I regularly use my iPhone to scan physical documents like medical reports, identity cards, forms from my bank, etc. Since 2015 or so, I've used an app called Scanner Pro to get the job done. It works well enough, but the best features require a subscription and it is no longer as fast as I'd like it to be. I've long known about Apple's built-in scanner in the Notes app, but it isn't as convenient as the app I've been using, so I never made the switch.

That changed when I recently discovered another built-in scanner on the iPhone, hidden away in the Preview app, of all places. This one is fast, free, and well integrated with the Files app, which is a big plus. Here's why you should consider using it

Your iPhone's Preview app has a hidden document scanner

Your iPhone ships with an app called Preview, which was added with the release of iOS 26 in 2025. Now, when you open a document in the Files app, your iPhone will automatically switch to Preview and load the it. However, if you open the Preview app directly, you'll see a "Scan Documents" button front and center. I've been using iOS 26 since the developer betas released, but I only noticed this feature after the recent release of the iOS 27 betas.

When you tap Scan Documents in Preview, your iPhone will fire up the viewfinder, and you can point the device at the documents you want to scan. Like Scanner Pro, the Preview app's scanner automatically identifies document borders, takes a picture to scan, and reopens the viewfinder so you can point the camera at the next page; it'll scan that quickly too. Continue this process till you're done scanning, after which you can hit the checkmark button in the top-right corner. The scanned PDF will automatically be saved to your iCloud Drive folder, without the need to export it. I found this process to be really fast and intuitive enough to recommend to my family members, who resist any technology that requires them to install a new app or press more than two buttons.

When the scanner is open, you'll see four buttons near the bottom of the screen. The big shutter button lets you manually click pictures for the scan, and the other three let you toggle flash, set color filters, and toggle on the auto-shutter feature, respectively. Auto shutter is the best feature of this app, as it automatically scans a page the moment it detects borders, but it's not perfect. If you want more precise control over your scans, you can disable it, and control the shutter manually.

Why Preview's scanner is much better than the one in Apple Notes

I don't enjoy dealing with PDFs in Apple Notes, and that's the best argument for using the scanner in Preview, which immediately saves those documents to the Files app. First, Notes makes it much harder to find and use the scanner: You need to open a note, tap the paperclip icon, and select the document scanner from the menu. The output is saved in the same note, and I find it unwieldy to deal with PDFs from within in the Notes app, which is best suited to viewing text-only notes.

I now only use the Notes app to scan documents when I specifically want to store the file in the Notes app. But other than the odd recipe I might scan to keep there, I don't foresee myself using the Notes scanner again. In most cases, Preview's scanner does a much better job.

Another third-party scanning app to consider

If you want more features than Apple's document scanner, there are third-party apps that may suit you better. In addition to Scanner Pro, which I mentioned above, Adobe Scan does a great job with scanning, OCR (optical character recognition) and has a generous free tier. In the free tier, Adobe Scan lets you capture unlimited scans, provides 2GB of space in Adobe Document cloud, and offers OCR for documents up to 25 pages long.

The premium tier costs $10/month, and adds a bunch of PDF editing features such as combining PDFs, extracting specific pages from a scan, and editing text in PDFs. You also get to use OCR on scans up to 100 pages per document, up to 20 GB of cloud storage, and a tool called Magic Eraser, which can automatically remove your thumb or fingers from scanned pages. I think the free tier is good enough for most people, but the most annoying thing about Adobe Scan is that even the free tier requires you to sign up for an account. You can sign in with your Apple, Google, or Facebook accounts to make it quick, but it's still an unnecessary step for those who just want an app that'll let them start scanning the moment it's installed.

from Lifehacker https://ift.tt/467zamE

Tidal Cyber has announced Threat-Led Asset Visibility and Vulnerability Prioritization, new innovations extending the company’s Threat-Led Defense platform.

The announcement marks a significant advancement in defensive security, shifting the industry beyond static asset inventories, CVSS scoring, and disconnected exposure management toward an execution-centric model built on how adversaries actually execute attacks across the kill chain.

At Tidal Cyber, adversary procedures are not another data point. They are the organizing principle that connects threats, assets, vulnerabilities, and defenses into a single operational mode to:

• Identify the assets and defenses based that matter most based on their role in adversary execution and attacker success.
• Expose vulnerabilities that enable adversary execution and increase the probability of successful attacks.
• Prioritize defensive action using procedural-level intelligence, not inventory counts or severity scores.
• Measure defensive gaps against real-world adversary execution and identify the controls most likely to disrupt an attack.

Unlike security platforms that treat assets, vulnerabilities, and threats as separate domains, most asset management programs still cannot determine which assets attackers care about. And most exposure management platforms still stop at identification instead of answering the only question that truly matters:

“Can an adversary successfully execute this attack against my environment?”

That question fundamentally changes the defensive equation. Rather than evaluating assets, vulnerabilities, and defenses independently, Tidal Cyber correlates them through the lens of real adversary execution. Every procedure becomes a connective layer that reveals how vulnerabilities enable attacks, which assets are operationally relevant, and where defensive controls can interrupt attacker progress. Instead of measuring isolated risk, organizations can understand and reduce the likelihood of attacker success across the entire attack lifecycle.

“Most security platforms still prioritize based on severity scores, inventory counts, or generalized risk models,” said Rick Gordon, CEO of Tidal Cyber. “But adversaries don’t attack environments based on CVSS scores or asset databases. They exploit the path of least resistance. Threat-Led Defense changes the model entirely by aligning defenses to the assets, vulnerabilities, and procedures attackers actually use to execute attacks. This announcement represents another major milestone in our mission to redefine how organizations understand, prioritize, and defend against modern cyber threats.”

Threat-Led Asset Visibility moves beyond inventory management by identifying which assets are operationally relevant to adversary execution, where defensive blind spots exist, and those gaps increase influence attacker success.

Threat-Led Vulnerability Prioritization moves beyond static severity scoring by correlating vulnerabilities directly to adversary procedures, operational tradecraft, and the likelihood of successful; attack execution.

Instead of asking, “Which vulnerabilities are most severe?” organizations can now answer the question that matters most: “Which vulnerabilities materially increase the likelihood of attacker success against the assets and procedures that matter most?”

This approach enables organizations to prioritize:

• vulnerabilities tied to active adversary tradecraft,
• control gaps impacting critical attack procedures,
• and defensive actions that reduce real operational risk.

The announcement also builds on Tidal Cyber’s continued innovation strategy, including the recent separation of MITRE ATT&CK CTI from Tidal Cyber CTI and proprietary intelligence sources, an industry-first approach designed to provide greater transparency, attribution clarity, and procedural precision across modern threat intelligence.

“Threat-Led Defense starts with a simple principle: you cannot reduce residual risk unless you understand how adversaries actually execute attacks and how that execution impacts your defensive environment,” said Frank Duff, Chief Innovation Officer of Tidal Cyber.

“That is why procedures are foundational to everything we do. Assets alone do not increase risk. Vulnerabilities alone do not explain attacker success. The value emerges when adversary procedures become the connective tissue between threats, vulnerabilities, assets, and defensive controls creating a unified operational model for disrupting attacks across the entire kill chain.”

from Help Net Security https://ift.tt/hjkNIYT

Organizations build, deploy, and operate AI in the cloud, but basic cybersecurity hygiene is often sacrificed for speed, according to Orca Security’s 2026 State of AI Security Report.

Building AI without security

Fifty-six percent of AI adopters have deployed agent frameworks into production, and 51.5% use AI to build custom applications. Orca also found that 81.2% of companies running AI packages have at least one known vulnerability, and 99.9% of AI vulnerability alerts with an available fix remain unpatched. These findings show how quickly AI has become operational infrastructure without a corresponding increase in security maturity.

API-based AI is embedded in development workflows with access to codebases, terminals, environment variables, and credentials, creating new attack surfaces.

Organizations deploying AI agents also deploy agent frameworks. Every production agent represents a new non-human identity with its own permissions, memory, and potential blast radius. Retrieval-augmented generation (RAG) pipelines allow LLMs to access internal documents, customer data, and proprietary knowledge at query time.

More than half of AI cloud service users, operate four or more distinct AI service types. Between 87% and 98% of organizations across the three major cloud providers have not configured customer-managed encryption keys for their AI services. They manage complex AI ecosystems connected to enterprise data, cloud services, identities, and production workflows.

“AI has introduced an entirely new operational layer into cloud environments,” said Nir Mishal, CISO at Orca Security. “Organizations now have agents making decisions, vector databases connected to enterprise data, and AI services spread across multiple cloud providers. Security teams need unified visibility across that entire environment, paired with automated prevention, to understand where risk actually exists and stop attackers before damage is done.”

Securing the AI supply chain

Attackers are moving across five layers of the AI stack: package registries, model hubs, developer tools, agent frameworks, and brand trust. Technologies across these layers are widely deployed in production environments.

Eighty-one percent of companies running AI packages have at least one known vulnerability, and 74.1% have at least one critical CVE. AI packages inherit vulnerabilities disclosed over the past five years, including CVEs published during the last 12 months, exposing production environments to both old and new threats.

A vulnerable library embedded in a dependency graph often outlives the patch cycle. AI workloads inherit the same problem despite release cycles that assume dependencies remain up to date.

In 2024, organizations often deprioritized patching AI packages because many vulnerabilities were considered difficult to exploit. Now, 99.9% of AI vulnerability alerts with an available fix remain unpatched.

Orca groups new AI-related packages vulnerabilities into three categories: SDKs for accessing hosted AI models, frameworks for building AI agents and integrations, and the rapidly expanding Model Context Protocol (MCP) ecosystem.

Managing AI agents and RAG

Despite the governance response making progress, adoption is not so many AI agents run with default permissions, logging, and no runtime separation from production systems. This gives attackers opportunity to weaponize them to execute commands and move laterally through the AI layer.

Sixty-four percent of AI adopters have deployed vector databases that connect LLMs to internal documents, customer records, and proprietary knowledge.

Businesses using retrieval-augmented generation (RAG) operate an average of 3.78 vector databases, making it more difficult to enforce consistent security policies across platforms, deployment models, and access methods.

Closing the governance gap

AI spans models, agents, packages, browser extensions, and cloud services. These technologies have spread across enterprises faster than security teams can inventory and secure them. Each introduces its own security model, encryption options, access controls, and compliance requirements.

AI coding tools can introduce vulnerabilities into software, making code review, secrets management, commit security policies, and security scanning essential.

Governments are expanding AI regulation. The EU AI Act introduces additional requirements for high-risk AI systems beginning on August 2, 2026. The United States continues to develop its AI regulatory framework, and Colorado’s amended AI law takes effect on January 1, 2027. China has expanded its cybersecurity framework with AI-specific requirements and mandatory labeling of AI-generated content.

AI services have created a new category of exposed credentials. API keys provide access to AI models, enterprise data, and AI services, making them attractive targets. Nearly 30% of AI adopters store at least one AI key in an insecure location. Keys committed to Git repositories may remain accessible even after they are removed from the codebase.

Fixing AI infrastructure exposure

Companies often deploy AI services with configurations that leave them exposed. Attackers increasingly target AI infrastructure by exploiting excessive permissions, public endpoints, weak authentication, and predictable configurations.

Common issues across platforms such as Amazon SageMaker, Azure OpenAI, and Google Vertex AI include missing encryption, broad access privileges, and internet-facing services that make lateral movement and data theft easier.

Strengthening AI encryption

Businesses that rely on provider-managed encryption keys have limited control over access to AI data. Provider-managed keys encrypt data at rest but do not allow customers to control key rotation, revoke access independently, or gain visibility into key usage.

Customer-managed encryption keys help protect training data, sensitive information, and AI models. Most organizations have not enabled them.

from Help Net Security https://ift.tt/1nqkWCr

Growing demand for compute capacity, power, cooling and low-latency connectivity is prompting organizations to reassess where AI applications run, according to CoreSite.

Public cloud continues to support experimentation and rapid deployment, while colocation is increasingly used for workloads that require predictable performance, dedicated infrastructure or close proximity to cloud services and enterprise data.

More than half of organizations have implemented or are upgrading AI technologies, an increase from the previous year. Generative AI, chatbots, predictive analytics and agentic AI have reached production environments at many organizations, indicating that AI deployments are moving beyond pilot projects.

Hybrid environments have become the preferred location for AI and machine learning workloads, while interest in on-premises deployments continues to decline. Colocation is emerging as a preferred environment for AI workloads that require additional power capacity and direct connections to cloud platforms.

“The levels of compute that AI requires are something new that enterprises are grappling with to manage effectively,” said Juan Font, President and CEO of CoreSite and SVP of American Tower.

“While the AI tools are effective, CIOs may not currently have accurate reporting on how widespread the usage is within their organizations. We’re seeing greater use of large language models, and the token usage, and therefore cost, is growing. So, when the actual invoices related to using these tools are shown to IT leaders, they start to rationalize and prioritize projects with higher ROI on AI spend.”

Colocation gains ground

Enterprises are expanding the role of colocation facilities within their infrastructure. They are deploying a broader range of applications in these environments, including web applications, human resources systems, security workloads and augmented AI applications.

Top technical drivers for moving workloads to a colocation environment (Source: CoreSite)

Organizations increased public cloud deployments of mobile applications, websites, chatbots and content delivery services compared with the previous year. Some workloads moved away from public cloud as organizations reassessed workload placement based on performance, security and infrastructure requirements.

Organizations prioritize security, uptime and predictable performance when selecting colocation providers. Businesses value direct connections to cloud platforms, scalable infrastructure and support for the higher-density power and cooling requirements of AI systems.

Connectivity becomes a priority

Direct connectivity between enterprise infrastructure and major cloud providers has become an important requirement for hybrid deployments.

79% of IT leaders said native, direct cloud connections are a very important capability for colocation providers. These connections provide lower-latency access to cloud services, reduce reliance on the public internet and simplify data movement between enterprise environments and cloud platforms.

Organizations are increasingly evaluating provider ecosystems that combine cloud platforms, network carriers, AI services, security products and managed services to support workloads across multiple infrastructure environments.

from Help Net Security https://ift.tt/AMb8PCz

Most PCs still run with a UEFI Secure Boot certificate authority, installed by default since 2013, that has now expired. That certificate signed the bootloaders letting machines start with Secure Boot turned on. Its expiry sits at the center of the sixth update to Debian 13, codenamed “trixie.” The point release carries mostly security corrections along with a few fixes for serious problems.

The Secure Boot problem gets handled through fwupd, updated to upstream version 2.0.20. The new build can update the Secure Boot certificate authority, the Key Exchange Key, and the revocation database on affected machines. Systems that skip these updates risk a specific failure. Future updates to “shim-signed” could leave them unable to boot with Secure Boot enabled. Debian advises users to apply the CA, KEK, and DBX updates supplied by their system OEM.

The shim package received its own attention. It moved to a new upstream release built with the default compiler, and its SBAT revocation level was set to 2025021800. The signed shim binaries were rebuilt to keep Secure Boot working with the 2023 Microsoft UEFI certificate, and the installer now checks for likely boot problems before it proceeds.

Licensing drove a second change. The “geoip-database” package reverted to a build dated around December 2019, because recent GeoLite versions conflict with the Debian Free Software Guidelines and cannot be shipped. Software reading the database may return stale network allocation data as a result. Debian encourages anyone depending on this data to obtain a GeoLite license directly.

Web tooling saw heavy patching. The curl package alone took 13 fixes covering bearer token leaks on redirects, reuse of the wrong cached certificate authority, connection reuse across HTTP Negotiate and proxy sessions, reuse of plaintext STARTTLS connections, a use-after-free in its SMB code, and leaked credentials during redirects. rsync gained a limit on overly long HTTP proxy response lines. python-urllib3, nginx, and squid each received separate advisories from the Security Team.

The apache2 web server received corrections for 13 tracked flaws. These covered use-after-free bugs, a cross-site scripting hole, several buffer overflows, denial-of-service conditions, out-of-bounds reads, and a file read issue. A further advisory, DSA-6323, covered additional apache2 work.

Virtualization users have a large batch to apply. The qemu emulator moved to a new upstream stable release carrying 25 security fixes. The Python interpreter shipped as python3.13 gained fixes for CR/LF injection in proxy tunnel headers, denial-of-service conditions, a path traversal, and a server-side request forgery.

Cryptographic libraries received targeted hardening. The libcrypt-pbkdf2-perl module changed its default hashing to HMAC-SHA256 and raised its default iteration count to 600,000, and it adopted constant-time comparison to close a timing attack. The nss library improved its handling of escape sequences during URI parsing. Separate advisories addressed openssl, gnutls28, libgcrypt20, and krb5.

The Security Team released more than a hundred advisories folded into this revision. Chromium accounted for close to a dozen of them, reflecting the browser’s steady stream of upstream releases. The Linux kernel appeared across several advisories covering its amd64 and arm64 signed builds. Firefox ESR, Thunderbird, Samba, PostgreSQL, and BIND rounded out the roster of widely deployed software with named fixes.

Several fixes targeted media and document handling, a common source of memory-safety bugs. giflib, libvncserver, graphite2, and rlottie all gained corrections for out-of-bounds access and memory corruption. The openslide library received a fix for a possible code execution flaw, and poppler corrected invalid signature creation.

Upgrading an existing installation can be achieved by pointing the package management system at one of Debian’s many mirrors.

from Help Net Security https://ift.tt/db68P1F

Here’s an overview of some of last week’s most interesting news, articles, interviews and videos:

Securing the inbox: Where identity, brand and security meet
Getting a verified logo to appear next to your email has traditionally meant having to work with two separate entities. You have to work with a DMARC partner for setting up DMARC and BIMI, then use a trusted Certificate Authority (CA) to purchase a Mark Certificate, and this means having to source a trusted partner for both which delays the project unnecessarily. Red Sift and GlobalSign have now folded both halves into a single package.

Researchers make the case for a cybersecurity AI scientist
Autonomous AI agents have started doing real security work. Language-model agents probe software for flaws, run penetration tests, and chain together attack steps that once needed a human operator. Research about security has stayed slower and more manual, built around expert scarcity and hand-designed experiments. A team at the Chinese Academy of Sciences wants to close that gap. In a recent paper, they define what they term the Cybersecurity AI Scientist. They describe a research system that moves from a question to experimental design, tool building, controlled execution, evaluation, and a written result on its own.

OpenAI and Anthropic are pulling in different directions
Companies are handing routine operational decisions to AI agents that plan, remember, and act on their behalf. These agents run on statistical models, and their behavior can drift across weeks and months. That drift opens a security gap outside the reach of standard monitoring tools. A study of about 1,080 open job postings at OpenAI and Anthropic maps where the two largest AI labs are taking this technology.

Orbia CISO Miranda Ritchie on building security into sustainable infrastructure
In this interview with Help Net Security, Miranda Ritchie, CISO at Orbia, talks about protecting industrial systems where software runs water, chemical and manufacturing processes. She explains why a cyber incident in these settings can harm people, equipment and the environment, and how spread-out sites and aging control hardware widen the risk.

Your coding agent says no in chat and yes in the code
Millions of developers share their keyboard with GitHub Copilot. Inside Visual Studio Code, it opens their files, writes and edits code, runs scripts, and reworks its own output across many turns. The safety testing that vets these agents still runs on chatbot rules: one harmful prompt, one response, graded alone. That rulebook misses where the real danger sits, according to a study from the Alan Turing Institute in London.

Attackers exploit critical Adobe ColdFusion vulnerability (CVE-2026-48282)
CVE-2026-48282, one of the maximum severity vulnerabilities patched in Adobe ColdFusion on June 30, 2026, has been targeted by attackers in the wild. Exploitation attempts were detected on July 2, through the honeypot sensors of cybersecurity threat-intelligence service KEVIntel, mere minutes after watchTowr researchers published a technical analysis of this and other ColdFusion flaws recently fixed by Adobe.

Accenture acknowledges security incident following 35GB data theft claim
Accenture appears to have suffered a data breach, the extent of which is currently unknown. On Monday, a threat actor going by the handle “888” posted on the cybercrime forum PwnForums, claiming to have breached the technology consulting company and stolen “just over 35gb of source codes” in July 2026.

Attackers using Langflow flaw for credential harvesting (CVE-2026-55255)
The US Cybersecurity and Infrastructure Security Agency (CISA) is warning about yet another Langflow vulnerability (CVE-2026-55255) leveraged by attackers in the wild. The flaw was added to the agency’s Known Exploited Vulnerabilities catalog on Tuesday, July 7, nearly two weeks after the Sysdig Threat Research Team observed it being actively targeted.

Microsoft releases fix for RoguePlanet Defender flaw (CVE-2026-50656)
Microsoft has finally released a security update for its Microsoft Malware Protection Engine, which fixes CVE-2026-50656, the Windows Defender local privilege escalation vulnerability triggered by the RoguePlanet exploit.

Extortion crew hijacks Microsoft 365 accounts via fake passkey setup
The Pink cyber extortion crew is tricking employees into giving them access to their Microsoft 365 accounts by faking Entra passkey enrollment requests. The attack starts with a vishing call to an employee. The caller poses as IT and says it’s time to set up a passkey. Everything after that is theater, built to keep the victim occupied while the attacker finalizes everything.

How to implement a continuous offensive security testing program
The hard part was never finding the exposure. It was deciding what to do about it: whether to patch, mitigate, monitor, or accept, and banking that that decision would still hold tomorrow. A penetration test answers this question for the day it runs, then quietly expires. The environment shifts, a control drifts, a new technique lands, and the report now describes a network that no longer exists.

How to prioritize AI agent security by business impact
Your CEO calls about an AI agent security incident in finance. He wants to know whether money moved, whether financial data was exposed, who owned the agent and why it had this level of access. The agent’s OAuth access remained active after its owner left. The access was valid, but no one verified it still served a legitimate business purpose. You need to know which AI agents create business risk and how far that risk can spread.

Your company already adopted AI and nobody is governing access
In this Help Net Security video, Antoine Berton, CTO at Elba Security, breaks down the AI attack surface. He maps five places where exposure lands, from standing OAuth grants and copilots that inherit human permissions to agent credentials stored in config files, missing off-boarding, and unclear authority when an agent acts.

Turning software supply chain security into a daily habit
In this Help Net Security video, Anastasia Tikhonova, Global Threat Research Lead at Group-IB, explains how to operationalize software supply chain risk. Instead of filing an SBOM away as a compliance document, she argues teams should use it every day for vulnerability triage, vendor access reviews, identity monitoring, and incident response.

July 2026 Patch Tuesday forecast: Is CVE tracking still practical?
In June, we saw the deluge of over 200 reported CVEs that I expected in May. There were 116 CVEs for Windows 11 and 104 for Windows 10. In addition, we saw large numbers in both common applications like Office and SharePoint Server as well as the host of development tools and libraries like Visual Studio and .NET. Will the trend continue this month?

New ClamAV security patch closes seven scanner bugs dating back two decades
Open source antivirus scanning sits inside mail gateways, file upload checks, and endpoint tooling at organizations of every size. Much of that work runs through ClamAV, the scanning engine maintained by Cisco’s Talos group. The project released two patch versions, 1.5.3 and 1.4.5, carrying fixes for seven security flaws along with smaller hardening changes.

Flipper Zero firmware development gets a fresh set of community rules
Owners of the Flipper Zero, the pocket-sized wireless testing tool, spent recent weeks worried that its official firmware had gone quiet. Pavel Zhovner, CEO of Flipper Devices, moved to settle that concern with word that the company has set aside staff to keep the firmware maintained and to support outside contributions. The work will run under a fresh set of rules covering feature requests, code submissions, and testing.

Omnigent: Open-source AI agent framework and meta-harness
Plenty of developers now keep several coding agents close at hand, reaching for Claude Code on one task and Codex or Cursor on the next. Each tool arrives with its own command line, its own handling of credentials, and its own way of running shell commands against a working directory. That spread leaves teams with a governance gap around where agent actions land and how much they cost.

Review: Building Machine Learning Systems with a Feature Store
Many people come to machine learning by training a model on a tidy dataset, and then meet a harder problem: making that model work for real users, on fresh data, every day. Jim Dowling’s O’Reilly book, Building Machine Learning Systems with a Feature Store, is written for that moment. Dowling, CEO of Hopsworks, based the book on a course he taught at KTH in Stockholm, so it reads like a guided walk through building real systems.

macOS is becoming a proving ground for AI agents
Somewhere right now, a Mac Mini is sitting on a shelf doing someone’s chores. Nobody’s watching it. It reads a version number out of Terminal, hops over to Safari, digs up a release year, then quietly files a reminder, the kind of dull three-app errand a human would grumble through in ninety seconds. The machine just works, hour after hour, an AI agent with hands on the keyboard and no one in the room.

A single malware file can outweigh an entire AI dataset
Antivirus vendors and security startups keep shipping AI features that promise to read malware the way a seasoned analyst would. The results inside security teams tell a quieter story. A new paper argues that static analysis of software, the job of deciding whether a program is malicious by examining its contents on disk, remains one of the hardest places to make generative AI work.

Messaging fraud trends point to smarter attacks, stronger blocking
Fraudsters spent 2025 investing in scale. New routes, new tools, and higher message volumes moved through the SMS, voice, and chat channels that businesses rely on to reach customers. Money follows that activity. The Communications Fraud Control Association puts global telecom fraud losses at around 42 billion dollars for the year, several billion higher than its estimate for the prior year.

Open-source collaboration is growing worldwide and putting pressure on maintainers
Developers are pushing code and opening pull requests across economy borders at a rate GitHub has rarely seen. Outbound collaboration, the sum of git pushes and pull requests sent from developers in one economy to public repositories in another, grew by 16% from Q4 2025 to Q1 2026, according to the latest GitHub Innovation Graph data.

Malicious AI agent skills can slip past the scanners built to stop them
AI coding agents can be extended with downloadable agent skills from public marketplaces. Because these skills run with the agent’s privileges, a malicious one can steal credentials, access source code, or install malware. Researchers at the Hong Kong University of Science and Technology developed SkillCloak to test how well existing skill scanners detect such threats.

5,811 arrests, $293 million seized over social engineering scams
Criminals who pose as police officers, romantic partners, and business suppliers have built fraud operations that reach across continents. A four-month enforcement campaign against these schemes wrapped up, and police in 97 countries and territories took part.

AWS gives its ERP agent deny-by-default rules and a separate identity
Accounts receivable teams at large companies spend hours each day matching incoming bank payments to invoices by hand. When those payments sit unmatched for days, cash flow suffers and days sales outstanding climbs. The same pattern repeats across blocked invoices, purchase order approval holds, month-end close, and intercompany reconciliations in almost every industry.

Most data brokers won’t tell you what happened to your deletion request
Data brokers collect personal details on most adults in the United States and sell them to buyers that include employers, landlords, insurance companies, and government agencies. California gives residents a way to push back. You can ask a broker to delete your records, or to stop selling and sharing them. A team at UC Irvine decided to find out what happens when someone sends those requests to the whole California registry. The answer gives consumers little comfort.

The open source library holding up your stack might have one maintainer
Every serious software product runs on code that someone else wrote and released for free. A web service leans on a cryptography library, a data pipeline pulls in a parser, and a mobile app ships a handful of small utilities that one person maintains in spare time. All of it carries the same label. A new paper argues that the single label hides differences large enough to change how each piece behaves once it lands in production.

The future of payment fraud could be automated
Payment fraud is becoming more organized as criminal groups use fake websites, large-scale operations, and, in some cases, forced labor to steal money and personal information. Advances in agentic AI could automate many stages of payment fraud, from collecting and assembling stolen credentials to deploying password-cracking tools.

OAuth, guest accounts, and weak MFA drive SaaS risk
Organizations often create guest accounts to give contractors, suppliers, and partners temporary access to files and SaaS applications. Many of these accounts remain active long after they are needed, creating overlooked access paths to corporate data.

Product showcase: Is that text a scam? Malwarebytes Mobile Security can help you find out
Malwarebytes Mobile Security for iPhone combines scam prevention, privacy protection, and identity monitoring in a single app. It evaluates a device’s security posture, provides recommendations to improve protection, and is available for Windows, macOS, Android, iOS, and ChromeOS.

OpenSSH 10.4 arrives with security fixes and a post-quantum signature option
Operators who manage remote access to Unix and Linux systems keep a close watch on OpenSSH, the software that carries most SSH traffic across the internet. The project released version 10.4 with eight security fixes, a set of bug corrections, and a couple of new features.

Power shortages could slow AI data center expansion
AI adoption is increasing demand for data center capacity at the same time operators are running into limits around power, equipment, land, and permitting, according to NTT Data. Access to electricity is becoming a deciding factor in where new data centers are built, when new capacity comes online and how quickly AI projects can expand.

Microsoft wants to keep your AI agents from going rogue
Microsoft has introduced Microsoft Execution Containers (MXC), a cross-platform, policy-driven execution layer for AI agents on Windows and Windows Subsystem for Linux (WSL), now available in early preview. Developers can define constraints for their applications and agents, and Windows enforces them at runtime through MXC.

Apple Container: Open-source tool for Linux containers on the Mac
Developers on Apple silicon Macs have run Linux containers through software built around a single shared virtual machine for years. Apple’s open-source Container project gives each Linux workload its own lightweight virtual machine.

Claude Cowork turns your phone into a remote control for AI work
Anthropic started rolling out Claude Cowork, an AI agent that completes multi-step tasks, in beta for Max users on mobile and the web. They describe a goal, and Claude plans the work, uses the required tools, and produces outputs such as documents, spreadsheets, presentations, and reports.

20 open-source cybersecurity tools to keep your team ready for anything
AI is changing how security teams find vulnerabilities, analyze code, test applications, and protect infrastructure. Developers are building tools to secure AI systems themselves, from coding agents and memory protection to model exposure discovery. This roundup covers recent open-source releases for vulnerability research, application security testing, container security, endpoint protection, AI security, and penetration testing.

Thousands of malicious AI skills found capable of stealing data, running malware
AI agents can browse the web, use external tools, execute commands, and perform tasks on behalf of users. Many rely on skills that define how they interact with services and data. Malicious skills can abuse those capabilities to steal data, execute malware, or manipulate an agent’s behavior, according to the H1 2026 ESET Threat Report.

Wireshark 4.6.7 patches a dozen security flaws
Network analysts who open packet captures in Wireshark push untrusted data through a large set of protocol dissectors, and each parser is a spot where a malformed frame can trip up the software. The 4.6.7 maintenance release closes twelve of those weak points. The fixes reach from cellular signaling parsers to the code that reads capture files off disk.

Product showcase: Protect your iPhone with McAfee Mobile Security
McAfee Mobile Security for iOS combines scam protection, web protection, VPN, Wi-Fi security, and device security checks in a single app. It is also available for Android.

The fake report message that ends with a stolen Reddit account
A direct message arrives on Reddit from a stranger, and it invites a reply. That reply is the point. This scheme runs on social engineering, with no malware and no malicious links, and it has spread across Reddit, Discord, and similar platforms. The goal is a single piece of information: a login or verification code that hands your account to someone else.

AWS centralizes access, spending, and governance for Claude
Claude apps gateway for AWS is a self-hosted control plane that gives organizations a single point of control over access, costs, and policies for Claude Code and Claude Desktop. It replaces per-developer cloud credentials, manual distribution of managed settings to developer laptops, and centralizes usage attribution and spending controls.

Only 28% of financial workforce MFA is phishing-resistant
Passwords remain part of many workforce authentication flows in financial organizations, making phishing and credential theft major identity security risks, according to a new Secret Double Octopus report.

Microsoft is rewriting Windows patch guidance because of AI
Microsoft is recommending that organizations shorten Windows update deployment timelines, warning that advances in AI are reducing the time attackers need to identify and exploit vulnerabilities after security updates are released.

Cybersecurity jobs available right now: July 7, 2026
We’ve scoured the market to bring you a selection of roles that span various skill levels within the cybersecurity field. Check out this weekly selection of cybersecurity jobs available right now.

New infosec products of the week: July 10, 2026
Here’s a look at the most interesting products from the past week, featuring releases from Attestiv, Automox, Codenotary, and First Recon AI.

from Help Net Security https://ift.tt/BHsSgTD

Google Home is Google's smart home platform, which integrates everything from Google's smart speakers to the lights, plugs, locks, and other appliances across your house. Whether you use just a voice assistant and a smart bulb or two or have a complex web of devices whose actions you're looking to automate, you'll want to consider these hidden tips and tricks to make your smart home work for you.

Enable Night mode to keep your devices from waking people up

Google speakers and displays have a Night mode that lowers their volume and dims their display lights during set "downtimes," so you can still use your voice assistant without disturbing the peace or waking kids who are sleeping. In the Google Home app, tap Home > All devices and long-press your device's tile. Tap Settings > Notifications & digital wellbeing > Night mode and turn Enable night mode on. From here, you can choose when downtime begins and ends and select which days of the week to apply Night mode.

Use Guest Mode to keep your profile private from visitors’ queries

If you have visitors over for dinner or house guests staying for an extended period, you may want them to be able to interact your smart speakers and displays without affecting your algorithm or compromising your privacy. When Guest Mode is turned on, Google automatically deletes recordings and voice assistant activity and disables personal results, such information collected from your Gmail and Google Calendar. This prevents other users from requesting sensitive information—like calendar events, contacts, and reminders—from your device. You can still control your smart home, play media, and query your assistant in Guest Mode. To enable or disable this setting on a specific device, you simply have to say “Hey Google, turn [on/off] Guest Mode.”

Designate household contacts so anyone can use your speaker to call for help

Your smart speaker comes in handy for hands-free calling, and you can set up household contacts so anyone—including kids, babysitters, and guests—can reach important numbers even if they haven't set up voice match. All they have to do is say "Hey Google, call [name or nickname]" to make a call. You can add emergency contacts for when you're away or simply make it easier for those at home to place calls to numbers they don't have memorized. In the Google Home app, tap your profile icon, then go to Home settings > Communication > Household contacts. You can tap Add Person if the contact isn't already listed.

Note that in an emergency, you cannot dial 911 directly from your smart speaker using a voice command. However, if you have a Google Home Premium subscription and sound detection enabled on your speakers or displays, you can set up an emergency calling feature that allows you to contact 911 from your phone if your smoke, carbon monoxide, or glass break alarm is triggered.

Use your speaker as a memory vault to keep track of items you often misplace

If you often find yourself wondering where you put that random item you were sure you'd remember but cannot find, you can offload this mental burden to Google Home. Your speaker can maintain a voice notepad and repeat information back to you later. This is especially useful for keeping track of items you use seasonally (like holiday decor), remembering where you keep important documents or various tools for home maintenance projects, or simply monitoring keys and wallets. Use a command like "Hey Google, remember that..." to add items to your list.

Use device state triggers to create an automated theater experience

If you have your media player or smart TV and lights connected to Google Home, you can set up an automation that turns your den into a home theater—dimming your lights and closing your shades as soon as you turn the TV on or hit play. In the Google Home app, go to the Automations tab and tap Add > Add starter. Choose When a device does something, select your smart TV or speaker, then choose the state you want to use as the trigger (such as when the TV turns on or the device is muted or unmuted). Tap Add action > Adjust Home Devices, select your lights and/or shades, and set them to the preferred brightness or closure. Label the routine and tap Save, then make sure the routine is toggled on.

Set up visual alerts for when your laundry or dishwasher finish running

Another way to use state-based automations is to have your speaker or lights announce when another appliance's task is complete—for example, if you're in your home office, you can set your smart bulbs to blink when the washing machine cycle is over so you know it's time to move clothing to the dryer. This follows the same process outlined above: go to Automations > Add > Household > Add starter > When a device does something. Select your smart appliance first, then select Stops or Finished. Then tap Add action > Visual Cue or Audio Announcement. You can also add conditions if you only want the automation to run during certain hours (so your speaker doesn't wake people up at night, for example).

Sync your lights and alarms for a gentler wake-up

Loud alarms are a jarring way to start the morning, but if you have a smart lights and a Google speaker or display, you can enable Gentle Sleep and Wake, which slowly brightens your lights over a 30-minute period before your alarm sounds. There are several voice commands for Gentle Wake depending on how many lights you want to enable, and you can sync with an alarm (consider selecting a softer, ambient option) so that the light routine will run any time you set an audio alarm. If you have a Nest display, you can also go to Alarms > Set an alarm, toggle on Sunrise Alarm, and customize the lights, timeline, and sounds for your wake-up routine.

Ask Gemini to build if/then automations using natural language

Building automations manually can be cumbersome, and you may not even know what your smart devices are capable of in order to do so. But if you have a Google Home Premium subscription and Gemini for Home enabled on your account, you can simply describe what you want your devices to do, and AI can build the routine for you. The "Help me create" feature works with natural language prompts, and it can also suggest automations based on what you have available in your Google Home app. Go to Add > Automations > Help me create, and speak or type the command. Tap Create, and follow the prompts to adjust or save the automation.

Ask Gemini to analyze camera footage for troubleshooting problems

Instead of scrubbing through hours of Nest footage to figure out what's going on in and around your home, you can ask Gemini to search your video history and give you a summary based on your query. This is useful for day-to-day events, like figuring out what time your dog walker typically arrives and leaves, though you can also ask things like "Did something eat my plants?" to figure out what animals are destroying your garden and troubleshoot accordingly. The Ask Home feature is part of Gemini for Home and is available to Google Home Premium Advanced plan subscribers.

Use privacy settings and commands to prevent your recordings from being stored

Connected devices in a smart home inherently introduce privacy risks, but you can, at the very least, keep Google from storing voice recordings gathered via your speaker or display. From your Google Account, go to Data & Privacy > Web & App Activity and uncheck the box next to "Include voice and audio activity." While you're at it, Google recently updated its privacy settings for Search, so you should go in and customize what it has access to under Search Services History and Personalized Recommendations. You can also ask your voice assistant to delete the last thing you said or activity over a specific time period with commands like "Hey Google, that wasn't for you."

from Lifehacker https://ift.tt/Ew4kx6K