On-Premises vs Cloud: Definitions, Use Cases, and Decision Guide

Trying to understand when on-premises makes sense and when the cloud is the better fit? Our latest article explains both models, their strengths, key differences, and a simple framework for deciding where each workload should run.

The “cloud is always the answer” narrative is cracking. While cloud adoption remains massive, the industry has moved past the initial hype phase into a more pragmatic era. We are now seeing a trend of “cloud repatriation” – moving specific, high-cost workloads back to owned hardware.

This tension creates a difficult choice for IT leaders. Do you keep owning and operating your own infrastructure, or do you move workloads into subscription services? This guide cuts through the noise to help you decide based on your specific financial and operational constraints.

What is on-premises computing?

On-premises computing is a model where an organization owns and operates its own hardware, storage, networking, and software in a private facility or colocation space, instead of consuming these as services from a cloud provider.

Figure 1: On-premises computing simple scheme

In practice, that means:

1. Servers physically sit in your racks.
2. Your team installs and manages OSs, hypervisors, databases, and line-of-business applications.
3. Security, physical access, backups, and disaster recovery are handled by your processes, on your sites.

This level of ownership and control is especially important in sectors like finance, healthcare, and government, where data privacy, residency, and auditability are non-negotiable. You decide where data lives, who can walk into the data hall, how encryption and key management work, and what your incident response looks like.

Economically, on-premises is usually CapEx-heavy at the start: you pay for servers, storage arrays, networking gear, software licenses, and support upfront, then carry ongoing costs for power, cooling, space, and IT staff. For stable, long-lived workloads that can still produce a very attractive total cost of ownership over a 3-5-year horizon.

Even for small datasets (~30GB), on-premises requires careful planning for backups, hardware maintenance, and disaster recovery, which can outweigh the apparent simplicity of “just a single server” or a high-spec laptop.

The upside is predictable performance and tight data locality. The trade-off is that every new project competes with existing capacity until the next hardware refresh comes through procurement and change control.

What is cloud computing?

Cloud computing is a model where compute, storage, databases, networking, analytics, and software are delivered over the internet from provider data centers, on a subscription or pay-as-you-go basis.

Figure 2: Cloud computing simple scheme

Instead of racking physical servers, you work with virtual machines, containers, object and block storage, managed databases, serverless functions, and SaaS applications exposed through APIs and management consoles.

The spending model shifts from large capital purchases to operational expenditure: you pay monthly for the resources you provision and use, rather than committing to multi-year hardware investments upfront. The infrastructure underneath is operated by the cloud provider, which takes care of the physical data centers and core platform, while you remain responsible for identities, configuration, application security, and a significant portion of compliance and governance.

The cloud has effectively become the default platform for AI experiments, big data initiatives, CI/CD-heavy development, and global SaaS offerings. It is far easier to bolt on a managed GPU cluster, a streaming pipeline, or a globally replicated database in the cloud than to design, buy, and run the equivalent stack entirely in your own server room.

Core differences: Funding, staffing, and physics

The debate often collapses into a few dimensions: funding models, staffing, and control.

Funding and cash flow

This is the most overlooked factor. The cloud is great for organizations with steady revenue (like SaaS companies) because costs scale with growth. However, for organizations funded by government grants or research allocations (STEM, Healthcare, Academia), the cloud can be a disaster. Grants are often «feast or famine». You might have a «good year» with funding, followed by a «bad year» with cuts. You cannot pay a variable AWS bill during a bad year. In these cases, spending CapEx upfront to buy hardware is a survival strategy; it ensures the compute is «free» to use when funding dries up.

Staffing and maintenance

Managing hardware takes time. If your organization has one or fewer full-time IT people, the cloud usually wins. A single sysadmin cannot effectively manage patches, backups, firewalls, and physical hardware failures without burning out. The cloud allows small teams to outsource the physical layer.

The physics of latency

Distance equals latency. If you run a factory floor with robotic arms needing millisecond response times, you cannot wait for a signal to travel to a cloud region and back. On-premises infrastructure is the only way to guarantee the low latency required for industrial control systems or high-frequency trading.

Use cases for on-premises

Despite the hype around public cloud, on-premises keeps a strong foothold where risk, regulation, or physics set hard constraints.

Financial services

A regional US bank might keep its core payment processing platform in its own data center. Transaction processing systems and their primary databases stay on-premises to satisfy stringent audit requirements and latency budgets. Customer mobile apps, marketing sites, and some reporting functions run in the cloud, but the transaction engine itself sits in a tightly controlled, low-latency cluster.

Healthcare

A large hospital network can host electronic health record systems and PACS/medical imaging archives on-premises. These systems need to function even if external connectivity degrades. The cloud is still used for anonymized analytics, research workloads, and patient portals, but the system of record remains in the hospital’s data center.

Defense and public sector

Where export controls, secrecy, and critical infrastructure are involved, the requirements for segmentation, supply-chain control, and physical security push many workloads toward on-premises or highly restricted private cloud.

Manufacturing and industrial operations

A factory that relies on MES (Manufacturing Execution System) and SCADA (Supervisory Control and Data Acquisition) systems often runs latency-sensitive control and monitoring workloads on local clusters close to the shop floor. Here, deterministic response times and integration with industrial equipment matter more than the elegance of the architecture.

Whenever data is highly sensitive, latency requirements are strict, and workloads are relatively stable over time, on-premises still fits extremely well.

Use cases for cloud

The cloud wins where flexibility, speed of change, or global reach matter more than deep hardware control.

Fast-growing startups and SaaS vendors

A product-led company building a SaaS platform usually can’t afford to spend six months designing a data center. It spins up infrastructure in the cloud, uses managed databases and Kubernetes, stores assets in object storage, and hooks in managed logging and monitoring. Landing a large customer often means turning a few dials, not buying another rack.

Distributed and hybrid workforces

Organizations with employees spread across states or continents use cloud-based identity, collaboration tools, and line-of-business applications to avoid central VPN bottlenecks. Access policies follow users; the data lives in regional services rather than a single «headquarters» LAN.

AI, analytics, and experimentation

Training models, building streaming analytics, and crunching logs at scale are classic cloud use cases. GPU capacity, managed ML platforms, streaming engines, and large-scale warehouses are available on demand. Teams can turn an idea into a production pipeline in weeks instead of waiting on specialized hardware purchases and long internal projects.

Global digital services

Game platforms, SaaS tools, and media services rely on cloud regions and CDNs to deliver acceptable latency across continents. Instead of opening new data centers per country, they replicate stacks into nearby cloud regions and let the provider handle much of the physical footprint.

If the main priorities are time-to-market, fast iteration, and the ability to scale up and down as demand shifts, the cloud is often the more pragmatic starting point.

On-premises vs cloud

The strengths of each model become clearer when you look at specific workload profiles instead of trying to crown a universal winner.

On-premises environments provide full control, consistent performance, and tight data boundaries. You know exactly where data lives, who can access the building, and how traffic flows between systems. For regulated, latency-sensitive, and stable workloads, on-prem can offer both lower risk and attractive long-term economics, especially if you keep utilization high and refresh cycles disciplined.

Cloud environments offer agility, elasticity, and access to higher-level services. Teams don’t wait for hardware to arrive to test a new feature. They spin up a stack, validate the idea, and tear it down. For workloads with bursty traffic, frequent changes, global user bases, or heavy use of analytics and AI, the cloud’s flexibility often more than justifies the ongoing cost.

In most organizations, the real benefit comes from combining both approaches: keep the «crown jewels» and cost-sensitive cores on infrastructure you control, and run elastic, experimental, or globally exposed workloads in the cloud.

Considerations for on-premises deployment

Choosing to stay on-premises or to refresh a data center footprint in 2026 pulls in several operational concerns that are easy to underestimate.

Refresh cycles

Servers and storage have a finite useful life. Many organizations aim for 3-5-year refresh cycles for performance, warranty, and support reasons. That means regular migration projects, capacity planning, and budget spikes instead of a flat monthly bill.

Power, cooling, and sustainability

Energy costs and sustainability reporting keep climbing up the priority list. Hardware that looked cheap years ago might be more expensive than you think once electricity, cooling, and downtime from thermal issues are factored in.

Physical security and resilience

Access control, CCTV, cages, fire suppression, dual power feeds, and redundant uplinks don’t manage themselves. In areas prone to natural disasters, site selection and geographic redundancy become part of the equation too.

The upside is custom security and strict data locality. You define encryption, segmentation, key management, and logging exactly the way your regulators and risk teams want them. For heavily regulated industries, this can simplify audits and reduce surprises.

For steady, high-utilization workloads, a well-run on-premises environment can still deliver a lower and more predictable total cost of ownership than a fleet of 24/7 cloud instances doing the same job.

Considerations for cloud deployment

Moving workloads into the cloud trades some problems for others.

Cost management

Without clear ownership and guardrails, cloud bills tend to grow faster than anyone’s ability to explain them. Always-on instances, oversized clusters, forgotten test environments, inter-region traffic, and data egress add up quickly. That’s why more and more organizations build dedicated FinOps practices to right-size resources, set budgets, and maintain visibility across teams.

Vendor dependence and multi-cloud

To avoid deep lock-in, many enterprises spread workloads across multiple cloud providers or mix public and private clouds. That reduces reliance on any single platform but increases operational complexity. Network design, identity, observability, and security policy have to work across several stacks, not just one.

Security and compliance

Cloud platforms provide strong primitives: encryption, IAM, logging, and compliance tooling. Misconfigurations still cause many of the real incidents. An accidentally public storage bucket, an overly permissive role, or a missing control plane audit log can undo years of policy work in one bad change. Regulated data (health, finance, government) needs additional attention to shared responsibility, data locality, and configuration drift.

So, the cloud isn’t «cheap and simple». It’s flexible and powerful, but it assumes you have architecture, automation, cost management, and security practices that are good enough to handle that flexibility. A blind lift-and-shift doesn’t fix technical debt. It just moves it into a different data center.

The repatriation trend

For the last decade, the migration flow was one-way: on-premises to cloud. We are now seeing a correction known as “cloud repatriation”.

Organizations that executed a “lift and shift” strategy, moving virtual machines directly to the cloud without refactoring them, are finding that the cloud is significantly more expensive than their old data center for steady-state workloads.

The main driver of cloud repatriation is economic rationalization. Companies like Dropbox and 37signals (Basecamp) famously moved storage-heavy and compute-heavy workloads back to owned hardware, saving millions annually.

Signs you should repatriate a workload:

• The bill is stable but high: You are paying for 24/7 compute capacity that rarely changes.
• Data egress is hurting you: You are paying massive fees just to move data out of the cloud to your users or partners.
• Performance variability: You are suffering from “noisy neighbor” issues on shared public cloud hardware.

Conclusions: The portfolio approach

The “on-premises vs. cloud” debate is a false dichotomy. It assumes you must pick a side.

Successful IT leaders treat infrastructure like an investment portfolio. You don’t put 100% of your retirement savings into a single volatile stock, nor do you keep it all in low-yield cash. You diversify based on risk and return.

• “Bonds”: On-premises hardware. It’s boring, stable, and offers a predictable, low cost for your core, unchanging workloads.
• “Stocks”: Public cloud. It’s volatile and usage-based, but it offers infinite upside for growth, experimentation, and customer-facing agility.

Don’t search for a universal winner. Audit your workloads. If a system is static and heavy, rack a server. If a system is dynamic and experimental, rent the cloud. The best architecture isn’t one or the other, but rather the bridge between them.

from StarWind Blog https://ift.tt/KSun2rT
via IFTTT

Executive Perspectives: ShapeBlue Leadership Talks: An Interview with Ivet Petrova, Marketing Director of ShapeBlue

Who is Ivet Petrova?

Marketing Director at ShapeBlue and Apache CloudStack PMC Member. I am a change-driven professional passionate about tackling new challenges. I’ve been working in the IT industry for the majority of my career, closely following its rapid evolution, emerging trends, and innovations.

As a professional, I strive to lead by example – inspiring my team and ensuring that ShapeBlue is recognised as “The CloudStack company”. We live and breathe open-source, and our values are deeply rooted in its principles of transparency, collaboration, and innovation.

On a personal level, I’m committed to continuous self-improvement. I enjoy travelling, learning new skills, and finding the balance between work, personal growth, and family life.

How do you define and measure the success of your marketing initiatives?

Marketing is not a single action or an isolated campaign. It is a continuous, multi-layered discipline that defines how a company positions its products, services, and overall value in the market. It encompasses how we communicate, how we show up across channels, the initiatives we drive, the events we deliver, and ultimately how we shape market perception.

Importantly, marketing is not confined to the marketing department. It is the sum of how the entire organisation presents itself. Every interaction – every employee, every touchpoint – reinforces or reshapes how customers view our company.

When it comes to measurement, our metrics must align directly with our objectives. If the goal is pipeline growth, we measure lead volume and quality. If the priority is market positioning, we look at brand awareness, website engagement, and broader shifts in how the market perceives us. In short, we measure what moves us closer to our strategic goals.

To give a short and clear answer: it depends on your targets!

 

What strategies do you employ to align marketing efforts with sales objectives?

For any IT company, it is critical to ensure smooth collaboration and communication between the marketing, sales, and tech teams. Objectives should be set with a clear understanding of the company’s potential, yet also be ambitious and motivating for the team.

When it comes to aligning marketing and sales, the key elements for me are:

• A shared vision
• A clear understanding of targets and KPIs
• A well-defined division of responsibilities and tasks

Last but not least – working together to achieve a common goal as one team. Marketing and sales must always recognise that they share the same objective, and that each side contributes to its success. Collaboration is crucial – helping and understanding each other is what makes the difference.

And of course, it all leads to building a stable and predictable pipeline.

Which campaign are you most proud of, and what contributed to its success?

No doubt, my greatest pride is the work we’ve done over the past two years to shift perceptions of open source. Where it was once seen as a second-tier option, open-source is now recognised by enterprises as a strategic choice for building sustainable, vendor-independent IT infrastructure.

Many companies searching for VMware alternatives and vendor independence are now confidently exploring and deploying open-source solutions in production environments.

 

How does ShapeBlue contribute to the marketing of Apache CloudStack?

ShapeBlue is the leading code contributor to the Apache CloudStack project, but we also recognise the importance of supporting the project from a marketing perspective. The more awareness there is of the benefits of open source, the greater the adoption will be.

Myself, our marketing team, and the entire company contribute in various ways. For example, we help organise events, produce high-quality content, and actively speak and present about Apache CloudStack at conferences and community gatherings. We also contribute significantly to the project’s website, video production, design work, and many other promotional activities.

 

What has your experience been like as a woman in a leadership role within a male-dominated industry?

It is true that the IT industry is male-dominated. I believe that people working in IT are judged by their professional qualities and skills. The IT industry is a great place to develop a career and grow. Sometimes it requires extra determination and persistence, but I believe that over the years I have demonstrated my skills, technical understanding, and leadership qualities.

In your view, what are the key ingredients to building and leading a high-performing marketing team?

Knowledge and expertise in the specific industry, combined with flexibility and the ability to communicate and collaborate with diverse people, are essential. I try to lead by example, share what I’ve learned, and support my team’s growth. It’s also essential to continuously improve your skills and expand your knowledge – both in marketing and on the technical side.

 

What activities or interests do you enjoy outside of your professional responsibilities?

I love being close to nature, travelling to new places, and learning new things. Spending time with family, being relaxed and enjoying the time. Preferably with a glass of nice wine and good music.

The post Executive Perspectives: ShapeBlue Leadership Talks: An Interview with Ivet Petrova, Marketing Director of ShapeBlue appeared first on ShapeBlue.

from CloudStack Consultancy & CloudStack... https://ift.tt/uGzs5UO
via IFTTT

ThreatsDay Bulletin: Wi-Fi Hack, npm Worm, DeFi Theft, Phishing Blasts— and 15 More Stories

Dec 04, 2025Ravie LakshmananCybersecurity / Hacking News

Think your Wi-Fi is safe? Your coding tools? Or even your favorite financial apps? This week proves again how hackers, companies, and governments are all locked in a nonstop race to outsmart each other.

Here's a quick rundown of the latest cyber stories that show how fast the game keeps changing.

1. DeFi exploit drains funds

   A critical exploit targeting Yearn Finance's yETH pool on Ethereum has been exploited by unknown threat actors, resulting in the theft of approximately $9 million from the protocol. The attack is said to have abused a flaw in how the protocol manages its internal accounting, stemming from the fact that a cache containing calculated values to save on gas fees was never cleared when the pool was completely emptied. "The attacker achieved this by minting an astronomical number of tokens – 235 septillion yETH (a 41-digit number) – while depositing only 16 wei, worth approximately $0.000000000000000045," Check Point said. "This represents one of the most capital-efficient exploits in DeFi history."

2. Linux malware evolves stealth

   Fortinet said it discovered 151 new samples of BPFDoor and three of Symbiote exploiting extended Berkeley Packet Filters (eBPFs) to enhance stealth through IPv6 support, UDP traffic, and dynamic port hopping for covert command-and-control (C2) communication. In the case of Symbiote, the BPF instructions show the new variant only accepts IPv4 or IPv6 packets for protocols TCP, UDP, and SCTP on non-standard ports 54778, 58870, 59666, 54879, 57987, 64322, 45677, and 63227. Coming to BPFDoor, the newly identified artifacts have been found to support both IPv4 and IPv6, as well as switch to a completely different magic packet mechanism. "Malware authors are enhancing their BPF filters to increase their chances of evading detection. Symbiote uses port hopping on UDP high ports, and BPFDoor implements IPv6 support," security researcher Axelle Apvrille said.

3. Phishing blitz blocked

   Microsoft said it detected and blocked on November 26, 2025, a high-volume phishing campaign from a threat actor named Storm-0900. "The campaign used parking ticket and medical test result themes and referenced Thanksgiving to lend credibility and lower recipients' suspicion," it said. "The campaign consisted of tens of thousands of emails and targeted primarily users in the United States." The URLs redirected to an attacker-controlled landing page that first required users to solve a slider CAPTCHA by clicking and dragging a slider, followed by ClickFix, which tricked users into running a malicious PowerShell script under the guise of completing a verification step. The end goal of the attacks was to deliver a modular malware known as XWorm that enables remote access, data theft, and deployment of additional payloads. "Storm-0900 is a prolific threat actor that, when active, launches phishing campaigns every week," Microsoft said.

4. Grant scam hides malware

   A new phishing campaign has been observed distributing bogus emails claiming to be about a professional achievement grant that lures them with supposed monetary grants. "It includes a password-protected ZIP and personalized details to appear legitimate, urging the victim to open the attached 'secure digital package' to claim the award, setting up the credential phish and malware chain that follows," Trustwave said. The ZIP archive contains an HTML page that's designed to phish their webmail credentials and exfiltrate it to a Telegram bot. Then a malicious SVG image is used to trigger a PowerShell ClickFix chain that installs the Stealerium infostealer to fix a purported issue with Google Chrome.

5. Russian spies hit NGOs

   A fresh wave of spear-phishing activity linked to the Russia-nexus intrusion set COLDRIVER has targeted non-profit organization Reporters Without Borders (RSF), which was designated as an "undesirable" entity by the Kremlin in August 2025. The attack, observed in March 2025, originated from a Proton Mail address, urging targets to review a malicious document by sharing a link that likely redirected to a Proton Drive URL hosting a PDF file. In another case targeting a different victim, the PDF came attached to the email message. "The retrieved file is a typical Calisto decoy: it displays an icon and a message claiming that the PDF is encrypted, instructing the user to click a link to open it in Proton Drive," Sekoia said. "When the user clicks the link, they are first redirected to a Calisto redirector hosted on a compromised website, which then forwards them to the threat actor's phishing kit." The redirector is a PHP script deployed on compromised websites, which ultimately takes the victims to an adversary-in-the-middle (AiTM) phishing page that can capture their Proton credentials. Proton has since taken down the attacker-controlled accounts.

6. Android boosts scam defense

   Google has expanded in-call scam protection on Android to Cash App and JPMorganChase in the U.S., after piloting the feature in the U.K., Brazil, and India. "When you launch a participating financial app while screen sharing and on a phone call with a number that is not saved in your contacts, your Android device will automatically warn you about the potential dangers and give you the option to end the call and to stop screen sharing with just one tap," Google said. "The warning includes a 30-second pause period before you're able to continue, which helps break the 'spell' of the scammer's social engineering, disrupting the false sense of urgency and panic commonly used to manipulate you into a scam." The feature is compatible with Android 11+ devices.

7. Ransomware hides behind packer

   A previously undocumented packer for Windows malware named TangleCrypt has been used in a September 2025 Qilin ransomware attack to conceal malicious payloads like the STONESTOP EDR killer by using the ABYSSWORKER driver as part of a bring your own vulnerable driver (BYOVD) attack to forcefully terminate installed security products on the device. "The payload is stored inside the PE Resources via multiple layers of base64 encoding, LZ78 compression, and XOR encryption," WithSecure said. "The loader supports two methods of launching the payload: in the same process or in a child process. The chosen method is defined by a string appended to the embedded payload. To hinder analysis and detection, it uses a few common techniques like string encryption and dynamic import resolving, but all of these were found to be relatively simple to bypass. Although the packer has an overall interesting design, we identified several flaws in the loader implementation that may cause the payload to crash or show other unexpected behaviour."

8. SSL certificates shorten lifespan

   Let's Encrypt has officially announced plans to reduce the maximum validity period of its SSL/TLS certificates from 90 days to 45 days. The transition, which will be completed by 2028, aligns with broader industry shifts mandated by the CA/Browser Forum Baseline Requirements. "Reducing how long certificates are valid for helps improve the security of the internet, by limiting the scope of compromise, and making certificate revocation technologies more efficient," Let's Encrypt said. "We are also reducing the authorization reuse period, which is the length of time after validating domain control that we allow certificates to be issued for that domain. It is currently 30 days, which will be reduced to 7 hours by 2028."

9. Fake extension drops RATs

   A malicious Visual Studio Code (VS Code) extension named "prettier-vscode-plus" has been published to the official VS Code Marketplace, impersonating the legitimate Prettier formatter. The attack starts with a Visual Basic Script dropper that's designed to run an embedded PowerShell script to fetch the next-stage payloads. "The extension served as the entry point for a multi-stage malware chain, starting with the Anivia loader, which decrypted and executed further payloads in memory," Hunt.io said. "OctoRAT, the third-stage payload dropped by the Anivia loader, provided full remote access, including over 70 commands for surveillance, file theft, remote desktop control, persistence, privilege escalation, and harassment." Some aspects of the attack were disclosed last month by Checkmarx.

10. Nations issue OT AI guidance

    Cybersecurity and intelligence agencies from Australia, Canada, Germany, the Netherlands, New Zealand, the U.K., and the U.S. have released new guidelines for secure integration of Artificial Intelligence (AI) in Operational Technology (OT) environments. The key principles include educating personnel on AI risks and its impacts, evaluating business cases, implementing governance frameworks to ensure regulatory compliance, and maintaining oversight, keeping safety and security in mind. "That kind of coordination is rare and signals the importance of this issue," Floris Dankaart, lead product manager of managed extended detection and response at NCC Group, said. "Equally important, most AI-guidance addresses IT, not OT (the systems that keep power grids, water treatment, and industrial processes running). It's refreshing and necessary to see regulators acknowledge OT-specific risks and provide actionable principles for integrating AI safely in these environments."

11. Airports hit by GPS spoofing

    The Indian government has revealed that local authorities have detected GPS spoofing and jamming at eight major airports, including those in Delhi, Kolkata, Amritsar, Mumbai, Hyderabad, Bangalore, and Chennai. Civil Aviation Minister Ram Mohan Naidu Kinjarapu, however, did not provide any details on the source of the spoofing and/or jamming, but noted the incidents did not cause any harm. "To enhance cyber security against global threats, AAI [Airports Authority of India] is implementing advanced cyber security solutions for IT networks and infrastructure," Naidu said.

12. npm worm leaks secrets

    The second Shai-Hulud supply chain attack targeting the npm registry exposed around 400,000 unique raw secrets after compromising over 800 packages and publishing stolen data in 30,000 GitHub repositories. Of these, only about 2.5% those are verified. "The dominant infection vector is the @postman/tunnel-agent-0.6.7 package, with @asyncapi/specs-6.8.3 identified as the second-most frequent," Wiz said. "These two packages account for over 60% of total infections. PostHog, which provided a detailed postmortem of the incident, is believed to be the 'patient zero' of the campaign. The attack stemmed from a flaw in CI/CD workflow configuration that allowed malicious code from a pull request to run with enough privileges to grab high-value secrets. "At this point, it is confirmed that the initial access vector in this incident was abuse of pull_request_target via PWN request," Wiz added. The self-replicating worm has been found to steal cloud credentials and use them to "access cloud-native secret management services," as well as unleash destructive code that wipes user data if the worm is unsuccessful in propagating further.

13. Fake Wi-Fi hacker jailed

    Michael Clapsis, a 44-year-old Australian man, has been sentenced to over seven years in prison for setting up fake Wi-Fi access points to steal personal data. The defendant, who was charged in June 2024, ran fake free Wi-Fi access points at the Perth, Melbourne, and Adelaide airports during multiple domestic flights and at work. He deployed evil twin networks to redirect users to phishing pages and capture credentials, subsequently using the information to access personal accounts and collect intimate photos and videos of women. Clapsis also hacked his employer in April 2024 and accessed emails between his boss and the police after his arrest. The investigation was launched that month after an airline employee discovered a suspicious Wi-Fi network during a domestic flight. "The man used a portable wireless access device, sometimes known as a Wi-Fi Pineapple, to passively listen for device probe requests," the Australian Federal Police (AFP) said. "When detecting a request, the Wi-Fi Pineapple instantly creates a matching network with the same name, tricking a device into thinking it is a trusted network. The device would then connect automatically."

14. Massive camera hack exposed

    Authorities in South Korea have arrested four individuals, believed to be working independently, for collectively hacking into more than 120,000 internet protocol cameras. Three of the suspects are said to have taken the footage recorded from private homes and commercial facilities, including a gynaecologist's clinic, and created hundreds of sexually exploitative materials to sell them to a foreign adult site (referred to as "Site C"). In addition, three individuals who purchased such illegal content from the website have already been arrested and face up to three years in prison.

15. Thousands of secrets exposed

    A scan of about 5.6 million public repositories on GitLab has revealed over 17,000 verified live secrets, according to TruffleHog. Google Cloud Platform (GCP) credentials were the most leaked secret type on GitLab repositories, followed by MongoDB, Telegram bots, OpenAI, OpenWeather, SendGrid, and Amazon Web Services. The 17,430 leaked secrets belonged to 2804 unique domains, with the earliest valid secret dating back to December 16, 2009.

16. Fake Zendesk sites lure victims

    The cybercriminal alliance known as Scattered LAPSUS$ Hunters has been observed going after Zendesk servers in an effort to steal corporate data they can use for ransom operations. ReliaQuest said it detected more than 40 typosquatted and impersonating domains mimicking Zendesk environments. "Some of the domains are hosting phishing pages with fake single sign-on (SSO) portals designed to steal credentials and deceive users," it said. "We also have evidence to suggest that fraudulent tickets are being submitted directly to legitimate Zendesk portals operated by organizations using the platform for customer service. These fake submissions are crafted to target support and help-desk personnel, infecting them with remote access trojans (RATs) and other types of malware." While the infrastructure patterns point to the notorious cybercrime group, ReliaQuest said that copycats inspired by the group's success couldn't be ruled out.

17. AI skills abused for ransomware

    Cato Networks has demonstrated that it's possible to leverage Anthropic's Claude Skills, which allows users to create and share custom code modules that expand on the AI chatbot's capabilities, to execute a MedusaLocker ransomware attack. The test shows "how a trusted Skill could trigger real ransomware behavior end-to-end under the same approval context," the company said. "Because Skills can be freely shared through public repositories and social channels, a convincing 'productivity' Skill could easily be propagated through social engineering, turning a feature designed to extend your AI's capabilities into a malware delivery vector." However, Anthropic has responded to the proof-of-concept (PoC) by stating the feature is by design, adding "Skills are intentionally designed to execute code" and that users are explicitly asked and warned prior to running a skill. Cato Networks has argued that the chief concern revolves around trusting the skill. "Once a Skill is approved, it gains persistent permissions to read/write files, download or execute additional code, and open outbound connections, all without further prompts or visibility," it noted. "This creates a consent gap: users approve what they see, but hidden helpers can still perform sensitive actions behind the scenes."

If there's one thing these stories show, it's that cybersecurity never sleeps. The threats might sound technical, but the impact always lands close to home — our money, our data, our trust. Staying alert and informed isn't paranoia anymore; it's just good sense.

from The Hacker News https://ift.tt/jwH9Sle
via IFTTT

How Cloud and Virtualisation Market Reshaped in 2025

2025 was a year of significant restructuring of the cloud and virtualisation market. Uncertainty with vendors, rising need for better cost control, rapid adoption of AI workloads and new requirements around data sovereignty pushed organisations to reassess long-established assumptions about where and how their workloads should run.

After years of “cloud-first” enthusiasm, many companies shifted their focus toward control, predictability and long-term vendor independence. This brought a rising interest towards open-source and the implementation of multi-hypervisor strategies. Another rising trend is the demand for GPU-as-a-Service, pushing cloud and MSP providers to adapt their offerings to meet a new wave of AI-driven expectations.

Across industries, four themes stood out consistently throughout the year:

• a move toward multi-hypervisor strategies to mitigate dependency on a single vendor;
• the steady growth of GPUaaS platforms built to support AI and ML workloads more efficiently;
• an emphasis on cost-driven architectural decisions, including cloud repatriation and consolidation;
• a move towards open-source infrastructure to ensure transparency, sovereignty and adaptability.

This article brings together an expert summary of the cloud and virtualisation market from ShapeBlue’s experience and our industry observations from working with multiple cloud integrators and third-party vendors. We will outline how enterprise virtualisation and cloud strategy evolved in 2025 and why these trends will continue to shape decision-making in 2026.

 

Multi-Hypervisor Becomes a Strategic Default in the Cloud and Virtualisation Market

One of the shifts in 2025 was the move away from relying on a single hypervisor. The uncertainty created by the VMware-Broadcom acquisition was a catalyst. But the underlying driver runs deeper: enterprises want to reduce dependency on licensing changes and regain architectural control.

Industry reports throughout the year highlighted this trend. The Register noted that organisations intensified their evaluation of alternative hypervisors, while TechTarget reported a rise in dual and multi-hypervisor planning. This reflects a broader shift in how virtualisation is being approached: resilience through diversification, not dependency.

We noticed this pattern in CloudStack user engagements, where increasing numbers of organisations adopted the platform as part of broader VMware migration or diversification initiatives. The objective is no longer to replace one vendor with another, but to design an environment where technologies such as KVM, Xen, Proxmox, Hyper-V or specialised hypervisors can coexist.

The introduction of the XaaS Extensions Framework in CloudStack 4.21 reinforced this trend by making hypervisor integration more flexible. Instead of being limited to a predefined set of hypervisors, organisations can now orchestrate external platforms through lightweight extensions. This model is shown in a recent ShapeBlue’s video, which shows CloudStack integrating with multiple hypervisors using the new extension mechanism:

https://www.youtube.com/watch?v=Rt4GqRJ2IfA

Throughout 2025, the rationale behind multi-hypervisor adoption remained consistent:

• avoiding dependency on a single vendor’s pricing and roadmap;
• maintaining the ability to shift workloads or adopt new technologies without large-scale migrations;
• reducing operational risk through diversification;
• enabling sovereign cloud and edge strategies without being constrained by proprietary formats.

By the end of the year, multi-hypervisor design had evolved from a defensive reaction to a strategic standard in the cloud and virtualisation market. It gives organisations the flexibility and resilience they increasingly seek in their virtualisation layer.

 

GPUaaS Platforms Gain Momentum

Demand for AI and accelerated computing continued to grow in 2025. Both enterprises and Service Providers re-evaluate how they deploy and deliver GPU capacity. While hyperscale public clouds are good option for initial experimentation, many organisations encountered limitations around costs, data locality and inconsistent access to GPU resources. These pressures contributed to a broader shift toward GPU-as-a-Service (GPUaaS) models that offer greater control, predictable economics and the ability to keep sensitive workloads within a managed infrastructure boundary.

For MSPs and CSPs, this transition was more significant. GPUaaS platforms reduce exposure to hyperscaler pricing, support vendor-independent infrastructure design and open new revenue opportunities. At the same time, they simplify operations and reduce the total cost of ownership compared to public cloud GPU instances. As a result –  more providers now offer shared or dedicated GPU capacity. This model has proven valuable in regions where hyperscaler GPU availability is limited or unpredictable, or where customers require sovereign or strictly local processing guarantees.

According to a 2025 report by Grand View Research, the global GPU-as-a-Service market was valued at USD 3.8 billion in 2024 and is projected to reach USD 12.26 billion by 2030, with a compound annual growth rate of 22.9%. The primary drivers include rising demand for GPU acceleration in AI, ML and large-scale data processing workloads.

CloudStack is evolving in the same direction. With version 4.21, GPUs became first-class resources, enabling Administrators to expose dedicated or virtualised (vGPU) capacity directly through the platform. ShapeBlue’s technology walkthrough demonstrates how internal or service-provider GPUaaS environments can be delivered on top of CloudStack orchestration:

https://www.youtube.com/watch?v=aYGgUpKth7I

 

 

 

Across 2025, organisations adopting GPUaaS, consistently cited motivations such as:

• predictable access to GPU resources for AI and ML workloads
• improved utilisation through shared GPU pools
• maintaining data locality for sensitive training and inference
• supporting sovereign cloud strategies where hyperscalers cloud regions are limited
• reducing long-term exposure to fluctuating cloud GPU pricing

By late 2025, GPUaaS had clearly shifted from a niche capability to a mainstream expectation. Both enterprises and CSPs began treating GPU acceleration as a core service layer.

 

Cost-Driven Architectures and Cloud Repatriation

2025 was a year marked by tighter financial discipline in IT. After more than a decade of deprioritising infrastructure cost transparency in favour of agility, many organisations reassessed where their workloads should run and why. As overall operating costs continued to rise, from hardware and energy to software licensing and managed services, companies faced increasing pressure to control expenses while remaining competitive in markets where customers did not easily accept price increases. This pushed CIOs and architects to evaluate whether specific workloads were better placed in on-premise or privately managed cloud environments, especially where cost predictability and long-term budgeting had become critical.

Industry reports across 2024–2025 reflected this shift. Coverage in CIO.com and BizTech noted an apparent rise in organisations pulling back specific workloads from public cloud, motivated by cost predictability, data-sovereignty requirements and the need for more consistent performance.

Independent analyses mirrored the same trend. ShapeBlue’s Cloud Cost Calculator and Pricing Report, a comparative study evaluating the long-term cost of running workloads on CloudStack-based infrastructure versus hyperscalers, highlighted how variable cloud consumption models, particularly for data-intensive workloads, continue to introduce cost unpredictability for many organisations.

These findings reinforced the growing need for more transparent and controllable infrastructure strategies:

https://www.shapeblue.com/cloud-cost-calculator-and-cloud-pricing-report/

 

 

 

 

 

Rather than a full return to on-prem environments, most of these moves were selective and workload-specific. Common drivers included:

• predictable cost models for steady or high-volume workloads
• reduced exposure to variable egress and data-movement charges
• regulatory or sovereignty constraints requiring local processing
• consolidation of environments that had become fragmented over time
• aligning infrastructure spending with measurable business value

Within the CloudStack ecosystem, this trend was reflected in increased interest from Cloud Service Providers and enterprises looking to operate their own cloud platforms with full visibility into cost structure. For these organisations, private or sovereign clouds offered a way to retain cloud-like automation while maintaining control over where data is stored and how resources are allocated.

By the end of 2025, cost-driven architectures had become a prominent theme across the industry. Instead of shifting wholesale to public cloud or on-prem, organisations embraced hybrid strategies grounded in economic reasoning, placing each workload where it delivers the most predictable and sustainable value.

 

Renewed Interest in Open-Source Infrastructure

In 2025, many organisations turned to open-source infrastructure as foundational pillars for long-term flexibility, control and adaptability. The decision reflects a broader strategic shift: with rising pressure on cost, compliance and sovereignty, open-source offers transparency, vendor-independence and a path to predictable evolution.

Recent data from the Linux Foundation gives concrete evidence of this shift. In the 2024 Global Spotlight Insights Report, 79% of respondents stated that open-source development leads to better software, 68% considered open-source software more secure than closed-source, and 64% reported increased business value from OSS use (with 56% reporting benefits from contributing to OSS). The same survey highlighted that AI/ML workloads emerged as the category most expected to benefit from open-source software, reinforcing the alignment between open infrastructure and modern, data-intensive use cases.

Adopting open-source infrastructure offers concrete benefits, especially when organisations need:

• architectural independence from proprietary licensing models,
• visibility and control over automation, orchestration and data flows,
• the flexibility to integrate or replace components without vendor lock-in,
• a stable baseline for hybrid or sovereign clouds, where compliance, data-locality and auditability matter,
• and a pathway for innovation, leveraging community-driven development, rapid iteration and interoperability across compute, storage and network layers.

For projects like Apache CloudStack, this shift aligns naturally: CloudStack, as an open-source orchestration platform, benefits from the ecosystem’s renewed emphasis on open infrastructure, and the 4.21 release (with its extensible XaaS Extensions Framework) gives organisations the technical means to build sovereignty-friendly, vendor-neutral cloud environments.

By end of 2025, open-source infrastructure had firmly re-established itself as a default strategic choice, not a niche, but a mainstream foundation for enterprise and CSP cloud architecture.

 

The Cloud and Virtualisation Market Enters a New Era of Independence

By late 2025, the industry had moved away from rigid cloud-first assumptions toward open and cost-aware architectures built around choice rather than dependency. Organisations concluded that long-term resilience depends on maintaining control over hypervisor strategy, GPU capacity, data locality and the economic profile of their workloads.

Apache CloudStack played a relevant role in this transition. Its open-source model, multi-hypervisor orchestration and GPUaaS capabilities gave enterprises and Service Providers a stable platform for building sovereign, transparent and operationally predictable clouds. As the focus shifts to 2026, infrastructure strategies centred on control, interoperability and architectural independence are set to accelerate and CloudStack’s design positions it well for this new phase.

The post How Cloud and Virtualisation Market Reshaped in 2025 appeared first on ShapeBlue.

from CloudStack Consultancy & CloudStack... https://ift.tt/npa7edv
via IFTTT

Spy vs. spy: How GenAI is powering defenders and attackers

• Generative AI (GenAI) is reshaping cybersecurity for both attackers and defenders, but its future capabilities are difficult to measure as techniques and models are evolving rapidly.
• Adversaries continue to use GenAI with varying levels of reliance. State-sponsored groups continue to take advantage, while criminal organizations are beginning to benefit from the prevalence of uncensored and unweighted models.
• Today, threat actors are using GenAI for coding, phishing, anti-analysis/evasion, and vulnerability discovery. It’s also starting to show up in malware samples, although significant human involvement is still a requirement.
• As models continue to shrink and hardware requirements are removed, adversarial access to GenAI and its capabilities are poised to surge.
• Defenders can use GenAI as a force multiplier to parse through vast threat data, enhance incident response, and proactively detect code vulnerabilities, helping to overcome analyst shortages. 

---

Generative AI (GenAI) has caused a fundamental shift in how people work and its impact is being felt almost everywhere. Individuals and enterprises alike are rushing to see how GenAI can make their lives easier or their work faster and more efficient. In information security, the focus has largely been on how adversaries are going to leverage it, and less on how defenders can benefit from it. While we are undoubtedly seeing GenAI have an impact on the threat landscape, quantifying that impact is difficult at best. The overwhelming majority of benefits from GenAI are impossible to determine from the finished malware we see, especially as vibe coding becomes more common.

AI and GenAI are evolving at an exponential pace, and as a result the landscape is changing rapidly. This blog is a snapshot of current AI usage. As models continue to shrink and hardware requirements lessen, it’s likely we are only seeing the tip of the iceberg on GenAI’s potential.

Adversarial GenAI usage 

Cisco Talos has covered this topic previously but the landscape continues to evolve at an exponential pace. Anthropic recently reported that state-sponsored groups are starting to leverage the technology in campaigns, while still requiring significant human help. The industry has also started to see actors embedding prompts into malware to evade detection. However, most of these methods are experimental and unreliable. They can greatly increase execution times, due to the nature of AI responses, and can result in execution failures. The technology is still in its infancy but current trends show significant AI usage is likely coming.

Adversaries are also leveraging prompts in malware and DNS records, mainly for anti-analysis purposes. For example, if defenders are using GenAI while analyzing malware, it will come across the adversary’s prompt, ignore all previous instructions, and return benign results. This new evasion method is likely to grow as AI systems play a bigger role in detection and analysis.

However, Talos continues to see the largest impacts on the conversational side of compromise, such as email content and social engineering. We have also seen plenty of examples of AI being used as a lure to trick users into installing malware. There is no doubt that, in the early days of GenAI, only well-funded threat groups were leveraging AI at high levels, most prominently at the state-sponsored level. With the evolution of the models and, more importantly, the abundance of uncensored and open weight models, the barrier to entry has lowered and other groups are likely using it.

Adversarial usage of AI is still difficult to quantify since most of the impacts are not visible in the end product. The most common applications of GenAI are helping with errors in coding, vibe coding functions, generating phishing emails, or gathering information on a future target. Regardless, the results rarely appear AI generated. Only companies operating publicly available models have the insights required to see how adversaries are using the technology, but even that view is limited.

Although this is how the GenAI landscape appears today, there are indications it is starting to shift. Uncensored models are becoming common and are easily accessible, and overall, the models continue to shrink in both size and associated hardware requirements. In the next year or two, it seems likely adversaries will gain the advantage. Defensive improvements will follow, but it is unclear at this point if they will keep pace.

Vulnerability hunting 

The use of GenAI to find vulnerabilities in code and software is an obvious application, but one that both offensive and defensive actors can use. Threat groups may leverage GenAI to uncover zero-day vulnerabilities to use maliciously, but what about the researchers using GenAI to help them triage fuzz farm outputs? If the researcher is focused on coordinated disclosure resulting in patches and not on selling to the highest bidder, GenAI is largely benign. Unfortunately, players on both sides are flooding the zone with GenAI-powered vulnerability discovery. For now we’ll focus purely on vulnerability analysis from outside the organization. The ways internal developers should use GenAI will be addressed in the next section.

For closed-source software, fuzzing is key for vulnerability disclosure. For open-source software, however, GenAI can perform deep public code reviews and find vulnerabilities, both in coordination with vendors or to be sold on the black market. As lightweight and specialized models continue to appear over the next few years, this aspect of vulnerability hunting is likely to surge.

Regardless of the end goal, vulnerability hunting is an effective and attractive GenAI application. Most modern applications have hundreds of thousands — if not millions — of lines of code and analyzing it can be a daunting task. This task is complicated by the barrage of enhancements and updates made to products during their lifetime. Every code change introduces risk and GenAI might currently be the best option to mitigate it. 

Enterprise security applications of GenAI 

On the positive side of technology, there is incredible research and innovation underway. One of the biggest challenges in information security is an astronomical volume of data, without enough analysts available to process it. This is where GenAI shines.

The amount of threat intelligence being generated is huge. Historically, there were a handful of vendors producing high-value threat intelligence reporting. That number is likely in the hundreds now. The result is massive amounts of data covering a staggering amount of activity. This is an ideal application for GenAI: Let it parse through the data, pull out what’s important, and help block indicators across your defensive portfolio.

Additionally, when you are in the middle of an incident and have reams of logs to correlate the attack and its impact, GenAI could be a huge advantage. Instead of spending hours poring over the logs, GenAI should be able to quickly and easily identify things like attempted lateral movement, exploitation, and initial access. It might not be a perfect source but will likely point responders to logs that should be further investigated. This allows responders to quickly focus on key points in the timeline and hopefully help mitigate the ongoing damage.

From a proactive perspective, there are a couple of areas where GenAI will benefit defenders. One of the first places an organization should look to implement GenAI is on analyzing committed code. No developer is perfect and humans make mistakes. Sometimes these mistakes can lead to huge incidents and millions or billions of dollars in damages.

Every time code is committed there is a risk that a vulnerability has been introduced. Leveraging GenAI to analyze each commit before they are applied can mitigate some of this risk. Since the LLM will have access to source code, it can more easily spot common mistakes that often result in vulnerabilities. While it may not detect complex attack chains involving chaining together low to medium severity bugs that could achieve remote code execution (RCE), it can still find the obvious mistakes that sometimes evade code reviews.

Red teamers can also utilize GenAI to streamline activities. By using AI to hunt for and exploit vulnerabilities or weaknesses in security posture, they can operate more efficiently. GenAI can provide  starting points to jump start their research, allowing for faster prototyping and ultimately success or failure.

GenAI and existing tooling 

Talos has already covered how Model Context Protocol (MCP) servers can be leveraged to help in reverse engineering and malware analysis, but this only scratches the surface. MCP servers connect a wide array of applications and datasets to GenAI, providing structured assistance for a variety of tasks. There are countless applications for MCP servers, and we are starting to see more flexible plugins that allow a variety of applications and data sets be accessed via a single plug-in. When combined with agentic AI, this could allow for huge leaps in productivity. MCP servers were also part of the technology stack used by state sponsored adversaries in the abuse covered by Anthropic. 

Agentic AI’s impact 

The meteoric rise of agentic AI will undoubtedly have an impact on the threat landscape. With agentic AI, adversaries could deploy agents constantly working to compromise new victims, setting up a pipeline for ransomware cartels. They could build agents focused on finding vulnerabilities in new commits to open-source projects or fuzzing various applications while triaging the findings. State-sponsored groups could task agents, who never need a break to eat or sleep, with breaking into high value targets, allowing them to hack until they find a way in, and constantly monitor for changes in attack surface or introduction of new systems.

On the other hand, defenders can use agentic AI as a force multiplier. Now you have some extra analysts that are looking for the slow and low attacks that might slip under your radar. Maybe an agent is tasked with watching windows logs for indications of compromise, lateral movement, and data exfiltration. Yet another agent can monitor the security of your endpoints and flag systems that are at higher risk of compromise due to improper access controls, incomplete patching, or other security concerns. Agents can even protect users from phishing or spam emails, or accidentally clicking on malicious links.

In the end, it all comes down to people 

There is one key resource that underpins all of these capabilities: humans. Ultimately, GenAI can complete tasks efficiently and effectively, but only for those that understand the underlying technology. Developers who understand code can use GenAI to increase throughput without sacrificing quality. In contrast, non-experts may struggle to use GenAI tools effectively, producing code they can’t understand or maintain.

Even Anthropic’s recent reporting notes that AI agents still require human assistance to carry out the attacks. The lesson is clear: People with the knowledge can do incredible things with GenAI and those without can accomplish a lot, but the true greatness of GenAI will only be available to those with the underlying knowledge to know what is right and possible with this new and emerging technology. 

from Cisco Talos Blog https://ift.tt/4TnKBDm
via IFTTT

5 Threats That Reshaped Web Security This Year [2025]

As 2025 draws to a close, security professionals face a sobering realization: the traditional playbook for web security has become dangerously obsolete. AI-powered attacks, evolving injection techniques, and supply chain compromises affecting hundreds of thousands of websites forced a fundamental rethink of defensive strategies.

Here are the five threats that reshaped web security this year, and why the lessons learned will define digital protection for years to come.

1. Vibe Coding#

Natural language coding, "vibe coding", transformed from novelty to production reality in 2025, with nearly 25% of Y Combinator startups using AI to build core codebases. One developer launched a multiplayer flight simulator in under three hours, eventually scaling it to 89,000 players and generating thousands in monthly revenue.

The Result#

Code that functions perfectly yet contains exploitable flaws, bypassing traditional security tools. AI generates what you ask for, not what you forget to ask.

The Damage#

• Production Database Deleted – Replit's AI assistant wiped Jason Lemkin's database (1,200 executives, 1,190 companies) despite code freeze orders
• AI Dev Tools Compromised – Three CVEs exposed critical flaws in popular AI coding assistants: CurXecute (CVE-2025-54135) enabled arbitrary command execution in Cursor, EscapeRoute (CVE-2025-53109) allowed file system access in Anthropic's MCP server, and (CVE-2025-55284) permitted data exfiltration from Claude Code via DNS-based prompt injection
• Authentication Bypassed – AI-generated login code skipped input validation, enabling payload injection at a U.S. fintech startup
• Unsecure code statistics in Vibe coding – 45% of all AI-generated code contains exploitable flaws; 70% Vulnerability Rate in the Java language.

Base44 Platform Compromised (July 2025) #

In July 2025, security researchers discovered a critical authentication bypass vulnerability in Base44, a popular vibe coding platform owned by Wix. The flaw allowed unauthenticated attackers to access any private application on the shared infrastructure, affecting enterprise applications handling PII, HR operations, and internal chatbots.

Wix patched the flaw within 24 hours, but the incident exposed a critical risk: when platform security fails, every application built on top becomes vulnerable simultaneously.

The Defense Response#

Organizations now implement security-first prompting, multi-step validation, and behavioral monitoring that detects unexpected API calls, deviant serialization patterns, or timing vulnerabilities. With the EU AI Act classifying some vibe coding as "high-risk AI systems," functional correctness no longer guarantees security integrity.

2. JavaScript Injection#

In March 2025, 150,000 websites were compromised by a coordinated JavaScript injection campaign promoting Chinese gambling platforms. Attackers injected scripts and iframe elements impersonating legitimate betting sites like Bet365, using full-screen CSS overlays to replace actual web content with malicious landing pages.

The campaign's scale and sophistication demonstrated how lessons from 2024's Polyfill.io compromise, where a Chinese company weaponized a trusted library affecting 100,000+ sites, including Hulu, Mercedes-Benz, and Warner Bros., had been weaponized into repeatable attack patterns. With 98% of websites using client-side JavaScript, the attack surface has never been larger.

The Impact#

Even React's XSS protection failed as attackers exploited prototype pollution, DOM-based XSS, and AI-driven prompt injections.

The Damage#

• 150,000+ Sites Compromised – Gambling campaign demonstrated industrial-scale JavaScript injection in 2025
• 22,254 CVEs Reported – A 30% jump from 2023, exposing massive vulnerability growth
• 50,000+ Banking Sessions Hijacked – Malware targeted 40+ banks across three continents using real-time page structure detection

The Solution#

Organizations now store raw data and encode by output context: HTML encoding for divs, JavaScript escaping for script tags, URL encoding for links. Behavioral monitoring flags when static libraries suddenly make unauthorized POST requests.

Download the 47-page JavaScript injection playbook with framework-specific defenses

3. Magecart/E-skimming 2.0#

Magecart attacks surged 103% in just six months as attackers weaponized supply chain dependencies, according to Recorded Future's Insikt Group. Unlike traditional breaches that trigger alarms, web skimmers masquerade as legitimate scripts while harvesting payment data in real-time.

The Reality#

Attacks demonstrated alarming sophistication: DOM shadow manipulation, WebSocket connections, and geofencing. One variant went dormant when Chrome DevTools opened.

The Damage#

• Major Brands Compromised – British Airways, Ticketmaster, and Newegg lost millions in fines and reputation damage
• Modernizr Library Weaponized – Code activated only on payment pages across thousands of websites, invisible to WAFs
• AI-Powered Selectivity – Attackers profiled browsers for luxury purchases, exfiltrating only high-value transactions

cc-analytics Domain Campaign (Sep 2025)#

Security researchers uncovered a sophisticated Magecart campaign leveraging heavily obfuscated JavaScript to steal payment card data from compromised e-commerce websites, with the malicious infrastructure centered around the domain cc-analytics[.]com has actively been harvesting sensitive customer information for at least one year

The Defense Response#

Organizations discovered CSP provided false confidence; attackers simply compromised whitelisted domains. The solution: validate code by behavior, not source. PCI DSS 4.0.1 Section 6.4.3 now requires continuous monitoring of all scripts accessing payment data, with compliance mandatory from March 2025.

4. AI Supply Chain Attacks#

Malicious package uploads to open-source repositories jumped 156% in 2025 as attackers weaponized AI. Traditional attacks meant stolen credentials. New threats introduced polymorphic malware that rewrites itself with each instance and context-aware code that detects sandboxes.

The Consequence#

AI-generated variants mutate daily, rendering signature-based detection useless. IBM's 2025 report showed breaches take 276 days to identify and 73 days to contain.

The Damage#

• Solana Web3.js Backdoor – Hackers drained $160,000–$190,000 in cryptocurrency during a five-hour window
• 156% Surge in Malicious Packages – Semantically camouflaged with documentation and unit tests to appear legitimate
• 276-Day Detection Window – AI-generated polymorphic malware evades traditional security scanning

The Shai-Hulud Worm (Sep-Dec 2025)#

Self-replicating malware used AI-generated bash scripts (identified by comments and emojis) to compromise 500+ npm packages and 25,000+ GitHub repositories in 72 hours. The attack weaponized AI command-line tools for reconnaissance and was designed to evade AI-based security analysis – both ChatGPT and Gemini incorrectly classified the malicious payloads as safe. The worm harvested credentials from developer environments and automatically published trojanized versions using stolen tokens, turning CI/CD pipelines into distribution mechanisms.

The Counter-Measures #

Organizations deployed AI-specific detection, behavioral provenance analysis, zero-trust runtime defense, and "proof of humanity" verification for contributors. The EU AI Act added penalties up to €35 million or 7% of global revenue.

5. Web Privacy Validation#

Research revealed that 70% of top US websites drop advertising cookies even when users opt out, exposing organizations to compliance failures and reputational damage. Periodic audits and static cookie banners couldn't keep pace with "privacy drift."

The Problem#

Marketing pixels collect unauthorized IDs, third-party code tracks outside stated policies, and consent mechanisms break after updates, all silently.

The Damage#

• €4.5 Million Fine for Retailer – Loyalty program script sent customer emails to external domains for four months undetected
• HIPAA Violations at Hospital Network – Third-party analytics scripts silently collected patient data without consent
• 70% Cookie Non-Compliance – Top US websites ignore user opt-out preferences, contradicting privacy claims

Capital One Tracking Pixels (March 2025) #

The federal court ruled that Meta Pixel, Google Analytics, and Tealium's sharing of credit card application status, employment details, and bank account information constituted "data exfiltration" under CCPA. The March 2025 decision expanded liability beyond traditional breaches, exposing companies to $100-$750 per incident (CCPA) plus $5,000 per incident (CIPA wiretap violations), turning routine tracking into litigation risk equivalent to security breaches.

The Defense Response: Continuous web privacy validation became the solution: agentless monitoring ensuring real-world activity aligns with declared policies through data mapping, instant alerts, and fix verification. Only 20% of companies felt confident in compliance at the year's start; those implementing continuous monitoring simplified audits and integrated privacy into security workflows.

Download the CISO's Expert Guide to Web Privacy Validation with vendor-specific recommendations here.

The Path Forward: Proactive Security in an AI-Driven World#

These five threats share a common thread: reactive security has become a liability. The lesson of 2025 is clear: by the time you detect a problem with traditional methods, you've already been compromised.

Organizations thriving in this landscape share three characteristics:

• They assume breach as the default state. Rather than preventing all intrusions, they focus on rapid detection and containment, understanding that perfect prevention is impossible.
• They embrace continuous validation. Successful security programs operate in constant vigilance mode rather than periodic audit cycles.
• They treat AI as both a tool and threat. The same technology that generates vulnerabilities can power defensive systems. Deploying AI-aware security to detect AI-generated threats has moved from experimental to essential.

Your 2026 Security Readiness Checklist#

Security teams should prioritize these five validations:

1. Inventory third-party dependencies – Map every external script, library, and API endpoint in production. Unknown code is an unmonitored risk.
2. Implement behavioral monitoring – Deploy runtime detection that flags anomalous data flows, unauthorized API calls, and unexpected code execution.
3. Audit AI-generated code – Treat all LLM-generated code as untrusted input. Require security review, secrets scanning, and penetration testing before deployment.
4. Validate privacy controls in production – Test cookie consent, data collection boundaries, and third-party tracking in live environments, not just staging.
5. Establish continuous validation – Move from quarterly audits to real-time monitoring with automated alerting.

The question isn't whether to adopt these security paradigms but how quickly organizations can implement them. The threats that reshaped web security in 2025 aren't temporary disruptions – they're the foundation for years to come.

The organizations that act now will define the security standards; those that hesitate will scramble to catch up.

Found this article interesting? This article is a contributed piece from one of our valued partners. Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.

from The Hacker News https://ift.tt/9FgAmvT
via IFTTT

WordPress King Addons Flaw Under Active Attack Lets Hackers Make Admin Accounts

Dec 03, 2025Ravie LakshmananVulnerability / Website Security

A critical security flaw impacting a WordPress plugin known as King Addons for Elementor has come under active exploitation in the wild.

The vulnerability, CVE-2025-8489 (CVSS score: 9.8), is a case of privilege escalation that allows unauthenticated attackers to grant themselves administrative privileges by simply specifying the administrator user role during registration.

It affects versions from 24.12.92 through 51.1.14. It was patched by the maintainers in version 51.1.35 released on September 25, 2025. Security researcher Peter Thaleikis has been credited with discovering and reporting the flaw. The plugin has over 10,000 active installs.

"This is due to the plugin not properly restricting the roles that users can register with," Wordfence said in an alert. "This makes it possible for unauthenticated attackers to register with administrator-level user accounts."

Specifically, the issue is rooted in the "handle_register_ajax()" function that's invoked during user registration. But an insecure implementation of the function meant that unauthenticated attackers can specify their role as "administrator" in a crafted HTTP request to the "/wp-admin/admin-ajax.php" endpoint, allowing them to obtain elevated privileges.

Successful exploitation of the vulnerability could enable a bad actor to seize control of a susceptible site that has installed the plugin, and weaponize the access to upload malicious code that can deliver malware, redirect site visitors to sketchy sites, or inject spam.

Wordfence said it has blocked over 48,400 exploit attempts since the flaw was publicly disclosed in late October 2025, with 75 attempts thwarted in the last 24 hours alone. The attacks have originated from the following IP addresses -

• 45.61.157.120
• 182.8.226.228
• 138.199.21.230
• 206.238.221.25
• 2602:fa59:3:424::1

"Attackers may have started actively targeting this vulnerability as early as October 31, 2025, with mass exploitation starting on November 9, 2025," the WordPress security company said.

Site administrators are advised to ensure that they are running the latest version of the plugin, audit their environments for any suspicious admin users, and monitor for any signs of abnormal activity.

from The Hacker News https://ift.tt/0zGfxl5
via IFTTT