Plus, why consumer confidence matters as much as consumer inspiration. https://www.adweek.com/brand-marketing/why-ai-can-never-replace-great-agencies-ft-andy-lopez-cmo-of-behr-paint/
Japanese software company Helpfeel is notifying users of its Gyazo image-sharing service that hackers have accessed their information.
Gyazo is a widely used cross-platform tool that lets users capture screenshots, GIFs, or short screen recordings and instantly generate shareable links.
Helpfeel revealed this week that it recently detected unauthorized access to Gyazo servers. A hacker exploited a vulnerability in its image upload server on September 11, enabling them to execute malicious commands.
The attacker was kicked out the next day, but not before accessing a database storing roughly 23.6 million user records.
The compromised Gyazo user information includes names, email addresses, password hashes, user and device IDs, X integration tokens, profile information, usage statistics, and billing information.
Payment card information was not compromised, according to the vendor.
“The approximately 23.62 million affected records include records for anonymous accounts with no registered email address or similar information. We are continuing to determine the actual number of individuals whose personal information was disclosed without authorization,” Helpfeel said.
In addition to the user records, the attacker accessed roughly 490 million image metadata records. This metadata includes information that could allow threat actors to reconstruct and access URLs associated with images uploaded by users.
A list of private images has also been compromised, but the company has not shared any information on volume.
Related: Brevo Supply Chain Attack Injects Malware Into 100,000 Websites
Related: Revolut Data Breach: 5 Months, 680 High-Profile Accounts, $3M Ransom
Related: 280,000 Impacted by Premier Medical Group Data Breach
https://www.securityweek.com/23-million-user-records-compromised-in-gyazo-data-breach/
Microsoft released patches for 18 vulnerabilities on Thursday, spanning its Azure cloud portfolio and Copilot-branded AI products.
Elevation of privilege flaws made up the bulk of the disclosures, affecting Azure ARC, Azure AI Foundry, Azure Logic Apps, Azure Billing, Azure HorizonDB, Azure Cosmos DB, Azure Container Registry, Microsoft Fabric, Microsoft Dataverse, and Microsoft 365 Copilot.
Several information disclosure vulnerabilities were addressed in Copilot, Microsoft 365 Copilot, Microsoft 365 Copilot Business Chat, and Azure Machine Learning. A single spoofing vulnerability was patched in Azure Portal.
Microsoft rated all vulnerabilities as critical, but their CVSS scores indicate high or medium severity for some.
While some of these flaws were discovered internally by Microsoft, many were reported to the software giant by external researchers.
None of the vulnerabilities have been flagged as exploited, and Microsoft noted that all fixes were implemented on the server side, meaning that customers do not need to take any action.
Microsoft also announced patches this week for a privilege escalation vulnerability affecting Windows. Users do need to update Windows to resolve this flaw, tracked as CVE-2026-85921, but Microsoft believes exploitation is ‘less likely’.
Like most major organizations, Microsoft has seen vulnerability discovery surge in recent months, driven by increased use of advanced AI. The company fixed a record-breaking 970 vulnerabilities across its products with the latest Patch Tuesday updates.
Related: Microsoft Commits to Sweeping AI Privacy Rules for Students. Will Other Tech Giants Follow?
Related: Microsoft AI Code of Conduct Sets Cyberattack Boundaries, Chain of Command, Safety Constraints
Related: New ‘ShieldCrash’ Zero-Day Exploit Targets Microsoft Defender
https://www.securityweek.com/microsoft-patches-18-vulnerabilities-in-ai-cloud-products/
Disney names Adam Smith new DTC boss. https://www.adweek.com/convergent-tv/disney-continues-leadership-shifts-with-streaming-shakeup/
The cafe chain’s brand chief Tressie Lieberman on rebuilding Starbucks through fandom, consistency, and participation. https://www.adweek.com/brand-marketing/3-ways-starbucks-is-reclaiming-its-brand-magic/
NightmareStresser, one of the longest-running distributed denial-of-service (DDoS) for-hire services in the world, has been disrupted.
The US Department of Justice announced this week that the FBI has seized the internet domains associated with the booter service.
Visitors to nightmare-stresser[.]com and nightmarestresser[.]org are now served a seizure banner.
Authorities said NightmareStresser had been active since at least 2022 and was used to launch hundreds of thousands of DDoS attacks against victims worldwide.
However, security researcher Alex Carter reported last year that NightmareStresser was likely founded in 2016 and became popular in 2018, after rival services were disrupted, becoming the largest DDoS tool in 2019.
By 2025, it had grown to nearly 1 million users. It could launch between 3,000 and 4,000 attacks per hour, accepted cryptocurrency payments, but avoided government, education, and hospital domains.
The NightmareStresser takedown was part of Operation PowerOFF, a coordinated global effort to dismantle DDoS-for-hire infrastructures globally and hold the individuals behind these services accountable.
DDoS-for-hire services, also referred to as booters or stressers, have been proliferating over the past years, as they represent low-entry barriers for cybercriminal-wannabes, the DoJ notes.
Over the past eight years, the US charged 12 DDoS attack facilitators and seized over 100 domains associated with booter services.
In April, law enforcement agencies in 21 countries disrupted 53 domains associated with DDoS-for-hire services. Last year, the US disrupted the RapperBot DDoS botnet, and 27 websites linked to booter services were seized in 2024.
In addition to disrupting DDoS-for-hire infrastructure, law enforcement agencies have been tracking and charging both the administrators and the users of these services.
Related: 23-Year-Old Sality P2P Botnet Disrupted
Related: US Disrupts Chinese Hacking Platform Used in Military and Critical Infrastructure Attacks
Related: Google, FBI Disrupt NetNut Residential Proxy Network Powered by Millions of Devices
Related: 15,000 WordPress Websites Cleaned Up in SocGholish Botnet Takedown
https://www.securityweek.com/nightmarestresser-ddos-service-disrupted-in-international-operation/
At Dreamforce, brands dish on unrealistic agentic AI goals—and why the future of AI agents still needs plenty of humans. https://www.adweek.com/media/ai-agents-get-a-reality-check-att-and-crocs-want-automation-but-still-need-humans-in-the-loop/
A critical-severity vulnerability in Orkes Conductor that can be exploited without authentication has been in attackers’ crosshairs for at least a month.
Conductor is an open source unified enterprise framework that allows organizations to orchestrate microservices, workflows, and AI agents.
Tracked as CVE-2026-58138 (CVSS score of 9.8), the critical bug is described as a remote code execution issue exploitable via inline workflow definitions submitted to the workflow API endpoint.
Attackers can include malicious JavaScript or Python expressions in the definitions to invoke arbitrary system commands. The flaw affects how Conductor runs scripts inside a workflow.
“An INLINE task (and LAMBDA, DO_WHILE, and SWITCH tasks) evaluates a user-supplied JavaScript or Python expression, and Conductor builds that evaluator on a GraalVM context configured with HostAccess.ALL,” Empirical Security explains.
This configuration disables the sandbox, and the attacker-supplied code reflects into the Java runtime and executes OS commands as the Conductor process, which often runs with root privileges.
“No login stands in the way, because the open-source server enforces no authentication by default and leaves its workflow API open. A single unauthenticated POST registers a workflow with a hostile INLINE task and starts it,” Empirical notes.
CVE-2026-58138 was patched in June in Orkes Conductor version 3.30.2. Proof-of-concept (PoC) code targeting it was published in early August, and exploitation started shortly after.
Empirical identified in-the-wild attacks on August 21, and Fortinet blocked roughly 1,300 exploitation attempts between September 8 and 9. This week, Fortinet released an outbreak alert on the vulnerability’s ongoing exploitation.
In addition to updating to Conductor 3.30.2 or later, organizations should restrict external access to Conductor’s workflow API endpoints and ensure Conductor deployments are behind a firewall and that their services are not directly exposed to the internet.
They should also monitor their instances for suspicious workflow submissions and unauthorized command execution, and review systems running vulnerable versions for signs of intrusion.
Related: Check Point, Kaspersky, Tanium Patch Product Vulnerabilities
Related: CISA Retires Weekly Vulnerability Bulletin in Risk-Based Pivot
Related: ISC Patches 14 Vulnerabilities in BIND 9 Security Update
Related: Cisco Fixes Dozens of Flaws Across FMC, ISE and Nexus Dashboard
https://www.securityweek.com/critical-orkes-conductor-vulnerability-exploited-in-attacks/
Il 18 e 19 novembre l’Auditorium della Tecnica di Roma ospita la 24ª edizione del Forum ICT Security. Traccia unica, ottocento partecipanti attesi, trenta interventi costruiti come un unico ragionamento.
Un agente di intelligenza artificiale legge un database aziendale, si collega a un servizio esterno e invia una comunicazione. Nessuno ha rubato credenziali, nessuno ha violato il perimetro: ogni singola operazione era autorizzata. Eppure, messe in fila, quelle operazioni hanno portato dati riservati fuori dall’azienda.
Chi ne risponde?
La domanda attraversa entrambe le giornate del Forum ICT Security 2026, e non è retorica. Dopo il recepimento della NIS2, approvare le misure di gestione del rischio è un obbligo personale dell’organo di amministrazione, e i primi procedimenti stanno arrivando.
Anche quest’anno la traccia è unica: nessuna sessione parallela, nessuna scelta da fare tra due interventi in contemporanea. Chi entra segue lo stesso percorso dall’inizio alla fine, e ogni intervento riprende il tema di quello precedente.
Si apre con una tavola rotonda sui primi procedimenti avviati in applicazione della NIS2, moderata dall’avvocata Laura Liguori. Al tavolo Francesco Cajani, Sostituto Procuratore presso il Tribunale di Milano; Donatella Curtotti, ordinaria di Diritto processuale penale a Foggia; Alessandra Michelini, amministratrice delegata e presidente di Telsy; Paola Rocco, Group Chief Security Officer. Un magistrato, una giurista, un vertice aziendale e chi la sicurezza la costruisce ogni giorno: quattro prospettive su cosa accade quando la responsabilità smette di essere teorica.
Fabio Roli, dell’Università di Genova, misura poi la distanza tra quello che la ricerca sa verificare oggi e quello che gli standard europei chiederanno di certificare domani. Gianni Amato del CERT-AgID spiega cosa cambia con la revisione di luglio del Model Context Protocol, il protocollo attraverso cui gli agenti usano strumenti e servizi esterni: nuove funzioni, e con esse nuovi modi di abusarne. Mario Trinchera, CISO di ABI Lab e coordinatore tecnico del CERTFin, usa i dati delle frodi bancarie per spiegare perché la formazione tradizionale non protegge da attacchi costruiti sulla singola vittima.
Il pomeriggio scende lungo le difese, uno strato alla volta. Mirko Lapi apre con una funzione aziendale che quasi nessuno ha ancora costruito: quella che riconosce la manipolazione informativa prima che arrivi alle decisioni. Giovanni Cherubin, di Microsoft, spiega perché quasi tutte le protezioni contro prompt injection e jailbreak sbagliano per costruzione, essendo fondate su classificatori che possono sempre essere ingannati, e ne presenta una di tipo diverso. Mario Cartia affronta il momento più esposto del ciclo di vita del dato, quello in cui viene elaborato su un’infrastruttura che l’azienda non controlla. Alberto Manfredi, presidente di Cloud Security Alliance Italy, presenta lo standard che intercetta le azioni di un agente prima che vengano eseguite. Roberto De Paolis racconta come si mette alla prova l’intelligenza artificiale dentro un grande gruppo industriale, simulando attacchi contro i propri sistemi.
Chiude Luciano Quartarone, vicepresidente di UNINFO, con la frase che riassume la giornata: l’operatività si delega, la responsabilità no.
Il 19 novembre si apre sul Mediterraneo, con una tavola moderata da Paola Girdinio. Ci sono Luisa Franchina per le infrastrutture critiche e Matteo Paroli per l’autorità portuale del Mar Ligure Occidentale. Ci sono Elio Rubino di Elettra Tlc e Davide Taddei di Prysmian, cioè chi i cavi sottomarini li progetta, li posa e li ripara. E c’è Alessio Merlo, Direttore Accademico del Centro Alti Studi per la Difesa, che studia come si manipolano i radar delle navi. Al centro una domanda che non si scioglie in fretta: come si distingue un guasto da un sabotaggio?
Seguono la rete elettrica, che è insieme un bersaglio e una dipendenza da cui nessun altro settore può prescindere; lo spazio come nuovo perimetro della sicurezza italiana; e il Cyber Resilience Act, che dal 2026 impone requisiti obbligatori a chiunque venda prodotti con componenti digitali.
Il pomeriggio è il più concreto delle due giornate. Alessandro Brucato presenta i risultati di oltre ottocento attacchi condotti da dieci modelli di intelligenza artificiale contro un ambiente cloud reale, per misurare quanto velocemente arrivano al bersaglio. Fabrizio Baiardi e Vincenzo Sammartino mostrano come si simula un attacco su una copia digitale dell’infrastruttura, senza toccare i sistemi in produzione. Stefano Maccaglia ricostruisce un attacco ai controller di un impianto industriale che non registrava nulla, dove ritrovare le tracce somiglia più all’archeologia che all’analisi forense. Roberto Froio racconta un caso in cui il ransomware arriva fino ai backup: a quel punto il problema non è più recuperare i dati, ma stabilire quali sistemi siano ancora affidabili.
La giornata si sposta poi sulla sanità, con Stefano Scaramuzzino, CISO della ASL Roma 1, sulla continuità delle cure quando i sistemi si fermano. Dal reparto si passa al consiglio di amministrazione, con Selina Zipponi. Chiude Nicola Sotira, responsabile del CERT di Poste Italiane, sulla crittografia post-quantum: l’unico intervento dedicato a un problema che deve ancora arrivare, e che proprio per questo impone di muoversi adesso.
In sala ci sono CISO, responsabili di rischio e dirigenti, pubblici e privati, insieme a una presenza rilevante di forze dell’ordine e mondo della difesa.
La manifestazione ha un’applicazione web dedicata, accessibile con la semplice registrazione all’evento. Alcune funzioni si attivano al momento dell’accesso in sede: da lì si inviano le domande ai relatori dopo ogni sessione, si lascia un giudizio sui singoli interventi, si fissano incontri riservati e si scaricano i materiali al termine delle due giornate.
Le iscrizioni al Forum ICT Security 2026 sono aperte: https://eventi.ictsecuritymagazine.com/eventi/forum-ict-security-2026
https://www.ictsecuritymagazine.com/notizie/forum-ict-security-2026-evento/
The company will use the funding to accelerate platform development and expand its presence in key enterprise markets.
The post MIND Secures $72 Million for AI-Powered DLP appeared first on SecurityWeek.
https://www.securityweek.com/mind-secures-72-million-for-ai-powered-dlp/