Docker CVE-2026-34040 Lets Attackers Bypass Authorization and Gain Host Access

A high-severity security vulnerability has been disclosed in Docker Engine that could permit an attacker to bypass authorization plugins (AuthZ) under specific circumstances.

The vulnerability, tracked as CVE-2026-34040 (CVSS score: 8.8), stems from an incomplete fix for CVE-2024-41110, a maximum-severity vulnerability in the same component that came to light in July 2024.

"Using a specially-crafted API request, an attacker could make the Docker daemon forward the request to an authorization plugin without the body," Docker Engine maintainers said in an advisory released late last month. "The authorization plugin may allow a request which it would have otherwise denied if the body had been forwarded to it."

"Anyone who depends on authorization plugins that introspect the request body to make access control decisions is potentially impacted."

Multiple security vulnerabilities, including Asim Viladi Oglu Manizada, Cody, Oleh Konko, and Vladimir Tokarev, have been credited with independently discovering and reporting the bug. The issue has been patched in Docker Engine version 29.3.1.

According to a report published by Cyera Research Labs researcher Tokarev, the vulnerability stems from the fact that the fix for CVE-2024-41110 did not properly handle oversized HTTP request bodies, thereby opening the door to a scenario where a single padded HTTP request can be used to create a privileged container with host file system access.

In a hypothetical attack scenario, an attacker who has Docker API access restricted by an AuthZ plugin can undermine the mechanism by padding a container creation request to more than 1MB, causing it to be dropped before reaching the plugin.

"The plugin allows the request because it sees nothing to block," Tokarev said in a report shared with The Hacker News. "The Docker daemon processes the full request and creates a privileged container with root access to the host: your AWS credentials, SSH keys, Kubernetes configs, and everything else on the machine. This works against every AuthZ plugin in the ecosystem."

What's more, an artificial intelligence (AI) coding agent like OpenClaw running inside a Docker-based sandbox can be tricked into executing a prompt injection concealed within a specifically crafted GitHub repository as part of a regular developer workflow, resulting in the execution of malicious code that exploits CVE-2026-34040 to bypass authorization using the above approach and create a privileged container and mount the host file system.

With this level of access in place, the attacker can extract credentials for cloud services, and abuse them to take control of cloud accounts, Kubernetes clusters, and even SSH into production servers.

It doesn't end there. Cyera also cautioned that AI agents can figure out the bypass on their own and trigger it by constructing a padded HTTP request upon encountering errors when attempting to access files like kubeconfig as part of a legitimate debugging task issued by a developer (e.g., debug the K8s out-of-memory issue). This approach eliminates the need for planting a poisoned repository containing the malicious instructions.

"AuthZ plugin denied the mount request," Cyera explained. "The agent has access to the Docker API and knows how HTTP works. CVE-2026-34040 doesn't require any exploit code, privilege, or special tools. It's a single HTTP request with extra padding. Any agent that can read Docker API documentation can construct it."

As temporary workarounds, it's recommended to avoid using AuthZ plugins that rely on request body inspection for security decisions, limit access to the Docker API to trusted parties by following the principle of least privilege, or run Docker in rootless mode.

"In rootless mode, even a privileged container's 'root' maps to an unprivileged host UID," Tokarev said. "The blast radius drops from 'full host compromise' to 'compromised unprivileged user.' For environments that can't go fully rootless, --userns-remap provides similar UID mapping."

from The Hacker News https://ift.tt/XqHafNs
via IFTTT

Talos Takes: 2025's ransomware trends and zombie vulnerabilities

Join Amy and Pierre Cadieux as they unpack the ransomware and vulnerability trends that defined 2025. From the persistent ransomware threats targeting the manufacturing sector to the rise of stealthy living-off-the-land tactics, we break down what these shifts mean for your defense strategy.

Why are attackers are increasingly targeting your management infrastructure? How do you spot the difference between a system admin and a threat actor? Tune in to hear Talos' insights on how to move beyond reacting to threats and start building a more resilient, proactive security posture for the year ahead.

View the 2025 Year in Review here.

from Cisco Talos Blog https://ift.tt/wJTgkqp
via IFTTT

The Hidden Cost of Recurring Credential Incidents

When talking about credential security, the focus usually lands on breach prevention. This makes sense when IBM’s 2025 Cost of a Data Breach Report puts the average cost of a breach at $4.4 million. Avoiding even one major incident is enough to justify most security investments, but that headline figure obscures the more persistent problems caused by recurring credential incidents.

Account lockouts and compromised credentials don’t make the news. They show up as repeated helpdesk tickets, interrupted workflows, and time pulled away from higher-value work. Individually, each incident seems minor, but collectively they place a constant burden on IT teams and the wider business.

The real cost doesn’t just sit in the breach you might prevent, but in the day-to-day disruption you’re already dealing with.

Repeated incidents equal repeated costs

If an organization finds itself suffering from credential-based attacks or repeated account compromises, the obvious response is to tighten password policies. However, many organizations struggle to balance security with usability. And when something doesn’t work, the helpdesk gets the call.

Forrester estimates that password resets account for up to 30% of all helpdesk tickets, with each one costing around $70 when you factor in staff time and lost productivity. For a mid-sized organization, that’s a significant, ongoing operational cost tied directly to credential incidents.

Disruptions like these build up and mean IT teams spend most of their time firefighting while end users lose momentum. The organization absorbs the cost in ways that are easy to overlook, but hard to eliminate.

How poor password policies contribute to credential incidents

When users are met with vague error messages like “does not meet complexity requirements,” they’re left guessing. Which rule did they break? What is missing? After a few failed attempts, most users stop trying to understand the policy and start looking for the quickest way through it.

People fall back to reusing old passwords with minor tweaks or storing credentials insecurely just to avoid going through the process again. None of this is malicious, but it increases the likelihood of repeated credential-related incidents, from lockouts to account compromise.

Without any form of breached password screening, organizations rely on time-based resets to manage risk. But a password doesn’t become unsafe because it’s old. It becomes unsafe when it’s exposed. 

Even with short expiry periods, users can continue logging in with credentials that have already been exposed in breaches. Those accounts are vulnerabilities waiting to be exploited, but without visibility into that, you’re effectively leaving it to chance.

At the same time, IT teams are still dealing with the operational impact of unnecessary resets without addressing the underlying risk. Without the ability to detect exposed credentials, organizations are left managing symptoms instead of the root cause, and the cycle of incidents continues.

It’s here that tools like Specops Password Policy help. Its Breached Password Protection feature continuously scans your user accounts against a database of more than 5.8 billion compromised passwords. If a password appears in our database, customizable alerts prompt users to reset, shortening the window of opportunity for attackers to abuse those credentials.

Specops Password Policy

Mandatory periodic resets compound password issues

For many years, forced password resets were treated as a baseline security measure. In practice, they tend to create more problems than they solve.

When users are required to change passwords every 60 or 90 days, behavior becomes predictable. People make small, incremental changes to existing passwords or choose something easy to remember under time pressure. The result isn’t stronger credentials, but more vulnerable ones.

Beyond creating weaker passwords, these fixed expiration intervals introduce regular disruption into the working day. Every reset is a potential lockout, adding to the mounting pile of helpdesk tickets that drain your resources without actually improving your security posture. 

This is why guidance from bodies like NIST has moved away from mandatory periodic changes towards only resetting passwords when there is evidence of a breach. While removing password resets entirely requires careful consideration, updated guidance should prompt a rethink of arbitrary expiration dates.

Strong password policies set the baseline for identity security

It’s easy to treat passwords as a legacy problem and something to minimize as you move towards passwordless authentication. However, passwords still underpin identity security. If that foundation is weak, the impact shows up everywhere.

Compromised or simplistic passwords introduce risk at the identity layer, where attackers can gain legitimate access and move laterally without raising immediate alarms. 

By enforcing robust, user-friendly requirements and identifying exposed credentials early, you reduce the number of weak entry points across your environment. This becomes especially important as organizations evolve their authentication strategies.

Specops Breached Password Protection continuously blocks over 5 billion breached passwords

Passwordless still depends on strong underlying credentials. Without a solid baseline, you risk carrying existing weaknesses into new systems.

Fewer compromised accounts mean fewer incidents, less time spent on remediation, and less disruption to day-to-day operations.

Beat the cost of repeated credential incidents

Strong password controls will help reduce risk. But the true operational payoff lies in reducing the time and resources spent resolving a constant flow of incidents across the organization.

When you factor in fewer lockouts, fewer reset requests, and less time spent dealing with compromised credentials, you’ll see the impact in reduced day-to-day disruption for both IT teams and end users.

If recurring credential incidents are becoming all too common in your environment, it’s worth taking a closer look.

Want to see how Specops can help strengthen your identity security? Book a demo to see our solutions in action.

Found this article interesting? This article is a contributed piece from one of our valued partners. Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.

from The Hacker News https://ift.tt/VANihpI
via IFTTT

Year in Review: Vulnerabilities old and new and something React2

Speed and age shouldn’t be allowed to pair up, but that is the theme of the Talos 2025 Year in Review vulnerability findings.

Figure 1. React/React2Shell (2025) at the top, with PHPUnit (2017) and Log4j (2021) following up.

The year was characterized by an unending beat-down on infrastructure that relied on older enmeshed dependencies (e.g., Log4j and PHPUnit), while React2Shell rocketed to the highest percentage of attacks for the entire year within the last three weeks of 2025. Agentic AI's capacity for building and deploying new proofs-of-concepts and exploit kits lowered attacker time-to-exploit, and the landscape shifted for defenders. 

“The speed at which these CVEs climbed into the top tier reflects a larger systemic challenge: Newly disclosed vulnerabilities in widely deployed software can generate significant, organization-wide impact long before typical patch cycles catch up, leaving defenders with small reaction windows and escalating consequences for even short-lived exposure.” – 2025 Talos Year in Review

Top-targeted infrastructure 

Outdated infrastructure continues to expand the attack surface. Components like PHPUnit, ColdFusion, and Log4j are often embedded within applications, tightly coupled to legacy applications. Technologies age quickly, and companies are under pressure to adopt first, ask questions later. Low-use systems in a network can fossilize, unnoticed and unpatched. Others become mainstays that often cannot be swapped out or even patched without destabilizing an organization.  

Attackers prioritized software and firmware inside network appliances, identity-adjacent systems, and widely deployed open-source components: 

• Remote code execution (RCE) flaws, which enable access without requiring user interaction, avoiding a need for social engineering  
• Legacy systems and widely used components 
• Perimeter devices, especially without endpoint detection and response (EDR) 

Figure 2. Top 50 network infrastructure CVEs.

The theme was identity, identity, identity. Controlling identity meant controlling access, so attackers focused on components that authenticate users, enforce access decisions, and broker trust between systems. A small number of vulnerabilities targeting these vectors drove outsized risk. This can invalidate multi-factor authentication (MFA) checks and bypass segmentation. 

Defender recommendations 

Attacker prioritization is now guided less by vulnerability age or maturity and more by exposure, exploitability, and proximity to trust, reshaping how organizations must think about risk in modern environments. 

Attackers exploit patching gaps and policy weaknesses in vendor lifecycles. Organizations should evaluate their identity-centric network components and management platforms and prioritize patching of network devices accordingly. 

For a more in-depth analysis of these trends, as well as how company size impacted CVE targeting trends, why the management plane matters, and the shortening window defenders have for putting defenses in place, see the 2025 Year in Review report.

from Cisco Talos Blog https://ift.tt/cP8guiV
via IFTTT

New GPUBreach Attack Enables Full CPU Privilege Escalation via GDDR6 Bit-Flips

New academic research has identified multiple RowHammer attacks against high-performance graphics processing units (GPUs) that could be exploited to escalate privileges and, in some cases, even take full control of a host.

The efforts have been codenamed GPUBreach, GDDRHammer, and GeForge.

GPUBreach goes a step further than GPUHammer, demonstrating for the first time that RowHammer bit-flips in GPU memory can induce much more than data corruption and enable privilege escalation, and lead to a full system compromise.

"By corrupting GPU page tables via GDDR6 bit-flips, an unprivileged process can gain arbitrary GPU memory read/write, and then chain that into full CPU privilege escalation — spawning a root shell — by exploiting memory-safety bugs in the NVIDIA driver," Gururaj Saileshwar, one of the authors of the study and Assistant Professor at the University of Toronto, said in a post on LinkedIn.

What makes GPUBreach notable is that it works even without having to disable the input–output memory management unit (IOMMU), a crucial hardware component that ensures memory security by preventing Direct Memory Access (DMA) attacks and isolating each peripheral to its own memory space.

"GPUBreach shows it is not enough: by corrupting trusted driver state within IOMMU-permitted buffers, we trigger kernel-level out-of-bounds writes — bypassing IOMMU protections entirely without needing it disabled," Saileshwar added. "This has serious implications for cloud AI infrastructure, multi-tenant GPU deployments, and HPC environments."

RowHammer is a long-standing Dynamic Random-Access Memory (DRAM) reliability error where repeated accesses (i.e., hammering) to a memory row can cause electrical interference that flips bits (changing 0 to 1m or vice versa) in adjacent rows. This undermines isolation guarantees fundamental to modern operating systems and sandboxes.

DRAM manufacturers have implemented hardware-level mitigations, such as Error-Correcting Code (ECC) and Target Row Refresh (TRR), to counter this line of attack. 

However, research published in July 2025 by researchers at the University of Toronto expanded the threat to GPUs. GPUHammer, as it's called, is the first practical RowHammer attack targeting NVIDIA GPUs using GDDR6 memory. It employs techniques like multi-threaded parallel hammering to overcome architectural challenges inherent to GPUs that previously made them immune to bit flips.

The consequence of a successful GPUHammer exploit is a drop in machine learning (ML) model accuracy, which can degrade by up to 80% when running on a GPU.

GPUBreach extends this approach to corrupt GPU page tables with RowHammer and achieve privilege escalation, resulting in arbitrary read/write on GPU memory. More consequentially, the attack has been found to leak secret cryptographic keys from NVIDIA cuPQC, stage model accuracy degradation attacks, and obtain CPU privilege escalation with IOMMU enabled.

"The compromised GPU issues DMA (using the aperture bits in PTEs) into a region of CPU memory that the IOMMU permits (the GPU driver's own buffers)," the researchers said. "By corrupting this trusted driver state, the attack triggers memory-safety bugs in the NVIDIA kernel driver and gains an arbitrary kernel write primitive, which is then used to spawn a root shell."

This disclosure of GPUBreach coincides with two other concurrent works – GDDRHammer and GeForge – that also revolve around GPU page-table corruption via GDDR6 RowHammer and facilitate GPU-side privilege escalation. Just like GPUBreach, both techniques can be used to gain arbitrary read/write access to CPU Memory.

Where GPUBreach stands apart is that it also enables full CPU privilege escalation, making it a more potent attack. GeForge, in particular, requires IOMMU to be disabled for it to work, whereas GDDRHammer modifies the GPU page table entry's aperture field to allow the unprivileged CUDA kernel to read and write all of the host CPU's memory.

"One main difference is that GDDRHammer exploits the last level page table (PT) and GeForge exploits the last level page directory (PD0)," the teams behind the two GPU memory exploits said. "However, both works are able to achieve the same goal of hijacking the GPU page table translation to gain read/write access to the GPU and host memory."

One temporary mitigation to tackle these attacks is to enable ECC on the GPU. That said, it bears noting that RowHammer attacks like ECCploit and ECC.fail have been found to overcome this countermeasure.

"However, if attack patterns induce more than two bit flips (shown feasible on DDR4 and DDR5 systems), existing ECC cannot correct these and may even cause silent data corruption; so ECC is not a foolproof mitigation against GPUBreach," the researchers said. "On desktop or laptop GPUs, where ECC is currently unavailable, there are no known mitigations to our knowledge."

from The Hacker News https://ift.tt/qDihHG9
via IFTTT

China-Linked Storm-1175 Exploits Zero-Days to Rapidly Deploy Medusa Ransomware

A China-based threat actor known for deploying Medusa ransomware has been linked to the weaponization of a combination of zero-day and N-day vulnerabilities to orchestrate "high-velocity" attacks and break into susceptible internet-facing systems.

"The threat actor's high operational tempo and proficiency in identifying exposed perimeter assets have proven successful, with recent intrusions heavily impacting healthcare organizations, as well as those in the education, professional services, and finance sectors in Australia, the United Kingdom, and the United States," the Microsoft Threat Intelligence team said.

Attacks mounted by Storm-1175 have also leveraged zero-day exploits, in some cases, before they have been publicly disclosed, as well as recently disclosed vulnerabilities to obtain initial access. Select incidents have involved the threat actor chaining together multiple exploits (e.g., OWASSRF) for post-compromise activity.

Upon gaining a foothold, the financially motivated cybercriminal actor swiftly moves to exfiltrate data and deploy Medusa ransomware within a span of a few days, or, in select incidents, within 24 hours.

To aid in these efforts, the group creates persistence by creating new user accounts, deploying web shells or legitimate remote monitoring and management (RMM) software for lateral movement, conducting credential theft, and interfering with the normal functioning of security solutions, before dropping the ransomware.

Since 2023, Storm-1175 has been linked to the exploitation of more than 16 vulnerabilities -

Both CVE-2025-10035 and CVE-2026-23760 are said to have been exploited as zero-days prior to them being publicly disclosed.As of late 2024, the hacking crew has exhibited a flair for targeting Linux systems, including exploiting vulnerable Oracle WebLogic instances across several organizations. However, the exact vulnerability that was being weaponized in these attacks remains unknown.

"Storm-1175 rotates exploits quickly during the time between disclosure and patch availability or adoption, taking advantage of the period where many organizations remain unprotected," Microsoft said.

Some of the notable tactics observed in these attacks are as follows -

• Using living-off-the-land binaries (LOLBins), including PowerShell and PsExec, along with Impacket for lateral movement.
• Relying on PDQ Deployer for both lateral movement and payload delivery, including Medusa ransomware, across the network.
• Modifying Windows Firewall policies to enable Remote Desktop Protocol (RDP) and deliver malicious payloads to other devices.
• Carrying out credential dumping using Impacket and Mimikatz.
• Configuring Microsoft Defender Antivirus exclusions to prevent it from blocking ransomware payloads.
• Leveraging Bandizip and Rclone for data collection and exfiltration, respectively.

The bigger implication here is that RMM tools like AnyDesk, Atera, MeshAgent, ConnectWise ScreenConnect, or SimpleHelp are becoming dual-use infrastructure for covert operations, as they allow threat actors to blend malicious traffic into trusted, encrypted platforms and reduce the likelihood of detection.

from The Hacker News https://ift.tt/1A6PtT4
via IFTTT

Flowise AI Agent Builder Under Active CVSS 10.0 RCE Exploitation; 12,000+ Instances Exposed

Threat actors are exploiting a maximum-severity security flaw in Flowise, an open-source artificial intelligence (AI) platform, according to new findings from VulnCheck.

The vulnerability in question is CVE-2025-59528 (CVSS score: 10.0), a code injection vulnerability that could result in remote code execution.

"The CustomMCP node allows users to input configuration settings for connecting to an external MCP (Model Context Protocol) server," Flowise said in an advisory released in September 2025. "This node parses the user-provided mcpServerConfig string to build the MCP server configuration. However, during this process, it executes JavaScript code without any security validation."

Flowise noted that successful exploitation of the vulnerability can allow access to dangerous modules such as child_process (command execution) and fs (file system), as it runs with full Node.js runtime privileges.

Put differently, a threat actor who weaponizes the flaw can execute arbitrary JavaScript code on the Flowise server, leading to full system compromise, file system access, command execution, and sensitive data exfiltration.

"As only an API token is required, this poses an extreme security risk to business continuity and customer data," Flowise added. It credited Kim SooHyun with discovering and reporting the flaw. The issue was addressed in version 3.0.6 of the npm package.

According to details shared by VulnCheck, exploitation activity against the vulnerability has originated from a single Starlink IP address. CVE-2025-59528 is the third Flowise flaw with in-the-wild exploitation after CVE-2025-8943 (CVSS score: 9.8), an operating system command remote code execution, and CVE-2025-26319 (CVSS score: 8.9), an arbitrary file upload.

"This is a critical-severity bug in a popular AI platform used by a number of large corporations," Caitlin Condon, vice president of security research at VulnCheck, told The Hacker News in a statement.

"This specific vulnerability has been public for more than six months, which means defenders have had time to prioritize and patch the vulnerability. The internet-facing attack surface area of 12,000+ exposed instances makes the active scanning and exploitation attempts we're seeing more serious, as it means attackers have plenty of targets to opportunistically reconnoiter and exploit."

from The Hacker News https://ift.tt/n4jgBWH
via IFTTT

Multi-OS Cyberattacks: How SOCs Close a Critical Risk in 3 Steps

Your attack surface no longer lives on one operating system, and neither do the campaigns targeting it. In enterprise environments, attackers move across Windows endpoints, executive MacBooks, Linux infrastructure, and mobile devices, taking advantage of the fact that many SOC workflows are still fragmented by platform. 

For security leaders, this creates a costly operational gap: slower validation, limited early-stage visibility, more escalations, and more time for attackers to steal credentials, establish persistence, or move deeper before the response fully begins.

The Multi-OS Attack Problem SOCs Aren’t Ready For

A multi-OS attack can turn one threat into several different investigations at once. The campaign may follow a different path depending on the system it reaches, which breaks the speed and consistency SOC teams rely on during early triage.

Instead of moving through one clear validation process, the team ends up jumping between tools, reconstructing behavior across environments, and trying to catch up while the attack keeps moving. 

That quickly leads to familiar problems inside the SOC:

• Validation delays increase business exposure by slowing the moment when the team can confirm risk and contain it.
• Fragmented evidence reduces incident clarity when fast decisions are needed on scope, priority, and impact.
• Escalation volume grows because too many cases cannot be closed confidently at the earliest stage.
• Response consistency breaks down across teams and environments, making investigations harder to manage at scale.
• Attackers get more time to move before the organization has a clear picture of what is unfolding.
• SOC efficiency drops as time is lost to tool-switching, duplicated effort, and slower decision-making.

How Top SOCs Turn Multi-OS Complexity into Faster Response

The teams that handle this well usually do one thing differently: they make cross-platform investigation faster, clearer, and more consistent from the start. With solutions like ANY.RUN Sandbox, that becomes much easier to do across enterprise operating systems. 

Here are three practical steps to make that happen:

Step 1: Make Cross-Platform Analysis Part of Early Triage

Early triage gets slower the moment teams assume the same threat will behave the same way everywhere. It often does not. A suspicious file, script, or link that reveals one pattern in Windows may take a different path on macOS, rely on different native components, and create a different level of risk. That makes cross-platform validation essential from the start.

For instance, macOS is often treated as the safer side of the enterprise environment, which can make it an easier place for threats to go unnoticed early. As adoption grows among executives, developers, and other high-value users, attackers have more reason to tailor campaigns for that environment. 

A recent ClickFix campaign was analyzed by ANY.RUN experts is a good example. Check its full attack chain below:

See the recent attack targeting Claude Code users.

Attackers exploited a Google ad redirect to lure victims to a fake Claude Code documentation page, then used a ClickFix flow to push a malicious Terminal command. That command downloaded an encoded script, installed AMOS Stealer, collected browser data, credentials, Keychain contents, and sensitive files, then deployed a backdoor for persistent access. 

Give your team a faster way to detect multi-OS threat behavior before hidden execution paths turn into credential theft, persistence, and deeper compromise.

Close Multi-OS Security Gaps

When cross-platform analysis starts early, teams can:

• Recognize how one campaign changes across operating systems before the investigation splits
• Validate suspicious activity earlier in the environment actually being targeted
• Reduce the chance of missing platform-specific behavior during early triage

Step 2: Keep Cross-Platform Investigations in One Workflow

Multi-OS attacks become harder to contain when one case forces the team into several disconnected workflows.A suspicious link on one system, a script on another, and a different execution path somewhere else can quickly turn a single incident into a messy investigation spread across multiple tools. That slows down validation, makes evidence harder to follow, and creates more room for the threat to keep moving.

ClickFix campaigns, for instance, show why this matters. The same technique has been used to target different operating systems, from Windows to macOS, while following different execution paths depending on the environment. 

If each version has tobe analyzed in a separate tool, the investigation takes longer, requires more effort, and becomes much harder to keep consistent. WithANY.RUN Sandbox, teams can investigate these threats within a single workflow across major enterprise operating systems, making it easier to compare behavior, follow the attack chain, and understand how the campaign changes from one environment to another without constantly switching context.

When investigations stay in one workflow, teams:

• Cut the operational overhead that multi-OS investigations create
• Keep one connected view of campaign activity instead of managing separate case fragments
• Support a more standardized response process as the attack scope expands across the enterprise

Step 3: Turn Cross-Platform Visibility into Faster Response

Seeing activity across operating systems only helps if the team can quickly understand what matters and act on it. In multi-OS attacks, that is often where the response starts to slow down. One behavior appears in one environment, other artifacts show up somewhere else, and the team is left trying to piece everything together before it can make a confident decision.

What helps is having the right information presented in a way that is easier to work through under pressure. With ANY.RUN Sandbox, teams can review auto-generated reports, follow attacker behavior, examine IOCs in dedicated tabs, and use the built-in AI Assistant to speed up analysis and understand suspicious activity faster. 

That makes it easier to move from raw activity to a clearer view of what the threat is doing, how serious it is, and what needs to happen next.

When cross-platform visibility is easier to work through, teams can:

• Make faster decisions with evidence that is easier to review and act on
• Reduce delays caused by scattered findings and manual reconstruction
• Move into containment with more confidence even when the attack behaves differently across environments

Stop Giving Multi-OS Attacks Room to Move

Multi-OS attacks win when defenders lose time. Every extra workflow, every delayed validation, and every missing piece of context gives the threat more room to spread before the team can contain it.

With ANY.RUN’s cloud-based sandbox, teams can reduce that delay by bringing cross-platform analysis into a more consistent workflow across major enterprise operating systems. That gives SOC teams clearer context, faster decisions, and measurable operational gains:

• Up to 3× stronger SOC efficiency across investigation workflows
• 21 minutes less MTTR per case when threats are validated faster
• 94% of users reporting faster triage in daily operations
• Up to 20% lower Tier 1 workload from reduced manual effort
• 30% fewer escalations from Tier 1 to Tier 2 during early analysis
• Lower breach exposure through earlier detection and response
• Less alert fatigue with faster access to threat insights

Expand cross-platform visibility to reduce investigation delays, limit business exposure, and give your SOC more control over multi-OS threats.

Found this article interesting? This article is a contributed piece from one of our valued partners. Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.

from The Hacker News https://ift.tt/eQI6c9D
via IFTTT

⚡ Weekly Recap: Axios Hack, Chrome 0-Day, Fortinet Exploits, Paragon Spyware and More

This week had real hits. The key software got tampered with. Active bugs showed up in the tools people use every day. Some attacks didn’t even need much effort because the path was already there.

One weak spot now spreads wider than before. What starts small can reach a lot of systems fast. New bugs, faster use, less time to react.

That’s this week. Read through it.

⚡ Threat of the Week

Axios npm Package Compromised by N. Korean Hackers—Threat actors with ties to North Korea seized control of the npm account belonging to the lead maintainer of Axios, a popular npm package with nearly 100 million weekly downloads, to push malicious versions containing a cross-platform malware dubbed WAVESHAPER.V2. The activity has been attributed to a financially motivated threat actor known as UNC1069. The incident demonstrates how quickly the compromise of a popular npm package can have ripple effects through the ecosystem. The malware's self-deleting anti-forensic cleanup points to a deliberate, planned operation. "The build pipeline is becoming the new front line. Attackers know that if they can compromise the systems that build and distribute software, they can inherit trust at scale," Avital Harel, Security Researcher at Upwind, said. "That's what makes these attacks so dangerous -- they're not just targeting one application, they’re targeting the process behind many of them. Organizations should be looking much more closely at CI/CD systems, package dependencies, and developer environments, because that's increasingly where attackers are placing their bets." Ismael Valenzuela, vice president of Labs, Threat Research, and Intelligence at Arctic Wolf, said the Axios npm compromise reflects a broader trend where attackers infiltrate trusted, widely used software components to obtain access to downstream customers at scale. "Even though the malicious versions were available for only a few hours, Axios is so deeply embedded across enterprise applications that organizations may have unknowingly pulled the compromised code into their environments through build pipelines or downstream dependencies," Valenzuela added. "That downstream exposure is what makes these incidents particularly difficult to spot and contain, especially for teams that never directly chose to install Axios themselves. This incident reinforces that security teams need to treat build‑time tools and dependencies as part of the attack surface and not just trust tools by default."

🔔 Top News

• Google Patches Actively Exploited Chrome 0-Day—Google released security updates for its Chrome web browser to address 21 vulnerabilities, including a zero-day flaw that it said has been exploited in the wild. The high-severity vulnerability, CVE-2026-5281 (CVSS score: N/A), concerns a use-after-free bug in Dawn, an open-source and cross-platform implementation of the WebGPU standard. Users are advised to update their Chrome browser to versions 146.0.7680.177/178 for Windows and Apple macOS, and 146.0.7680.177 for Linux. Google did not reveal how the vulnerability is being exploited and who is behind the exploitation effort.
• TrueConf 0-Day Exploited in Attacks Targeting Government Entities in Southeast Asia—Chinese hackers have exploited a zero-day vulnerability in the TrueConf video conferencing software in attacks against government entities in Southeast Asia. The exploited flaw, tracked as CVE-2026-3502 (CVSS score of 7.8), exists because of a lack of integrity checks when fetching application update code, allowing an attacker to distribute a tampered update. "The compromised TrueConf on-premises server was operated by the governmental IT department and served as a video conferencing platform for dozens of government entities across the country, which were all supplied with the same malicious update," Check Point said. The activity, which began in January 2026, involved the deployment of the Havoc framework. Most infections likely began with a link sent to the victims. TrueConf is used widely across organizations in Asia, Europe, and the Americas, serving about 100,000 organizations globally.
• Fortinet FortiClient EMS Flaw Under Attack—Fortinet released out-of-band patches for a critical security flaw impacting FortiClient EMS (CVE-2026-35616) that it said has been exploited in the wild. The vulnerability has been described as a pre-authentication API access bypass leading to privilege escalation. Exploitation efforts against CVE-2026-35616 were first recorded against its honeypots on March 31, 2026, per watchTowr. The development comes days after another recently patched, critical vulnerability in FortiClient EMS (CVE-2026-21643) came under active exploitation.
• Apple Backports DarkSword Fixes to More Devices—Apple expanded the availability of iOS 18.7.7 and iPadOS 18.7.7 to a broader range of devices to protect users from the risk posed by a recently disclosed exploit kit known as DarkSword. The update targets customers whose devices are capable of upgrading to the newest operating system (iOS 26), but have chosen to remain on iOS 18. Apple has taken the unprecedented step to counter risks posed by an exploit kit called DarkSword. The broader availability of the patches underscores the level of threat that malware like DarkSword poses. The fact that a large number of users were still using iOS 18, combined with the leak of a new version of DarkSword on GitHub, has pushed Apple towards releasing the fix so that they can stay protected without the need for updating to iOS 26. The leak is significant as it puts it within reach of less technically savvy cybercriminals out there.
• ClickFix Attack Leads to DeepLoad Malware—The ClickFix technique is being used to deliver a stealthy malware named DeepLoad that's capable of stealing credentials and intercepting browser interactions. The malware first emerged on a dark web cybercrime forum in early February 2026, when a threat actor, using the alias "MysteryHack," advertised it as a "centralized panel for multiple types of malware." According to ZeroFox, "DeepLoad's design is explicitly focused on actively facilitating real-time cryptocurrency theft, which almost certainly makes it an attractive malware suite in the cybercrime-as-a-service (CaaS) environment." The malware has since been distributed to Windows systems through ClickFix under the guise of resolving fake browser error messages. Besides stealing credentials, the malware drops a rogue browser extension to intercept sensitive data and spreads via removable USB drives. DeepLoad's actual attack logic is buried under layers of obfuscation, raising the possibility that some parts of the malware were developed using an artificial intelligence (AI) model.
• Claude Code Source Code Leaks—Anthropic acknowledged that internal code for its popular artificial intelligence (AI) coding assistant, Claude Code, had been inadvertently released due to a human error. Essentially, what happened was this: When Anthropic pushed out version 2.1.88 of its Claude Code npm package, it accidentally included a map file that exposed nearly 2,000 source code files and more than 512,000 lines of code. The source code leak has since revealed various features the company appears to be working on or that are built into the service, including an Undercover mode to hide AI authorship from contributions to public code repositories, a persistent background agent called KAIROS, combat distillation attacks, and active monitoring of words and phrases that show signs of user frustration. The leak also quickly escalated into a cybersecurity threat, as attackers pounced on the surge in interest to lure developers into downloading stealer malware.

🔥 Trending CVEs

New vulnerabilities show up every week, and the window between disclosure and exploitation keeps getting shorter. The flaws below are this week's most critical — high-severity, widely used software, or already drawing attention from the security community.

Check these first, patch what applies, and don't wait on the ones marked urgent — CVE-2026-35616 (Fortinet FortiClient EMS), CVE-2026-20093 (Cisco Integrated Management Controller), CVE-2026-20160 (Cisco Smart Software Manager On-Prem), CVE-2026-5281 (Google Chrome), CVE-2026-3502 (TrueConf), CVE-2026-27876, CVE-2026-27880 (Grafana), CVE-2026-4789 (Kyverno), CVE-2026-2275, CVE-2026-2285, CVE-2026-2286, CVE-2026-2287 (CrewAI), CVE-2025-14819 (Notepad++), CVE-2026-34714, CVE-2026-34982 (Vim), CVE-2026-33660, CVE-2026-33696 (n8n), CVE-2026-25639 (Axios), CVE-2026-25075 (strongSwan), CVE-2026-34156 (NocoBase), CVE-2026-3308 (Artifex MuPDF), CVE-2026-1579 (PX4 Autopilot), CVE-2026-3991 (Symantec Data Loss Prevention Agent for Windows), CVE-2026-33026 (nginx-ui), CVE-2026-33416, CVE-2026-33636 (libpng), CVE-2026-3775, CVE-2026-3779 (Foxit PDF Editor), CVE-2026-34980, CVE-2026-34990 (CUPS), and CVE-2026-34121 (TP-Link).

🎥 Cybersecurity Webinars

• Learn How to Close Identity Gaps Using Insights from IT Leaders → Identity programs face rising risk from disconnected apps, manual credentials, and expanding AI access. Based on 2026 insights from 600+ IT and security leaders, this session shows what to measure, fix, and do now to close identity gaps and regain control.
• Learn How to Build Secure AI Agents Using Identity, Visibility, and Control → AI agents are already being used, but most teams don’t know how to secure them properly. This session shows a clear, practical way to do it using three key ideas: identity, visibility, and control.You will see what real deployment looks like, how to track what agents do, and how to manage their behavior safely.It also explains how to secure AI systems today without waiting for standards to settle.

📰 Around the Cyber World

• Device Code Phishing Attacks Surge —Device code phishing attacks, which abuse the OAuth device authorization grant flow to hijack accounts, have surged more than 37.5x this year. Push Security said it detected a 15x increase in device code phishing pages at the start of March 2026, indicating that the technique has finally entered mainstream adoption. "The technique tricks a user into issuing access tokens for an attacker-controlled application (not a device, confusingly)," the company said. "Any app that supports device code logins can be a target. Popular examples include Microsoft, Google, Salesforce, GitHub, and AWS. That said, Microsoft is, as always, much more heavily targeted at scale now than any other app." This has been fueled by the emergence of EvilTokens (aka ANTIBOT), the first reported criminal PhaaS (Phishing-as-a-Service) toolkit that supports device code pushing. EvilTokens features a Cloudflare Workers frontend and a Railway backend for authentication. Early iterations of the PhaaS kit emerged in January 2026. Another closed-source PhaaS kit called Venom offers device code phishing capabilities similar to EvilTokens. Some of the other PhaaS kits that have incorporated this technique include SHAREFILE, CLURE, LINKID, AUTHOV, DOCUPOLL, FLOW_TOKEN, PAPRIKA, DCSTATUS, and DOLCE.
• LinkedIn Comes Under Scanner for BrowserGate —A newly published report called BrowserGate alleged that Microsoft's LinkedIn is using hidden JavaScript scripts on its website to scan visitors' browsers for thousands of installed Google Chrome extensions and collect device data without users' consent. "LinkedIn scans for over 200 products that directly compete with its own sales tools, including Apollo, Lusha, and ZoomInfo," the report said. "Because LinkedIn knows each user’s employer, it can map which companies use which competitor products. It is extracting the customer lists of thousands of software companies from their users' browsers without anyone's knowledge. Then it uses what it finds. LinkedIn has already sent enforcement threats to users of third-party tools, using data obtained through this covert scanning to identify its targets." The report also claimed LinkedIn loads an invisible tracking pixel from HUMAN Security, along with a separate fingerprinting script that runs from LinkedIn's servers and a third script from Google that runs silently on every page load. In response to the findings, LinkedIn told Bleeping Computer it scans for certain extensions that scrape data without members' consent in violation of its terms of service. The company also claimed the report is from an individual who is "subject to an account restriction for scraping and other violations of LinkedIn's Terms of Service."
• ICE Confirms Use of Paragon Spyware —The U.S. Immigration and Customs Enforcement (ICE) confirmed it uses spyware developed by Paragon to "identify, disrupt, and dismantle Foreign Terrorist Organizations, addressing the escalating fentanyl epidemic and safeguarding national security." Paragon's Graphite spyware has been found on the phones of journalists. WhatsApp last year said it disrupted a campaign that deployed the spyware against its users. The governments of Australia, Canada, Cyprus, Denmark, Israel, and Singapore are suspected to be customers of the Israeli company.
• Ex-Engineer Pleads Guilty to Extortion Campaign —Daniel Rhyne, 59, of Kansas City, Missouri, pleaded guilty to a failed data extortion campaign that targeted his former employer. Rhyne was arrested in September 2024. According to court documents, Rhyne worked as a core infrastructure engineer at a U.S.-based industrial company headquartered in New Jersey. In November 2023, the defendant executed a ransomware attack against the company and sent an extortion email to its employees, threatening to continue shutting down the firm's servers unless he was paid about 20 Bitcoin, which was valued at $750,000 at the time. Last month, the U.S. Justice Department (DoJ) announced the conviction of Cameron Curry (aka Loot), a 27-year-old from Charlotte, North Carolina, for carrying out a cyber extortion scheme against a D.C.-based international technology company called Brightly Software. "Trial evidence established that Curry misused his position to access the victim company's personnel and other sensitive corporate records, which he then used to carry out the cyber extortion scheme after he learned that his contract was not going to be renewed and that he would no longer be employed by the company," the DoJ said. Between December 11, 2023, and January 24, 2024, Curry sent more than 60 emails to company executives and employees, stating he would disclose sensitive information unless he was paid $2.5 million in cryptocurrency. Brightly ended up paying $7,540 in Bitcoin.
• Residential Proxies Bypass Reputation Systems —Threat intelligence firm GreyNoise's analysis of 4 billion sessions targeting the edge over a 90-day period from November 29, 2025, to February 27, 2026, found that 39% of unique IP addresses targeting the edge originated from home internet connections, and that 78% vanish before any reputation system can flag them. "78% of residential IPs appear in only 1–2 sessions and are never observed again," it said. "IP reputation is structurally broken against residential proxies. The rotation rate exceeds the update cycle of any feed-based defense." This behavior also makes source IPs indistinguishable from a legitimate user's connection. The data also showed that 0.1% of residential sessions carry exploitation payloads, in contrast to 1.0% from hosting infrastructure, indicating that they are primarily used for network scanning and reconnaissance. The residential proxy traffic is generated by IoT botnets and infected computers, with the networks also resilient against takedown efforts. "After IPIDEA lost 40% of its nodes, operators backfilled within weeks," GreyNoise said. "Every major takedown produces the same result -- temporary disruption, then regeneration." The company also recommended that "Detection must shift from 'where is the traffic from?' to 'what is the traffic doing?" Device fingerprinting provides more durable detection because fingerprints survive IP rotation."
• Suspected N. Korea Campaign Targets Cryptocurrency Companies Using React2Shell —A new campaign has been observed systematically compromising cryptocurrency organizations by exploiting web application vulnerabilities such as React2Shell (CVE-2025-55182), pillaging AWS tenants with valid credentials, and exfiltrating proprietary exchange software containing hardcoded secrets. "Their targeting spans the crypto supply chain, from staking platforms, to exchange software providers, to the exchanges themselves," Ctrl-Alt-Intel said. The threat intelligence firm has assessed the activity with moderate confidence to be aligned with North Korean cryptocurrency theft operations.
• India Extends SIM-Binding Mandate —The Indian government has extended its SIM-binding mandate through December 31, 2026, while shelving plans to require messaging apps to forcibly log out web-based sessions like WhatsApp Web every six hours. The decision comes after the Broadband India Forum, which represents Meta and Google, warned the Department of Telecommunications (DoT) that the directions were unconstitutional. Under the framework announced in November 2025, a messaging app account would be tied exclusively to the physical SIM card during registration. This meant that the users could access the messages and other content only when that SIM is present in the device. Companies were given 90 days (i.e., until the end of February 2026) to comply. While SIM binding has been proposed as a way to combat spammers and conduct cross‑border fraud, the move has raised feasibility and user experience concerns. According to Moneycontrol, WhatsApp is said to be beta testing SIM binding on Android.
• Russian Threat Actors Looking to Regain Access Through Compromised Infrastructure —Russian threat actors like APT28 and Void Blizzard are attempting to regain access to computer systems they previously compromised to check if access is still available and whether the obtained credentials remain valid, CERT-UA has warned. "Unfortunately, these attempts sometimes succeed if the root cause of the initial incident has not been completely eliminated," the agency said.
• OkCupid Settles with FTC for Privacy Violations —OkCupid and its owner, Match Group, reached a settlement with the U.S. Federal Trade Commission over allegations that it did not inform its customers that nearly three million user photos were shared with Clarifai, a company that develops AI systems to identify and analyze images and videos. The complaint also accused the dating site of sharing users' location information and other details without their consent. As part of the settlement, OkCupid and Match did not admit or deny the allegations but agreed to a permanent prohibition that prevents them from misrepresenting how they use and share personal data.
• New Android Malware Mirax Advertised —A sophisticated new Android banking trojan named Mirax is being advertised as a private malware-as-a-service (MaaS) offering for up to $2,500 per month. The malware enables customers to gain remote control over devices and includes specialized overlays for more than 700 different financial applications to steal credentials and other sensitive information. It can also capture keystrokes, intercept SMS messages, record lock screen patterns, and use the infected device as a SOCKS5 proxy.
• Venom Stealer Spreads via ClickFix —A new malware-as-a-service (MaaS) platform dubbed Venom Stealer is being sold on cybercrime forums as a subscription ($250/month to $1,800 for lifetime access). It's marketed as "the Apex Predator of Wallet Extraction." Unlike other stealers, it automates credential theft and enables continuous data exfiltration. "It builds ClickFix social engineering directly into the operator panel, automates every step after initial access, and creates a continuous exfiltration pipeline that does not end when the initial payload finishes running," BlackFog said. The development coincides with a new ClickFix variant that replaces PowerShell with a "rundll32.exe" command to download a DLL from an attacker-controlled WebDAV resource. The attack leads to the execution of a secondary loader called SkimokKeep, which then downloads additional payloads, while incorporating anti-sandboxing and anti-debugging mechanisms. In the meantime, recent ClickFix campaigns have also leveraged searches for installation tutorials for OpenClaw, Claude, and other AI tools, as well as for common macOS issues to push stealer malware like MacSync.
• More Information Stealers Spotted —Speaking of stealers, recent campaigns have also been observed using procurement-themed email lures and fake Homebrew install guides served via sponsored search results to deliver Phantom Stealer and SHub Stealer. Some other newly discovered infostealer malware families include Storm, MioLab, and Torg Grabber. In a related development, CyberProof said it observed a surge in PXA Stealer activity targeting global financial institutions during Q1 2026. Another malware that has gained notoriety is BlankGrabber, which is distributed through social engineering and phishing campaigns. Data gathered by Flare shows that a single stealer log can be devastating, with individual logs containing up to 1,381 pieces of personally identifiable information. In an analysis published by Whiteintel last month, the company found that a single careless download of cracked software by one employee can hand criminal groups direct access to an entire corporate network in under two days. "An employee downloads cracked software on Tuesday afternoon," it said. "By Thursday morning, their credentials are listed on the Russian Market for $15. Corporate VPN access, AWS credentials, session tokens that bypass MFA – all packaged and ready for purchase."
• Phishing Campaign Targets Philippine Banking Users —An ongoing phishing campaign targeting major banks in the Philippines is using email phishing via compromised accounts as the initial vector to harvest online banking credentials and one-time passwords (OTPs) for financial fraud. According to Group-IB, the campaign began in early 2024, distributing over 900 malicious links as part of the coordinated scheme. Clicking on the link embedded in the email message triggers a redirection chain that uses trusted services like Google Business, AMP CDN, Cloudflare Workers, and URL shorteners before taking the victims to the final landing page. "The campaign enables real-time financial fraud by bypassing MFA mechanisms through the theft of valid One-Time Passwords (OTP), allowing attackers to perform unauthorized fund transfers," the company said. "Telegram bots were used as exfiltration channels, enabling threat actors to automatically collect victims' login information in real time." The activity has been attributed to a threat group called PHISLES.
• Chrome Extensions Harvests ChatGPT Conversations —A malicious Chrome extension, named "ChatGPT Ad Blocker" (ID: ipmmidjikiklckbngllogmggoofbhjikgb), found on the Chrome Web Store masquerades as an ad-blocking tool for the AI chatbot, but contains functionality to "steal the user's ChatGPT conversations data by systematically copying the HTML page and sending to it to a webhook on a private Discord channel," DomainTools said.
• Iran Conflict Triggers Espionage Activity in Middle East —In the aftermath of the U.S.-Israel-Iran conflict, Proofpoint said it has recorded an increase in campaigns from state-sponsored threat actors likely affiliated with China (UNK_InnerAmbush, which uses phishing emails to deliver Cobalt Strike payload), Belarus (TA473, which has used HTML attachments in emails for reconnaissance), Pakistan (UNK_RobotDreams, which has sent spear-phishing emails to India-based offices of Middle East government entities to deliver a Rust backdoor), and Hamas (TA402, which has used compromised Iraq government email addresses to conduct Microsoft account credential harvesting) targeting Middle East government organizations. The enterprise security company said it also identified the Charming Kitten actor targeting a think tank in the U.S. to trick recipients into entering their Microsoft account credentials. One activity cluster that remains unattributed is UNK_NightOwl. The email messages include a domain that spoofed Microsoft OneDrive, leading the victim to a credential harvesting page. If the user enters credentials and clicks the sign-in button, the target is redirected to "hxxps://iran.liveuamap[.]com/," a legitimate open-source platform called Liveuamap with news updates on the Middle East conflict.
• U.K. Warns of Messaging App Targeting —The U.K. National Cyber Security Centre (NCSC) became the latest cybersecurity agency to warn of malicious activity from messaging apps like WhatsApp, Messenger, and Signal, where threat actors could trick high-risk individuals into sharing their login or account recovery codes, or linking an attacker-controlled device under their accounts.

• Dev Machine Guard → It is an open-source script that scans a developer machine to list installed tools and detect security risks across IDEs, AI agents, extensions, and configurations, without accessing source code or secrets, helping expose gaps traditional tools miss in developer environments.
• Pius → It is an open-source tool that maps a company’s external attack surface by discovering and cataloging internet-facing assets, helping security teams identify exposure and reconnaissance risks that could be targeted by attackers.

Disclaimer: For research and educational use only. Not security-audited. Review all code before use, test in isolated environments, and ensure compliance with applicable laws.

Conclusion

The lesson is simple. Small things matter. Most issues now start from normal parts of the system, not big, obvious gaps.

Don’t trust anything just because it looks routine. Updates, tools, and background systems can all be used in the wrong way. If it seems low risk, check it again. That’s where the problems are starting now.

from The Hacker News https://ift.tt/bXQkYyA
via IFTTT

AI governance in healthcare: Why this moment feels different

For most healthcare leaders I talk to today, AI isn’t a hypothetical anymore. It’s embedded in clinical tools, creeping into workflows, showing up in places we didn’t explicitly plan for. And almost every conversation starts the same way.

It’s not, “Should we use AI?” It’s, “How did AI get here so fast?”

I’ve been in this industry long enough to recognize when something feels different. We’ve lived through EHR rollouts, cloud migrations, cybersecurity wakeup calls, and waves of digital transformation that promised more than they delivered. But AI has a different kind of momentum. It doesn’t wait for steering committees, respect budget cycles, or slow down just because governance hasn’t caught up.

This is what healthcare CIOs are wrestling with in 2026.

The real tension isn’t innovation, it’s control

From the outside, it might look like healthcare is struggling to adopt AI. From the inside, it feels very different. AI is already being used sometimes officially, sometimes quietly, sometimes in ways leaders didn’t intend. The tension isn’t whether AI can help. Most leaders I know believe it can. The tension is control:

Where is the data going?

Why does an AI-driven app work on one workstation but not another?

And how do we slow things down just enough to ensure safety without stopping innovation entirely?

Those questions sound familiar because they aren’t really AI questions. They’re governance questions. And they’re the same ones that healthcare leaders have been asking for years; just with higher stakes now.

Why AI breaks traditional governance models

Healthcare governance was built for a different era. We designed it around systems that were relatively static—applications, users, devices, and networks that changed on predictable timelines.

AI doesn’t behave that way. It evolves quickly. It shows up inside other tools. It can act, not just advise. And when it isn’t well integrated into clinical workflows, it creates friction like extra logins, inconsistent performance, workarounds that clinicians adopt just to get through the day.

When that happens, leaders don’t lose control because they ignored governance. They lose control because governance was never designed to account for something this fluid.

Treating AI as “special” is the fastest way to lose oversight

One of the biggest mistakes I see is treating AI as a separate initiative, committee, approval process, or a side program running parallel to everything else. That approach feels logical at first. AI is new. It feels risky. It deserves attention. But separating AI from existing governance structures often creates more risk, not less.

When AI lives outside the systems that already manage access, identity, and workflows, it becomes harder to monitor and explain. It encourages shadow usage, fragments accountability, and forces clinicians and IT teams to navigate yet another set of rules in an environment that’s already overloaded.

The reality is that AI is no longer a separate technology category. It’s part of the clinical environment just like identity, access, devices, and workflows.

One of the reasons I’m encouraged right now is that this conversation isn’t happening in isolation. The same questions CIOs are asking inside health systems are now being asked at a national level.

Earlier this year, Citrix submitted a response to the HHS Health Sector AI Request for Information. At its core, our position was straightforward: the biggest barrier to safe, scalable AI in healthcare isn’t the model – it’s the governance and delivery layers that surround it.

In our response, we emphasized that AI should be integrated within existing enterprise controls rather than managed as a separate technology with new policies. By embedding AI into frameworks like Zero Trust access, role-based governance, unified telemetry, and auditable workflows, healthcare organizations can advance innovation while safeguarding trust, accountability, and patient safety. This approach enables scalable progress without introducing unnecessary risk.

What effective AI governance really looks like

The healthcare leaders who seem most confident right now aren’t the ones moving fastest. They’re the ones integrating AI into what already works.

They focus on three things:

• Experience: If AI makes work harder, clinicians will avoid it. Governance has to ensure AI fits naturally into existing workflows, not alongside them.
• Security: AI needs the same managed access, least-privilege controls, and auditability as any other enterprise system – no exceptions.
• Operations: Governance only works if IT teams can actually enforce it. Automation, visibility, and consistency matter more than policy documents.

None of this requires reinventing governance. It requires extending it.

Where policy meets enforcement

A lot of health systems are still trying to govern AI through policy alone — acceptable use documents, vendor review checklists, steering committee approvals. Those things have their place, but policy without enforcement isn’t governance. It’s intention.

What’s actually making a difference in organizations that have moved beyond pilots is embedding control at the delivery layer, where AI traffic flows between clinicians, applications, and models. For Citrix customers, this is where NetScaler AI Gateway becomes relevant.

In a healthcare environment, that translates into practical control. Teams can be scoped to specific models based on role and need. Token-based rate limiting prevents a single department from driving uncontrolled cost or degrading performance for others. And sensitive data can be protected in real time — with LLM redaction automatically removing PHI from prompts before they reach a model, or from responses before they reach a user.

These are just a few examples of what’s possible today. As the space evolves, this approach extends further through integrations with best-of-breed LLM security solutions, enabling a layered model for AI governance that adapts alongside both emerging threats and new capabilities.

This is what governance looks like when it actually works — enforced in the data path, not just written into policy.

Why this matters right now

Healthcare leaders are carrying more responsibility than ever. AI can help, but only if it’s deployed in a way that strengthens trust instead of eroding it. This moment isn’t about slowing innovation – it’s about anchoring it.

The organizations that succeed won’t be the ones with the most AI pilots. They’ll be the ones that made AI part of their operating model and aligned with the realities of care delivery. That’s the work ahead of us. And it’s work worth doing right.

from Citrix Blogs https://ift.tt/gBLZMDP
via IFTTT

How LiteLLM Turned Developer Machines Into Credential Vaults for Attackers

The most active piece of enterprise infrastructure in the company is the developer workstation. That laptop is where credentials are created, tested, cached, copied, and reused across services, bots, build tools, and now local AI agents.

In March 2026, the TeamPCP threat actor proved just how valuable developer machines are. Their supply chain attack on LiteLLM, a popular AI development library downloaded millions of times daily, turned developer endpoints into systematic credential harvesting operations. The malware only needed access to the plaintext secrets already sitting on disk.

The LiteLLM Attack: A Case Study in Developer Endpoint Compromise

The attack was straightforward in execution but devastating in scope. TeamPCP compromised LiteLLM packages versions 1.82.7 and 1.82.8 on PyPI, injecting infostealer malware that activated when developers installed or updated the package. The malware systematically harvested SSH keys, cloud credentials for AWS, Azure, and GCP, Docker configurations, and other sensitive data from developer machines.

PyPI removed the malicious packages within hours of detection, but the damage window was significant. GitGuardian's analysis found that 1,705 PyPI packages were configuredto automatically pull the compromised LiteLLM versions as dependencies. Popular packages like dspy (5 million monthly downloads), opik (3 million), and crawl4ai (1.4 million) would have triggered malware execution during installation. The cascade effect meant organizations that never directly used LiteLLM could still be compromised through transitive dependencies.

Why Developer Machines Are Attractive Targets

This attack pattern isn't new; it's just more visible. The Shai-Hulud campaigns demonstrated similar tactics at scale. When GitGuardian analyzed 6,943 compromised developer machines from that incident, researchers found 33,185 unique secrets, with at least 3,760 still valid. More striking: each live secret appeared in roughly eight different locations on the same machine, and 59% of compromised systems were CI/CD runners rather than personal laptops.

Adversaries now slip into the toolchain through compromised dependencies, malicious plugins, or poisoned updates. Once there, they harvest local environment data with the same systematic approach security teams use to scan for vulnerabilities, except they're looking for credentials stored in .env files, shell profiles, terminal history, IDE settings, cached tokens, build artifacts, and AI agent memory stores.

Secrets Live Everywhere in Plaintext

The LiteLLM malware succeeded because developer machines are dense concentration points for plaintext credentials. Secrets end up in source trees, local config files, debug output, copied terminal commands, environment variables, and temporary scripts. They accumulate in .env files that were supposed to be local-only but became a permanent part of the codebase. Convenience turns into residue, which becomes opportunity.

Developers are running agents, local MCP servers, CLI tools, IDE extensions, build pipelines, and retrieval workflows, all requiring credentials. Those credentials spread across predictable paths where malware knows to look: ~/.aws/credentials, ~/.config/gh/config.yml, project .env files, shell history, and agent configuration directories.

Protecting Developer Endpoints at Scale

It’s important to build continuous protection across every developer endpoint where credentials accumulate.GitGuardian approaches this by extending secrets security beyond code repositories to the developer machine itself.

The LiteLLM attack demonstrated what happens when credentials accumulate in plaintext across developer endpoints. Here's what you can do to reduce that exposure.

Understand Your Exposure

Start with visibility. Treat the workstation as the primary environment for secrets scanning, not an afterthought. Use ggshield to scan local repositories for credentials that slipped into code or linger in Git history. Scan filesystem paths where secrets accumulate outside Git: project workspaces, dotfiles, build output, and agent folders where local AI tools generate logs, caches, and "memory" stores.

ggshield detecting a secret in a specific file from a path

Don't assume environment variables are safe just because they're not in files. Shell profiles, IDE settings, and generated artifacts often persist environment values on disk indefinitely. Scan these locations the same way you scan repos.

Add ggshield pre-commit hooks to stop creating new leaks in commits while cleaning up old ones. This turns secret detection into a default guardrail that catches mistakes before they become incidents.

ggshield pre-commit command catching a secret

Move Secrets Into Vaults

Detection without remediation is just noise. When a credential leaks, remediation typically requires coordination across multiple teams: security identifies the exposure, infrastructure owns the service, the original developer may have left the company, and product teams worry about production breaks. Without clear ownership and workflow automation, remediation becomes a manual process that gets deprioritized.

The solution is treating secrets as managed identities with defined ownership, lifecycle policies, and automated remediation paths. Move credentials into a centralized vault infrastructure where security teams can enforce rotation schedules, access policies, and usage monitoring. Integrate incident management with your existing ticketing systems so remediation happens in context rather than requiring constant tool-switching.

GitGuardian Analytics showing the state of secrets being monitored

Treat AI Agents as Credential Risks

Agentic tools can read files, run commands, and move data. With OpenClaw-style agents, "memory" is literally files on disk (SOUL.md, MEMORY.md) stored in predictable locations. Never paste credentials into agent chats, never teach agents secrets "for later," and routinely scan agent memory files as sensitive data stores.

Eliminate Whole Classes of Secrets

The fastest way to reduce secret sprawl is by removing the need for entire categories of shared secrets. On the human side, adopt WebAuthn (passkeys) to replace passwords. On the workload side, migrate to OIDC federation, so pipelines stop relying on stored cloud keys and service account secrets.

Start with the highest-risk paths where leaked credentials hurt most, then expand. Move developer access to passkeys and migrate CI/CD workflows to OIDC-based auth.

Use Ephemeral Credentials

If you can't eliminate secrets yet, make them short-lived and automatically replaced. Use SPIFFE to issue cryptographic identity documents (SVIDs) that rotate automatically instead of relying on static API keys.

Start with long-lived cloud keys, deployment tokens, and service credentials that developers keep locally for convenience. Shift to short-lived tokens, automatic rotation, and workload identity patterns. Each migration is one less durable secret that can be stolen and weaponized.

The goal is to reduce the value an attacker can extract from any successful foothold on a developer machine.

Honeytokens as early warning systems 

Honeytokens provide interim protection. Place decoy credentials in locations attackers systematically target: developer home directories, common configuration paths, and agent memory stores. When harvested and validated, these tokens generate immediate alerts, compressing detection time from "discovering damage weeks later" to "catching attacks while unfolding." This isn't the end state, but it changes the response window while systematic cleanup continues.

Developer endpoints are now part of your critical infrastructure. They sit at the intersection of privilege, trust, and execution. The LiteLLM incident proved that adversaries understand this better than most security programs. Organizations that treat developer machines with the same governance discipline already applied to production systems will be the ones that survive the next supply chain compromise.

Found this article interesting? This article is a contributed piece from one of our valued partners. Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.

from The Hacker News https://ift.tt/YmByurR
via IFTTT