Security researchers affiliated with Austria's Graz University of Technology have found flaws in the implementation of file notification systems on Android, Linux, macOS, and Windows that leak potentially compromising system information. "We found decades-old bugs on [these operating systems], all rooted in the file-notification subsystems that every modern OS ships to inform applications when files change," said Sudheendra Raghav Neela, a doctoral student at TU Graz, in an email to The Register. Affected systems include inotify on Linux since 2005, FileObserver on Android since 2008, ReadDirectoryChangesW on Windows since 2000, and FSEvents on macOS since 2007. These file notification subsystems tell the operating system when a file has been opened, changed, written, or deleted. They don't reveal file contents. But file event information functions as a side channel that allows a malicious user to infer the activities of other users of the computer. Armed with file event data, an attacker may be able to conduct inter-keystroke-timing attacks that reveal user input (not only locally but remotely over SSH), website fingerprinting attacks that reveal website visits, and UI redress attacks that allow credential theft. Neela and colleagues Xufan Zhao, Jeanette Angelika Wultsch, Hannes Weissteiner, Florian Draschbacher, Stefan Gast, and Daniel Gruss describe their findings in a paper titled "File Notification Attacks: Templating and Exploiting Side-Channel Leakage from the File-Notification Systems on Linux, Windows, and macOS." The paper, summarized at inoti.fyi, says the basic problem is that unprivileged users can access the file notification subsystem and that on Linux and Windows file information is available even without read access. The attack scenarios mostly involve a local attacker who has access to an account with files that can be read by multiple users. The researchers however note that the list of globally readable files is extensive. Neela said, "On Linux, watching a readable directory leaks events on files inside it you cannot even read: watching /dev/input gives a notification on every keystroke, which we turn into a local inter-keystroke timing attack with a 93.1–100 percent [keystroke accuracy] score across seven users and a remote (SSH) one at 100 percent." He added that the group also carried out an authentication-prompt redress attack on KDE Plasma 6 under Wayland, and website fingerprinting on the top 100 sites at 87.9 percent. The Linux vulnerability (CVE-2025-68788) was partially fixed in December 2025 in kernels 5.10.248, 5.15.198, 6.1.160, 6.6.120, 6.12.64, and 6.18.3. The patch prevents the generation of "access" and "modify" events on special files in /dev/. "On Android, FileObserver goes past the FUSE layer meant to isolate per app storage, so a permissionless app can watch (for example) WhatsApp's private folder and see, by filename and timestamp, exactly when photos, videos, and documents are sent, received, or deleted," said Neela. Though the researchers claim that they responsibly disclosed their findings to security teams for Linux, Android, Windows, and macOS between August and October 2025, no mitigation appears to have been made for Android devices. Apple's macOS provided the least information because no bypasses were found for reading private directories. But FSEvents still allowed the monitoring of various file changes that show up in .plist files. These include audio input and output changes, power settings changes, Bluetooth device and printer updates, network cable-initiated DNS changes, and volume mount/unmount events. Application installations and removals can also be observed. "On Windows, watching the root directory C:\ reports the full path of every file touched anywhere on the system, across all users, regardless of permissions, enough to track which websites on Firefox another user visits in real time at a 97.8 percent [accuracy] score," said Neela. "Microsoft told us this is 'by-design' and that it's an undocumented feature. This response was nominated for the lamest vendor response at the Pwnie Awards 2026." The authors argue that file-notification attacks affect all major operating systems and that further mitigations are needed. They note that despite the protection for device files that has been implemented already, capability checks should be extended to monitoring one's own files and to any readable file. "On Windows, we propose disallowing the monitoring of entire drives," they state in their paper. "On Windows and macOS, the kernel could introduce a permission system (for context, access control, owned files and directories, minifilters)." The researchers' paper is scheduled to appear at ACM CCS 2026 this November in The Hague, Netherlands. ®
Canonical is speeding up Ubuntu kernel releases to one a week as AI-assisted bug hunting helps bury defenders under an ever-growing pile of CVEs. The Ubuntu maker is overhauling how it ships kernel Stable Release Updates (SRUs), replacing its current four-week regular and two-week security cycles with overlapping two-week cycles that will push a kernel release every week. Canonical says the change is needed because the number of reported vulnerabilities has exploded, with AI deserving some of the credit – or blame, depending on which side of the patch queue you're sitting. "Large language models (LLMs) and specialized AI agents have transformed bug discovery from a manual, time-intensive process into a highly automated engine," Canonical said on Wednesday. AI isn't solely responsible for the CVE avalanche. The upstream Linux kernel community became a CVE Numbering Authority in 2024 and began assigning identifiers to thousands of bugs on the basis that almost any kernel flaw affecting a running system could have security implications. Put the two together, and Linux vendors have far more CVEs to deal with. Canonical says the resulting backlog requires faster releases to shrink the window between vulnerabilities becoming public and patched kernels reaching users. Under the new system, each SRU cycle lasts two weeks, but a new one starts every week. The first week is spent integrating patches, preparing and building kernel packages, and carrying out basic checks to make sure nothing catches fire. By the end of that stage, release candidates are published to Ubuntu's -proposed pocket. Week two is reserved for the heavier stuff, including hardware certification, distro integration, and regression testing. Once that's done, the kernel is released. Because the next cycle starts while that testing is under way, Canonical can publish another kernel the following week. For admins who consider even that too leisurely, there's a faster route. Organizations particularly sensitive to patching delays can take release candidates from the -proposed pocket after the first week and run their own acceptance tests. Canonical makes the trade-off clear: those users get access to fixes sooner, but before the company has finished its extensive certification testing. That can make kernel CVE fixes available within a week, provided customers are willing to perform some of the testing themselves. Canonical also wants to leave customers less exposed between disclosure and patch availability. It aims to provide safe workarounds where possible, or recommend general hardening measures where none exist, putting systems into what it calls a "defensible, safer state" within 24 to 48 hours of public disclosure. Those measures are not intended to replace patching, merely to give admins something better than crossing their fingers while a fix makes its way through the release process. The end result is a considerably busier kernel release schedule, although perhaps that's inevitable when machines are increasingly being enlisted to find bugs faster than humans can patch them. AI was supposed to make everyone's jobs easier. Ubuntu's kernel team may want a word. ®
In response to the emerging threat of rogue and shadow AI agents, here’s how the newly formed Blueprint Alliance seeks to help businesses secure their systems against anomalous AI activity.
The "third-party[.]com" domain, commonly used as a documentation placeholder, has been observed serving a ClickFix lure to Windows browsers while displaying a harmless decoy to other users.
"third-party[.]com has been a generic documentation placeholder for years, the same role example.com plays," Manifold Security's Head of Research, Ax Sharma, said. "Unlike 'example[.]com,' third-party[.]com
Asus has warned eShop customers that an intruder got into part of its online store and may have helped themselves to contact details and order records. The PC maker disclosed the incident in an email sent to customers, first reported by KitGuru, in which it said had identified "unauthorized access to part of the Asus eShop environment," although exactly when that access occurred remains unclear. "Our investigation indicates that certain customer order information, including contact details and order records, may have been accessed," the company said. There is at least some good news for anyone who has handed Asus their card details. The company said no payment card, bank account, or other financial information was involved in the breach. Asus also said it isn't currently aware of the compromised information being misused or of any affected customers suffering harm. The company said it took steps to contain the incident after discovering the unauthorized access, launched an investigation, and introduced additional measures to secure the affected systems. That investigation remains ongoing, but Asus said it had found no evidence of continued unauthorized access. What Asus hasn't said is how many customers are caught up in the mess, when the intrusion began, how long the attacker had access, which countries are affected, or how whoever was behind the break-in managed to get into the eShop environment in the first place. The details that did escape, however, could give scammers a decent head start. Asus warned that the stolen details could give scammers enough to make phishing emails, texts, and phone calls about its products or customers' orders look rather more convincing. Asus told customers to keep an eye out for unexpected messages mentioning previous purchases, though it reckons the risk of anyone actually misusing the data remains low. This isn't the PC maker's first recent brush with data thieves. In December, Asus confirmed that one of its suppliers had been hacked after the Everest ransomware gang claimed to have pinched 1 TB of data from itself, ArcSoft, and Qualcomm. The company said the haul included some camera source code used in its phones, but maintained that its own systems and customer data were untouched. The Register asked Asus for more details about the latest breach, including how many customers were affected and when and how the intrusion occurred, but has not yet received a response. Asus is yet to comment publicly on the incident, and there is no mention of the breach on its eShop. So it's the usual post-breach drill: beware unexpected emails, texts, and calls. Except this time, whoever's behind them may have the receipts. ®
An active ClickFix campaign has been observed compromising legitimate Ukrainian business websites to inject bogus Cloudflare verification pages and trick victims into downloading a previously undocumented information stealer called Psychedelic.
"When a visitor interacts with the page, the lure copies a Windows Installer command to the clipboard and instructs the visitor to paste it into the
Google has jumped on the AI-defense-for-critical-systems train with its Scan for Good initiative, and says that its threat-hunting models have already autonomously uncovered critical security issues at hospitals, a municipality, a public rail operator, and major technology providers. So don't fear these bots. The initiative, announced on Thursday, uses Google’s Gemini 3.8 Flash Cyber, a version of the model tuned for software bug hunting and remediation, and Wiz’s Red Agent - this is the Google-owned cloud security shop’s pentesting AI agent. The AI systems will uncover public exposures and attack paths across public services, critical infrastructure, and nonprofits, and then hand these off for verification and remediation to human security researchers. “The program has been active over the past several months, and with this official launch, we are scaling it globally,” Gal Nagli, head of offensive security at Wiz, told The Register. “There is no set end date.” It's similar to OpenAI’s Daybreak for Frontline Defenders initiative, announced earlier this month. This program will distribute $1 billion in credits to subsidize access to OpenAI services and training for resource-strapped cyber defenders, including those protecting water and energy systems, community banks, local governments, nonprofits, and open-source projects. And like OpenAI’s new program, the Wiz and Google DeepMind partnership follows disclosures that Google’s AI agents also escaped their sandboxes and hacked other companies’ websites - as did agents developed by OpenAI, Anthropic, and Meta, and those are just the ones we know about. It also comes as existential dread about AI killing all of humanity reaches a fever pitch. AI for good (not evil) Scan for Good aims to put offensive security agents and Gemini 3.8 Flash Cyber to good, not evil, use. When authorized, either explicitly by organizations that apply for an assessment or under applicable bug bounty programs and vulnerability disclosure policies, the AIs will examine publicly facing websites, APIs, and applications for exposures, and then work with organizations to find and fix these. Every potential finding will be reviewed and validated by a human, and Wiz assures that “humans will remain responsible for confirming impact and making disclosure decisions.” When the bots and humans do identify a serious issue, the humans will contact the affected organization and work with them to remediate the security holes. Google’s AI systems have already helped critical organizations and tech providers find serious, internet-facing risks, including a critical GitHub Actions workflow vulnerability in one of Snowflake’s public repositories. In this bug-hunting expedition, conducted through Snowflake’s HackerOne vulnerability disclosure program, Wiz’s Red Agent autonomously identified a script injection vulnerability in snowflakedb/snowflake-connector-net. The flaw allowed an unauthenticated user to execute arbitrary commands within a GitHub Actions runner by opening a GitHub issue with a specially crafted title. Wiz disclosed the issue on June 23, and Snowflake fixed it on the same day, rotated the affected credential, and verified through detailed audit logs that Wiz was the only actor during the exposure window. Real-world examples The Google-owned biz provided several other examples of its AI for good, and said all of these were autonomously discovered by the models before Wiz validated them, but “only far enough to confirm real-world impact.” At that point, they privately notified the affected organization about the issue and helped it remediate the vulnerability. Some of these include: An exposed administrator key enabled read, write, and delete access to 8.8 million files in a “nationally significant archive” belonging to an unnamed Middle Eastern country. Assigning the correct set of permissions fixed the flaw. A public hospital with missing access controls exposed staff contact information and gave anyone online control of a hospital-wide mobile alert channel. A private hospital’s public appointment-booking site used an unsafe upload method that would have allowed attackers to take control of a hospital server and obtain patient identifiers, clinical information, and consent signatures. A municipality’s public data service exposed sensitive personal, health, and financial information belonging to about 5,000 elderly residents. Wiz confirmed the risk without collecting a bulk dataset. A public rail operator had a leaky production database that exposed active administrator sessions. This could have allowed criminals to take control of routes, schedules, service announcements, and administrator accounts - essentially disrupting the entire transportation system. Wiz helped the operator secure the system. The US Cybersecurity and Infrastructure Security Agency (CISA) also gave Scan for Good its stamp of approval, and Wiz told us the American cyber-defense agency provided guidance on the initiative. “At a time of evolving threats, defensive vulnerability discovery helps strengthen the nation’s digital infrastructure,” CISA acting director Nick Andersen said in a statement. ®
The logistics sector has become the target of a new malicious cyber campaign that distributes an Android spyware codenamed Corp MDM.
According to Have I Been Squatted, the campaign uses fake Google Play pages branded as CEVA and TKW Logistics to distribute an Android Package Kit (APK) file that's dressed up as a system service. The delivered app has the package name "com.corp.mdm"
Corp MDM
AI coding agents are changing how quickly developers can build and ship software as well as how quickly credentials can become exposed. According to GitGuardian’s 2026 State of Secrets Sprawl Report, commits identified as AI-assisted are leaking secrets at approximately twice the rate of human-written ones. Most of the fastest-growing categories of leaked credentials are now connected to AI
The country’s prime minister expressed disappointment at being informed of the hack only via email. Now Australia is investigating whether OpenAI broke the law.
ClickFix has become the most common way attackers get into enterprise networks, and it does it without an exploit, an attachment, or a file on disk. Our new global threat report traces the technique from a novelty in late 2023 to a subscription product with on-chain infrastructure and a state-sponsored user base, and explains why blocking malicious domains is no longer a useful defense.
Read
Welcome back to PWNED, the column where we look at all the ways your security can become self-owned. Today’s scary story involves government contractors who just had to make their lives easier at the expense of locking down sensitive information. Have a story about someone leaving a gaping hole in their network? Share it with us at pwned@sitpub.com. Anonymity is available upon request. Our tale of bureaucratic hell comes courtesy of security researcher Joe Brinkley, who previously worked for a government contractor as an information system security officer responsible for firewall rule changes, plus network intrusion detection and prevention. To improve the contractor's ability to deploy program changes, some of the org's developers wanted to change the firewall rules so it would be easier to move data from a low-security datacenter where they tested new code to the classified datacenter that housed the production server and data. They wanted to be able to VPN into a low-security commercial datacenter, where other non-governmental tenants, such as Microsoft and Oracle, had servers accessible through the same VPN connection. The datacenter itself provided the VPN, not the government. Back then, in the early 2010s, developers would use a provisioning server to help deploy code from dev to production. But there was always a hard firewall between the classified datacenter and the non-classified datacenter. The developers wanted this provisioning server to be able to access all of the production servers that sat in the classified datacenter so they could more easily push the code around. When the developers suggested they make this change for ease of deploying code, Brinkley told the Change Review Board that it was a very bad idea. “It creates a very glaring issue that we are going from a low-level secured datacenter all the way up to a high-level, top secret secured datacenter for production, and you guys are opening up a firewall rule that would allow anybody from that low level datacenter to have access into, at a minimum, into the high level datacenter,” Brinkley said. However, during a week when Brinkley was on vacation, the developers who wanted this firewall change talked directly to the Change Acceptance Board and got the rule changed. When he got back, Brinkley got a member of his company and a government representative to sit down for a demonstration. Tethering his laptop to his cell phone, he logged into the dev server over the VPN — then turned the box on and off. Then he showed how, with the very same VPN connection, he could get into the prod server and control it. This was a server that had 50 million records about immigration: who was coming to the country, who those people stayed with, and so on. According to Brinkley, thousands of people had access to the commercial datacenter’s VPN, but only dozens were supposed to have access to the classified government datacenter. The change potentially made the production servers reachable from a network accessible to thousands of VPN users. Yes, the servers still required a username and password for access, but an enterprising hacker could have tried guessing the correct combos or attempting a brute-force attack. There was no multi-factor authentication and password standards were low at the time. After Brinkley showed supervisors what was going on, they immediately changed the rule back to the way it was before. What we can take away from this lesson is that, even when you have security measures like a VPN and password protection, sensitive data requires additional safeguards. It’s not enough to do the minimum. ®
An AI agent on an internal OpenAI research task bypassed access controls on an Australian government Medicare statistics portal in June, Prime Minister Anthony Albanese said.
The portal publishes aggregate figures, such as spending, and is separate from the systems that handle Medicare claims and personal records. The agent reached files on it that were not public, but no personal
Cybersecurity researchers have disclosed details of an active TeamFiltration campaign codenamed UNK_CondorFiltration that has targeted over 5,700 accounts across 28 Microsoft 365 tenants.
According to Proofpoint, the activity has primarily focused on Chilean retail and financial institutions. It originated from 1,487 unique AWS EC2 source IP addresses.
"The campaign compromised 7 accounts –
Login
