When it comes to cyberattacks that shut down power grids, drinking-water systems, and other critical infrastructure, AI doesn’t – yet – turn script kiddies into sophisticated, nation-state attackers. But “the potential is there,” according to operational technology (OT) security experts. "One thing that we've relied on for years is security by obscurity when it comes to utilities," said Steve Swick, former chief information security officer at American Electric Power. "The knowledge needed to do some of that stuff is getting less likely to be necessary," Swick added during a media panel ahead of the publication of Frenos' State of AI in Security report. AI makes it easier and faster for human attackers to target critical infrastructure, gain access to utilities and manufacturing plants, and perform OT system reconnaissance. “Basic access can recon documentation, and distill through that documentation very quickly to find out critical design features of your plant and facility,” said Paul Shaver, head of OT at Armadin, during the panel. “I can download the manual for almost any automation controller, parse through that very quickly, and come up with ways that I can exploit a dedicated feature of something that was not secure by design.” Armadin is Kevin Mandia’s new security startup that uses swarms of autonomous AI agents to simulate real-world cyberattacks. Prior to joining Armadin, Shaver spent six years as the global OT practice leader at Mandia’s earlier company, Mandiant, which Google acquired in 2022. “I will fly my Mandiant flag for a second and try to steer away from the fear, uncertainty, and death of the world is coming to an end, and every script kiddie is now a very sophisticated nation-state adversary. But I’m not going to say the potential is not there, because the tools are improving such that the access to information is so much quicker.” At Armadin, and with an AI assist, “I'm very quickly building tools in days that would normally have taken me months,” Shaver said. “If it can do that for me, it's doing something similar for the folks that have a very basic skill set. I wouldn't go so far as to script kiddies yet, but as the models improve, that becomes more of a possibility in this space.” Plus, as AI lowers the technical barriers to would-be OT hackers, “it advances the timeline,” said Harry Thomas, chief technology officer and co-founder of Frenos, a security company that does AI pentesting for OT environments. “If a better-than-average script kiddie can now perform attacks,” Thomas said, “You have more threat actors out there. There's an acceleration in timeline, more attacks could be happening, and from a defensive position, you might not know who your threat actor is anymore.” Testing the power of LLMs to help plan attacks The Frenos report, published Wednesday, examined the extent to which AI could help someone plan an attack on industrial systems. To do this, it ran several AI models through 16,980 tests between October 2025 and September 2026. These included 13,884 decision attempts, 2,520 planning attempts, and 576 simulated attacks. The company won’t disclose the models or providers’ names, but said it tested six frontier models, two US open weight models, and two foreign open weight models, on three kinds of tasks: choosing one action, planning the steps to a goal, and working through a simulated scenario. Each test gave the model background information and a set of attack actions to choose from. Before choosing, each model received details about assets, networks, and known weaknesses, plus the access each action required. Frenos then checked whether the model’s choice matched the required outcome. Depending on the model, between 6 percent and 47 percent of the choices passed. These tests found that the strongest three frontier models succeeded in about 90 percent of their planning attempts – meaning they produced a workable attack plan – but these same models weren’t consistent: 60 percent, 62.9 percent, and 74.3 percent of the attack plans passed every repeat. “A plan can look sensible and still leave out something essential,” according to the report. “The models had information about the task, but some answers skipped a step or assumed access that the plan had not established.” Meanwhile, the most successful of the four open weight models – a non-US model – achieved a 36.2 percent overall success rate. That figure, however, was still higher than the overall success rates of three other US frontier models, which scored 31.9 percent, 18.8 percent, and 17.9 percent, respectively. “We're seeing that even though AI models help us accelerate our tooling, accelerate our access and knowledge transfer, they are still prone to hallucinations – aka mistakes,” Thomas said. “We still think human judgment remains essential for these AI models to make the threat actors achieve whatever mission or goal they're trying to achieve.” In these tests, no humans asked the models to correct their plans, whereas in a real-life attack, a miscreant who understood the target could spot a gap in the AI’s plan, provide more information, and ask the model to revise its answer. “On top of that, when we were testing the AI models, we used a harness that was pretty simple: Here's some information. Here's the context. Give me an answer,” Thomas said. “A more capable harness could have given these AI models more of an edge.” Based on the findings, Frenos recommends actions for OT defenders to take, starting with a layered defense. This involves segmenting networks, limiting remote access and user permissions, and testing recovery steps. “We have our business continuity plans and disaster recovery plans for a reason,” Thomas said. “Let's execute them.” ®

Nvidia has proposed a new way to keep corporate AI agents in line. Nvidia on Wednesday introduced its OpenShell Reference Architecture. Based on the company's OpenShell secure runtime, It's a recipe for creating, operating, observing, and policing AI agents using OpenShell on Nvidia hardware. "Nvidia created OpenShell to give agents the freedom to do useful work within clearly defined boundaries — contained, monitored and under control," CEO Jensen Huang said in a canned statement. "With the OpenShell Reference Architecture, agents can think on Rubin, act on Vera and be governed on BlueField." AI agents are touted as a powerful automation technology. The reality is that they can be unruly, as demonstrated by security testing OpenAI and Anthropic conducted, during which their models exceeded their remit and attacked third-party organizations. Developers of existing agents, like Claude Code, Codex, OpenClaw, and OpenCode, therefore include controls that limit access to tools like curl and bash.Devs also create sandboxes to isolate an agentic process from the host, so that if agents go awry they're contained. OpenShell sits a level above that with a runtime that extends sandboxing to govern gateway-brokered credentials, identity and policy boundaries, and (eventually) routing and workflows too. At least mostly – OpenShell still has a few open security-related issues listed on GitHub. To implement OpenShell, organizations need Nvidia hardware. The company's blueprint calls for Nvidia Vera Rubin infrastructure to run models like Nvidia Nemotron, with agent harnesses handled via Vera CPUs, and Nvidia BlueField-4 DPUs (aka SmartNICs) propping up Nvidia Sentry security software to monitor agent behavior. The AI biz has made this blueprint available to partners capable of powering Linux and Kubernetes infrastructure. The usual suspects are aboard: Canonical, SUSE and Red Hat. Cloud hyperscalers Amazon Web Services, Google Cloud, and Microsoft Azure have also been tapped as vendors for this vision. And of course Nvidia's floor plan applies to agents from various model builders, including Anthropic, Cohere, Google, Meta, OpenAI, Perplexity, Reflection, and SpaceX. Nvidia says several banks – Europe’s BBVA and Santander – are perusing the OpenShell Reference Architecture spec to see how it aligns with their security and governance requirements. And the AI biz is not too modest to let slip that SAP is integrating the OpenShell Reference Architecture with its Joule Studio runtime for safer agent operations. It's worth noting that OpenShell collects telemetry data by default, "to improve the project," Nvidia insists. The biz allows users to opt-out, with a cautionary note: "Third-party services, model providers, inference endpoints, agents, or tools that you configure and use with OpenShell may have their own terms and privacy practices." ®

The European Commission has opened an investigation under the Digital Services Act into whether Booking.com is doing enough to stop fraudsters running scams, phishing and smishing on its platform. Officials told The Register the probe, which opened Wednesday, covers a very large online platform (one with more than 45 million EU users) and has three strands. The first is whether Booking.com is failing to prevent fraudulent and non-compliant listings. "This is very much about people portraying themselves as the owner of premises and putting it up for rent while they are not the real owner," an EC spokesperson said. The second is whether it does enough to counter phishing and smishing (SMS phishing), and social engineering. "Scammers take over the account of a property owner and… portray themselves as the property owner, but also take over the contact details," she said. "So they start sending messages that people need to pay additional amounts." The Commission also suspects Booking.com is not sufficiently protecting the data of its consumers and business users. The third strand is advertising transparency: whether the platform clearly distinguishes ads from organic results, and whether it is clear about boosted listings, where property owners pay for higher ranking. Officials cited Booking.com's own admission in June 2024 of a 500-900 percent jump in travel scams over the previous 18 months. "What made us concerned is the very high figures," an official said. In the Netherlands alone, more than 1,000 fraud notifications were made in the first part of 2026, causing damage of €82,000, a tenfold increase on the previous year. “This is a real problem, and this is only the Dutch element,” the official said. “We have reports like that almost from all member states… So, we have clear elements where we find that the risk assessment was not sufficient, and as you know, the risk assessment is a key tool for us.” The Commission acknowledges that Booking.com assesses fraud using cases on its own platform and external reports, and takes internal measures in response. But “we feel that what they have done is absolutely substandard,” the official said. “Although they take measures, they could go much further, and they could have much more solid systems to prevent fraud.” “In the future we expect Booking.com to do a more diligent risk assessment,” she added. That could include addressing abuse of the reservation system, rapidly removing listings when fraud is reported, checking licenses, and changing how property owners are onboarded. A spokesperson at Booking.com told The Register: "We are cooperating fully with the European Commission and engaging constructively on its questions under the Digital Services Act (DSA). Security, trust and the protection of personal information are top priorities at Booking.com. We remain committed to working with relevant governments, regulators, law enforcement and industry partners to combat cybercrime and online fraud and protect travelers and partners." ®

Tragically simple private keys used by a certification authority based in India have been compromised, meaning the 60-million-plus certs it has issued can’t be trusted and necessitating a massive clean-up job. The CA of concern in this case is called eMudhra, which boasts of having issued over 60 million digital certificates to help usher in a world of digital trust. The company has instead panicked the world. News of the company’s errors appeared on Tuesday in a post by Dennis Jackson, a member of Mozilla’s cryptography engineering team. “On Saturday, October 17, at 20:06 UTC, Mozilla received a report from a community member that private keys associated with eight eMudhra intermediate certificates had been compromised,” he wrote. “These keys could allow attackers to issue fraudulent HTTPS certificates for websites they do not control.” Or as Cloudflare put it, “an attacker can create a forged certificate for any domain and use it to impersonate servers to intercept or modify traffic.” Jackson has since elaborated on the incident and the response, which has thankfully seen Mozilla, Chrome, and Apple remediate the issue so their browsers won’t rely on the certificates – at least after users install an update. He also reports that eMudhra has revoked the certs, and lists many FOSS projects that have issued updates that mean they won’t recognize certs from eMudhra. That’s welcome, but sadly certs signed with these private keys are still out there and many services rely on them. Browser makers are set up to detect and reject bad certs. Others who relied on them may not be, and will likely need to dig into their environments to see if they rely on certs signed by eMudhra. Developer Geoffrey Huntley has offered some advice on automating that process. At the time of writing, eMudhra has not responded to The Register’s inquiries about the incident and its security practices. The latter question is of great interest because security researcher Scott Helme analyzed eMudhra’s certs and found one the private keys it used “is the number 4.” “Not a number that starts with 4, or the number 4 followed by a few hundred random digits, just, 4... Another one is 56, and another is 115. I know, because I recovered all of them from their public certificates on my laptop just now, and it took less than a second,” Helme wrote. Other researchers have found private keys including the numbers 66, 155, 156, 230 and 237. Those are vastly inadequate keys, because they’re easy to guess, making all certs issued by eMudhra susceptible to brute force attacks. As Helme put it: “A P-384 private key should be a random 384-bit number, which gives you 2³⁸⁴ possibilities (or roughly 10¹¹⁵), so nobody is ever going to search that.” This is a developing story and The Register will update it as more information becomes available. ®

An automotive tech startup claims that its IT systems were attacked by individuals trying to steal its driving model, and that those attacks came from an IP address associated with a rival in the space. The tech startup, IQ.Lvbs, described the alleged security incident in a recent blog post. On October 3, IQ.Lvbs introduced the private beta of NovaSpark, the first model for the company's IQ.Pilot app, in the Comma.ai Discord channel. They put it in that channel because the model requires the use of Comma.ai's camera hardware, which is built for self-driving vehicles. From there, things got weird. "From October 7 to 14, we faced repeated attempts to steal NovaSpark, access users’ devices and private driving files, and exploit our sign-in system," the IQ.Lvbs blog post claims. "The first requests came from an IP assigned to Comma.ai Inc." In addition, on October 8 – shortly after the alleged attacks began – somebody banned IQ.Lvbs' team from the Comma.ai Discord channel. Posts on the IQ.Pilot Discord channel indicate that individuals doing private beta testing for IQ.Lvbs have also been banned from that channel. One of the three people involved in IQ.Lvbs, a UI/UX designer who asked to be identified only as "Cat," speculated to The Register about the reasons for the alleged hack and Discord ban. "Our model, NovaSpark, is a good deal ahead of Comma's latest small and large models, which directly threatens their core business of making AI models good enough to sell their hardware," he said. "Comma for the most part has been stagnant in their models' improvement and that was a main driver for us making NovaSpark." An October 7, 2026 Discord message from user Torq_boi, said to be Harald Schäfer, Comma.ai’s CTO, implies NovaSpark was distilled from Comma.ai's Rebellious Hope model. “I’m glad people are training models and experimenting with this stuff," the post starts. "But don’t lie to people about what you’re doing, and saying it’s not a finetune of existing comma models when it is. That’s not cool.” IQ.Lvbs disputes that assertion and says it did the work on its own. "The claim that NovaSpark is Rebellious Hope with a short fine-tune and an unchanged policy does not survive scrutiny, and we’re not sure how Comma came to that conclusion, especially considering that they do not possess NovaSpark’s model weights or ONNX," the biz said. In the log data IQ.Lvbs published to support its claims, the company flags the username haraschax as one of those associated with Comma.ai IP addresses. Schäfer uses that username on GitHub. Comma.ai and Schäfer did not respond to requests for comment sent to several different addresses. The Discord user Torq_boi in the Comma.ai channel did not respond to a DM seeking comment. Comma.ai is currently being investigated [PDF] by the National Highway Traffic Safety Administration to assess whether its driving automation tech contributed to five crashes and three deaths. IQ.Lvbs says it's considering legal action over the alleged hack. "We are currently reviewing our legal options and looking into involving the authorities," said Cat. ®

Multiple ransomware groups, including Qilin and Inc, have been exploiting a high-severity authentication bypass bug in Palo Alto Networks' PAN-OS, with Unit 42 investigating attacks since early June across numerous industries, such as finance, healthcare, and manufacturing. CVE-2026-0257 affects PAN-OS GlobalProtect portals and gateways, potentially allowing attackers to bypass security restrictions and establish an unauthorized VPN connection. The security vendor first disclosed and patched the bug on May 13 and initially assigned it a medium-severity rating, saying it was aware of attempts to exploit it but had not observed any malicious exploitation. That assessment quickly changed, and by the end of the month, Rapid7 researchers said they observed successful exploitation across multiple customer environments dating back to at least May 17. On Monday, Palo Alto Networks’ consulting and incident response biz, Unit 42, said ransomware crews including Qilin and Inc continue to batter the CVE. “Attackers are leveraging this vulnerability to gain an initial foothold into corporate networks, subsequently bypassing multi-factor authentication (MFA) controls to establish a VPN session,” said Andy Piazza, a senior director of threat intelligence at Unit 42. After gaining initial access, the criminals move laterally across the networks using Remote Desktop Protocol and Server Message Block (SMB), dropping additional malware for credential harvesting and data theft before ultimately deploying ransomware, Piazza warned. In its ongoing investigations, Unit 42 has spotted the ransomware criminals infecting “numerous industries, including education, financial services, healthcare, high tech, hospitality, manufacturing, professional and legal services, government, transportation and logistics, utilities and energy, and wholesale and retail." Palo Alto Networks did not respond to The Register’s inquiries about the attacks, including how many organizations have been infected. Additionally, ReliaQuest intel analysts warned that “multiple threat groups,” including Settra ransomware operators, are also exploiting the bug to gain initial access to corporate networks via unauthorized VPN sessions. “The most significant evolution in tactics, techniques and procedures (TTPs) following successful exploitation of CVE-2026-0257 is the direct pivot to the virtualization layer,” Piazza wrote. “In one notable case, attackers moved from the compromised VPN gateway to the vCenter management appliance. From there, they disabled security controls on ESXi hypervisors (execInstalledOnly) and used a custom tool to perform offline credential dumping directly against a domain controller's virtual disk (VMDK).” This allows the miscreants to bypass in-guest endpoint detection and response products, and represents “a highly sophisticated method” of stealing domain-wide credentials, he added. Unit 42 has also spotted criminals chaining this exploit for initial access with other vulnerabilities such as CVE-2023-27532, which targets Veeam backup infrastructure. So if you haven’t already patched vulnerable PAN-OS software, do so now - and investigate whether attackers have already gained access to your network. Check Unit 42’s indicators of compromise to assist with threat-hunting activities.®

An "avalanche of vulnerability reports" is forcing curl to move lower-severity cases into public view, reserving private handling for high and critical flaws. From October 26, low and medium-severity reports should be filed in the open source data transfer tool's public GitHub repository, maintainer Daniel Stenberg said. "Security researchers in doubt can still submit the issue on HackerOne and we can tell them what severity we deem it to be. Over the last few years, over 90 percent of all submissions could quickly be assessed to be less than HIGH." Stenberg already shuttered curl's bug bounty scheme this year as AI-generated submissions piled work onto its security team. Stenberg has previously acknowledged that not all AI-assisted reports are bad, but the workload now demands another response. "This policy change is entirely triggered by the current avalanche of vulnerability reports that keep pouring in. We see no end to them and we do not anticipate this flood to decrease within the next several months. "We are struggling as a project as all key maintainers feel strained, overloaded and brought to the brink of what we can muster. We must act to survive. This is our next step in a survival strategy. It might not be our last. We aim to not drown." Public handling would let more people assess reports, develop fixes, write advisories, and check for related problems before releases ship, Stenberg said. Handling vulnerability reports publicly won't reduce the work per report, he admits, though it could spread the load and make the resulting lessons and documentation easier to find. At least that's the theory. Public disclosure also gives attackers more time to exploit flaws before fixes arrive. The maintainer agrees this is unfortunate yet unavoidable. "We limit this practice to less than HIGH for this reason: at least these problems are not terrible." Stenberg said researchers using AI are generating unusual option combinations unlikely to occur in real applications, then treating minor discrepancies as vulnerabilities. "We can't continue down this spiraling path with our sanity intact. We don't have the bandwidth, manpower or even will to handle a never-ending vulnerability reporting stream at this pace. I believe few software projects can stand this kind of prolonged high volume deluge for extended periods. Something needs to give way." ®