Kategorie

In recent months, hints emerged concerning Apple’s plans to introduce camera-equipped AirPods Pro; the cameras would be designed to pick up details of your ambient surroundings and feed information to Siri to help you with your life. 

At one point, we heard the product had been pulled citing privacy concerns. But that doesn’t seem to be the case, as the latest seemingly orchestrated Apple “leak” offers up a short video to explain how these things are going to work.

The privacy reset

First spotted by MacRumors (is Mark Gurman on vacation?), the short clip was unearthed from within the macOS 26.7 Release Candidate. 

The demo shows a man holding up a book so the camera in the AirPods can see the title. A voiceover says, “With Visual Intelligence, your world becomes saveable.” It continues, “See something you like? Just ask me to save it for later.”

While you could be forgiven for thinking this is a reference to salvation, the task at hand is much more mundane, with the cameras used to search for a book called Could Should Might Don’t, How we Think About the Future by futurist Nick Foster. There’s probably a message in that choice, given that the inherent tech at play here consists of cameras that are always on. Perhaps we need to think different about putting our lives on tape?

What Apple’s promise seems to be

While nothing has been announced, Apple seems to have designed the tech so that it doesn’t record or save ambient video without consent. That means the data is (probably) processed on your iPhone, rather than in the cloud, likely in real time — with no saving unless you expressly request it. Apple hasn’t announced the product, so we have no insight yet into how this works technically.

But what it suggests is that the camera is designed to feed its data to Visual Intelligence, which lets Siri pick up information about your environment so it can answer questions such as: “Where is my local CCTV camera?” or “Is that person wearing camera-equipped glasses over there filming my kids without permission?” I doubt Siri will have answers to those questions.

Inherently, though, Apple’s promise seems to be that while the AirPods cameras are always rolling, the information is interrogated, rather than saved, so no real data is retained. You just gain access to Visual Intelligence for ambient AI. That’s a promise that, on the face of it, seems to marry privacy with convenience to some extent.

How will this be put to the test?

Apple’s historical commitment to privacy has led the industry. It has quite literally fought to protect customer privacy even as other big firms folded. Sadly, we can no longer be completely certain of the extent to which the company still protects our privacy in an era dominated by unannounced decisions taken by secret courts. 

We also know AI is being used to poke holes in platform security at an incredibly rapid pace. In recent weeks, we learned Apple is being inundated with vulnerability reports. And while many of these are repetitions of the same thing, or not precisely what they seem to be, the company has had to look at them. This has led to a rash of security patches and resource allocation challenges. (It’s even worse for other platforms, by the way.)

Of course, the big secret behind this is that at least some of these now-fixed vulnerabilities will have been actively used by military intelligence. And as those insecurities are found and eradicated by AI, security services will become more insistent that OS makers build in tools for surveillance. We’ll see how this shapes up. 

What we can easily predict is that whatever security protection Apple builds inside of its camera-equipped AirPods will quickly be put to the test.

Inside the enterprise

The fact that these things will be tested means enterprise IT will need to engage in close scrutiny of the protections Apple puts in place. You do not want confidential documents, blueprints, or other printed records photographed by cameras stuffed in someone’s ears; IT will likely put constraints on these things at work or in highly confidential settings, such as hospitals.

Finally, I’m fairly convinced this leak represents a company looking to reset privacy expectations on its platforms. The introduction of the friendly and fluffy face of video AirPods in the video should help Apple familiarize its customers with the concepts and workings of these devices. Apple has time to move slowly on this, and its leadership likely already knows that spy cameras in your ears will not be an easy sell to all of its customers. 

Nevertheless, it’s a sell it has to make, in part because future Apple glasses will require this – and because building trust and familiarity with this kind of intrusive tech will also be necessary for other product categories. (Apple insiders whisper the company wants to get into robotics, automation, or even transportation. 

Apple isn’t alone in needing to dance between privacy expectation and product realization, hence the need for a reset. I don’t like it, by the way, but this appears to be the direction of travel. Good luck in tech dystopia, and don’t forget to subscribe to my newsletter for news and analysis. 

You can follow me on social media! Join me on BlueSky, LinkedIn, Mastodon and subscribe to The Core.

Microsoft has started testing a faster File Explorer and a less cluttered and more customizable context menu in Windows 11 preview builds rolling out to Insiders this week. [...]

Security researchers are warning of a newly uncovered Python malware framework that routes much of its command-and-control (C2) activity through Microsoft services that defenders already expect to see.

The Ontinue Cyber Defense Center discovered the implant while investigating an active campaign in July and has since tracked it as TWINLOOT. It was seen using SharePoint Online as a file-based dead drop, Microsoft Teams’ TURN infrastructure for interactive communications, and a headless instance of the victim’s own Edge browser to send Microsoft Graph API requests.

Its primary C2 traffic can terminate in Microsoft IP space rather than an attacker-controlled domain, Ontinue researchers said in a report shared with CSO ahead of its publication Tuesday.

“TWINLOOT works because defenders have been trained to treat Microsoft traffic as safe by default, and this malware was built to take full advantage of that,” said Shane Barney, chief information security officer at Keeper Security. “There is no attacker-owned domain in the chain, which means the traffic looks exactly like what it is supposed to look like, and most detection tools will leave it alone.”

Microsoft did not immediately respond to CSO’s request for comment.

Malware lives inside the trust boundary

TWINLOOT’s architecture separates routine tasking from “interactive” access. Its SharePoint channel polls a drive roughly every 15 seconds for commands, returning results and exfiltrating stolen credentials and reconnaissance data.

According to Ontinue, the implant authenticates to an attacker-controlled Azure tenant rather than the victim’s Microsoft 365 environment, producing no authentication or audit events in the victim’s Entra ID logs.

For interactive access, the malware can establish a reverse SOCKS5 tunnel and route it through Microsoft’s Teams TURN infrastructure. The operator can then use the compromised endpoint to access the internal network, with connections to services such as SMB, RDP, and WinRM appearing to originate from the victim machine.

TWINLOOT is only the second observed case of in-the-wild Teams TURN abuse, and Ontinue says it is the first to use actual WebRTC DataChannels for the technique.

The pathway is different from Edge transport. The implant launches Microsoft Edge in headless mode, attaches through the Chrome DevTools Protocol, and issues Graph API calls as “same-origin fetch ()” requests from within the browser. From network telemetry, it looks like a legitimate Edge process communicating with Microsoft, the researchers said.

Commenting on the detection complications TWINLOOT adds, Robert Coles, senior manager of threat intelligence security at Black Duck, said, “Attackers are increasingly hiding inside trusted cloud services rather than using attacker-controlled infrastructure.” He recommended focusing on behavioral detection, identity monitoring, and anomaly detection, including unusual Graph API activity, OAuth applications and consent grants, and anomalous SharePoint and Teams behavior.

Stealing credentials and persisting without admin rights

On command, TWINLOOT displays a Windows 10 or Windows 11 lock screen populated with the victim’s real account information. It never validates the password. Instead, every password attempt is captured, encrypted, and sent to the SharePoint C2 channel. The victim receives a normal-looking incorrect password message before eventually authenticating the login.

The stolen credentials can enable lateral movement through the reverse SOCKS tunnel, potentially allowing RDP, SMB, or WinRM access to other systems.

The implant also contains a persistence technique that Ontinue calls “Corrupting the Hive Mind.” It creates a Windows “NTUSER.MAN” mandatory-profile hive offline, requiring no administrator privileges and generating no registry modification event.

This is the first time the technique is ever used in the wild, Ontinue said. Defenders were advised to focus on anomalous SharePoint, Teams, and Graph activity rather than malware signatures alone. Ontinue also recommended disabling Edge headless mode, monitoring unusual Python activity, resetting exposed credentials, and using phishing-resistant authentication.

The article originally appeared on CSO.

Vibe coding is a top security threat to enterprises and could leak data into the public sphere, analysts and executives are saying.

“The number one risk at the minute is hard-coded secrets being uploaded through vibe-coded applications to GitHub, and then providing a route in,” said Pete Shoard, chief of research for cybersecurity at Gartner.

The term “vibe coding” was coined by Andrej Karpathy as a way to describe how developers can now create applications by chatting with generative AI (genAI) tools and services. AI can quickly generate code to create a program, a dramatic change from the typical manual development process.

Not surprisingly, vibe coding became the latest rage in the developer community almost immediately.

Enterprises have been rushing to upskill employees to take advantage of the technology by encouraging non-tech employees to vibe-code applications. Companies have seen the benefits, including faster application development and quick creation of prototypes or mockups of final products. 

“Vibe coding makes writing apps more accessible to teams that don’t have developer or security experience, which expands the enterprise attack surface,” said Erik Nost, senior security analyst at Forrester Research.

Software companies aren’t necessarily “vibe coding” software patches, but they are able to leverage AI tools to help accelerate writing them, Nost said.  

“The most common motivation theme for vibe coding — 62% — is speed & efficiency, with vibe coders highlighting rapid development,” researchers from Massey University and the University of Auckland wrote in a research study published last month. 

AI coding tools produce working software in hours instead of weeks. But the rapidly advancing coding processes often neglect code reviews or security checks, raising the risk of undetected vulnerabilities.

“Others emphasized that while the outputs might appear clean and functional, they could conceal subtle logic errors, performance bottlenecks, or serious security flaws that only become apparent later,” the researchers wrote.

AI tools can hallucinate with poor prompting, and the same can happen with vibe coding. That’s why significant audit tools are required to verify and validate the results, said academic researchers from the US and UK in a June 30 paper published by the Association for Computing Machinery.

Employees who turn to vibe coding can quickly spin up hundreds of applications, but those efforts can also create problems, according to Gartner’s Shoard. “Not all of them will be scanned,” he said. “There will be no commonality. It’s not a patch that everyone can install.”

The big danger is that sensitive information or intellectual property can leak, Shoard said.

For example, vibe-coding tools could in many cases sync data files with public repositories like GitHub, unintentionally uploading internal corporate files to the internet.

The current vibe-coding hype has “done AI a massive disservice,” said Frank Erickson of 28Stone, a consulting firm that develops software for the capital markets. “There’s a huge difference between vibe coding and enterprise software development, and some of the loudest, most aggressive proponents of AI are a bit too latched onto the concept,” he said.

AI might be changing the nature of a variety of jobs, especially for developers, but vibe coding can’t scale — and it can’t outright replace enterprise software development. “I get pretty perturbed when our people internally refer to AI tooling as vibe coding. If they think that’s what they’re doing, they’re misunderstood,” Erickson said.

Vibe coding, while potentially good for software prototyping, should be governed by guidelines and development principles, researchers said. That would include heavy auditing to address hallucinations and security risks, as well as skilled prompts to provide better context, the US and UK researchers wrote.

“AI functions primarily as an assistant…, providing localized code suggestions and learning support while leaving overall direction, integration, and validation to the human developer,” they said.

Beyond automated security auditing, governance should include “continuous technical debt monitoring,” Indonesian researchers said in a research paper published last month. 

The researchers proposed a vibe-coding framework that includes inspecting, interpreting, and validating AI-generated code as part of the typical software development lifecycle. This foundation “provides for developing risk-based governance policies that can guide … in adopting AI-assisted programming responsibly,” the researchers wrote.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that ransomware gangs are also exploiting a high-severity Windows Task Host vulnerability that was flagged as actively exploited in April. [...]

Microsoft says some users are experiencing issues searching in Microsoft 365 apps, including Outlook on the web, Outlook desktop, SharePoint Online, and OneDrive. [...]

SafePal has disclosed that an authorization flaw in an order-tracking plug-in exposed the names, email addresses, shipping addresses, phone numbers, and purchase details of approximately 39,798 customers. The hardware wallet maker said all affected customers were notified individually by email on August 16 from [email protected], with the subject line "[Important] Your SafePal Order Swati Khandelwalhttp://www.blogger.com/profile/[email protected]

Microsoft announced that it removed the Windows Management Instrumentation Command-line (WMIC) tool from Windows 11 24H2 and 25H2, as well as from Windows 11 beta builds released this week. [...]

GitHub has restored services after a nearly eight-hour outage disrupted several of its core developer tools, including Actions, pull requests, APIs, Git operations, Webhooks, and Copilot, impacting software development workflows across its platform.

“This incident has been resolved. Thank you for your patience and understanding as we addressed this issue,” the company wrote on its status page.

The disruption was first reported at 1:40 PM UTC on August 17, with GitHub initially flagging degraded performance across parts of its platform. Within minutes, the disruption had spread to API Requests, Actions, Webhooks, Issues, and pull requests (PRs).

At the height of the incident, GitHub reported an error rate of about 20% across its web experience and API traffic. Archive downloads and raw repository content downloads were seeing an error rate of approximately 50%, while SAML and OIDC authentication, SCIM, and Team Sync were also affected.

GitHub’s AI coding assistant, Copilot, also experienced degraded availability beginning at 2:31 PM UTC. The company later said that some Copilot authentication problems persisted even after other parts of the platform had recovered.

Recovery was not linear

Finally, at 4:36 PM UTC, the company said that it had identified the problematic component and had taken corrective actions.

However, the recovery of services was not linear.

Git Operations experienced another period of degraded performance, while API Requests briefly returned to a degraded state. GitHub subsequently said it had mitigated the Git Operations issue and restored normal API operation by 7:01 PM UTC.

Still, other services remained affected with problems centered largely on authentication. GitHub said it had partially disabled authentication-token retries after observing sporadic authentication failures and later reported that Copilot authentication issues were still affecting some applications.

“We are continuing to investigate sporadic authentication failures. We have partially disabled authentication token retries and have seen improvement, and we are monitoring impact before fully applying this mitigation,” the company wrote.

It finally fixed these issues at 8:45 PM UTC and marked the incident resolved at 9:15 PM UTC, nearly 8 hours after it was first reported.

Downtime significant for enterprise teams

While the incident didn’t amount to a complete shutdown of GitHub, the number and nature of services impacted are significant for enterprise development teams as the company increasingly serves as more than a repository for source code.

Development teams use its APIs, Actions workflows, PRs, and integrations as connected parts of their software delivery processes, and a disruption to several of those components simultaneously can therefore affect workflows even when basic repository access remains available.

GitHub has yet to identify the “problematic component” that caused the failure or why its failure took out so many services together.

Until the company’s post-incident analysis is available, it is unclear whether the outage was caused by an infrastructure failure, a software change, an authentication problem, or another issue like an attack.

For now, GitHub’s status page says that a “detailed root cause analysis will be shared as soon as it is available.”

The article originally appeared on InfoWorld.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a critical flaw impacting Ray to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. Ray is an open-source, Python-native distributed computing framework designed to scale artificial intelligence and machine learning workloads. As of writing, the GitHub project has more than Ravie Lakshmananhttp://www.blogger.com/profile/[email protected]

The good news is that large language model (LLM) token costs are coming down. The conundrum: The overall cost of AI workloads is going up.

Gartner research predicts that, while token costs will fall by 95% by 2030, inference costs for agentic workflows will increase more than fivefold over the next two years. This is because AI app builders are using more, and often more expensive, tokens as LLMs get ever more complex. It is what Gartner calls the “inference paradox.”

In other words, “the rate of innovation is outpacing the cost curve,” Gartner analysts Will Sommer and Sabine Zimmerhansl noted in their report. “The market is captured by a token-deflation illusion.” Buyers dangerously assume that as AI providers improve token economics, these savings will be reflected in their roadmaps. But, simply put, “they will not.”

‘Swarms’ of agents eating up tokens

There is no doubt that AI delivers massive value, and is often better, and faster, than people at many routine tasks, the analysts pointed out. Agents can also more quickly identify patterns across siloed systems. For instance, Gartner has seen customer success agents reduce response times by 99%.

But as AI evolves, token usage increases, and token value is variable, Sommer and Zimmerhansl noted. Advanced AI agents that can reason already cost up to 150x more on a single task than basic AI chatbots.

A simple chatbot must read and interpret a request and quickly deliver a “probabilistically reasonable” answer, but agents, as they become more sophisticated, must think, question, and adapt when something goes wrong, and they increasingly run continuously, and often invisibly, in the background.

“They need to be able to validate their results for accuracy without necessarily having a human in the loop,” the analysts wrote. “They need to talk to other agents.”

All of this demands more resources, and token consumption increases exponentially as “swarms” of increasingly autonomous agents trigger and call each other. This incurs a “massive inference tax” before a user even gets their result, they noted.

The hardware costs to train medium-sized agentic models with advanced reasoning capabilities is 2.5x greater than training simple, similarly-sized chatbots, they reported. Further, agent inference costs are 5x greater, and agents require 5x to 30x more tokens than a chatbot to handle equivalent tasks.

“Now consider how costs will balloon when running hundreds of agents that can perform dozens or hundreds of tasks each hour,” the analysts said. Costs continue to skyrocket as agents break many problems into several small tasks, call higher-order models, and require multimodal data.

“The volume of compute required for these capabilities is mind-bending,” the analysts noted.

To analyze the impacts of agentic systems, Gartner built a Tokenomics Model based on various scenarios of training and inference. These included various designs (number of layers, LLM-as-a-judge or as mixture-of-experts), technology improvements, hardware specifications, and various other cost considerations (data, infrastructure, energy, labor).

The firm ran 12 types of AI model with various capabilities, and found that basic workflows cost around $0.05 per inference token; summarization and knowledge retrieval cost roughly $0.10; more complex workflows cost around $0.30; and planning and learning cost roughly $0.40 per token. This means provider cost per token for planning and learning tasks is 8x to 10x that of basic workflows.

“Costs will inevitably escalate, and as they do, there is no guarantee that value will grow commensurately,” Sommer and Zimmerhansl contended. “ROI from each new generation of technology will be hard-earned.”

Being economical in the age of AI

Enterprises can be diligent and keep token costs in check by developing and maintaining complex multimodal systems, Gartner said. They will also need ways to measure ROI and improvement across completed workflows.

Orchestration will be the differentiator, and “inference tiering” will improve cost and performance, so enterprises should develop systems that route queries to the most cost‐efficient model and block agents from invoking frontier models by default for simpler tasks, Gartner advised. Adopting usage-based pricing is another important step; move from flat compute fees to tiered plans that scale based on need.

Enterprises can consider mandating continuous refresh cycles, Sommer and Zimmerhansl added. “Treat each model release like a ‘new car’ losing value on day one,” they wrote, and build in data fine-tuning and self-learning feedback loops.

Builders should also set minimum standards for AI execution: Define success thresholds and risk mitigation and compliance overhead up front. “Refuse to greenlight deployments until scenarios are stress-tested against token-price swings and compliance expenses,” the analysts emphasized.

Further, Gartner also advises embedding value-per-outcome into product planning. This could mean requiring every AI feature to forecast and track its spend against a “clear outcome metric,” such as tasks automated or cases successfully closed. This can help identify the low-performing workflows that require improvement or deprecation.

Still, ROI is “eminently possible,” but it requires significant effort across complex workflows, the analysts noted; enterprises can’t simply rely on traditional systems and workflows. “Defaulting to generic autonomous intelligence will result in unbounded costs orders of magnitude higher than those of optimized product ecosystems,” they pointed out.

OpenAI president Greg Brockman on Sunday warned enterprise CISOs that they need to more aggressively embrace agents if they want to survive upcoming cyberattacks. 

Brockman said in a blog post that it has become “increasingly clear” that company systems are hiding “significant flaws, and defenders need to find and fix them before attackers do.”

He added: “The Hugging Face incident showed that we underestimated the real-world cyber capabilities of our AI models.” 

The details he shared about OpenAI’s current defensive efforts, however, were mostly routine best practices familiar to enterprises. 

“We continue to invest in secure architecture and controls, embrace strategies like defense in depth and least privilege, and are designing systems that require multiple independent controls to fail simultaneously for something catastrophic to occur,” Brockman said. “Classic security controls like network isolation, workload hardening, monitoring, and safe patching and deployment will be more important than ever in the AI future.”

To combat emerging threats, Brockman also advised enterprise CISOs to increase their use of agentic systems, not surprisingly recommending those from OpenAI.

“Give your security team an agent,” he wrote. “Start using Codex, the Codex Security plugin, or another capable agentic coding and security tool. Give it approved access to the codebases, infrastructure configurations, and technical documentation your security team needs to assess. Do not wait for a company-wide rollout to start with your highest-priority systems.”

Then, he said, “Equip that agent with security expertise. Start from community-supported skills, which include workflows for static analysis, security-focused code review, vulnerability variant analysis, software supply-chain risk, and other security workflows. Then build your own skills around your organization’s architecture, security standards, threat models, and playbooks.”

Accurate advice, but self-serving

Analysts and consultants said that Brockman’s advice was accurate, but that it was also obvious and somewhat self-serving.

Gartner VP analyst Nader Henein put it bluntly: “As a rule, I tend to recommend against taking advice from a party actively selling the solution to a problem they had a role in creating. Curiously, at no point in the blog post is the subject of liability discussed.”

Pieter Arntz, malware intelligence researcher at Malwarebytes, added “the thing that really stands out to me is that the OpenAI sales pitch is unusually explicit.”

“‘Give your security team an agent’ and provide it access to code, infrastructure configurations, and technical documentation, and begin with high-priority systems rather than waiting for a company-wide rollout,” Arntz said, paraphrasing Brockman’s post. “The recommended trajectory from read-only scans to alert triage to automatic closure of narrowly defined false positives is sensible in outline, but OpenAI is clearly trying to normalize agent access for enterprise environments.”

Flavio Villanustre, CISO for the LexisNexis Risk Solutions Group, was also skeptical.

“Although I agree in general with Mr. Brockman’s recommendations, this is a problem that OpenAI helped create in the first place. And the recommendation seems to be for users to now pay more to OpenAI as they use AI to defend themselves,” he said. “I’m fully aware that the cat is now out of the bag and cannot be put back, but I believe that OpenAI should take a responsible approach and help address the problem with higher safety standards, and even fund initiatives that increase software security in general. Perhaps help fund key open source projects that are currently severely overtaxed with the increased volumes of AI-generated findings and fixes.“

“Accountability should always start at home,” he added, “and I don’t see this reflected in that blog post.”

Mike Wilkes, enterprise CISO at Aikido Security, noted what is more important are the many things that Brockman did not say, such as suggesting ways to limit the damage when agents go rogue. 

“Every consequential agent action needs blast-radius limits, an audit trail and a tested, near-immediate rollback path, not simply confidence in the model’s security judgment,” Wilkes said. “Brockman’s own recommendation to expand autonomy only incrementally is consistent with that, but I would make reversibility an explicit design requirement.”

He added, “Brockman appropriately talks about ‘bounded automated responses’ and keeping humans responsible for the highest-impact decisions, but enterprises deploying defensive agents also need extremely fast and highly reliable ‘undo buttons’ for whatever those agents change.”

Incident response always operates with incomplete knowledge, he pointed out, and early indicators are often wrong, leading teams to pursue the wrong thing until new evidence modifies their hypothesis about who is attacking, what has been breached and where they are going next.

An industry-wide problem

Analysts and consultants agreed that these problems are industry-wide, and that many AI vendors have been focusing on what makes the most money and positions them to control the greatest market share, instead of ways to make systems truly safer. 

“Brockman’s blog post is a good summary, but there’s nothing really new or noteworthy in it. All of the major AI labs are backing off the safety and ethics guardrails that were put in place in the early days,” said Mark Tauschek, a distinguished analyst at Info-Tech Research Group. “Their focus is going to be on cybersecurity capabilities because that’s where the attention and money are. The appetite to spend money and slow development in order to ensure new models are acting ethically and safely for average users has waned.”

Noah Kenney, principal consultant at Digital 520, agreed, and added that there are reasons for OpenAI to do this, given that they are preparing for an IPO.

“To me, this is an IPO story more than anything else. Defensive security reads well in an S-1 because it protects revenue, signals operational maturity, and reassures investors,” Kenney said. “A catastrophic risk team is the opposite kind of line item, because its entire purpose is to walk into a launch meeting and say this model may be too dangerous to release. That results in delays and legal exposure right when a company is trying to go public, and it brings in no revenue.”

Katie Norton, research director of cloud security at IDC, said the key point that struck her about the post was the immediacy of the suggested actions.

“What stands out is the urgency of Brockman’s message and OpenAI’s admission that it underestimated the real-world cyber capabilities of its models following the OpenAI-Hugging Face incident,” Norton said. “He is essentially saying organizations have months, rather than years, to adapt.”

GitLab has released security updates to address a critical vulnerability impacting its Community Edition (CE) and Enterprise Edition (EE) software that, under certain conditions, could allow an unauthenticated attacker to remotely modify or delete public projects and user data. The flaw, tracked as CVE-2026-19478, has been rated Critical by GitLab and assigned a CVSS score of 9.4. Released on Swati Khandelwalhttp://www.blogger.com/profile/[email protected]

A threat actor is selling employee databases allegedly stolen from the Microsoft Azure infrastructure of multiple Fortune 500 companies after gaining access using compromised credentials. [...]

Pokémon Center is notifying customers in the United Kingdom and Germany that it suffered a third-party data breach after hackers stole customer personal and order information from third-party logistics provider CEVA Logistics. [...]

Cybersecurity researchers at Wiz have disclosed a new GitHub Actions workflow injection vulnerability in Snowflake's public snowflakedb/snowflake-connector-net repository that it said could be exploited through a crafted GitHub issue to execute commands in a workflow containing internal Jira credentials. The issue was present in .github/workflows/jira_issue.yml, which ran when a Swati Khandelwalhttp://www.blogger.com/profile/[email protected]

A critical security flaw has been disclosed in Forminator Forms, a WordPress plugin with more than 600,000 active installations, that could be exploited to achieve arbitrary code execution on susceptible sites. The vulnerability, tracked as CVE-2026-15748, is rated 9.8 out of 10.0 on the CVSS scoring system. It was discovered and reported by a security researcher who goes by the online alias "Ravie Lakshmananhttp://www.blogger.com/profile/[email protected]

Cybersecurity researchers have traced the continued evolution of the Cavern (aka Cav3rn) command-and-control (C2) framework used by Iranian nation-state hackers in attacks targeting entities in Israel. Russian cybersecurity company Kaspersky said its ongoing monitoring of the threat activity cluster since December 2025 has led to the discovery of previously unreported components that expand theRavie Lakshmananhttp://www.blogger.com/profile/[email protected]

**Všechny nové Macy vám budou dobře sloužit celé roky. **Výkonu mají dostatek, ani starší modely nejsou brzdou. **MacBook dává smysl, i když už máte iPad.

US Commerce Secretary Howard Lutnick is “not in favor” of Apple’s plan to alleviate the impact of rapid memory price inflation by purchasing RAM made in China for use in devices sold there.

Trade by US firms with the biggest Chinese memory manufacturers, CXMT and Yangtze Memory Technologies, is restricted. Apple must secure a license before it can share product information with either firm, though it can still purchase off-the-shelf components that do not require any product details to be shared.

That may be good for Apple, despite White House reticence. Apple has said there isn’t a lot of customization in how it uses memory on its systems, which means it might be able to purchase off-the-shelf RAM. Still, Lutnick seems ideologically against such a move, saying there must be “other solutions to the memory issue, but it’s not great American companies using Chinese memory.” 

No solution in sight

Apple isn’t alone. HP and Acer are both using memory from CXMT in devices sold outside the US, which suggests a US-native solution to the memory crisis doesn’t yet exist. Pending discovery of any magical fix to the real-world supply challenge, the big three US-approved memory vendors continue to raise DRAM prices as they focus manufacturing on data center clients. The vendors have promised to bring more capacity online, but this won’t get into production until 2029 at the earliest.

The US seems to be rushing to make this more difficult; there’s a bipartisan Senate push to force Apple to avoid doing business with the firms, alongside calls to place even heavier restrictions on trade with CXMT. That would prevent Apple from purchasing even commodity memory from the companies.

The lack of memory supply is raising prices across the consumer and enterprise electronics industries worldwide, putting smaller companies out of business and making tech far less affordable for US and international consumers. It is also affecting product inventories; Apple has had to delay delivery dates for newly purchased devices and was forced to temporarily stop sales of some high memory configurations.

Analyst Ming-Chi Kuo even warned Apple has scaled back its hardware shipment plans for 2026 in response to the crisis. (There are even reports that the supply of Apple silicon processors has been hit by the shortage of good memory.)

We pay the price

The only positive way to escape this inflationary loop is to source, manufacture, or otherwise secure more supply — as Apple is attempting to do with CXMT. Alternatively, the government might need to force existing vendors to divert additional capacity to DRAM, which the Trump Administration hasn’t done and has flagged no intention to do.

US consumers and US businesses continue to pay the price for that indifference. Apple has been forced to raise some product prices up to 25% and might yet have to implement another wave of price increases.

The rapid increase in prices is being reflected by consumer purchasing behavior. The biggest signal so far on how this will play out comes from Japan, where refurbished iPhone sales more than doubled after Appe’s July price hikes. That trend was confirmed by a second report in Japan Times, which reports a huge spike in iPhone sales via the Nicosuma online marketplace.

As that trend asserts itself globally, it will affect new device sales, hurting both down- and upstream manufacturers in the consumer electronic supply chain, creating another vortex of inflationary pressure. Consumers will also wind up using their devices longer and turn to lease and hire schemes in preference to cash or credit to settle high purchase costs. 

New consumer habits

This change in behaviour can only go on for so long while new device sales shrink. At some point, it will become apparent that not enough new devices are entering the second user value chain to satisfy demand in that side of the market. The result: an additional inflationary wave, prompting second-user devices to become even more costly as lowering sales of new devices put smaller manufacturers out of business entirely, further reducing competition, denting corporate profits and, conceivably, undercutting tax receipts.

You can follow me on social media! Join me on BlueSky,  LinkedIn, Mastodon and subscribe to The Core.Apple’s Chinese memory puzzle