❌

Visualização de leitura

Microsoft Links ConnectWise Breach to China-Linked Group Using AI Pentesting Tool ARTEX

China-linked Storm-0940 used AI tool ARTEX to target 2,250 Microsoft 365 tenants, exploiting stolen ConnectWise credentials at machine speed.

Microsoft published a detailed technical report naming Storm-0940, a China state-aligned group, as the actor behind the ConnectWise Cloud Backup supply chain compromise. The group used ARTEX, an open-source AI-driven penetration testing framework, to run attacks at machine speed against hundreds of organizations across aerospace, defense, energy, financial services, government, manufacturing, and more.

“Several of these Storm-0940 ARTEX-driven attacks have resulted in the actor obtaining privileged access to an organization’s cloud infrastructure – including multiple instances where the time from initial targeting to privileged access was less than 3 hours.” reads the report. “Microsoft assesses that Storm-0940 was responsible for the recently disclosed ConnectWise supply chain compromise of a multi-tenant application.”

Storm-0940 has been active since 2021 and has historically relied on password spraying and OAuth application abuse to get into Microsoft 365 environments. Adding ARTEX changed the scale of what they could do. In some attacks, the time between initial targeting and achieving privileged cloud access was under three hours.

Before obtaining the ConnectWise credentials, Storm-0940 launched a password spraying attack between October 10 and 14. The attack came from the IP address 144.172.64[.]99. Microsoft recorded more than 151,000 failed login attempts against 327 accounts at eight organizations. Activity peaked on October 11, with 2,900 failed attempts per minute. Forty-eight accounts each received more than 1,000 failed attempts. None of these attempts succeeded.

The situation changed on October 15, one day after the ConnectWise breach became public. The AI agents stopped trying passwords and switched to a different attack method. By then, Storm-0940 had obtained the credentials of several ConnectWise cloud application accounts. The agents used these credentials to log directly into customer Microsoft 365 environments.

“Storm-0940’s use of ARTEX accelerated the speed of compromised application abuse to authenticate to Microsoft 365 customer environments through applications that had already been granted access.” Microsoft continues. “This allowed the threat actor to operate without requiring an interactive user sign-in. “

The agents used applications that already had permission to access their targets. This allowed the attackers to enter customer environments without requiring users to sign in interactively.

In a subset of environments where authentication succeeded, the agents didn’t stop there. They moved into Microsoft Graph and ran directory reconnaissance, modified application credentials to establish persistence, and attempted changes to identities, groups, and privileged roles. Microsoft identified multiple customer environments with evidence of this follow-on activity.

The persistence mechanism is the part defenders need to act on now, even if they’ve already disabled the ConnectWise connections.

“These changes can remain active as a backdoor even after the original compromised application is mediated.” says the IT giant.

An attacker who added their own credentials to a trusted application before you revoked access still has a working key. Reviewing all service principal credential additions since at least October 1 is the right starting point, not October 15 when the public breach was announced.

ARTEX is not a tool used only by Storm-0940. Microsoft says threat actors in several regions have used the same framework. Originally open-source, ARTEX was written in Go and can use different AI models to plan and carry out tasks. Researchers at Zscaler and Recorded Future also found a Chinese-speaking group using it to target South Korean financial institutions. The setup used DeepSeek, GLM, and Grok as coordinated AI agents, with GLM checking DeepSeek’s work. After these attacks became public, the project went closed-source. However, anyone who already has a copy can still use it.

The speed point is what Microsoft keeps coming back to in its report. Agents don’t take weekends, don’t sleep, and can run multiple attack paths simultaneously.

“This activity demonstrates how threat actors are integrating agentic AI into existing offensive security workflows and allows them to scale their operations exponentially.” Microsoft concludes. “Agents are not constrained by factors affecting humans – they can work around the clock, on weekends, and on holidays and attempt multiple breach paths simultaneously enabling significantly reduced time from selecting a target to achieving objectives, increasing the speed and impact of complex attacks like supply chain compromises.”

When Storm-0940 had valid application credentials, they didn’t have to iterate slowly. They hit 2,250 tenants with 2,900 sign-in attempts per minute, a pace at which manual detection and response simply can’t keep up.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, ARTEX)

Tokenomics na cibersegurança: ataques de negação de carteira e custos das operações de SOC

Recentemente, fizemos uma postagem sobre tokenomics e ataques de “negação de carteira” (denial of wallet): um novo tipo de ataque DDoS que busca gerar gastos excessivos com tokens de IA. Antes de começarem a proteger os processos de IA de seus colegas contra essa nova ameaça, os profissionais de segurança precisam considerar que as próprias atividades do departamento de segurança da informação também podem ser alvo desse tipo de ataque. Como as equipes de segurança estão testando e implementando ativamente diferentes formas de automação baseada em IA, a ameaça de interferência externa destinada a paralisar o sistema de defesa pode afetar diretamente seus próprios processos e tecnologias.

A Elastic estima que, conforme a arquitetura do SOC baseado em agentes, a triagem de um único alerta de um host pode custar US$ 0,69 com um conjunto de agentes especializados ou US$ 3,42 com um agente de uso geral capaz de executar 14 tipos diferentes de tarefas.

No entanto, esses valores médios ocultam uma enorme variação nos custos. A qualquer momento, o processamento inicial de um alerta simples (como, por exemplo, mil tokens) pode desencadear uma investigação sobre o processamento de milhões de entradas de registro, chamadas de API, e de outros dados relacionados, consumindo milhões de tokens em questão de minutos.

A própria Elastic reconhece que utiliza o modelo Claude Sonnet 4.6 em seu SOC. Isso levanta uma questão imediata: o que acontece quando o orçamento se esgota ou os filtros de segurança do modelo são acionados? No pior cenário, o SOC baseado em IA aciona uma “orquestra de agentes” para investigar eventos suspeitos que se assemelham a movimentos laterais na infraestrutura. O agente faz uma chamada à API da Anthropic, mas o orçamento mensal do departamento já se esgotou, e a API retorna erros. A investigação fica paralisada, e a equipe só percebe o problema meio dia depois. Além disso, se os “filtros de segurança” de um grande provedor de IA, que estão em constante mudança, classificarem as solicitações do SOC como maliciosas, o mesmo poderá ocorrer mesmo que ainda haja orçamento disponível. Isso ficou evidente na experiência da Hugging Face ao investigar a invasão de sua infraestrutura pela OpenAI.

É claro que um invasor tem interesse em provocar esse tipo de situação. O invasor pode aumentar diretamente os custos da equipe de defesa ao inserir prompts maliciosos nos dados que ela processa, como registros DNS TXT, cabeçalhos HTTP, comentários no código e nomes de arquivos, sabendo que esses prompts serão analisados pelos sistemas de segurança da informação. No ataque GhostJacking, registros do WAF são usados como vetor para a injeção de prompts. Em outro método, apresentado em um estudo acadêmico, pesquisadores conseguiram atacar as próprias proteções de segurança dos LLMs, aumentando a latência das solicitações em 148 vezes e o consumo de tokens em 63 vezes. Em teoria, o sistema continua funcionando normalmente, mas o processamento dos alertas fica muito mais lento e os custos associados aumentam significativamente.

O perigo das falhas silenciosas

Em sistemas baseados em agentes, o esgotamento do orçamento nem sempre gera um erro explícito com a mensagem “limite de solicitações excedido” e um alerta imediato aos responsáveis. Em determinadas configurações, pode ocorrer degradação silenciosa: quando uma solicitação ao modelo excede o tempo limite, o sistema muda automaticamente para um modelo mais barato, reduzindo a qualidade das respostas e interrompendo a execução de subagentes e tarefas periódicas. Enquanto isso, a equipe de segurança pode passar horas acreditando que tudo continua funcionando normalmente.

Como controlar os custos da IA na cibersegurança

Gerenciar os custos, é claro, não se resume a “evitar gastos excessivos”. O setor já caiu nessa armadilha ao implementar soluções SIEM: quando as empresas passaram a pagar de acordo com o volume de telemetria coletada, começaram a restringir seletivamente a coleta de registros, nem sempre de forma eficaz. Como resultado, surgiram pontos cegos na detecção de ameaças. O mesmo pode acontecer com os tokens, mas de forma mais rápida e em maior escala. Uma política de redução de custos mal planejada pode comprometer a profundidade das investigações e a qualidade das respostas. Sem uma política desse tipo, a decisão sobre o que cortar ficará a cargo do analista de plantão às 3h da manhã, e não do arquiteto ou do CISO durante a fase de projeto do sistema. Outra possibilidade é que o próprio fornecedor do sistema imponha limites automaticamente.

Alguns princípios simples ajudam a evitar aumentos previsíveis de custos e a gerenciar melhor situações realmente imprevisíveis.

Não recorra à IA para analisar informações que podem ser verificadas por meio de consultas convencionais. Tarefas repetitivas e previsíveis devem continuar sendo executadas da maneira tradicional, com regras e consultas a dados. Essas regras e consultas podem ser desenvolvidas com o auxílio da IA, mas devem funcionar de maneira determinística. O modelo deve ser usado apenas quando for realmente necessário avaliar uma situação ambígua.

Estabeleça limites rigorosos e emita alertas imediatos aos usuários sempre que forem ultrapassados. Combine diferentes tipos de limite, como limites por tarefa, limites diários e assim por diante. Os alertas de violação dos limites devem chegar imediatamente tanto aos analistas de plantão quanto aos responsáveis por todo o sistema.

Defina com antecedência o que fazer quando um limite for atingido. A decisão entre interromper o processo para economizar, mesmo que isso reduza o controle, ou continuar e arcar com os custos deve ser tomada antes que ocorra um incidente.

Restrinja as permissões dos agentes e as ferramentas às quais eles têm acesso. Quanto mais restrito o conjunto de ações, melhor será seu desempenho em tarefas específicas. Isso também reduz as oportunidades de elevar os custos e a probabilidade de exploração por agentes externos.

Examine rigorosamente os dados externos não confiáveis. Solicitações, consultas, mensagens, comentários e campos técnicos de texto livre, como registros DNS, cabeçalhos HTTP e nomes de arquivos, podem servir tanto para injetar prompts maliciosos quanto para sobrecarregar deliberadamente o sistema. Limite o tamanho desses dados e monitore a carga de trabalho que geram.

Para evitar interrupções causadas por provedores externos e manter o controle total sobre os dados da organização, avalie a possibilidade de usar modelos locais implantados na própria infraestrutura, pelo menos nas atividades de segurança da informação. Embora não sejam os modelos mais avançados, sua especialização e seu ajuste fino com dados da empresa podem garantir bom desempenho e reduzir o risco de falhas inesperadas.

Em arquiteturas mais complexas, os LLMs podem ser divididos em níveis de gravidade. A primeira linha de defesa, responsável por roteamento, filtragem de ruído e enriquecimento de dados é tratada localmente por modelos compactos. Isso reduz significativamente a imprevisibilidade dos custos. O segundo nível conta com um modelo local de maior porte, responsável pelo trabalho analítico principal: correlacionar eventos, testar hipóteses e reconstruir o cenário do incidente. Esse modelo também não gera custos por solicitação, mas tem capacidade limitada, o que pode causar gastos além do orçamento, sobrecargas e acúmulo de eventos em filas. Apenas casos excepcionais e realmente complexos são encaminhados a modelos avançados na nuvem, de preferência com a aprovação explícita de um analista. Nesse modelo, ainda há custos variáveis, mas eles ficam restritos a poucos casos. Cada encaminhamento é uma decisão consciente, e não uma consequência inesperada de um script executado durante a noite.

Na prática, essa abordagem reproduz o modelo clássico de SOC em vários níveis: a primeira linha faz a triagem, e a terceira conduz as investigações. A diferença é que essas funções são desempenhadas por modelos, e não por pessoas.

Meta’s new commercial terms say if its AI makes a mistake, it will legally be the customer’s fault

In Meta commercial terms changes slated to kick in on October 30, the company will shift the liability for any mistakes made by its AI models to its enterprise customers. The new language also makes those IT executives responsible for anything done by a partner or contractor.

The changes also finally put a stake into the heart of robots.txt, with Meta granting itself the right to grab, and use for its own purposes, any content associated with a Meta account.

The language allows Meta to “use automated software such as web scrapers, bots, robots, spiders, crawlers, and user agents and create test credentials to access, index, cache, analyze, collect, retrieve, or crawl the domains, web pages, or URLs, and any content available through them, that are associated with your products or services,” according to the new language on its website on Monday. Meta also wants to be able to “periodically pull updates from such domains, web pages, or URLs in order to provide, develop, improve, research, and maintain advertising and business products including business, commercial and related products to help you create and deliver ads and other commercial content.”

Consultants said the three biggest concerns they had about the changes were the web scraping, data ownership, and AI liability transfer.

Web scraping and data ownership

However, Meta emailed a statement to CIO.com late Monday suggesting that it was rethinking its position on web scraping. Saying that Meta wanted “to clarify” the web scraping changes, Emil Vazques, a Meta public affairs manager, said, “the crawling terms we consolidated only applied to our ads and business products and we’ve clarified that in the terms themselves. It does not change how Meta uses web crawlers. As always, content owners can use robots.txt to signal their preferences. This is not about scraping news sites, and these updates don’t give us new rights that supersede those preferences.”

As of Monday evening, New York time, the proposed document’s wording had yet to be altered to reflect this, but Vazques said that a change was coming soon.

The data ownership issue sets Meta apart from other AI vendors in that it wants to train its models on anything it encounters. Then again, the nature of Meta businesses focuses on advertising and would therefore be expected to seek more data control.

The new proposed phrasing, which Meta could alter before it takes effect later this month, said that using any Meta product grants Meta “a license to content that is covered by intellectual property rights like photos or videos you share, post, or upload on or in connection with our Meta Company Products. That license applies to content you or someone on your behalf, such as your agency that places an ad for you or your service provider that manages your Page content for you, makes available on or in connection with any Meta Company Products. Without limiting anything in our terms and for clarity, Meta may use such content … to provide, develop, improve, research, and maintain Meta Company Products.”

AI liability

But the change that prompted the most raised eyebrows involved AI liabilities. 

The proposed language said, “AI features may make mistakes and may not always produce accurate, complete, or suitable results,” and customers “are solely responsible for and assume any and all risks associated with such AI features and any resulting content.”

That AI clause, said Frank Dickson, principal analyst at Dickson Research, “turns accountability upside down. Meta builds the AI features, admits they ‘may make mistakes’ and then assigns ‘any and all risks’ to the business.”

Mike Wilkes, enterprise CISO at Aikido Security, agreed that the move is perplexing.

“The new AI provisions shift substantial responsibility for inaccurate or unsuitable outputs onto customers. That makes no sense,” he said. “As an example, the ASPCA is going to be liable for Meta creating unsuitable results when they ask Meta to create an image of a dog. Only Meta has control of the model being used to create that image. I see a very high flight risk among enterprise customers when platforms impose such onerous terms and conditions around content usage.”

The October 30 date that the US-based Meta chose is ironic. That is the day before Halloween, which is known as mischief night in the US, when children play pranks on their neighbors. Given that, Dickson said, the date for these changes is appropriate: “Meta is handing out the tricks and keeping the treats.” 

He added that the data grab is frightening. “What Meta wants is content: what a business posts, uploads, or shares on or in connection with Meta’s products,” he noted. “The trouble is the phrase ‘in connection with,’ which can stretch as far as Meta needs it to. The list of ‘Meta Company Products’ lives on a separate page that Meta can revise at will. The license grows every time that list does.”

And, Dickson noted: “Meta may use the content to ‘provide, develop, improve, research, and maintain’ its products. Those five verbs cover nearly everything a technology company does.”

‘Legal sophistry’

One of the obvious defensive measures for an enterprise is to sever all relations with Meta. But beyond the pragmatic difficulties of doing that, given the powerful market share enjoyed by Facebook, WhatsApp, Instagram and Threads, such a move may not even solve the problem. That is because Meta made other contract changes in July that make Meta licenses “perpetual” and that said, “this license survives termination of these terms by any party for any reason.”

That, said Noah Kenney, principal consultant at Digital 520, means that the “the general content license ends when content is deleted from Meta’s systems,” not when the enterprise ends a contract.

One additional twist to the new language is that Meta had recently tweaked it to no longer explicitly say that it would train it models on enterprise data. But Thomas Randall, a research director at Infotech, said that the wording change made by Meta amounted to legal sophistry. “The revised version drops the word ‘train’ and states that collection is just for developing and maintaining advertising and business products, alongside protecting Meta products’ integrity and security.”

But dropping the word “train” is “not a substantive fix,” he pointed out. “The revised terms are still flexible enough to cover most AI work. When combined with other aspects of the revised terms — continued use equals consent, broad indemnity, AS-IS disclaimer, and Meta’s freedom to discontinue products without notice or liability — this is a one-way street. The difference between ‘train Meta products’ and ‘developing and maintaining Meta products’ is a matter of how you pronounce tomato.”

Could force IT strategy changes

In addition, Aman Mahapatra, chief strategy officer for technology consulting firm Tribeca Softech, stressed that this contract could be an industry admission that robots.txt no longer delivers any meaningful protections. Agentic systems had already made robots.txt close to irrelevant. 

“October 30 ends a thirty-year assumption that robots.txt protects what you publish. It never did,” Mahapatra said. “It was a courtesy convention the web agreed to honor, and Meta’s own framing of robots.txt as a place for site owners to register preferences tells you exactly how it will be weighed against a signed contract.”

Mahapatra said the language in the new Meta commercial terms could force a significant change in IT strategy.

“‘On your behalf’ extends the license to whatever your agencies and vendors upload. ‘Associated’ extends the crawl to domains nobody has defined, including the ones where marketing pages sit beside product documentation, research, and investor materials,” Mahapatra said. “Most CIOs cannot tell me how many Meta pages, ad accounts, and WhatsApp numbers carry their brand, because marketing and agencies own them and IT never inventoried them.”

Attackers Abuse Stolen ConnectWise Application Credentials to Target Microsoft 365

Attackers stole ConnectWise application credentials to access Microsoft 365 tenants, prompting the company to suspend cloud services.

ConnectWise suspended its Cloud Backup service and took both SaaS Security and Cloud Management offline over the weekend after discovering that unknown attackers had obtained unauthorized access to seven of its application identities.

The company discovered the incident on October 14 through internal monitoring, disabled the compromised identities on October 17, and is still investigating how attackers obtained the credentials.

“We have taken protective action following unauthorized access to application identities associated with ConnectWise Cloud Backup, formerly known as SkyKick. Our investigation remains ongoing. Since implementing the mitigations described below, we have not observed successful threat activity in the environments we monitor.” reads the alert published by the company on October 17. “Out of an abundance of caution, we suspended Cloud Backup service by revoking certificates used for affected application connections across all users. This removed ConnectWise’s access through those connections. The shared credentials previously used for Cloud Backup are no longer valid and cannot be used. In addition to mobilizing our internal security teams and Security Operations Center (SOC), we have engaged a reputable third-party incident response firm to support our investigation and containment efforts. Together, these teams are actively monitoring our backup infrastructure and broader environment, with the investigation extending across all partner-facing services. At this time, we have no indication that any other ConnectWise product, service, or offering is impacted.”

This was not a case of attackers stealing individual customers’ passwords. ConnectWise’s applications already had permission to access customer Microsoft 365 environments to manage services and run backups. After stealing the application credentials, the attackers could pretend to be ConnectWise’s own applications and request access tokens from Microsoft Entra ID. They did not need to steal any customer passwords.

Depending on the permissions granted to these applications, the attackers could access mailboxes, SharePoint documents, Teams messages, and directory data. ConnectWise explained that disabling the affected connections prevents new authentication through those connections; however, it does not reverse changes previously made inside a tenant. In other words, disabling the compromised connections stops new access through them, but it does not undo what the attackers may have already done inside customer environments. Any changes made before the connections were disabled may remain.

Here’s what makes this particularly hard to clean up. An attacker who used a stolen application credential to get into a tenant could add their own client secret to a different trusted application already registered in that tenant, or create an entirely new application and grant it permissions. Either path gives them a second key that still works even after ConnectWise’s original compromised credential is revoked.

“The larger risk is what happens when that access is used to gain more. If an application can assign directory roles, as we saw in one tenant, it can make itself a Global Administrator, and an administrator can add credentials to other applications, create new applications and grant them permissions, reset passwords and authentication methods for users, and change Conditional Access policies.” reads the analysis published by cybersecurity firm Huntress. “Each of those steps gives the attacker another way back in that does not depend on the original vendor credential, which is why rotating the vendor credential is necessary, but not enough.”

Huntress identified malicious sign-ins from IP address 144.172.64.128 through October 15 at around 14:20 UTC, and a second targeted wave later that same day aimed specifically at 16 tenants in the policy, national security, trade, and critical minerals sectors. That second wave appeared to be manual rather than automated and hit Exchange Online, SharePoint Online, Teams, Azure Resource Manager, Entra, and Office 365 Management APIs in rapid succession. All 16 attempts in the second wave failed, but the fact that they were manually targeted at sensitive sectors is the detail worth sitting with.

Of about 1,000 Microsoft Entra tenants that recorded sign-in activity from the suspicious IP address, around 300 sign-ins were successful. However, a successful sign-in did not always give the attackers access to a tenant. In some cases, they could not proceed because the required service principal was missing. This was a result of the tenant’s configuration, not a security measure that had been deliberately put in place.

ConnectWise said its Cloud Backup archives remain encrypted, isolated, and preserved, with no evidence that attackers accessed or compromised them.

“Cloud Backup remains suspended. Scheduled backups are not running, and access to affected backup archives and restoration capabilities remains unavailable.” continues the ConnectWise’s alert.”Existing archives remain encrypted, isolated, and preserved. We have no evidence that these archives have been accessed.”

However, while the service remains offline, backups cannot run and customers cannot restore their data. This creates an operational risk for organizations that depend on the service to recover their systems and information.

Huntress’s recommendation for anyone using ConnectWise Cloud Backup or Cloud Management is to review both their own Microsoft 365 tenant and every managed customer tenant, including any with dormant SkyKick connections. Look specifically for sign-in activity from 144.172.64[.]128 starting October 13. Before doing anything else, preserve available sign-in and audit logs, because containment steps can overwrite the evidence you need to understand what actually happened.

The list of what to check is long: application credentials and federation trusts, directory role assignments, consent grants, recent policy changes, mailbox forwarding rules, and delegated mailbox access. Any of these could be the thing an attacker quietly added before the connection was killed. Full ConnectWise advisory and ongoing updates are available here.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, ConnectWise)

Firefox takes aim at the enterprise browser market

There’s growing talk of digital sovereignty as enterprises rethink past consolidation decisions made in the name of simplicity.

Mozilla, developer of Firefox, argues that a “very specific, very important layer” has been mostly missing from that conversation: The browser.

To that end, the company has unveiled Firefox Enterprise in a bid to diversify the browser engine to support privacy, control, and security.

The new offering combines the Firefox browser with a management console that enterprises can run on their own infrastructure using their own tooling. Companies get a full view of their data and can govern how it moves, and IT teams can manage policy, access, and set controls around AI use.

Firefox is already deployed across thousands of organizations and used by roughly 200 million people each month, Mozilla said. It is built on Mozilla’s independent Gecko engine, the only major browser engine developed outside Google and Apple.

“If all your options are built with the same technology underneath, ‘choice’ is a lie. So is control,” Mozilla CEO Anthony Enzor-DeMeo observed in the blog post announcing the product.

The promise of Firefox Enterprise

“Firefox is hardly the first browser vendor to offer an enterprise-optimized choice,” said independent technology analyst Carmi Levy. “But it carves out a unique value proposition for IT organizations intent on maintaining independent control over how browsers are deployed, configured, secured, and managed.”

Firefox Enterprise keeps core management within an organization’s own environment; its data, keys, telemetry, and policy remain in controlled boundaries that the organization can run on-premises and audit itself. IT teams can gate access and control policies based on user and device. They can also export browser events and audit activity in their SIEM, and native DLP helps prevent data loss.

Mozilla is particularly gearing Firefox Enterprise to organizations with strict security, governance, and compliance concerns. The offering can help enterprises meet regulatory requirements like the General Data Protection Regulation (GDPR), the Digital Operational Resilience Act (DORA), the NIS2 directive, ISO27001, and SOC2.

IT teams can set external connection controls, allow or block organization-wide add-ons, and restrict browsing with a lockdown mode “so one zero-day doesn’t take down every browser in the estate,” the announcement said. AI use can be allowed, restricted, or disabled. 

From a security standpoint, enterprises can set data loss prevention (DLP) rules by domain or action, and integrate with existing security information and event management (SIEM) tools like Trellix or Broadcom to extend analysis into the browser.

IT teams can protect against phishing, malware, and malicious sites with native isolation, extension control, and managed security updates. Access can be gated based on user and device, without the need for virtual private networks (VPNs), remote browser isolation (RBI), and virtual desktops.

The company said that it will use a subscription model “that doesn’t depend on monetizing customer data or forcing a roadmap.” Firefox Enterprise includes Firefox Professional support; for businesses running the free Firefox browser without Firefox Enterprise, Firefox Professional support is available as a paid subscription.

Firefox Enterprise is now being introduced in Europe, initially across France, Germany, Austria, and Switzerland, with more markets to follow. Mozilla is also developing Thunderbird Enterprise, which will manage Thunderbird email, calendar, and contacts.

The case for enterprise browsers

Largely thanks to the shift to cloud-based computing, the browser has evolved from a simple internet gateway to the place where most workers spend virtually all of their time. This makes them “the very epicenters of modern enterprise digital security,” said Levy.

Thus it makes sense for IT to consider the merits of a dedicated enterprise browser. But, Levy said, “there are no ideal solutions in IT, and enterprise-class browsers are no exception.”

Employees may bristle at additional layers of controls and raise privacy concerns around centralized monitoring. Administrative complexity is also a concern, as existing identity management, endpoint management, monitoring, and data protection tools may not always “cleanly integrate” with a more robust browser, he noted.

Enterprise-class browsers also can’t stop “less-than-ideally-trained employees” from clicking on phishing links, and they also can’t protect against “every last malicious extension.” As always, bad actors can find ways to compromise sensitive corporate data or otherwise use AI toolsets in unsanctioned ways.

But these types of browser can help minimize AI-related risks as employees lean more heavily into chatbots and agents. Admins can craft more flexible rules of engagement; for example, workers could access a web app for deep-dive analysis, but humans and AI alike could be prevented from copying data externally. Enterprise browsers also allow more granular control of AI features, and even disengagement if they conflict with policy.

Key differentiators

Firefox Enterprise isn’t the only option when choosing an enterprise browser, however. Microsoft Edge for Business would likely still be the preferred choice for environments already heavily invested in Microsoft’s enterprise Azure and Microsoft 365 ecosystem, Levy pointed out. Similar logic would apply to Google Chrome Enterprise’s appeal for those already committed to Google’s cloud and productivity infrastructure. And the Prisma Browser from Palo Alto Networks integrates aggressive cybersecurity tools with monitoring of AI use, remote devices, and unmanaged devices.

Firefox Enterprise’s key differentiation is its use of the Gecko browser engine, and its management console that can be deployed on a company’s own infrastructure, Levy said. This might make it a good fit for shops that want to minimize implementation disruptions to existing data management, access control, and compliance protocols.

“Firefox Enterprise lets customers craft their own deployment roadmap, assuming they have the skills and resources to self-manage the process,” Levy said.

This article originally appeared on Computerworld.

Google Adds Android Enterprise AI Controls: What IT Teams Can Manage

Google has announced new Android Enterprise policies for controlling AI automation, alongside stronger work-profile protections and additional device-management features.

The post Google Adds Android Enterprise AI Controls: What IT Teams Can Manage appeared first on TechRepublic.

Splunk Patches 22 Vulnerabilities, Including Critical Flaw With CVSS 9.8

Splunk Enterprise

Splunk has patched a large set of Splunk vulnerabilities in Splunk Enterprise, the most severe of which carries a CVSSv3.1 score of 9.8. The fixes are described in two advisories, SVD-2026-1001 and SVD-2026-1002, both published on October 7, 2026, and together they cover 22 CVE identifiers, CVE-2026-76264 through CVE-2026-76285.   A security bulletin issued on October 9, 2026, rated the overall risk as medium and warned that a remote attacker could exploit some of the flaws to achieve remote code execution, denial of service, elevation of privilege, security restriction bypass, sensitive information disclosure, and data manipulation. 

Splunk Enterprise Versions Affected 

Branch  Affected versions  Fixed version 
10.4  10.4.0 to 10.4.2  10.4.3 
10.2  10.2.0 to 10.2.6  10.2.7 
10.0  10.0.0 to 10.0.9  10.0.10 
9.4  9.4.0 to 9.4.14  9.4.15 

The Critical Patroni Flaw 

The top-rated issue, CVE-2026-76268 (CWE-306), stems from missing authentication in the Patroni REST API. On a search head cluster member running a version below 10.4.3 or 10.2.7, an unauthenticated attacker with network access to that interface could run operating-system commands, because critical configuration operations require no login. Versions 10.0.x and 9.4.x are not affected.   Organizations that do not use Edge Processor, OpAmp or SPL2 data pipelines can turn off the PostgreSQL sidecar by setting disabled = true in the [postgres] stanza of $SPLUNK_HOME/etc/system/local/server.conf, then restarting. 

Privilege Escalation and Secure Gateway Splunk Vulnerabilities 

CVE-2026-76266 (7.7, High) lets a local user who can run commands as the Splunk account plant content that a later Linux package upgrade executes as root. Upgrading with a tar file avoids the issue.  Three flaws hit Splunk Secure Gateway: CVE-2026-76265 (6.5) and CVE-2026-76272 (4.3) let non-admin users make it sign attacker-controlled payloads, while CVE-2026-76280 (6.3) allows writes to alert and mobile-device recipient data. They are fixed in Secure Gateway 3.10.11, 3.9.25 and 3.8.72. Admins who do not use Splunk Mobile, Spacebridge or Mission Control can disable the app instead. 

Data Exposure and Input Validation in Splunk Enterprise 

Several medium-severity bugs expose other users' data. CVE-2026-76269 (6.5) and CVE-2026-76275 (4.3) reveal other users' search jobs, CVE-2026-76270 (6.5) is a SQL injection in the SPL2 module catalog affecting only 10.4.x, and CVE-2026-76278 (4.3) leaks SPL2 module permission grants. CVE-2026-76274 (6.5), an SSRF, can disclose the Observability Cloud API token.  Others include log injection (CVE-2026-76267), a regex-based denial of service (CVE-2026-76271), source code leaking through source maps (CVE-2026-76276), collect command abuse (CVE-2026-76273, CVE-2026-76279), usernames ending in a period (CVE-2026-76277, 4.1) and scripted lookup edits by non-admins (CVE-2026-76264). 

Internally Identified Hardening Fixes 

Advisory SVD-2026-1002 groups internal findings by weakness class, scoring each CVE by its worst finding: CVE-2026-76281 (CWE-284, 9.8), CVE-2026-76284 (CWE-707, 9.0), CVE-2026-76282 (CWE-664, 8.8), CVE-2026-76283 (CWE-693, 7.6) and CVE-2026-76285 (CWE-710, 4.4). 

Fixing the Splunk Vulnerabilities 

Splunk advises upgrading Splunk Enterprise to 10.4.3, 10.2.7, 10.0.10 or 9.4.15, or later. CVE-2026-76264, CVE-2026-76265, CVE-2026-76272 and CVE-2026-76280 need extra steps. For CVE-2026-76264, admins should set scripted_lookup_raw_write_enforcement = block under [lookup] in limits.conf and restart. Where upgrading is not possible, removing run_collect from roles without internal-index access mitigates CVE-2026-76279.  Credited researchers include Gabriel Nitu of Splunk, Jean-Michel Remi Boudreau, Anton (therceman), M Mahdan Argya Syarif, Saidina Hikam, Alex Hordijk and Younes Zendour. 

Google wants to be the gatekeeper for enterprise AI agents

Google seems to be making a strategic play to control the AI infrastructure layer, not just roll out another shiny new agent.

At its Gemini at Work 2026 event this week, the tech giant unveiled what it calls a “single, universal agent” and API in Gemini that can be kicked off from a simple prompt box. Like other available agents, it is plugged into skills, tools, and enterprise systems, can answer questions, create media, and write and run code, return finished work via of documents, inboxes, and developer environments, and spin up sub-agents to help it do its job.

But Google isn’t just looking to go toe-to-toe with existing offerings, or trying to convince enterprises its models are qualitatively and quantitatively superior, said independent tech analyst Carmi Levy.

“Instead, it’s trying to establish itself as the gatekeeper of the new enterprise operating system, powered by whatever underlying model makes the most sense,” he said.

‘Omnipresent access,’ orchestration capabilities

Google says its Gemini agent works autonomously from a single interface, and can function as a personal assistant or team member, akin to a project manager or analyst. Coworker agents can perform tasks across days, sessions, and shifting responsibilities; they have dedicated identities, and are given their own @agents.company.com emails and persistent storage.

However, Google says, they only have access to specifically-defined data and channels. Enterprise-dictated security, governance, and cost controls are built-in.

“You give it objectives, not instructions,” Google Cloud CEO Thomas Kurian said in his keynote. “Work now starts in the prompt window.”

The agent runs in the cloud and has “omnipresent access,” meaning it can work on nearly any device, including iOS and Android phones or Windows and Mac desktops, he said. It can also be accessed through any channel, including command line interfaces (CLIs), Google Workspace, Microsoft 365, or Slack channels, and when integrated into third-party apps. When needed, it also works as a headless agent, or even without a dedicated user interface.

Working autonomously, the Gemini agent can spin up temporary or job-specific underlying agents and communicate and coordinate workflows with them to orchestrate multi-step tasks. These include parallel and sequential steps that might run for hours or days, Google said.

Notably, the agent is given the flexibility to choose which model should drive different workflows, to improve quality and reduce cost; right now, those models include the Gemini family and Claude, but Google says it will soon expand capabilities to other leading private and open models.

This is important because the leading model changes every few months, Kurian noted, and “the best model for the task is not always the largest one.”

Choice a ‘unique value proposition’

Mahmoud Ramin, a research director at Info-Tech Research Group, noted that Google’s announcement does not create a whole new category, since OpenAI, Anthropic, Microsoft, and Meta have already positioned multiagent capabilities in their platforms.

What is interesting with Gemini, though, is that not only can it operate directly in multiple Google products like Gmail, Drive, Sheets, and Slides, it also connects to external systems. It is, of course, a good fit for those already using the Google environment, he noted, and the strongest use cases are around repetitive tasks and information synthesis, such as that described in the research performed by project managers, analysts, and marketing specialists.

Levy agreed that Google’s unique value proposition revolves around choice. “It separates the agent from the underlying model, and allows enterprises to use whatever model makes sense for a given workload,” he said.

Its role-based agents are also “compellingly unique,” because they allow enterprises to create agents optimized for specific roles; meanwhile, more granular permission-setting addresses growing concerns about automated bots going off the rails.

While OpenAI and Microsoft have made similar claims, Google is “arguably leading the conversation around identity, audit trails, and who, or what, is ultimately responsible for workflows,” Levy said.

Google and others looking to be ‘gatekeepers’

As the AI industry pivots beyond mere chatbots toward its “inevitably agentic future,” the role of companies like Google, OpenAI, Anthropic, Microsoft, and others in the role of gatekeepers comes into sharper focus, Levy noted. The defining layer has shifted from operating systems to browsers, apps, cloud platforms, and now large language models (LLMs).

In the agentic rush, key players are racing to establish their role in enterprise workflow infrastructure. “The agent layer could be the ultimate prize of the AI era, and it largely explains why every vendor announcement seems to essentially claim the same thing,” Levy said.

But Google has to convince IT decision makers that its agentic roadmap is better than the competition’s; this means shifting the AI conversation to autonomy, rather than just basic tasks.

Like virtually every other vendor’s agent, Google’s Gemini agent can write an email, tweak a spreadsheet, and build a presentation. “However,” Levy said, “whether CIOs and CISOs can trust it to run mission critical business processes indefinitely without doing something stupid enough to generate damaging headlines is another story altogether.”

“Will enterprises care? If they’re already heavily invested in Google’s workplace stack, this could be an easier sell in the C-suite,” he noted.

Raising important governance questions

Info-Tech’s Ramin noted that whatever platform enterprises choose, the front-and-center focus going forward should be who controls AI agents.

“As organizations unleash the power of agent autonomy, it raises the pivotal and non-negotiable requirement of enforcing governance,” he said, noting that with basic AI systems, risk is “much more contained” compared to that of an autonomous agent that has access to multiple business systems and can communicate with other agents.

In the latter case, enterprises should significantly enforce guardrails, including permissions, identity, human oversight, and system audits, he said. They should “clearly outline which decisions the agent is allowed to make, what data should be accessed, and how performance will be monitored.”

This article originally appeared on Computerworld.

86,644 Firewalls in 194 Countries Breached With Stolen Passwords

FortiBleed

The FBI and the U.S. Secret Service (USSS) have issued a joint cybersecurity advisory warning organizations about FortiBleed, an active global credential-compromise campaign targeting internet-facing Fortinet FortiGate firewalls and SSL VPN gateways. The advisory, published on October 6, 2026, cites SOCRadar data verifying more than 86,644 compromised devices across 194 countries.

According to the advisory, the campaign exploits reused or leaked credentials and legacy SHA-256 password storage, allowing threat actors to harvest and crack authentication data at scale. Attackers continue to scan exposed Fortinet firewalls using previously obtained credentials, and some affected organizations have been locked out of their own systems.

How the FortiBleed Attack Chain Works

The operation's internal workflow came to light after the threat actors unintentionally exposed their own backend server. The open directory revealed a mature, multi-stage campaign run as an initial access broker operation.

Attackers first scanned the internet for exposed FortiGate SSL VPN portals using automated scripts. They then gathered credentials through credential stuffing and password spraying, drawing on prior Fortinet leak dumps and infostealer logs.

Password hashes taken from compromised devices were exfiltrated and fed into a GPU-accelerated cracking cluster running on rented infrastructure, where Hashcat and Hashtopolis ran distributed jobs to convert stolen data into plaintext credentials.

[caption id="attachment_114628" align="aligncenter" width="800"]FortiBleed Attack Chain Source: FBI[/caption]

Cracked credentials were then validated, with scripts filtering out honeypots, mapping organizations and ranking high-value targets by revenue and network structure. Attackers created new administrative accounts on firewalls to maintain persistence, then moved into victim networks to enumerate Active Directory and identify privileged accounts. The final stage involved selling access, including working VPN configurations and target lists, to downstream threat actors.

FortiBleed Lockouts and Ransomware Links

The advisory warns that victims may lose access to their Fortinet devices if attackers delete original accounts or change their passwords. In certain cases, threat actors removed existing accounts to block organizations from their devices while attempting lateral movement. Recovery may require steps beyond standard patching and password resets.

Reporting also indicates that initial access brokers using the FortiBleed attack chain have supplied access to ransomware affiliates, currently including INC/Lynx ransomware and Payload ransomware.

FortiBleed Indicators of Compromise

The agencies released indicators of compromise (IOCs) to help defenders review their environments. IP address 45.154.12.132 was observed as a command and control server, while 154.202.59.169 and 103.27.186.156 served as proxy nodes and 45.155.250.158 functioned as a beacon relay. The address 85.11.187.8 was linked to the Hashtopolis tool. The advisory also lists 13 IP addresses observed between June 18 and July 23, 2026, conducting brute force attacks or authenticating with compromised accounts.

Account names found on victim systems include adminin, fortiAdmin, forticloud-sync, fgtsecure, adminsslvpn, itadmin and roadmin. The agencies note that IP addresses may be reassigned over time and advise organizations to vet IOCs before acting on them.

Recommended Mitigations Against FortiBleed

The FBI and USSS recommend that organizations:

  • Restrict external management through trusted hosts, a local-in policy, or by removing internet administration entirely.
  • Terminate all active admin and VPN sessions and reset all Fortinet VPN and administrative passwords.
  • Enforce phishing-resistant MFA on all remote access and administrative accounts.
  • Review firewall and VPN configurations for unrecognized accounts and unauthorized changes.
  • Check firewall, VPN, authentication and domain controller logs for unusual access.
  • Use PBKDF2 to store administrator credentials and remove weaker legacy hashes, following Fortinet guidance for FortiOS v7.2.11 and later.
  • Review all REST API keys, remove unknown ones and refresh legitimate keys.

Organizations that detect a compromise are urged to isolate affected hosts, scope the intrusion and report incidents to the FBI's Internet Crime Complaint Center (IC3), a local FBI field office or a local USSS field office.

Tokenomics de cibersegurança: ataques de Denial of Wallet

Há pouco tempo, muitas empresas começaram a implementar agentes de IA em uma ampla variedade de fluxos de trabalho. Rapidamente, o custo de uso desses agentes se tornou uma questão urgente para as empresas. Além disso, a questão vai muito além do departamento financeiro. Além das preocupações orçamentárias, surgiram problemas de confiabilidade, estabilidade operacional e até de segurança da informação. Isso ocorre porque o custo de automatizar um mesmo processo varia significativamente entre implementações, é imprevisível e pode ser afetado por fatores externos.

Além disso, para um agente malicioso, qualquer processo automatizado com IA e vulnerável a influências externas é, na prática, um alvo conveniente para o “novo tipo de ataque DDoS”. Relatórios de erros de aplicativos, avaliações de produtos ou solicitações de suporte técnico podem, assim como qualquer outro dado externo processado pela empresa com IA, ser usados em um ataque para aumentar o consumo de tokens (fragmentos de palavras que são a unidade básica de entrada e saída de um LLM).

Um ano de crescimento explosivo… nas contas

Em 2026, grandes empresas gastaram pela primeira vez muito além do orçamento destinado a seus sistemas de IA. A Uber já havia gasto todo o orçamento anual até abril, enquanto uma empresa não identificada não definiu limites de gastos para o Claude e gastou US$ 500 milhões em um único mês. Embora os provedores de IA anunciem regularmente preços mais baixos e modelos mais eficientes, a transição de chatbots para sistemas agênticos que operam de forma contínua e autônoma aumenta o consumo de tokens em centenas ou milhares de vezes.  Ao mesmo tempo, o modelo de “assinatura fixa de US$ 20 ou US$ 100” para empresas é coisa do passado. Todos os principais provedores estão migrando clientes corporativos para o modelo de pagamento conforme o uso.

Como resultado, as empresas estão enfrentando um problema já conhecido pelos setores de armazenamento em nuvem e telecomunicações. Sem sistemas especializados de contabilização e gerenciamento de custos, uma organização só descobre quanto um determinado processo ou projeto custou depois de concluí-lo. Nos setores de telecomunicações e nuvem, esse problema acabou sendo resolvido com o desenvolvimento de sistemas sofisticados de faturamento, e os clientes desses setores até adotaram o termo especializado FinOps. No caso da IA, esse processo ainda está em estágio inicial. Além disso, a natureza probabilística da IA generativa torna esse problema ainda mais difícil de resolver.

Consumo imprevisível de tokens

Para entender por que os custos aumentam tão rapidamente e são tão difíceis de prever e controlar, precisamos lembrar como funciona um modelo de linguagem e o que o transforma em um agente de IA. O modelo não armazena informações de estado. Em outras palavras, não retém informações entre as interações. A cada nova etapa, todo o histórico de trabalho de uma determinada tarefa (o contexto) precisa ser reenviado ao modelo: o prompt inicial, o raciocínio anterior, o conteúdo dos arquivos lidos e as respostas de todas as ferramentas. A cada etapa, essa “recapitulação” fica mais longa, especialmente se a tarefa envolver loops iterativos. Se uma etapa falhar, a resposta não for clara ou uma ferramenta retornar um erro, o agente simplesmente tenta novamente, aumentando ainda mais o tamanho do contexto. E, se a tarefa for executada por vários agentes, que dividem o trabalho entre si e trocam resultados, esse volume aumenta proporcionalmente ao número de agentes. Como resultado, o consumo de tokens não aumenta gradualmente, mas em saltos, e é quase impossível prevê-lo no início da tarefa.

Ao executar duas sessões diferentes de um agente de IA para resolver exatamente a mesma tarefa (dois tíquetes de suporte técnico, duas tarefas de análise e assim por diante), a quantidade de tokens consumidos pode variar. A diferença pode chegar a 30 (!) vezes. Isso depende do número de etapas, erros e tentativas necessárias para concluir a tarefa. O aumento do consumo de recursos não depende necessariamente da complexidade da tarefa. Há casos conhecidos em que a IA ficou presa em um “loop de raciocínio” e desperdiçou uma quantidade absurda de recursos em tarefas triviais.

Três gerações de IA em sistemas corporativos consomem recursos de maneiras completamente diferentes:

  • Machine learning clássico (ML). Normalmente, trabalha com dados bem estruturados e não exige muitos recursos computacionais. O consumo de recursos é previsível e baixo. É um item de orçamento fixo;
  • Um chatbot ou outro assistente de IA baseado em LLM. Ele consome tokens, mas o ritmo é definido por uma pessoa: o funcionário inicia a tarefa manualmente, avalia o resultado e interrompe o processo. O custo aumenta aproximadamente de acordo com o número de usuários ativos e pode ser estimado com base no número de licenças;
  • Um agente autônomo de IA. Uma pessoa define um objetivo e deixa o sistema trabalhar sozinho. O próprio sistema decide o que fazer e quantas etapas são necessárias. O custo continua aumentando até que a tarefa seja considerada concluída, sem um limite previsível.

Tokenomics em ataques: Denial of Wallet, o novo DDoS

Como as chamadas a LLMs são significativamente mais caras que as chamadas de software convencionais, automatizar tarefas corporativas rotineiras pode sair muito caro. Por exemplo, o Gartner estima que resolver uma única solicitação de suporte ao cliente usando um LLM custa aproximadamente US$ 3. É fácil imaginar como invasores poderiam bombardear uma empresa com milhares de solicitações longas e sofisticadas geradas por um LLM barato, causando um prejuízo financeiro significativo. Como o processo é automatizado, as anomalias podem não ser detectadas imediatamente.

Se um invasor souber qual sistema de agentes e qual LLM são usados em um processo de negócios, poderá realizar um ataque mais preciso e causar danos significativamente maiores. Os autores do estudo GitInject estimaram que um invasor capaz de criar incidentes no GitHub em uma organização que usa agentes de IA para análise de erros pode, com um único ataque (antes da ação dos mecanismos de defesa do GitHub), causar até US$ 111 em prejuízos e consumir 400 minutos do GitHub Actions da conta da vítima. Naturalmente, esse ataque pode ser repetido várias vezes, sem nenhum custo para o invasor.

O maior risco, embora seja difícil quantificá-lo em termos financeiros, vem de ataques que induzem os LLMs a um raciocínio excessivo. No artigo OverThink, os autores demonstraram como uma tarefa formulada de maneira inofensiva, quando enviada a um modelo de linguagem, produz um resultado correto, mas, nesse processo, consome 46 (!) vezes mais tokens do que deveria. Além disso, todas as tarefas testadas pelos pesquisadores passaram pelos filtros de segurança existentes.

Na nova versão do guia OWASP Top Risks for Language Models, esse problema alcançou a mais alta prioridade já registrada: o consumo ilimitado de tokens agora é classificado como LLM06:2026 e, entre suas variantes, o ataque de “denial of wallet” (negação de carteira), que esgota o orçamento da vítima para o uso de LLMs, é explicitamente destacado.

Como evitar ser vítima do “novo DDoS”

Antes de tudo, é preciso abandonar o princípio de “usar IA só por usar IA”. Não faz sentido delegar todas as tarefas a agentes autônomos. É recomendável analisar periodicamente o custo-benefício do uso de inteligência artificial.

Além disso, você deve limitar as permissões e o conjunto de ferramentas disponíveis para um agente autônomo de IA. Quanto menos ações o sistema puder executar, mais eficiente será em tarefas específicas, menos oportunidades terá de aumentar os custos e menor será a chance de alguém conseguir “manipulá-lo” para gastar tokens desnecessariamente.

Também recomendamos definir limites rígidos para o consumo de tokens e configurar um sistema de notificações para alertar as pessoas quando esses limites forem ultrapassados. Também é recomendável definir vários limites simultaneamente: por tarefa, por dia e assim por diante. Os alertas de limite excedido devem ser enviados imediatamente ao especialista responsável pelo sistema, para que ele decida se o processo deve continuar ou ser interrompido.

Verifique rigorosamente os dados externos não confiáveis. Qualquer informação processada pela IA que venha de fontes externas, como solicitações, consultas, mensagens, comentários ou campos técnicos que possam conter texto arbitrário (registros DNS, cabeçalhos HTTP, nomes de arquivos), pode não apenas levar à injeção de prompt, mas também aumentar deliberadamente a carga de trabalho. É recomendável limitar o tamanho desses dados e monitorar a carga que geram.

Calcule o custo unitário do trabalho e compare as faturas do fornecedor com seus próprios dados. O custo por análise, solicitação ou verificação é a única maneira de entender pelo que você está pagando e identificar erros nas faturas.

Despite ShinyHunters arrests after FBI jobs data breach, enterprises still have no answers about PeopleSoft risks

The theft of FBI employee data by hacking group ShinyHunters, and the subsequent shutdown of the FBI’s Peoplesoft-based jobs portal, is causing concern for enterprise users of the Oracle product, with analysts recommending extreme measures in response.

Law enforcement has made some progress in its pursuit of the cyber criminals involved, but there has still been no official word from either the FBI or Oracle about Peoplesoft’s alleged involvement.

On Saturday, Reuters reported that a suspected member of ShinyHunters had been arrested in Jordan and has been cooperating with law enforcement to help identify other member of the group. The arrest comes a week after the arrest of another suspected ShinyHunters member by the Dutch National Police. In a video about that arrest, an FBI official warned gang members that arrests have a way of changing who is willing to talk, concluding, “You know how to find us, and we know how to find you.” Before the arrests, the gang told The Register it had discovered a new PeopleSoft zero-day hole and leveraged it to break into an FBI system, stealing information on all FBI employees. The FBI has since confirmed the breach without providing details.

This wouldn’t be the first flaw ShinyHunters had found in PeopleSoft. It discovered a PeopleSoft zero-day hole in June that resulted in a flurry of extortion attempts, long after Oracle said it had patched the bugs.

Oracle did not respond to a request for comment on the alleged new vulnerability.

Significant risk exposure for enterprises

Analysts and consultants played up the risk exposure from the potentially new vulnerability even as they sharply played down the implications of the arrest.

Frank Dickson, principal analyst at Dickson Research, recommended that PeopleSoft users take immediate action.

“If it is a new flaw, the patch is necessary but not sufficient. PeopleSoft customers should pull the Environment Management Hub and the Integration Broker off the public internet,” he said. “Doing so does not break normal user sessions.”

He also encouraged users to quickly implement many of the recommendations from Google unit Mandiant’s report late last month on PeopleSoft security issues, especially “hunting for the web shells and outbound traffic Mandiant describes.”

“For PeopleSoft shops, the to-do list is short,” Dickson said. “Apply Oracle’s patch. Disable or remove the Environment Management Hub if you do not use it. Search your logs for encoded variants of the PSEMHUB path, not just the literal string. If you find a web shell, treat the server as compromised and rotate every credential it could read.”

This is a dangerous situation, he said: “An unpatched PeopleSoft flaw is a Sword of Damocles over every PeopleSoft shop

But despite the extreme risk, even after the patch was released, rather than applying it, some organizations have opted for other mitigations. “Many organizations chose to block the vulnerable endpoint with web application firewall rules rather than patch,” Dickson said. “The attackers walked past those rules by changing a single character in the web address, writing ‘%50’ in place of the letter ‘P.’”

Could signal a bigger problem

However, IDC Research Director Philip Harris encouraged CISOs to view the FBI’s confirmation of its breach with caution, given the attack vector was not revealed.

“ShinyHunters says it used a second, previously undocumented PeopleSoft preauth RCE zero-day, distinct from the CVE-2026-35273 flaw exploited in the earlier campaign,” he said. Yet, he pointed out, “no CVE has been assigned to it, it has not appeared on CISA’s Known Exploited Vulnerabilities catalog and Oracle has not commented on it. Every outlet covering this is explicit that the zero-day claim comes only from the threat actor, not from independent forensic confirmation or from Oracle. That distinction matters.”

But if the hole is as the group has suggested, Harris said it signals a much bigger problem.

“Assuming it is real, this would mean PeopleSoft has a second critical, unpatched preauth RCE in the same window as CVE-2026-35273, a pattern of recurring critical exposure rather than one isolated bug,” he said. “ShinyHunters’ own claim that they are already using it against other, unnamed Fortune 500 targets would mean every PeopleSoft customer is currently exposed to an unpatchable, undisclosed flaw with no vendor guidance to act on, a meaningfully worse position than the WAF-bypass story, since there is no mitigation to attempt while waiting on Oracle to confirm something it has not acknowledged.”

Jeff Valdes, a director at consulting firm Acceligence, added that Oracle’s silence is unwarranted.

“I think customers reasonably want more communication from the vendor,” he said. “They want to understand whether Oracle’s original guidance remains sufficient, whether there are additional mitigations customers should implement, whether Oracle is seeing anything through its own support organization that changes the risk picture, and whether there are configurations or architectural choices that materially increase exposure. Those are operational security questions that can be addressed without discussing attribution, arrests, investigative techniques or anything else that might interfere with an FBI investigation.”

This article originally appeared on CSOonline.

OpenAI bets enterprises are ready to delegate real work to autonomous agents

OpenAI says true agentic AI has finally arrived, pushing beyond the trivial capabilities of early-stage virtual assistants.

This week at OpenAI Dev Day, the company introduced Dots, which CEO Sam Altman described as “remarkably capable, always-on” agents powered by GPT‑6 Astra. Dots have their own cloud computer, can be accessed in ChatGPT, Slack, or Teams, and plug into more than 4,000 apps based on human-set boundaries.

In a keynote, Altman said using it will feel like “a whole new way to work with AI.”

“It can hugely magnify your ability and expand your potential, working 24/7 to take on things that you don’t want to do, so you can focus on higher-level work,” he said.

OpenAI also announced a slew of other new capabilities and tools, including GPT-6.1 Sol, a cheaper and faster sibling of GPT-6.1 Astra, which was shelved earlier this week due to safety concerns. Additionally, Codex is also now in the cloud, Codex CLI has voice control and can help developers inspect, edit, and run code locally, and a new Agents API supports computer use and provides components like harnesses, hosting, memory, and multi-agent controls.

Dots goes beyond ‘trivial’ tasks

Early virtual assistants have been useful for quick handoff tasks like booking reservations, but that is “trivial relative to what the technology can do,” Altman contended in his keynote.

Taking that to the next level, OpenAI’s new Dots can understand what’s happening in a user’s workflows and learns over time without requiring constant human instruction, he explained. Soon, users will be able to access Dots outside ChatGPT by interacting with it through text messages or even by calling the agents on the phone to discuss updates, changes, and weigh in on decision-making.

“You can delegate ambitious pieces of work the way you would to a high agency engineer or a chief of staff,” Altman said. Dots can monitor incoming bug reports and propose fixes, draft pull requests (PRs), or take on tasks like kicking off the next year’s budget planning cycle.

Altman provided the example of migrating an app off a legacy API. This can be difficult, because the API might be used all over a code base, he said, and it could break as developers start making changes. But Dots can trace dependencies and determine what needs to change, run tests, and suggest next steps.

“Think about how you would have done that the old way,” Altman noted. “How many people would have been involved? How much time would it have taken them? What could they have done instead?”

Dots is now available to all ChatGPT Pro, Business Premium, and Enterprise users. OpenAI is also now previewing specialist Dots for enterprises, and is working with Microsoft to integrate Dots into Agent 365. These will serve as virtual teammates to help scale more intensive work in accounting, marketing, or legal, Altman explained.

Carmi Levy, an independent technology analyst, said of everything announced at DevDay 2026, Dots might be the most impactful, as it represents OpenAI’s definitive move into AI agents.

While Meta has been grabbing headlines with its app store-topping Muse, OpenAI’s offering is potentially more relevant to enterprise decision makers who are still trying to figure out how agents can fit into their corporate AI development and deployment roadmap, he noted.

“It allows enterprise customers to build on their pre-existing investments in OpenAI’s stack, and represents a familiar adoption path for developers,” he said.

Cheaper and faster sibling of Astra

OpenAI launched GPT-6 Astra to a limited group of users earlier this month, calling it state-of-the-art in computer use, browsing, software engineering, cybersecurity, science, and professional work. But its generally availability was canceled this week after the model failed critical internal safety and alignment tests.

OpenAI learned from the experiment, Altman said, with early testers demanding: “make it cheaper and make it faster.” The answer to that is GPT 6.1 Sol, which provides near Astra level intelligence at one-fifth of the price. Cached inputs cost $0.10 (US) per million tokens, 95% less than standard input pricing. This makes it cheaper for agents to work through longer tasks, reuse context, and ruminate on solutions. Example uses include multi-step business workflows, code writing and debugging, and document analysis.

GPT 6.1 Sol is “smarter than Astra in some ways, and it will become your daily workhorse,” Altman said. It is now available to all Plus, Pro, Business, Enterprise, and Edu users of ChatGPT Work and Codex, and will soon be offered in an ‘Ultrafast’ plan, with up to 8X faster token generation.

Levy noted that GPT 6.1 Sol reduces the cost curve for enterprises looking to deploy AI agents at scale, all while “avoiding some of the privacy/safety/integrity baggage of the now-stillborn GPT 6.1 Astra.” It effectively shifts the economics of AI agents by dropping the price of resource-intensive development activities like querying repositories, running tests, and iterating code.

“It doesn’t have quite the power of Astra, but that was never what the average developer was looking for, anyway,” Levy noted. “Affordability still drives development decisions, and by leading with Sol, OpenAI removes one more barrier to broad-based adoption.”

New Codex capabilities, assurances around safety

In a much-anticipated move, OpenAI has introduced Codex Cloud, giving developers the ability to move coding tasks between devices without losing threads. “You don’t have to worry about closing your laptop in the middle of a run,” Altman said. “Your agents just keep working, wherever you are.”

Meanwhile, new Codex CLI capabilities allow developers to start, steer, delegate, and track tasks with voice commands, and a new Codex Security Cloud helps defenders identify vulnerabilities and prepare fixes.

Altman addressed the top-of-mind security and governance issue in his keynote. “The best version of AI is not about making people cogs in a giant machine,” he said, noting that there are some things that should not be automated.

“People often talk about AI as a new industrial revolution. I find that quite off-putting,” Altman said. “The future, if we get this right, can be much more like a new renaissance than a new industrial revolution.”

This article originally appeared on InfoWorld.

Meta’s next big AI bet is enterprise; its biggest hurdle may be trust

Meta is once again repositioning itself to target the enterprise market.

This week, the company announced the Meta Enterprise Platform, which it says will evolve its AI stack into products and services that enterprises can deploy into operations, rather than just using them for advertising and social media campaigns.

While the company provided few details about the offering, Meta CEO Mark Zuckerberg called the platform “the next major pillar” of its business, saying it will feature a connected suite of products including Muse agent, Meta Business Agent, Muse API, and Muse Code.

MongoDB’s Chirantan “CJ” Desai will step in as chief enterprise platform officer to lead the effort.

The question is whether this endeavor, once fully launched, will be more lasting than Meta’s previous attempts in the enterprise.

“The issue of trust remains,” said Armaan Sandhu, research analyst in the AI practice at Info-Tech Research Group.

The shutdown of previous products like Workplace and Horizon Workrooms indicate that Meta tends to “abandon the enterprise products as soon as its vision of the future changes,” he said. “Companies will therefore require hard evidence that Meta will stick to its future plans and continue investing in their development.”

Meta’s growing AI ambitions

Meta has been working to reorganize its AI efforts since founding its Meta Superintelligence Lab in 2025. Muse Spark was the first new model to come out of that initiative; launched in April 2026, the agent supports multimodal inputs, multiple reasoning modes, and can spin up sub-agents in parallel to handle more complex tasks.

Next, Meta Business Agent, launched in June, directly targets enterprises, providing them with AI assistants to automate customer interactions, support sales, and drive leads across platforms including WhatsApp, Messenger, and Instagram. The company followed that up with Muse Agent, an autonomous business and personal agent that can handle multi-step background tasks.

Muse Code is designed to handle complex software workflows across large codebases, while Muse API gives developers direct access to the Muse AI stack.

Abandoned efforts

However, Meta has so far struggled to gain a strong foothold in the enterprise market, and in some cases has abandoned previous attempts after they failed to take off.

For instance, Workplace, launched in 2016, supported communication and information sharing across organizations, but Meta announced in 2024 that the service would be discontinued, even as it reported millions of users. After a 10-year run, Workplace officially shut down in May 2026.

Then there are the company’s virtual reality efforts, including Horizon Workrooms, a collaboration app used with Quest headsets. It was offered for five years before being retired in February 2026.

Different positioning

But the company is positioning Meta Enterprise Platform differently; it will play on strengths that “few other companies have” and leverage its experience connecting millions of businesses and customers, Zuckerberg said, touting the company’s “advanced models, leading agents, large-scale infrastructure, and years of working closely with many businesses.”

However, noted Info-Tech’s Sandhu, Meta’s key advantage is not its technology; rivals such as Microsoft, Google, Amazon, and Salesforce also offer capable models and agents. Its differentiator is that it owns the platforms where users familiarize themselves with brands, interact with businesses, and make purchases. Meta can therefore link advertising, customer discovery, messaging, service, and commerce through AI agents running across WhatsApp, Instagram, and Messenger.

“Few rival companies can boast of such an effective combination of AI and access to customer channels,” Sandhu said.

Enterprise appeal may not be there

Still, Meta has challenges to overcome as it seeks to compete with well-entrenched tech giants and move beyond its consumer market origins.

Said independent technology analyst Carmi Levy, “It’s difficult to understand the appeal to enterprises, as Meta has never been known as a significant player in the enterprise market.”

Its data stewardship track record is also “somewhat checkered,” he pointed out, citing the infamous Cambridge Analytica scandal that Meta is now answering for, as well as a number of other high-profile data stewardship and privacy cases in the US and UK.

He contended that the company’s core competency revolves around harvesting data to fuel growth, hardly a desirable trait in the enterprise space. Workplace “never quite realized its early promise,” and it’s unclear whether the Meta Enterprise Platform will suffer the same fate.

“Time and again, Meta’s behavior betrays its inability to craft the kind of iron-clad enterprise-grade infrastructure and organizational competency that corporate decision makers value,” he said, noting that even if its offerings were years ahead of the competition, these trust issues should give buyers pause.

In addition, Meta Enterprise Platform loosely ties together a host of offerings originally released into the mass consumer market, yet positions Muse as the pillar of its future enterprise strategy, he pointed out. If anything, Muse’s “early teething troubles,” including privacy violations and serious zero-day vulnerabilities, should be the only warning enterprise buyers need.

If Meta did manage to turn a consumer-architected collection of offerings into something somewhat more enterprise-ready, its “indifferent level of commitment” to earlier enterprise offerings raises the question of whether it intends to support such a platform well into the future. “If the commitment isn’t there, neither is the trust,” Levy added.

However, if enterprises do decide to evaluate the product, Sandhu advised that they pay attention to pricing, integration with other systems, and technical features. And initially, they should choose a narrow field of application, “with the goal of maximum benefit without making this technology a company’s key system.”

❌