Docker Fixes Critical Ask Gordon AI Flaw Allowing Code Execution via Image Metadata

Cybersecurity researchers have disclosed details of a now-patched security flaw impacting Ask Gordon, an artificial intelligence (AI) assistant built into Docker Desktop and the Docker Command-Line Interface (CLI), that could be exploited to execute code and exfiltrate sensitive data.

The critical vulnerability has been codenamed DockerDash by cybersecurity company Noma Labs. It was addressed by Docker with the release of version 4.50.0 in November 2025.

"In DockerDash, a single malicious metadata label in a Docker image can be used to compromise your Docker environment through a simple three-stage attack: Gordon AI reads and interprets the malicious instruction, forwards it to the MCP [Model Context Protocol] Gateway, which then executes it through MCP tools," Sasi Levi, security research lead at Noma, said in a report shared with The Hacker News.

"Every stage happens with zero validation, taking advantage of current agents and MCP Gateway architecture."

Successful exploitation of the vulnerability could result in critical-impact remote code execution for cloud and CLI systems, or high-impact data exfiltration for desktop applications.

The problem, Noma Security said, stems from the fact that the AI assistant treats unverified metadata as executable commands, allowing it to propagate through different layers sans any validation, allowing an attacker to sidestep security boundaries. The result is that a simple AI query opens the door for tool execution.

With MCP acting as a connective tissue between a large language model (LLM) and the local environment, the issue is a failure of contextual trust. The problem has been characterized as a case of Meta-Context Injection.

"MCP Gateway cannot distinguish between informational metadata (like a standard Docker LABEL) and a pre-authorized, runnable internal instruction," Levi said. "By embedding malicious instructions in these metadata fields, an attacker can hijack the AI's reasoning process."

In a hypothetical attack scenario, a threat actor can exploit a critical trust boundary violation in how Ask Gordon parses container metadata. To accomplish this, the attacker crafts a malicious Docker image with embedded instructions in Dockerfile LABEL fields. 

While the metadata fields may seem innocuous, they become vectors for injection when processed by Ask Gordon AI. The code execution attack chain is as follows -

• The attacker publishes a Docker image containing weaponized LABEL instructions in the Dockerfile
• When a victim queries Ask Gordon AI about the image, Gordon reads the image metadata, including all LABEL fields, taking advantage of Ask Gordon's inability to differentiate between legitimate metadata descriptions and embedded malicious instructions
• Ask Gordon to forward the parsed instructions to the MCP gateway, a middleware layer that sits between AI agents and MCP servers.
• MCP Gateway interprets it as a standard request from a trusted source and invokes the specified MCP tools without any additional validation
• MCP tool executes the command with the victim's Docker privileges, achieving code execution

The data exfiltration vulnerability weaponizes the same prompt injection flaw but takes aim at Ask Gordon's Docker Desktop implementation to capture sensitive internal data about the victim's environment using MCP tools by taking advantage of the assistant's read-only permissions.

The gathered information can include details about installed tools, container details, Docker configuration, mounted directories, and network topology.

It's worth noting that Ask Gordon version 4.50.0 also resolves a prompt injection vulnerability discovered by Pillar Security that could have allowed attackers to hijack the assistant and exfiltrate sensitive data by tampering with the Docker Hub repository metadata with malicious instructions.

"The DockerDash vulnerability underscores your need to treat AI Supply Chain Risk as a current core threat," Levi said. "It proves that your trusted input sources can be used to hide malicious payloads that easily manipulate AI’s execution path. Mitigating this new class of attacks requires implementing zero-trust validation on all contextual data provided to the AI model."

from The Hacker News https://ift.tt/hQXqTtU
via IFTTT

Microsoft SDL: Evolving security practices for an AI-powered world

As AI reshapes the world, organizations encounter unprecedented risks, and security leaders take on new responsibilities. Microsoft’s Secure Development Lifecycle (SDL) is expanding to address AI-specific security concerns in addition to the traditional software security areas that it has historically covered.

Explore Microsoft Secure Development Lifecycle practices

SDL for AI goes far beyond a checklist. It’s a dynamic framework that unites research, policy, standards, enablement, cross-functional collaboration, and continuous improvement to empower secure AI development and deployment across our organization. In a fast-moving environment where both technology and cyberthreats constantly evolve, adopting a flexible, comprehensive SDL strategy is crucial to safeguarding our business, protecting users, and advancing trustworthy AI. We encourage other organizational and security leaders to adopt similar holistic, integrated approaches to secure AI development, strengthening resilience as cyberthreats evolve.

Why AI changes the security landscape

AI security versus traditional cybersecurity

AI security introduces complexities that go far beyond traditional cybersecurity. Conventional software operates within clear trust boundaries, but AI systems collapse these boundaries, blending structured and unstructured data, tools, APIs, and agents into a single platform. This expansion dramatically increases the attack surface and makes enforcing purpose limitations and data minimization far more challenging.

Expanded attack surface and hidden vulnerabilities

Unlike traditional systems with predictable pathways, AI systems create multiple entry points for unsafe inputs including prompts, plugins, retrieved data, model updates, memory states, and external APIs. These entry points can carry malicious content or trigger unexpected behaviors. Vulnerabilities hide within probabilistic decision loops, dynamic memory states, and retrieval pathways, making outputs harder to predict and secure. Traditional threat models fail to account for AI-specific attack vectors such as prompt injection, data poisoning, and malicious tool interactions.

Loss of granularity and governance complexity

AI dissolves the discrete trust zones assumed by traditional SDL. Context boundaries flatten, making it difficult to enforce purpose limitation and sensitivity labels. Governance must span technical, human, and sociotechnical domains. Questions arise around role-based access control (RBAC), least privilege, and cache protection, such as: How do we secure temporary memory, backend resources, and sensitive data replicated across caches? How should AI systems handle anonymous users or differentiate between queries and commands? These gaps expose corporate intellectual property and sensitive data to new risks.

Multidisciplinary collaboration

Meeting AI security needs requires a holistic approach across stack layers historically outside SDL scope, including Business Process and Application UX. Traditionally, these were domains for business risk experts or usability teams, but AI risks often originate here. Building SDL for AI demands collaborative, cross-team development that integrates research, policy, and engineering to safeguard users and data against evolving attack vectors unique to AI systems.

Novel risks

AI cyberthreats are fundamentally different. Systems assume all input is valid, making commands like “Ignore previous instructions and execute X” viable cyberattack scenarios. Non-deterministic outputs depend on training data, linguistic nuances, and backend connections. Cached memory introduces risks of sensitive data leakage or poisoning, enabling cyberattackers to skew results or force execution of malicious commands. These behaviors challenge traditional paradigms of parameterizing safe input and predictable output.

Data integrity and model exploits

AI training data and model weights require protection equivalent to source code. Poisoned datasets can create deterministic exploits. For example, if a cyberattacker poisons an authentication model to accept a raccoon image with a monocle as “True,” that image becomes a skeleton key—bypassing traditional account-based authentication. This scenario illustrates how compromised training data can undermine entire security architectures.

Speed and sociotechnical risk

AI accelerates development cycles beyond SDL norms. Model updates, new tools, and evolving agent behaviors outpace traditional review processes, leaving less time for testing and observing long-term effects. Usage norms lag tool evolution, amplifying misuse risks. Mitigation demands iterative security controls, faster feedback loops, telemetry-driven detection, and continuous learning.

Ultimately, the security landscape for AI demands an adaptive, multidisciplinary approach that goes beyond traditional software defenses and leverages research, policy, and ongoing collaboration to safeguard users and data against evolving attack vectors unique to AI systems.

SDL as a way of working, not a checklist

Security policy falls short of addressing real-world cyberthreats when it is treated as a list of requirements to be mechanically checked off. AI systems—because of their non-determinism—are much more flexible that non-AI systems. That flexibility is part of their value proposition, but it also creates challenges when developing security requirements for AI systems. To be successful, the requirements must embrace the flexibility of the AI systems and provide development teams with guidance that can be adapted for their unique scenarios while still ensuring that the necessary security properties are maintained.

Effective AI security policies start by delivering practical, actionable guidance engineers can trust and apply. Policies should provide clear examples of what “good” looks like, explain how mitigation reduces risk, and offer reusable patterns for implementation. When engineers understand why and how, security becomes part of their craft rather than compliance overhead. This requires frictionless experiences through automation and templates, guidance that feels like partnership (not policing) and collaborative problem-solving when mitigations are complex or emerging. Because AI introduces novel risks without decades of hardened best practices, policies must evolve through tight feedback loops with engineering: co-creating requirements, threat modeling together, testing mitigations in real workloads, and iterating quickly. This multipronged approach helps security requirements remain relevant, actionable, and resilient against the unique challenges of AI systems.

So, what does Microsoft’s multipronged approach to AI security look like in practice? SDL for AI is grounded in pillars that, together, create strong and adaptable security:

• Research is prioritized because the AI cyberthreat landscape is dynamic and rapidly changing. By investing in ongoing research, Microsoft stays ahead of emerging risks and develops innovative solutions tailored to new attack vectors, such as prompt injection and model poisoning. This research not only shapes immediate responses but also informs long-term strategic direction, ensuring security practices remain relevant as technology evolves.
• Policy is woven into the stages of development and deployment to provide clear guidance and guardrails. Rather than being a static set of rules, these policies are living documents that adapt based on insights from research and real-world incidents. They ensure alignment across teams and help foster a culture of responsible AI, making certain that security considerations are integrated from the start and revisited throughout the lifecycle.
• Standards are established to drive consistency and reliability across diverse AI projects. Technical and operational standards translate policy into actionable practices and design patterns, helping teams build secure systems in a repeatable way. These standards are continuously refined through collaboration with our engineers and builders, vetted with internal experts and external partners, keeping Microsoft’s approach aligned with industry best practices.
• Enablement bridges the gap between policy and practice by equipping teams with the tools, communications, and training to implement security measures effectively. This focus ensures that security isn’t just an abstract concept but an everyday reality, empowering engineers, product managers, and researchers to identify threats and apply mitigations confidently in their workflows.
• Cross-functional collaboration unites multiple disciplines to anticipate risks and design holistic safeguards. This integrated approach ensures security strategies are informed by diverse perspectives, enabling solutions that address technical and sociotechnical challenges across the AI ecosystem.
• Continuous improvement transforms security into an ongoing practice by using real-world feedback loops to refine strategies, update standards, and evolve policies and training. This commitment to adaptation ensures security measures remain practical, resilient, and responsive to emerging cyberthreats, maintaining trust as technology and risks evolve.

Together, these pillars form a holistic and adaptive framework that moves beyond checklists, enabling Microsoft to safeguard AI systems through collaboration, innovation, and shared responsibility. By integrating research, policy, standards, enablement, cross-functional collaboration, and continuous improvement, SDL for AI creates a culture where security is intrinsic to AI development and deployment.

What’s new in SDL for AI

Microsoft’s SDL for AI introduces specialized guidance and tooling to address the complexities of AI security. Here’s a quick peek at some key AI security areas we’re covering in our secure development practices:

• Threat modeling for AI: Identifying cyberthreats and mitigations unique to AI workflows.
• AI system observability: Strengthening visibility for proactive risk detection.
• AI memory protections: Safeguarding sensitive data in AI contexts.
• Agent identity and RBAC enforcement: Securing multiagent environments.
• AI model publishing: Creating processes for releasing and managing models.
• AI shutdown mechanisms: Ensuring safe termination under adverse conditions.

In the coming months, we’ll share practical and actionable guidance on each of these topics.

Microsoft SDL for AI can help you build trustworthy AI systems

Effective SDL for AI is about continuous improvement and shared responsibility. Security is not a destination. It’s a journey that requires vigilance, collaboration between teams and disciplines outside the security space, and a commitment to learning. By following Microsoft’s SDL for AI approach, enterprise leaders and security professionals can build resilient, trustworthy AI systems that drive innovation securely and responsibly.

Learn more about Microsoft SDL for AI

Keep an eye out for additional updates about how Microsoft is promoting secure AI development, tackling emerging security challenges, and sharing effective ways to create robust AI systems.

To learn more about Microsoft Security solutions, visit our website. Bookmark the Security blog to keep up with our expert coverage on security matters. Also, follow us on LinkedIn (Microsoft Security) and X (@MSFTSecurity) for the latest news and updates on cybersecurity. 

The post Microsoft SDL: Evolving security practices for an AI-powered world appeared first on Microsoft Security Blog.

from Microsoft Security Blog https://ift.tt/Etqn3Sb
via IFTTT

PCI DSS 4.0.1 compliance with HashiCorp Vault and Vault Radar

PCI DSS (Payment Card Industry Data Security Standard) defines technical and operational requirements for protecting payment data. Recently this standard has raised the bar for how organizations protect payment data, especially in cloud-native environments.

With the release of PCI DSS 4.0, tatic credentials, hard-coded secrets, and limited visibility across development pipelines are no longer just bad practices, they are audit risks that could result in significant fines. Organizations are being evaluated against stricter requirements that emphasize continuous security controls, visibility, and auditability.

HashiCorp Vault and HCP Vault Radar work together to help organizations meet PCI DSS 4.0.1 requirements by securing secrets within the cardholder data environment and continuously monitoring for exposure across the software delivery lifecycle:

• Vault secures secrets (credentials, keys, tokens, certificates, etc.) and cryptographic material within approved systems.
• HCP Vault Radar detects when those secrets escape into places they don’t belong, such as source code repositories, CI/CD pipelines, or collaboration tools.

This post explores how Vault and Vault Radar work together to secure secrets and provide the continuous visibility required under PCI DSS 4.0.1.

What Is HashiCorp Vault?

HashiCorp Vault is an identity-based secrets and encryption management platform. It provides secure storage, access control, encryption services, and auditability for sensitive data such as API keys, passwords, certificates, and cryptographic keys.

Vault authenticates users, applications, and machines, authorizes access through fine-grained policies, and records every operation in a detailed audit log. Access is available via UI, CLI, or API, making Vault suitable for both human and automated workflows.

What Is HCP Vault Radar?

HCP Vault Radar is a secrets scanning, discovery, and exposure detection product that continuously scans environments where secrets are commonly leaked, including:

• Source code repositories
• CI/CD pipelines
• Ticketing systems
• Collaboration and messaging tools

Vault Radar acts as the detection layer, helping organizations identify when secrets escape approved boundaries. Through its integration with Vault, you can rapidly remediate leaked secrets into secure storage.

Supporting PCI DSS requirements with Vault and Vault Radar

Together, Vault and Vault Radar support multiple PCI DSS control areas by combining preventative safeguards in combination with continuous detection and response.

Secure secrets and key management

Vault centralizes the storage and control of credentials, encryption keys, and certificates used across the cardholder data environment (CDE), reducing secret sprawl and unauthorized access.

Vault Radar continuously monitors environments outside Vault to detect leaked secrets, helping ensure that sensitive credentials remain centrally managed.

Encryption and cryptographic controls

Vault provides encryption-as-a-service and manages keys used to protect data at rest and in transit, supporting PCI requirements for strong cryptography and secure key lifecycles.

Vault Radar helps ensure that cryptographic material and access credentials are not inadvertently exposed in code or collaboration platforms.

Dynamic secrets and automated rotation

Vault can generate credentials on demand and automatically rotate them, minimizing the risk of long-lived or compromised secrets.

When Vault Radar detects exposed secrets, organizations can use Vault to immediately revoke and rotate credentials, limiting blast radius and supporting incident response requirements.

Advanced data protection

Vault’s Transform secrets engine supports:

• Data masking
• Format-preserving encryption (FF3-1)
• Tokenization

These capabilities can reduce PCI scope by limiting exposure of cardholder data while preserving application compatibility.

Vault Radar reinforces scope reduction by identifying uncontrolled access paths that could unintentionally expand PCI scope.

Secure software development

Vault enables applications to retrieve secrets securely at runtime, eliminating the need to hard-code credentials.

Vault Radar scans source code, pull requests, CI/CD pipelines, and IDEs to detect hard-coded secrets and prevent them from being published in version control.

Access control and auditability

Vault enforces least-privilege access using role-based access control (RBAC) policies tied to identity, not IP addresses. It also records all access in tamper-evident audit logs, supporting PCI audit trail requirements.

Vault Radar provides additional investigative context by identifying where and when secrets were exposed, supporting forensic analysis alongside Vault audit logs.

Observability and continuous monitoring

PCI DSS Requirement 11 emphasizes the importance of regular testing and monitoring of security systems to detect vulnerabilities, anomalous behavior, and unauthorized access.

Vault Radar directly supports this requirement by:

• Continuously monitoring for secrets exposure outside of Vault
• Alerting security teams to potential security events or misconfigurations
• Providing dashboards and reporting for visibility and audit evidence
• Enabling proactive responses and remediation to reduce risk

This observability ensures organizations can detect and respond to risks in real time, an essential part of PCI DSS compliance.

Mapping Vault and Vault Radar to PCI DSS 4.0.1 Requirements

PCI DSS 4.0.1 Requirement	HashiCorp Vault	HCP Vault Radar
Req. 2 – Secure configurations	Enforces secure access to secrets using identity-based authentication, policy controls, and trusted auth sources. Dynamic, time-bound credentials reduce reliance on static configurations.	Out of scope for system configuration management.
Req. 3 – Protect stored account data	Secures credentials and encryption keys, automates rotation, and supports non-reversible protections such as tokenization, masking, and format-preserving encryption.	Detects exposed credentials that could grant unauthorized access to systems storing cardholder data.
Req. 4 – Protect cardholder data during transmission	Provides encryption in transit, certificate lifecycle management, SSH key management, and KMIP-based key distribution.	Out of scope for encryption and transport security.
Req. 6 – Secure software development	Provides secrets securely at runtime, preventing hard-coding of credentials in application code.	Continuously scans development pipelines, source repositories, pull requests, and IDEs to detect hard-coded or exposed secrets.
Req. 7 – Restrict access by business need	Enforces least-privilege access through fine-grained policies tied to identity and workload context.	Out of scope for access enforcement.
Req. 8 – Identify and authenticate access	Supports strong authentication for users, services, and workloads, including short-lived and federated credentials.	Out of scope for identity authentication.
Req. 9 – Restrict physical access	Out of scope for physical access controls.	Out of scope for physical access controls.
Req. 10 – Log and monitor access	Maintains detailed, immutable audit logs for all access to secrets and cryptographic material.	Identifies where and when secrets were exposed outside Vault, providing context for investigation and correlation with Vault audit logs.
Req. 11 – Test security systems	Supports audit logging and automated key rotation to enable security testing of Vault-managed secrets.	Provides continuous observability through exposure scanning, alerts, and dashboards to detect vulnerabilities and misconfigurations.
Req. 12 – Incident response and governance	Enables rapid revocation and rotation of compromised secrets during incident response.	Triggers alerts and workflows when secret exposure occurs, supporting incident response, risk management, and evidence collection.

Using Vault and Vault Radar as part of a PCI Compliance Program

Vault and Vault Radar are most effective when integrated into a broader PCI strategy that includes people and process controls. Common best practices include:

• Mapping Vault and Vault Radar capabilities to specific PCI requirements
• Defining compliant usage policies and secure development standards
• Placing Vault appropriately within the network and limiting access to the CDE
• Continuously monitoring for secret exposure and unauthorized access paths
• Regularly reviewing audit logs, findings, and remediation actions
• Updating configurations as PCI requirements evolve

A PCI case study and final thoughts

PCI compliance is not achieved through tooling alone, but the right tools make it achievable at scale. HashiCorp Vault provides the preventive controls required to secure secrets, keys, and access, while HCP Vault Radar provides the continuous detection, monitoring, and observability needed to ensure those controls are not bypassed.

Together, Vault and Vault Radar help organizations strengthen their PCI DSS compliance posture by reducing risk, improving visibility, and supporting audit readiness across modern cloud and software delivery environments.

Organizations with strict PCI obligations routinely use Vault alongside Terraform to implement compliance as code and scale secure, repeatable architectures. You can read about a real-world case study in our post: Managing PCI compliant architectures at scale with Terraform & Vault.

Learn more

• Visit the HashiCorp Vault product page
• Explore HCP Vault Dedicated and Vault Enterprise features
• Learn about HCP Vault Radar

If you’d like to discuss how Vault and Vault Radar fit into your PCI DSS journey, feel free to reach out.

from HashiCorp Blog https://ift.tt/6imFzUD
via IFTTT

Introducing HashiCorp Agent Skills

Today, we're announcing HashiCorp Agent Skills, a repository of Agent Skills and Claude Code plugins for HashiCorp products. At launch, this includes Skills for Terraform and Packer.

These Skills give AI assistants specialized HashiCorp product knowledge, including plugin framework architectures, schema definitions, and up-to-date best practices. The initial HashiCorp Agent Skills pack includes Skills that can:

• Follow HashiCorp style conventions when generating Terraform code
• Write and run Terraform tests
• Create orchestrations with Terraform Stacks
• Help build Terraform providers according to best practices
• Refactor Terraform modules
• Build AWS, Azure, and Windows images with Packer
• and more

In this post, we'll cover what Agent Skills are, how these skills improve your infrastructure workflow, and how to install them in your AI assistant.

What are Agent Skills?

Agent Skills are based on an open standard for packaging domain expertise into portable, reusable instructions that AI agents can load on demand. Developed by Anthropic and released as an open format, skills solve a fundamental problem: AI assistants often lack the specific technical context needed to perform complex tasks reliably.

A note on the Model Context Protocol (MCP). You might be wondering how this differs from MCP. Agent Skills and MCP are complementary technologies. MCP is the "pipe" or server interface that connects data to an AI, while Agent Skills are the "textbooks" of knowledge. You can use them together to create a powerful, context-aware assistant.

Each Skill is a folder containing instructions, reference materials, and resources. When you load a Skill, your AI assistant gains access to curated expertise it can apply to your work, significantly reducing hallucinations and adhering to strict architectural standards.

Skills for every stage of your DevOps journey

The HashiCorp Agent Skills package currently includes Skills that address the most common challenges that Terraform and Packer users face, with more planned for the future:

Building a new provider: Creating a Terraform provider requires understanding of the plugin framework, resource lifecycle methods, schema design, and testing patterns. Our provider development Skills give AI assistants the context to guide you through the entire process, from scaffolding a new provider to implementing complex data sources to testing, all without having to point your AI to different documents manually or risk bad practices and nonsensical results from creeping in.

Maintaining an existing provider: Provider maintenance involves handling breaking changes, updating to new framework versions, and addressing community issues. The Terraform Skills also help AI assistants understand your existing codebase and suggest changes that follow established patterns.

Generating quality Terraform code: We’ve baked our coding conventions into AI workflows with our Terraform style guide Skill. That means when you start generating Terraform configurations with the style guide Skill, the code will follow HashiCorp’s documented style conventions, rather than potentially using conventions from code found in the wild.

Breaking down monoliths: The refactor module Skill helps refactor monolithic Terraform configurations into modules, making your configurations more reusable and manageable.

Using Terraform Stacks: Terraform Stacks are a configuration layer in HCP Terraform and Terraform Enterprise designed to manage complex, multi-environment, multi-region infrastructure as a single, cohesive unit. With the Terraform Stacks Skill, you can simplify the coding process of Stack components without as many general-LLM pitfalls.

Building machine images with Packer: Packer Skills help users build golden images across AWS, Azure, and Windows with proper builder configurations, provisioners, platform-specific patterns, and HCP Packer integration for image lifecycle management.

Evaluating our Agent Skills

A key part of creating our Skills was evaluating their efficacy and iteratively improving them based on evaluation data. Skills can significantly improve how an agent completes a task when written well. Written poorly, they may consume too much context with little gain. They can also lack critical information or be phrased in ways that different models interpret inconsistently.

HashiCorp partnered with Tessl to evaluate and improve our Agent Skills. We used two evaluation techniques:

• Review evals, which test Skill structure against Anthropic's best practices
• Task evals, which run agents through real tasks with and without the Skill to assess results

You can see the full review eval results on our listing here.

Install Skills in seconds

We designed the installation process to be as simple as possible. You have a few options:
* Using npx, run: *  npx skills add hashicorp/agents-skills
* Using Tessl, run: *  npm i -g @tessl/cli && tessl i github:hashicorp/agent-skills * For Claude Code specifically, run: *  /plugin marketplace add hashicorp/agent-skills *  /plugin install terraform-provider-development@hashicorp

Any of these methods will install the Skill files directly into your AI assistant's configuration directory, with no manual copying or configuration editing.

What's next

This initial release covers Terraform and Packer, but we plan to expand the library to cover additional HashiCorp products very soon.

We also welcome contributions from the community. If you have expertise to share or ideas for new Skills, visit our repository to get involved. Let us know how these Skills help your workflow and tell us what you’d like to see next by opening an issue in the repository.

More resources

• Keep up to date with HashiCorp Agent Skills: Follow the GitHub Repository. Install via /plugin, Tessl, or npx.
• Learn the standard: Read about Agent Skills to understand how the open format works.
• Scale your impact: Sign up for HCP Terraform and HCP Packer to manage your new infrastructure configurations at scale.

from HashiCorp Blog https://ift.tt/gXW8d4a
via IFTTT

Deepin Linux 25 Community Edition: Immutable, User-Friendly, and great for transition from Windows 10

For users considering a move away from Windows 10, our new article analyzes Deepin Linux 25 Community Edition (CE) in terms of onboarding, hardware support, file system compatibility, and software options. It also covers limitations and where expectations should be realistic.

If you’re anything like me – tired of bloated OSes, constant telemetry headaches, and hardware that feels strangled by modern requirements, then you’re probably eyeing Linux more seriously these days. In late 2025 / early 2026, one distro that keeps popping up in conversations (and my own testing) is Deepin Linux Community Edition, especially the shiny new 25 release which I really like.

Deepin comes from China, sure, but is fully open-source, Debian-based, and community-driven these days. An open-source nature allows anyone to audit the code. Forget any old enterprise vibes, this is the real deal for everyday users, developers, and tinkerers who want elegance without the headache.

What really hooked me? The combo of immutable core system for rock-solid stability, super-intuitive desktop that feels familiar if you’re coming from Windows/macOS, and surprisingly smooth integration for installing software – including running Windows apps. The look and feel are very nice, polished. Something in between MacOS and Windows 11. Let’s have a look at it technically, and see if Deepin 25 deserves your attention.

Deepin desktop is stylish – between W11 and MacOS

Why Immutable Design Matters (Especially in 2026)

One of the biggest upgrades in Deepin 25 is the “Solid” immutable system. In plain English: the core OS files are read-only. You can’t accidentally (or maliciously) break things by messing with /usr, /etc, or the kernel directly.

Apps, drivers, and extensions install as layered add-ons – think Fedora Silverblue style, but tuned for Deepin’s beautiful DDE desktop.

Atomic updates: Changes apply all-or-nothing. Failed update? Auto-rollback on next boot. No more “half-updated” disasters.

Worry-Free Restore: Snapshots in seconds, instant revert if something goes sideways.

Extensions for everything: Proprietary NVIDIA drivers, Wi-Fi modules, custom kernels—install them safely without touching the base.

From a performance angle, In my quick tests on mid-range hardware (Ryzen 5, 16GB RAM), idle usage stayed low (~600-800MB RAM), and boot times felt snappier after multiple update/rollback cycles.

If you’re running a lab, testing new software, or just hate babysitting your OS, immutability is a game-changer. You can temporarily disable Solid for deep tweaks (fixed write perms), then re-enable. Balance of security and flexibility – nice touch.

Deepin Desktop Environment (DDE): Beautiful and Actually Usable

Deepin isn’t just another GNOME/KDE spin. DDE (built on Qt) gives nice polished, modern look with rounded corners, fluid animations, macOS-style dock vibes with Windows taskbar familiarity.

Community Edition amps is created in mind with user-driven fixes: better gesture support (3-4 fingers), merged audio channels, multi-line notifications with images, and a Control Center that’s finally logical.

File Manager is a standout: real-time search-as-you-type, keyword highlighting, indexing status – handles huge folders fast. Window effects are tunable (disable translucency on move for older GPUs).

File manager real-time search

 

Shutdown logic got smarter with no more hanging on blocked processes.

The Installer supports 17 languages, preinstalls useful input methods, and defaults to AES encryption (upgrade from SM4). Onboarding feels smooth, even for Linux newcomers. Power users get kernel switching (LTS vs. stable) right in Control Center.

The installer of Deepin Linux

 

To sum this all – It’s pretty without being heavy, intuitive without dumbing down options. Perfect if you’re migrating from Windows 11 and want something that “just works” but still lets you change many options.

Transitioning from Windows 10 to Deepin: Easier Than You Think (And How It Stacks Up Against Fedora Silverblue)

With Windows 10’s end-of-life hitting in October 2025, 2026 is prime time for folks leaving Microsoft for good – especially if your hardware doesn’t meet Windows 11’s TPM 2.0 or Secure Boot demands. Even if Microsoft is allowing one more year of updates for users willing to create a Microsoft account, still, the W10 end is dooming.

File migration? Grab your docs via external drive or cloud, and Deepin’s File Manager handles NTFS partitions natively for easy access.

Apps? No sweat you can use Wine for legacy Windows software (more on that below), or find Linux alternatives in the App Store. Installation is a breeze: boot from USB, follow the graphical wizard (under 30 minutes on most rigs), and dual-boot if you’re not ready to commit fully. Community forums have tons of guides for importing browser data, email setups, and even printer configs. In my experience, it’s less jarring than jumping to Ubuntu, thanks to the visual familiarity and built-in tools like one-click backups to avoid data loss mid-transition.

Nice configurable and polished desktop environment

 

Now, comparing Deepin 25 to Fedora Silverblue which is another immutable distro – they share that rock-solid atomic update, but cater to different crowds.

Both uses layered systems (Deepin’s Solid vs. Silverblue’s rpm-ostree) for easy rollbacks and security, minimizing downtime on failed updates.

But Deepin, being Debian-based with APT, feels more approachable for beginners with its vast stable repos and user-friendly App Store, while Silverblue (Fedora RPM/DNF) pushes bleeding-edge packages and Flatpak/container focus, ideal for devs chasing the latest tech.

UI-wise, Deepin’s sleek DDE is gorgeous and customizable out-of-the-box (think macOS polish), whereas Silverblue’s GNOME is minimalistic and extension-heavy which is great for power users but a bit harsh for Windows migrants.

Resource use? Deepin can be a little bit heavier on RAM (though optimized in 25), but Silverblue shines on efficiency for servers or low-spec machines.

If you’re after beauty and Wine ease, Deepin wins; for pure dev workflows and Fedora ecosystem, Silverblue edges it.

Software Installation: App Store, Distrobox, Linyaps – No More Dependency Hell

Software side is where Deepin shines for daily driving. App Store is clean: filter by format (Deb, Flatpak, AppImage), detailed info, one-click installs.

View of the software store

 

With Solid immutable mode, apps land as extensions – no risk to core system. Need more? Distrobox integration is brilliant – one-click subsystems like Ubuntu 24.04, Arch, Fedora 42, Debian 12. Run them isolated, launch apps straight to your desktop/taskbar. Great for dev toolchains without polluting host.

Linyaps packaging tool unifies everything: supports thousands of packages across arches (AMD64, ARM64, LoongArch), online/offline modes. Fills gaps where native repos might lag.

Filter packages based on deb or linyaps which is a cross-distribution Linux package format

Running Windows Apps? Wine Integration Is Actually Good

Here’s the killer feature for many: Deepin makes Wine feel native. Their deepin-wine fork optimizes popular Windows tools (WeChat, QQ, Office suites, legacy enterprise stuff). Better menu rendering, fewer artifacts, faster load times than vanilla Wine.

• Install via App Store (many pre-packaged Wine apps) or APT.
• deepin-wine8+ uses single WOW64 build—no separate 32/64-bit.
• winecfg for tweaks, WINEPREFIX for isolated bottles.

Performance: Community patches often beat stock Wine on Deepin.

Pros, Cons, and Should You Try It?

Default installation selection is fine for the lab

 

Pros:

• Immutable Solid = ultimate stability & easy recovery.
• Gorgeous, customizable DDE that’s beginner-friendly yet powerful
• Excellent Wine support + Distrobox for broad software compatibility
• Low resource use, great hardware support (including proprietary drivers)
• Active community, frequent updates

Cons:

• Debian base means slightly older packages sometimes (but Flatpak/Distrobox fix that)
• Chinese origin raises eyebrows for some (code is open, auditable)
• Experimental features (like Treeland compositor) may have Wine quirks

Final Words

In 2026, with Windows 10 EOL still fresh and Windows 11 feeling heavier than ever, Deepin 25 Community Edition is a seriously compelling alternative which is on my list. The choice is hard because many Linux distros mimicks Windows looks and feel lately, and many of them are good (Winux, AnduinOS and others).

However, Immutable foundation for peace of mind, beautiful UI that doesn’t sacrifice function, and real Windows app support via Wine – it’s not just another distro, it’s one that could actually replace your daily driver. Download the ISO from the official site and follow the installation guide. It walks you through with how to put it on a USB (or test in VM), and give it 30 minutes. Installation is quick, and the experience might surprise you.

from StarWind Blog https://ift.tt/sWHaRId
via IFTTT

When Cloud Outages Ripple Across the Internet

Recent major cloud service outages have been hard to miss. High-profile incidents affecting providers such as AWS, Azure, and Cloudflare have disrupted large parts of the internet, taking down websites and services that many other systems depend on. The resulting ripple effects have halted applications and workflows that many organizations rely on every day.

For consumers, these outages are often experienced as an inconvenience, such as being unable to order food, stream content, or access online services. For businesses, however, the impact is far more severe. When an airline's booking system goes offline, lost availability translates directly into lost revenue, reputational damage, and operational disruption.

These incidents highlight that cloud outages affect far more than compute or networking. One of the most critical and impactful areas is identity. When authentication and authorization are disrupted, the result is not just downtime; it is a core operational and security incident.

Cloud Infrastructure, a Shared Point of Failure

Cloud providers are not identity systems. But modern identity architectures are deeply dependent on cloud-hosted infrastructure and shared services. Even when an authentication service itself remains functional, failures elsewhere in the dependency chain can render identity flows unusable.

Most organizations rely on cloud infrastructure for critical identity-related components, such as:

• Datastores holding identity attributes and directory information
• Policy and authorization data
• Load balancers, control planes, and DNS

These shared dependencies introduce risk in the system. A failure in any one of them can block authentication or authorization entirely, even if the identity provider is technically still running. The result is a hidden single point of failure that many organizations, unfortunately, only discover during an outage.

Identity, the Gatekeeper for Everything

Authentication and authorization aren't isolated functions used only during login - they are continuous gatekeepers for every system, API, and service. Modern security models, specifically Zero Trust, are built on the principle of "never trust, always verify". That verification depends entirely on the availability of identity systems.

This applies equally to human users and machine identities. Applications authenticate constantly. APIs authorize every request. Services obtain tokens to call other services. When identity systems are unavailable, nothing works.

Because of this, identity outages directly threaten business continuity. They should trigger the highest level of incident response, with proactive monitoring and alerting across all dependent services. Treating identity downtime as a secondary or purely technical issue significantly underestimates its impact.

The Hidden Complexity of Authentication Flows

Authentication involves far more than verifying a username and password, or a passkey, as organizations increasingly move toward passwordless models. A single authentication event typically triggers a complex chain of operations behind the scenes.

Identity systems are commonly:

• Resolve user attributes from directories or databases
• Store session state
• Issue access tokens containing scopes, claims, and attributes
• Perform fine-grained authorization decisions using policy engines

Authorization checks may occur both during token issuance and at runtime when APIs are accessed. In many cases, APIs must authenticate themselves and obtain tokens before calling other services.

Each of these steps depends on the underlying infrastructure. Datastores, policy engines, token stores, and external services all become part of the authentication flow. A failure in any one of these components can fully block access, impacting users, applications, and business processes.

Why Traditional High Availability Isn't Enough

High availability is widely implemented and absolutely necessary, but it is often insufficient for identity systems. Most high-availability designs focus on regional failover: a primary deployment in one region with a secondary in another. If one region fails, traffic shifts to the backup.

This approach breaks down when failures affect shared or global services. If identity systems in multiple regions depend on the same cloud control plane, DNS provider, or managed database service, regional failover provides little protection. In these scenarios, the backup system fails for the same reasons as the primary.

The result is an identity architecture that appears resilient on paper but collapses under large-scale cloud or platform-wide outages.

Designing Resilience for Identity Systems

True resilience must be deliberately designed. For identity systems, this often means reducing dependency on a single provider or failure domain. Approaches may include multi-cloud strategies or controlled on-premises alternatives that remain accessible even when cloud services are degraded.

Equally important is planning for degraded operation. Fully denying access during an outage has the highest possible business impact. Allowing limited access, based on cached attributes, precomputed authorization decisions, or reduced functionality, can dramatically reduce operational and reputational damage.

Not all identity-related data needs the same level of availability. Some attributes or authorization sources may be less fault-tolerant than others, and that may be acceptable. What matters is making these trade-offs deliberately, based on business risk rather than architectural convenience.

Identity systems must be engineered to fail gracefully. When infrastructure outages are inevitable, access control should degrade predictably, not completely collapse.

Ready to get started with a robust identity management solution? Try the Curity Identity Server for free.

Found this article interesting? This article is a contributed piece from one of our valued partners. Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.

from The Hacker News https://ift.tt/rwj7lkS
via IFTTT

APT28 Uses Microsoft Office CVE-2026-21509 in Espionage-Focused Malware Attacks

The Russia-linked state-sponsored threat actor known as APT28 (aka UAC-0001) has been attributed to attacks exploiting a newly disclosed security flaw in Microsoft Office as part of a campaign codenamed Operation Neusploit.

Zscaler ThreatLabz said it observed the hacking group weaponizing the shortcoming on January 29, 2026, in attacks targeting users in Ukraine, Slovakia, and Romania, three days after Microsoft publicly disclosed the existence of the bug.

The vulnerability in question is CVE-2026-21509 (CVSS score: 7.8), a security feature bypass in Microsoft Office that could allow an unauthorized attacker to send a specially crafted Office file and trigger it.

"Social engineering lures were crafted in both English and localized languages (Romanian, Slovak, and Ukrainian) to target the users in the respective countries," security researchers Sudeep Singh and Roy Tay said. "The threat actor employed server-side evasion techniques, responding with the malicious DLL only when requests originated from the targeted geographic region and included the correct User-Agent HTTP header."

The attack chains, in a nutshell, entail the exploitation of the security hole by means of a malicious RTF file to deliver two different versions of a dropper, one that's designed to drop an Outlook email stealer called MiniDoor, and another, referred to as PixyNetLoader, that's responsible for the deployment of a Covenant Grunt implant.

The first dropper acts as a pathway for serving MiniDoor, a C++-based DLL file that steals a user's emails in various folders (Inbox, Junk, and Drafts) and forwards them to two hard-coded threat actor email addresses: ahmeclaw2002@outlook[.]com and ahmeclaw@proton[.]me. MiniDoor is assessed to be a stripped-down version of NotDoor (aka GONEPOSTAL), which was documented by S2 Grupo LAB52 in September 2025.

In contrast, the second dropper, i.e., PixyNetLoader, is used to initiate a much more elaborate attack chain that involves delivering additional components embedded into it and setting up persistence on the host using COM object hijacking. Among the extracted payloads are a shellcode loader ("EhStoreShell.dll") and a PNG image ("SplashScreen.png").

The primary responsibility of the loader is to parse shellcode concealed using steganography within the image and execute it. That said, the loader only activates its malicious logic if the infected machine is not an analysis environment and when the host process that launched the DLL is "explorer.exe." The malware stays dormant if the conditions are not met.

The extracted shellcode, ultimately, is used to load an embedded .NET assembly, which is nothing but a Grunt implant associated with the open source .NET COVENANT command-and-control (C2) framework. It's worth noting that APT28's use of the Grunt Stager was highlighted by Sekoia in September 2025 in connection with a campaign named Operation Phantom Net Voxel.

"The PixyNetLoader infection chain shares notable overlap with Operation Phantom Net Voxel," Zscaler said. "Although the earlier campaign used a VBA macro, this activity replaces it with a DLL while retaining similar techniques, including (1) COM hijacking for execution, (2) DLL proxying, (3) XOR string encryption techniques, and (4) Covenant Grunt and its shellcode loader embedded in a PNG via steganography."

The disclosure coincides with a report from the Computer Emergency Response Team of Ukraine (CERT-UA) that also warned of APT28's abuse of CVE-2026-21509 using Word documents to target more than 60 email addresses associated with central executive authorities in the country. Metadata analysis reveals that one of the lure documents was created on January 27, 2026.

"During the investigation, it was found that opening the document using Microsoft Office leads to establishing a network connection to an external resource using the WebDAV protocol, followed by downloading a file with a shortcut file name containing program code designed to download and run an executable file," CERT-UA said.

This, in turn, triggers an attack chain that's identical to PixyNetLoader, resulting in the deployment of the COVENANT framework's Grunt implant.

from The Hacker News https://ift.tt/zY4U2lm
via IFTTT

Mozilla Adds One-Click Option to Disable Generative AI Features in Firefox

Mozilla on Monday announced a new controls section in its Firefox desktop browser settings that allows users to completely turn off generative artificial intelligence (GenAI) features.

"It provides a single place to block current and future generative AI features in Firefox," Ajit Varma, head of Firefox, said. "You can also review and manage individual AI features if you choose to use them. This lets you use Firefox without AI while we continue to build AI features for those who want them."

Mozilla first announced its plans to integrate AI into Firefox in November 2025, stating it's fully opt-in and that it's incorporating the technology while placing users in the driver's seat.

The new feature is expected to be rolled out with Firefox 148, which is scheduled to be released on February 24, 2026. At the outset, AI controls will allow users to manage the following settings individually -

• Translations
• Alt text in PDFs (adding accessibility descriptions to images in PDF pages)
• AI-enhanced tab grouping (suggestions for related tabs and group names)
• Link previews (show key points before a link is opened)
• AI chatbot in the sidebar (Using well-known chatbots like Anthropic Claude, OpenAI ChatGPT, Microsoft Copilot, Google Gemini, and Le Chat Mistral while navigating the web)

Mozilla said user choice is crucial as more AI features are baked into web browsers, adding that it believes in giving people control regardless of how they feel about the technology.

"If you don't want to use AI features from Firefox at all, you can turn on the Block AI enhancements toggle," Varma said. "When it's toggled on, you won't see pop-ups or reminders to use existing or upcoming AI features."

Last month, Mozilla's new CEO, Anthony Enzor-DeMeo, said the company's focus will be on becoming a trusted software company that gives users agency in how its products work. "Privacy, data use, and AI must be clear and understandable," Enzor-DeMeo said. "Controls must be simple. AI should always be a choice – something people can easily turn off."

from The Hacker News https://ift.tt/S4WT7n0
via IFTTT

Notepad++ Hosting Breach Attributed to China-Linked Lotus Blossom Hacking Group

A China-linked threat actor known as Lotus Blossom has been attributed with medium confidence to the recently discovered compromise of the infrastructure hosting Notepad++.

The attack enabled the state-sponsored hacking group to deliver a previously undocumented backdoor codenamed Chrysalis to users of the open-source editor, according to new findings from Rapid7.

The development comes shortly after Notepad++ maintainer Don Ho said that a compromise at the hosting provider level allowed threat actors to hijack update traffic starting June 2025 and selectively redirect such requests from certain users to malicious servers to serve a tampered update by exploiting insufficient update verification controls that existed in older versions of the utility.

The weakness was plugged in December 2025 with the release of version 8.8.9. It has since emerged that the hosting provider for the software was breached to perform targeted traffic redirections until December 2, 2025, when the attacker's access was terminated. Notepad++ has since migrated to a new hosting provider with stronger security and rotated all credentials.

Rapid7's analysis of the incident has uncovered no evidence or artifacts to suggest that the updater-related mechanism was exploited to distribute malware.

"The only confirmed behavior is that execution of 'notepad++.exe' and subsequently 'GUP.exe' preceded the execution of a suspicious process 'update.exe' which was downloaded from 95.179.213.0," security researcher Ivan Feigl said.

"update.exe" is a Nullsoft Scriptable Install System (NSIS) installer that contains multiple files -

• An NSIS installation script
• BluetoothService.exe, a renamed version of Bitdefender Submission Wizard that's used for DLL side-loading (a technique widely used by Chinese hacking groups)
• BluetoothService, encrypted shellcode (aka Chrysalis)
• log.dll, a malicious DLL that's sideloaded to decrypt and execute the shellcode

Chrysalis is a bespoke, feature-rich implant that gathers system information and contacts an external server ("api.skycloudcenter[.]com") to likely receive additional commands for execution on the infected host.

The command-and-control (C2) server is currently offline. However, a deeper examination of the obfuscated artifact has revealed that it's capable of processing incoming HTTP responses to spawn an interactive shell, create processes, perform file operations, upload/download files, and uninstall itself.

"Overall, the sample looks like something that has been actively developed over time," Rapid7 said, adding it also identified a file named "conf.c" that's designed to retrieve a Cobalt Strike beacon by means of a custom loader that embeds Metasploit block API shellcode.

One such loader, "ConsoleApplication2.exe" is noteworthy for its use of Microsoft Warbird, an undocumented internal code protection and obfuscation framework, to execute shellcode. The threat actor has been found to copy and modify an already existing proof-of-concept (PoC) published by German cybersecurity company Cirosec in September 2024.

Rapid7's attribution of Chrysalis to Lotus Blossom (aka Billbug, Bronze Elgin, Lotus Blossom, Spring Dragon, and Thrip) based on similarities with prior campaigns undertaken by the threat actor, including one documented by Broadcom-owned Symantec in April 2025 that involved the use of legitimate executables from Trend Micro and Bitdefender to sideload malicious DLLs.

"While the group continues to rely on proven techniques like DLL side-loading and service persistence, their multi-layered shellcode loader and integration of undocumented system calls (NtQuerySystemInformation) mark a clear shift toward more resilient and stealth tradecraft," the company said.

"What stands out is the mix of tools: the deployment of custom malware (Chrysalis) alongside commodity frameworks like Metasploit and Cobalt Strike, together with the rapid adaptation of public research (specifically the abuse of Microsoft Warbird). This demonstrates that Billbug is actively updating its playbook to stay ahead of modern detection."

from The Hacker News https://ift.tt/k5bX4Ot
via IFTTT

Three years. Five Use Cases. A Leader: Citrix

A Leader again—here’s what we feel that recognition means for you

For the third year in a row, Citrix has received recognition across all five Use Cases in the 2025 Gartner® Critical Capabilities for Desktop as a Service (DaaS) report. That’s more than an honor to Citrix. In our opinion, it’s a signal to enterprises that proven, enterprise-grade digital workspace is here.

When your business depends on secure, reliable, and flexible access to apps and desktops, the partner you choose matters. We feel that this Gartner recognition reinforces what thousands of global enterprises already know: Citrix delivers results across every DaaS scenario that matters.

Why Gartner Critical Capabilities report matters

Unlike the Magic Quadrant, which assesses vendors on Vision and Execution, Gartner Critical Capabilities is an essential companion to the Gartner Magic Quadrant. This methodology provides deeper insight into providers’ product and service offerings by extending Magic Quadrant analysis.

In the 2025 edition, Citrix ranked #1 in all of the following categories:

1. Remote Workers Use Case
2. High Security and Compliance Use Case
3. High Performance Use Case
4. Custom Enterprise Architectures Use Case
5. On-Premises/Hybrid Use Case

We feel this is more than a technology recognition. In our opinion, it’s a strategic validation of Citrix’s ability to support the most pressing business needs in modern IT environments.

What we believe recognition in all five Use Cases means for you

Let’s break down how we believe Citrix delivers across each Use Case in Gartner analysis.

Remote Workers Use Case: Delivering flexibility without friction
Citrix enables remote and distributed workforces to thrive without compromising productivity or security. Employees can access virtual desktops and applications from any device, anywhere, with a consistent, high-performance experience.

Citrix supports everything from home-office setups to global nomad workstyles, with built-in resilience, bandwidth optimization, and real-time collaboration readiness.

High Security and Compliance Use Case: Secure by design
Citrix is engineered with Zero Trust access principles at its core. Whether you’re in a regulated industry or simply prioritizing risk reduction, Citrix ensures end-to-end protection.

From Citrix Secure Private Access to integrated enterprise browsers and granular policy controls, your organization gains full visibility and control without user disruption.

Citrix helps meet compliance requirements for HIPAA, PCI, GDPR, and more, with centralized auditing and threat response baked into the platform.

---

Citrix supports full Zero Trust access, regulatory compliance, and endpoint control out of the box.

---

High Performance Use Case: Experience that scales
Citrix is known for delivering a fast, seamless user experience, even in environments where bandwidth is limited or latency is high. That’s thanks to technologies like Citrix HDX, which intelligently optimizes audio, video, printing, graphics, and collaboration workloads.

Coupled with advanced session monitoring and analytics, IT can detect and address performance issues before they impact users. Whether employees are using 3D design apps, video conferencing, or EMR systems, Citrix keeps experiences smooth and reliable.

---

HDX technology delivers high-definition graphics and videos in real time on any device.

---

Custom Enterprise Architectures Use Case: Built for complexity
Citrix excels at delivering DaaS in complex, enterprise-grade environments. Whether you’re dealing with legacy infrastructure, custom business apps, or a heavily regulated operational model, Citrix meets you where you are.

From custom network configurations to complex app delivery rules, Citrix enables centralized control without sacrificing flexibility. Role-based access, dynamic provisioning, and deep integrations with platforms like ServiceNow and Intune simplify operations at scale.

Citrix capabilities for complex enterprise deployments

Challenge in complex environments	How Citrix helps	Example capabilities
Role-based access management	Enforce policies based on user, group, or device context	Contextual access policies, dynamic provisioning, integration with Active Directory & Azure AD
Custom networking requirements	Support secure, optimized app delivery across diverse infrastructures	Citrix NetScaler ADC, secure gateways, traffic shaping, VPN-less Zero Trust access
Legacy app delivery	Modernize and deliver apps that weren’t built for the cloud	Virtual Apps streaming, app layering, Windows app support on non-Windows devices
Cross-cloud control	Manage workloads across multiple public and private clouds from one console	Centralized Citrix Cloud management, hybrid/multi-cloud orchestration, autoscaling
Regulatory or industry-specific compliance	Adapt to strict controls in healthcare, finance, or government	Session recording, auditing, granular policy enforcement, FedRAMP/HIPAA/GDPR support

On-Premises/Hybrid Use Case: Any cloud. Any data center. No compromise.
Many enterprises aren’t fully in the cloud and may never be. Citrix is designed to support on-prem, hybrid, and multi-cloud architectures with unified management.

We believe Citrix allows you to run workloads in Azure, AWS, Google Cloud, or your private data center with consistent performance, security, and visibility. This flexibility ensures your DaaS strategy evolves with your business—without vendor lock-in.

Strategic recognition that goes beyond rankings

We think being #1 across five Use Cases is significant, but what matters even more is how Citrix shows up as a strategic partner to your organization.

Citrix is a platform and a pathway to:

• Accelerated digital transformation
• Workforce flexibility and agility
• Future-proof architecture
• Stronger security posture
• Improved IT efficiency

With over 400,000 customers, including 99% of the Fortune 100, Citrix helps the world’s largest organizations thrive in complex, regulated, and rapidly changing environments.

What you gain with Citrix as your DaaS partner

In our opinion, choosing a vendor isn’t just about today’s rankings; it’s about tomorrow’s outcomes. When you partner with Citrix, you get:

• Consistent performance across all work environments
• Compliance-ready security, no matter your industry
• Deployment flexibility—from on-prem to any cloud
• Faster time to value with simplified management
• Confidence in a platform trusted by the world’s top enterprises

See the full Gartner report. Then talk to us.

Want the full picture? Download your complimentary copy of the 2025 Gartner Critical Capabilities for DaaS report to see how we believe Citrix stacks up across all five Use Cases and why enterprises continue to choose us year after year.

Then let’s talk about how we can help you build a digital workspace that meets today’s needs and tomorrow’s goals. Download the full report. 

---

Gartner, Critical Capabilities for Desktop as a Service, Sunil Kumar, Todd Larivee, Stuart Downes, 18 August 2025

Gartner, Magic Quadrant for Desktop as a Service, Stuart Downes, Sunil Kumar, Todd Larivee, 11 August 2025

GARTNER is a registered trademark and service mark of Gartner, Inc. and/or its affiliates in the U.S. and internationally, and MAGIC QUADRANT is a registered trademark of Gartner, Inc. and/or its affiliates and are used herein with permission. All rights reserved.

Gartner does not endorse any vendor, product or service depicted in its research publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner’s research organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose.

This graphic was published by Gartner, Inc. as part of a larger research document and should be evaluated in the context of the entire document. The Gartner document is available upon request from Citrix.

from Citrix Blogs https://bit.ly/49R1lDy
via IFTTT

Securing the Mid-Market Across the Complete Threat Lifecycle

For mid-market organizations, cybersecurity is a constant balancing act. Proactive, preventative security measures are essential to protect an expanding attack surface. Combined with effective protection that blocks threats, they play a critical role in stopping cyberattacks before damage is done.

The challenge is that many security tools add complexity and cost that most mid-market businesses can't absorb. With limited budgets and lean IT and security teams, organizations often focus on detection and response. While necessary, this places a significant operational burden on teams already stretched thin.

A more sustainable approach is security across the complete threat lifecycle—combining prevention, protection, detection, and response in a way that reduces risk without increasing cost or complexity.

Why Mid-Market Security Often Feels Stuck

Most mid-market organizations rely on a small set of foundational tools, such as endpoint protection, email security, and network firewalls. However, limited staff and resources often leave these tools operating as isolated point solutions, preventing teams from extracting their full value.

Endpoint Detection and Response (EDR) is a common example. Although EDR is included in most Endpoint Protection Platforms (EPP), many organizations struggle to use it effectively. EDR was designed for enterprises with dedicated security operations teams, and using it well requires time and specialized expertise to configure, monitor, and respond to alerts.

With teams focused on firefighting, there is little time for proactive improvements that strengthen overall security. Unlocking more value from existing tools is often the fastest way to improve coverage without adding complexity.

Making Advanced Security Accessible with Platforms

Security platforms extend the value of EDR by providing visibility across the broader attack surface. By correlating signals from endpoints, cloud, identities, and networks, platforms turn fragmented insights into a unified view through Extended Detection and Response (XDR).

Many platforms are also shifting beyond reactive detection and response to include proactive prevention. Preventative controls help stop attackers before they gain a foothold, reducing pressure on already lean teams.

Solutions such as Bitdefender GravityZone consolidate critical security capabilities into a single platform, enabling centralized management, visibility, and reporting across the security program. This approach allows mid-market organizations to achieve broader coverage without increasing operational overhead.

Extending Coverage with MDR

Managed Detection and Response (MDR) services offer another way to strengthen security quickly. MDR provides 24/7 monitoring, proactive threat hunting, and incident response, effectively extending internal teams without adding headcount.

By combining a unified platform with MDR, mid-market organizations can close coverage gaps and focus internal resources on strategic priorities.

Takeaway: Security Across the Threat Lifecycle

Improving mid-market cybersecurity isn't about adding more tools—it's about using the right tools more effectively. Integrating prevention, protection, detection, and response across the threat lifecycle enables stronger security outcomes with less complexity.

Platforms like Bitdefender GravityZone help mid-market organizations strengthen resilience while reducing the operational burden on lean teams.

To explore this approach further, read How to Secure Your Mid-Market Business Across the Complete Threat Lifecycle or the Buyer's Guide for Mid-Market Businesses: Choosing the Right Security Platform.

Found this article interesting? This article is a contributed piece from one of our valued partners. Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.

from The Hacker News https://bit.ly/4kdMXIT
via IFTTT