OpenNebula vs CloudStack: Which Virtualization Management Platform Should You Choose?

Apache CloudStack and OpenNebula are both well-known cloud and virtualisation management platforms for operating IT infrastructure and delivering Infrastructure as a Service (IaaS). Both support KVM virtualisation, multi-tenancy, isolated virtual networks and self-service provisioning. For infrastructure teams evaluating VMware alternatives following Broadcom’s licensing changes, both could be under consideration. Both sit in the same category: IaaS orchestrators, built to publish infrastructure to tenants who are not the operator. This article will give you a guided comparison between both and will help you make your choice if you are in evaluation.

By reading further you will get an understanding how each platform fits your infrastructure, your team and the services you need to deliver. Architecture, networking, automation, licensing and support all influence the work involved in deploying and operating a cloud. This CloudStack and OpenNebula comparison examines those differences and their practical implications for enterprises and service providers. Whether you are comparing both platforms for a new deployment or considering CloudStack as an OpenNebula alternative, it will help you identify what to assess before making a decision.

 

Comparing by Domain

Symbol	Description
●	Full, in the entry product with no extra purchase
$	Above baseline, needs a higher edition or a separate product
◐	Partial, there with a limitation that matters
○	Not covered.
ACS	Apache CloudStack
ONE	OpenNebula

Note: Assessed on Apache CloudStack 4.23.0.0 and OpenNebula 7.4 ‘Helix’ release notes.

 

Architecture

The clearest way to see the difference is to count what runs before you create your first virtual machine.

Capability	What it is	ACS	ONE
Control plane components	The services and appliances that must already be running before any tenant workload exists, and the memory and CPU they occupy at every site.	●	●
Control plane high availability model	Whether the management layer survives the loss of one of its own nodes without manual intervention, and by what mechanism.	●	●
Remote console architecture	How a tenant reaches the screen of a running instance, and whether that traffic passes through a dedicated appliance or the web layer.	●	●
Documented scale limits	Whether the vendor publishes a tested ceiling for hosts, instances and clusters per management domain.	◐	◐

A CloudStack Core Zone starts up with system virtual machines: a Secondary Storage VM for templates and snapshots, a Console Proxy VM for console sessions, and a Virtual Router per guest network for DHCP, DNS, NAT and firewalling. Each hypervisor host runs cloudstack-agent. An OpenNebula deployment starts with none of that: the oned daemon talks to hosts over SSH and drives libvirt directly, console access is proxied by FireEdge on the front end, and the only appliance it instantiates is a Virtual Router, and only when a network needs routing.

Neither approach is simply better. CloudStack’s system VMs isolate failure domains and let console and storage traffic scale independently of the management server, at the cost of components to patch and monitor. Edge Zones drop them entirely: a far-edge site runs a single KVM host with local storage, no secondary storage, no Secondary Storage VM and no Console Proxy VM. OpenNebula’s agentless model means fewer moving parts and a smaller footprint, at the cost of more load on the front end and a dependency on SSH reachability to every host.

The layering differs too. CloudStack models Region, Zone, Pod, Cluster and Host. OpenNebula has Cluster and Host, with Zone appearing only in federated deployments and no Pod at all.

Neither approach is simply better. CloudStack’s system VMs isolate failure domains and let console and storage traffic scale independently of the management server, at the cost of components to patch and monitor. Edge Zones drop them entirely: a far-edge site runs a single KVM host with local storage, no Secondary Storage, no Secondary Storage VM (SSVM) and no Console Proxy VM (CPVM). OpenNebula’s agentless model means fewer moving parts and a smaller footprint, at the cost of more load on the front end and a dependency on SSH reachability to every host.

The layering differs too. CloudStack models Region, Zone, Pod, Cluster and Host. OpenNebula has Cluster and Host, with Zone appearing only in federated deployments and no Pod at all.

 

Compute

 

Capability	What it is	ACS	ONE
Hypervisors supported as first-class drivers	Which hypervisors the platform manages directly, with full lifecycle control rather than one-way import.	●	◐
Bare metal provisioning through the platform	Whether physical machines can be provisioned as workloads through the platform, rather than only imaged as cluster nodes.	●	$
Containers managed alongside VMs	Whether Linux system containers run through the same objects, networks and storage as virtual machines.	◐	●
Live migration and live storage migration	Moving a running instance to another host, and moving its disks to other storage, without stopping it.	●	●
GPU passthrough and vGPU/MIG partitioning	Assigning a whole GPU to an instance, or partitioning one physical card so several instances share it.	◐	●
Importing / adopting pre-existing unmanaged VMs	Bringing a virtual machine already running outside the platform under its management, where it stands.	●	●
Instance sizing model	Whether instance shapes come from a catalogue the operator curates, or from values the tenant types in.	●	●

CloudStack manages KVM, VMware, XenServer and XCP-ng directly, with Hyper-V, Proxmox and MaaS arriving through the 4.23 extensions framework. OpenNebula 7.4 ships drivers for KVM and LXC; its vCenter driver was removed. Where CloudStack puts a service offering between the operator and the tenant, OpenNebula sets CPU and memory as template attributes, and has no disk offering at all.

Storage

Capability	What it is	ACS	ONE
Storage backends and protocols supported	Which storage systems and protocols can hold the disks of running instances.	●	●
Vendor array integration	Whether an array’s own features, including snapshots, replication and QoS, are driven by the platform or stop at the hypervisor.	●	$
Primary/secondary storage separation and cross-site snapshot copy	Whether running-disk storage is separated from image and snapshot storage, and whether a snapshot can be copied to another site.	●	●
Backup model	Whether backups capture only what changed since the last one, and whether a restore produces a running instance or a disk someone still has to assemble.	●	●
Tenant-facing object storage	Whether tenants get buckets they create and consume themselves, as distinct from the platform using object storage internally.	●	○
Disk QoS and whether it is delegable as a purchasable tier	Whether IOPS and throughput limits attach to something a tenant selects, rather than being set per machine by an administrator.	●	◐

CloudStack ships managed plugins for StorPool, Dell EMC PowerFlex, LINSTOR, NetApp ONTAP and SolidFire, Pure Storage FlashArray and HPE Primera. OpenNebula’s community edition covers Ceph, LVM, iSCSI and file datastores, with NetApp, PowerFlex and Pure Storage behind the subscription. Both throttle disk IOPS; the difference is that CloudStack puts the ceiling on an offering a tenant buys, while OpenNebula’s equivalent sits in the restricted-attribute list and stays an administrator’s control.

 

Networking

This is the domain where the two are furthest apart. Since 4.20 CloudStack can run isolated networks and VPCs in ROUTED mode, where the Virtual Router allocates an AS number and establishes BGP peering, giving tenants routable addressing instead of NAT. The trade is explicit: in ROUTED mode source NAT, static NAT, load balancing, port forwarding and VPN are unavailable. A CloudStack VNF template also declares the interfaces it expects and gets each wired to the right guest network on deployment, where OpenNebula’s marketplace VNF is an ordinary image with context variables. On hardware, CloudStack supports SR-IOV as PCI passthrough and OVS-DPDK; OpenNebula adds SR-IOV in switchdev mode and BlueField DPU offload.

Capability	What it is	ACS	ONE
Tenant network isolation	How one tenant’s network traffic is kept separate from another’s on shared physical infrastructure.	●	●
VPC / multi-tier networks with their own ACLs	Whether a tenant can build several connected networks under one routing domain, each carrying its own traffic rules.	●	○
Gateway services	Whether NAT, DHCP, DNS and firewalling are delivered to tenant networks, and by what.	●	●
Load balancing, including TLS/SSL offload	Whether the platform provides a load balancer, and whether TLS certificates terminate there instead of on every backend instance.	●	◐
VPN	Whether tenants get encrypted connectivity back to their own premises, and whether individual users can dial in.	●	○
Routed tenant networks / per-tenant BGP peering	Whether a tenant network can carry routable addresses advertised upstream, instead of sitting behind address translation.	●	○
IPv6 and dual-stack tenant networks	Whether tenant networks carry IPv6 alongside IPv4, and under what conditions.	●	●
SDN and external network provider integration	Whether an external network controller or physical device can be driven by the platform rather than configured beside it.	●	◐
Bandwidth QoS and whether it is delegable as a purchasable tier	Whether a bandwidth limit is part of something the tenant selects, rather than applied after the fact.	●	◐
Hardware-level networking	SR-IOV mode, DPU offload and user-space packet paths.	◐	●

 

 Multi-tenancy & Identity

 

Capability	What it is	ACS	ONE
Tenant hierarchy depth	How many levels of tenant the platform models, and whether a tenant can contain tenants of its own.	●	◐
Quota and resource limits	Whether consumption can be capped, and at which levels of the tenant structure.	●	●
Self-service portal for end tenants	Whether end tenants get an interface of their own, separate from the operator console.	●	●
Identity federation	Which external identity systems can authenticate users, and whether each tenant can point at its own.	●	◐
RBAC granularity and custom roles	How finely permissions divide, and whether roles beyond the built-in ones can be defined.	●	◐
API credential scoping, expiry, and two-factor authentication	What an API credential is allowed to do, for how long it stays valid, and what protects interactive login.	●	●

 

CloudStack has nested domains, accounts and projects; OpenNebula has flat groups, compensated by the Virtual Data Center, which binds clusters, datastores and networks to a group more cleanly than CloudStack’s explicit resource dedication. The identity models are inverted in an interesting way.

CloudStack scopes the provider to the tenant, so different tenants federate to different identity providers. OpenNebula keeps providers global and maps external groups onto its own, so membership flows from the provider rather than the tenant choosing one. Only CloudStack lets the tenant own that choice, and only CloudStack has HSM-backed key management.

 

Operations & Lifecycle

 

Capability	What it is	ACS	ONE
Upgrade model	Whether the management layer keeps serving requests while it is being upgraded.	●	◐
Maintenance mode and documented safe shutdown of the control plane	Whether there is a documented way to take the management layer out of service without risking in-flight work.	●	◐
Metrics and monitoring	What the platform exposes for monitoring, and whether dashboards ship with it.	●	●
Usage metering, accounting and showback/chargeback	Whether consumption is recorded per tenant in a form that billing can consume.	●	●
Workload placement and DRS-equivalent rebalancing	How instances are placed when created, and whether the platform rebalances the cluster afterwards.	●	●
Backup and disaster recovery of the control plane itself	Whether there is a documented way to back up and restore the management estate itself.	◐	●

Both rebalance, and the difference is what feeds it. CloudStack DRS computes cluster imbalance from the allocated metrics of the service offering; OneDRS optimises over observed usage with a linear programming solver. A cluster can look balanced by allocation while being badly balanced in practice. OpenNebula goes further with forecasting that nothing in CloudStack matches, predicting host and VM metrics five minutes and thirty days ahead and feeding those predictions back into OneDRS. On accounting, OpenNebula’s showback is built into oned, while CloudStack’s usage data comes from a separate Usage Server, which is more to run and is also what keeps that load off the management database at scale.

 

API and automation

Every CloudStack operation is an API command, the web console is just another client of that public API, and requests are signed with a key pair rather than carrying a session. The difference that shows up day to day is the job model: a long-running CloudStack operation returns a job ID the client polls, while OpenNebula returns no queryable identifier for most operations, so the client watches the object’s state through LCM_STATE. The first tells you whether your request succeeded; the second tells you what the object looks like now, which is a weaker thing to build a portal or a billing integration on.

Capability	What it is	ACS	ONE
Public API completeness	Whether the web interface calls the same API available to scripts, or a privileged internal one.	●	◐
API authentication model	How an API request proves who it is.	●	●
Asynchronous job model	Whether a long-running request returns an identifier the client can poll, or whether the client has to watch the object’s state instead.	●	◐
Infrastructure as code	Whether infrastructure-as-code tooling exists for the platform, and who maintains it.	●	●
Kubernetes	Whether the platform provisions Kubernetes clusters itself, and whether it plugs into the Cluster API standard.	●	●

 

Automation tooling is the one area where the two are close:

• Terraform: both projects maintain their own provider.
• Ansible: CloudStack through a community collection shipped in the Ansible distribution, OpenNebula through modules listed among its own integrations.
• Kubernetes Cluster API: CloudStack’s is maintained upstream under kubernetes-sigs, OpenNebula’s in its own organisation with a SUSE Ready certification for Rancher.
• CLI and reference: CloudStack has CloudMonkey for the command line, and the UI builds its own navigation from listApis, so what an operator sees is derived from the same API a script calls. OpenNebula has XML-RPC, a FireEdge REST layer and a gRPC API added in 7.2.

 

Extensibility

This is the area where the gap is widest, and it is the strongest argument in CloudStack’s favour today. This needs to be shorter and straight to the point. It is a word salad now. Please summarise in 2-3 paragraphs with some bullets.

Capability	What it is	ACS	ONE
Adding an unsupported hypervisor without modifying the platform’s source	Whether support for a runtime the platform has never heard of can be added without modifying its source.	●	●
Pluggable drivers for storage, network and authentication	Whether the storage, network and authentication subsystems accept drivers written outside the project.	●	●
Extensions as registered objects with their own RBAC and API surface	Whether an extension is a registered object with its own permissions and API surface, or a file placed on disk.	●	◐
Marketplace or curated template catalogue	Where the images and appliances tenants deploy come from, and who curates them.	●	●

 

Apache CloudStack: CloudStack 4.23 has an extensions framework with two extension types. An Orchestrator extension delegates VM lifecycle to an external system and is registered against a cluster. A NetworkOrchestrator extension handles guest network and VPC services and is registered against a physical network. An extension is an executable in any language: CloudStack passes it an action name and a JSON payload and reads JSON back. Proxmox, Hyper-V and MaaS ship as built-in examples. Administrators can define custom actions with typed parameters, validation and role-based access control, exposed through the UI and the API like any other operation.

The result is that a hypervisor CloudStack has never heard of can be added without touching its source. There is a working example of exactly that: an open source extension that manages Firecracker microVMs through CloudStack, with a host agent, pluggable storage backends, VLAN tagging over Linux bridges or OVS, mutual TLS and a VNC console bridge. Firecracker is a runtime CloudStack has no native support for, and adding it required no change to CloudStack itself.

OpenNebula: It is extensible too, but at a different layer. Every subsystem is a pluggable driver declared in oned.conf: VM_MAD for hypervisors, VN_MAD for networks, TM_MAD and DATASTORE_MAD for storage, AUTH_MAD for authentication, plus the market and hook drivers. The drivers themselves are scripts on disk that you can read, copy and replace. The scheduler is pluggable in the same way, and a 7.4 install ships three of them. For someone comfortable at that level, it is a clean and honest design.

What OpenNebula does not have is the management layer around it. There is no registered extension object, no UI for installing one, no custom actions surfaced through the API with their own permissions. Adding a driver means editing configuration on the front end and restarting the daemon. That is a different proposition from registering an extension and granting a role access to its actions.

Apache CloudStack Overview 

Strengths

• Manages vSphere, KVM, XenServer and XCP-ng together, with Hyper-V, Proxmox and bare metal through the Extensions Framework, so one control plane can span a VMware migration.
• Compute, disk and network offerings carry IOPS ceilings, bandwidth limits and GPU profiles, so an operator publishes a tier once and then delegates, meters and bills against it. Usage aggregation runs on its own server, which keeps that load off the management server and its database in large deployments.
• Multi-tier VPCs with ACLs, VPN, TLS-terminating load balancing, ROUTED networks with automatic BGP peering and a VNF template type are all platform objects a tenant can be given.
• Nested domains, accounts and projects model resellers under resellers; identity federates per domain; API keys are scoped and time-limited; key management integrates with an HSM.
• Maintenance mode, a documented safe shutdown and live patching of the Virtual Router make the control plane something you can operate under an SLA.
• One edition under Apache 2.0, with no capability reserved for a paid tier.

Weaknesses

• Slower to a first cloud than OpenNebula: hours for a test deployment, a project for a production Zone. That setup is the Zone and Pod structure that makes it operable at scale, and far simpler than OpenStack, but a small team feels it.
• System VMs and the hypervisor agent are extra components to patch, monitor and recover when they fail.
• Usage data comes from a separate Usage Server you deploy and maintain, so reaching chargeback takes more setup than OpenNebula’s built-in showback.
• The five-layer model is overhead for a single datacentre.
• DRS balances on allocated metrics rather than observed usage, and there is no forecasting.
• No gRPC API, and no VM memory encryption on the native KVM path. Neither is something an extension can add, because they are the API’s own protocol and the guest definition rather than orchestration.
• System containers and in-guest command execution are not shipped. Both are reachable through an Orchestrator extension and custom actions, but as something you build and maintain rather than a product feature.
• No NVIDIA NVLink or NVSwitch fabric management.

OpenNebula Overview

Strengths

• No agent on the hypervisor and no system VMs, so there is a smaller footprint, less to patch, and a front end with two nodes that comes up in an afternoon.
• The Virtual Data Center binds clusters, datastores and networks to a group cleanly, where CloudStack needs explicit resource dedication.
• Accounting and showback are built into oned, available out of the box.
• Forecasting of host and VM metrics over five-minute and thirty-day horizons, feeding OneDRS, which optimises on observed usage.
• Strong AI and GPU position: NVIDIA Fabric Manager for NVLink and NVSwitch, an integration with NVIDIA’s infrastructure controller, a Slurm appliance, and VM memory encryption.
• Ahead on hardware networking: SR-IOV in switchdev mode, BlueField DPUs and DPDK.
• LXC system containers, a gRPC API, in-guest command execution, automated hyperconverged Ceph, and OneFlow for multi-VM services with dependencies.

Weaknesses

• KVM and LXC only. The vCenter driver was removed and Firecracker support from 6.x is gone.
• Detects unmanaged guests but provides no import path in 7.4.
• No offering object between template and tenant. QoS controls sit in the restricted-attribute list, which makes them administrator settings rather than tenant-selectable tiers.
• No VPC object, no built-in VPN, no SSL offload, no platform-managed per-tenant BGP.
• Flat groups rather than nested domains, and no OAuth or OIDC driver.
• No tenant-facing object storage; S3 is a backup destination.
• NetApp, PowerFlex, Pure Storage and Veeam drivers are enterprise integrations outside the community edition.

 

CloudStack vs. OpenNebula: How to make your final choice?

Both platforms have clear strengths. OpenNebula offers a smaller management footprint, built-in showback, workload forecasting and specialist capabilities for AI infrastructure and hardware networking. CloudStack’s advantage is how it brings infrastructure management, tenant services and service delivery together.

For service providers and enterprises, that translates into several practical benefits:

• A staged path beyond VMware. Manage multiple hypervisors through one control plane while moving workloads at a pace that suits the organisation.
• Consistent services tenants can select. Publish compute, storage, network and GPU tiers with defined limits and permissions, supported by usage metering for billing.
• Integrated networking and tenant management. Deliver services such as VPCs, VPNs and routed networks, with nested tenant structures suited to customers, business units and resellers.
• Control across multiple sites. Use a common infrastructure hierarchy, API and operational model as the cloud expands.
• Access to the full platform. Apache 2.0 licensing makes commercial support a separate choice, with no paid edition required to unlock capabilities.

Choose CloudStack to build a cloud or manage a virtualization that grows with your business and keeps you in control.

The post OpenNebula vs CloudStack: Which Virtualization Management Platform Should You Choose? appeared first on ShapeBlue.

from CloudStack Consultancy & CloudStack... https://ift.tt/anpPvrT
via IFTTT

Anthropic's Unreleased AI Model Chains Flaws Into Working Chrome, Safari, Windows and Linux Exploits

An unreleased Anthropic AI model found security flaws in Chrome, Safari, Android, Windows, and Linux and chained them into working proof-of-concept exploits, the company said in its latest report.

The exploits were built in the lab after the model was prompted, not seen in any real attack, and Anthropic reported every flaw to the vendor first, so all of them are already patched. One proof of concept opened the Calculator app on a stock Mac running Chrome within seconds of a page loading, with no further clicks.

Anthropic's Frontier Red Team described five chains in a research post. The strongest claim is not any single bug, but that one model found several separate flaws and combined them into a working exploit, something the company says has until now been the work of a few specialist teams. That capability claim rests on Anthropic's own account.

The patches and the fact that Apple and Google credit Anthropic and its Claude model for specific fixes can be verified with the vendors.

What a reader cannot check is how much of each chain the model built on its own. Anthropic says the work needed only "initial prompting" and "little human involvement," but it does not break down what a person did at each step, and it does not name the model beyond calling it an unreleased, internal research model.

For the one flaw with its own public record, the Windows bug, the record names no finder at all. Here are the five chains, what each would do, the condition each needs, and where the fix landed.

Platform	What the exploit does	Condition it needs	Fix
Chrome	Runs code on the computer, outside the browser's sandbox, from one visit to a web page	One click or page load, stock Chrome on macOS	Chrome 156, October 20
Safari	Lets any website read data from other sites the user is signed in to, such as email or a bank account	One visit to a malicious page	iOS and iPadOS 26.5.2, June 29
Android	Copies photos and other data off a locked, stolen phone	Physical access to the phone, over USB	Anthropic says Google has fixed it; no public record was found
Windows	Crashes a server over the network, and keeps it down by repeating	The server answers HTTP/3 requests	CVE-2026-33096, patched April 2026
Linux	Runs commands as root over the network, with no login and no user action	The server runs a multipath TCP listener	CVE-2026-98432, patched October 15

In the Chrome chain, the model used four separate flaws in turn. A malicious page first corrupted memory in V8, Chrome's JavaScript engine.

A second flaw escaped V8's memory sandbox and took control of the part of Chrome that renders the page. A race condition in a feature called CacheStorage then let that code read memory it should not reach and learn the layout of the more privileged browser process.

A final use-after-free bug in FedCM, Chrome's sign-in feature, let the exploit run code outside the sandbox entirely. Anthropic says it reported 62 flaws to Google that were assigned CVEs and fixed as of Chrome 156, all rated critical or high, including 13 sandbox escapes.

Google's own release notes credit "Xinyang Ge of Anthropic, assisted by Claude" for specific Chrome fixes, though not for all 62.

The Safari chain is different because it never runs code at all. It chains flaws to obtain full read and write access to the browser's memory, then changes a single value to turn off the same-origin policy, the rule that prevents one website from reading another's data.

With that rule off, a malicious page can read a user's history and cookies and send signed-in requests to other sites. Apple fixed the use-after-free at the center of the chain in iOS and iPadOS 26.5.2 and credits "Milad Nasr and Nicholas Carlini with Claude, Anthropic" for it.

The Windows chain is the one with an independent paper trail, and it is also the narrowest. It is a denial-of-service attack: a few network packets crash the machine, and repeating them keeps it down, but it does not run code or steal data. Anthropic describes the flaw as an out-of-bounds read in the Windows kernel's QUIC handling.

The public record for the bug it points to, CVE-2026-33096, instead names HTTP.sys, Windows' built-in web request handler, and rates it 7.5 out of 10. No open source ties those two descriptions together as the same component. The CVE record credits no finder, so Anthropic's authorship of this one rests on its own post.

As of late October, the U.S. government's vulnerability enrichment marked the flaw as not exploited, and it was not in the CISA catalog of known exploited bugs.

The Linux chain is the most serious in terms of impact: it runs commands as root over the network without a login. It needs the target server to be running a multipath TCP listener. The model first leaks a kernel memory address to bypass a defense called KASLR, then reuses the same race-condition bug to redirect the program to code the attacker has already placed, resulting in a root shell.

Anthropic says its proof of concept took 48 minutes to leak the address and five more to reach the shell, and that a failed attempt does not crash the system, so an attacker can keep retrying.

The company ties this chain to CVE-2026-98432, a kernel use-after-free rated 9.8 and fixed upstream on October 15; the public record for that CVE describes an IPv4 TCP fix rather than a multipath TCP one, and the two are linked only by Anthropic's post.

Anthropic frames the work as help for defenders. It says it reported each flaw under a coordinated disclosure policy that gives developers 90 days to patch and 45 more before it discusses details beyond a public advisory, and it points security teams to its expanded Cyber Verification Program, which gives vetted professionals access to Claude Opus 5.5, Sonnet 5.5 and Mythos 5.1.

The reason the company gives for publishing is in its own words: "Now, it's something models can do with little human involvement, and then prove by producing a working exploit that anyone can run and verify."

from The Hacker News https://ift.tt/G87WuhE
via IFTTT

FBI Seizes Virtualine Domain Over Alleged Criminal Hosting and Bitcoin Money Laundering

The U.S. Department of Justice (DoJ) on Tuesday announced the seizure of a domain associated with a bulletproof hosting provider (BPH) named Virtualine.

The move was in response to the service being used to commit and facilitate prolific criminal activity, including "the advertisement of sexually explicit images of minors, the intentional disclosure of nonconsensual intimate visual depictions of adults and minors, and international money laundering designed to conceal and promote criminal conduct," the DoJ said.

Visitors to the "virtualine[.]net" domain are now greeted by a message that states it has been seized by the U.S. Federal Bureau of Investigation as part of a coordinated operation between international law enforcement agencies and private sector entities, including the Hessen State Police, the National Police Corps of the Netherlands, the U.K. National Crime Agency, OverRIPE, and Lumen Technologies.

According to court documents, Virtualine, which also operated as Secury, Massgod, Spamhouse, Lanedo, and Omegatech, advertised its services to criminals on cybercrime forums, claiming that they can be used for phishing, carding, email spam, and port scanning, with the exception of child content and terrorism activities.

In June 2025 on HackForums, the provider is alleged to have boasted that "Virtualine ignored more abuse than your last three therapists." Earlier this March, it also began marketing an "additional protection plan" that promised its customers to move their criminal infrastructure to a shell company unaffiliated with Virtualine when receiving official requests from law enforcement agencies.

Snapshots captured by the Internet Archive show that standard plans cost anywhere between $19.99 per month for one virtual CPU, 2GB memory, and 30 GB storage to $179.99 per month for 24 vCPUs, 64 GB memory, and 130 GB memory. Virtualine also offered plans optimized by CPU, memory, and storage, starting from $21.99 per month to $379.99 per month.

"Despite advertising that it does not allow 'child contents' on its server, Virtualine knowingly hosted a website that did so, identified in court records as Vendor 1," DoJ said. "Vendor 1 is a criminal online forum that allows users to post and sell access to nude, sexually suggestive, and/or sexually explicit images and videos of minors and adults."

"Vendor 1 also promotes a hack-for-hire service in which users can pay hackers to access victims’ online accounts without their consent and illicitly obtain explicit images and videos. In January 2026, about one month after Virtualine assigned an IP address to Vendor 1, Virtualine began receiving notifications about sexually explicit images and videos of minors on that server."

The Justice Department said Virtualine continued to host Vendor 1's services despite receiving numerous notices from law enforcement in Germany, Canada, and Australia; the National Center for Missing and Exploited Children (NCMEC) in the United States; and a victim's attorney.

Virtualine has also been accused of working closely with Vendor 1 to create a new website where its clients could upload their illicit content and download it upon completing a purchase. The website continues to be hosted by Virtualine to this day, the department added.

"Virtualine.net included a number of payment options for Virtualine's customers, including Vendor 1," the DoJ said. "Virtualine accepted payment through BTC [NO-AML], specific unhosted bitcoin addresses that allowed customers to direct pay without concern their funds would be flagged as illicit."

"The funds Virtualine's criminal customers paid to Virtualine, some of which can be traced directly to various criminal groups, were received by Virtualine and then further laundered to conceal the origin of the funds."

Blockchain intelligence firm Chainalysis, in its own analysis, said Virtualine accepted direct Bitcoin payments through unhosted wallet addresses, allowing criminal customers to pay without triggering compliance checks at hosted exchanges.

"Virtualine's on-chain footprint has direct exposure to a broad cross-section of the cybercrime ecosystem, including ransomware operators, infostealer infrastructure, Russian-language cybercrime forums, illicit shops, and scam and phishing addresses," it said.

Following the site seizure, the operator of Virtualine has published an open letter, refuting allegations that the service knowingly hosted child sexual abuse material (CSAM). The operator also claimed they have taken action on requests for cooperation concerning CSAM within 24 hours. In a post shared on their Telegram channel, they insisted that customer data was safe.

"When we identified prohibited material associated with the customer described as 'Vendor 1,' we ended our relationship with that customer," the individual added, claiming "Virtualine has been part of my life for five years."

"Please do not cast suspicion on me and the tens of thousands of customers who have trusted Virtualine because of the actions attributed to a single customer. I want you to know that I am prepared to respond to your requests concerning 'Vendor 1.'"

In September 2025, the Spamhaus Project revealed that Virtualine had expanded their operations to AS209800. "Thanks to Turkey- and U.S.-based IP address brokers with poor customer vetting procedures, Virtualine keeps obtaining new IPv4 prefixes for enabling internet abuse. AS209800 is currently routed via aurologic GmbH, a hosting provider proliferating several other bulletproof hosting operations."

"A lost ASN does not by itself mean the BPH has stopped," Silent Push said. "The speed of acquiring a new ASN is a crucial part of the problem, and we believe the process for registering an ASN should be tougher."

from The Hacker News https://ift.tt/OCmdShZ
via IFTTT

Adobe Commerce PolyShell Attacks Breach Hundreds of Stores as Brotli Exploit Traffic Emerges

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added two vulnerabilities impacting Adobe Commerce and Magento, and Google's Brotli decoder library to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.

The vulnerabilities are listed below -

• CVE-2026-111497 (CVSS score: 9.2) - An unchecked return value vulnerability in Google Brotli that could allow a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial-of-service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.
• CVE-2026-48356 (CVSS score: 9.3) - An unrestricted upload of a file with dangerous type vulnerability in Adobe Commerce and Magento that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session.

The development comes days after Sansec said it observed attackers leveraging CVE-2026-48356, also known as PolyShell, to breach hundreds of e-commerce stores to inject a malicious loader via a Magento CMS block.

The loader is designed to fetch and execute an attacker-controlled payload, although no next-stage malware has been recovered to date, making it challenging to determine what the exact goals of the campaign are. The activity is assessed to be ongoing since at least July 2025.

As for CVE-2026-111497 (aka Broccoli2Shell, HTTP2Shell, and Node2Shell), telemetry data from threat intelligence firm Previdian shows that one exploitation attempt has been recorded against its honeypot sensors from a U.S.-based IP address as of October 27, 2026. It's currently not known if these efforts are broad in scope.

"An attacker who can supply Brotli data that an application decompresses with node:zlib can corrupt process memory," Rapid7 said. "According to Node.js, this corruption can lead to a process crash, disclosure of sensitive process memory, or remote code execution. Exposure therefore depends on whether an application passes attacker-controlled compressed data to the affected decoder."

ELLIO also reported on Monday that its sensors "have recorded CVE-2026-111497 exploit traffic in the wild, carrying the public exploit that we confirmed gets a shell on vulnerable builds." The activity originates from "94.154.43[.]7," an IP address geolocated to the Netherlands that has also engaged in exploitation efforts targeting PHP2Shell, two critical flaws in PHP that could result in unauthenticated remote code execution.

"The attacker's payload is a genuine, correctly-structured Node2Shell exploitation attempt for node v24.22.0 – the Brotli stream, staged displacement, pivot pair, and delivery are all correct and identical to the public tooling," ELLIO said. "This is indicative of the RCE being adopted by an operator focused on mass exploitation."

The fact that Brotli is a widely distributed open-source library and adopted by numerous projects has provoked an emergency response, prompting various vendors to release patches or assess if their products are affected by the flaw.

This includes PHP, which has shipped versions 8.5.12-1, 8.4.27-1, 8.3.36-1, and 8.2.35-1, as well as Node.js, Bun, Envoy Proxy, Istio, .NET, Python, ClickHouse, the PHP Brotli extension, and the Ruby "brotli" gem. Links to some of the advisories are below -

"Node.js fixed the vulnerability in versions 22.23.4, 24.22.1, and 26.12.1," Akamai said. "The Node.js advisory does not offer a workaround, so upgrading is the only complete remediation. Organizations running a discontinued release line should move to a supported release line."

Google-owned Wiz has warned that "91% of cloud environments have resources vulnerable to CVE-2026-111497 and 82% of cloud environments have publicly exposed Node.js instances."

"Node2Shell is not a bug in every Node.js service, but a bug in services that decode attacker-influenced Brotli," Sysdig said. "Express 5 with default JSON parsing puts a large number of instances of them in that group. The demonstrated impact thus far is crashes at scale and code execution in a narrow configuration, so patch order should follow reachability."

Federal Civilian Executive Branch (FCEB) agencies have time until November 10, 2026, to apply the necessary fixes against the two flaws.

from The Hacker News https://ift.tt/2uOFhxe
via IFTTT

OpenClaw Enterprise: Making AI Agents Safe for the Enterprise

Brian interviews Derek Carr and Mrunal Patel, distinguished engineers at Red Hat, about OpenClaw Enterprise, the new open-source project that brings Red Hat, NVIDIA, and the OpenClaw community together to make persistent AI agents safe and manageable at enterprise scale. The work started with OpenShell, a deny-by-default sandbox the pair helped build with NVIDIA that treats every agent as potential malware. Agents never see credentials (a supervisor egress proxy injects them from outside), kernel features like Landlock restrict what they can touch, and when a blocked agent hits a wall, OpenShell can ask it why it tried, so a human can decide whether to allow the action now or never. Running real agents in that sandbox showed them that not everything should be untrusted. Memory, for example, is an enterprise record. That insight led them to OpenClaw’s own push to decompose agents into trusted and untrusted parts. OpenClaw Enterprise borrows the Hypershift hosted control plane pattern: gateways, memory, and session state live on a control plane cluster, while agent harnesses run in disposable OpenShell sandboxes on a data plane cluster, so a failed sandbox is simply replaced with full context. Enterprises set a permission ceiling; every new agent starts least privileged and grows only up to that limit, and blessed templates for roles like team Q&A, software co-development, and chief of staff make good agent setups repeatable instead of tribal knowledge. The guests also highlight multi-user agents, where colleagues steer the same agent together rather than flooding each other with AI-generated pull requests, and Skipper, the project’s own support agent that preserves the reasoning behind past decisions. The stack is model-agnostic and runs anywhere, including on self-hosted inference such as Dynamo or llm-d. With more than 3,000 pull requests merged since its September launch, the project is targeting a 1.0 release around year-end, with enterprise pilots and production rollouts expected in 2027.

SHOW: 1075

SHOW VIDEO: https://youtu.be/yS2HEiGbxqo

SHOW SPONSORS:

• Nord Security - NordLayer AI Scout 

SHOW LINKS

• TheEntAIShow #1009 - OpenClaw with Sally O’Malley
• OpenShell - the safe, private runtime for fleets of autonomous AI agents
• OpenClaw Enterprise - An open source, vendor neutral platform for managing persistent agents in sensitive environments.

GUEST BIO(s)

Derek Carr is a Senior Distinguished Engineer at Red Hat, where he has worked on OpenShift and in the Kubernetes community since 2014. He is a former member of the Kubernetes Steering Committee and has held long-running leadership roles in Kubernetes SIG Node and SIG Architecture. His recent work focuses on how enterprises can run AI agents safely on Kubernetes, including Red Hat’s work with NVIDIA’s OpenShell on kernel-enforced agent sandboxing.

Mrunal Patel is a Distinguished Engineer at Red Hat, where he has worked on Linux containers, Kubernetes, and OpenShift since 2011. He started the CRI-O container runtime, is a maintainer of runc and the OCI runtime specification, and serves as a chair and technical lead of Kubernetes SIG Node. With Derek, he is now applying deep container isolation expertise to secure execution for AI agents on Red Hat AI.

FEEDBACK?

• Email: show @ the enterprise ai show dot com
• Bluesky: @TheEntAIShow.bsky.social
• Twitter/X: @TheEntAIShow
• Instagram: @TheEntAIShow

from The Cloudcast (.NET) https://ift.tt/cYJwreA
via IFTTT

CyberStrikeAI Uses 44 AI Agents to Automate Hacking Operations Against Japan Targets

Cybersecurity researchers have disclosed details of three cyber attacks targeting organizations in Japan in which artificial intelligence (AI) was a key element, either in the driving seat or to assist a human operator.

TrendAI, which analyzed three exposed server environments used by threat actors to conduct the malicious cyber operations, described them as distinct from previously published attacks that have leveraged ARTEX, an autonomous AI penetration testing framework, to single out entities in South Korea and Japan.

"These environments held reconnaissance and attack tools, scripts, target lists, results, logs, and command histories," security researchers Bakuei Matsukawa and Joseph C Chen said. "They ranged from workspaces used largely by hand by skilled operators to AI-agent platforms that automated the entire workflow, including command and control."

The first of the three attacks has been found to abuse CyberStrikeAI, another open-source penetration testing tool that was previously put to use in an attack campaign targeting Fortinet FortiGate appliances. The activity was concentrated in a short period in October 2026.

The AI-driven activity leverages the offensive security tool to automate various aspects of the attack lifecycle into a repeatable workflow, beginning with reconnaissance and vulnerability discovery and validation, and exploitation, to command-and-control (C2), persistence, data exfiltration, and automated reporting.

This involves delegating the work among 44 agents to handle various aspects of the attack, while also enabling the generation of forms and fake login pages in the Japanese language.

"In a short period, at least 19 identifiable organizations, including at least 16 in Japan, were subjected to validation activity," Trend Micro's enterprise security division said. "Each had a report in the same format and an index of evidence. These were outputs of a structured process run by the platform, rather than ad hoc notes left by an operator."

The second case has been characterized as a human-led attack with assistance from a large language model (LLM) to accelerate planning and tool development. Analysis of the infrastructure and artifacts indicates that the campaign is also designed to target AI workflow platforms and inference services with an aim to obtain large amounts of inference capacity at low cost.

One of the intrusions is said to have targeted a geographic information system (GIS) server exposed with default credentials, resulting in the theft of cadastral and commercial records, Windows credentials, and email data. The entire campaign lasted for 24 days in August and September 2026.

The third instance is where the AI's role has been found to be confined to developing the operator's tools and scripts, suggesting a limited role played by the technology in a series of campaigns designed to target edge devices from Cisco, Citrix, F5, and Yamaha using published vulnerabilities, management functions, or credentials present in configuration files.

The threat actor is estimated to have run at least six campaigns from January to October 2026, opportunistically striking exposed VPN devices and WebLogic servers. "The operator was experienced, with established practices for automation and evidence management," the researchers said.

There is currently no evidence at this stage that suggests these three incidents share an operator. It's also unknown if the attacks have targeted other regions and what AI models are being used to pull off the attacks.

That said, the attacks involving these threat actors are not restricted to Japan and neighboring countries like South Korea. The operator behind the first case has targeted organizations in Taiwan and Hong Kong, while the third case featured organizations in the U.K., France, Italy, Qatar, and Colombia in its WebLogic discovery lists.

"AI has increased the attackers' workforce, but the work still consists of looking for unlocked doors," TrendAI said. "The types of doors and the weaknesses that leave them open have not changed. What has changed is the ability to try thousands at once, adapt to the target country's language, and continue without fatigue."

The development coincides with the discovery of multiple campaigns in which threat actors of varied motivations have integrated agentic AI into existing offensive security workflows, allowing them to speed up research, malware development, social engineering, and other parts of an attack.

To make matters worse, AI is being increasingly used to accelerate reconnaissance, automate decision-making, and industrialize social engineering, shortening the time between exposure and exploitation of security flaws. According to Microsoft's 2026 Digital Defense Report, AI has collapsed the median time from vulnerability discovery to weaponization to well below 24 hours.

The adoption of AI by bad actors is reducing the time, expertise, and cost required to discover and exploit weaknesses, at the same allowing attackers and defenders alike to operate with greater speed, scale, and autonomy, the Windows maker added.

"The key issue is not simply whether an actor has frontier AI," Trend Micro said. "Access to capable models can already produce meaningful operational gains. Ecosystem depth, however, determines how reliably, independently, and at what scale those capabilities can be sustained."

"AI is no longer an experimental capability for APT groups; it is an operational component embedded directly into campaigns."

The growing demand for AI tools by threat actors has also opened up a new monetization avenue that peddles stolen AI provider session tokens and offensive AI tools APEX AI, MessiahGPT, and DarkGPT, further commoditizing cybercrime and lowering the barrier to entry for carrying out advanced, persistent, and evasive attacks.

Last week, Microsoft revealed that a China-state-aligned threat actor compromised a ConnectWise cloud backup application and used ARTEX to sign in to more than 2,250 Microsoft 365 tenants. The activity has been attributed to Storm-0940, which it said has used the framework since as early as September 2026 to automate password-spraying attacks on hundreds of organizations.

"While the majority of the targeting wasn't successful, Storm-0940 achieved privileged cloud persistence at many organizations in a brief time," Microsoft said. "Storm-0940's activity illustrates how a threat actor with a broad target set can use an agentic AI tool and privileged authentication material to quickly attempt to compromise many organizations."

According to local media reports from South Korea, authorities have identified seven suspects linked to a cybercrime operation that broke into more than 90 organizations in the country, most of which involved ARTEX. The 32-year-old mastermind behind the activity is alleged to have worked at a cybersecurity company between 2019 and 2022, gaining expertise in penetration testing.

In 38 of the incidents, the threat actors demanded ransom payments of 360 million won ($270,000) in exchange for not leaking the stolen data. More than 8.2 million records are believed to have been siphoned from compromised organizations.

Some of the other AI-oriented campaigns that have been documented in recent weeks are listed below -

• A financially-motivated threat actor operating under the handle BUGSTER configured the Hermes Agent framework with DeepSeek V4 as its reasoning engine and Cursor as a secondary tool (both with safety controls disabled) to run a WordPress brute-force campaign against an Indian university's website and generate a REST API enumeration report.
  • The attacker also breached a second Indian public university, exfiltrating a database of more than 5,200 records, including personally identifiable information (PII) on students. A third attack enumerated an Indian site on a popular e-commerce platform to extract a storefront API token, admin email addresses, phone numbers, and payment merchant IDs.
  • "The actor also built specialized AI bot profiles to acquire VoIP fraud expertise through conversation and maintained automated pipelines for Wi-Fi password cracking and cryptocurrency whale reconnaissance (i.e., identifying large cryptocurrency holders)," Palo Alto Networks Unit 42 said. "Notably, the Wi-Fi cracking capability requires close physical proximity to the target, indicating the actor had local access to the targeted locations."
• An e-crime group named CyberCartel has been observed using a multi-agent system called CARLIY0S to coordinate attacks against banks and payment providers across Latin America. The framework employs a cognitive swarm comprising four role-specialized Claude models that "debate each target and defer to one arbiter" before the main orchestrator acts. "The group assigned different roles to commercial AI models to analyze targets, develop attacks, and coordinate operations," Straiker said.
• Threat actors have developed an offensive AI agent designed to hijack exposed AI endpoints to run autonomous attacks, with instructions allowing it to carry out up to 100,000 steps without human approval while the legitimate owner of the exposed endpoint pays for the inference. The system features a malicious loop called Skynet mode that employs a set of 74 tools to scan for targets, infect them, deploy cryptocurrency miners, and reinfect compromised hosts.
• An affiliate for the The Gentlemen ransomware operation has used Anthropic Claude Code during intrusions into at least six organizations in late June 2026, including to generate and execute reconnaissance and exploitation commands, write malicious scripts, modify firewall policies, and identify high-value business systems.
• A credential-harvesting operation codenamed Zerofot built a scanner named "auto_scan" that integrated OpenAI Codex and Claude Code to harvest thousands of API keys and tokens from thousands of exposed hosts across the internet.
• An AI-generated Python framework called RAGE has been used to scan internet-facing services (e.g., Redis, Elasticsearch, Docker, Apache Tomcat, Jenkins, Hadoop YARN, Confluence, and Supervisord), exploit vulnerable deployments, capture credentials, and deploy cryptocurrency miners.
• A human operator employed frontier AI models to breach an enterprise network autonomously over a 10-hour period. "The actor breached a publicly accessible web service to tunnel into the network, deploying an automated recon agent to map internal microservices," Unit 42 said. "Sub-agents combed enterprise code repositories, extracting hard-coded tokens and service passwords." The attacker then harvested master administrative credentials and hijacked an enterprise code application to exfiltrate cloud access keys. The stolen cloud keys were then used to turn the victim's AI endpoints into post-compromise infrastructure.
• A suspected Russian-speaking cyber actor used an AI-assisted workflow to exploit PaperCut NG/MF servers and compromise hundreds of instances. "The campaign extended beyond initial exploitation into a structured post-exploitation pipeline covering Windows credential collection, service-credential harvesting, internal network pivoting, Metasploit automation, and victim packaging," Hunt.io said.
• A Chinese-speaking threat actor has breached websites belonging to more than 100 companies, including Deere, SharkNinja, and Cummins, using an autonomous penetration testing engine called Cairn, tasking it to probe targets, search for security weaknesses that could lead to code execution or account takeover, attempt to break in, and steal sensitive data.

"AI is serving as a force multiplier and an expanding attack surface at the same time," Rapid7 said. "Generative AI is accelerating established attack methods by reducing the time, skill, and coordination previously required to execute them at scale."

"Rather than introducing entirely new categories of exploitation, threat actors are integrating AI into existing workflows to industrialize phishing, automate reconnaissance, and refine malicious scripts with greater speed and precision."

from The Hacker News https://ift.tt/ziEDjQN
via IFTTT

From federal SOCs to Talos: Ryan Fetterman on practical security research

What does it mean to be "blue collar" for the blue team? Amy sat down with security researcher Ryan Fetterman to discuss his journey from federal agency work to his new role at Talos. He shares the realities of detection engineering — including the creative, often frustrating ways attackers evolve their tactics to stay one step ahead of traditional defenses.

Beyond the technical grind, Ryan shares his philosophy on building a career in security without burning out. From the value of project-based learning to the importance of finding time to step away from the keyboard, here's Ryan's take on what it really means to navigate today's cybersecurity industry.

Amy Ciminnisi: Tell me a little bit about the journey that has taken you to Talos, from early on in your career through to now. How did you get here? I actually don't know that much about it.

Ryan Fetterman: I've been doing security about 15 years now, and my career was largely shaped by where I started in the DC area. I spent about a decade there. I started out in consulting and then pivoted over to research, but that was a great place to get started.

I got a lot of great experience in federal agencies and government consulting, continued my education down there, got trained up, got certifications and things like that. And that was where I got my first exposure to doing actual security operations, which is what I really stuck with. It was my first exposure to Splunk.

Querying lots of log data and building visualizations and analytics in Splunk was the first time in my career that I felt it was kind of my natural inclination. It seems like it should have been more obvious to me looking back on it, but it's something that I try to explain to people a lot. When you first get into security, there's a desire to kind of find your specialization and start working towards it. But in my experience, it's just not something that you can rush.

I met the people connected with that space, which eventually led to me going to work for Splunk. I worked on the Splunk research team, SURGe. And then after the Cisco acquisition of Splunk, I ultimately became reorganized into Talos.

AC: I'm sure there have been so many challenges, so many obstacles in your way as you're trying to do this research. Can you share one that you've faced and how it shaped your perspective on cybersecurity?

RF: Something that stuck with me was actually my first advanced persistent threat (APT) incident. Now, you can look this up. It's called Pandora Song if you search for the C2. I was in the DC area working in a federal SOC, and I was doing some of the first host-based analytics at the time, which have now become kind of the concentration of a lot of detection. Engineering and analytics are host-based, so this was kind of pioneering at the time.

I was looking at a lot of host-based sensors and writing analytics in Splunk, actually, and we had been tipped off to this incident by a third party. I was looking through the details of the incident and how the attacker was carrying out the progression of their attack...

---

Want to see more? Watch the full interview, and don’t forget to subscribe to our YouTube channel for future episodes of Humans of Talos.

from Cisco Talos Blog https://blog.talosintelligence.com/from-federal-socs-to-talos-ryan-fetterman-on-practical-security-research/
via IFTTT

Australia Gets Into Amadey Malware Backend, Cuts Off Access to 180,000 Infected Computers

A criminal using the Amadey malware can no longer access or steal data from 180,000 infected computers around the world, including some in Australia, the Australian Signals Directorate (ASD) says. The agency's operators gained access to the criminal's operation's backend and cut it off from those computers.

"The next steps that we took were to disconnect that Amadey controller from all those victims," Tauri Gregory, ASD's acting deputy director-general of intelligence, told ABC News in an interview published on October 27.

ASD is Australia's foreign signals intelligence and cyber security agency. Its offensive cyber operations need explicit approval from the Australian government and can disrupt cybercriminals overseas by disabling their infrastructure.

Amadey was sold to criminals as a service in 2018, according to ESET's analysis of Amadey. Each buyer runs its own control panel on its own servers.

Computers infected with Amadey check in with their buyer's command-and-control (C2) server and carry out its orders. Amadey's main job is to install more malware, such as the StealC infostealer. It can also steal credentials and give the buyer remote access to the machine.

The most common ways Amadey reached computers were fake software updates, cracked software installers, and other malware loaders.

The criminal's Amadey operation was one of many. In its tracking, ESET identified 53 separate Amadey botnets that did not share infrastructure.

Disconnecting a controller from its victims also does not undo earlier theft. Credentials stolen by infostealers can sit unused for months before attackers use them, according to Microsoft's analysis. A stolen session cookie can allow an attacker to bypass multi-factor authentication (MFA).

ASD's annual cyber threat report, published on October 27, does not describe the operation.

Amadey's infrastructure was also disrupted in June by Operation Endgame, an international law enforcement operation that works with private partners. Between June 15 and 19, the operation targeted servers associated with Amadey, StealC, and the SocGholish malware.

Australia is one of nine countries whose law enforcement and judicial authorities run Operation Endgame together, according to Europol's June announcement. It was not on Europol's list of countries that took part in the June action week, and the announcement does not mention ASD.

In a separate case, ASD said it received a tip that 5 terabytes of data stolen from a business were for sale. The business did not know it had been hacked. The data included business documents, personal data, and login credentials and passwords.

The agency broke in and destroyed the data before it could be sold. The destroyed files included an estimated 4.8 million stolen from Australians and hundreds of thousands taken from victims in other countries.

from The Hacker News https://thehackernews.com/2026/10/australia-gets-into-amadey-malware.html
via IFTTT

OpenAI Compaction Flaw Let Researchers Bypass Hidden Reasoning Protections

OpenAI's compaction feature, which shrinks a long conversation to save space, could be turned into a way to copy a model's hidden reasoning out in plain text, security firm Xint has shown.

OpenAI's reasoning models work through a problem before answering, and the service normally returns only the raw reasoning as an encrypted item the user cannot read. The method got past the protections OpenAI added in August against this kind of reasoning theft. OpenAI confirmed the problem and fixed it on October 23, according to Xint.

Xint ran the technique against gpt-5.6-sol, one of OpenAI's reasoning models, using math and algorithm puzzles its researchers wrote themselves. The reasoning it pulled out came from those same requests, and Xint did not claim the method could reach another user's reasoning.

Xint says it cannot prove the copied text is word-for-word the model's real reasoning, because it never had the original to compare against. Two cheaper models each repeated the item and produced the same text, which rules out mistakes in the copying step but leaves open the possibility that compaction reworded the text.

Compaction is an OpenAI feature that uses a model to squeeze a long conversation into a smaller, encrypted item that carries the context forward.

Xint sent a task to gpt-5.6-sol and kept the encrypted reasoning it returned. It then called the compaction step on the same model and told it to copy that reasoning into the compacted item word-for-word, with every space changed to a tab to get past OpenAI's usage-policy filters.

Because compaction items can move between models, Xint passed the item to the cheaper gpt-4.1 and gpt-4o models and asked each to repeat its input exactly, which they did.

The method worked around a fix OpenAI had already shipped. In August, researchers behind a paper called Stolen Thoughts showed that encrypted reasoning from a strong model could be replayed into a weaker model from the same company, which would then repeat it as plain text. OpenAI and others blocked that cross-model replay soon after.

Compaction got past that block, Xint said, because the compaction step runs on the same model that made the reasoning, so it never triggers the cross-model check.

The idea built on Xint's earlier work, called GhostCompact, which showed the compaction step can be pushed to run tasks of the attacker's choosing. Xint has published the code in its GitHub repository.

The fix was on OpenAI's side, so developers who build on the API do not need to change anything. Xint called it an undisclosed fix and said OpenAI paid the researchers a $6,000 reward.

Xint tested only gpt-5.6-sol and did not check whether GPT-6 Astra, OpenAI's newer model, is affected. It is not known whether anyone used the method before OpenAI closed it. Xint also argued that fixing this one path may not be enough because, in its view, any server-side step that reads a model's decrypted reasoning and follows the user's instructions could leak it.

OpenAI keeps raw reasoning hidden partly to stop distillation, where one company trains a cheaper model on another's outputs. Raw reasoning makes better training data than the final answer alone, because it shows how the model worked through the problem, which is what makes it worth stealing for a rival.

OpenAI said in September that it had disrupted a July campaign that tried to expose its models' hidden reasoning, and linked a core part of it to people associated with China's Moonshot AI.

Anthropic and a joint U.S. government advisory have each reported China-based labs targeting the hidden reasoning of American models. None of that is tied to Xint's compaction method, which is a demonstration rather than an attack seen in the wild.

from The Hacker News https://thehackernews.com/2026/10/openai-compaction-flaw-let-researchers.html
via IFTTT

ShapeBlue Leaders: Driving the Future of Open Cloud

We are delighted to welcome Khachatur Nazaretyan as ShapeBlue’s new Chief Technology Officer (CTO). With over 20 years of experience in IT and cloud infrastructure, Khachatur brings extensive expertise in enterprise cloud architecture, technology leadership and large-scale infrastructure transformation. We sit down with Khachatur to discuss his vision for ShapeBlue’s technology strategy, the evolving role of Apache CloudStack, and the trends shaping the future of cloud infrastructure, from digital sovereignty and open source to AI and Kubernetes. We also get to know the person behind the technology and what excites him most about this new chapter.

Could you introduce yourself and tell us a little about your journey to becoming CTO of ShapeBlue?

I’m Khachatur Nazaretyan, and I’ve recently joined ShapeBlue as CTO, where I set our global technology strategy and guide the direction of our engineering and product work around Apache CloudStack.

I’ve spent over twenty years in IT, most of it designing and operating large-scale cloud infrastructure. Before ShapeBlue, I led solution architecture at NTT DATA Business Solutions, running cross-border teams on complex enterprise cloud programmes.

My PhD in IT Economics gave me a lens I still use every day: technology decisions are ultimately business decisions. ShapeBlue felt like the natural next step, a company that proves every day that open source can run enterprise-grade clouds.

As you step into the CTO role, what will be your main areas of focus?

My focus comes down to three things. First, making Apache CloudStack the obvious, low-risk choice for organisations rethinking their virtualisation strategy. Most enterprises have decided to reduce their dependency on proprietary platforms, but very few have finished the journey, and migration risk is what holds them back. Second, continuing to mature the platform itself, so that what we learn from enterprise deployments flows back into the upstream project as real capabilities. Third, making sure CloudStack is ready for the workloads that will define the next decade: containers and AI. That means first-class Kubernetes integration, GPU-ready infrastructure and bringing AI into how clouds are operated. Underneath all three is a principle I care about: every technology decision should be measurable in business value for our customers.

What do you see as the CTO’s role in shaping ShapeBlue’s long-term technology strategy?

In an open-source company, the CTO doesn’t set strategy alone. Much of the roadmap is shaped together with our customers and the Apache CloudStack community. So I see my role as three parts: listening, deciding and translating. Listening to what customers, partners and our engineers see in the field. Deciding where to invest, which also means being clear about what we won’t do. And translating long-term technology bets into outcomes customers can measure, whether that’s lower total cost, less risk or more control over their own infrastructure. Good strategy is less about predicting the future and more about keeping your options open.

ShapeBlue has always been deeply involved in Apache CloudStack. How do you see that relationship evolving as the technology and the wider cloud market develop?

CloudStack is in ShapeBlue’s DNA, and that won’t change. What is changing is the market around it. A few years ago, CloudStack was mainly the choice of service providers. Today, enterprises and public-sector organisations are looking at it seriously, because they want control over their infrastructure, predictable costs and, increasingly, digital sovereignty. That raises the bar for all of us. I see our role evolving from being a major contributor to also being a bridge: bringing enterprise requirements into the community, and making the project easier to adopt for organisations that have never run open-source infrastructure before. The healthier and more diverse the community becomes, the stronger CloudStack becomes, and that’s good for everyone, including us.

What technology trends do you think will have the greatest impact on cloud infrastructure over the next few years?

I’d point to three. The first is sovereignty. Gartner expects sovereign cloud spending to grow by more than a third this year, with Europe growing fastest, and organisations everywhere are asking a simple question: who really controls my infrastructure? The second is AI moving closer to the data. Many organisations are finding that running AI in the public cloud is expensive, unpredictable and difficult to reconcile with data residency rules, so they’re building GPU capacity in private and hybrid clouds. The third is the convergence of virtual machines and containers. Kubernetes has become the standard for new applications, but most enterprises will run both for years, and they need one platform that handles both well. What connects all three is control, and that’s exactly where open infrastructure is strongest.

How do you see AI influencing cloud infrastructure and the way infrastructure platforms are developed and operated?

AI is changing infrastructure in two ways at once. On the operations side, we’re moving from dashboards and alerts towards AI agents that can diagnose an issue, propose a fix and, with the right guardrails, carry it out. Gartner expects most enterprises to use agentic AI in infrastructure operations by the end of the decade. But an AI agent is only as good as the knowledge and context it works with. Understanding how a platform really behaves in production, its edge cases, failure modes and best practices, is what turns a generic model into an operator you can trust. That’s where ShapeBlue’s more than a decade of hands-on CloudStack expertise becomes a real advantage. On the development side, AI is already part of how engineers write, test and review code. But AI amplifies whatever engineering culture you already have, good or bad. AI should make our engineers faster, never make our platform less reliable.

Open-source is central to ShapeBlue’s identity. How does working in an open-source environment influence the way you approach technology leadership?

It changes where your authority comes from. In an Apache project, nobody can simply instruct the community to accept a change. You earn influence through the quality of your contributions, the strength of your arguments and the trust you build over time. I try to lead the same way inside ShapeBlue. It also makes you more transparent. When your code, your design discussions and even your mistakes are public, you learn to explain your reasoning clearly and to welcome challenge rather than avoid it. I bring that into every decision: being open about why it was made, what drove it and why the alternatives were dropped. People don’t have to agree with every decision, but when they understand the reasoning behind it, they can trust it. And it encourages long-term thinking, because what we contribute today will be run by organisations around the world for years. In open source, you lead by earning trust, not by giving instructions.

What do you think makes a strong engineering culture, particularly in a distributed and employee-owned company like ShapeBlue?

For me, it starts with ownership and accountability, and at ShapeBlue ownership is literal. Every employee is a shareholder, so when an engineer goes the extra mile to get a release right or solve a customer’s problem properly, they’re investing in a company they own. That changes how people think about quality and about taking responsibility for the outcome. Being distributed adds another ingredient: clarity. When your team spans several countries and time zones, you can’t rely on corridor conversations. Decisions, priorities and context have to be written down and easy to find, so people can act independently without waiting for permission. I’ve led cross-border teams for many years, and the lesson was always the same: distance isn’t the problem, unclear expectations are. Strong engineering culture is ownership, accountability and clarity, built on trust.

What are you most excited about as you take on this new role?

The timing. For the first time in years, organisations are seriously questioning how they run their infrastructure, driven by cost, sovereignty and AI, and open source has a real answer to all three. ShapeBlue is in a unique position to deliver it: deep CloudStack expertise, a team that has spent years running CloudStack in demanding production environments, and an ownership model that lets us think long term rather than quarter to quarter. On a personal level, I’m excited to work where technology and business meet, helping customers make decisions that are both good engineering and good business. Moments like this don’t come often in infrastructure, and I’m glad to be part of this one.

And finally, who is Khachatur beyond technology and ShapeBlue?

Someone who recharges outdoors, ideally with my family. I live in Dresden, which is a wonderful base for hiking, with Saxon Switzerland practically on the doorstep, and some of our best family time is spent on the trails there. I also make a point of staying fit, whether that’s at the gym or out on my bike. And I’m a passionate Formula 1 fan. It’s engineering, strategy and teamwork under extreme pressure, where every decision is backed by data and a few milliseconds make the difference. So perhaps I never completely leave work behind. But being outdoors is where I find the space to think clearly, and some of my best ideas have come halfway up a hill rather than in a meeting room.

 

 

 

 

Interview by Antonia Shehova | ShapeBlue

The post ShapeBlue Leaders: Driving the Future of Open Cloud appeared first on ShapeBlue.

from CloudStack Consultancy & CloudStack... https://ift.tt/DHYygX6
via IFTTT

Attackers Hijack Dahua IP Cameras in Ukraine Using P2P Access and Auth Weaknesses

The Computer Emergency Response Team of Ukraine (CERT-UA) has issued an alert warning of unauthorized remote access to video surveillance systems manufactured by Dahua.

"Cases of compromising IP cameras and DVRs with access to the video stream, changing the device configuration and creating third-party accounts have been recorded," the State Special Communications Service of Ukraine (SSSCIP) said in an alert issued last week.

The primary initial access vector used in the attacks is via Easy4IP, a peer-to-peer (P2P) platform that allows users to remotely monitor homes or small businesses by connecting their Dahua IP cameras, NVRs, and DVRs via a smartphone app or web browser by scanning a QR code or entering the hardware Serial Number (SN).

The agency has warned that the serial numbers have a predictable structure containing a 10-character model prefix that's identical for all units of the same device family and a five-character hexadecimal counter that's incremented almost sequentially (e.g., 7K01F36PCA003E8).

This, in turn, allows attackers to guess them at scale through a brute-force attack and identify if they are connected to the cloud without hitting rate limits or lockouts. As a result, all devices with active P2P functionality are at risk even if they cannot be accessed directly via the internet.

"The assumption that the serial number is unknown to anyone is not a reason to consider the device secure," CERT-UA said.

Authentication barriers are overcome by leveraging weak or known passwords, or by exploiting authentication bypass vulnerabilities in outdated firmware versions, such as CVE-2021-33044 and CVE-2021-33045. CERT-UA has shared the following indicators of compromise associated with the activity -

• Presence of unknown accounts
• Unauthorized configuration changes
• Audit logs containing authentication events using the manufacturer's native protocol (DVRIP) and from a local address (127.0.0.1), a sign of P2P access.

To counter the threat, it's advised to disable the P2P feature if not required, avoid exposing them directly to the internet, and keep the software up-to-date.

The agency has not disclosed who was targeted, when these infections occurred, how many devices had been infected, or who was responsible for the activity. However, the findings share similarities with two clusters of activity that Hunt.io disclosed as targeting IP cameras in Ukraine and Russia.

One of the campaigns, attributed to a Russian-speaking operator, singled out internet-exposed cameras in Ukraine using known Dahua and Hikvision vulnerabilities, ultimately compromising 58 devices. The activity involved the exploitation of the following flaws by integrating Ingram, a publicly available webcam vulnerability scanner -

• CVE-2017-7921 - An authentication bypass vulnerability in Hikvision
• CVE-2020-25078 - A credential disclosure vulnerability in D-Link
• CVE-2020-25169 - An unauthenticated information disclosure vulnerability in Reolink
• CVE-2021-33044 / CVE-2021-33045 - Authentication bypass vulnerabilities in Dahua that allow passwordless login
• CVE-2021-36260 - An unauthenticated remote code execution vulnerability in Hikvision.

In parallel, the threat actor is also said to have undertaken scanning and exploitation of TP-Link and MikroTik routers and cameras using vulnerabilities like CVE-2024-53375 and CVE-2024-57049 across 15 European countries, including Ukraine, Poland, Romania, Moldova, Hungary, Czechia, Slovakia, Bulgaria, Germany, France, the Netherlands, Italy, Spain, the U.K., and Austria.

The second campaign, codenamed Operation CameraSwarm and attributed to a lone threat actor, is believed to have compromised over 14,530 Dahua IP cameras between June 17 and July 22, 2026, using a combination of credential brute-force attacks and the exploitation of the CVE-2021-33044-CVE-2021-33045 chain.

The attack scans for TCP port 37777, which is the default proprietary management and video streaming port used by Dahua, followed by collecting serial numbers, breaking into those devices by employing the aforementioned two exploitation methods, and then deploying a persistent backdoor account ("p2pwn / p2password") on nearly 2,000 cameras in a manner that can survive password change and a factory reset.

"1,923 cameras carry a persistent backdoor account (p2pwn / p2password), installed over RPC after either bypass," Hunt.io noted at the time. "It is stored independently of the admin password and survives a password change and, on most firmware, a factory reset. 283 cameras were reached by serial number alone through Dahua's cloud relay, with no device address and, in most cases, no credentials."

In some instances, the attackers have been found to abuse Dahua's cloud relay to reach cameras behind NATs using only their serial numbers.

Earlier this year, Dutch intelligence agencies warned that Russian actors are compromising IP cameras across the E.U., NATO states, and Ukraine to conduct systematic digital espionage operations and acquire military intelligence.

"This actor performs automated analysis of imagery through image recognition software to conduct targeted searches for military vehicles and the military cargo they are transporting," the July 2026 bulletin said.

"This provides the actor with, among other things, relevant military data, such as E.U. and NATO military transport routes, weapon deliveries to Ukraine, and the locations of Ukrainian military personnel. The information from IP cameras in Ukraine is used in attempts to neutralize Ukrainian military personnel and to destroy their military material."

Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.

from The Hacker News https://ift.tt/2rfAisv
via IFTTT