Search This Blog

Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Showing posts with label Cyber Security. Show all posts

Opendoor Shuts India Operations as AI Reshapes Offshore Work Economics

 

Surprisingly quiet since its launch, Opendoor's Indian venture now halts - barely twenty-four months after setting up hubs in Bengaluru and Chennai. Though framed as a digital frontier play, the retreat fuels debate: could smarter machines quietly reshape rules once favorable to offshoring? While cost gaps drove past expansions, algorithmic progress may erode those advantages faster than expected. Some argue efficiency gains from automation make remote labor pools less compelling over time. 

Notably, this shift does not unfold through sudden rupture - but by gradual recalibration behind corporate doors. Outlining the move, CEO Kaz Nejajtian explained efforts to align operations more closely with customers across the United States - using compact teams powered by artificial intelligence. While details remain limited on staff numbers or exactly how AI influenced choices, reactions followed fast from tech executives and investors alike. 

Seen by some as hinting at wider shifts, the news sparked discussion despite minimal data being shared. Nowhere else on Earth does such scale of operational support unfold quite like it does across India. Starting as a hub for routine administrative work, its role gradually shifted toward something far broader. 

Today, sprawling networks of Global Capability Centers operate within its cities, serving international firms through tech solutions, financial oversight, product innovation, while also shaping career paths for countless professionals. Revenue streams run deep each year, woven into the fabric of worldwide service delivery. Far from just an outsourcing destination, the nation holds a central position in how modern enterprises function abroad. 

Early in 2024, Opendoor moved into India by forming groups focused on handling daily operations through various platforms. Around then, close to 250 workers were on payroll at its local offices there. Despite that early growth, pulling out of India aligns with wider job cuts happening throughout the business. Records show a sharp drop in staff worldwide during the last twelve months, along with a steep decline in employees outside the home market. 

Even with broad internal reductions, experts warn it might be misleading to see the shutdown just as a move tied to shifting work overseas. Facing strain from downturns in American real estate - hit hard those who buy houses digitally - Opendoor needed ways to spend less. Still, its push toward artificial intelligence for smoother operations has sparked questions about what comes next for jobs handled abroad. 

One reason some investors saw it was because artificial intelligence might lower the need for jobs requiring heavy human effort. As machines take on repetitive tasks, companies could downsize - not due to location but ability. The shift suggests staffing needs may shrink when automation steps in. What stands out now isn’t a shift of roles from India to the U.S., yet a broader drop in workforce needs across operations. 

Because intelligent systems blend deeper into daily workflows, firms often rely on tighter groups supported by tools instead of people. Efficiency reshapes staffing - software handles tasks once managed by many. Structures shrink not due to location changes, but because technology reduces demand. Outcomes stay steady while headcount falls, driven by smart integration behind the scenes. 

Some researchers view this new framework as movement into "services-as-software," where firms lean on AI-driven processes rather than growing teams indefinitely. In practice, results follow more from blending tools with niche skills than cutting costs through workforce choices. Though Opendoor shut down operations in India, drawing attention amid talks on AI and jobs, experts stress it's not a straightforward story. 

Long before smart algorithms gained ground, job cuts were already underway at the firm. Market forces beyond technology played a role too. Still, the move sparked sharper conversation - what part might automation play in moving service tasks overseas? Could entire sectors shift as machines learn faster?

CISA Warns Organizations to Secure Fortinet Devices Amid Massive FortiBleed Credential Theft Campaign

 



The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has advised organizations to strengthen the security of internet-facing Fortinet devices following the discovery of a large-scale credential theft operation that may affect more than 86,000 firewalls and VPN systems.

The campaign, known as FortiBleed, was first brought to light earlier this week. Cybersecurity firm SOCRadar initially reported that over 30,000 Fortinet devices had been compromised, potentially putting enterprise networks at risk. The company has since revised its estimate, indicating that more than 86,000 devices may be impacted.

“Discovered in June 2026, the operation has produced a verified database of over 86,644 confirmed working credentials across 194 countries, all collected from internet-facing Fortinet infrastructure,” the company says.

According to researchers, threat actors compiled a large database of usernames and passwords and validated them using automated testing tools. Many of the exposed credentials are believed to have originated from previous security incidents and were never updated or revoked.

Security researcher Kevin Beaumont, in collaboration with Hudson Rock, worked with several affected organizations and confirmed that many of the credentials remain active and recently used.

“The data comprises roughly 50% of all Fortinet firewall devices facing the internet, based on polling from Shodan,” Beaumont says.

Further investigation by security researcher Bob Diachenko suggests that a Russian-speaking threat actor is behind the campaign. Reports indicate that at least four organizations have already experienced complete network compromise.

“They intercept SSL VPN authentication, crack hashes on a 45-GPU cluster managed via Hashtopolis, and pivot into internal Active Directory environments,” Diachenko says.

Researchers estimate that the attackers carried out approximately 1.16 billion credential-stuffing attempts against more than 320,000 FortiGate devices. Additionally, around 2.1 billion brute-force login attempts were directed at over 160,000 Microsoft SQL (MSSQL) servers.

Hudson Rock noted that thousands of organizations have been affected, “including major government entities and critical infrastructure providers”.

Cybersecurity company Huntress also highlighted the scale of the incident. “While the overall campaign is massive, Huntress has cross-referenced the listed IP addresses against their own data corpus and identified 845 partner organizations specifically impacted by this credential dump.”

In response to the growing threat, CISA released an advisory on Thursday urging Fortinet customers to take immediate action. Recommended measures include terminating active user sessions, resetting passwords, adopting the Password-Based Key Derivation Function 2 (PBKDF2) algorithm for storing administrator credentials, reviewing logs for suspicious activity, enabling phishing-resistant multi-factor authentication (MFA), and restricting management access to minimize exposure and reduce the attack surface.

Bitcoin Drops Below $60,000 as Market Selloff and Security Fears Weigh on Crypto

 

Falling further now, Bitcoin dipped under $60,000 again - the first time since early 2024 - amid softness across financial markets and rising unease about digital safety. Around $59,909, it lost close to 6% in one session, almost 18.5% in seven days. This slump stretches beyond just Bitcoin. Ethereum followed closely behind, sliding 23% over the week until reaching approximately $1,555. Meanwhile, Solana saw a similar drop of 22%, settling near $63.75 after sharp downward pressure. 

Bitcoin now trades over 52 percent below its peak of $126,080 set last October. A mix of pressures drives the drop, according to market observers. Attention earlier centered on steady withdrawals from physical Bitcoin ETFs along with Strategy offloading coins for the first time since 2022. Lately, though, shifts in outlook regarding Federal Reserve interest moves have added pressure, alongside fresh unease about digital asset safety. 

Surprising strength marked last month's U.S. labor numbers, as payrolls expanded by 172,000 during May. That outcome ran well ahead of forecasts - almost twice what analysts had predicted - shifting how investors view future rate moves. With inflation concerns lingering, officials may feel less pressure to ease policy soon. Because higher yields often make safer investments more appealing, digital coins typically face headwinds under such conditions. Market participants now weigh whether extended tightening cycles could dampen speculative flows. 

Despite recent gains in employment figures, expectations for lower interest rates have faded, according to Nicolai Søndergaard of Nansen. Having shed roughly 15 percent lately, Bitcoin now faces added strain without any obvious economic trigger to spark rebound. Though digital assets struggle, broader uncertainty lingers due to unrest in the Middle East. That stress shows up in cautious trading behavior worldwide. 

With few positive signals on the horizon, momentum remains fragile. Even as attention grows around blockchain safety, news of a serious weakness in Zcash - a coin built for anonymity - has raised alarms. Though programmers pushed out an update to correct the problem, they stated plainly that tracking past misuse is impossible due to hidden transaction details. Without clear evidence of abuse, doubt spread quickly among investors. 

That hesitation showed in price movements: ZEC plunged over two-fifths in value in just one day. Now worries spread through crypto circles after the event. Because AI tools might detect weak spots in blockchains, investor unease grows. Questions emerge - could similar flaws threaten more digital currencies? As machine learning advances, trust faces new tests. Out of nowhere, a slight uptick appeared for Bitcoin ETFs amid continued market softness. 

On Thursday, U.S. spot Bitcoin funds saw inflows exceeding $3 million - breaking a run of 13 straight days of outflows. While tiny next to the billions pulled so far this year, the shift hinted at changed sentiment, if only briefly. Not long after prolonged pullbacks, investors paused, then edged back in. After tech shares slipped, so did broader market sentiment - Nasdaq dropped sharply amid wider financial strains. 

Not just crypto felt the downturn; traditional assets wavered too, pulled by similar worries. Investors moved carefully through overlapping pressures: shaky economies, global conflicts, threats in digital finance. When equities fell, digital coins followed close behind, mirroring the wariness spreading through capital markets.

Unpatchable BootROM Flaw Exposes Apple A12 and A13 SecureROM Chain


 

The disclosure of a new hardware-level exploit has raised new concerns about the long-term security implications of immutable silicon vulnerabilities across Apple's entire ecosystem. Paradigm Shift researchers have revealed usbliter8, a working SecureROM exploit compromising the boot chain of Apple A12 and A13 processor-based devices. 

In 2019, checkm8 emerged as the first publicly released unpatched attack on these chip generations. By exploiting a flaw within the BootROM, the code that runs before iOS and all higher security controls, the exploit is able to bypass protections at the earliest stage of the initialization process. Physical access, a USB connection, and manual placement of the device into DFU mode are required to perform the attack, but the significance lies in the vulnerability itself. This vulnerability is not able to be remedied by updating firmware, updating operating systems, or restoring devices since it occurs in silicon rather than software.

In addition to the niche jailbreak development impacted by this disclosure, Apple hardware that is still supported, including iPhones, iPads, Apple Watches, and other Apple devices, now carry a permanent hardware weakness that can be exploited throughout the device's operational lifetime. 

Along with presenting a notable research discovery, USBliter8 also presents a significant hardware security incident due to the permanent nature of the vulnerability exploited by it. The affected SecureROM code is therefore physically embedded within the processor while the device is being manufactured, placing it beyond Apple's control once the device leaves the factory. This is in contrast to conventional vulnerabilities that can be mitigated by updating firmware or operating systems. 

During a coordinated engagement with Apple Product Security on June 18, 2026, researchers revealed the exploit and accompanying proof of concept, demonstrating that a successful attack can be carried out in less than two seconds before Apple's trusted boot sequence takes over. There remains a strict physical access requirement for the attack: a target device must be manually placed into Device Firmware Update (DFU) mode and connected to an RP2350-based microcontroller platform using USB. Nevertheless, there is a considerable range of hardware impacted. 

Publicly supported targets include devices built on Apple's A12 and A13 application processors, in addition to the S4 and S5 systems-on-chip used across Apple Watch and HomePod products. There are a number of products, such as the iPhone XS, iPhone XR, iPhone 11, two-generation iPhone SE, multiple iPad models, Apple Watch Series 4 and 5, the first-generation Apple Watch SE, HomePod mini, and others, which continue to see active deployment. 

Research indicates that support for A12X and A12Z processors may be technically achievable in the future, but this has not yet been implemented. The architectural differences in USB memory handling do not seem to affect devices based on A11 silicon, while A14 and newer generations appear to be immune due to improved DART configuration and memory isolation controls within the boot environment.

The disclosure also highlights an aspect of modern device security that is seldom encountered: there are some vulnerabilities that are beyond the reach of all software-based defense mechanisms available to vendors as well as users. The vulnerability can not be eliminated by iOS updates, firmware revisions, factory restores, or standard hardening measures since the vulnerability lies within immutable SecureROM code. It remains imperative to maintain the latest software versions, enforce strong authentication controls, and adhere to sound security practices to protect against conventional threats; however, those measures do not alter the hardware trust anchor targeted by USBliter8. 

In identifying the most practical long-term mitigation strategy for organizations and individuals seeking to reduce exposure, Paradigm Shift identified migration to devices utilizing A14 or newer silicon. While Apple has not publicly addressed the research as of publication, the researchers stated that Apple Product Security has been notified and disclosure procedures have been completed before technical details and exploit code can be released. There is a great deal of variation in the security implications associated with the various operating environments in which affected devices are used. 

For the average consumer, the requirement for physical possession, DFU mode access, and specialized hardware greatly narrows the scope of potential exploitation. Individuals who operate under elevated threat conditions, including journalists, corporate executives, activists, government employees, and others whose devices may be seized, inspected, or held for extended periods, face a significantly different risk profile. In such scenarios, a compromised device based on A12, A13, S4, or S5 could be affected by persistent boot-level intrusions that are anchored underneath the operating system itself, even after software updates are applied. Thus, device lifecycle planning now includes security considerations instead of just procurement, with the newer A14-generation hardware and later platforms posing the most obvious route to avoiding this type of exposure. 

In addition to the immediate technical accomplishments, researchers are closely tracking whether usbliter8 follows a similar path to checkm8 that was established nearly seven years ago. Along with the research, a proof-of-concept code was released that gained significant attention from the security community.

It quickly gained hundreds of GitHub stars and indicated strong interest from researchers and developers alike. It is widely anticipated that jailbreak-focused tools will emerge in the near future, but the more consequential question is whether the exploit will evolve into a mature hardware research and forensic framework for A12 and A13 devices. Ultimately, Checkm8 has become the primary tool for examining and interacting with older Apple hardware in a manner previously not possible for defenders, researchers, and forensic practitioners. 

While USBliter8 has not yet reached that level, its publication provides the first public insight into a generation of Apple silicon which, until now, has been largely beyond the reach of unpatched SecureROM exploits. With the advent of USBliter8, we are reminded that not all security risks originate with software, and not all can be resolved through patching. 

By exposing a hardware-rooted vulnerability that remains widely deployed, this research contributes to a heightened awareness of the long-term security implications of silicon-level trust boundaries. However, organizations and individuals responsible for sensitive data should reassess their device custody practices, hardware refresh strategies, and exposure to high-risk environments as a result of the exploit. 

Usbliter8 remains a significant landmark in Apple security research and is being examined by the security community in order to fully comprehend its impact. It demonstrates how important it is not only to secure the software on a device, but also the device itself.

Operation Escaneo Signals Shift in Latin America Cyber Threat Landscape

 

Operation Escaneo is a warning sign for Latin America’s cybersecurity ecosystem, showing that financially motivated attackers are adopting more advanced intrusion methods. The campaign, uncovered through an exposed attacker server, targeted government, financial, and critical infrastructure organizations across Mexico, with smaller activity in Ecuador and Portugal. Researchers say the operation reflects a shift in the region, where threat actors are increasingly combining opportunistic motives with sophisticated tooling. 

The attackers relied heavily on internet-facing vulnerabilities to gain entry. Reporting links the campaign to Fortinet FortiOS SSL-VPN and Ivanti Connect Secure flaws, along with other exploits involving Apache Tomcat, Windows, and Log4Shell. Rather than depending on a single vulnerability, the group appears to have built a flexible intrusion chain that could adapt to different environments, increasing its chances of success and making defense more difficult. 

Once inside, the operation used multiple layers of persistence and control. CloudSEK’s findings, as summarized by Infosecurity Magazine, describe Neo-reGeorg webshells, Chisel reverse tunnels, and even a compromised Cisco router configured with a GRE tunnel to maintain access. These methods helped the attackers stay connected while blending into normal traffic, a tactic that can evade host-based security tools and delay detection. 

The damage was not limited to access alone. Analysts reported large-scale theft of sensitive data, including personal records, Active Directory maps, SSL private keys, SAP service-account hashes, and browser-stored passwords. That level of exposure creates serious risks for identity abuse, lateral movement, and further compromise, especially in public-sector and financial environments where trust and encryption keys are critical assets.

Operation Escaneo is a reminder that Latin American defenders should prioritize patching perimeter appliances, monitoring for unusual tunneling activity, and limiting the spread of privileged credentials. The campaign’s scale and tradecraft suggest that regional attackers are moving closer to APT-level capability, with the potential to disrupt operations far beyond the initial breach.

Critical Flaws in SiderAI and MaxAI Chrome Extensions Expose Millions to Browser Hijacking

 

Over ten million people might face major online threats following the discovery of severe weaknesses in two common AI-based Chrome add-ons, SiderAI and MaxAI. Though designed to assist with summaries and automated tasks, these tools were found carrying dangerous bugs - dubbed “Spyder” and “MaXSS” - by analysts at Rebora Security during a routine check of such software. Once exploited, either flaw lets unauthorized parties hijack active browsing activities. 

Information saved on sites, along with files on personal devices, may become reachable without permission. While built for convenience through side panels and smart responses, their broad adoption across Chromium-linked browsers amplifies how far harm could spread. Despite appearing helpful, the underlying structure allows invasive access when misused. One of the leading tools on the Chrome Web Store, SiderAI sits in the top quarter of all extensions by popularity. 

A recent analysis revealed flaws in how SiderAI and MaxAI managed data flow between sites and their inner workings, especially involving content scripts. Although these scripts should serve as controlled messengers - keeping site code apart from backend logic - the boundaries blurred in practice. Messages sent by web pages entered without sufficient checks. Because verification steps were missing, untrusted inputs could move deeper into the system than intended. A flaw in MaxAI allowed harmful sites to transmit manipulated data directly to its content script. 

Though meant to relay information, the system passed these signals onward - into the background process - with little checking. Because of this gap, unauthorized users gained access to powerful functions. Hidden tabs appeared without warning, snapshots of screens were captured, site interactions occurred - all while riding on logged-in accounts. Security weakened when trust was misplaced across internal components. Testing revealed researchers gaining entry to live Gmail and Google Calendar sessions, pulling confidential data while leaving no trace. 

What made the Spyder vulnerability in SiderAI alarming was its ability to mimic real user behavior - clicks, typing - all within integrated browser windows. A compromised site, using this loophole, might load Google Gemini unseen, harvest ongoing AI dialogues, then send them outward. Detection during such an event remained unlikely. What happens because of these flaws goes well past messages or chat tools. 

Through them, hackers might grab login codes, see private correspondence, change files, while acting like the victim on many sites. Sometimes, the broad access given to such add-ons lets intruders reach data saved directly on a person's device. What stands out most is how little effort an attacker needs - just opening a harmful webpage can trigger the flaw. Because of this low barrier, threats can spread fast without clear signs. 

After uncovering the problem, Rebora Security reached out to the creators of the affected tools; silence followed. With no reply, the details eventually appeared online, while a heads-up also went to Google. Should SiderAI or MaxAI appear in a user's browser, removal is urgent. This case brings attention to rising risks tied to artificial intelligence add-ons - especially those collecting sensitive online behavior. 

When apps gain deep access to personal information, careful review of their privileges becomes unavoidable. Security grows more complex as these tools spread across everyday browsing routines.

Ukraine Joins EU Cybersecurity Reserve to Strengthen Cyber Resilience and Emergency Response

 

Now able to tap into the EU’s emergency cyber network, Ukraine joins a support framework cleared by the Council of the European Union. When overwhelming cyberattacks strike, help may come faster because Kyiv can formally seek aid beyond what it handles alone. Specialized teams and resources from across the bloc stand ready, activated through shared crisis procedures. 

This link strengthens real-time defense options amid severe digital threats. Help arrives via the EU Cybersecurity Reserve, run by ENISA - the European Union’s cybersecurity agency. Born from the Cyber Solidarity Act, it lets member nations turn to vetted private experts if local teams cannot keep up. As attacks grow more complex, ties in tech defense strengthen between the bloc and Ukraine. Their collaboration now includes shared readiness against online risks. 

If a cyberattack overwhelms Ukraine’s internal resources, it can officially trigger emergency support through the framework. When that happens, digital security specialists from various European nations might step in to help control, examine, and recover systems. Officials view this measure as one piece of wider work aimed at boosting readiness, speeding up reactions, and building stronger collaboration amid rising complexity in online attacks. 

Though cyber threats grow more frequent, unity among nations strengthens defenses. Because attacks target government systems, companies, and vital services, joint efforts matter more now. The European Commission views this move as a step toward stronger cooperation. When one country acts alone, risks rise - yet shared knowledge reduces vulnerability. As digital dangers spread, responses must shift from isolated attempts to unified strategies. Now ranking as the second non-EU nation within the reserve, Ukraine follows Moldova’s inclusion during 2024. 

That year, rising cyber threats tied to Russian activity prompted Moldova’s entry. Seen by European authorities as pivotal for regional collaboration on digital security, its involvement highlights ongoing efforts. Resilience in cyberspace continues shaping how the EU engages nearby states. Progress here reflects broader aims, yet depends heavily on real-time readiness. Besides tackling cyber threats, the European Union now works more closely with Moldova on various digital fronts. 

Recently, an accord was reached politically, paving the way for Moldova’s entry into the EU Roaming Zone - pending official approval. Should it pass, people from both regions could make calls, send messages, or access data while traveling, free of extra fees. Now operating within the EU Third Countries’ Trusted List, Moldova streamlines how electronic signatures and digital seals are recognized across entities and individuals. 

Backed by EU funding, a fresh node of the European Digital Media Observatory - named FACT - emerges to counter disinformation and external manipulation efforts. Now comes news on cyber defense, right after fresh progress in how the EU engages Ukraine and Moldova. Talks to join the bloc officially started, backed unanimously by national leaders lately. 

Marking the moment, Commission head Ursula von der Leyen called it a turning point - not just symbolic, but rooted in real changes made amid hardship. Her view: this step shows lasting support for peace, resilience, and shared effort where it matters most. 

Now more shielded, Ukraine taps into the EU Cybersecurity Reserve, linking efforts with European allies when large-scale digital threats emerge. This cooperation builds lasting strength in facing future attacks, not just immediate fixes. Through shared response channels, new stability takes root beyond borders. Long-term readiness grows quietly but steadily from such joint undertakings.

New Apple Ad Blocker Filtr Expands Protection Beyond Browsers on iPhone, iPad and Mac

 

Filtr, a fresh ad-blocking app, extends privacy for Apple device owners. Instead of limiting itself to web browsers, it stops advertisements inside mobile and desktop applications too. Created by Kaylee Serena Calderolla - known for developing Wipr, a tool that blocks ads in Safari - it taps into features unveiled in iOS 26 and macOS 26. Through these updates, the software intercepts ad-related data directly within the system’s network layer. Beyond the usual add-ons confined to Safari alone, Filtr taps into Apple’s updated method for handling web traffic. 

With that foundation, it intercepts connections aimed at known ad networks long before content appears - stopping trackers and pop-ups not just in browsers but throughout compatible apps. Blocking happens earlier, silently, cutting down unwanted surveillance along with cluttered visuals wherever digital activity occurs. Filtr comes as a premium feature inside Wipr, an often-used tool that stops ads in Safari. 

Its creator, Calderolla, claims it runs without gathering any personal details or needing entry to sensitive user content. Updates to a custom blocklist - kept current by the maker - allow the filter system to work effectively. Working begins with an initial screening done locally on the device. This step uses a built-in catalog of sites that often serve ads. When uncertainty remains, a follow-up check occurs using a fuller database kept by Calderolla. Communication moves through Apple’s infrastructure, which keeps individual users anonymous to service creators. 

Only matching results trigger deeper analysis, limiting exposure of personal activity. Some people trying the function notice fewer commercials when opening certain programs, though a few show blank spaces instead of promotions. Enabling the link blocker just one time lets the software manage changes on its own, making preparation straightforward. Not every application behaves the same way - some skip ads entirely, others leave gaps. Updates happen in the background after initial activation, reducing ongoing effort. Filtr cannot stop all ads - some slip through when they come straight from an app’s built-in servers. 

Since cutting those might break how the app works, certain promotions stay visible. So, while using platforms like Facebook, Google, or Reddit, users may still spot occasional banners. Even with its constraints, progress shows clearly in how Wipr tackles ads across Apple devices. Priced at five dollars, it works on any device, whereas Filtr adds yearly fees unless users opt to pay twenty-five upfront inside the app.