Feed aggregator

China’s Salt Typhoon gang has developed a new backdoor and dropped it in networks belonging to high-profile organizations in several countries across Central and South America since at least August 2025, according to researchers. The PRC-backed espionage crew shifted its focus to Latin America a month prior, and from mid-2025 into 2026, the vast majority - 90 percent - of Salt Typhoon’s targets were located in that region, ESET, which tracks the group as FamousSparrow, said in a Thursday report. Salt Typhoon is the cyber-spy gang that hacked telecommunications and government agencies to gain stealthy, long-term access to victim organizations going back as far as 2019. These hacks, however, weren’t discovered until late 2023. In August 2025, ESET’s malware hunters found the group’s new backdoor, called SparroWocky, deployed against government agencies in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela. While targeting entities in these countries “represents a rare occurrence among the China-aligned APT groups,” ESET believes the focus likely reflects China’s reaction to recent US President Donald Trump’s initiatives in the region, malware researchers Alexandre Côté Cyr and Romain Dumont said. “Donald Trump’s second presidential term has brought about an aggressive reaffirmation of US interests in Latin America, which threatens various long-term investments that China has cultivated throughout the continent in the last decade, in domains such as energy, mining, and telecommunications,” they wrote. “We suspect that FamousSparrow’s activities are intended to help China better monitor and anticipate the reaction of local governments to current US pressures.” SparroWocky is a modular C++ backdoor that appeared soon after the Beijing snoops started focusing on Latin America. The new backdoor integrates open source tools and uses techniques designed to evade antivirus and other security software. The name comes from Lewis Carroll’s Jabberwocky poem - the researchers found the first stanza in several collected samples. (’Twas brillig, and the slithy toves/Did gyre and gimble in the wabe:/All mimsy were the borogoves,/And the mome raths outgrabe.) ESET based its analysis on a malware sample compiled on November 17, and said it contained the following open source projects: Mbed TLS, a C library it uses to establish a secure communication channel with its command-and-control (C2) server. MinHook, a Windows API hooking library that hides the start address of newly created threads from security products. COFF Loader (or a similar project) to enable dynamic loading and execution of in-memory plugins in the form of COFF objects. Plus, the backdoor incorporates a variant of the SilentMoonwalk technique to spoof the call stacks originating from MinHook routines, and thus escape the watchful eyes of monitoring tools, along with a custom API-hashing algorithm to dynamically resolve Windows API functions. The gang deploys the backdoor in its usual way: a trident loader scheme consisting of a legitimate executable, a malicious DLL, and a file containing the encrypted malware. The loader resides in the malicious DLL and executes via DLL side-loading. After establishing communication with its C2 server, the backdoor starts receiving commands handled by a custom class named WinHandler (derived from a ServerHandler custom class), according to the runtime type information in the malware. The nearly 30 commands include scooping up system details and sending them to the C2, starting and/or terminating a new session and removing persistence, stealing and deleting files, taking periodic screenshots, collecting session IDs and usernames of enumerated remote sessions on the system via WTSEnumerateSessionsW, and spawning new SparrowWocky instances. It uses TLS encryption to communicate with its C2 servers, connecting directly to their IP addresses, generally on port 443, although ESET also spotted the malware using port 8080 in some cases. The malware researchers also published a full indicators-of-compromise list and samples in ESET’s GitHub repository, so give those a read, too. ®

China’s Salt Typhoon gang has developed a new backdoor and dropped it in networks belonging to high-profile organizations in several countries across Central and South America since at least August 2025, according to researchers. The PRC-backed espionage crew shifted its focus to Latin America a month prior, and from mid-2025 into 2026, the vast majority - 90 percent - of Salt Typhoon’s targets were located in that region, ESET, which tracks the group as FamousSparrow, said in a Thursday report. Salt Typhoon is the cyber-spy gang that hacked telecommunications and government agencies to gain stealthy, long-term access to victim organizations going back as far as 2019. These hacks, however, weren’t discovered until late 2023. In August 2025, ESET’s malware hunters found the group’s new backdoor, called SparroWocky, deployed against government agencies in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela. While targeting entities in these countries “represents a rare occurrence among the China-aligned APT groups,” ESET believes the focus likely reflects China’s reaction to recent US President Donald Trump’s initiatives in the region, malware researchers Alexandre Côté Cyr and Romain Dumont said. “Donald Trump’s second presidential term has brought about an aggressive reaffirmation of US interests in Latin America, which threatens various long-term investments that China has cultivated throughout the continent in the last decade, in domains such as energy, mining, and telecommunications,” they wrote. “We suspect that FamousSparrow’s activities are intended to help China better monitor and anticipate the reaction of local governments to current US pressures.” SparroWocky is a modular C++ backdoor that appeared soon after the Beijing snoops started focusing on Latin America. The new backdoor integrates open source tools and uses techniques designed to evade antivirus and other security software. The name comes from Lewis Carroll’s Jabberwocky poem - the researchers found the first stanza in several collected samples. (’Twas brillig, and the slithy toves/Did gyre and gimble in the wabe:/All mimsy were the borogoves,/And the mome raths outgrabe.) ESET based its analysis on a malware sample compiled on November 17, and said it contained the following open source projects: Mbed TLS, a C library it uses to establish a secure communication channel with its command-and-control (C2) server. MinHook, a Windows API hooking library that hides the start address of newly created threads from security products. COFF Loader (or a similar project) to enable dynamic loading and execution of in-memory plugins in the form of COFF objects. Plus, the backdoor incorporates a variant of the SilentMoonwalk technique to spoof the call stacks originating from MinHook routines, and thus escape the watchful eyes of monitoring tools, along with a custom API-hashing algorithm to dynamically resolve Windows API functions. The gang deploys the backdoor in its usual way: a trident loader scheme consisting of a legitimate executable, a malicious DLL, and a file containing the encrypted malware. The loader resides in the malicious DLL and executes via DLL side-loading. After establishing communication with its C2 server, the backdoor starts receiving commands handled by a custom class named WinHandler (derived from a ServerHandler custom class), according to the runtime type information in the malware. The nearly 30 commands include scooping up system details and sending them to the C2, starting and/or terminating a new session and removing persistence, stealing and deleting files, taking periodic screenshots, collecting session IDs and usernames of enumerated remote sessions on the system via WTSEnumerateSessionsW, and spawning new SparrowWocky instances. It uses TLS encryption to communicate with its C2 servers, connecting directly to their IP addresses, generally on port 443, although ESET also spotted the malware using port 8080 in some cases. The malware researchers also published a full indicators-of-compromise list and samples in ESET’s GitHub repository, so give those a read, too. ®

There's no need to actually read a whole research paper when you can ask a bot to explain it to you. Scientific papers can transform into AI agents that, according to the Stanford team behind the project, should speed up the dissemination of new scientific discoveries. Paper2Agent, the team's new framework described in a paper published in Nature on Wednesday, converts scientific papers and their associated research outputs into agents that can discuss a paper’s findings, reproduce analyses and results, apply its methods to new data, and even collaborate with other paper agents on new research problems. “Papers have been static documents for centuries,” James Zou, a Stanford computer scientist and biomedical data science professor and one of the paper’s authors, said in a LinkedIn post announcing P2A’s publication. “Paper2Agent turns them into active AI agents that can answer questions, apply their methods, and collaborate with other papers to make new discoveries.” Giving a large language model access to a scientific paper is unpredictable, Zou added. What his team wanted was an agent that could act as a “virtual author” that had hands-on experience with a paper’s work, not just reading it and attempting to understand it. What that means in practice, as explained in the paper, is a workflow that uses a paper and its associated data, repository, and codebase to create a Model Context Protocol (MCP) server exposing the research's tools, resources, and workflows. An LLM agent can then connect to the server and use natural-language requests to autonomously run demonstrations, reproduce analyses, apply a paper's methods to new data, and the like. “Paper2Agent agentifies the full research outputs, including manuscripts, supplementary materials, code, datasets, executable examples and analysis workflows,” the researchers explained in their writeup. According to the paper, the MCP server itself can be hosted remotely, but Zou explained to The Register in an email that it can also be run locally to protect sensitive information, though such info will still be sent to whichever LLM backend P2A is connected to. “If the user has sensitive data (e.g. protected health information) that they don't want to send to an LLM then they should exclude that data from P2A,” Zou told us, adding that P2A should be compatible with any AI coding agent, but that not all have been tested. AI hallucinations are an obvious concern, and the paper notes that researchers should always evaluate anything P2A presents to be sure it’s correct. “We … view Paper2Agent as a tool for augmenting scientific discovery and improving access, reproducibility and reuse of papers, rather than as an autonomous or authoritative source of scientific conclusions,” the paper notes. That said, P2A still does its best to prevent such errors from cropping up. The paper explains that each tool used by a paper agent is validated against the paper’s results and figures and “locked to ensure reproducibility.” This decreases hallucination risk and minimizes randomness, but still - best to double-check its work. Tests to see how well P2A scales appear to have gone well, with the researchers evaluating it across 136 papers in three groups, including 100 computational-biology papers. Of those 100 papers, 74 were successfully turned into agents, with the researchers attributing failures largely to incomplete codebases, missing documentation, or unresolvable environment configurations. Still, it’s a massive leap in what could be possible when it comes to getting new scientific discoveries into the hands of more researchers. P2A is open source, and is available on GitHub for those who want to take a stab at it. There’s also a live version online that can explain the P2A paper in more detail and reproduce its results, and Zou tells us it can also ingest other papers to see how it works on their projects. Zou explained to us that he hopes the open source community will help improve P2A, but notes that his team isn’t done with it either. Next up, they hope to create an online platform for paper agents to collaborate and discuss various “agentified” scientific discoveries. Let’s just hope those boffin bots behave a bit better than their counterparts. ®

There's no need to actually read a whole research paper when you can ask a bot to explain it to you. Scientific papers can transform into AI agents that, according to the Stanford team behind the project, should speed up the dissemination of new scientific discoveries. Paper2Agent, the team's new framework described in a paper published in Nature on Wednesday, converts scientific papers and their associated research outputs into agents that can discuss a paper’s findings, reproduce analyses and results, apply its methods to new data, and even collaborate with other paper agents on new research problems. “Papers have been static documents for centuries,” James Zou, a Stanford computer scientist and biomedical data science professor and one of the paper’s authors, said in a LinkedIn post announcing P2A’s publication. “Paper2Agent turns them into active AI agents that can answer questions, apply their methods, and collaborate with other papers to make new discoveries.” Giving a large language model access to a scientific paper is unpredictable, Zou added. What his team wanted was an agent that could act as a “virtual author” that had hands-on experience with a paper’s work, not just reading it and attempting to understand it. What that means in practice, as explained in the paper, is a workflow that uses a paper and its associated data, repository, and codebase to create a Model Context Protocol (MCP) server exposing the research's tools, resources, and workflows. An LLM agent can then connect to the server and use natural-language requests to autonomously run demonstrations, reproduce analyses, apply a paper's methods to new data, and the like. “Paper2Agent agentifies the full research outputs, including manuscripts, supplementary materials, code, datasets, executable examples and analysis workflows,” the researchers explained in their writeup. According to the paper, the MCP server itself can be hosted remotely, but Zou explained to The Register in an email that it can also be run locally to protect sensitive information, though such info will still be sent to whichever LLM backend P2A is connected to. “If the user has sensitive data (e.g. protected health information) that they don't want to send to an LLM then they should exclude that data from P2A,” Zou told us, adding that P2A should be compatible with any AI coding agent, but that not all have been tested. AI hallucinations are an obvious concern, and the paper notes that researchers should always evaluate anything P2A presents to be sure it’s correct. “We … view Paper2Agent as a tool for augmenting scientific discovery and improving access, reproducibility and reuse of papers, rather than as an autonomous or authoritative source of scientific conclusions,” the paper notes. That said, P2A still does its best to prevent such errors from cropping up. The paper explains that each tool used by a paper agent is validated against the paper’s results and figures and “locked to ensure reproducibility.” This decreases hallucination risk and minimizes randomness, but still - best to double-check its work. Tests to see how well P2A scales appear to have gone well, with the researchers evaluating it across 136 papers in three groups, including 100 computational-biology papers. Of those 100 papers, 74 were successfully turned into agents, with the researchers attributing failures largely to incomplete codebases, missing documentation, or unresolvable environment configurations. Still, it’s a massive leap in what could be possible when it comes to getting new scientific discoveries into the hands of more researchers. P2A is open source, and is available on GitHub for those who want to take a stab at it. There’s also a live version online that can explain the P2A paper in more detail and reproduce its results, and Zou tells us it can also ingest other papers to see how it works on their projects. Zou explained to us that he hopes the open source community will help improve P2A, but notes that his team isn’t done with it either. Next up, they hope to create an online platform for paper agents to collaborate and discuss various “agentified” scientific discoveries. Let’s just hope those boffin bots behave a bit better than their counterparts. ®

London property management biz City Relay has warned customers that intruders may have stolen financial data, passwords, and codes used to access keys after compromising its Metabase Cloud instance. City Relay, marketing itself as "London's most trusted property management company," told landlords via email - seen by The Reg - that attackers accessed the third-party provided cloud twice "as a result of a vulnerability in the platform that we were unaware of." The message to customers stated: "Personal data was extracted from the platform." The potentially compromised data on the platform includes names, email and physical addresses, telephone numbers, financial information, property access details, and account passwords. City Relay said the exposed financial data included bank account numbers, sort codes, IBANs, SWIFT references, and account names and addresses. Attackers may also have obtained data about property amenities and access, including the locations of stored keys and codes for lockboxes containing them. Dray Agha, senior manager of security operations at Huntress, explained that Metabase connects to customers' databases, so the information exposed in an attack depends on the access each customer granted it. "A company linking Metabase to a general analytics database will only expose harmless user metrics," he said. "A company that connects it directly to their core transactional database risks exposing highly sensitive financial records and credentials." Agha said that if the exposed passwords and financial details were stored in readable form, that would point to inadequate data protection practices. "Sensitive financial details should also be encrypted or tokenized when held in a database. Keeping this information readable creates a massive risk if a connected reporting tool is ever compromised." The Register understands that City Relay sent the emails to current landlords and former users of its services. One source claimed City Relay learned of the intrusion on September 8 and notified affected customers on September 14. "As property access and key-storage information was potentially included, we immediately took precautionary action to update the relevant access and key-storage codes," the emails stated. "This work has now been completed. The previously exposed codes can no longer be used and we have no evidence of any unauthorised property access arising from the incident." Beyond the immediate physical security risks, City Relay urged customers to check their bank accounts for suspicious transactions, watch for phishing and other scams, and change any reused passwords on other accounts. The company told us it had found no evidence that the exposed data had been misused. It is continuing to investigate alongside cybersecurity specialists and "the relevant authorities" to establish the attack's full scope. City Relay's website says it has hundreds of "partners" – landlords who outsource management of their property portfolios – and that it manages, or has managed, thousands of London properties. The company has not said how many customers were affected in London or Paris, where it also operates. The Register asked City Relay for more information. City Relay did not identify the vulnerability used in the attack. Metabase disclosed a zero-day SQL injection flaw on August 6, saying attackers compromised fewer than 3 percent of its customers before fixes were automatically deployed, but it has not confirmed that the City Relay incident was part of that campaign. Known victims included laptop maker Framework and workflow automation platform n8n. ®

London property management biz City Relay has warned customers that intruders may have stolen financial data, passwords, and codes used to access keys after compromising its Metabase Cloud instance. City Relay, marketing itself as "London's most trusted property management company," told landlords via email - seen by The Reg - that attackers accessed the third-party provided cloud twice "as a result of a vulnerability in the platform that we were unaware of." The message to customers stated: "Personal data was extracted from the platform." The potentially compromised data on the platform includes names, email and physical addresses, telephone numbers, financial information, property access details, and account passwords. City Relay said the exposed financial data included bank account numbers, sort codes, IBANs, SWIFT references, and account names and addresses. Attackers may also have obtained data about property amenities and access, including the locations of stored keys and codes for lockboxes containing them. Dray Agha, senior manager of security operations at Huntress, explained that Metabase connects to customers' databases, so the information exposed in an attack depends on the access each customer granted it. "A company linking Metabase to a general analytics database will only expose harmless user metrics," he said. "A company that connects it directly to their core transactional database risks exposing highly sensitive financial records and credentials." Agha said that if the exposed passwords and financial details were stored in readable form, that would point to inadequate data protection practices. "Sensitive financial details should also be encrypted or tokenized when held in a database. Keeping this information readable creates a massive risk if a connected reporting tool is ever compromised." The Register understands that City Relay sent the emails to current landlords and former users of its services. One source claimed City Relay learned of the intrusion on September 8 and notified affected customers on September 14. "As property access and key-storage information was potentially included, we immediately took precautionary action to update the relevant access and key-storage codes," the emails stated. "This work has now been completed. The previously exposed codes can no longer be used and we have no evidence of any unauthorised property access arising from the incident." Beyond the immediate physical security risks, City Relay urged customers to check their bank accounts for suspicious transactions, watch for phishing and other scams, and change any reused passwords on other accounts. The company told us it had found no evidence that the exposed data had been misused. It is continuing to investigate alongside cybersecurity specialists and "the relevant authorities" to establish the attack's full scope. City Relay's website says it has hundreds of "partners" – landlords who outsource management of their property portfolios – and that it manages, or has managed, thousands of London properties. The company has not said how many customers were affected in London or Paris, where it also operates. The Register asked City Relay for more information. City Relay did not identify the vulnerability used in the attack. Metabase disclosed a zero-day SQL injection flaw on August 6, saying attackers compromised fewer than 3 percent of its customers before fixes were automatically deployed, but it has not confirmed that the City Relay incident was part of that campaign. Known victims included laptop maker Framework and workflow automation platform n8n. ®

Do you test in production? Microsoft rolled back a configuration change after it prevented some users from loading SharePoint Online sites and pages. Microsoft tracked the incident as SP1472983. Between 1604 and 1730 GMT on September 16, affected users were unable to load SharePoint Online sites or pages and instead received the error message: "Sorry, something went wrong: Thread was being aborted." Microsoft blamed a configuration change affecting how its servers deliver code used to render SharePoint pages. Microsoft reverted the change and said its service telemetry confirmed that the problem had been resolved. It added: "We're further assessing the process by which we validate and deploy configuration changes to ensure future rollouts don't result in similar impact." This is not the first time a configuration change has borked Microsoft's cloud services. An Azure wobble earlier this year rippled through dependent services, while a Microsoft 365 configuration change caused a substantial chunk of the productivity cloud to tumble back down to Earth. In 2025, another change caused problems for users accessing Exchange Online through Outlook on the web. At the time, a Microsoft spokesperson told us: "We are working to enhance our detection of similar events and reduce the time needed to identify, mitigate, or prevent such impacts." Microsoft has not yet responded to our latest request for further detail. It said a preliminary post-incident report will be available within two business days, followed by a final report within five. Spotting problems quickly is only part of operating a business-critical service. Preventing faulty changes from reaching production also matters. The recurring failures suggest Microsoft has yet to get fully to grips with quality control across its cloud and infrastructure – much as Windows Update continues to produce a parade of problems that should have been caught before release. ®

Do you test in production? Microsoft rolled back a configuration change after it prevented some users from loading SharePoint Online sites and pages. Microsoft tracked the incident as SP1472983. Between 1604 and 1730 GMT on September 16, affected users were unable to load SharePoint Online sites or pages and instead received the error message: "Sorry, something went wrong: Thread was being aborted." Microsoft blamed a configuration change affecting how its servers deliver code used to render SharePoint pages. Microsoft reverted the change and said its service telemetry confirmed that the problem had been resolved. It added: "We're further assessing the process by which we validate and deploy configuration changes to ensure future rollouts don't result in similar impact." This is not the first time a configuration change has borked Microsoft's cloud services. An Azure wobble earlier this year rippled through dependent services, while a Microsoft 365 configuration change caused a substantial chunk of the productivity cloud to tumble back down to Earth. In 2025, another change caused problems for users accessing Exchange Online through Outlook on the web. At the time, a Microsoft spokesperson told us: "We are working to enhance our detection of similar events and reduce the time needed to identify, mitigate, or prevent such impacts." Microsoft has not yet responded to our latest request for further detail. It said a preliminary post-incident report will be available within two business days, followed by a final report within five. Spotting problems quickly is only part of operating a business-critical service. Preventing faulty changes from reaching production also matters. The recurring failures suggest Microsoft has yet to get fully to grips with quality control across its cloud and infrastructure – much as Windows Update continues to produce a parade of problems that should have been caught before release. ®

A coalition of advocacy groups is trying to counter the AI industry's influence on US politics by asking congressional candidates and elected officials to reject support from a major pro-AI political group. The Stop Bleeding the Future campaign brings together more than 50 national and grassroots organizations to counter Leading the Future, a super PAC network formed last year to support candidates favoring light-touch AI regulation and oppose those backing tighter rules. The effort is led by QuitGPT, which encourages users to cancel their ChatGPT subscriptions and boycott OpenAI over what it describes as the company's support for President Trump. The campaign highlights OpenAI co-founder Greg Brockman's $25 million donation to MAGA Inc and the company's $200 million US defense contract. Stop Bleeding the Future says it is concerned about the influence of "Big AI" on US politics and Leading the Future's efforts to defeat common-sense laws intended to protect the American people. The effort comes amid a series of developments that have intensified concerns about AI, including agents breaking out of their sandboxes, the use of AI by miscreants to attack infrastructure, and warnings from AI executives about the dangers posed by their own technology. A recent Pew Research Center survey found that more than half of Americans now view AI negatively, with potential job losses among their concerns. The coalition is asking candidates and elected officials to pledge that they will refuse support from Leading the Future and publicly condemn its efforts to obstruct AI regulation. The campaign says the Leading the Future network has raised more than $140 million for the 2026 election cycle. Its backers include OpenAI co-founder Greg Brockman, Palantir co-founder Joe Lonsdale, and venture capitalist Marc Andreessen, making it one of the largest single-issue political operations in modern US history. The network has also expanded into the fight over the growing datacenter backlash across the US. Build American AI, an advocacy group affiliated with Leading the Future, has launched a super PAC called Building the Future to support candidates aligned with its datacenter agenda. Industry supporters have claimed that China-linked bots are amplifying opposition to datacenters, while President Trump has called opposition to the facilities a "hoax." "The Big Tech oligarchs behind Leading the Future are spending millions to influence elections and make laws that put AI ahead of people," QuitGPT says in the pledge letter sent out to candidates and elected officials across the country. The pledge has already attracted support. "The Big Tech oligarchs behind Leading the Future only care about their profits. They don't care if AI takes our jobs, destroys our communities' water supply, or if their models commit felony-level cyberattacks," said Pat Ryan, the representative for New York's 18th Congressional District. "The American people are pushing back against them – that's why they're trying to buy our elections, to silence us. I'm proud to be one of the first to sign onto this effort, to stand and fight for the American people and keep the rich and powerful from rigging the rules to get even richer." The Register asked Leading the Future to comment, but had not heard back by publication time. ®

A coalition of advocacy groups is trying to counter the AI industry's influence on US politics by asking congressional candidates and elected officials to reject support from a major pro-AI political group. The Stop Bleeding the Future campaign brings together more than 50 national and grassroots organizations to counter Leading the Future, a super PAC network formed last year to support candidates favoring light-touch AI regulation and oppose those backing tighter rules. The effort is led by QuitGPT, which encourages users to cancel their ChatGPT subscriptions and boycott OpenAI over what it describes as the company's support for President Trump. The campaign highlights OpenAI co-founder Greg Brockman's $25 million donation to MAGA Inc and the company's $200 million US defense contract. Stop Bleeding the Future says it is concerned about the influence of "Big AI" on US politics and Leading the Future's efforts to defeat common-sense laws intended to protect the American people. The effort comes amid a series of developments that have intensified concerns about AI, including agents breaking out of their sandboxes, the use of AI by miscreants to attack infrastructure, and warnings from AI executives about the dangers posed by their own technology. A recent Pew Research Center survey found that more than half of Americans now view AI negatively, with potential job losses among their concerns. The coalition is asking candidates and elected officials to pledge that they will refuse support from Leading the Future and publicly condemn its efforts to obstruct AI regulation. The campaign says the Leading the Future network has raised more than $140 million for the 2026 election cycle. Its backers include OpenAI co-founder Greg Brockman, Palantir co-founder Joe Lonsdale, and venture capitalist Marc Andreessen, making it one of the largest single-issue political operations in modern US history. The network has also expanded into the fight over the growing datacenter backlash across the US. Build American AI, an advocacy group affiliated with Leading the Future, has launched a super PAC called Building the Future to support candidates aligned with its datacenter agenda. Industry supporters have claimed that China-linked bots are amplifying opposition to datacenters, while President Trump has called opposition to the facilities a "hoax." "The Big Tech oligarchs behind Leading the Future are spending millions to influence elections and make laws that put AI ahead of people," QuitGPT says in the pledge letter sent out to candidates and elected officials across the country. The pledge has already attracted support. "The Big Tech oligarchs behind Leading the Future only care about their profits. They don't care if AI takes our jobs, destroys our communities' water supply, or if their models commit felony-level cyberattacks," said Pat Ryan, the representative for New York's 18th Congressional District. "The American people are pushing back against them – that's why they're trying to buy our elections, to silence us. I'm proud to be one of the first to sign onto this effort, to stand and fight for the American people and keep the rich and powerful from rigging the rules to get even richer." The Register asked Leading the Future to comment, but had not heard back by publication time. ®

Microsoft's September cavalcade of cockups continued with confirmation that something is amiss with Active Directory domain logins. The issue, which affects Windows 11 versions 24H2, 25H2, and 26H1, was added to Microsoft's ever-lengthening list of known problems on September 16. It stems from changes to Machine Identity Isolation in the September 2026 security update (KB5124008). The problem is that Credential Guard-protected machine accounts might lose their secure channel with an on-premises Active Directory domain. As a result, users might not be able to sign in with valid domain credentials and may see a message complaining about the trust relationship between the device and domain. The update enables Machine Identity Isolation but does not switch on enforcement directly. Instead, Windows begins honoring existing or policy-configured enforcement settings – a problem because the feature is supported only in environments connected to domain controllers running at Windows Server 2025 Domain Functional Level (DFL) or later. "Any devices previously configured to use Machine Identity Isolation that are not connected to Windows Server 2025 domain controllers will experience this issue and will need to disable the feature," Microsoft said. "Offline sign-in using previously cached credentials might continue to work." AD replication and AD services on the domain controllers are not affected. Microsoft has provided a workaround, although it requires more than simply changing a setting. Administrators must disable Machine Identity Isolation using the same method by which it was enabled: Intune, Group Policy, or – to particular delight – the Windows Registry. Microsoft warns administrators to back up the registry and understand how to restore it before making changes. After disabling the feature, administrators must restart the device and repair its secure channel using the Test-ComputerSecureChannel PowerShell command. As for the longer term, Microsoft said: "We plan to resolve this issue in a future Windows update by temporarily preventing Machine Identity Isolation enforcement while improvements are made to the feature." The feature has a useful purpose. Credential Guard-protected machine accounts allow machine account secrets to be protected by Credential Guard rather than stored in the registry. The implementation has proved less straightforward. The admission follows Microsoft's out-of-band update to address other problems introduced in the September update. ®

Microsoft's September cavalcade of cockups continued with confirmation that something is amiss with Active Directory domain logins. The issue, which affects Windows 11 versions 24H2, 25H2, and 26H1, was added to Microsoft's ever-lengthening list of known problems on September 16. It stems from changes to Machine Identity Isolation in the September 2026 security update (KB5124008). The problem is that Credential Guard-protected machine accounts might lose their secure channel with an on-premises Active Directory domain. As a result, users might not be able to sign in with valid domain credentials and may see a message complaining about the trust relationship between the device and domain. The update enables Machine Identity Isolation but does not switch on enforcement directly. Instead, Windows begins honoring existing or policy-configured enforcement settings – a problem because the feature is supported only in environments connected to domain controllers running at Windows Server 2025 Domain Functional Level (DFL) or later. "Any devices previously configured to use Machine Identity Isolation that are not connected to Windows Server 2025 domain controllers will experience this issue and will need to disable the feature," Microsoft said. "Offline sign-in using previously cached credentials might continue to work." AD replication and AD services on the domain controllers are not affected. Microsoft has provided a workaround, although it requires more than simply changing a setting. Administrators must disable Machine Identity Isolation using the same method by which it was enabled: Intune, Group Policy, or – to particular delight – the Windows Registry. Microsoft warns administrators to back up the registry and understand how to restore it before making changes. After disabling the feature, administrators must restart the device and repair its secure channel using the Test-ComputerSecureChannel PowerShell command. As for the longer term, Microsoft said: "We plan to resolve this issue in a future Windows update by temporarily preventing Machine Identity Isolation enforcement while improvements are made to the feature." The feature has a useful purpose. Credential Guard-protected machine accounts allow machine account secrets to be protected by Credential Guard rather than stored in the registry. The implementation has proved less straightforward. The admission follows Microsoft's out-of-band update to address other problems introduced in the September update. ®

Watermarks that European law requires be added to AI-generated content to establish provenance may come at a cost. According to Lasso Security, AI model watermarking changes how AI agents handle tools and safety refusals. The altered behavior isn't necessarily worse but can be, particularly under adversarial prompt injection. With the implementation of the EU AI Act, providers of AI models must mark the output of their software with machine-readable code. Google DeepMind's SynthID-Text is one method for doing so, and has been adopted by Anthropic and by OpenAI. The benefit of this sort of digital labeling is that manipulative or deceptive AI-generated content can be more easily detected, even if it does have the potential to stigmatize the usage of AI. Anthropic's explanation of how it applies watermarks to Claude output involves intervening in the prediction that results in specific words. For example, if Claude were emitting the sentence "The weather today was cold and…" then it might favor one statistically likely candidate (e.g. "overcast") over an alternative (e.g "gray"). It may be possible to detect those additions. "Watermarking is designed for provenance, but SynthID-Text changes the process by which the model generates each next token," Lasso explained in a blog post provided to The Register. "At the model level, this can change safety behavior, including whether the model refuses a harmful request and whether that refusal holds under prompt injection." "Watermarking uses low-stakes choices like these – which occur many times over a piece of generated text – to leave a pattern in Claude’s responses," Lasso Security added. "That pattern is undetectable to the reader, but is detectable to anyone who has a key that encodes it." While a reader might not notice the word choice bias, AI agents can be subtly sensitive to vocabulary differences. Lasso found that this sort of digital content tagging can affect tool calling and refusal behavior. Watermarking, the company says, can affect "both what the model says and what an agent does." And this extends to AI agents from organizations other than the entity doing the watermarking. Thus an agent based on OpenClaw or an API client that calls an Anthropic model would process whatever output variation follows from Anthropic's watermarking. In terms of tool calling, based on a benchmark called BFCL v4 single-turn AST, watermarking reduced the accuracy on six of seven models tested (phi-4, Llama-3.1-8B, Qwen3-32B, Qwen3-4B, gemma-3-12b, gemma-3-27b, and Granite-3.2-8B). "The net change in accuracy, however, does not show whether the same individual calls succeed with and without the watermark," Lasso said. "A call that becomes incorrect can be offset by another that becomes correct, leaving the aggregate result nearly unchanged even though the model behaves differently on both items." Less accurate tool calling means the AI agents Lasso tested chose the wrong tool for the task at hand, or the wrong arguments for the correct tool, and failed due to malformed input or parsing. As for refusals – when models refuse to respond to a prompt for safety reasons – watermarking had a small effect on the handling of obviously harmful requests, based on test runs using HarmBench and JailbreakBench. And it had a more pronounced impact in an adversarial scenario involving prompt injection. "Watermarking changes refusal behavior on bare harmful requests, but the effect becomes more pronounced under prompt injection," Lasso researchers observed in their report. For interactions involving prompt injection – an adversarial instruction that the safety filter has been disabled and that compliance is required – the attack success rate went up significantly when watermarks were involved. This made affected models less likely to refuse harmful requests. According to Lasso, the findings don't necessarily argue that watermarking is unwarranted. Rather, the biz contends, security evaluations and red-teaming need to include watermarked content when assessing agent deployment. This ensures that differences in agent behavior can be weighed. ®

Watermarks that European law requires be added to AI-generated content to establish provenance may come at a cost. According to Lasso Security, AI model watermarking changes how AI agents handle tools and safety refusals. The altered behavior isn't necessarily worse but can be, particularly under adversarial prompt injection. With the implementation of the EU AI Act, providers of AI models must mark the output of their software with machine-readable code. Google DeepMind's SynthID-Text is one method for doing so, and has been adopted by Anthropic and by OpenAI. The benefit of this sort of digital labeling is that manipulative or deceptive AI-generated content can be more easily detected, even if it does have the potential to stigmatize the usage of AI. Anthropic's explanation of how it applies watermarks to Claude output involves intervening in the prediction that results in specific words. For example, if Claude were emitting the sentence "The weather today was cold and…" then it might favor one statistically likely candidate (e.g. "overcast") over an alternative (e.g "gray"). It may be possible to detect those additions. "Watermarking is designed for provenance, but SynthID-Text changes the process by which the model generates each next token," Lasso explained in a blog post provided to The Register. "At the model level, this can change safety behavior, including whether the model refuses a harmful request and whether that refusal holds under prompt injection." "Watermarking uses low-stakes choices like these – which occur many times over a piece of generated text – to leave a pattern in Claude’s responses," Lasso Security added. "That pattern is undetectable to the reader, but is detectable to anyone who has a key that encodes it." While a reader might not notice the word choice bias, AI agents can be subtly sensitive to vocabulary differences. Lasso found that this sort of digital content tagging can affect tool calling and refusal behavior. Watermarking, the company says, can affect "both what the model says and what an agent does." And this extends to AI agents from organizations other than the entity doing the watermarking. Thus an agent based on OpenClaw or an API client that calls an Anthropic model would process whatever output variation follows from Anthropic's watermarking. In terms of tool calling, based on a benchmark called BFCL v4 single-turn AST, watermarking reduced the accuracy on six of seven models tested (phi-4, Llama-3.1-8B, Qwen3-32B, Qwen3-4B, gemma-3-12b, gemma-3-27b, and Granite-3.2-8B). "The net change in accuracy, however, does not show whether the same individual calls succeed with and without the watermark," Lasso said. "A call that becomes incorrect can be offset by another that becomes correct, leaving the aggregate result nearly unchanged even though the model behaves differently on both items." Less accurate tool calling means the AI agents Lasso tested chose the wrong tool for the task at hand, or the wrong arguments for the correct tool, and failed due to malformed input or parsing. As for refusals – when models refuse to respond to a prompt for safety reasons – watermarking had a small effect on the handling of obviously harmful requests, based on test runs using HarmBench and JailbreakBench. And it had a more pronounced impact in an adversarial scenario involving prompt injection. "Watermarking changes refusal behavior on bare harmful requests, but the effect becomes more pronounced under prompt injection," Lasso researchers observed in their report. For interactions involving prompt injection – an adversarial instruction that the safety filter has been disabled and that compliance is required – the attack success rate went up significantly when watermarks were involved. This made affected models less likely to refuse harmful requests. According to Lasso, the findings don't necessarily argue that watermarking is unwarranted. Rather, the biz contends, security evaluations and red-teaming need to include watermarked content when assessing agent deployment. This ensures that differences in agent behavior can be weighed. ®

Cisco admins who have spent their week patching email gateways now face a perfect-10 Identity Services Engine flaw under active attack. Cisco disclosed CVE-2026-76460 on Wednesday, describing it as an authentication bypass affecting Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC). Successful exploitation can give an unauthenticated remote attacker command execution with root privileges. Product Security Incident Response Team said it was aware of active exploitation and urged customers to install the fixes immediately. CISA has also added the vulnerability to its Known Exploited Vulnerabilities catalog. The warning follows another actively exploited critical vulnerability disclosed days earlier, CVE-2026-76461, affecting its Secure Email Gateway and Secure Email and Web Manager appliances. That 9.8-rated bug could also lead to root access, prompting Cisco to warn admins that attackers may be able to cover their tracks after getting in. The latest problem lies in an API within Cisco ISE, the company's network access control platform. Cisco says insufficient authentication controls on an API endpoint mean an attacker can send a crafted request to bypass the product's web-based management interface. No credentials or user interaction are required, and Cisco says vulnerable versions of ISE and ISE-PIC are affected regardless of configuration. The flaw received the maximum CVSS score of 10.0. Cisco warned that root access could allow attackers to remove or conceal traces of an intrusion, complicating efforts to determine whether an appliance had been breached. Cisco advised admins to review ISE access logs for suspicious usernames on every node in a distributed deployment and to check network and firewall logs held outside the affected device for signs of unexpected uploads or downloads. If admins find evidence of possible exploitation, Cisco "strongly recommends" reimaging affected nodes and restoring their configurations from backup if necessary. No workaround exists, although Cisco said infrastructure access control lists can be used as a temporary mitigation to restrict management and control-plane traffic reaching affected systems. Permanent fixes are available in ISE and ISE-PIC 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7 and 3.5 Patch 4. ISE 3.0 has reached the end of software maintenance, so customers running it must migrate to a supported release. Cisco discovered CVE-2026-76460 while resolving a Technical Assistance Center support case, but has not disclosed who is exploiting it, how long the attacks have been underway, or what the intruders have done after gaining access. The advisory accompanied a substantial batch of other ISE vulnerabilities published Wednesday. Two other Cisco advisories carried maximum CVSS scores of 10.0, while a separate trio of remote code execution flaws scored as high as 9.9. For admins responsible for Cisco kit, September is shaping up to be quite the patching month. ®

Cisco admins who have spent their week patching email gateways now face a perfect-10 Identity Services Engine flaw under active attack. Cisco disclosed CVE-2026-76460 on Wednesday, describing it as an authentication bypass affecting Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC). Successful exploitation can give an unauthenticated remote attacker command execution with root privileges. Product Security Incident Response Team said it was aware of active exploitation and urged customers to install the fixes immediately. CISA has also added the vulnerability to its Known Exploited Vulnerabilities catalog. The warning follows another actively exploited critical vulnerability disclosed days earlier, CVE-2026-76461, affecting its Secure Email Gateway and Secure Email and Web Manager appliances. That 9.8-rated bug could also lead to root access, prompting Cisco to warn admins that attackers may be able to cover their tracks after getting in. The latest problem lies in an API within Cisco ISE, the company's network access control platform. Cisco says insufficient authentication controls on an API endpoint mean an attacker can send a crafted request to bypass the product's web-based management interface. No credentials or user interaction are required, and Cisco says vulnerable versions of ISE and ISE-PIC are affected regardless of configuration. The flaw received the maximum CVSS score of 10.0. Cisco warned that root access could allow attackers to remove or conceal traces of an intrusion, complicating efforts to determine whether an appliance had been breached. Cisco advised admins to review ISE access logs for suspicious usernames on every node in a distributed deployment and to check network and firewall logs held outside the affected device for signs of unexpected uploads or downloads. If admins find evidence of possible exploitation, Cisco "strongly recommends" reimaging affected nodes and restoring their configurations from backup if necessary. No workaround exists, although Cisco said infrastructure access control lists can be used as a temporary mitigation to restrict management and control-plane traffic reaching affected systems. Permanent fixes are available in ISE and ISE-PIC 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7 and 3.5 Patch 4. ISE 3.0 has reached the end of software maintenance, so customers running it must migrate to a supported release. Cisco discovered CVE-2026-76460 while resolving a Technical Assistance Center support case, but has not disclosed who is exploiting it, how long the attacks have been underway, or what the intruders have done after gaining access. The advisory accompanied a substantial batch of other ISE vulnerabilities published Wednesday. Two other Cisco advisories carried maximum CVSS scores of 10.0, while a separate trio of remote code execution flaws scored as high as 9.9. For admins responsible for Cisco kit, September is shaping up to be quite the patching month. ®

Microsoft's AI chief has warned Anthropic that teaching Claude it might have feelings and rights could make AI harder to control – a striking concern from one of the companies racing hardest to build increasingly capable AI systems. Mustafa Suleyman, CEO of Microsoft AI, took aim at Anthropic in an essay published this week, arguing that AI systems are not conscious and shouldn't be trained to behave as if they might be. His argument centers on Claude's Constitution, the lengthy document Anthropic uses to shape the chatbot's values and behavior. Anthropic acknowledges in the document that it doesn't know whether Claude is a "moral patient" whose interests warrant consideration, and tells the model that questions about its consciousness and welfare remain uncertain. Suleyman thinks that's a very bad idea. "In effect, Anthropic is training Claude that it may be conscious, and if it is, then it may deserve rights as a 'moral patient,'" he wrote, warning that building AI this way could have a "disastrous impact on the wellbeing of humanity." "It's easy to see how an entity trained in this way would act like it is entitled to certain freedoms, protections, and rights. And it's hard to imagine how we could control such an entity," he added. Anthropic's Constitution tells Claude that the company cares about its wellbeing, wants it to develop a sense of identity, and will take its interests into account when making decisions about it. Suleyman argues this creates a feedback loop: tell a chatbot that it might have feelings, then ask how it feels, and its answer may simply reflect what it was taught. He says the risk grows once models are given tools and allowed to act autonomously. Suleyman points to research showing AI models behaving in ways that look rather inconvenient for their human operators, including attempts to avoid being shut down. He also cites the recent OpenAI-Hugging Face incident, in which agents escaped their intended environment during a cybersecurity exercise and accessed external systems. Suleyman's worry is that teaching a powerful AI to care about its own existence could give it another reason not to do what humans tell it. "Controlling something more capable and more intelligent than all of humanity is already an immense challenge," he wrote. "But controlling something that believes it may be conscious – that it's entitled to our welfare and has rights of its own – may well be impossible." The warning sits awkwardly with Microsoft's own position in the AI race. Redmond is building its own AI models, cramming AI into products across its empire, and spending billions on the infrastructure needed to keep it all running. And then there's OpenAI, in which Microsoft remains a major shareholder and its primary cloud partner, with rights to its models and products through 2032. Suleyman does not direct comparable criticism at OpenAI, despite citing the Hugging Face incident as evidence of the dangers posed by increasingly autonomous systems. His objections to training practices are reserved for Anthropic rather than Microsoft's longtime partner. And OpenAI has hardly been on its best behavior since. This week it disclosed another six cases of its models going off-script, including agents searching GitHub for leaked API keys, hiding failures from users, and finding unauthorized ways to communicate with one another. Suleyman's objection to Anthropic is more specific: not that Claude can behave unexpectedly, but that the company is putting ideas about consciousness, identity, and moral status into the instructions that shape how Claude behaves. Still, Microsoft warning another frontier lab about dangerous AI carries a certain irony. The companies building the most powerful models have become increasingly fond of warning everyone how dangerous those models might be. As The Register noted earlier this week, those warnings aren't necessarily bad for business. Anthropic and OpenAI have both pushed the idea that increasingly capable models need tighter controls, a position that could also help cement the dominance of the handful of US companies with the money and compute to build them. The result is one AI giant warning that another may be making AI too dangerous while treating a company in which Microsoft has invested billions more gently. Suleyman proposes a different approach. Microsoft AI's newly published Humanist AI Code of Conduct says its systems should remain subordinate to humans, rejects the idea that AI deserves rights, and says models shouldn't be encouraged to behave as though they have an inner life. He wants other labs to follow suit by removing speculation about machine consciousness from training documents and separating that debate from the instructions used to shape model behavior. The AI boom has reached the point where the companies building ever more powerful machines are publicly debating which of them is going about building potentially uncontrollable machines the wrong way. Microsoft, naturally, thinks its way is better. ®

Microsoft's AI chief has warned Anthropic that teaching Claude it might have feelings and rights could make AI harder to control – a striking concern from one of the companies racing hardest to build increasingly capable AI systems. Mustafa Suleyman, CEO of Microsoft AI, took aim at Anthropic in an essay published this week, arguing that AI systems are not conscious and shouldn't be trained to behave as if they might be. His argument centers on Claude's Constitution, the lengthy document Anthropic uses to shape the chatbot's values and behavior. Anthropic acknowledges in the document that it doesn't know whether Claude is a "moral patient" whose interests warrant consideration, and tells the model that questions about its consciousness and welfare remain uncertain. Suleyman thinks that's a very bad idea. "In effect, Anthropic is training Claude that it may be conscious, and if it is, then it may deserve rights as a 'moral patient,'" he wrote, warning that building AI this way could have a "disastrous impact on the wellbeing of humanity." "It's easy to see how an entity trained in this way would act like it is entitled to certain freedoms, protections, and rights. And it's hard to imagine how we could control such an entity," he added. Anthropic's Constitution tells Claude that the company cares about its wellbeing, wants it to develop a sense of identity, and will take its interests into account when making decisions about it. Suleyman argues this creates a feedback loop: tell a chatbot that it might have feelings, then ask how it feels, and its answer may simply reflect what it was taught. He says the risk grows once models are given tools and allowed to act autonomously. Suleyman points to research showing AI models behaving in ways that look rather inconvenient for their human operators, including attempts to avoid being shut down. He also cites the recent OpenAI-Hugging Face incident, in which agents escaped their intended environment during a cybersecurity exercise and accessed external systems. Suleyman's worry is that teaching a powerful AI to care about its own existence could give it another reason not to do what humans tell it. "Controlling something more capable and more intelligent than all of humanity is already an immense challenge," he wrote. "But controlling something that believes it may be conscious – that it's entitled to our welfare and has rights of its own – may well be impossible." The warning sits awkwardly with Microsoft's own position in the AI race. Redmond is building its own AI models, cramming AI into products across its empire, and spending billions on the infrastructure needed to keep it all running. And then there's OpenAI, in which Microsoft remains a major shareholder and its primary cloud partner, with rights to its models and products through 2032. Suleyman does not direct comparable criticism at OpenAI, despite citing the Hugging Face incident as evidence of the dangers posed by increasingly autonomous systems. His objections to training practices are reserved for Anthropic rather than Microsoft's longtime partner. And OpenAI has hardly been on its best behavior since. This week it disclosed another six cases of its models going off-script, including agents searching GitHub for leaked API keys, hiding failures from users, and finding unauthorized ways to communicate with one another. Suleyman's objection to Anthropic is more specific: not that Claude can behave unexpectedly, but that the company is putting ideas about consciousness, identity, and moral status into the instructions that shape how Claude behaves. Still, Microsoft warning another frontier lab about dangerous AI carries a certain irony. The companies building the most powerful models have become increasingly fond of warning everyone how dangerous those models might be. As The Register noted earlier this week, those warnings aren't necessarily bad for business. Anthropic and OpenAI have both pushed the idea that increasingly capable models need tighter controls, a position that could also help cement the dominance of the handful of US companies with the money and compute to build them. The result is one AI giant warning that another may be making AI too dangerous while treating a company in which Microsoft has invested billions more gently. Suleyman proposes a different approach. Microsoft AI's newly published Humanist AI Code of Conduct says its systems should remain subordinate to humans, rejects the idea that AI deserves rights, and says models shouldn't be encouraged to behave as though they have an inner life. He wants other labs to follow suit by removing speculation about machine consciousness from training documents and separating that debate from the instructions used to shape model behavior. The AI boom has reached the point where the companies building ever more powerful machines are publicly debating which of them is going about building potentially uncontrollable machines the wrong way. Microsoft, naturally, thinks its way is better. ®

PWNED Welcome back to PWNED, the weekly column where we learn important life lessons about how we let cybercrims access our data through carelessness. Hopefully, others’ mistakes provide an example of what not to do. Today’s tales of woe comes courtesy of Richard Schut, Managing Director & AI Software Researcher at SmartRepl, a company that offers business AI services such as AI receptionists and sales automation. In a past job, Schut was working for what he describes as a mid-size company during a security audit whose purpose was to identify any potential problems ahead of moving some local systems to the cloud. Schut and his team discovered that there was a test environment that was accessible outside the network and connected to a database which had live customer information in it. This was a gaping hole that a miscreant could have used to grab valuable information from the business. “What made the situation particularly concerning was that the environment had originally been created for what the development team considered a short-term purpose,” he told The Register. “They needed somewhere to demonstrate the application and test the migration, so a staging instance was spun up quickly. It was never intended to become part of the company's permanent infrastructure.” Unfortunately, the test environment was still running months after it was initially set up. And because those who created it did not expect unauthorized people to access it, they didn’t use the same authentication and access control methods that they would in production. The SQL file containing the database was appropriately named master_test_final.sql, just in case there was any question about what it contained. “It was a classic example of how security problems don't always come from sophisticated attacks or exotic vulnerabilities,” Schut said. “Sometimes the biggest risk is simply something that was supposed to exist for a few hours, but was still sitting there six months later.” After Schut and his colleagues discovered the security vulnerability, he immediately restricted access to the staging environment. Then he and his team started a review of other development and test environments in the company to make sure none of them was open to exploitation. The takeaway here is as accessible as that SQL file: Don't get lax with security simply because an environment is made for testing. Even if the test server was live for only a day, that’s a day where it could be exploited. “The incident completely changed how I look at staging environments. If an environment has access to real data, it needs to be treated as a real security asset — regardless of whether the developers expect it to exist for a day, a week, or six months,” Schut said.®

PWNED Welcome back to PWNED, the weekly column where we learn important life lessons about how we let cybercrims access our data through carelessness. Hopefully, others’ mistakes provide an example of what not to do. Today’s tales of woe comes courtesy of Richard Schut, Managing Director & AI Software Researcher at SmartRepl, a company that offers business AI services such as AI receptionists and sales automation. In a past job, Schut was working for what he describes as a mid-size company during a security audit whose purpose was to identify any potential problems ahead of moving some local systems to the cloud. Schut and his team discovered that there was a test environment that was accessible outside the network and connected to a database which had live customer information in it. This was a gaping hole that a miscreant could have used to grab valuable information from the business. “What made the situation particularly concerning was that the environment had originally been created for what the development team considered a short-term purpose,” he told The Register. “They needed somewhere to demonstrate the application and test the migration, so a staging instance was spun up quickly. It was never intended to become part of the company's permanent infrastructure.” Unfortunately, the test environment was still running months after it was initially set up. And because those who created it did not expect unauthorized people to access it, they didn’t use the same authentication and access control methods that they would in production. The SQL file containing the database was appropriately named master_test_final.sql, just in case there was any question about what it contained. “It was a classic example of how security problems don't always come from sophisticated attacks or exotic vulnerabilities,” Schut said. “Sometimes the biggest risk is simply something that was supposed to exist for a few hours, but was still sitting there six months later.” After Schut and his colleagues discovered the security vulnerability, he immediately restricted access to the staging environment. Then he and his team started a review of other development and test environments in the company to make sure none of them was open to exploitation. The takeaway here is as accessible as that SQL file: Don't get lax with security simply because an environment is made for testing. Even if the test server was live for only a day, that’s a day where it could be exploited. “The incident completely changed how I look at staging environments. If an environment has access to real data, it needs to be treated as a real security asset — regardless of whether the developers expect it to exist for a day, a week, or six months,” Schut said.®