DigiCert confirms customer data breach following 16-month security lapse

Posted in Commentary with tags on November 9, 2026 by itnerd

Certificate authority DigiCert has disclosed a data breach involving an internal business system that was inadvertently exposed to the internet for more than 16 months following a February 2025 network migration.

The system, previously restricted to VPN access, allowed an unauthorized user to create an account without multifactor authentication and access archived customer information. DigiCert discovered unauthorized accounts on June 18, 2026, but initially dismissed them as harmless because they weren’t assigned to an application.

Although the vulnerability was addressed on July 2, the company didn’t confirm until October 19 that customer records had been accessed between June 27 and July 2. Exposed information included names, business contact details and, for some customers, passports, driver’s licenses and other identity documents. The number of affected customers remains undisclosed.


Seemant Sehgal, Founder & CEO, BreachLock

“A system that was behind a VPN for years and then sat on the open internet for 16 months tells you the migration checklist had no step that asked what else this change exposes. This is how most of these exposures start. No one re-verified reachability after the move, so the control everyone assumed was in place had quietly stopped existing. When unauthorized accounts are dismissed because they weren’t tied to an application, it means the team judged risk by what the account was assigned to rather than what it could reach. That is how an exposure turns into a confirmed records breach four months later.”

ㅤ

John Strand, Owner, Black Hills Information Security

“Whenever I see articles like this, I get uncomfortable with the way information trickles out from the vendor, bit by bit by bit. Sometimes we don’t get a cohesive understanding of what happened until months later. This breach feels like that.

“First, there was a breach, but nothing sensitive was affected. Then, there was a breach, but we took care of it. Now we’re hearing that the exposure lasted more than 16 months.

“That pattern makes me question whether the slow release of information is intentional. I can’t say what the vendor’s intent is, but dribbling out details can bury a story. Something that would have been a very large story if disclosed all at once starts small and grows through updates that attract less attention.

“The story gets old. Writers and reporters end up covering what looks like the same incident again and again, even when the new information materially changes our understanding of it. That concerns me, because this is starting to look like a much larger breach than was initially reported..

“It’s either that, or they are very incompetent.”

ㅤ

Sharon Hagi, CSO, Finite State:

“Certificate authorities are the root of trust for the connected world. Billions of devices rely on them to prove who they are (identity), to authenticate each other (authentication and key exchanage), and to accept only genuine firmware updates (digital signatures). When a CA’s security fails, the damage can reach every system that trusts it.

“DigiCert says certificate issuance was not affected, and that matters. But this was not a sophisticated attack. It was a basic operational failure: a system was exposed for 16 months, accounts could be created without MFA, and confirming the breach took four months. The stolen identity documents are the same ones used to validate certificate holders, which gives attackers material for impersonation and social engineering. The fact that a certificate authority fell short in this case, is the material concern.

“CAs sit at the top of the trust hierarchy. They have to be held to a higher standard than anyone else in ecosystem, and they have to meet it.”

This is way too long to notify humans that you got pwned. And you have to question if people are paying attention. Especialy 16 months later.

Leave a comment »

UK deploys military cyber hunt teams overseas to disrupt hackers before attacks

Posted in Commentary with tags on November 9, 2026 by itnerd

The UK military is deploying specialized cyber teams overseas to identify and disrupt hostile hackers before they can attack British defense networks, according to a new report from The Times.

Major General Mike Fayers, commander of the UK’s Defence Cyber and Electromagnetic Force, revealed that personnel are conducting forward-deployed operations across Europe and Asia with the consent of host nations. The force, comprising more than 700 military and civilian personnel, also searches Ministry of Defence networks for intruders and hidden malware that could be activated during a conflict.

Fayers warned that AI is accelerating cyberattacks, reducing the time available to respond to newly exploited vulnerabilities from days to minutes. The Ministry of Defence reported approximately 90,000 state-linked cyberattacks over the past two years, double the previous period.

Darin Fredde, Senior Director and Offensive Security Evangelist, Ridge Security

“Waiting for an attacker to reach your network before looking for them is becoming an increasingly expensive strategy.

“What interests me about the UK’s approach isn’t simply deploying cyber teams overseas. It’s the recognition that effective defense increasingly requires understanding adversaries, their capabilities, and the paths they may take before an attack reaches its intended target.

“AI may compress attack timelines, but speed alone doesn’t determine the outcome. Visibility, preparation, intelligence, and tested security controls still matter.

“Organizations don’t need military cyber teams to adopt this mindset. They need proactive threat hunting, continuous offensive testing, and the discipline to validate complete attack paths rather than simply count vulnerabilities.

“The objective isn’t to win every game of cat and mouse. It’s to make sure the mouse doesn’t already have the keys to the house.”

ㅤ

Seemant Sehgal, Founder & CEO, BreachLock

“Forward hunting buys defenders time, and that time pays off only for those who already know which of their systems an attacker can reach. Behind the 90,000 attacks the MoD reported, the number that decides outcomes is how many found a path that already existed. When the response window shrinks from days to minutes, any weakness you have not already found and closed will be reached first.”

ㅤ

John Strand, Owner, Black Hills Information Security

“I think this kind of forward thinking from militaries around the world is absolutely essential. It also scares me. Both can be true.

“I’ll be one of the first people to say that militaries need offensive cyber capabilities. Full stop. If the NSA, NRO, CIA and, within its authorities, the FBI aren’t looking at how those capabilities fit into their missions, then what the hell are we paying them for?

“The UK is moving in this direction, and I think that’s necessary because our adversaries are already doing it. It’s disturbing to see countries tie their own hands while their adversaries are willing to do whatever they want. There is no scenario where simply hoping the other side shows restraint works out.

“But we also have to talk about escalation. As with almost any military option, cyber or kinetic, there is a risk that your actions trigger a response and that response drives the next escalation. There are going to be problems, and we need to be honest about them.

“You can hold both things in your head at the same time. You can recognize the danger of escalation and still understand the absolute necessity of having offensive capabilities.”

Maybe the US needs to take a page out of the UK playbook here? Just a thought?

Leave a comment »

“CrackGate” Is Apparently Not Apple’s Fault Says Leaker

Posted in Commentary with tags on November 9, 2026 by itnerd

Those who have been keeping track of the latest Apple controversy known as “CrackGate” (see here, here, here, and here) very much would like to know if Apple ever figured out what the deal is in terms of the cracking screens. Well, apparently they have. According to Chinese leaker Kang, reposted on Twiter/X by Ice Universe, the hinge issues are due to the materials used for a specific component in the hinge.

The bottom line is this:

  • The issue itself has been traced to “defective materials” at one of Apple’s two hinge suppliers. They claim this isn’t an issue with the hinge design, which presumably explains why it hasn’t affected more Duo users.
  • Apple can identify the affected iPhone Duos from their serial number.

Now logic says that Apple should just reach out to anyone with a potential affected serial number and proactively swap the phone to stop images from popping up in places like Twitter/X, Reddit, etc. But Apple won’t go that route because….. Apple. Thus they will likely wait until the screen cracks and the user appears in the Apple Store. That’s a dumb way of doing things in my opinion. But Apple is a trillion dollar company for a reason I guess. The thing is that who knows if this is a widespread issue? Numbers haven’t been shared by Apple and rage online tends to look way worse than it is. So perhaps Apple has the right strategy here? We’ll never know I guess.

Leave a comment »

AI Value Realization Is Driving a New Phase of Cloud Modernization for Canadian Organizations

Posted in Commentary with tags on November 9, 2026 by itnerd

CDW Canada today released its 2026 State of Digital Infrastructure and AI in Canada Report, with research insights by IDC, exploring how Canadian organizations are managing hybrid infrastructure and AI solutions while navigating the shift to digital sovereignty. The study, conducted and analyzed independently by IDC Canada, surveyed 700 senior business leaders at small, medium-sized and large organizations across industries and provinces in Canada.

The report found that Canadian organizations are entering a new phase of AI maturity, where success will be determined less by access to technology and more by the ability to operationalize it. That shift is reshaping cloud priorities as organizations modernize applications, strengthen data foundations and adopt flexible hybrid infrastructure to support AI while maintaining greater control over where data lives and how it is used.

AI value realization is accelerating cloud modernization

AI adoption is already well established among Canadian organizations, with 77 percent using copilots or conversational AI, 60 percent using generative AI and 31 percent testing agentic AI. Most organizations are also choosing to buy or customize rather than build from scratch, with 85 percent purchasing or adapting AI solutions instead of developing their own models.

As adoption matures, organizations are turning their attention to realizing value from these investments and are creating the environments needed to run AI at scale. That is putting greater pressure on the technology and data foundations that support AI. Nearly two-thirds (64 percent) say AI has led them to modernize applications and infrastructure in the cloud, while 59 percent say it has accelerated cloud adoption. Scalability is the top data architecture improvement required to support AI, cited by 63 percent of respondents.

Hybrid cloud becomes the foundation for AI at scale

As organizations modernize their cloud environments, hybrid cloud is emerging as the preferred operating model. Nearly two-in-three (63 percent) Canadian organizations prefer a hybrid approach, giving them the flexibility to place AI and other business-critical workloads where performance, cost, security and compliance requirements best align.

The appeal of hybrid cloud is particularly strong among medium-sized and small organizations, where simplicity and cost control can outweigh the benefits of operating across multiple public cloud providers. Large organizations are more likely to use multicloud environments to access differentiated capabilities, while smaller organizations often use hybrid strategies to keep predictable workloads in lower-cost environments. For mid-sized organizations in particular, a manageable hybrid environment can provide the flexibility to support new AI workloads without introducing unnecessary cost and complexity.

Managing multiple environments is the next challenge for Canadian organizations. Real-time management and monitoring (63 percent), AI and GenAI automation (51 percent) and cloud orchestration (36 percent) are the top areas for increased investment. While hybrid can offer a simpler path than multicloud for smaller organizations, operational complexity remains a challenge. Smaller organizations are more inclined to manage each cloud environment using its native tools rather than a unified management layer. While simpler to implement initially, this approach can fragment visibility and operations across the cloud estate, with downstream implications for automation maturity.

The operational challenge extends to resilience and security. Over half (57 percent) of organizations now describe their infrastructure as sufficiently or exceptionally resilient, up from 48 percent in 2024. Cybersecurity remains the top concern (62 percent) and the leading priority for futureproofing (69 percent).

Trusted data is critical to AI value

As organizations put AI to work across more of the business, the quality, security and accessibility of their data become increasingly important. More than half of organizations have standardized data management on cloud or dedicated platforms, particularly for integration, governance and privacy.

However, significant gaps remain. More than half (55 percent) say their data management capabilities need improvement, with data security (56 percent) and data fragmentation (54 percent) cited as the leading challenges. Looking ahead, organizations are prioritizing data privacy (49 percent), security (48 percent) and quality (35 percent).

Modern cloud strategies balance scale and sovereignty

Canadian organizations increasingly view digital sovereignty as a matter of governance, trust and business resilience. Nearly three quarters (72 percent) are already on the path to sovereign cloud adoption. More than one quarter have moved beyond the planning stage, with 10 percent using sovereign cloud extensively and 16 percent deploying it for select workloads. The remainder are either piloting sovereign cloud solutions or have plans for implementation within the next 12 months.

Evolving privacy regulations and growing expectations around data governance are driving the change. Quebec’s Law 25 has set a higher bar for how organizations manage and transfer personal information. At the same time, a growing range of Canadian cloud offerings are giving organizations real options. Among large organizations, 27 percent already use Canadian cloud providers and another 24 percent plan to make the shift within the year.

Rather than applying one standard, Canadian organizations are matching the level of protection to each workload. Most prefer to stay on major global cloud platforms and add their own sovereign controls, such as keeping data in Canada, holding their own encryption keys and setting clear policies on who can access their data and under what conditions. Of respondents, 34 percent have already taken this approach, which keeps the scale and features of global providers.

As AI moves from early adoption toward enterprise-wide deployment, the measure of success will increasingly shift from how much AI organizations adopt to the value they generate from it. Canadian organizations that combine trusted data, strong governance and flexible hybrid infrastructure will be best positioned to turn AI investment into measurable business outcomes. To read the full report, visit http://www.cdw.ca/cloudreport.

Leave a comment »

Nearly Nine in Ten Businesses Cannot Leave Their Largest Cloud or Infrastructure Provider Within Three Weeks, Leaseweb Research Finds

Posted in Commentary with tags on November 9, 2026 by itnerd

Nearly nine in ten (89%) businesses could not migrate business-critical workloads away from their largest cloud or infrastructure provider within three weeks, despite most believing they have control over their data, according to new research from Leaseweb, a global cloud services and Infrastructure as a Service (IaaS) provider.

The Leaseweb Digital Independence Survey 2026, conducted among 800 C-suite leaders in the UK, US, Germany and the Netherlands, found that only 11% of organizations could make the move within this timeframe. More than half (55%) said it would take longer than three months, or was not currently possible.

The Netherlands recorded the highest proportion of businesses expecting migration to take more than three months (65%), followed by the UK (59%), US (55%) and Germany (40%). Dutch businesses also gave the longest average estimated migration time, at 4.7 months.

AI Set to Increase Cloud Provider Lock-In

The challenge for many businesses is that this dependence is expected to grow even further as AI adoption increases. Overall, more than three-quarters (79%) of business leaders expect AI to increase their reliance on a small number of providers over the next three years (89% in the US, 83% in the UK, 76% in Germany, and 67% in the Netherlands).

Geopolitical pressures are also prompting changes to infrastructure strategies. Over three-quarters (78%) have taken action to reduce reliance on a particular technology or infrastructure provider in response to geopolitical challenges, including 91% in the US and 87% in the UK, while 45% of respondents overall plan to take this even further.

Businesses are also placing a clear financial value on independence. Almost all respondents would pay more to gain greater control, reduce provider dependence, or improve their freedom to move, and 73% would pay at least 11% more, with an average premium of approximately 16%. Willingness to pay was highest in the Netherlands, where 81% would pay at least 11% more and 26% would pay at least 21% more, followed by Germany with 79% willing to pay at least 11% more.

“Digital independence comes down to having real choices, and our research shows many businesses have fewer than they think,” said Lex Boost, co-CEO at Leaseweb. “Organizations may believe they control their data, but once applications have been built around a provider’s platform, moving them is rarely quick or simple. With AI expected to tie businesses even more closely to a small number of providers, leaders need to understand and act on those dependencies now, not when a pricing change or geopolitical shift forces their hand.”

Additional findings include:

  • 76% reported complete or high control over their ability to move data to another provider or environment, yet only 11% could migrate business-critical workloads from their largest provider within three weeks.
  • Fewer than three in ten treat regulatory and legal compliance (28%) or security and data protection (28%) as non-negotiable when choosing a cloud provider, and two-thirds (67%) would accept at least a minor trade-off on compliance.
  • AI-related technology and provider dependence was the most frequently selected potential barrier to digital independence overall (28%), although in Germany legacy-system complexity ranked first (30%).
  • The leading non-negotiable considerations when choosing a cloud provider were availability and uptime in the US (35%), provider reputation and trust in the UK (34%), security and data protection in Germany (30%), while regulatory and legal compliance and exposure to geopolitical or trade-related risks were tied in the Netherlands (both 27%).

Methodology

Research conducted by Censuswide among 800 C-suite leaders at organizations with 500 to 5,000 employees, with 200 respondents each in the UK, US, Germany and the Netherlands between September 22-30, 2026.

Leave a comment »

Where wearable interest is booming worldwide

Posted in Commentary with tags on November 9, 2026 by itnerd

Australia has the world’s biggest appetite for smartwatches and fitness trackers—narrowly ahead of Japan—according to a new analysis by Wareable based on 12 months of Google search data across 101 countries

Apple dominates brand interest worldwide, accounting for 76.3% of brand searches and ranking first in all 101 countries. Meanwhile, Garmin out-searches Samsung in the US, UK, and Australia, among others.

You can read the study here: Study: Where wearable interest is booming worldwide | Wareable

Leave a comment »

Park Place Technologies to Showcase Global AI and HPC Infrastructure Services at SC26

Posted in Commentary with tags on November 9, 2026 by itnerd

Park Place Technologies will showcase solutions designed to help organizations scale AI and high-performance computing (HPC) infrastructure more efficiently at SC26, The International Conference for High Performance Computing, Networking, Storage, and Analysis, November 15-20 at McCormick Place in Chicago.

Visitors to booth #5301 will see how Park Place Technologies is helping OEMs, ODMs, AI cloud providers, and enterprises deploy, operate, and extend service capabilities globally. With a global engineering and logistics footprint, Park Place provides the field execution behind complex AI and HPC environments, including GPU infrastructure deployment and maintenance, liquid cooling support, RMA and logistics infrastructure managed services, and full lifecycle services.

Attendees can learn how Park Place can support their data center infrastructure in two booths:

  • Booth #5301 for global site readiness, deployment, full lifecycle support and Infrastructure Managed Services to maximize uptime.
  • Booth #4044 to explore AI GPU server maintenance and liquid cooling solutions in collaboration with Green Revolution Cooling.

SC26 is the premier annual gathering of the high-performance computing community, bringing together thousands of attendees from industry, academia, government and research organizations. This year’s conference, themed HPC Unites, features a technical program of keynotes, papers, panels, tutorials and workshops alongside an exhibit floor showcasing the latest in HPC, networking, storage and analysis.

Leave a comment »

Rillet Expands into the UK: New London Office Follows Surging European Demand

Posted in Commentary with tags on November 9, 2026 by itnerd

Rillet today announced its expansion into the UK, with a new office in central London and its UK team already on the ground. European demand already drives 10% of Rillet’s net new ARR with customers in the UK and across Europe, including some of the fastest-growing AI companies like Black Forest Labs, Temporal, and Primer.

The expansion comes less than three months after Rillet raised a $100 million Series C at a $1 billion valuation led by ICONIQ, with participation from Sequoia and Andreessen Horowitz. Rillet now serves nearly 1,000 customers across 75 countries, including publicly listed enterprises and some of the fastest-growing companies globally. Rillet’s international net new ARR more than tripled month over month, reflecting accelerating demand beyond US borders.

UK companies were choosing Rillet long before it had a local presence, driving the company’s decision to expand into Europe. Europe is home to some of the world’s most ambitious companies, yet many of their finance teams still close the books on legacy systems.

Rillet is building a large-scale organization in London, with its founding UK team already in place and significant hiring planned in the months ahead. Rillet has a track record of attracting top talent, and this month, LinkedIn named it on its 2026 Top Startups list of 50 U.S. companies, a signal that UK and European finance teams are in good hands. The goal is to give finance teams in the UK and across Europe a team that is close by, invested in their success, and there for the long term.

For UK and European finance leaders, Rillet’s expansion comes at a critical time. As companies scale and move upmarket, finance teams face increasing pressure to scale efficiently, embrace AI, and build systems that can keep pace with the business. Rillet aims to help them navigate that complexity with a robust agentic platform and a dedicated team on the ground. Beyond technology, Rillet is bringing its Close Club community to Europe, which already connects over 1,500 finance leaders in the US, creating a space for CFOs to exchange ideas, share experiences, and learn from peers facing similar challenges.

London is a natural starting point for Rillet’s European expansion. As one of the world’s leading financial hubs, the city brings together a deep pool of finance and accounting talent, an established professional services ecosystem, and some of Europe’s fastest-growing and most innovative companies. The move also marks a return to familiar ground for Kopp, who studied accounting at the London School of Economics and spent several years working in the City.

Rillet is well positioned to tap into this ecosystem having built its category alongside the accounting firms that audit and advise the world’s largest companies, and many of those firms have established practices across the UK and Europe. Rillet’s ecosystem includes an alliance with EY, a strategic alliance with RSM, and partnerships with more than half of the Accounting Today top 20 CPA firms. Those relationships give Rillet a foundation to build local credibility, expand its network, and accelerate momentum across EMEA.

Leave a comment »

OpenAI unveils GPT-6 Cyber with new safety safeguards

Posted in Commentary with tags on November 6, 2026 by itnerd

OpenAI has introduced GPT-6 Cyber, a cybersecurity-focused AI model designed to discover vulnerabilities, develop working exploits and help security teams patch weaknesses. OpenAI reports that the model identified 81 previously unknown high-severity vulnerabilities in Firefox and developed working exploits for 948 Linux kernel vulnerabilities.

The model achieved a 48.5% success rate on OpenAI’s ExploitGym benchmark, compared with 32.1% for GPT-5.6 Cyber. OpenAI also introduced stronger safeguards intended to prevent unauthorized exploitation. In internal evaluations, GPT-6 Cyber remained within its assigned boundaries in 99.93% of tests without additional deployment safety instructions and 100% with them.

OpenAI has classified the model as Critical in cybersecurity under its Preparedness Framework. Initially available to a limited group of approved researchers through its Daybreak Red program, GPT-6 Cyber includes additional monitoring, identity verification and safeguards for high-risk activities involving critical infrastructure. The launch raises questions about how organizations can safely deploy increasingly capable autonomous security tools while ensuring defenders have access to them.

Daniel Park, Senior Marketing Executive, BreachLock

“A 99.93% boundary compliance rate sounds reassuring until you ask what the 0.07% looks like when the model is holding a working privilege-escalation exploit. In a test harness, that’s a rounding error. But on a production network, it’s an unauthorized action by something that can chain exploits faster than anyone can review them. The first real measure of those safeguards will come from what the model does when a live environment pushes back.”

ㅤ

Darin Fredde, Senior Director and Offensive Security Evangelist, Ridge Security

“An AI agent capable of developing working exploits shouldn’t also get to write its own permission slip. GPT-6 Cyber represents meaningful progress in offensive security, and I understand OpenAI’s decision to limit initial distribution. These capabilities deserve responsible oversight. But restricting access cannot become a substitute for proving the technology operates safely. We also need to consider who gets access. If the most capable security tools remain available only to a select few, we risk leaving smaller organizations and independent defenders behind. The answer is neither unrestricted access nor indefinite gatekeeping. Its responsible expansion supported by enforceable rules of engagement, independent validation, and technical controls that limit what these agents can do. The real breakthrough won’t be deciding who gets the keys. It will be proving the brakes work, regardless of who’s driving.”

Frankly, OpenAI can’t be trusted. At least not with me. So I would be wary of running this model as it may go rogue just like every other OpenAI model.

Leave a comment »

Researchers identify 1,465 exposed AI-powered hacking frameworks

Posted in Commentary with tags on November 6, 2026 by itnerd

New research from Censys has identified 1,465 internet-exposed instances of ARTEX, an AI-powered autonomous penetration testing framework previously linked to cyberattacks against South Korean financial institutions and a China-linked campaign targeting ConnectWise customers.

In a separate November 5 warning, CERT-EU reported observing multiple threat actors using ARTEX to automate cyberattacks and assessed that similar activity targeting EU institutions highly likely involved the framework. The agency warned that ARTEX could enable faster, more frequent and scalable attacks, noting that its operating boundaries rely on configurable rules and AI model behavior rather than hard technical enforcement.

Censys found that 155 exposed instances (10.6%) were hosted alongside other offensive security tools or threats, including Cobalt Strike and Vshell. Researchers also discovered 32 publicly accessible directories containing exploitation tools, malware implants and post-exploitation utilities. Approximately 650 hosts shared nearly identical configurations.

CERT-EU urged organizations to restrict internet-facing management interfaces, monitor privileged accounts, strengthen authentication and address even minor misconfigurations that automated tools could combine into more serious attacks.

The original ARTEX repository was withdrawn in October, but independent forks remain publicly available.

Daniel Park, Senior Marketing Executive, BreachLock

“Microsoft documenting privileged cloud access in under three hours shows that the human-paced assumptions behind most defensive programs have already broken. Censys found roughly 650 exposed hosts with nearly identical configurations, which means this tooling is being deployed from a template by operators who need very little skill of their own. Any tenant with an open path to privileged access is now on a timeline measured in hours, and a remediation cycle measured in weeks will lose that race.”

ㅤ

Corey Ham, COO, Black Hills Information Security

“There’s no honor among cyber criminals. They don’t just go after corporations, they go after each other. ARTEX is an ideal target for a supply chain attack: If it succeeds, you compromise another hacker and pillage whatever they have gathered from their victims. If anyone happens to using ARTEX for legitimate purposes, compromising them is even better, as they likely have corporate resources backing them up. I suspect the attackers main goal was to obtain AI API keys they can use to fuel more attacks. As good as tools like ARTEX are, they are not cheap to run, because of their token use. This creates an unexpected financial burden on threat actors: they have to monetize their campaigns early on, to make up for the cost of running these tools.

“We’ve seen threat actors using tools like https://github.com/Wei-Shaw/sub2api to cheaply combine AI subscription services like Claude and Codex, since these subscriptions are much cheaper than API billing, and spreading this activity across multiple accounts makes it harder to detect for providers like Anthropic and OpenAI. I also assume that many of the accounts being used with sub2api are compromised and stolen accounts. Earlier this year, we saw Anthropic proactively notifying people who had Claude accounts compromised by infostealers.”

ㅤ

Darin Fredde, Senior Director and Offensive Security Evangelist, Ridge Security

“ARTEX didn’t invent the attack chain. It just took the coffee breaks out of it. What concerns me isn’t simply how many ARTEX instances Censys discovered. Not every deployment is malicious. It’s what we’re seeing in documented attacks, where automation combines reconnaissance, exploitation, and abuse of trusted relationships at speeds that leave defenders precious little time to respond. Attackers have always combined weaknesses to achieve their objectives. Agentic AI can accelerate that process without necessarily introducing new techniques. Our response shouldn’t be to panic over another AI framework. We need proven countermeasures, strong identity and access controls, and continuous offensive testing that challenges trust boundaries, business logic, and complete attack paths. The real question isn’t how quickly an AI agent can find a weakness. It’s whether our security controls can stop what happens next.”

ㅤ

Ryan McCurdy, Vice President of Marketing, Liquibase

“What’s concerning about ARTEX isn’t just how widely available these tools are. It’s how quickly they can operate. Attackers can now automate reconnaissance, test permissions, and move through systems at a speed that gives security teams very little time to respond.

“For databases, that creates another challenge. An attacker with valid credentials doesn’t necessarily need to exploit a vulnerability to make a damaging change. They may already have the permissions needed to execute it.

“Companies have spent years strengthening access controls and vulnerability detection but organizations also need to limit unnecessary privileges, monitor unexpected database activity, and enforce policies around changes before they reach production.

“AI is accelerating the attack lifecycle. The controls protecting critical systems need to account for that speed.”

This is bad as it is a safe bet that the bad guys are using tools like this to go after any organization that is not prepared for this sort of thing. So you need to choose which organization that you are.

Leave a comment »

« Older Entries
Newer Entries »