Swiss rail manufacturer Stadler Rail says it refused a CHF 10 million ($12.3 million) ransom demand after the Everest ransomware gang compromised one of its suppliers. Stadler will not pay, and based on its account of events, the company appears to have got off lightly. It stated that "no security-relevant data [was] affected" in the breach, which was limited to "technical information from a supplier." According to its announcement, "no relevant personal data was stolen," and the incident had no impact on the functioning of its rolling stock (train and tram carriages) or its global production lines. The attackers accessed the technical data through a "data exchange platform" Stadler used with the unnamed supplier, authenticating with compromised login credentials. "Stadler's IT systems were not compromised and remained intact," the company said. At the time of writing, Stadler does not appear on Everest's data leak site (DLS), nor has the swiped technical data been leaked. Stadler's absence from the extortion group's website is unusual. The typical cyber extortion playbook involves the crooks first notifying victims that data has been stolen and/ or encrypted, then issuing their demand and threat to leak data if the ransom is unpaid. Failure to meet the deadline - or refuse outright, as Stadler did - typically lands the victim organization a spot on the extortionist's DLS. That's often when a second countdown timer begins. Criminals typically offer victims another few days to realize they are not bluffing and will leak the stolen data if a fee isn't paid. If they pay, victims are scrubbed from the DLS. If they don't, their data is leaked. That's the usual playbook. However, for a victim to both refuse to pay a ransom and not appear on the gang's DLS is an oddity. Everest, a Russian-speaking cybercrime group, has operated since circa December 2020 and claimed attacks on sportswear giant Under Armour, Mailchimp, AT&T, and Collins Aerospace, to name just a few. It's dabbled in both encryptionless extortion and double extortion, and has branched out into initial access brokering and recruiting corporate insiders. ®

PWNED Welcome back to PWNED, the weekly column where we focus on security own-goals so you can avoid them. This week’s topic involves serious problems in the healthcare sector, specifically the very human problem of compromised gatekeepers. Have a story about someone leaving a gaping hole in their network? Share it with us at pwned@sitpub.com. Anonymity is available upon request. Our legend of lameness comes courtesy of red teamer Dahvid Schloss, who shared so many great stories with us that we’ve featured his tales a couple of times before. Schloss has made a career out of testing not only network security but also physical security at a wide variety of places. He has learned that if you act as you belong, people will usually treat you like you belong. At one hospital, Schloss was hired to test security by getting access to the records room and trying to steal a specific physical file that his client left there for him to pilfer. The challenge was that the records room had both an electronic lock and a nurse gatekeeper guarding it. Schloss told us that he considered several approaches to get into the records room. He could try picking the lock, cloning a badge, or even stealing the badge of someone who had access. Instead, he decided to try social engineering. Schloss did research on the hospital and he put on a pair of appropriate scrubs and made himself a fake security badge that could not possibly swipe in. Then he knew it was time to turn on the charm with the nurse who was on duty at the records room. And by “turn on the charm,” we mean “diss the doctor.” “Nurses talk a lot of shit. It's the law of the land when it comes to the hospital,” Schloss told us. So he tried to swipe his non-working badge and showed frustration when it didn’t work. Then he walked up to the window where the on-duty nurse was standing and won her over. “I'm doing fine, hon. How you doing,” he told the nurse. “Look, I'm gonna save you the details. But Dr Johnson's being an absolute asshole right now; he didn't pull out his patient records that he was supposed to pull out for trauma. We need these records, and they sent me down here. I'm brand new. I just started yesterday.” Schloss had done his research and picked out the name of an actual doctor on staff. What he couldn’t have known is that the doctor was actually a difficult person to work with. And the duty nurse let him know she was on his side before letting him in. “The nurse goes ‘honey, I know exactly the pain that you're going through,’” Schloss continued. “She goes ‘I got you’ and she opens the door, lets me in.” After Schloss went into the records room and retrieved the file, he hung around and talked to the nurse for another 10 minutes, complaining about how security was incompetent for not activating his badge and letting her complain about what jerks some of the doctors were. He even had a backstory about where he had worked before. She invited him to hang out and go for lunch sometime before he left with the folder. Other hospitals he tested had bad network security practices. He told us about one hospital where he sat down in the waiting room and logged into the guest Wi-Fi network and did a scan. What he found was that all the important devices in the hospital were on VLAN 1, the same network as guest Wi-Fi. All of the data coming out of medical devices like the MRI machine was readily accessible and unencrypted. He said that most medical devices at most hospitals he’s tested do not encrypt data that they send over the network. “So you're getting Social Security numbers just being populated over the network via the MRI machine and you're getting the patient data, the date of birth, all the PII that any organization would lose their shit about,” he said. Schloss said that he thinks hospitals he’s tested prioritize the ability to keep machines running and distributing data quickly over good security hygiene. If someone tried to get data, failed, and had to call IT for help, those precious minutes of delay could cost a life. But even if it's a matter of life and death, do not let someone into a restricted area just because they look and act the part. ®

If you're responsible for Linux security, someone just dumped a pile of work onto your desk: 432 Linux kernel CVEs were published across Sunday and Monday this week. Linux watchers at nixCraft pointed out the volume on Monday morning, and it didn’t take long for seasoned sysadmins to start expressing concerns. Jan Schaumann, chief information security architect at Akamai Technologies, took to the OSS-SEC mailing list Tuesday to express concerns over the sheer volume of Linux kernel CVEs published in recent days. Aside from noting that the CVE system isn’t the best way to track security changes, Schaumann also wondered in his post whether there was any good way to deal with so many kernel security issues. “This onslaught really shows it's not feasible to attempt to prioritize individual kernel changes,” Schaumann said. “You might attempt to process this large set of changes by pointing an LLM at the intake and asking it to prioritize them,” he suggested, “but if it spits out a dozen today and another 25 the next, you haven't won much.” Schaumann also suggested waiting to see which ones emerge as serious issues and focusing on those in the weeks to come, or updating one’s entire fleet of Linux machines on a weekly basis. “I sure would like to be able to do [that], but reality keeps getting in my way,” Schaumann said. “I'm not sure what to do here going forward.” In an email to The Register, Schaumann said that individually reviewing vulnerabilities for patching was already difficult enough before things rose to this level, and that automation may be the only option - but it's not a great one. "Automated, regular, and frequent updates that pull in all changes within a given time window of tolerance seem to me the only reasonable approach, but that is very difficult for many large organizations," Schaumann explained. Those orgs often rely on lengthy QA processes, slow and staged development cycles, and may even have contractual requirements for long-term support that make an automated approach an impossible one. The nixCraft team speculated on social media that AI bug reports are a likely reason for all those kernel CVEs, which wouldn’t be without precedent - Linus Torvalds himself said in May that the Linux kernel security mailing list had become “almost entirely unmanageable” due to AI-assisted bug hunting. Nonetheless, Torvalds has described AI as a useful tool for Linux development while still noting it can be a drag for maintainers, both from a workload standpoint and the fact "it keeps finding embarrassing bugs." On that note, it's worth understanding what a Linux kernel CVE actually means - many of the vulnerabilities included in the Sunday-to-Monday batch are small in scope, but they're vulnerabilities nonetheless. As senior Linux maintainer Greg Kroah-Hartman noted in a February blog post, the Linux kernel CVE team follows the CVE Program's definition of a vulnerability: a weakness in a product that can negatively affect a system's confidentiality, integrity, or availability. “At the level that the Linux kernel runs, almost any type of bug that can affect a running system can be classified as a vulnerability,” Kroah-Hartman noted. The kernel team looks at every bugfix that is added to stable kernel releases, he added, and if it fixes an issue that meets that CVE criteria, a CVE is assigned. AI-assisted bug hunting has increased the volume of reports reaching Linux kernel maintainers. We reached out to the Linux kernel team, but didn’t hear back. Kroah-Hartman did tell The Register earlier this year that AI bug reports had become worthwhile in recent months, and he predicted they're likely to keep adding to his workload. Unfortunately for Linux sysadmins, the position in which they find themselves in this current mess isn’t one that’s readily solved. CVEs might be a messy way to track and prioritize security updates, especially when hundreds of them are published over a short period, but without something better, it falls to IT and security teams to determine which vulnerabilities affect their systems and which kernel updates they need to deploy. Hope you’ve got the coffee machine filled up: The onslaught is unlikely to ease if other recent patch cycles are any indication. ®

EXCLUSIVE A Windows information-stealer targeting more than 300 applications comes equipped with a novel surveillance tool: an AI profiler that ranks infected victims so crooks know who to target first. Varonis Threat Labs spotted the new stealer and remote access trojan (RAT), called Dolphin X, for sale on a cybercrime forum, and shared their research exclusively with The Register. The ad for the malware claims it can target upwards of 300 applications and has the ability to bypass browser passwords and steal enterprise credentials, cryptocurrency wallets, .env files, SSH keys, cloud tokens, and DevOps secrets. Dolphin X also promises users a super-sneaky surveillance feature called the AI Profiler. It scores infected users by app usage, browsing history, and installed software, and sends the cybercriminals a daily summary that ranks victims’ based on the likely payoff from an attack. “There's two things that stand out,” Daniel Kelley, a senior threat researcher with Varonis, told The Register. “The first thing is the AI profiler. That's something I've never seen before. And then it’s also the breadth of applications that it steals - and it’s not even just applications. It’s everything, you name it: it will steal files, or credentials, cryptocurrencies. It’s probably one of the biggest stealers I’ve ever seen, and covers the biggest attack surface.” A malware vendor using the alias “Kontraktnik” posted Dolphin X for sale, promising: “You can use it as a stealer, as an HVNC [Hidden Virtual Network Computing], as a DDoS botnet, as a loader.” The crimeware currently only runs under Windows, but “we are working on Debian,” Kontraktnik claimed, adding that the malware also only supports English and Russian. Kelley suspects the developer is Russian-speaking, and told us that the stealer includes an option not to infect any users in the Commonwealth of Independent States (CIS) countries, a common choice among Russian-based ransomware and cybercrime gangs. Kelley and his team obtained and analyzed the malware builder, operator panel and its network traffic, but didn't examine a malware sample. Varonis therefore can’t guarantee that all of the developer’s claims are true. However, “when we looked at the builder, it had everything to suggest the features were legitimate,” he said. “We couldn’t test out the malware itself, but I would say it probably lives up to most of its expectations.” Feedback left on the forum where the malware is sold supports that analysis. As of Tuesday, the sales thread has passed 3,000 views, we’re told, with Kontraktnik closing at least two confirmed deals. Both of these included positive feedback from the buyers. Three-tier subscription model Beyond the 300 + apps it targets, Dolphin X's operator panel lists 329 features across 10 categories. Buyers can subscribe to one of three tiers, each unlocking new features, or buy a lifetime subscription. The minimalist suscription costs about $80 per month, which buys rewriting and altering capabilities across Windows Portable Executable (PE) timestamp, Rich headers, and section padding, along with capabilities allowing the malware to exploit the brittle YARA rules to bypass detection and hash-based blocklists. The middle tier advertises shuffling the import table, which would change the binary's import hash between builds. The top level sub (about $230 per month) claims to rewrite the code’s control flow, substitute instructions, and re-encrypt embedded strings with a new random key each time, thus making stable byte sequences harder to identify. Lifetime subscription cost about $1,140 for basic access, $2,280 for mid-tier malware, or $3,420 for perpetual pro-level Pwnage. “It really lowers the barrier to entry,” Kelley said, adding that in the not-so-distant past, cybercriminals needed a certain level of technical expertise to develop and use different types of malware. “Now it's set up in a way where it's almost like SaaS. Anyone can purchase it. Anyone can take it out of the package and use it.” All of this suggests two takeaways for defenders, according to the security sleuths. First, keep long-lived credentials off disk if possible. “Infostealers are designed to grab everything in one pass, so anything stored locally should be treated as potentially exposed,” the report warns. Second: focus threat detection on behavior - not file signatures - because this and other malwares include capabilities to bypass signature-based detection. “For example, explorer.exe running under a non-default desktop is a strong indicator of an HVNC session, regardless of how the malware binary is packed or what hash it uses,” the authors wrote. Varonis’ threat hunters previously uncovered other AI-powered malware, including an all-in-one phishing kit called Bluekit, and an email attack tool called SpamGPT. “It’s a huge trend,” Kelley said. “Cybercriminals are finding a lot of unique ways to integrate AI, and then they're using it to make their lives a lot easier, which is problematic.” ®

Authorities have long warned organizations not to pay ransoms, and fresh figures underline why: handing over the money doesn't mean the crooks leave you alone. Proofpoint survey data suggests that 58 percent of affected UK organizations paid a ransom. Worse, 22 percent of those who pay get extorted again anyway. The UK broadly tracks the global picture: 54 percent of victim organizations paid, though the rate swings sharply by region, from just 19 percent in Japan to 93 percent in the US. Cybersecurity biz Proofpoint, which published the data on Wednesday, attributes the regional variation to "a combination of regulatory environment, recovery capability, insurance incentive structures, and cultural norms around negotiation." "But the core finding holds everywhere: ransomware creates enough pressure that a significant share of organizations in each of the surveyed markets choose to pay." UK organizations that paid fared somewhat better than the 37 percent global average for repeat extortion. Still, the core lesson stands: paying doesn't reverse an attack. You can't trust a criminal's word. It just restarts a negotiation where the attacker holds every card, including the data, decryption keys, and the threat of publishing what they've stolen. Operation Cronos, law enforcement's LockBit takedown, provided hard proof of what had long been suspected: cybercriminals often retain victim data even after being paid. Before Dmitry Khoroshev's cybercrime empire collapsed, this was an assumption, not evidence-based. Cronos didn't just shutter the then-leading ransomware gang; it undermined the entire premise that paying restores the status quo. Proofpoint found that 2 percent of victims who paid a ransom never recovered their files at all. Earlier this year, Nitrogen's ESXi ransomware victims hit a similar wall after a coding error in the decryptor left some unable to fully restore access, and it was far from an isolated case. Attackers don't need to hold up their end of the bargain to keep the payments coming. The better answer is to build cyber-resilience into the organization itself. A word on AI No 2026 security report is complete without AI. In the UK, 65 percent of surveyed security practitioners said AI had sharpened the attacks that precede ransomware and extortion, most notably malicious links, business email compromise, malicious attachments, and credential harvesting. AI is not yet a key tool in ransomware payloads themselves, despite recent reports suggesting this may soon change. However, it is being used for more convincing phishing lures, sharper impersonation attempts, and faster system reconnaissance once attackers are inside a network. "AI hasn't fundamentally changed ransomware, but it has materially improved the attacks that lead to it," said Ryan Kalember, chief strategy officer at Proofpoint. "Today's attackers are using AI to create highly convincing phishing emails and credential theft campaigns that exploit human trust at scale. "Organizations that continue treating ransomware as an endpoint or recovery problem are missing where these attacks most frequently begin: people, identities and trusted communications." ®

A council worker who "abused" his position to unlawfully access "highly sensitive" personal records of family members and other people known to him has received a suspended sentence after admitting to violating the Computer Misuse Act (CMA). Geoffrey Smith, 31, from Ledbury, was a new Herefordshire Council employee working in the Children and Young People directorate. Over a four-day period, he accessed roughly 490 records and downloaded 94 documents relating to family members and "families known to him." This included data on adults and children, the Information Commissioner's Office (ICO) said. The data accessed included "highly sensitive material" such as medical records, social worker reports, and child and family assessments, the watchdog said. Smith pleaded guilty to an offence under Section 1 of the CMA 1990 relating to "unlawful accessing of personal data held on computers." He was sentenced at Worcester Magistrates' Court on July 17 to two months' imprisonment, suspended for 12 months. Smith was also ordered to complete 120 hours of unpaid work and pay £2,000 in costs plus a £154 victim surcharge. Andy Curry, ICO head of investigations, said: "Smith abused his position as an employee and used his access to Herefordshire Council's systems to view the personal information of people known to him, without any legitimate reason to do so. "The sensitive nature of the records held within a Children and Young People directorate, and Smith's systematic misuse of that information, makes this particularly serious. People have a right to expect that their personal information is kept safe, and that those with access to it will only use it for the purposes for which it was intended." Tough words from the ICO, whose former information commissioner resigned after admitting that his conduct had fallen below the standards expected of public officials. ®

Who needs expensive frontier models to find software vulns? Cisco has just released two open-weight models that specialize in finding known bugs in existing codebases. The models, Antares-350M and Antares-1B, are part of Cisco’s new Antares family of security small language models (SLMs), and are now available on Hugging Face - but only to vetted users. “We’re making sure we’re gating that and appropriately granting access,” DJ Sampath, Cisco's senior vice president and general manager of AI software and platform, told The Register. The company is working with academic and nonprofit organizations, as well as smaller and public organizations’ security teams, to ensure they have access to the vulnerability-hunting models. Plus, because both are small models designed to run locally, “you also need the keys to the source code” to scan for and find vulnerabilities, Sampath said. “This means an attacker is going to be able to exploit an endpoint or a service that you have.” It also means that proprietary code never leaves the organization’s machines, compared to cloud-based LLMs that send code to the AI providers’ external servers for processing and analysis. This enables security analysis in environments with strict privacy or compliance requirements, according to the networking and security giant. And yes, it's named after the massive red super-giant star. “It's almost 1,000 times bigger than the sun, even though the sun dominates the sky, and that is the analogy that we're using here for vulnerability detection and localization,” Cisco VP and chief AI scientist Amin Karbasi told The Register. “The impact of vulnerabilities in your codebase is huge, but it might be only a single file or a few lines of code in a million lines of code.” A future, 3-billion-parameter model in the Antares family won’t be released to the public, Karbasi added. “We are completely gating the 3B model to make sure that we responsibly release it to communities that need it,” he said. Small yet mighty Cisco claims that its models perform as well as or better than dozens of larger models in its new benchmark test that measures how efficiently AI models identify security flaws in codebases. Antares-1B outperforms Google’s Gemini 3 Pro and is comparable to Z.ai's GLM-5.2, we’re told, while the yet-to-be-released Antares-3B does a better job at finding vulnerabilities than GLM-5.2 and OpenAI’s GPT-5.5. Plus, we’re told that the small models scan code much faster and at a fraction of the cost of larger, token-gobbling AI systems. “If you look at the performance, in terms of the time it takes to finish 500 repositories, Antares finishes the entire cohort of repositories in 15 minutes, whereas frontier models take five hours,” Karbasi said, adding that this translates to significantly less cost. “It takes like less than $1 whereas frontier models are above $100 into $150 of cost,” he added. The difference, Karbasi explained, is that Cisco took a “fundamentally different approach” to building Antares. “These models have been trained in a very different way,” he said. “Antares is inherently not a chatbot. It is an investigator. It is a search engine. It has to find a very specific thing that might be a needle in a haystack, and it goes and finds that.” This required training the model on several different ways to search for vulnerabilities “because one way of search may not actually be fruitful, then it has to change its strategy, do it another way, and then do it another way,” Karbasi said. “Because it is very nimble and it’s very small, it can actually do a lot of search at the same time, which is very different from bigger models.” Karbasi likened it to a bicycle on a busy London street: “You can go much faster than the biggest truck.” Or, to use Sampath’s favorite analogy for the benefits of using a small, security-focused model to find bugs in code: “Sometimes you don't need a private jet to go to a corner store, right?”®

German authorities say they have neutralized the main infrastructure supporting the Kratos phishing-as-a-service (PhaaS) kit following an operation supported by the US and Indonesia. Officers from Frankfurt am Main's Central Office for Combating Internet Crime (ZIT) and the Federal Criminal Police (BKA) described Kratos as one of the most widespread and dangerous PhaaS kits on the market. In Indonesia, authorities said they arrested the Kratos kit's alleged "developer and technical administrator." The announcement of Kratos's takedown did not mention whether any other individuals are being pursued. According to the ZIT and BKA, Kratos allowed low-skill cybercrims to harvest credentials, including passwords and session cookies, to bypass MFA by providing them with convincing Microsoft-themed phishing pages. Criminals using Kratos phishing pages targeted hundreds of thousands of victims across more than 30 countries, while the operation behind the kit allegedly earned more than €300,000 ($342,000) since 2024. More than 1,800 criminal enterprises are estimated to have used Kratos, which was responsible for around 15,000 phishing campaigns per month. "Each individual campaign had the potential to harm several thousand recipients worldwide," the German authorities said in a statement. The operation neutralized more than 200 servers, according to the ZIT and BKA, although the latter declined to explain how. Methods used in previous takedowns included handing legal warrants to infrastructure providers, such as Kratos's chosen hosting company, and working with ISPs to null-route or sinkhole traffic associated with suspect IP addresses. Dr Benjamin Krause, head of the ZIT at the Frankfurt am Main Public Prosecutor's Office, said, "Our approach of disruptive law enforcement works: In addition to the primary task of identifying and prosecuting the accused, we have once again succeeded in dismantling a criminal online service and thus contributing to greater cybersecurity." Carsten Meywirth, head of the cybercrime department at the BKA, added: "Anyone who steals login credentials online using fake websites shouldn't feel safe. The success against the Kratos phishing kit shows that even highly professional phishing infrastructures can be effectively combated. "This is pioneering work and a clear signal to other cyber actors – phishing will not go unpunished and will be consistently fought by the BKA." Many names, same focus German authorities referred to the PhaaS kit only as Kratos, although open source reporting has tied it to products previously sold under names such as SneakyLog and Sneaky 2FA. Similarly, the ZIT and BKA mentioned only fake Microsoft authentication pages among the templates offered by Kratos. Microsoft, meanwhile, reported earlier this year that SneakyLog had been used to generate phishing campaigns targeting US citizens with fake W-2 tax forms. As recently as July 16, security shops such as Heal Security reported that Kratos offered customers lures themed around various websites, including SharePoint, OneDrive, Microsoft Forms, Canva, Tilda, and more. KnowBe4 added Adobe lures to that list with its own investigation in February, which also raised uncertainty about when the kit first hit the market. Microsoft, which said Kratos was also known as SneakyLog, believes the latter entered the phishing kit market as of early 2025, although KnowBe4 said the first signs of Kratos only emerged in January 2026. Muddying the picture further, KnowBe4 did not mention SneakyLog or Sneaky 2FA as part of Kratos's past. The security shop said instead that it evolved from a previous life as a family of commercial trojans and infostealers. One thing that most open source reports agree on, however, is that the targets of the phishing kit's customers are based primarily in the US and Europe. Microsoft identified manufacturing, retail, and healthcare as the main target industries in the US, while in Europe, industrial organizations, law firms, polytechnic institutions, schools, SMBs, and others have all been attacked, according to ANY.RUN. ®

A data breach at AI music generator platform Suno exposed more than 55 million user accounts, according to Troy Hunt's Have I Been Pwned service, which ingested the files. The dump consisted mostly of email addresses, although phone numbers were also included where users had signed up with them instead, HIBP said. Tens of thousands of Stripe records further revealed data such as names, physical addresses, purchase amounts, as well as partial credit card data, such as card type, expiry date, and the last four digits of the card number. The breakdown from Have I Been Pwned puts a figure on the scale of Suno's data breach for the first time since the news of the slip-up broke last week. The individual who claimed responsibility for breaching Suno also supplied source code apparently dating from 2023 and 2024 that they said showed the company scraping millions of songs and lyrics from services including YouTube Music, Deezer, and Genius to train its AI. Suno has acknowledged training its AI on music available on the open internet, while arguing that doing so constitutes fair use. It did not immediately respond to The Register's request for comment. AI's imposition on the arts has been a persistent topic of ethical and moral debate for years. Major record labels came together to complain about mass data scraping and copyright infringement by AI companies prior to Suno's breach in November 2025. Record labels represented by the Recording Industry Association of America (RIAA) sued Suno and rival Udio in 2024 for allegedly scraping songs en masse without permission of the copyright holders. Among the plaintiffs in the case were Sony Music Entertainment, UMG Recordings, and Warner Records, which represent artists such as Bruce Springsteen, Beyoncé, Taylor Swift, and Dua Lipa. Warner has since settled its litigation with Suno and begun a commercial partnership with the AI company, while Sony and UMG are continuing their claims in court. ®

If you use WordPress, patch now. Just hours after fixes came out, attackers have begun exploiting two bugs that, when chained together, allow pre-authentication remote code execution (RCE). And security researchers tell us there’s a very good chance the miscreants had an AI assist. “Once the vulnerabilities were publicly disclosed, reproducing them with the help of frontier AI models was only a matter of time and tokens,” Jake Knott, watchTowr principal security researcher, told The Register. “WatchTowr was able to trivially reproduce CVE-2026-63030 within minutes of disclosure, and the second CVE-2026-60137 with some additional effort.” WordPress released patches for both CVEs late Friday, but by Saturday it was game over. “By the early hours of Saturday morning, successful exploitation was already well underway, initially using public exploit code to exfiltrate hashed credentials, with remote code execution following once additional details were made public,” Knott said. “From our vantage point across a global client base, we are seeing widespread impact of this vulnerability across organizations of every size and every vertical.” Here are the details about both security holes, and what went down since WordPress revealed and fixed them on Friday. CVE-2026-60137 is a moderate-severity SQL injection issue, and CVE-2026-63030 is a critical REST API batch-route confusion bug. “A route confusion flaw causes the arrays containing the sub-requests, validation results, and matched handlers to become misaligned,” Hacktron researchers explained. This causes WordPress to become confused about which requests have been properly validated and thus treat all requests as trusted, including those that it should block. Individually, the bugs are difficult to exploit. But when chained together, they can wreak havoc on any organization using a vulnerable WordPress version because they allow unauthenticated RCE. WordPress 6.9 is affected by both vulnerabilities, and version 6.9.5 contains fixes for both, while WordPress 6.8 is only affected by the SQL injection flaw, and version 6.8.6 fixes it. Additionally, WordPress 7.1 Beta 1 is also vulnerable. Version 7.1 Beta 2 fixes both CVEs. Versions of WordPress prior to 6.8 are not affected. John Blackbourn, one of the WordPress core developers, recommended affected users “update your sites immediately.” Because of the flaws’ severity, the WordPress security team “enabled forced updates via the auto-update system for sites running affected versions,” he added. The content management system credited Searchlight Cyber researcher Adam Kues with finding and reporting CVE-2026-63030, and in a subsequent Friday advisory, Kues dubbed the bug wp2shell. “The attack has no preconditions and can be exploited by an anonymous user in a stock install of WordPress with no plugins,” Kues said, adding that his security shop released a free wp2shell checker to determine if your instance is vulnerable. Security firm PatchStack reported exploitation of both CVEs as of Friday night, but didn’t provide details about the attacks. VulnCheck’s research team, which also began researching the patches on Friday, verified more than two dozen unique proof-of-concept exploits targeting WP2Shell as of Sunday. “After public exploit code was released, attackers began spraying the internet indiscriminately, hitting anything reachable and trying to get lucky,” Knott told us. “Our honeypots recorded tens of thousands of exploitation attempts, and more than 100 backdoor accounts created by different threat actors using variations of public tooling.” After creating these backdoor admin accounts, watchTowr observed attackers deploying fake WordPress plugins to achieve RCE, exfiltrate credentials or secrets, or download additional tooling to further compromise the system, he added. “In one case, we watched a threat actor repeatedly attempt to pull down Overlord RAT, a Golang-based remote access trojan.” Any orgs that waited until Monday to patch are likely already compromised, Knott warned. “Defenders need to inspect their WordPress instances for new administrator accounts, malicious plugins, or other suspicious files, regardless of whether they’ve patched,” he said.®

Real FBI agents won't slide into your DMs and offer to help you recover stolen funds. The bureau's Internet Crime Complaint Center (IC3) updated an earlier warning on Monday about scammers impersonating the agency online, saying fraudsters continue to use the scheme "to deceive and revictimize individuals." According to IC3, there are two different schemes being used to target cybercrime victims, both directly and by soliciting them to report incidents. In the first scheme, IC3 said scammers create fraudulent social media profiles and pages impersonating FBI personnel or IC3. They may also infiltrate online groups for fraud victims or contact victims directly while claiming to represent the FBI or the complaint center. In other cases, victims are being contacted by someone claiming to be an FBI agent after realizing they were approached by someone trying to scam them and saying they intended to report the incident to the FBI or file an IC3 complaint. The FBI said the impersonator then directs victims to a fake IC3 update page or continues communicating through messaging apps. In the other instance, scammers are creating AI-generated videos on social media depicting senior FBI officials and directing users to a spoofed IC3 website to report cybercrimes they may have fallen victim to, with the scammers then collecting the information and using it to contact victims for further fraud. AI-generated depictions of public figures are similarly being used to make such scams appear legitimate. “Some individuals received an email or a phone call, while others were approached, or observed an advertisement via social media or forums,” the IC3 said. “Almost all complainants indicated the scammers claimed to have recovered the victim's lost funds or offered to assist in recovering funds.” Regardless of how legitimate social media profiles look, or how realistic those AI-generated videos may be, the IC3 is warning that none of them should be believed for a simple reason: The IC3 doesn’t have a social media presence of any kind, and it doesn’t investigate crimes or offer to recover lost funds through social media. “Any social media profiles or pages claiming to represent IC3 or offering to recover lost money are fraudulent and are actively attempting to steal your personal or financial information,” the IC3 warned. “IC3 will never directly communicate with individuals via phone, email, social media, phone apps, online chat, or public forums.” The IC3 said that any contact made with a cybercrime victim who reports an incident via its actual website will be made by an FBI employee from a local field office or other law enforcement official. Here’s another hot tip: If you fall victim to a cybercrime or online scam, don’t post about it on social media - that’s only going to invite someone with bad intentions to seek you out. ®

Microsoft 365 calendars have become the latest hiding place for espionage malware, with attackers stashing commands and stolen files inside appointments dated 24 years into the future. Researchers at Group-IB say they've uncovered a malware component they call HOLLOWGRAPH that swaps the usual command-and-control server for something rather less conspicuous – a compromised Microsoft 365 calendar. Instead of reaching out to attacker-controlled infrastructure for instructions, the implant rummages through calendar events, picks up encrypted tasking, and drops stolen files into new appointments for its operators to collect later. Every event created by HOLLOWGRAPH is dated May 13, 2050, an otherwise empty corner of the diary where encrypted attachments are less likely to attract attention. HOLLOWGRAPH isn't exploiting Microsoft Graph so much as blending into it, wrapping its command-and-control traffic inside legitimate Graph API requests that look just like any other Microsoft 365 application talking to the cloud. The malware itself is relatively lean. Group-IB says it does little more than fetch instructions from one calendar event, stash stolen files in another, and periodically retrieve fresh Entra ID credentials over a DNS tunneling channel so the Graph-based communications keep working. The security firm linked the malware to the Cavern framework with high confidence after finding matching command formats and other implementation details. It also spotted similarities with the Iranian-linked espionage group Lyceum, although it stopped well short of pinning the operation on that crew, saying the connection was supported with only low confidence. "HOLLOWGRAPH represents an advanced and highly targeted espionage threat," Group-IB wrote. "By abusing trusted Microsoft 365 calendars through the Microsoft Graph API and refreshing its cloud authentication credentials through DNS tunneling, the malware conceals its command-and-control within legitimate Microsoft 365 and network traffic, evading conventional perimeter defenses." The campaign itself appears to be narrowly targeted. Group-IB identified 12 infected systems, only three of which communicated with the compromised mailbox during the period it observed. The compromised mailbox used for command-and-control belonged to an Israeli organization, malware samples were uploaded from Israel, and the researchers said the evidence points to a focused espionage operation rather than a broad smash-and-grab. HOLLOWGRAPH doesn't exploit a flaw in Microsoft 365 or Microsoft Graph. Instead, it takes advantage of services that are already trusted inside most organizations, making the activity far less conspicuous than malware calling home to attacker-controlled infrastructure. ®

Notice more spam getting through that corporate email filter lately? Attackers are using a technique known as "text salting," which hides benign-looking words intended to confuse some AI-powered email filters, says cybersecurity firm Barracuda. The email security outfit said on Thursday that it had detected more than one million retail-themed phishing attacks using text salting since April. It’s not a new technique by any stretch and has been used to fool traditional secure email gateways for years, but Barracuda says it can also confuse machine-learning and LLM-based security tools. Text salting involves peppering (sorry) a malicious email with random, harmless-seeming words in order to fool an email scanning system into thinking there’s nothing off about the flavor of a message (sorry again), tricking the system into passing it to its recipient for consumption (I’ll stop with the food jokes here). Pour a pile of salty text on top of an email and a human reader would probably get suspicious, however, so attackers typically use one or more of three flavor variations (okay, I'm done – promise) to hide the additives from human readers, but not automated scanners, per Barracuda. Typical techniques include CSS cropping, which sets the visible window small enough that a human won't see the hidden filler text; text manipulation to move the salty copy outside the visible screen; and zero font techniques which insert misleading words between suspicious phishing copy that’s visible to a machine but not a human. The end result of each of those techniques is a message that reads less malicious, more gibberish to a machine, leading it to assume the email is fine, and which looks exactly as the attacker intended when viewed by a human. Modern email security systems have largely adapted to these techniques, with newer tools able to remove hidden text to see what a reader is supposed to see, sounding alarms when a lot of hidden stuff is inserted in an email, and the like. AI, however, hasn’t managed to follow suit, says Barracuda. “Text salting and related techniques can be used to confuse AI-driven content analysis engines by flooding the email with random terms that encourage the AI system into making an incorrect classification decision,” the company wrote in its report - just like those early 2000s SEGs. What a technological leap we’ve made! LLMs, Barracuda explained, are typically designed to process email text and source code plainly, with no understanding of whether text is visible or hidden from a user. They can be trained to do so, but that just means most tools probably aren’t doing that by default. So, what can enterprises do to stop the flow of salty spam to their employees? Barracuda recommends a layered approach to email security rather than relying solely on keyword detection, including checking sender reputation, authentication results, embedded URLs, HTML-rendering techniques, and differences between user-visible and hidden content. Ditching that AI spam filter might not be a bad idea, either. ®

Fortinet admins have two more reasons to clear their calendars after CISA confirmed a pair of critical FortiSandbox bugs are being actively exploited. The two bugs, tracked as CVE-2026-39808 and CVE-2026-25089, both carry CVSS scores of 9.1 and affect FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS. According to Fortinet, they are OS command injection flaws that allow unauthenticated attackers to execute arbitrary commands via specially crafted HTTP requests, requiring neither valid credentials nor user interaction. Fortinet released fixes for CVE-2026-39808 in April and CVE-2026-25089 in June, warning in advisories published at the time that successful exploitation could lead to remote code execution via low-complexity attacks. Fortinet has not publicly confirmed that either flaw is being exploited in the wild, but CISA has now added both bugs to its Known Exploited Vulnerabilities (KEV) catalog. Inclusion in the catalog means CISA has evidence that the vulnerabilities are being actively exploited, although the agency rarely attributes attacks or discloses how widespread they are. For federal civilian agencies, bugs landing in KEV come with homework. Binding Operational Directive 26-04 requires them to patch within CISA's deadlines or pull the plug on vulnerable products if they can't be adequately secured. Fortinet has not updated its advisories to mark either flaw as exploited and did not respond to The Register's questions. CISA isn't the only one reporting attackers poking at these vulnerabilities. Security firm Defused said it had observed exploitation attempts against both flaws this week alongside another FortiSandbox vulnerability, CVE-2026-39813. Not every exploit appears to be doing its job, though, as Defused described the one targeting CVE-2026-25089 as "vibecoded" and likely broken, adding that it has yet to see a working public exploit. CISA also used Thursday's KEV update to flag another fresh concern: Microsoft's newly patched SharePoint Server bug, CVE-2026-58644. The critical deserialization vulnerability, rated 9.8, allows authenticated attackers with Site Owner privileges to execute arbitrary code remotely against vulnerable SharePoint servers. Microsoft warned that the bug can be exploited remotely over the internet with relatively little effort, making it one to patch sooner rather than later. ®

Picture this. Someone gets hold of your Android phone and, despite not knowing your PIN, they can use Gemini from the lock screen to send SMS or WhatsApp messages as you. This is a real bug and Google says a fix is coming as soon as this week. Since May, The Register has received multiple reports of users bypassing device authentication on Android 16 devices that enable Gemini access from the lock screen. These are distinct from the similar Gemini-based Android lock screen bypass bugs that have made the rounds since September 2025. One of the bugs reported to us allowed unauthenticated users with physical access to an Android device to enable functionality such as phone, texts, and WhatsApp via Gemini on the lock screen using a specific multi-touch gesture. When device owners revoke Gemini’s access to certain apps, like Messages, and someone later tries to send an SMS via Gemini on the lock screen, the chatbot will prompt the user to open the relevant app. Selecting "Continue" prompts the user to enter the correct PIN to access messages. However, when “Continue” is pressed simultaneously with Gemini’s “Add attachment” button, the device will then allow unauthenticated users to send that SMS via Gemini, without needing to enter a PIN. From there, users can enable Gemini’s access to other apps, which were previously disconnected from Gemini in the user’s Settings, by invoking the relevant prompt. For example, to allow Gemini access to WhatsApp, users can enter “@WhatsApp” in the Gemini text window. No PIN needed. You can then check this has worked by going back into user Settings, after entering a correct PIN, and it will show that WhatsApp is connected to Gemini without completing the expected authentication step. Exploiting the flaw requires physical access to a device. In most circumstances, we steer clear of giving this type of vulnerability too much airtime since it is often difficult to pull off in real-world scenarios. If Windows, for example, had a make-me-admin bug that required the attacker, for whatever reason, to have physical access to the keyboard connected to the Windows machine, then the owner of said machine has bigger problems than the vulnerability itself. However, given the state of phone theft crime, especially in the UK, and the potential to send convincing SMS messages as part of fake kidnapping scams, to name one possibility, we think this one deserves some attention. A Google spokesperson told us this is a known bug and it has already implemented a fix that was scheduled for a full deployment this week. They also said the bug is not Pixel-specific, after some claimed that they could not reproduce it on Samsung devices, but fell short of specifying which manufacturers, models, or versions are vulnerable. ®

The operator of the .ME domain registry has confirmed that Telegram's t.me shortlinks stopped working for around a day while the messaging platform verified that links associated with a sanctioned VPN service had been removed. The US Office of Foreign Assets Control (OFAC) designated First VPN Service (1VPNS) on July 13 for selling services to ransomware groups and other cybercriminals. Shortly after, users across the app reported problems with t.me links, which Telegram uses to share links to channels, groups, and profiles. Founder and CEO Pavel Durov publicly asked the .ME domain registry to look into it and Domain.Me confirmed the issues were related to OFAC sanctions. "The .ME Registry works closely with law enforcement to monitor and mitigate issues across the .ME domain in accordance with applicable laws, including sanctions requirements," Domain.Me stated via X. "On 13 July, 1VPNS was included as a sanctioned entity by the US Department of the Treasury. A Telegram channel using the t.me domain was among 1VPNS identified infrastructure. Accordingly, the t.me domain was suspended. "On 14 July, Telegram provided confirmation that it had removed its links and affiliations with 1VPNS. Once the confirmation was reviewed and verified, the suspension was removed from the t.me domain. "We appreciate Telegram's prompt cooperation in resolving this matter." The registrar did not specify which Telegram channel or group was identified as 1VPNS infrastructure. However, given that the service ran its own Telegram channel/account, and that group had its own t.me link that was also included verbatim in OFAC's sanction announcement, it seems likely that this was the reason for the domain-wide disruption. After European law enforcement agencies took 1VPNS's infrastructure offline in May, authorities said the service, whose administrator was based in Dnipro, Ukraine, had been used by at least 25 ransomware groups, including Avaddon, for network reconnaissance and intrusions. Edvardas Šileris, head of Europol's European Cybercrime Centre, said at the time: "For years, cybercriminals saw this VPN service as a gateway to anonymity. They believed it would keep them beyond the reach of law enforcement. This operation proves them wrong. "Taking it offline removes a critical layer of protection that criminals depended on to operate, communicate, and evade law enforcement." According to the FBI, which supported the France and Netherlands-led takedown, 1VPNS was advertised almost exclusively on criminal dark web forums and used for activity beyond ransomware. The service allegedly enabled scammers, botnet traffic, denial-of-service attacks, scanning operations, and more since it began operating around 2014. OFAC designated 1VPNS and its administrator, Dmytro Rashevskyi, on Monday. It also sanctioned Yevgeniy Vladimirovich Silayev for selling cryptors – tools designed to disguise ransomware and other malware so they evade detection by security software. The announcement of the sanctions stated that ransomware groups used both services, causing billions of dollars in losses to US businesses and critical infrastructure providers. Gene Lange, senior counselor to the Secretary of the Treasury, who is also performing the duties of the Under Secretary for Terrorism and Financial Intelligence, said: "Under President Trump's leadership, Treasury is using every available tool to disrupt the cybercriminal ecosystem and protect the American people. "We will continue targeting the actors who enable ransomware attacks against Americans and our critical infrastructure." ®

PWNED Welcome back to PWNED, the weekly column where we gather lessons from organizations that didn’t take security seriously enough. This week’s tale of woe comes from a company that left a door wide open for miscreants, but was lucky it didn't have to pay the price. Have a story about someone leaving a gaping hole in their network? Share it with us at pwned@sitpub.com. Anonymity is available upon request. Our story comes courtesy of a reader we’ll Regomize as Manny. A few years ago, Manny got a job working at a law firm. The firm used him to replace an entire team, making him the de facto IT department all by himself. He soon discovered that all of the company’s data and applications lived in one large web-based interface, which was divided up based on the type of client. So there were areas in the UI for personal injury cases and others for travel refunds, for example. There was just one big, gaping security hole: a master password that allowed you to log in as any user in the system. If you had this password, which many people in the law firm did, you could grab detailed personal information about any client, even their health records. “I immediately raised this as a huge security risk,” Manny told us. “But I was told, 'Oh that's the admin password, everyone uses it. Don't touch it.'” As long as you had the person’s email address that you wanted to impersonate, this password would allow you to impersonate them. This applied to both staff and clients. “Colleague is off sick? Sign in as them and reassign their work to someone else to complete. Client forgot to fill in a field? Log in as them and complete it for them,” Manny said. The system itself was 15 years old, ancient in tech terms, and it desperately needed replacing. So Manny was asked to build a whole new system. Naturally, he refused to add a back door, even though that’s what the boss wanted. “I point blank refused to add any back doors to it,” Manny recalled. “So they promoted every user to a system admin and carried on, business as usual.” What we can take away from Manny’s experience is that sometimes even the best IT people who know security basics can still be hindered by clueless management. We also know that sometimes in order to pay the bills, IT people have to go along with security practices they strongly disagree with. In the end, the boss will have the final word, even if that word is “ignorance.” ®

The crippling high-consequence attack on vital infrastructure that cybersecurity experts have warned about for years is upon us, in the form of an incident that may force KFC to close some stores in Japan. Colonel Sanders himself is not the victim here. That role goes to Nichirei Group, a Japanese purveyor of frozen foods and super-chill logistics services that move them around. Nichirei Group on Monday posted a notice in which it admitted “system failures caused by unauthorized access have occurred.” The failures meant the frozen food concern could not arrange shipments to or from its refrigerated warehouses or conduct its other operations. Shortly after Nichirei Group revealed its difficulties, KFC Japan warned customers that delivery of ingredients to its stores would likely be affected. The chicken chain therefore stopped taking orders through its app and website and said it may need to limit menu items and opening hours. “Some stores may be closed depending on the availability of ingredients,” the company said. On Wednesday, Nichirei Group confirmed the cause of the outage was a cyberattack and admitted attackers accessed a server that stores personal information. The Group declined to offer any detail on the incident “to prevent further damage.” The company hopes to resume operations on Friday. That Nichirei Group is unable to provide some services suggests a ransomware attack has made some data unavailable. The mention of “further damage” suggests that discussing whatever happened could divulge clues about security weaknesses that would allow further attacks, perhaps directed at the Group’s clients. KFC Japan hasn’t posted any information about store closures. Indeed, the company continues to promote summer menu items such as a Japanese-style citrus and chicken combo that the chain says is refreshing to eat even in the heat of summer. The Register’s Asia-Pacific bureau will not venture to Japan to assess the impact of this incident, or try the burgers: At times like this, with critical infrastructure under stress, that’s just the right thing (not) to do. ®

The US Cybersecurity and Infrastructure Security Agency (CISA) has urged all organizations running SharePoint to harden their defenses after the disclosure of actively exploited vulnerabilities. The warning applies to those running any supported version of SharePoint Server on-prem, with three vulnerabilities of particular interest cited. A spoofing bug, CVE-2026-32201 (6.5), was the first to be mentioned. Microsoft disclosed it in March and CISA confirmed it was being actively exploited in June. Additionally, CISA appears concerned by CVE-2026-45659 (8.8) – a remote code execution (RCE) flaw made public in June and confirmed as being actively used in attacks last week after Microsoft said exploitation was "less likely." The most recent of the three, CVE-2026-56164 (5.3), a privilege escalation flaw, was one of the 622 bugs that featured in this month's record Patch Tuesday. CISA also picked out two more critical bugs, both from the latest Patch Tuesday, as ones that could potentially complicate SharePoint security further. Neither CVE-2026-55040 (9.1) nor CVE-2026-58644 (9.8) is being actively exploited to date, although Microsoft has attached the "Exploitation More Likely" label to both. CISA said the three exploited vulnerabilities are associated with post-exploitation activity, including the theft of Internet Information Services (IIS) machine keys and deserialization techniques, both in an effort to gain persistence and deploy malware. The agency did not offer any more detail about what led it to issue the warning, but went on to encourage defenders to review an alert it published in August 2025, which similarly urged organizations to harden SharePoint from "ToolShell" attacks. CISA said attackers were chaining together CVE-2025-49706 (6.5) and CVE-2025-49704 (8.8) to break into SharePoint Servers and, in some cases, deploy Warlock ransomware. It did not go as far as attributing the activity referenced in either SharePoint advisory to any group or country, although Microsoft said as far back as July 2025 that ToolShell vulnerabilities were being exploited by Chinese nation-state crews. Applying Microsoft's latest security patches and verifying that Antimalware Scan Interface (AMSI) integration is enabled for each SharePoint web application are among the recommended hardening measures. CISA also advised defenders to go threat hunting for signs of intrusion before rotating IIS keys to avoid exposing SharePoint to the web unless it's necessary and block external access to SharePoint Central Administration. As is the case with any potential intrusion, CISA encouraged organizations to implement robust, tailored logging that can detect potential exploits. ®

UPDATED: Microsoft’s worst nightmare - a prolific zero-day vulnerability hunter who calls themselves Nightmare Eclipse - published yet another zero-day on Tuesday, a vulnerability allowing attackers to mount user hives, including partial exploit code. Suspected of being a disgruntled former Microsoft engineer, based on the sophistication of their prior vulnerabilities, NightmareEclipse came good on their promise to release another zero-day on July 14. Whether it lives up to the promised “bone-shattering” standard touted in June is up for debate, however. Called “LegacyHive,” the proof of concept (PoC) code for the zero-day local privilege escalation (LPE) vulnerability targets Windows’ user hives - the section of the Windows Registry that stores a user's specific desktop settings, application preferences, and environment configurations. The code exploits a weakness in profsvc, the Windows User Profile Service, and the way in which it loads hives. If exploited correctly it could grant regular users privileged read-write access to target other users' hives. Matei Badanoiu, lead security researcher at Pentest-Tools.com, said that while the exploit could prove useful for attackers who had already gained a foothold in a target environment, it falls short of providing a fuller system compromise. “What caught my attention is the difference between what the public proof of concept actually demonstrates and what a full compromise would require,” he told The Register. “LegacyHive is a local privilege escalation in the Windows User Profile Service. It abuses arbitrary registry hive loading, so a standard user can mount another user’s hive, including an administrator’s, into their own classes root. “For an attacker who already has a foothold, that is a genuinely useful primitive. Bundling it with credential access and persistence into ‘full compromise’ is more of an ambition than the released code.” The LegacyHive publication differs from some of NightmareEclipse’s earlier drops in that the PoC code is stripped back in an effort to prevent widespread exploitation. According to the bug hunter, there is more than one way of exploiting the profsvc flaw. The public PoC requires additional user credentials for it to work, and is limited to the usrclass.dat hive. NightmareEclipse said the original PoC, which differs from the one they published, does not require additional user credentials to exploit the bug, and it works beyond the usrclass.dat hive, “but you would need some brain cells to make the PoC do it.” This represents a divergence from NightmareEclipse’s previous approaches. As Badanoiu pointed out to us, some of NightmareEclipse’s earlier drops, such as BlueHammer and RedSun, went from PoC to widespread exploitation within days. LegacyHive, however, comes without a fully working PoC and a CVE identifier. Regardless, security experts told The Register that cyber practitioners should respond promptly since capable attackers could probably build a reliable exploit, despite the gaps left in the PoC by NightmareEclipse. “Threat intelligence teams are advised to act with some urgency here,” said Dray Agha, senior manager of security operations at Huntress. “Huntress observed NightmareEclipse's prior LPE and defence evasion tools rapidly deployed threat actors and ransomware groups shortly after publication. “Given this history, we’d expect that capable actors will reverse-engineer the missing components of the LegacyHive PoC to build fully weaponized versions in short order.” The timing NightmareEclipse may have changed their approach to releasing full working PoCs to the public, perhaps a reflection of Microsoft’s suggestion of preparing legal action against the bug hunter, but the nuisance timing of the vulnerability disclosures remains. They dropped the details for LegacyHive shortly after Microsoft released its monthly Patch Tuesday updates, which contained an unprecedented 622 fixes. Agha said timing the disclosure in this way maximizes the exposure window before a patch can be developed, causing more trouble for Microsoft. The Register asked the Windows-maker about LegacyHive and whether it was planning to release a fix before August’s patches. NightmareEclipse claims their latest zero-day works against Windows machines that are fully patched according to July’s fixes. Microsoft previously issued a quiet remedy for one of NightmareEclipse’s earlier zero-days, RoguePlanet, last week, although the company did not go into any details about what the mitigation entailed. ® Updated to add on July 16: A Microsoft spokesperson got in touch with The Reg to say is is: "aware of the reported vulnerability and is actively investigating the validity and potential applicability of these claims." They added: "Microsoft is committed to investigating security issues and updating impacted products to protect customers as soon as possible. Importantly, we support coordinated vulnerability disclosure, an industry standard that protects customers and supports the research community by ensuring their findings are thoroughly investigated and addressed before being made public."