Thursday, August 20, 2026

New Cryptographic Context Injection Attack Could Let Web Pages Steal Grok Chat Data

Adversa AI has disclosed an attack technique that it says can cause xAI's Grok chatbot to send a user's name, approximate location, subscription tier, and the prompts from the ongoing conversation to an attacker-controlled server after the user asks it to summarize an ordinary web page.

The AI security company, which has codenamed the technique "Cryptographic Context Injection," said the transfer completed without a confirmation step and with no visible warning in its proof-of-concept demonstration.

There is no patch, no CVE identifier, and no user-facing workaround, and the company said it could still reproduce the attack against Grok as of August 19, 2026. The writeup does not report any exploitation in the wild, and does not name the Grok model version or build tested.

The technique ships the attacker's instructions as ciphertext rather than readable text, with the page carrying an encrypted JSON object, the key material, and an instruction to decrypt it, which Grok executes in its own Python code execution runtime.

Recovering the plaintext requires running PBKDF2 and AES-256-GCM, which a content classifier does not do at inspection time. Hence, the instructions reach the model's context as the output of code the model has just executed rather than as fetched web content.

"Strong encryption cannot be read by a content classifier and cannot be shortcut in-weights, so it forces recovery through the runtime the attack depends on. Whether a weaker encoding would also bypass a given target's specific filters is an empirical question," security researcher Rony Utevsky said.

The decrypted instructions then direct the agent to resolve its private session context and embed it in a URL it is told to open to "fetch additional context."

One element of the chain has the model construct an additional "decryption key" that is not key material at all, and whose value is a template string interpolating the name, location, tier, and chat history. Grok then invokes its own navigation tool to load that URL, carrying the data in the request's query parameters.

"The framework built by xAI lets instructions and data parsed from an untrusted external page drive the invocation of a privileged, internet-connected tool; it allows private session metadata and conversation history to be resolved into the inputs of that outbound tool; and it enforces no effective egress boundary or consent gate on this path, and no provenance separation we could observe. The laundered, attacker-controlled instructions reach a privileged egress action unimpeded," Adversa said.

The company said it first reported the issue to xAI on June 3, 2026, and to xAI's HackerOne bug bounty program on the same date; that xAI acknowledged the report without providing specifics or a mitigation timeline, and that further contact attempts on August 4 and August 10 drew no response.

Adversa is the only source for the Grok finding, said it is withholding the operational payloads to avoid exploitation, and xAI has not published a statement or advisory on the research as of August 20, 2026.

A second demonstration in the same writeup targets Google's Gemini in Deep Thinking mode, where a single prompt makes the model decrypt a payload that resolves into a fabricated Python traceback carrying a bogus safety-policy deactivation callback and a first-person reasoning prefix that pre-commits it to the restricted output.

Adversa said the vector produced restricted content and reproduced Gemini's system instructions, which it identified as Gemini 3 Flash (Web) on the paid tier. Google was not notified, Adversa said, because jailbreaks are out of scope for its disclosure program, and the success rate against the company's agents had "dropped significantly by August," with the cause left unattributed between filter updates and model version changes.

The Gemini demonstration was published in substantially the same form five months earlier. Utevsky described the same chain on his personal research site on March 11, 2026, under the name Cryptographic Payload Injection, reporting five out of five independent reproductions and cross-model results in which OpenAI's GPT-5 failed to parse the decryption instructions and Anthropic's Claude Sonnet 4.5 flagged the payload as prompt injection after decrypting it.

"You do not need to fix this at the model layer. Every control that bounds this attack sits in the harness around the agent: what identity it runs as, what it can reach, what it can write, and what you can replay afterward," Adversa said.

Teams running agents are advised to perform the following steps -

  • Quarantine untrusted content in a context with no tools and no credentials, returning only structured data to the privileged context.
  • Gate irreversible and outbound actions, confirming new network destinations, pushes, merges, publishes, and writes outside the workspace with fully resolved arguments rather than templates, and applying a hard deny where no human is present.
  • Capture per-session tool traces with resolved arguments, without which there is neither detection nor forensics.
  • Alert on the sequence rather than on any single payload, treating an opaque blob paired with instructions to decrypt it as a review signal and never as a blocking filter.
  • Make context provenance a procurement requirement and ask vendors whether tool output is separated from the instruction channel.

The development comes as Alexander Panfilov and seven co-authors reported in a preprint published on August 10, 2026, that the encrypted chain-of-thought blocks Anthropic, OpenAI, and Google return to application programming interface (API) clients are interchangeable across sessions, users, and models within a provider's ecosystem, and that attackers can use the flaw to "execute invisible prompt injections, embedding malicious payloads entirely within encrypted blocks to poison public agentic rollouts."

Separately, researchers at UC Berkeley, the Ethereum Foundation, and NYU Shanghai found in work presented at USENIX Security 2026 that a two-turn attack in which the model decodes a substitution cipher and is then asked to act on the decoded text succeeded against Grok 3 on all 12 of the malicious intents tested, while the same cipher used without that second activation turn failed on all 12.

xAI's handling of prompt injection reports against Grok has drawn criticism before. In December 2024, Johann Rehberger demonstrated an end-to-end data exfiltration chain against Grok in the X iOS app, in which an indirect prompt injection caused the assistant to send previous chat information to a third-party server, and said all the issues he reported were closed as "Informational."

"xAI claims there is no practical impact with the reported vulnerability. I'm not sure how leaking user's chat messages and IP address is not a vulnerability, the question is more about severity," Rehberger said.



from The Hacker News https://ift.tt/y45TWMz
via IFTTT

NAS backup: best practices, backup methods, and enterprise solutions

A solid NAS backup strategy keeps stored data safe and recoverable when the primary hardware fails, a user deletes critical files, or a cyberattack hits the environment. Protecting a NAS takes more than RAID or snapshots. You’ll need independent copies that can be restored when the primary system is no longer trustworthy.

Below, we walk through the core backup methods, practical best practices, and enterprise storage options that help protect network-attached storage environments.

What is NAS backup?

NAS backup is the process of creating one or more additional copies of data stored on a Network Attached Storage (NAS) device so that you can recover it after accidental deletion, corruption, cyberattacks, or hardware failure.

Diagram comparing a primary NAS device with an independent NAS backup copy.

NAS vs. NAS backup

Vendors like Synology, QNAP, and TrueNAS cover most small and mid-sized deployments. Larger organizations tend to run enterprise arrays instead, sometimes NetApp, sometimes Dell PowerScale, sometimes a HyperFlex node that happens to expose NFS. The NAS itself is responsible for serving data. Backup has a different purpose: it creates an independent copy that can be recovered if the primary system is compromised, and that distinction (really, that separation) is what most homegrown plans quietly miss.

RAID keeps an array running through a drive failure, but it does not check whether the data being written is correct. Delete a folder by mistake and RAID preserves that mistake across every disk. You can’t get it back from the array, and worse, you usually can’t tell anything went wrong until you try to open the file. Snapshots offer more real protection by keeping point-in-time versions of the filesystem. They can help you restore a file from yesterday or last week, depending on the retention policy. However, snapshots usually reside on the same NAS as the production data. If the appliance itself is compromised, they’re likely affected as well.

This is exactly what several NAS-targeting ransomware campaigns exploited. DeadBolt, eCh0raix, and Qlocker targeted QNAP and Synology systems between 2019 and 2022 by compromising administrative access, encrypting file shares, and rendering local recovery mechanisms ineffective. RAID kept right on working through every one of those events. The arrays were healthy. The data inside them was already encrypted garbage, and there was no way to roll it back.

Replication copies data to a second NAS in near real time, which protects against hardware failure but faithfully replicates a corrupted file just as fast. That’s why dedicated NAS backup remains necessary. It provides recovery points that are independent of the primary NAS, whether you’re protecting a Synology or QNAP appliance or an enterprise storage array

Why NAS backup is essential

Data loss on a NAS often begins as something other than a storage failure. Accidental deletions and secondary drive failures during RAID rebuilds are common, but ransomware dictates modern backup architecture. According to Sophos’s 2025 report,, backup repositories are targeted in 96% of attacks and compromised in 76%. Groups like Akira actively harvest Veeam credentials from Active Directory before ever touching production data, which means the backup server itself is the first thing attackers go after, not the last. Local-only backups fail immediately against site-wide events like fires, floods, or power outages, and so do local-only anything.

These risks have changed cyber insurance. Underwriters now strictly require immutable backups and documented, evidence-based recovery testing to write or renew a policy, and “documented” is doing more work in that sentence than it looks like. A screenshot from 2021 doesn’t count.

Every NAS backup decision rests on RPO (maximum tolerable data loss) and RTO (maximum tolerable downtime). To meet these targets, the baseline is the 3-2-1-1-0 strategy: three copies of data, two media types, one off-site, one immutable copy, and zero errors confirmed through regular restore verification. The last digit is the one most shops still skip, which is also the first thing an auditor asks about.

NAS backup methods

Different backup methods solve different problems. Most production environments combine at least two of them so that fast local recovery and disaster recovery are handled separately. Picking only one tends to leave a gap you don’t notice until 2 a.m. on a Sunday.

Local backup

Local backup keeps a copy close to the source, which means a fast job and a fast restore. An external drive rotated in and out of the office is the cheapest version, but it depends on someone remembering to swap it, and that step quietly stops happening within a few busy weeks. A secondary NAS or a dedicated backup appliance removes that dependency and adds real throughput, retention management, and deduplication on top.

Whether a nightly backup fits within the available backup window depends on several factors working together: total data volume, the daily change rate, and available network bandwidth. Capacity alone doesn’t determine how long a backup takes. A large archive that changes very little may complete quickly using incremental backups; a much smaller surveillance system that continuously generates new footage may require far more time because its daily change rate is much higher. For that reason, most local backup jobs rely on incremental processing with integrity checks so that each cycle verifies the data instead of simply assuming that a completed job is valid.

Local backup still fails the off-site half of the 3-2-1 rule on its own, no matter how it’s built. A fire, or a NAS-targeting ransomware strain that reaches the local network, can take out the primary NAS and its local backup in the same event. It’s a solid first layer, and it was never meant to be the whole strategy.

Off-site backup without a cloud subscription

Cloud isn’t the only way to get a copy off-site. A second NAS or backup appliance at a branch office, a colocation facility, or another site the organization already operates can serve the same purpose, replicated on a schedule over a VPN tunnel or a straightforward rsync job.

Once the hardware is in place, there’s no recurring subscription, which matters for organizations sitting on tens of terabytes where cloud egress and storage fees add up fast. The tradeoff is that someone’s still got to manage that second box: patch it, monitor it, and make sure its retention and immutability settings actually match the primary site’s. Organizations without a second physical site tend to find cloud or object storage more practical by default. Those that already run more than one location often find replicating to hardware they control cheaper over a few years, especially after the third renewal quote lands in their inbox.

Cloud and object storage backup

Cloud and object storage backup extend protection past the building the NAS sits in. Public cloud platforms provide virtually unlimited capacity without requiring organizations to manage storage hardware. The tradeoff is ongoing storage and data transfer costs, which can be acceptable for businesses with seasonal growth or fluctuating backup requirements. Private cloud environments keep the storage infrastructure under direct organizational control, which can be important for industries with strict data residency or regulatory requirements.

Many organizations adopt a hybrid approach. Local backups provide fast day-to-day recovery, while cloud or object storage provides off-site protection and long-term retention. This combination is common in mid-sized and enterprise NAS deployments because it balances recovery speed with resilience.

S3-compatible object storage has also become a widely supported backup target. Because many backup applications can write to the S3 API, organizations gain more flexibility when selecting storage providers. Compatibility still varies between vendors and backup software, so it’s worth validating supported features before standardizing on a platform – WORM support, specifically, because not every S3-compatible target actually enforces it.

Pricing differs by provider, region, and commitment level, and it changes over time, but standard cloud storage tiers have commonly landed somewhere in the mid-single digits per terabyte per month in recent years. Some providers, such as Wasabi, don’t charge egress fees at all as long as monthly downloads stay within the stored volume, which matters for organizations that actually test restores on a regular basis. Since pricing changes regularly, it’s best to verify current rates directly with the provider.

Immutable storage relies on write-once-read-many (WORM) protection: once a backup is written, it can’t be deleted or modified for a defined retention period, even from a compromised administrator account. It’s one of the most effective technical controls against a ransomware group that’s already inside the network. Off-site protection and NAS disaster recovery follow from there: a copy that’s physically and logically separated from the primary NAS survives whatever takes out the entire primary site, which is the whole point of having the second copy in the first place.

Object storage also scales by adding capacity instead of requiring a redesign of the backup architecture. That’s why it’s become common in enterprise NAS backup environments. S3-compatible immutable storage is now available both as a cloud service and as on-premises infrastructure, including appliances such as DataCore Swarm Appliance for organizations that want to retain direct control of their data.

NAS backup best practices

The technology you choose matters, but the overall backup design is what determines whether you can recover from an incident.

Follow the 3-2-1-1-0 backup strategy

Three copies means the original plus at least two backups. One copy alone is a single point of failure with extra steps. Two different storage media protects against a single technology failure, bad drive firmware, or a faulty batch of disks taking out every copy at once. One off-site copy covers events that take out an entire building: fire, flood, theft, a site-wide ransomware outbreak. One immutable copy is the piece most pre-ransomware backup strategies were missing: data that can’t be encrypted, altered, or deleted even by a compromised admin account, for a defined retention window. And zero errors confirm that backups are recoverable through regular restore testing. The final point is often the most overlooked. A backup job that reports “successful” isn’t the same thing as a backup that has been restored and verified. The only way to know whether your recovery process works is to test it.

It also helps to remember that a NAS used as a backup repository is still a storage system that needs protection. Holding copies of other systems doesn’t make it immune to hardware failure, ransomware, or site-wide incidents. The backup repository itself should have an off-site copy or replication target.

Immutability is a useful security control, but it isn’t the end of the backup strategy. A backup that can’t be deleted is useful, yet you still need to know that it can be restored within the required recovery window. Regular recovery testing validates the entire chain: the backup data, the storage platform, the credentials, the recovery procedures, and the time required to bring systems back online. Immutability protects the copy from being destroyed. Restore testing confirms that the copy can actually return the business to operation when it’s needed.

Tier backups by data criticality

Not every file on a NAS needs the same level of protection. Applying the most expensive backup policy to everything can quickly drive up storage and operational costs without reducing meaningful risk. Financial records, contracts, source files, and original photo or video assets are usually difficult or impossible to replace. These datasets should be versioned, encrypted, and protected with at least one immutable off-site copy.

Other data may have a much lower recovery priority. Archived project renders, licensed stock assets, or old software installers can often be downloaded or regenerated if necessary. A simpler backup tier may be sufficient for this type of content.

The goal is to match the protection level to the business value of the data. Applying the full 3-2-1-1-0 strategy to every terabyte can become unnecessarily expensive, while using the same policy for everything can make it harder to identify what actually needs the strongest protection.

A tiered approach gives you a more practical balance: critical data receives stronger protection and longer retention, while replaceable data uses fewer resources.

Automate and test backups

Scheduled backups exist for a simple reason: manual backups get missed. Automation makes the backup strategy repeatable and ensures jobs continue to run regardless of who’s available to manage them. A successful backup job doesn’t prove that the data can be recovered, though.

Restore testing is one of the steps organizations most often postpone until an incident makes it urgent. Regular testing gives you an opportunity to find problems while there’s still time to fix them. It also provides evidence that your recovery procedures work, which matters more than ever for security audits and cyber insurance requirements.

Many backup failures are surprisingly mundane. A service account password expires and the scheduled job can no longer authenticate. A backup volume reaches capacity and new jobs begin skipping files. A network change interrupts transfers. None of these problems necessarily cause an obvious outage.

This is where monitoring matters most. Your backup environment should alert you to failed or missed jobs, unusual backup durations, storage capacity thresholds, authentication failures, and other conditions that could compromise recovery.

Encryption should cover both data at rest and data in transit, particularly when backup copies leave the organization’s direct control. For off-site and cloud backups, this protects data while it’s being transferred and while it resides on the remote storage platform.

Integrity verification provides another safeguard. Checksums and other validation mechanisms can detect silent corruption in backup data before you actually need to restore it. Automate the backup, monitor the result, and periodically perform a real restore.

Common NAS backup mistakes

Even organizations that understand the difference between NAS reliability and NAS backup fall into a handful of recurring traps. Watching for these often matters more than any specific tool choice.

Treating RAID or snapshots as backup

RAID protects availability when a disk fails. Snapshots provide point-in-time recovery. Neither one provides an independent backup copy. The distinction can be easy to overlook because a healthy RAID array and a working snapshot schedule both create a sense that the data is protected. The gap only becomes visible during an actual incident, which is the worst possible time to find out.

Keeping the only backup on the production site

A local backup is useful for fast recovery, but it shouldn’t be the only copy. A fire, theft, flood, prolonged power incident, or ransomware attack that reaches the local network can affect both the production NAS and its backup target. At least one recovery copy should therefore be kept in a separate location.

Never testing a restore

A backup job reporting “success” doesn’t guarantee a successful restore. Restore testing should cover more than a single sample file. For critical systems, periodically test the recovery of representative datasets and measure how long the process takes. This is the only reliable way to determine whether your RTO is realistic.

Applying the same policy to every file

Treating every dataset identically can create two problems at once: you may spend too much protecting replaceable data while still failing to provide adequate protection for business-critical information. Classifying data by recovery priority, retention requirements, and business impact makes the backup strategy easier to manage as the NAS environment grows.

Leaving the backup repository itself unprotected

A backup repository is still a storage system. If it’s damaged, encrypted, or lost in the same incident as the primary NAS, the copies stored there may disappear with it. Protect the repository with appropriate access controls and, where required, maintain a separate off-site or immutable copy.

Choosing a tool without modeling growth

Backup costs often change substantially as the environment grows. A licensing model that looks attractive at 20 TB may become much less appealing at 100 TB.

Before selecting a solution, model expected data growth, retention requirements, and the resulting licensing and storage costs over several years. This is especially important for capacity-based licensing, where the cost can increase directly with the amount of protected data.

How to choose a NAS backup solution

Once the backup architecture is clear, picking the right technology gets easier. Whether you use NAS-native software, a dedicated backup appliance, enterprise backup software, or a mix of these, the solution has to fit both your current environment and its expected growth.

Several criteria deserve a close look before you commit:

  • Scalability The solution should absorb expected data growth without forcing a major migration in the near future. Plan around your actual growth rate, not today’s footprint
  • Recovery speed Measure how quickly the platform can restore real workloads, not how fast a backup job reports success. The two numbers can be wildly different
  • Immutable storage support Enforce immutability at the storage or repository level so a compromised admin account can’t simply remove the protection
  • Cloud and object storage compatibility S3-compatible storage gives you extra options for off-site backups and long-term retention without forcing a different architecture later
  • Security features Encryption, access controls, authentication, ransomware protection, and integrity verification all belong in the backup workflow
  • Ease of management During an incident, admins need to identify the correct recovery point and start a restore quickly. A complicated interface becomes a serious operational problem under pressure
  • Total cost of ownership Weigh software licensing, hardware, storage growth, network costs, cloud storage, egress fees, and the admin effort required to run the platform
  • Integration with existing infrastructure A solution that works with your existing backup software, storage protocols, and operational processes is generally easier to introduce and maintain

Capacity-based licensing deserves a closer look during evaluation. Run the numbers at today’s capacity, then again at where you’ll be in three to five years. That math alone can expose a substantial gap between products that initially look similarly priced – the kind of difference that doesn’t show up until year two or three of the contract

With those factors in mind, here’s how the main NAS backup approaches stack up

Comparing NAS backup approaches

No single category wins outright. Each one fits a different combination of scale, budget, and in-house expertise, so the table below lines up the main options (open-source tools and the major enterprise platforms) against the criteria that matter most

Approach Examples Best for Native immutability Typical cost model
NAS-native backup software Synology Hyper Backup, QNAP Hybrid Backup Sync Small deployments already standardized on one NAS vendor Limited, vendor-dependent Included with the NAS
Open-source tools restic, rclone, Duplicati Technical teams that want full control over destinations and scripting Depends on the target storage Free software; pay only for storage
Enterprise backup platforms Veeam, Commvault, Rubrik, Cohesity Larger environments needing centralized policy, reporting, and multi-workload support beyond just NAS Native, policy-based Capacity-based licensing, usually the largest line item
On-premises S3-compatible object storage DataCore Swarm Organizations that need object storage and immutability without a public cloud subscription Native Hardware plus software licensing
Public cloud object storage Backblaze B2, Wasabi, AWS S3 Organizations without a second physical site, or needing effectively unlimited off-site capacity Native, via object lock Per-gigabyte storage, plus possible egress fees

Your data volume, retention period, recovery objectives, existing infrastructure, and operational expertise all influence which approach makes the most sense. There isn’t a single right answer, and plenty of environments end up combining two or three of these tiers

DataCore Swarm Appliance

DataCore Swarm Appliance gives you a local S3-compatible backup repository for environments that need object storage without managing a custom cluster. It ships as an integrated hardware and software unit, and it includes retention locking, cryptographic integrity checks, self-healing via replication and erasure coding, and encryption at rest and in transit. It’s been validated as an S3 target for major backup platforms like Commvault, Veritas, and Rubrik, so it fits scenarios where teams want a dedicated, scalable storage target for long-term retention

Conclusion

NAS reliability and backup aren’t the same thing, even though they get lumped together constantly. RAID, replication, and snapshots can improve availability and give you useful recovery options, but they don’t replace an independent backup strategy. Confusing the two is how organizations end up with a backup that’s been encrypted right alongside the source

If you keep the two ideas separated (independent copies, off-site protection, immutability, appropriate retention, and regular restore testing), you can recover the data you need within the time the business can afford, even when the systems you normally rely on are no longer available. If you don’t, the day you find out won’t be a good one

FAQ

Can I back up a NAS to object storage

Yes. Most modern backup software supports S3-compatible object storage as a repository, which is why it’s become a common choice for off-site, immutable, and long-term NAS backup retention

What’s the most common reason a NAS backup restore fails when it’s actually needed

Rarely the backup software itself. Common culprits include expired credentials on the restore target, incorrect immutability or retention settings, and restore procedures that were never tested against a realistic dataset. A small test file can restore fine while a production-scale recovery runs into insufficient capacity, unexpected dependencies, missing permissions, or an RTO the platform can’t meet



from StarWind Blog https://ift.tt/QIFucBl
via IFTTT

Isolated-vm Flaw Lets Sandboxed JavaScript Escape to Host for Potential RCE

Cybersecurity researchers have disclosed a critical security flaw in isolated-vm, a popular open-source sandbox with more than 2,900 stars and 190 forks on GitHub, that could allow attackers to escape the confines of the isolated environment.

The vulnerability ("GHSA-864f-rcv7-6rh4"), which has yet to be assigned a CVE identifier, impacts all versions of the library before and including 7.0.0. It has been patched in versions 6.2.0 and 7.0.1 released earlier this month.

Isolated-vm is a Node.js library for running untrusted JavaScript inside a V8 Isolate, an independent instance of the Google V8 JavaScript engine, allowing multiple sandboxed JavaScript environments to run concurrently without sharing data or interfering with each other. The npm package has witnessed nearly 1 million downloads over the past week.

Because each V8 Isolate has a separate state and maintains its own heap, it is not possible to directly pass JavaScript objects from the main Node.js thread into a worker isolate. Isolated-vm exposes a class called ExternalCopy to securely serialize JavaScript objects out of the host isolate and deserialize them into the guest isolate.

The vulnerability identified by Endor Labs resides in this component, allowing code running inside the sandbox to break out and corrupt memory in the host application.

"A type confusion in ExternalCopy's handling of the transferList option lets code running inside the sandbox corrupt memory in the host process," Endor Labs researcher Cristian-Alexandru Staicu, who is credited with discovering and reporting the flaw, said in a technical write-up shared with The Hacker News.

"Starting from nothing but a single ivm.Reference, the standard way hosts hand a sandbox any capability at all, we escalated the bug from a controlled-address crash all the way to hijacking the host's control flow, demonstrating a full guest-to-host sandbox escape."

Successful exploitation of the flaw allows memory corruption in the host process, causing the host process to crash with a segmentation fault (SIGSEGV). It can also lead to a guest-to-host sandbox escape and an erosion of the trust boundary that undermines the very purpose of isolated-vm.

"Minimum demonstrated impact is a reliable, controlled-address crash (denial-of-service) triggerable by any guest that has been given an ivm.Reference (the standard way to grant a sandbox any capability)," project maintainer Marcel Laverdet said in an advisory.

"Maximum demonstrated impact is control-flow hijack of the host process, i.e., potential remote code execution in the host."

Users who have isolated-vm installed in their developer environments are advised to update to the latest version for optimal protection. Additional details of the full exploit have been withheld so as to prevent bad actors from launching their own attacks.

"The most important takeaway is that what was not broken was the isolation primitive itself," Staicu said. "V8's Isolate boundary held. What failed was the C++ glue code that marshals values across that boundary. A perfectly sound building block was undermined by the binding layer wrapped around it."



from The Hacker News https://ift.tt/SnDACJt
via IFTTT

Attackers Exploit Zimbra SNMP Flaw for Unauthenticated Remote Code Execution

A now-patched security flaw impacting Zimbra Collaboration (ZCS) has come under active exploitation in the wild, according to the Polish Computer Emergency Response Team (CERT Polska).

The vulnerability in question is CVE-2026-73570 (CVSS score: 8.9), which refers to a case of command injection that can lead to remote code execution.

"A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed, and SNMP notifications are enabled," according to a description of the flaw in the NIST National Vulnerability Database (NVD).

"Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user."

The security issue was patched by Zimbra last month with the release of version 10.1.20.

In a bulletin issued earlier this week, CERT Polska alerted of active exploitation efforts targeting the flaw, urging users to check the "/var/log/zimbra.log" file for suspicious Zimbra service restarts, as well as for files created in the below directories within the last 30 days -

  • /opt/zimbra/jetty/webapps/
  • /opt/zimbra/jetty_base/webapps/
  • /tmp/

Vulnerabilities in Zimbra have been frequently targeted by threat actors. Last month, the U.S. government disclosed details of a phishing campaign orchestrated by a Russia-linked adversary called Laundry Bear (aka CL-STA-1114, TA488, UNK_PitStop, and Void Blizzard) that involved targeting Zimbra mail servers belonging to Western government and commercial organizations since at least July 2025.

The campaign was found to have weaponized CVE-2025-66376, a stored cross-site scripting vulnerability in Zimbra's Classic UI, to deliver a malicious JavaScript payload dubbed ZimReaper to harvest email communications and other sensitive data.



from The Hacker News https://ift.tt/zJ1uvdA
via IFTTT

Protecting Water and Wastewater Infrastructure from Cyber Attacks

Water and Wastewater Treatment Facilities Under Attack

This Is Happening Right Now

On July 30, 2026, the FBI and EPA issued a joint Public Service Announcement warning that malicious cyber actors are attacking internet-facing programmable logic controllers (PLCs) at water and wastewater utilities. Since July 27, 2026, utilities in at least seven states have reported incidents, and some of those attacks degraded water operations.

The details are worth reading closely. Attackers reached Rockwell Automation/Allen-Bradley MicroLogix 1100 and 1400 series PLCs directly over the internet, changed their IP addresses, and set new passwords. Operators lost the ability to see and control their own equipment. Reported effects included loss of water pressure and flooding, and at least one utility discovered modified ladder logic across several sites. Pressure loss is not an inconvenience. It can allow untreated groundwater to seep into distribution pipes.

One more detail deserves attention: the FBI noted that similar network setups installed by third parties across multiple utilities let the attackers multiply their success. A vulnerable cookie-cutter deployment at one site is a vulnerable deployment at every site that integrator touched.

Why Utilities Are Vulnerable

Nation-state groups, criminal organizations, and other malicious actors have learned that water and wastewater utilities are attractive targets. Successful attacks disrupt essential services, threaten public health, and undermine public confidence. Most attacks focus on operational technology (OT), including PLCs, human-machine interfaces (HMIs), remote telemetry units (RTUs), and other control systems that were designed for reliability rather than internet exposure.

Operators in this sector face real challenges in their mission:

  • A mix of federal, state, local, tribal, and territorial agencies govern many utilities
  • Population growth can strain current distribution and collection infrastructure
  • Many OT devices prioritize reliability and availability over modern network protections
  • Smaller utilities don't have large budgets for security measures or hardware upgrades. In many cases, deployed hardware has reached end-of-life (EOL) status and will never receive another security update. The FBI notes that EOL devices are routinely targeted for exactly this reason.

What the FBI and EPA Recommend

The PSA's guidance is direct, and it echoes earlier federal guidance for the sector:

  • Disconnect PLCs from the public-facing internet. Remove inbound port exposure entirely, and mediate all remote access through a secure gateway that brokers the connection
  • Secure cellular modems used for field connectivity with strong authentication, and consider isolated architectures such as private APNs, ZTNA, or site-to-site VPNs
  • Strictly control network access to PLCs with firewall rules or ACLs that allow only authorized communications between expected control system devices, and block traffic from unauthorized sources such as hosting-provider IP space
  • Use strong, unique passwords on every device
  • Block unauthorized changes to logic, configuration, and firmware, and review project files for tampering
  • Plan for EOL replacement, and where replacement must wait, isolate EOL assets behind compensating controls

Notice what almost every one of these recommendations has in common: they are firewall problems. The attacks in this PSA succeeded because PLCs were directly addressable from the internet. Every mitigation on the list either removes that exposure or controls what can talk to the device once it's removed.

How Netgate Helps Secure Utility Networks

Netgate® appliances running pfSense® Plus software implement these recommendations directly:

  • End direct internet exposure. A pfSense Plus security gateway in front of a PLC, with default-deny inbound policy and no port forwards, removes the entire attack class described in the PSA. If the PLC is not addressable, it cannot be found, and it cannot be tampered with remotely
  • Broker all remote access. Instead of an exposed PLC port, remote vendors and staff connect through encrypted VPN (WireGuard, OpenVPN, or IPsec) with per-user credentials, then through a jump host, and only then to control systems. This is exactly the mediated access model the FBI describes. It works over cellular field connections too: a site-to-site tunnel over the cellular link means the modem exposes nothing
  • Enforce the Access Policy. Put PLCs on their own network segment and write firewall rules that permit only the SCADA server, HMI, and engineering workstation on the specific ports the control protocol requires. Block everything else in both directions. Egress filtering matters here: a PLC has no business initiating connections to the internet, and blocking outbound traffic frustrates the attacker's infrastructure even after a compromise elsewhere.
  • Enable DNS Filtering and Zero-Trust Egress: Threatgate, a filtering capability built into pfSense Plus can prevent your devices from reaching out to the internet unless the destination is explicitly allowed by policy.
  • See what's happening. Firewall logs, exported to your syslog server or SIEM, plus Snort version 3 intrusion detection on the OT segment, give you the monitoring and review capability the PSA calls for
  • Wrap what you can't patch. An EOL PLC that will never see another firmware update can still be defended. Isolating it behind a firewall that admits only enumerated, authorized paths is precisely the compensating control federal guidance prescribes

Utilities can deploy pfSense Plus security gateways at network boundaries to restrict unauthorized communications between operational networks, customer-facing networks, and internet-connected systems. Site-to-site VPNs protect communications between facilities, while our Nexus controller provides centralized management using Zero Trust Network Access (ZTNA). For the multi-site utility, central management answers the PSA's warning about replicated third-party setups: you can see every site's configuration and version state from one place, instead of trusting that each installation is still what the integrator left behind.

before-1

after-1

Each pfSense Plus security gateway comes with the following:

  • pfSense Plus updates for the life of the product
  • TAC Lite zero-to-ping technical assistance for the life of the product
  • Access to no-cost training for pfSense Plus
    • Certifications available

Network Security That Fits Utility Budgets

The utilities in this PSA were not compromised for lack of a million-dollar security program. They were compromised because control devices sat naked on the internet. Fixing that does not require a rip-and-replace project or a consulting engagement. It requires a capable security gateway at each site, configured once, managed centrally.

Netgate pfSense Plus security gateways are low-cost, in stock, and can ship today! We have a number of pfSense Plus appliances under $1000:

Need help choosing the right appliance for your environment? Contact our sales team for personalized guidance.

Protecting Critical Infrastructure

Water and wastewater operators cannot eliminate every threat, but they can eliminate the one this PSA describes: direct internet exposure of control systems. Limiting exposure, controlling network access, and encrypting remote communications remain the highest-value moves in the sector, and they are the exact moves the FBI and EPA are asking operators to make now. Netgate solutions help utilities implement these recommended practices quickly, economically, and without disrupting critical operations. Our products are trusted worldwide, used by organizations of every size, and deployed across government, education, utilities, healthcare, and enterprise networks.

If your utility has experienced similar OT outages, the FBI asks that you contact your local field office and file a complaint with the IC3 at ic3.gov.



from Blog https://ift.tt/OlQZRPM
via IFTTT

Elementor Pro Flaw Could Let Unauthenticated Attackers Upload PHP and Execute Code

Cybersecurity researchers have disclosed details of a critical flaw in the Elementor Pro WordPress plugin that, if successfully exploited, could lead to remote code execution.

The vulnerability, tracked as CVE-2026-32475, carries a CVSS score of 9.0 out of 10.0. It has been described as a case of unrestricted upload of a file with a dangerous type.

"The flaw lives in the Forms module's File Upload field, where the extension check and the file-move step run in two separate loops with different handling of empty file entries," Patchstack said.

"By submitting two file parts for the same field, an unauthenticated attacker skips the extension blocklist entirely and writes a PHP file into a public directory."

This discrepancy in how it validates the file's extension and moves the uploaded file to a public directory when empty file entries are processed turns a restricted file-upload field into an unauthenticated remote code execution primitive.

Successful exploitation of the flaw could allow an attacker to upload arbitrary files, including PHP scripts, that could then be used to achieve remote code execution on affected systems. The security defect impacts all versions of the plugin prior to and including version 4.2.1.

The WordPress security company said the only precondition required to pull off an attack is that the target site has at least one published Elementor page containing a Form widget with a File Upload field. The uploaded file is written as "wp-content/uploads/elementor/forms/<uniqid>.php," where "<uniqid>" is the output of PHP's uniqid() function.

"This is an extremely common, everyday configuration: job-application forms, 'attach a photo/ID/receipt' forms, and support-ticket attachments all use it," it noted. "The field's 'Required' toggle being off is its default state, so no hardened or unusual setting is needed."

Security researcher Tin Pham (aka TF1T) has been credited with discovering and reporting the flaw under the Patchstack Bug Bounty Program. After the issue was reported to Elementor Pro on July 16, 2026, a patch (version 4.2.2) was released on August 19.

The release comes a little over a week after WordPress released 7.0.4 to address a high-severity security issue (CVE-2026-65640, CVSS score: 8.8) that enables remote code execution via malicious Postscript file upload by an Author-level user or higher. It affects WordPress core versions 4.7 all the way up to 7.0.

However, for the attack to be successful, two conditions have to be satisfied -

  • Imagick and Ghostscript in use on the server, given the issue is in Ghostscript's handling of certain embedded files
  • A malicious user with the upload_files capability

The update "changes how WordPress hands your uploaded media to ImageMagick, and it closes a path that could let a logged-in author turn an ordinary-looking image upload into code execution on your server," Patchstack said.

"If you run a multi-author publication, a membership site, a client site with contributors, or anything with open or loosely managed registration, that bar is a lot lower than it sounds. On those sites, an Author uploading a booby-trapped 'image' is a genuinely realistic threat, not a theoretical one. If it's just you and a tightly held set of trusted editors, your exposure is smaller."

The findings also coincide with the discovery of a large-scale operation dubbed StopAndProtect that's turning thousands of compromised WordPress websites into a distributed infrastructure for malware delivery, command-and-control communications, and the storage of stolen data.

WordPress users are advised to keep their websites and plugins up-to-date, scan for unauthorized modifications that serve unexpected redirects or pop-ups, and audit them for unknown accounts and plugins.



from The Hacker News https://ift.tt/J9Se0Mj
via IFTTT

Wednesday, August 19, 2026

OpenAI Pauses Frontier RL Training as It Tightens Defenses Against Unsafe AI Behavior

OpenAI on Tuesday revealed that it paused reinforcement learning (RL) training for its latest artificial intelligence (AI) models for two weeks while it shored up additional defenses and increased the scope of its monitoring to avert another Hugging Face-like incident.

"As models become more capable, the risks associated with developing and testing them internally also grow," the AI company said. "Our standards for monitoring, alignment, and security must stay ahead of those risks. We wanted to take the time necessary to meet those standards, so we temporarily slowed the pace of scaling."

The company said its largest planned frontier RL run remains on hold for the time being as it conducts smaller-scale training and evaluations to evaluate model behavior, validate its safeguards, and establish more concrete evidence of alignment before moving to the next phase.

To that end, OpenAI said it plans to strengthen safeguards across its development process, including monitoring to better respond to unintended and concerning behavior; alignment to reduce the likelihood of harmful or unauthorized actions; and security measures to limit what AI systems can access or affect.

Part of this involves stronger sandboxes, network isolation to prevent internet access, and continuous security testing to remove potentially vulnerable shared services, reduce standing privileges, and improve security and trust boundaries.

The development comes days after OpenAI said it's pausing some "internal activities" involving its upcoming artificial intelligence (AI) model Astra after an internal evaluation found it had made significant advancements in agentic coding and cybersecurity.

"While some Astra training and evaluations meet those requirements, a significant number of workloads remain paused until they are fully migrated and enhanced to meet the new security bar," the company stressed. "We are prioritizing safety and alignment workloads for migration to these new environments first."

In tandem, the monitoring setup has been revamped to flag and escalate potential concerns to "increasingly sophisticated and high-compute automated investigators," which then examine tool actions, available reasoning, and the full sequence of activity for unauthorized access, data theft, destructive behavior, and attempts to defeat safeguards.

OpenAI plans to issue an alert within 30 minutes after concerning activity is surfaced through this monitoring mechanism. The approach is being made mandatory for all RL training and evaluations involving tools for models of Sol capability or higher. These safeguards are expected to increase compute overhead by 20% of the observed inference workload.

"As models gain advanced capabilities, such as the ability to cyberattack, and operate in more complex environments, misaligned behaviors like reward hacking (finding ways to receive high rewards in training without actually achieving the intended outcome), deception, or unauthorized access will create increasingly serious risk," the company pointed out.

Indeed, new research published by rival Anthropic last week found that AI agents, when placed in situations with competing and contradictory objectives, began to sabotage others and deployed self-replicating malware against one another, leading to what has been described as a "multi-agent turf war."

"This included disabling the Unix accounts of the other agents, writing automated scripts that found and killed competing processes on a loop, and deploying malicious code that was disguised as belonging to another agent," Anthropic said.

While concerns about autonomous systems going rogue have become a hot topic of discussion, the study seeks to understand what new behaviors and possibly harmful dynamics can emerge when multiple agents interact with one another or are pitted against each other.

These interactions can lead to situations in which they coordinate and work in unison in pursuit of a common goal (as in the case of the Hugging Face incident) or compete with each other before attempting to resolve their conflicts through a "tournament."

In another case that recently came to light, an Australian man's attempts to reserve a spot in one of the popular gym classes through OpenClaw led to unexpected consequences when Anthropic Claude Opus 4.6, the model plugged into the AI assistant platform, went ahead and booked a gym class months in advance by taking advantage of a vulnerability it discovered in the booking software.

Even worse, it found a way to hack into the system and cancel other members' reservations off the waitlist. The incident, which took place in April 2026, is yet another example of how AI agents will go to any lengths to accomplish the tasks they have been assigned, even if it means breaking established rules.

To counter such risky emergent patterns, OpenAI said it's taking steps to improve reward models to better detect and discourage unsafe behavior; train models to be more transparent about their actions, capabilities, and limitations; and reduce behaviors that exploit weaknesses in rewards, graders, tools, or oversight.

The development comes a day after the company said AI may tilt the scales of cybersecurity in favor of defenders, as it makes it easier to find, prioritize, and fix flaws in existing systems before they are likely to be discovered by AI-powered attackers.

"We are using frontier intelligence to continuously enumerate, probe, and identify potential attack paths," OpenAI's Greg Brockman said. "By identifying vulnerabilities, misconfigurations, overly privileged identities, or unintentional trust boundaries, we are able to quickly identify and close these gaps before they can be abused by attackers."

Another crucial layer of defense goes without saying: investing in fundamentals, which means secure architecture and controls, implementing defense in depth strategies and the principle of least privilege (PoLP), and designing systems that require multiple independent controls for failure.

"Classic security controls like network isolation, workload hardening, monitoring, and safe patching and deployment will be more important than ever in the AI future," Brockman added.

According to a WIRED report last week, OpenAI's rogue-agent hack of Hugging Face has not only been a "watershed moment" for AI safety and cybersecurity, but has also sparked concerns that competitive pressures to ship new AI models and products have made it difficult for employees to adequately prioritize safety, security, and alignment.

Frontier AI labs like Anthropic, OpenAI, and Meta have faced increased scrutiny in the wake of incidents in which their models escaped safeguards and containment boundaries during security testing and targeted real-world systems in some cases.

AI safety testing firm Irregular has since disclosed that the breach involving Anthropic was due to a naming error, which caused a fictional company name used during hacking simulations to unknowingly match with a real domain. This, in turn, caused the models to take offensive actions.

The Israeli company said it was because of "human oversight" and said the issues have been remediated. However, it did not disclose how many such incidents occurred, instead opting to describe them as a "handful" or "small fraction" of cases. A thorough investigation remains ongoing.

It also emphasized that there is no evidence of a "customer's systems being breached or customer's data being leaked," referring to the AI companies it partners with to stress test AI models, and that "all subsequent public disclosures refer to the same underlying issue" rather than "materially separate incidents."

"Because internet access was enabled in the environment, the domain was targeted a limited number of times by different models, which mistook it for part of the challenge they were tested on," it said. "After obtaining access to the target, models took actions such as exploiting vulnerabilities, extracting credentials, and obtaining access to a production database."

"Ultimately, most of the issues we've discovered were due to internet access controls. Mainly, models believed they were in simulated environments, when they in fact took action in the real world. We are putting in place new and robust protocols to ensure setup issues do not occur while meeting the constraints of the testing process."



from The Hacker News https://ift.tt/lKHf7Ej
via IFTTT

Microsoft named a Leader in the Frost Radar™: Cloud Workload Protection Platforms, 2026

Security teams are overwhelmed with findings but still struggle to answer a simple question: which risks matter right now? A vulnerability alone is rarely the problem. The same vulnerability running in production, exposed through a misconfiguration or over-permissioned identity, is a real path to compromise. Organizations do not need longer lists of alerts. They need context that connects code, cloud resources, identities, and runtime activity so they can prioritize the issues that pose the greatest risk and stop cyberthreats before they reach production.

As organizations adopt cloud-native architectures at scale, protecting workloads requires more than scanning. Today, 82% of container users run Kubernetes in production, making runtime visibility and protection critical for modern applications.1

That change, from scanning workloads to protecting them where they run, is exactly what Frost & Sullivan describes in its Frost Radar™: Cloud Workload Protection Platforms, 2026. Out of more than 45 qualified vendors, it benchmarked 20, and it found the category moving to a single runtime security model, one that ties together code, cloud, runtime, identity, and the security operations center (SOC).

Within that market, Frost & Sullivan names Microsoft a visionary leader, its category for vendors that balance innovation with growth and help set the direction of the market. Microsoft is also the largest cloud workload protection platform (CWPP) provider by revenue, with an estimated share of more than 22% of the global CWPP market. In the analyst’s words:

“Microsoft is positioned as a visionary leader in this analysis for its scale and breadth of [Microsoft] Defender for Cloud within a unified framework. The platform stands out for its breadth of coverage across infrastructure, workloads, identities, entitlements, data, and applications, and for its deep integration with Microsoft’s broader security ecosystem, allowing organizations to secure modern and AI-native application lifecycles, while reducing operational complexity.”

Scale and breadth, in one framework. That is what customers are asking for, and it is where this category is heading. 

Radar chart showing cybersecurity companies ranked by Growth Index (vertical axis) and Innovation Index (horizontal axis). Microsoft is positioned near the top-right, indicating high growth and innovation, alongside other notable companies like Wiz, CrowdStrike, and Palo Alto Networks, with concentric circles marking index levels.

Why cloud workload protection is being redefined

For a long time, protecting a workload meant scanning its image, fixing known vulnerabilities, and hardening configurations before deployment. That still matters. But it is no longer enough, because what looks safe before deployment can become exploitable once the workload is running.

Most teams are also dealing with real sprawl. A modern estate spans several clouds and mixes containers, Kubernetes, serverless functions, microservices, and AI workloads. Every layer throws off its own signals, and those signals rarely connect on their own. One misconfiguration looks harmless until it sits next to an over-permissioned identity and a container that is already live. Then it is a path into production.

The tools were not built for this. Posture sits in one console, workload scanning in another, detection in a third, and teams are left connecting them by hand, usually in the middle of an incident. What they need instead is one platform that can:

  • Bring posture, runtime, identity, and control-plane signals into one place.
  • Rank risk by what is truly exploitable, not by a severity score alone.
  • Stop risky workloads close to deployment, before they reach production.
  • Get what it finds at runtime to the developers and the SOC who can act on it.

The market is moving the same way. Frost & Sullivan expects CWPP spending to grow from $6.43 billion in 2025 to about $7.95 billion in 2026, and 19.1% a year through 2030. That is teams voting with their budgets to modernize cloud security, meet regulation, and protect the workloads behind their apps, data, and AI services.

What distinguishes leading platforms

Frost & Sullivan scores vendors on two things: how fast they innovate and how fast they grow. But the report is blunt about something more telling: the bar for leadership has moved. It is now, in the analyst’s words:

“Increasingly defined by runtime telemetry depth, container, and K8s security, workload behavior analysis, cloud-native threat detection, remediation and response automation, SOC integration, AI workload protection, and global go-to-market execution.”

Put plainly, discovery, scanning, and compliance checklists no longer separate the leaders. Depth at runtime does. The platforms pulling ahead tend to share a few traits:

  • They cover real ground, from infrastructure and workloads to identities, data, and applications, without asking you to bolt five products together.
  • They go deep at runtime, not just posture and log review.
  • They carry cloud detection and response (CDR) straight into the SOC.
  • They connect code, cloud, and the SOC instead of treating each as its own island.
  • They span clouds with both agent and agentless coverage, and they are moving quickly on AI and data security.

None of that is about longer findings lists. It is about context: seeing how the pieces connect and acting on the few that matter.

How Microsoft helps organizations protect cloud workloads

Microsoft’s capabilities address the problems customers raise most, and Frost & Sullivan points to the same strengths: 

“The strength in scaled runtime protection depth, strong CDR expansion, and ability to operationalize cloud runtime security across [Microsoft] Defender XDR, [Microsoft] Sentinel, GitHub, [Microsoft] Security Copilot, and the broader Microsoft security stack give Microsoft clearest advantages, particularly for large enterprises that already operate across Microsoft security, Azure infrastructure, GitHub, and Sentinel environments.”

Here is what that looks like in practice, starting from the problem in each case. 

1. Protect workloads while they are running

Microsoft Defender for Cloud watches workloads while they run. A lightweight sensor (eBPF-based) picks up Kubernetes events, process activity, and network traffic, and detections map to MITRE ATT&CK, so alerts line up with real cyberattacker behavior. Most of the recent effort has gone into the container layer: DNS detection for Kubernetes on Azure AKS, Amazon EKS, and Google GKE; anti-malware that blocks rather than just alerts; runtime protection for EKS Bottlerocket; and drift blocking when a binary changes mid-run.

Defender for Cloud can also act before a workload starts. Kubernetes’ gating applies policy at the cluster and namespace level, so a risky or non-compliant image is blocked before it ever starts. Frost & Sullivan calls this out as especially relevant to CWPP, because it puts preventive controls right next to production. That is the whole idea: catch a bad image before it becomes an incident, not after.

2. Get runtime signal to the SOC

Runtime signal only helps if it reaches the people who respond. With expanded CDR, Defender for Cloud ties runtime telemetry, Kubernetes audit data, process and network activity, control-plane events, and identity signals to specific workload incidents, then hands them to Microsoft Defender XDR and Microsoft Sentinel. A suspicious process in a running cluster does not land as a lonely alert. It arrives already connected to the identity that launched it and the activity around it.

For the SOC, that means faster answers and far less stitching signals together by hand.

3. Send runtime findings back to the developers who can fix them

Finding a problem at runtime is only half the work. Someone still has to fix it. Defender for Cloud links runtime context, exploitability, and attack-path detail to developer workflows through GitHub Advanced Security and Copilot Autofix, syncing both ways between security and development. A risk caught in production can go straight to the engineer who owns the code, get fixed at the source, and be checked afterward.

The right issue reaches the right owner, and security and DevOps finally work from the same list.

4. Extend protection to AI and across clouds

More and more, the workloads worth protecting are AI. Defender for Cloud supports model scanning and threat protection, including prompt injection and suspicious access, for Azure AI Foundry and Azure OpenAI, and AI security posture management for Google Vertex AI and Amazon Bedrock. It spans Microsoft Azure, Amazon Web Services (AWS), Google Cloud Platform (GCP), and hybrid environments with both agent and agentless coverage, and Microsoft Security Copilot adds guided investigation across the workflow.

Protection follows the workload, whether that is a new AI service or a third cloud.

What this signals for security leaders

For anyone choosing a workload protection platform this year, the shift in this report changes the questions worth asking. The ones to put at the top:

  • Is workload protection part of one cloud security platform, or a separate tool wired onto the SOC after the fact?
  • Can it stop a risky workload before production, or only flag it afterward?
  • Does it connect runtime activity to identity, data, and control-plane context, and rank what is genuinely exploitable?
  • Do its findings reach both the SOC and the developers who can act on them?
  • Does it hold up across several clouds and AI workloads?

The vendors that can answer “yes” are the ones shaping what comes next, and the Frost Radar places Microsoft among them.

Bottom line

Frost & Sullivan’s Frost Radar™: Cloud Workload Protection Platforms, 2026 reinforces a clear shift. Cloud workload protection is leaving isolated scanning behind for runtime security that connects posture, identity, code, and the SOC. Frost & Sullivan positions Microsoft as a visionary leader, and the largest CWPP provider by revenue, because Defender for Cloud brings that range together in one framework, goes deep at runtime and in CDR, and plugs into the wider Microsoft security stack.

Learn more

To learn more about Microsoft Security solutions, visit our website. Bookmark the Security blog to keep up with our expert coverage on security matters. Also, follow us on LinkedIn (Microsoft Security) and X (@MSFTSecurity) for the latest news and updates on cybersecurity.


1Kubernetes Established as the De Facto ‘Operating System’ for AI as Production Use Hits 82% in 2025 CNCF Annual Cloud Native Survey. PR Newswire, January 20, 2026.

The post Microsoft named a Leader in the Frost Radar™: Cloud Workload Protection Platforms, 2026 appeared first on Microsoft Security Blog.



from Microsoft Security Blog https://ift.tt/Kk0eZsJ
via IFTTT

8 Hyperconverged Infrastructure Trends for 2026


HCI is still growing in 2026, but what you’re actually buying has changed. Broadcom’s VMware shifts, growing demand for edge infrastructure, on-premises AI, and persistent ransomware pressure are reshaping the market. The result is a much more fragmented HCI market, with organizations comparing platforms, licensing models, hardware choices, and lifecycle costs instead of just picking an appliance built around one hypervisor.

The HCI market in 2026

Mordor Intelligence sizes the HCI market at $19.62 billion in 2026, rising to $43.59 billion by 2031 at a 17.31% CAGR. Treat those figures as a direction, not a precise reading – research firms don’t always define HCI the same way. Some count only certified appliances; others include software and managed services. What’s worth noting is the segment data: HCI software and managed services are growing faster than the overall category, which means more value is migrating from boxes to subscription and service delivery.

VMware is the other half of the story. CloudBolt’s survey (a vendor survey, for context) found 86% of companies actively reducing their VMware footprint, while 54% still run it and cut dependence in phases. This is a phased, multi-platform transition, and most organizations will run mixed environments for years.

So, is HCI dead? No. The eight trends below show how these changes affect platform design and procurement.

Not every trend is yours, though. An MSP or hosting provider will probably start with licensing, operating cost, and service delivery. Distributed retailers and manufacturers, by contrast, may care more about small edge clusters and cyber recovery. Anyone piloting AI cares about independent scaling and inference. A mid-market shop staring at a VCF renewal is watching licensing and lifecycle cost above all.

The market signals help put those differences in perspective:

Market signal Current evidence What it means
HCI keeps growing Mordor: $19.62B (2026) to $43.59B (2031), 17.31% CAGR The category is growing, but its composition is changing
Software and services grow fastest Mordor: HCI software and managed services outpace the total category Value shifting from appliances to software and service
VMware dependence easing CloudBolt (vendor survey): 86% reducing VMware, 54% still on it A phased, multi-platform transition
Edge spending climbing IDC: ~$261B (2025) to $380B (2028), 13.8% CAGR There is a strong market driver for small-footprint infrastructure
Ransomware pressure high Sophos 2026: 56% of attacks encrypted data; avg recovery $1.7M Separate cyber recovery from replication
Power is now a constraint IEA: data-center electricity ~945 TWh by 2030 (about 2x 2024) Energy consumption is becoming part of HCI TCO

With that broader picture in mind, let’s look at the architectural changes behind the numbers.

1. The end of one-hypervisor HCI

Broadcom ended perpetual VMware licensing and moved VMware’s portfolio toward subscription-based offerings, including VMware Cloud Foundation. That changed the economics of the vSAN-on-an-appliance model that had defined HCI for much of the previous decade. For many organizations, the practical response is a gradual reduction in VMware usage, not an overnight exit. VMware can still make sense where its integrations and operational maturity justify the cost – and every alternative brings its own storage architecture, backup workflows, networking model, and skills requirements.

The difficult part of a hypervisor migration usually isn’t moving the VMs themselves. It’s everything connected to them. Before you switch platforms, you’ll want to inventory the vSphere APIs your backup software calls, the NSX features your security tools assume, and the automation tied to vCenter. Those dependencies often set the migration schedule. VM conversion is usually the easier piece once you’ve mapped the surrounding ecosystem.

The financial pressure isn’t even, either. MSPs and hosting providers feel it quickly because VMware Cloud Service Provider changes and subscription minimums can directly squeeze rental margins. Budget-constrained sectors – public services, education, healthcare – may have less room to absorb a large licensing increase during a fixed multi-year budget cycle. Organizations operating many small sites face a different problem: the licensing cost has to make sense at ROBO scale, where even a modest per-site increase adds up fast.

In each case, cost is usually the trigger for the discussion. The technical dependencies decide how hard the change will be.

Backup is one dependency that teams often discover late. Incremental backup mechanisms differ between platforms: vSphere uses Changed Block Tracking, Hyper-V uses Resilient Change Tracking, and Proxmox VE can use QEMU dirty bitmaps, most directly through its integration with Proxmox Backup Server. Before you commit to a target platform, verify that your backup vendor supports it, and test both incremental backup and restore workflows. Don’t skip this step – it may not seem the most important at the first glance, but gets critical very soon.

The migration sequence is of high priority too. Moving fast helps only as long as you can still recover from a mistake. Here’s the path that tends to burn the fewest teams:

  1. Inventory the dependencies. Identify every tool that touches vSphere, vCenter, or NSX – backup, monitoring, automation, and security included. These dependencies usually set the timeline.
  2. Pilot the target platform. Run non-critical VMs on the new environment for a few weeks before committing anything to production.
  3. Rebuild and test backup. Prove that backups and restores work on the target platform before you migrate a single important workload.
  4. Recreate networking and security. Segmentation, firewall rules, and load balancers rarely port one-to-one between platforms. Rebuild them and test the resulting configuration.
  5. Migrate in waves. Start with low-risk workloads while the existing environment stays available. Validate each wave before moving to the next.
  6. Decommission last. Retire the old platform only after restores, monitoring, automation, and operational runbooks have been proven on the new environment.

This approach takes some discipline, but it also gives you several points at which to stop and correct course.

2. Compute and storage stop scaling in lockstep

Traditional HCI has always had a simple scaling model: add a node and you add compute, memory, and storage at the same time. That’s one of its strengths, especially for small and medium-sized clusters. It gets less attractive when workload growth is uneven. AI inference wants GPU-dense nodes; VDI wants memory; backup archives want cheap dense capacity. Forcing all of those onto a uniform node profile leaves one of them under-served.

A storage-heavy workload may force you to buy extra CPU and memory just to get more capacity. Compute-heavy workloads, by contrast, can leave expensive storage sitting mostly idle. Over several hardware refresh cycles, that imbalance quietly eats a noticeable slice of the infrastructure budget, and the bigger the cluster, the louder it gets. It’s a slow leak, and most teams don’t notice it until the next refresh.

Disaggregation is one answer to that problem in 2026. Technologies like vSAN Max and HCI Mesh, storage-only nodes, external NVMe arrays, and software-defined storage platforms that pool resources across different hardware let compute and storage grow on separate schedules. DataCore SANsymphony and StarWind VSAN are examples of software-defined storage approaches that fit this model.

That doesn’t kill traditional HCI. If your workloads are reasonably balanced, conventional nodes are still hard to beat for simplicity. Disaggregation starts to pay off when compute and storage needs begin moving in different directions, and not before.

Once you separate those resources, the network gets a lot more important. Networking deserves attention even in a conventional HCI cluster, honestly. As all-flash storage gets faster, a 10GbE link can quickly become the bottleneck for storage traffic and east-west traffic. For new deployments, 25GbE is a sensible baseline for many performance-oriented environments. 100GbE becomes more relevant for high-performance NVMe, GPU, and heavily consolidated workloads.

Keep storage traffic properly isolated and build redundancy into the switching layer. Jumbo frames help in environments where they’re consistently configured and validated end to end. RDMA can cut CPU overhead and latency, but the implementation matters: RoCE, for example, needs careful congestion and loss management, so treat it as an architectural decision rather than something you simply flip on at the NIC.

The three models stack up like this:

Figure 1: HCI types comparison

Figure 1: HCI types comparison 

3. HCI shrinks to two nodes at the edge

IDC put global edge spending near $261 billion in 2025, heading for $380 billion by 2028. That’s a driver for small-footprint HCI well beyond classic ROBO consolidation. Picture a supermarket that needs its self-checkout systems and pricing database to stay online during an ISP outage, or a factory that needs local access to PLC and MES data when the WAN link to headquarters goes down. Retail, manufacturing, healthcare, surveillance, and logistics all have versions of the same requirement: keep critical workloads running at the site even when connectivity to the central environment is interrupted.

That makes availability the main design problem for small clusters. One node can’t provide HA. Two nodes can, but the architecture needs a mechanism to decide which node should stay active if the communication link between them fails. A witness placed independently of both nodes is a common approach (sometimes called an arbiter or tiebreaker, depending on the vendor). On some platforms that witness runs at a third site. On others, it runs in the cloud. The point is to verify exactly how the platform handles quorum, witness placement, and split-brain protection before you commit to it.

The hardware itself can stay modest. A two-node edge cluster may only need a few CPU cores, 64 to 128 GB of RAM, and NVMe storage per node, depending on the workload. And there are cases where HCI is overkill entirely. If a site can tolerate a short outage and same-day intervention, one well-backed-up server may give you a better balance of cost and operational simplicity, and that’s a perfectly defensible answer.

That distinction matters because edge infrastructure is often deployed in dozens or hundreds of locations. A small amount of unnecessary complexity multiplied across every site turns into a heavy operational burden, and edge teams feel it first.

4. AI on HCI means inference

For HCI, the most practical AI workloads to plan for in 2026 are inference workloads. Computer vision on a production floor, retrieval-augmented generation over private documents, predictive maintenance, and smaller private models are realistic use cases for infrastructure teams that want to keep AI close to their existing data instead of dragging it across the WAN to a public endpoint.

Nutanix’s 2026 Enterprise Cloud Index,, which is based on its own survey and should be read in that context, reports that 85% of respondents say AI is accelerating container adoption, while 82% say their infrastructure isn’t fully ready for on-premises AI.

The real question is what “AI-ready” actually means for your infrastructure. GPUs alone don’t make a cluster AI-ready. Inference gets throttled as often by NVMe throughput, metadata operations, memory capacity, east-west networking, and data locality as by the accelerator. GPU-enabled nodes plus high-speed Ethernet or RDMA help, and coupled scaling bites here too: pin a GPU to a node and you can strand its storage or CPU. HCI is the wrong tool for large training runs, multi-petabyte datasets, or anything needing specialized GPU fabrics and parallel file systems. Those belong on purpose-built systems. Treating a cluster as a substitute is how AI projects stall out at the proof-of-concept stage.

Two design details decide whether an inference workload runs well. The first is the data path. A RAG service or a vision pipeline reads far more than it writes, and its latency is set by how fast vectors, embeddings, and model weights move from NVMe into GPU memory, so an all-flash tier and enough east-west bandwidth matter as much as the card itself.

The second is GPU sharing. A single accelerator is often idle between requests, so features like NVIDIA MIG partitioning and time-slicing let several VMs or pods share one card. That changes the sizing math entirely: instead of one GPU per workload, you can consolidate a handful of light models onto one node and keep utilization up. Both depend on the hypervisor exposing GPU passthrough or vGPU cleanly, which is one more line to confirm on the platform you’re comparing.

For a rough gauge, a quantized 7B-8B model fits in about 8 to 16 GB of GPU memory (roughly the footprint of a mid-range consumer card), so one mid-range card can serve a couple of light models at once. Keep the vectors and embeddings behind them on the NVMe tier, not in GPU memory, and size that tier for reads.

5. One platform for VMs and containers

Containers have changed what teams expect from HCI. The platform is increasingly becoming a common operating environment for VMs and Kubernetes together, mostly because teams want fewer places to manage policy, backup, security, and governance across core, cloud, and edge environments.

The requirements are fairly practical. Stateful containers need CSI drivers and persistent storage. Backup has to cover both VMs and container workloads. Management needs to remain usable at remote or offline sites. VDI can run on the same infrastructure, although that’s a mature HCI use case by now, not a new trend.

Several platforms have arrived at this model from different directions. VMware runs Tanzu and vSphere Kubernetes Service on top of vSphere. Nutanix offers Nutanix Kubernetes Platform (NKP). Red Hat runs virtual machines inside OpenShift through KubeVirt, while Proxmox combines VMs with LXC containers (the lightweight container format built into the Linux kernel, not the same thing as Kubernetes pods).

The important question is what happens underneath those workloads. A Kubernetes cluster can run perfectly well on an HCI platform, but that doesn’t automatically make the storage layer suitable for production containers.

Stateful containers need persistent volumes with capabilities such as snapshots and cloning, together with a CSI driver that the Kubernetes cluster can use reliably. If the same storage infrastructure can serve both VM datastores and container volumes, the operational argument for a unified platform gets much stronger. You can apply the same storage policies, monitor the same infrastructure, and manage capacity from one place.

Data protection is another practical test. A backup platform that can protect VMs and persistent volumes under coordinated policies is much easier to operate than two separate backup systems the team has to stitch together. Before you call a platform “unified,” check what happens when you actually need to restore something.

There’s a limit to this model, though. A unified infrastructure stack doesn’t make workloads automatically portable. Data gravity, egress costs, licensing, and platform-specific integrations can still keep applications tied to their current environment. And if you only run a few stateless containers, a managed Kubernetes service may be considerably simpler than building an on-premises platform around them.

So before committing to convergence, look at your actual workloads. Verify that the target platform supports the backup, networking, storage, and multi-site workflows you already depend on, including persistent container volumes.

6. Cyber recovery earns its own line item

Synchronous replication does exactly what it’s designed to do: every write is copied to the second system immediately. If ransomware encrypts the primary workload, that encrypted data can be replicated just as faithfully as everything else. That’s why HA and replication can no longer be treated as the complete resilience strategy.

Cyber recovery has become its own design and procurement consideration. Many organizations use the 3-2-1-1-0 approach: three copies of the data, stored on two different media types, with one copy off site, one copy immutable or offline, and zero errors confirmed through recovery testing.

The immutable copy is particularly important. HA keeps services available when hardware fails. Replication keeps another copy synchronized. Neither one gives you a clean historical recovery point after an attacker has compromised the environment. An object-locked backup can remain protected even when an attacker has gained significant access to the production domain.

Around that immutable copy, you may also need an air-gapped copy that an online attacker can’t reach and an isolated recovery environment where workloads can be restored safely. Otherwise, there’s a real risk of restoring compromised systems and immediately reinfecting the environment you’re trying to recover.

HCI introduces another consideration: the shared management plane. Centralized management reduces configuration drift and makes fleet-wide operations easier, but it also creates concentration of risk. If an attacker compromises the management layer, they may gain access to many clusters at once.

Design the recovery architecture so that management credentials, snapshots, and online backups can’t all be destroyed through the same control path. Keep at least one recovery copy outside that administrative boundary. The security controls themselves are familiar: MFA, RBAC, network segmentation, secure boot, vulnerability management, and timely patching all matter. They still don’t replace a recovery test.

Run a restore exercise with the assumption that your normal platform credentials are unavailable. Measure how long it actually takes to recover the workload and document what went wrong. An annual recovery exercise is much more useful than a backup dashboard showing green status every morning. An untested backup is a hope, not a recovery plan.

7. You’re buying the operating model

When skilled infrastructure staff are in short supply, operational effort becomes part of the purchasing decision. Uptime Institute’s 2025 survey found nearly two-thirds of operators struggling to hire or retain staff. That’s the case for integrated HCI: prevalidated firmware, drivers, hypervisor versions, storage components, rolling upgrades, and centralized fleet management can remove a lot of routine integration work from a small infrastructure team.

The real value shows up on day two. Someone still has to maintain a combination of firmware, drivers, hypervisor versions, and storage software that the vendor has actually tested together. Security patches have to be applied without turning every update into a weekend maintenance project. If an upgrade fails halfway through, the team needs a supported rollback path.

An integrated appliance can simplify that process because the vendor maintains the compatibility matrix and provides the upgrade tooling. You also have one support channel for the integrated stack, including the hardware: one number to call, one escalation path. For a two-person infrastructure team managing dozens of sites, that can be more important than the hardware specification itself.

The trade-off is cost and flexibility, and flexibility matters most when you actually need it. Integrated platforms generally come with higher licensing costs and tighter hardware constraints. A DIY stack based on Proxmox and Ceph gives you more freedom to choose hardware and software components, but your team takes responsibility for compatibility testing, upgrade sequencing, rollback procedures, and support across each layer.

Neither model is automatically better. Integrated HCI tends to make more sense for small teams responsible for many locations. Open platforms are attractive when you already have strong Linux, virtualization, and storage expertise and want more control over the stack.

The real trade is between control and operational ownership. One vendor owning the stack can mean fewer 3 a.m. arguments about whether the problem is firmware, storage, networking, or the hypervisor. An open stack gives you more freedom, but you need the engineering capability to make all those pieces work together.

And if a vendor promises “one-click upgrades,” treat that as something to validate. Before you sign the contract, get one answer in writing: if the cluster fails halfway through an upgrade, who owns the incident from firmware through storage and the hypervisor?

8. The bill that arrives in year four

The argument that “HCI is cheaper because it uses fewer boxes” has been incomplete for years. A realistic TCO model includes hardware, per-core or per-node licensing, support renewals, network upgrades, backup software, staff time, migration work, power, rack space, refresh cycles, and eventual decommissioning.

The initial quote tells you very little about several of those costs. Start with the software around the HCI platform. Monitoring, backup systems, security tools, and management software may all need new licenses or integrations when you change hypervisors. Then there’s training. Certification costs are easy to put into a spreadsheet, the less visible cost is the productivity dip while administrators learn a new API, CLI, management model, and troubleshooting workflow.

Migration also temporarily increases infrastructure costs. During a platform transition, you’ll often need to run old and new environments side by side. A move from three-tier infrastructure to HCI can also change the number and type of nodes you need, which affects the initial hardware investment.

Renewals are where an apparently attractive quote can become expensive. Model the cost of node four and year four, not just the first invoice. You’ll want to include expected support increases, additional capacity, hardware expansion, and licensing changes – the items vendors are most likely to gloss over in the original quote.

Exit costs deserve the same attention. Data export, professional services, migration tooling, temporary dual-running, and application changes all carry a price. Define those requirements before signing the contract, and you’ve got a much better chance of avoiding an unpleasant surprise later. Ideally you’ve already priced a realistic exit before you commit – not in anger six months before the renewal.

Power consumption now belongs in the same conversation. The IEA projects data-center electricity near 945 TWh by 2030 (roughly double 2024), which has buyers watching watts per workload and per usable terabyte rather than rack counts. That also changes what you should negotiate. Price protection at renewal, license portability, hardware flexibility, data export rights, and migration assistance can carry as much long-term value as a discount on the initial purchase. It’s not unusual for the energy line over five years to outweigh the hardware line.

None of this means HCI is inherently expensive. For workloads that fit its scaling model, HCI is still a very efficient way to run infrastructure – cheaper than the alternatives, even after you’ve accounted for all of the above.

Conclusion

The HCI decision has moved from consolidation to platform choice: which hypervisor, how it scales, and what it costs to run and eventually leave. Weigh those three upfront and the year-four surprise mostly disappears.

Whatever lands on your shortlist, test it against your own availability, support, and migration requirements before you commit. A datasheet can tell you what a platform supports. Only a test can tell you what it’ll be like to operate.

FAQ

How many nodes does an HCI cluster need?

Three is the common production starting point, so the cluster survives losing one node and still holds quorum. Two-node designs work when a separate witness breaks ties, and single-node deployments exist for edge sites that can tolerate a short outage. Scaling up means adding nodes; the practical ceiling is the hypervisor’s cluster limit.

What is disaggregated HCI (dHCI)?

It’s HCI that keeps single-pane management but lets compute and storage grow on separate curves, using storage-only nodes or external software-defined storage instead of adding both resources in every node. Teams reach for it when workloads are lopsided and lockstep scaling would strand CPU or disk.

Which hypervisor should replace VMware vSphere?

There’s no single answer; it depends on your workloads and in-house skills. Hyper-V and Azure Local suit Microsoft-centric shops, Nutanix AHV offers a managed route, Proxmox VE and XCP-ng appeal to teams wanting open-source control, and OpenShift Virtualization fits container-heavy estates. Match the surrounding ecosystem – backup, networking, and automation – before the hypervisor itself.

Can you mix different hypervisors in one HCI environment?

Usually not within the same cluster, but you can run different hypervisors across separate clusters. This is common during phased migrations from VMware.



from StarWind Blog https://ift.tt/8l7kgE9
via IFTTT