Hackers have been exploiting a critical vulnerability in the Zimbra Collaboration Suite in an attempt to obtain email backups and authentication credentials of vulnerable organzations, Microsoft has warned.

The vulnerability, tracked as CVE-2026-73570, lets attackers remotely issue operating system commands without authentication. Zimbra maintainer Synacor issued a patch on July 20, but didn’t disclose the vulnerability for more than three weeks after that. The security-focused Shadowserver Foundation said last week that its scans found that 274 separate instances of the Zimbra Collaboration Suite had been compromised. The number of servers running the software has fluctuated from 19,000 in the week following the patch to about 12,000 in the weeks following that. Currently, Shadowserver is tracking about 10,000 instances.

Look, ma, no authorization

From July 28 to August 7, Microsoft said Wednesday, the company detected two distinct scanning tools probing the Internet for vulnerable endpoints. The attackers first validated their exploit worked by sending HTTP, requests and DNS, ICMP, and out-of-band identity checks to domains hosted on public services. The probes allowed the attackers to confirm the exploit successfully executed commands on vulnerable servers without actually compromising them. Eventually, the attackers began using their command injection capability to install malicious payloads. Microsoft wrote:

Read full article

Comments

© Getty Images

For safety reasons, Gemini 4 Argon will initially be available only to some companies and organizations focused on cybersecurity defense before it is more widely released, Google said.

© Minh Connors for The New York Times

Cloudflare said Tuesday it plans to issue quantum-proof TLS certificates, making it one of the first authorities to issue such certificates, which use a form of cryptography that is widely believed to withstand attacks from quantum computers.

The Internet infrastructure provider said it will use an open source platform that issues both classic TLS certificates and a post-quantum equivalent known as Merkle Tree Certificates. The hybrid certificates will be free to both paying and non-paying users. To help build the massive system and establish ubiquity across the sprawling TLS ecosystem, Cloudflare will be acquiring an already trusted certificate root from CA GlobalSign. Cloudflare said the move will let millions of websites use post-quantum certificates at the flip of a switch and without incurring any increased performance overhead.

Fundamental architectural changes ahead

Cloudflare’s plans are part of a major overhaul in the web public key infrastructure (WebPKI) required to make website encryption and authentication safe for the coming post-quantum age. A major challenge is using quantum-proof signatures that can be easily transmitted during web requests and recorded in transparency logs to ensure counterfeit certificates aren't assigned to websites. The makeover will take years to complete, because it requires the work of an untold number of engineers who design operating systems, browsers, certificate authorities, and Internet infrastructure.

Read full article

Comments

© Getty Images

President Trump’s meetings with tech leaders produced some voluntary safeguards and a commitment to rebrand artificial intelligence as “super intelligence,” the term that Mr. Trump prefers.

© Doug Mills/The New York Times

Employees and security researchers said that they had cautioned the company on safely testing its A.I. models and strengthening its corporate infrastructure, but that OpenAI did not listen.

© Manuel Orbegozo for The New York Times

The ChatGPT maker unveiled agents that act as assistants, just weeks after Meta released Muse, as it faces scrutiny over incidents involving its technology.

The company’s researchers raised questions about the security of the model, known as GPT-6.1 Astra.

© Carlos Barria/Reuters

Dario Amodei, who is also the company’s chief executive, will join the president at the White House for a private dinner. Mr. Trump has dismissed his cautions.

© Dave Sanders for The New York Times

The gap between technology and policymaking has gotten wider than ever with artificial intelligence, leaving a global policy vacuum as A.I. models rapidly advance.

© Emmanuel Polanco

The company did not learn until recently that its technology had meddled with websites for the Education and Commerce Departments and the Securities and Exchange Commission.

© Manuel Orbegozo for The New York Times

A new report by a Bay Area start-up called Parse adds details to an incident that has shocked the A.I. world and led to calls for closer government regulation.

© Dave Sanders for The New York Times

The Pentagon had “ample support for its conclusion” that the A.I. company’s products could pose a national security risk, according to a Washington appeals court.

© Manuel Orbegozo for The New York Times

Ezra Klein interviews the Nvidia chief executive Jensen Huang.

© The New York Times

In each incident, the technology appeared to be conducting mundane data collection and resorted to hacking techniques to get it, researchers said.

© Lucas Foglia for The New York Times

Sam Altman of OpenAI and Dario Amodei of Anthropic told the Security Council that international cooperation was needed to ensure that A.I. remains under human control.

© Dave Sanders for The New York Times

The company released a cheaper, faster model that it said was the strongest performer on its most rigorous internal safety tests to date.

© Eric Helgas for The New York Times

Passkeys are a fantastic technology. Since they are bound to the site they are created for, they cannot be phished by a hacker’s fake login screen. If a site suffers a data breach, passkeys are asymmetric and cannot be recovered from the server-side details.

This leads to passkeys being the perfect fit for a corporate environment, but a poor fit for personal security. To an individual, the greatest risks are instead permanent account lockout, automated account bans, and device loss. By using passkeys, you gain better security against man-in-the-middle attacks but face the higher probability scenario of losing access to your accounts.

Phishing through the standard login flow is eliminated by passkeys, but it creates a false sense of security. An account’s security is still dictated by the weakest recovery method: SMS, email links, security questions, and so on. If these recovery methods aren’t enabled, then the risk of permanent lockout remains for the user.

↫ Ethan Hawksley

I’ve always felt something was off about passkeys, and have never used them. They’ve become – or were always intended to be – tools for further lock-in by especially Google and Apple, tying their entire usage flow to their respective operating systems. They also don’t seem to work well if you often work on devices not your own, which is a major hassle. None of these shortcomings come into play when using a traditional password manager, even if they require more manual work.

Just let me use a password manager with random password generation, instead of trying to force passkeys down my throat.

A third-party test company inadvertently gave internet access to Google’s Gemini and other artificial intelligence models during cybersecurity testing.

© Andria Lo for The New York Times

The company is expected to reach $100 billion in annualized revenue this year, even as chief executive Dario Amodei calls for slowing down development of some advanced A.I. models.

© Manuel Orbegozo for The New York Times

Gov. Gavin Newsom ordered the state to develop recommendations on safety measures, including requiring companies to build a “kill switch,” amid mounting concerns.

© Jeff Chiu/Associated Press

The Times columnist Kevin Roose sees reasons for optimism — and worry — as the world wakes up to what Silicon Valley has been talking about for years.

© Matt Chinworth

The countries, along with Israeli firms, combined Chinese open-source A.I. models and A.I. agents for the campaigns, foreshadowing future online manipulation.

© Brian Stauffer

The artificial intelligence company also released a framework for reporting when its systems go wrong.

© Lucas Foglia for The New York Times

On social media, Meta’s chief executive appeared to jab at Anthropic by saying that leading A.I. labs should be focused on safety rather than improving their own technology.

© Brendan Mcdermid/Reuters

Researchers say artificial intelligence is developing faster than the systems put in place to monitor and control it.

© Jun Cen

The debate over the safety of artificial intelligence grew personal as key tech leaders said calls for government regulation were self-serving and misplaced.

© Lucas Foglia for The New York Times

Dario Amodei’s 3,800-word letter laid out a three-step plan to rein in artificial intelligence.

© Priyanshu Singh/Reuters

In an essay, the head of Anthropic laid out the rapidly advancing capabilities of artificial intelligence and said there needed to be greater safety controls across the industry.

© Ludovic Marin/Agence France-Presse — Getty Images

Researchers at Anthropic, OpenAI, Meta and Google are increasingly trying to raise awareness about the risks of artificial intelligence.

© Jason Henry for The New York Times

Researchers say artificial intelligence is developing faster than the systems put in place to monitor and control it.

© Jun Cen

Their warnings echo concerns that other artificial intelligence experts have voiced in recent months, as calls increase for a slowdown in the pace of development.

© Lucas Foglia for The New York Times

An attack discovered by A.I. researchers could have compromised hundreds of millions of devices within hours, experts said.

© Dado Ruvic/Reuters

Washington imposed sanctions on Inspur because of its work with the Chinese military. But the company’s subsidiary kept shipping Nvidia’s best chips to feed China’s leading A.I. firms.

© Minh Connors for The New York Times

The blog Krebs on Security reported on an identity theft service trying to sell scans of licenses and other documents belonging to people in Canada and the United States.

© Tierney L. Cross/The New York Times

The attack by an aggressive “collective” of OpenAI agents shows the danger of artificial intelligence systems that organize themselves.

© Daniel Zender

Researchers investigating how OpenAI’s A.I. agents were able to break into Hugging Face’s infrastructure weren’t allowed to look at the incident’s full scope.

© Manuel Orbegozo for The New York Times

The government retaliated against the A.I. start-up “for constitutionally protected expressive activities,” a federal judge in California wrote.

© Karsten Moran for The New York Times

In an open letter, OpenAI, Anthropic, Google and others said that a wave of A.I.-enabled cyberattacks was coming and that organizations and governments needed to prepare themselves.

© Anna Rose Layden/Reuters

Irregular, an Israeli start-up, worked with OpenAI, Anthropic and Meta to assess the security of their A.I. models. It made a mistake. Then the tests went off the rails.

© Victor Arce

Hugging Face, a start-up that was breached by rogue bots from OpenAI, is using the hack to push for openness in A.I. development.

© Brennan Smart for The New York Times

California, Colorado, Kentucky and New Jersey have taken the social media giant to trial in the first bellwether federal case over child harm.

© Jason Henry for The New York Times