security News (CSN) that DDRop uses a custom DDR5 registered DIMM interposer to interfere with memory writes at normal operating speeds.

The project includes hardware designs, controller firmware, host tools, and proof-of-concept attack code for the affected platforms. The attack requires privileged control of the target host and brief physical access to install the device.

That makes it less likely to affect ordinary endpoint users, but it creates a serious risk model for cloud infrastructure, colocation facilities, and other environments where attackers may access servers during maintenance or supply-chain handling.

New DDRop Attack Breaks Intel TDX

The researchers built the interposer for $159 in parts, excluding development time and assembly costs. It sits between the CPU and a DDR5 RDIMM, then manipulates command signals instead of reading ordinary application data.

The design can trigger parity failures, causing the memory module to reject selected write commands while the system is not properly alerted.

When a write is silently discarded, a protected virtual machine can later read older data that should have been replaced. This is the core DDRop primitive.

The researchers found that Intel TDX, Intel Scalable SGX, and AMD SEV-SNP can be affected because scalable memory-encryption designs do not fully verify whether encrypted memory contains the freshest version of each cache line.

That distinction matters. Encryption can keep a memory value unreadable to an attacker, yet it does not necessarily prove the value is current.

Similar lower-level risks were highlighted in recent DRAM scrambling analysis, where researchers examined how changes beneath the operating system can bypass controls that assume memory addresses remain stable.

TDX and SEV-SNP Security Impact

DDRop becomes more damaging when it is combined with trusted memory-management interfaces exposed to a malicious host. The researchers showed that an attacker could interfere with page relocation and force a destination page to retain stale contents.

In testing, this enabled deterministic copying of plaintext between pages belonging to the same confidential virtual machine. On Intel TDX, the team also demonstrated injection of malicious Secure Extended Page Table entries.

This can give an attacker control over protected address translations, opening a route to victim ciphertext access, replay attacks, and corruption of sensitive control structures.

The researchers further showed attacks that could place a trust domain into debug mode or forge an expected attestation measurement. The most durable fix requires hardware designs that provide both cryptographic integrity and freshness checks, the researchers said.

Until then, organizations should limit physical access to servers, monitor firmware and memory configuration changes, use attestation carefully, and disable memory-management features that are not required.

Broader AI data center hardening practices, including firmware baselines and hardware inventory controls, can also help reduce exposure to physical platform attacks.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post New DDRop Attack Breaks Intel TDX and AMD SEV-SNP With $159 DDR5 Device appeared first on Cyber Security News.