Connect with us
DAPA Banner

Tech

Shadow mode, drift alerts and audit logs: Inside the modern audit loop

Published

on

Traditional software governance often uses static compliance checklists, quarterly audits and after-the-fact reviews. But this method can’t keep up with AI systems that change in real time. A machine learning (ML) model might retrain or drift between quarterly operational syncs. This means that, by the time an issue is discovered, hundreds of bad decisions could already have been made. This can be almost impossible to untangle. 

In the fast-paced world of AI, governance must be inline, not an after-the-fact compliance review. In other words, organizations must adopt what I call an “audit loop”: A continuous, integrated compliance process that operates in real-time alongside AI development and deployment, without halting innovation.

This article explains how to implement such continuous AI compliance through shadow mode rollouts, drift and misuse monitoring and audit logs engineered for direct legal defensibility.

From reactive checks to an inline “audit loop”

When systems moved at the speed of people, it made sense to do compliance checks every so often. But AI doesn’t wait for the next review meeting. The change to an inline audit loop means audits will no longer occur just once in a while; they happen all the time. Compliance and risk management should be “baked in” to the AI lifecycle from development to production, rather than just post-deployment. This means establishing live metrics and guardrails that monitor AI behavior as it occurs and raise red flags as soon as something seems off.

Advertisement

For instance, teams can set up drift detectors that automatically alert when a model’s predictions go off course from the training distribution, or when confidence scores fall below acceptable levels. Governance is no longer just a set of quarterly snapshots; it’s a streaming process with alerts that go off in real time when a system goes outside of its defined confidence bands.

Cultural shift is equally important: Compliance teams must act less like after-the-fact auditors and more like AI co-pilots. In practice, this might mean compliance and AI engineers working together to define policy guardrails and continuously monitor key indicators. With the right tools and mindset, real-time AI governance can “nudge” and intervene early, helping teams course-correct without slowing down innovation.

In fact, when done well, continuous governance builds trust rather than friction, providing shared visibility into AI operations for both builders and regulators, instead of unpleasant surprises after deployment. The following strategies illustrate how to achieve this balance.

Shadow mode rollouts: Testing compliance safely

One effective framework for continuous AI compliance is “shadow mode” deployments with new models or agent features. This means a new AI system is deployed in parallel with the existing system, receiving real production inputs but not influencing real decisions or user-facing outputs. The legacy model or process continues to handle decisions, while the new AI’s outputs are captured only for analysis. This provides a safe sandbox to vet the AI’s behavior under real conditions.

Advertisement

According to global law firm Morgan Lewis: “Shadow-mode operation requires the AI to run in parallel without influencing live decisions until its performance is validated,” giving organizations a safe environment to test changes.

Teams can discover problems early by comparing the shadow model’s decisions to expectations (the current model’s decisions). For instance, when a model is running in shadow mode, they can check to see if its inputs and predictions differ from those of the current production model or the patterns seen in training. Sudden changes could indicate bugs in the data pipeline, unexpected bias or drops in performance.

In short, shadow mode is a way to check compliance in real time: It ensures that the model handles inputs correctly and meets policy standards (accuracy, fairness) before it is fully released. One AI security framework showed how this method worked: Teams first ran AI in shadow mode (AI makes suggestions but doesn’t act on its own), then compared AI and human inputs to determine trust. They only let the AI suggest actions with human approval after it was reliable.

For instance, Prophet Security eventually let the AI make low-risk decisions on its own. Using phased rollouts gives people confidence that an AI system meets requirements and works as expected, without putting production or customers at risk during testing.

Advertisement

Real-time drift and misuse detection

Even after an AI model is fully deployed, the compliance job is never “done.” Over time, AI systems can drift, meaning that their performance or outputs change due to new data patterns, model retraining or bad inputs. They can also be misused or lead to results that go against policy (for example, inappropriate content or biased decisions) in unexpected ways.

To remain compliant, teams must set up monitoring signals and processes to catch these issues as they happen. In SLA monitoring, they may only check for uptime or latency. In AI monitoring, however, the system must be able to tell when outputs are not what they should be. For example, if a model suddenly starts giving biased or harmful results. This means setting “confidence bands” or quantitative limits for how a model should behave and setting automatic alerts when those limits are crossed.

Some signals to monitor include:

  • Data or concept drift: When input data distributions change significantly or model predictions diverge from training-time patterns. For example, a model’s accuracy on certain segments might drop as the incoming data shifts, a sign to investigate and possibly retrain.

  • Anomalous or harmful outputs: When outputs trigger policy violations or ethical red flags. An AI content filter might flag if a generative model produces disallowed content, or a bias monitor might detect if decisions for a protected group begin to skew negatively. Contracts for AI services now often require vendors to detect and address such noncompliant results promptly.

  • User misuse patterns: When unusual usage behavior suggests someone is trying to manipulate or misuse the AI. For instance, rapid-fire queries attempting prompt injection or adversarial inputs could be automatically flagged by the system’s telemetry as potential misuse.

When a drift or misuse signal crosses a critical threshold, the system should support “intelligent escalation” rather than waiting for a quarterly review. In practice, this could mean triggering an automated mitigation or immediately alerting a human overseer. Leading organizations build in fail-safes like kill-switches, or the ability to suspend an AI’s actions the moment it behaves unpredictably or unsafely.

Advertisement

For example, a service contract might allow a company to instantly pause an AI agent if it’s outputting suspect results, even if the AI provider hasn’t acknowledged a problem. Likewise, teams should have playbooks for rapid model rollback or retraining windows: If drift or errors are detected, there’s a plan to retrain the model (or revert to a safe state) within a defined timeframe. This kind of agile response is crucial; it recognizes that AI behavior may drift or degrade in ways that cannot be fixed with a simple patch, so swift retraining or tuning is part of the compliance loop.

By continuously monitoring and reacting to drift and misuse signals, companies transform compliance from a periodic audit to an ongoing safety net. Issues are caught and addressed in hours or days, not months. The AI stays within acceptable bounds, and governance keeps pace with the AI’s own learning and adaptation, rather than trailing behind it. This not only protects users and stakeholders; it gives regulators and executives peace of mind that the AI is under constant watchful oversight, even as it evolves.

Audit logs designed for legal defensibility

Continuous compliance also means continuously documenting what your AI is doing and why. Robust audit logs demonstrate compliance, both for internal accountability and external legal defensibility. However, logging for AI requires more than simplistic logs. Imagine an auditor or regulator asking: “Why did the AI make this decision, and did it follow approved policy?” Your logs should be able to answer that.

A good AI audit log keeps a permanent, detailed record of every important action and decision AI makes, along with the reasons and context. Legal experts say these logs “provide detailed, unchangeable records of AI system actions with exact timestamps and written reasons for decisions.” They are important evidence in court. This means that every important inference, suggestion or independent action taken by AI should be recorded with metadata, such as timestamps, the model/version used, the input received, the output produced and (if possible) the reasoning or confidence behind that output.

Advertisement

Modern compliance platforms stress logging not only the result (“X action taken”) but also the rationale (“X action taken because conditions Y and Z were met according to policy”). These enhanced logs let an auditor see, for example, not just that an AI approved a user’s access, but that it was approved “based on continuous usage and alignment with the user’s peer group,” according to Attorney Aaron Hall.

Audit logs should also be well-organized and difficult to change if they are to be legally sound. Techniques like immutable storage or cryptographic hashing of logs ensure that records can’t be changed. Log data should be protected by access controls and encryption so that sensitive information, such as security keys and personal data, is hidden or protected while still being open.

In regulated industries, keeping these logs can show examiners that you are not only keeping track of AI’s outputs, but you are retaining records for review. Regulators are expecting companies to show more than that an AI was checked before it was released. They want to see that it is being monitored continuously and there is a forensic trail to analyze its behavior over time. This evidentiary backbone comes from complete audit trails that include data inputs, model versions and decision outputs. They make AI less of a “black box” and more of a system that can be tracked and held accountable.

If there is a disagreement or an event (for example, an AI made a biased choice that hurt a customer), these logs are your legal lifeline. They help you figure out what went wrong. Was it a problem with the data, a model drift or misuse? Who was in charge of the process? Did we stick to the rules we set?

Advertisement

Well-kept AI audit logs show that the company did its homework and had controls in place. This not only lowers the risk of legal problems but makes people more trusting of AI systems. With AI, teams and executives can be sure that every decision made is safe because it is open and accountable.

Inline governance as an enabler, not a roadblock

Implementing an “audit loop” of continuous AI compliance might sound like extra work, but in reality, it enables faster and safer AI delivery. By integrating governance into each stage of the AI lifecycle, from shadow mode trial runs to real-time monitoring to immutable logging, organizations can move quickly and responsibly. Issues are caught early, so they don’t snowball into major failures that require project-halting fixes later. Developers and data scientists can iterate on models without endless back-and-forth with compliance reviewers, because many compliance checks are automated and happen in parallel.

Rather than slowing down delivery, this approach often accelerates it: Teams spend less time on reactive damage control or lengthy audits, and more time on innovation because they are confident that compliance is under control in the background.

There are bigger benefits to continuous AI compliance, too. It gives end-users, business leaders and regulators a reason to believe that AI systems are being handled responsibly. When every AI decision is clearly recorded, watched and checked for quality, stakeholders are much more likely to accept AI solutions. This trust benefits the whole industry and society, not just individual businesses.

Advertisement

An audit-loop governance model can stop AI failures and ensure AI behavior is in line with moral and legal standards. In fact, strong AI governance benefits the economy and the public because it encourages innovation and protection. It can unlock AI’s potential in important areas like finance, healthcare and infrastructure without putting safety or values at risk. As national and international standards for AI change quickly, U.S. companies that set a good example by always following the rules are at the forefront of trustworthy AI.

People say that if your AI governance isn’t keeping up with your AI, it’s not really governance; it’s “archaeology.” Forward-thinking companies are realizing this and adopting audit loops. By doing so, they not only avoid problems but make compliance a competitive advantage, ensuring that faster delivery and better oversight go hand in hand.

Dhyey Mavani is working to accelerate gen AI and computational mathematics.

Editor’s note: The opinions expressed in this article are the authors’ personal opinions and do not reflect the opinions of their employers.

Advertisement

Welcome to the VentureBeat community!

Our guest posting program is where technical experts share insights and provide neutral, non-vested deep dives on AI, data infrastructure, cybersecurity and other cutting-edge technologies shaping the future of enterprise.

Read more from our guest post program — and check out our guidelines if you’re interested in contributing an article of your own!

Source link

Advertisement
Continue Reading
Click to comment

You must be logged in to post a comment Login

Leave a Reply

Tech

Federal cyber experts called Microsoft’s cloud a “pile of shit,” approved it anyway

Published

on

The problem is that agencies often lack the staff and resources to do thorough reviews, which means the whole system is leaning on the claims of the cloud companies and the assessments of the third-party firms they pay to evaluate them. Under the current vision, critics say, FedRAMP has lost the plot.

“FedRAMP’s job is to watch the American people’s back when it comes to sharing their data with cloud companies,” said Mill, the former GSA official, who also co-authored the 2024 White House memo. “When there’s a security issue, the public doesn’t expect FedRAMP to say they’re just a paper-pusher.”

Meanwhile, at the Justice Department, officials are finding out what FedRAMP meant by the “unknown unknowns” in GCC High. Last year, for example, they discovered that Microsoft relied on China-based engineers to service their sensitive cloud systems despite the department’s prohibition against non-US citizens assisting with IT maintenance.

Officials learned about this arrangement—which was also used in GCC High—not from FedRAMP or from Microsoft but from a ProPublica investigation into the practice, according to the Justice employee who spoke with us.

Advertisement

A Microsoft spokesperson acknowledged that the written security plan for GCC High that the company submitted to the Justice Department did not mention foreign engineers, though he said Microsoft did communicate that information to Justice officials before 2020. Nevertheless, Microsoft has since ended its use of China-based engineers in government systems.

Former and current government officials worry about what other risks may be lurking in GCC High and beyond.

The GSA told ProPublica that, in general, “if there is credible evidence that a cloud service provider has made materially false representations, that matter is then appropriately referred to investigative authorities.”

Ironically, the ultimate arbiter of whether cloud providers or their third-party assessors are living up to their claims is the Justice Department itself. The recent indictment of the former Accenture employee suggests it is willing to use this power. In a court document, the Justice Department alleges that the ex-employee made “false and misleading representations” about the cloud platform’s security to help the company “obtain and maintain lucrative federal contracts.” She is also accused of trying to “influence and obstruct” Accenture’s third-party assessors by hiding the product’s deficiencies and telling others to conceal the “true state of the system” during demonstrations, the department said. She has pleaded not guilty.

Advertisement

There is no public indication that such a case has been brought against Microsoft or anyone involved in the GCC High authorization. The Justice Department declined to comment. Monaco, the deputy attorney general who launched the department’s initiative to pursue cybersecurity fraud cases, did not respond to requests for comment.

She left her government position in January 2025. Microsoft hired her to become its president of global affairs.

A company spokesperson said Monaco’s hiring complied with “all rules, regulations, and ethical standards” and that she “does not work on any federal government contracts or have oversight over or involvement with any of our dealings with the federal government.”

This story originally appeared on ProPublica. ProPublica is a Pulitzer Prize-winning investigative newsroom. Sign up for The Big Story newsletter to receive stories like this one in your inbox.

Advertisement

Source link

Continue Reading

Tech

Compass drops lawsuit against Zillow over home-listing policy

Published

on

(BigStock Photo)

This story originally appeared on Real Estate News.

One of the biggest lawsuits to capture the real estate industry’s attention over the past year has come to an abrupt end.

Compass International Holdings announced Wednesday that it is dismissing the lawsuit it filed last June against Zillow. The two industry titans have battled in court for months over Zillow’s Listing Access Standards, a policy barring listings that are publicly marketed but not widely available via the MLS.

Zillow shares rose slightly after the news broke.

Compass’ signature 3-phased marketing strategy, in which sellers are encouraged to launch their home as a Compass Private Exclusive and then enter a Compass Coming Soon phase before listing publicly via the MLS, had been in direct conflict with those standards.

Advertisement

The move comes a day after Compass Chairman and CEO Robert Reffkin appeared to extend an olive branch to the brokerage’s portal rival after Zillow introduced a change in its approach to pre-market listings.

Compass dismissed its lawsuit without prejudice, which means the company could file the case again at a later date.

What Compass said: Reffkin specifically cited Zillow’s “Preview” product announcement — which he referred to as a policy “reversal” — in a post on social media announcing the dismissal.

“Because of this reversal, we are dismissing our lawsuit against Zillow,” he wrote.

Advertisement

“Our goal has always been to give homeowners more choice to decide when, where, and how to market their homes. We are pleased to see that both other brokerages and portals are now recognizing the strong consumer demand for more options in how they sell their homes,” Reffkin’s post said.

“At Compass International Holdings, we will always defend our real estate professional’s ability to put their clients first, and we will continue to advocate for more choices, not fewer, for homeowners.”

What Zillow said: “Zillow welcomes Compass’ decision to voluntarily withdraw its lawsuit. As we said from the outset, the claims lacked merit, and the court’s preliminary injunction ruling reinforced that view,” a spokesperson said in a statement.

“The underlying issue remains: Private listing networks are not in the best interests of consumers, and they never have been. Restricting listings to hidden networks limits transparency, disadvantages buyers and sellers and undermines fair access to real estate information which is so critical in this housing affordability crisis,” the statement continued.

Advertisement

The Listing Access Standards “were introduced to protect core principles of competition, openness and access that support healthy markets and benefit homebuyers, sellers and agents,” and those standards “remain in effect.”

“Zillow will continue to choose not to display listings that were previously hidden from the public for the benefit of any one company. Any suggestion that these standards are no longer being enforced is incorrect,” the company said.

“Hidden listing networks that gate access to listings behind a registration wall or require buyers to work with a specific brokerage do not meet our standards and, to the extent Compass continues operating a network of inventory hidden in the shadows, those listings remain at odds with our standards.”

How we got here: Zillow, which has repeatedly advocated for listings transparency and an open marketplace, announced its Listing Access Standards in April 2025. At the time, the home search giant said the policy was designed to “create an even playing field” as the private listings trend gained momentum across the industry.

Advertisement

Compass, which has built its marketing strategy around private listings and the idea of “seller choice,” sued Zillow in June — days before the policy’s enforcement began — alleging that Zillow possessed “monopoly power” and was violating antitrust laws. Compass later alleged that a conspiracy existed between Zillow and Redfin after Redfin made moves to adopt a similar ban on certain private listings. That ban never took effect, and Compass has since made a deal to display its Coming Soon listings on Redfin.com.

Zillow had recently notched a win in its court battle with Compass. Months after filing a preliminary injunction asking the court to pause Zillow’s ban while the case proceeded, a judge denied Compass’ request in a Feb. 6 ruling that allowed Zillow to continue enforcing its listing standards.

Compass said at the time that it planned to move forward with the lawsuit, declaring that the judge’s ruling was “not a loss.”

Making nice? But much has changed since early February. After the home search site unveiled Zillow Preview, Reffkin’s Mar. 17 social media response to Zillow Preview seemed to signal some kind of vibe shift between the two companies — two industry giants that have been vocal in their criticism of each other’s policies.

Advertisement

“A sincere thank you to Zillow for offering homeowners more choice,” he wrote in response to Zillow’s announcement. “Sellers deserve the choice to decide when, where and how they market their homes.”

Source link

Advertisement
Continue Reading

Tech

The Best Outdoor Deals From the REI Member Days Sale (2026)

Published

on

REI’s Member Days sale starts today and runs through March 23, 2026. As the name implies, the bulk of the deals are exclusively for REI members. Members get 20 percent off one full-price item with the coupon code MEMBER26. Members also get 20 percent off one used Re/Supply item, and 40 percent off all REI Co-Op Campwell and Wonderland tents. If you’re not yet an REI member, you can join today.

We’ve combed through the member deals, as well as some more limited outlet deals to find the best price on all our favorite tents, backpacks, outdoor apparel, and more.

Updated Wednesday, March 2026: We’ve added a few more deals, including a great sale on REI’s Flash 22 daypack, a Sea to Summit sleeping pad, a Mystery Ranch backpack, and an Exped sleeping pad.

WIRED Featured Deals

Advertisement

See all of WIRED’s Outdoor Gear Coverage

Hiking & Backpacking Gear Guides:

Camping Guides

Outdoor Apparel Guides

Advertisement

Winter Sports


What You Should Get With Your Member Coupon

During the REI Member Days sale REI Members get 20 percent off one full-price item with the coupon code MEMBER26. Here are a few pieces of outdoor gear we love that are good candidate for buying with your member coupon. Not an REI member? You can sign up today and get access to the coupon.

Upgrade Your Sleeping Experience

Therm-a-Rest NeoLoft sleeping pad in orange color

Therm-a-Rest

NeoLoft Sleeping Pad

Advertisement

I just got back from a three-day trip using this pad for the first time in a few months. What a revelation it is, every time I sleep on this thing. I’d been testing other pads most of the winter. While some are very good, nothing compares to the Therm-a-Rest NeoLoft for comfort. This pad reinvigorated my love of backpacking by ensuring that I get a great night’s sleep in the backcountry. It’s cushy and comfortable, like a plush car-camping pad, with excellent pressure relief (pro tip: for max comfort, don’t over inflate it). The R-4.8 insulation keeps you warm down to about freezing, though I’ve used it in colder conditions by pairing it with a closed cell foam pad. I also love that it packs up quite small considering how massive it is when inflated.

Lighten Your Load With an Ultralight Tent

Big Agnes tent

Big Agnes

Copper Spur HV UL Tent

The Big Agnes Copper Spur tents are high quality, lightweight, and well designed. At 2 pounds 10 ounces for the two-person model, this is one of the lightest freestanding tents on the market. It’s easy to set up, and stable even in strong winds. The Copper Spur is also very livable, with steep sidewalls to maximize interior space. Mesh pockets help with gear storage and give you a place to stick your headlamp for dispersed light. The ingenious “awning” design makes getting in and out a snap (provided you have trekking poles to set it up). All seams are taped with waterproof, solvent-free polyurethane tape. They’re also durable despite their lightweight fabrics, standing up to years of abuse on the trail. I do recommend grabbing the footprint ($80), though, to help protect the floor. It also allows you to pitch the fly only, which is nice shelter on sunny days at the beach.

Advertisement

Grab REI’s Best Lightweight Backpack

REI Flash Air Backpack in gray with white grid and writing

Photography: Scott Gilbertson

REI Co-op

Flash Air 50 Backpack

I tested this pack quite a bit last summer as part of an upcoming ultralight backpack guide. It’s very comfortable, carrying a 25-pound load without issue. It’s not the lightest pack I’ve tried (it’s 1 pound, 14 ounces for a medium), but like most REI-brand gear, it strikes a great balance between features and price. It’s made of UHMWPE ripstop nylon, with shaped steel piping for the frame, making it studier than a frameless pack. I love the precurved back panel and hip belt, which were much more comfortable than most ultralight framed packs in this class. It’s got nice load lifters as well, and the minimalist design works well to keep weight down. My only real gripe is that the exterior pocket isn’t very big.

Advertisement

Get the Best Camp Stove

Coleman 1900 Camping Stove

Coleman

Cascade 3-in-1 Stove

Any flame will work, but Coleman’s Cascade 3-in-1 stove really elevates your outdoor cooking experience. I lived full time in an RV for over seven years and cooked on this stove almost every day. It’s all about the cast iron grates. They’re sturdier than the usual metal and don’t warp over time. Apply a light coat of oil to them periodically and they’ll develop a protective seasoning just like a cast iron pan. The flat top is also handy for cranking out camp pancakes for a hungry family. The coupon brings the price here down to $200.


Deals on Camping and Backpacking Gear

Nemo Mayfly Tent in the woods

Photograph: Scott Gilbertson

Nemo Equipment’s Mayfly Osmo tent is the two-person tent I reach for the most. It’s solidly built, cleverly designed, and has proved durable, and most importantly, dry, in my years of testing. I tested the Mayfly two-person model, which has a trail weight of 3 pounds 8 ounces. A little heavier than our top pick for ultralight hiking (the Copper Spur suggested above) but still pretty light when split between two people. It’s a semi-freestanding design, which means there are fewer poles, but you have to stake out the foot-end of the tent. Two sewn-in ridged stays help ensure there’s plenty of room by your feet, but the Mayfly is on the tight side. Two sleeping pads fit, and hikers under 6′ 4″ will be fine, but if you’re not close with your hiking partner, the three-person model for $375 ($125 off) will be a better option.

Advertisement

The Dragonfly Osmo is a slightly lighter tent than the Mayfly above, aimed at ultralight backpackers who want a freestanding tent. I’ve tested and liked the one-person version, which is spacious, lightweight, and sturdy. The Osmo fabric is Nemo’s proprietary blend of nylon and polyester, which in my experience sheds rain better than most nylon rainflies. The Dragonfly Osmo 3-person version is also on sale for $435 ($145 off), and the bike-packing friendly two-person version, with poles that fit between your handlebars, is on sale for $376 ($204 off)

This is the best value of the REI Member’s Day sale. The Wonderland 6 replaces my beloved Kingdom 6, as REI spacious, hoop-design family car camping tent. While I prefer the square design of the Base Camp 6, the Wonderland 6 is undeniably roomier, better ventilated, and overall a better choice for most families. The biggest thing I miss about the Wonderland is the interior divider wall, which makes it easy to have a sleeping area and separate area for hanging out. The Wonderland 4 is also on sale for $257 ($172 off), but I highly recommend the two-person version as it’s nearly the same price and gives you considerably more living space.

Thermarest ZLite Sol

Photograph: Thermarest

The Z-Lite Sol weighs next to nothing (10 ounces for the small), folds up small enough to lash to the outside of any pack, and can double as a chair, extra padding on cold nights, table, you name it. I am too old and too soft to be the sort of ultra-minimalist who gets by with just a Z-Lite for sleeping, but I still have one around on almost every backpacking trip I take.

The self-inflating Comfort Plus inhabits an interesting borderland between car camping pad and backpacking sleeping pad. At 3 pounds it’s definitely not light, but if you don’t mind the weight it’s a comfortable option. The open-cell interior offers a nicely cushy sleeping experience with enough padding to help even side sleepers avoid bottoming out.

Advertisement

Formerly our top pick for backpacking sleeping pads, the Exped Ultra 7R is still a great winter sleeping pad, especially at this price. The Ultra has down insulation inside it to achieve the high R-rating. At under 2 pounds for the wide version, it’s not that heavy for a four season pad, but it is quite bulky, taking up considerable pack space due to the down. I have used this pad down to 20 degrees Fahrenheit and was very comfortable (in a 10-degree bag). Exped rates it to –20 degrees F.

Sea to Summit Ether Light XT Sleeping pad in gray with stuff sack

Photograph: REI

Sea to Summit’s Ether Light XT is a 4-inch thick ultralight sleeping pad—the ever-popular Therm-a-Rest X-Lite is only 3—making it the best ultralight option for side sleepers. I also like the baffle design better than the Therm-a-Rest, and it seems to be a little more durable in my testing. Note that the XT has been replaced by a newer model, but this one is still great.

Nemo’s Forte 35 is our favorite synthetic sleeping bag. It’s rated to 35 degrees (comfort rated), making it a good choice for summer. What I like most about this bag, and nearly all of Nemo’s sleeping bags, is the wider cut through the torso area down to the knees. This bag is almost a hybrid of a mummy bag and your father’s good old 1970s square sleeping bag. Which is to say, this bag is roomy.

The Best Outdoor Deals From the REI Member Days Sale

Photograph: Adrienne So

The Arc’teryx Beta SL rain jacket is our favorite rain jacket. This is Arc’teryx’s lightest rain shell, but it’s also one of the few jackets that has never failed to keep me dry. It has Gore-Tex’s latest fabric innovation, called ePE (expanded polyethylene)—it’s a breathable, waterproof membrane laminated to a nylon face (PFC-free). It has a hydrostatic head (HH) rating of 28,000, which is far better than the usual rating of 10,000 that you find in most jackets. This deals takes a little of the sting out of the one thing I don’t like about this jacket—the price.

Advertisement

Patagonia’s classic rain jacket, now with a a PFC-free DWR finish. I like the roomier fit of the Arc’teryx Beta SL above, but this jacket is 95 percent as good and less than half the price of the Beta. It’s got a two-way adjustable hood, and cuffs have velcro to give a nice, tight seal against the rain. The only real complaint I have with this jacket is that’s it’s on the noisier side, but at this price, I can deal with a little extra nylon crinkling.

There’s only a couple colors available at this price, but this is a great deal on one of the most packable synthetic puffer jackets we’ve tested. If you’re avoiding down, but want a light puffer for three-season backpacking, or just around town wear, this the jacket to get.

REI CoOp 650 Down Jacket

Photograph: REI

Another deal with limited color selection, but this is too good of a price to ignore. The 650 Down Jacket is one of the best budget three-season puffers you can buy, more so at this price. At 10.9 ounces, it’s reasonably lightweight and has large hand pockets and some very nice internal pockets for stashing a hat or gloves. The kids’ version is also on sale in a nice yellow color that’s handy for spotting your child in the snow.

Patagonia’s Down Sweater is a much-loved, classic puffer jacket. It uses 800-fill-power down and borders on overstuffed, making for a beefier coat than many others I’ve tried. It has plenty of loft nonetheless, and the recycled nylon ripstop fabric still looks like it does the day I took it home (that fabric is now made from recycled fishing nets).

Advertisement

Nemo’s Resolve is a great pack that incorporates a low-waste footprint into the design. It uses solution-dyed fabrics and eschews straps and buckles in favor of bungees and pull-tabs. This does make adjusting it fussier, but once you’re used to it and have the fit dialed in, it’s not an issue. The Resolve is a comfortable pack. While technically frameless, it feels like it has some structure. and it sits nice and high on your back. At 1 pound 15 ounces, it’s also pretty light.

REI Flash 22 day hiking pack in gray

Photograph: Scott Gilbertson

The Flash 22 is possibly the best-value day pack on the market, especially on sale. I was surprised by how comfortable this thing is, despite the lightweight straps and minimal padding. It carries loads up to 15 pounds without straining the shoulders, and the side stash pockets are fabulously large—big enough for a Nalgene bottle or rain jacket. The Flash 22 is made of 70-denier recycled ripstop nylon, which is on the lighter side, but mine has held up well, even coming through some rough canyon hikes in Utah without any more than mud stains. Note that this deal is only on the print versions.

This is Mystery Ranch’s stab at an ultralight pack. It’s still 3 pounds, 13 ounces, but the full suspension system can handle loads far beyond what most ultralight packs (even those with frames) can handle. This is one of the most comfortable packs I’ve tested and my top pick for any load over 25 pounds, but unfortunately, Mystery Ranch has discontinued it, so this might be your last chance to snag one.

If you want to bring a chair backpacking, this is the one to get. It’s just about the lightest on the market at 18 ounces, and it packs down nice and small. Nemo also solved the main problem with all pole chairs: The included base pad keeps it from sinking in soft ground.

Advertisement
Yeti Hopper Flip 8 Cooler a blue padded device holding canned beverages leaning against a black golf bag sitting in the...

Photograph: Ryan Waniata

As with most Yeti sales, this one applies only to a single color, in this case the insanely bright Firefly Yellow. I can almost guarantee you will never lose it if you get that color. Yeti’s Hopper cooler is my go-to cooler for an afternoon at the beach. It’s just large enough for ice, drinks, and snacks for my family of five.


Power up with unlimited access to WIRED. Get best-in-class reporting and exclusive subscriber content that’s too important to ignore. Subscribe Today.

Source link

Advertisement
Continue Reading

Tech

The Gas In CA Is Completely Different From The Rest Of The US

Published

on





Assuming you aren’t currently hiding under a very large rock, you’ve likely noticed that gas prices spiked dramatically in early March. Pain at the pump can be attributed to the war in Iran, specifically the difficulty of getting ships through the Strait of Hormuz, through which 20% of all exported oil and natural gas typically passes. Until recently, gas prices were relatively low, averaging just below $3 a gallon in the U.S. At time of writing, the average price of a gallon is $3.79, but of course, you may pay more or less depending on where you live.

According to GasBuddy, the cheapest gas can currently be found in Oklahoma, where residents will pay about $3.20, and residents of the Golden State are getting hit the hardest. Californians are paying more than $5.53 per gallon as of mid-March. One station in Los Angeles raised prices to more than $8 a gallon. Why is gas so much more expensive in California, especially when the state is home to several refineries? It all comes down to science — the formula of the gas, to be specific.

Fuel standards differ from state to state and often reflect local air quality needs. The federal Clean Air Act sets national standards but permits states to set their own specialized programs. In 1996, California’s Air Resources Board mandated that the state sell a unique blend to help reduce pollution. It’s cleaner than gas sold elsewhere, but more expensive to make because it requires more processing. Because California is the only state with this requirement, it can’t simply import gas from other states.

Advertisement

Other contributors to cost

California’s strict fuel standards aren’t the only contributors to its high fuel costs. There’s also an age-old complaint: taxes. The state pays more in taxes per gallon than any other part of the country. A whopping $0.90 of each gallon is a combination of local, state, and federal taxes. In addition to high taxes, California’s tough environmental standards impact more than just the blend of the fuel. The Cap-and-Invest Program, previously called Cap-and-Trade, to reduce greenhouse gas emissions, and its Low Carbon Fuel Standard, which is designed to decrease the carbon intensity of fuel, both increase costs at the pump.

California is also considered a fuel island — an isolated market that refines most of its own fuel. There are no pipelines across the Rocky Mountains and only a few from the Gulf Coast. Additionally, there are few refineries outside the state that can meet California’s strict blend requirements. To further complicate the issue, the state is losing refineries at an alarming rate. The Phillips 66 Wilmington refinery closed in late 2025, and Valero Energy Corporation plans to close its refinery in Benicia this year.

Advertisement

In 2023, California passed a law that would allow it to cap refinery profits and penalize oil companies for price gouging, legislation that many hoped would help when prices skyrocketed. The law has never been used, however, and in 2025, the California Energy Commission delayed it for five years, worried that penalizing refineries could lead to more closures. Critics of the law maintain it doesn’t address the real issue — the state’s isolation — while proponents argue that the state remains dangerously exposed to global shakeups in the energy market.



Advertisement

Source link

Continue Reading

Tech

Family Sharing no longer means sharing a credit card in iOS 26.4

Published

on

Apple is finally fixing one of Family Sharing’s most awkward limitations in iOS 26.4, letting multiple adults on one family pay for their own purchases without breaking shared access.

iPhone screen showing Apple Cash add money screen, selecting 20 dollars, with text indicating new Apple Cash balance of 30 dollars on a dark background
Apple updates payments for Family Sharing

For years, Family Sharing forced everyone into a single payment method whenever purchase sharing was enabled. The approach worked for traditional households, but it created friction for anyone sharing with friends, partners, or extended family.
One person effectively became the default payer, even when it made no practical sense. iOS 26.4 changes the structure by letting adult members use their own payment methods while still joining shared purchases.
Continue Reading on AppleInsider | Discuss on our Forums

Source link

Continue Reading

Tech

AI training lawsuit drags Apple in yet again for alleged use of pirated book dataset

Published

on

AI training with sketchy data repository “The Pile” returns to the courts in a lawsuit by Chicken Soup for the Soul, LLC accusing just about all of big tech of piracy. The problem is, Apple denies using it to train Apple Intelligence.

Glowing multicolored Siri orb with overlapping light ribbons centered inside a neon gradient atomic-style looped outline that is the Apple Intelligence logo on a solid black background
Apple accused of using ‘The Pile’ for AI training yet again

Artificial intelligence is a term that has virtually lost all meaning because of its being applied to everything. In that sense, it seems a lawsuit has mistakenly included Apple when it has previously denied utilizing the dataset in question.
According to a lawsuit from Chicken Soup for the Soul, LLC, Apple, Meta, xAI, Google, Anthropic, OpenAI, Perplexity, and NVIDIA are all in violation of copyright thanks to training their respective artificial intelligence tools on a dataset known as “The Pile.” While that dataset is filled with proprietary content, like YouTube subtitle files, it wasn’t used by Apple to train Apple Intelligence.
Continue Reading on AppleInsider | Discuss on our Forums

Source link

Continue Reading

Tech

ENIAC, the General-Purpose Digital Computer, Is 80

Published

on

Happy 80th anniversary, ENIAC! The Electronic Numerical Integrator and Computer, the first large-scale, general-purpose, programmable electronic digital computer, helped shape our world.

On 15 February 1946, ENIAC—developed in the Moore School of Electrical Engineering at the University of Pennsylvania, in Philadelphia—was publicly demonstrated for the first time. Although primitive by today’s standards, ENIAC’s purely electronic design and programmability were breakthroughs in computing at the time. ENIAC made high-speed, general-purpose computing practicable and laid the foundation for today’s machines.

On the eve of its unveiling, the U.S. Department of War issued a news release hailing it as a new machine “expected to revolutionize the mathematics of engineering and change many of our industrial design methods.” Without a doubt, electronic computers have transformed engineering and mathematics, as well as practically every other domain, including politics and spirituality.

ENIAC’s success ushered the modern computing industry and laid the foundation for today’s digital economy. During the past eight decades, computing has grown from a niche scientific endeavor into an engine of economic growth, the backbone of billion-dollar enterprises, and a catalyst for global innovation. Computing has led to a chain of innovations and developments such as stored programs, semiconductor electronics, integrated circuits, networking, software, the Internet, and distributed large-scale systems.

Advertisement

Inside the ENIAC

The motivation for developing ENIAC was the need for faster computation during World War II. The U.S. military wanted to produce extensive artillery firing tables for field gunners to quickly determine settings for a specific weapon, a target, and conditions. Calculating the tables by hand took “human computers” several days, and the available mechanical machines were far too slow to meet the demand.

In 1942 John Mauchly, an associate professor of electrical engineering at Penn’s Moore School, suggested using vacuum tubes to speed up computer calculations. Following up on his theory, the U.S. Army Ballistic Research Laboratory, which was responsible for providing artillery settings to soldiers in the field, commissioned Mauchly and his colleagues J. Presper Eckert and Adele Katz Goldstine, to work on a new high-speed computer. Eckert was a lab instructor at Moore, and Goldstine became one of ENIAC’s programmers. It took them a year to design ENIAC and 18 months to build it.

The computer contained about 18,000 vacuum tubes, which were cooled by 80 air blowers. More than 30 meters long, it filled a 9 m by 15 m room and weighed about 30 kilograms. It consumed as much electricity as a small town.

Programming the machine was difficult. ENIAC did not have stored programs, so to reprogram the machine, operators manually reconfigured cables with switches and plugboards, a process that took several days.

Advertisement

By the 1950s, large universities either had acquired or built their own machines to rival ENIAC. The schools included Cambridge (EDSAC), MIT (Whirlwind), and Princeton (IAS). Researchers used the computers to model physical phenomena, solve mathematical problems, and perform simulations.

After almost nine years of operation, ENIAC officially was decommissioned on 2 October 1955.

ENIAC in Action: Making and Remaking the Modern Computer, a book by Thomas Haigh, Mark Priestley, and Crispin Rope, describes the design, construction, and testing processes and dives into its afterlife use. The book also outlines the complex relationship between ENIAC and its designers, as well as the revolutionary approaches to computer architecture.

In the early 1970s, there was a controversy over who invented the electronic computer and who would be assigned the patent. In 1973 Judge Earl Richard Larson of U.S. District Court in Minnesota ruled in the Honeywell v. Sperry Rand case that Eckert and Mauchly did not invent the automatic electronic digital computer but instead had derived their subject matter from a computer prototyped in 1939 by John Vincent Atanasoff and Clifford Berry at Iowa State College (now Iowa State University). The ruling granted Atanasoff legal recognition as the inventor of the first electronic digital computer.

Advertisement

IEEE’s ENIAC Milestone

In 1987 IEEE designated ENIAC as an IEEE Milestone, citing it as “a major advance in the history of computing” and saying the machine “established the practicality of large-scale electronic digital computers and strongly influenced the development of the modern, stored-program, general-purpose computer.”

The commemorative Milestone plaque is displayed at the Moore School, by the entrance to the classroom where ENIAC was built.

“The ENIAC legacy heralded the computer age, transforming not only science and industry but also education, research, and human communication and interaction.”

A paper on the machine, published in 1996 in IEEE Annals of the History of Computing and available in the IEEE Xplore Digital Library, is a valuable source of technical information.

Advertisement

The Second Life of ENIAC,” an article published in the annals in 2006, covers a lesser-known chapter in the machine’s history, about how it evolved from a static system—configured and reconfigured through laborious cable plugging—into a precursor of today’s stored-program computers.

A classic history paper on ENIAC was published in the December 1995 IEEE Technology and Society Magazine.

The IEEE Inspiring Technology: 34 Breakthroughs book, published in 2023, features an ENIAC chapter.

The women behind ENIAC

One of the most remarkable aspects of the ENIAC story is the pivotal role women played, according to the book Proving Ground: The Untold Story of the Six Women Who Programmed the World’s First Modern Computer, highlighted in an article in The Institute. There were no “programmers” at that time; only schematics existed for the computer. Six women, known as the ENIAC 6, became the machine’s first programmers.

Advertisement

The ENIAC 6 were Kathleen Antonelli, Jean Bartik, Betty Holberton, Marlyn Meltzer, Frances Spence, and Ruth Teitelbaum.

“These six women found out what it took to run this computer, and they really did incredible things,” a Penn professor, Mitch Marcus, said in a 2006 PhillyVoice article. Marcus teaches in Penn’s computer and information science department.

In 1997 all six female programmers were inducted into the Women in Technology International Hall of Fame, in Los Angeles.

Two other women contributed to the programming. Goldstine wrote ENIAC’s five-volume manual, and Klára Dán von Neumann, wife of John von Neumann, helped train the programmers and debug and verify their code.

Advertisement

To honor the women of ENIAC, the IEEE Computer Society established the annual Computer Pioneer Award in 1981. Eckert and Mauchly were among the award’s first recipients. In 2008 Bartik was honored with the award. Nominations are open to all professionals, regardless of gender.

An ENIAC replica

Last year a group of 80 autistic students, ages 12 to 16, from PS Academy Arizona, in Gilbert, recreated the ENIAC using 22,000 custom parts. It took the students almost six months to assemble.

A ceremony was held in January to display their creation. The full-scale replica features actual-size panels made from layered cardboard and wood. Although all electronic components are simulated, they are not electrically active. The machine, illuminated by hundreds of LEDs, is accompanied by a soundtrack that simulates the deep hum of ENIAC’s transformers and the rhythmic clicking of relays.

A white woman using a computer-adding machine in the 1940\u2019s. The device resembles a bulky typewriter and prints large stacks of paper with tabulated answers.

This machine prints and tabulates the answers to the problems solved by the ENIAC.

Advertisement

Bettmann/Getty Images

“Every major unit, accumulators, function tables, initiator, and master programmer is present and placed exactly where it was on the original machine,” Tom Burick, the teacher who mentored the project, said at the ceremony.

The replica, still on display at the school, is expected to be moved to a more permanent spot in the near future.

Advertisement

ENIAC’s legacy

ENIAC’s significance is both technical and symbolic. Technically, it marks the beginning of the chain of innovations that created today’s computational infrastructure. Symbolically, it made governments, militaries, universities, and industry view computation as a tool for improvement and for innovative applications that had previously been impossible. It marked a tectonic shift in the way humans approach problem-solving, modeling, and scientific reasoning.

The ENIAC legacy heralded the computer age, transforming not only science and industry but also education, research, and human communication and interaction.

As Eckert is reported to have said, “There are two epochs in computer history: Before ENIAC and After ENIAC.”

The remarkable evolution of computer hardware during the past 80 years has been sparked by advances in programming languages—the essential drivers of computing.

Advertisement

From the manual rewiring of ENIAC to the orchestration of intelligent, distributed systems, programming languages have steadily evolved to make computers more powerful, expressive, and accessible.

Predictions for computing in the decades ahead

The evolution of computing will continue along multiple trajectories, with the emphasis moving from generalization to specialization (for AI, graphics, security, and networking), from monolithic system design to modular integration, and from performance-centric metrics alone to energy efficiency and sustainability as primary objectives.

Increasingly, security will be built into hardware by design. Computing paradigms will expand beyond traditional deterministic models to embrace probabilistic, approximate, and hybrid approaches for certain tasks.

Those developments will usher in a new era of computing and a new class of applications.

Advertisement

From Your Site Articles

Related Articles Around the Web

Source link

Advertisement
Continue Reading

Tech

HP Study Finds Many Indian SMBs Still Ignore Printer Security Risks

Published

on

Cybersecurity in 2026 is one of the most pressing issues since everything we interact with is connected to the internet. HP has just released a new report titled The Workflow Wakeup, highlighting how everyday workplace technologies, including printers, can impact cybersecurity in modern organizations. According to the study, 51% of SMBs consider print security a low priority, even as businesses increasingly adopt digital tools and hybrid work environments.

Print Security Still a Blind Spot

The research was based on responses from 200 IT decision-makers and 600 knowledge workers across Indian SMBs with 50 to 1,000 employees.

One of the most notable findings is that employees often underestimate the risks associated with printers connected to office networks. Around 75% of knowledge workers assume network printers are secure, while 48% do not consider printers to be a cybersecurity threat.

At the same time, concerns about document privacy remain significant. Nearly 49% of workers worry about confidential documents being printed and accessed by the wrong person. The study outlines several key risks organizations worry about when it comes to printing infrastructure:

Advertisement
  1. Cybersecurity threats linked to connected printers
  2. Employees mishandling or misprinting sensitive documents
  3. Managing security across multiple printers in an organization
  4. Unauthorized access to print queues or files
  5. Security risks tied to cloud-based scanning workflows

Smart Printing Technology Could Help

A person giving showing someone a printed paper

While the report highlights several challenges, HP also suggests that adopting smarter print management systems can improve security.

Among SMBs that have implemented smart printing technology, 88% reported improved security outcomes. Businesses cited three main benefits:

  • Better visibility into printing and scanning activity (90%)
  • Improved compliance with security standards (85%)
  • Stronger enforcement of printing rules and restrictions (83%)

Source link

Continue Reading

Tech

Prof Lynne Taylor and Dr Sarah O’Keeffe awarded 2026 St Patrick’s Day Medal

Published

on

The Research Ireland St Patrick’s Day Medal honours exceptional academic and industry leaders with strong Irish roots.

Taoiseach Micheál Martin, TD has presented Prof Lynne Taylor, a Retter distinguished professor of pharmacy at Purdue University, and Dr Sarah O’Keeffe, the group vice-president for product research and development at Eli Lilly, with the Research Ireland St Patrick’s Day medal.

The medal is awarded each year to academic and industry leaders with established Irish roots, who from their positions in the US, support and champion Ireland’s research community. Previous winners include computer scientist Dr Eamonn Keogh, Stripe founders John and Patrick Collison and Dr Ann Kelleher

A global authority on drug formulation science, Taylor’s research provides the foundation technologies that support the delivery of life-saving treatments for diseases such as cancer and hepatitis C. An Irish citizen, she is a vocal advocate for Ireland’s pharma space through her advisory roles with the Research Ireland Centre for Pharmaceuticals and collaboration with universities. 

Advertisement

She is also the editor-in-chief of Molecular Pharmaceutics and is committed to supporting other women in STEM via the mentorship of emerging scientists and has built a formidable talent pipeline, with many former group members now holding prominent positions globally.

Commenting on the award, Taylor said: “It is a great honour to receive this award from Ireland’s research and innovation agency. For many years I have been involved with championing Irish research and supporting scientists at every stage of their development, across Ireland and globally. 

“Whether serving as a mentor, adviser, collaborator or guest speaker, these interactions with Irish scientists have been deeply rewarding. It is a privilege to continue playing a role in fostering greater connectivity and knowledge exchange between the United States and Ireland, and I am confident that the long-standing bonds between our two countries will grow even stronger into the future.”

O’Keeffe is considered among one of Ireland’s most senior leaders in global pharmaceutical R&D and she oversees more than 1,000 scientists and engineers who translate discovery molecules into medicines for patients worldwide. She has been central to a number of major advances in drug development, including in the development of the investigational drug candidate orforglipron, which was recognised by Time magazine for its potential global health impact in the management of diabetes and obesity.

Advertisement

Beginning her career with Eli Lilly in Indianapolis, O’Keeffe played a central role in advancing manufacturing capabilities at the company’s Kinsale site, earning the facility the IPSE Global Facility of the Year Award for Innovation in 2017 and is a central figure in the development of the $4.5bn Lilly Medicine Foundry.

Of her win, she said: “I am delighted and proud to receive this recognition from Research Ireland. I would like, firstly, to acknowledge UCC for being the launchpad for my career in industry. I’d also like to thank all my Lilly colleagues in Ireland, United States and internationally over the last two decades, for their extraordinary commitment and relentless pursuit of excellence. 

“Pharmaceutical research endeavours are a team pursuit, and collective passion and perseverance through times of challenge and often, failure is how progress and success happens. It has been a pleasure to have shared my journey to date with such talented colleagues who have the patient front and centre in all that they do.”

Presenting both recipients with their medals in Washington DC, Martin stated: “Today, we honour two outstanding scientific leaders whose achievements exemplify the very best of our global research community. Prof Taylor and Dr O’Keeffe demonstrate how members of the Irish diaspora, working at the highest levels in the United States, are helping to shape the future of medicine and strengthen international partnerships. 

Advertisement

“Their respective work has enhanced Ireland’s reputation as a leader in research and innovation, and reflects both the deep and enduring ties between Ireland and the US, and our shared commitment to scientific excellence. I am delighted to recognise their leadership and achievements here today, and to celebrate the impact they continue to make on behalf of Ireland.”

Updated, 3.35pm, 18 March 2026: This article was amended to clarify that O’Keeffe helped Eli Lilly’s Kinsale site earn the IPSE Global Facility of the Year Award for Innovation.

Don’t miss out on the knowledge you need to succeed. Sign up for the Daily Brief, Silicon Republic’s digest of need-to-know sci-tech news.

Advertisement

Source link

Continue Reading

Tech

CISA orders feds to patch Zimbra XSS flaw exploited in attacks

Published

on

Email

CISA has ordered U.S. government agencies to secure their servers against an actively exploited vulnerability in the Zimbra Collaboration Suite (ZCS).

Zimbra is a very popular email and collaboration software suite used by hundreds of millions of people worldwide, including thousands of businesses and hundreds of government agencies.

Tracked as CVE-2025-66376 and patched in early November, this high-severity security flaw stems from a stored cross-site scripting (XSS) weakness in the Classic UI that remote unauthenticated attackers could exploit by abusing Cascading Style Sheets (CSS) @import directives in email HTML.

While Synacor (the company behind Zimbra) didn’t share any details on the impact of a successful CVE-2025-66376 attack, it can likely be exploited to execute arbitrary JavaScript via malicious HTML-based emails, potentially allowing attackers to hijack user sessions and steal sensitive data within the compromised Zimbra environment.

Advertisement

CISA added it to its catalog of vulnerabilities exploited in the wild on Wednesday and gave Federal Civilian Executive Branch (FCEB) agencies two weeks to secure their servers by April 1st, as mandated by the Binding Operational Directive (BOD) 22-01 issued in November 2021.

Although BOD 22-01 applies only to federal agencies, the U.S. cybersecurity agency encouraged all organizations, including those in the private sector, to patch this actively exploited flaw as soon as possible.

“Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable,” CISA warned. “These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.”

Zimbra servers under attack

Zimbra security flaws are frequently targeted in attacks and have been exploited to breach thousands of vulnerable email servers worldwide in recent years.

Advertisement

For instance, as early as June 2022, Zimbra auth-bypass and remote code execution bugs were abused to breach more than 1,000 servers.

Starting in September 2022, hackers exploited a zero-day vulnerability in Zimbra Collaboration Suite, breaching nearly 900 servers within two months after gaining remote code execution on compromised instances.

The Russian state-backed Winter Vivern hacking group also used reflected XSS exploits to breach the Zimbra webmail portals of NATO-aligned governments and the mailboxes of government officials, military personnel, and diplomats.

More recently, threat actors exploited another Zimbra XSS vulnerability (CVE-2025-27915) in zero-day attacks to execute arbitrary JavaScript code, enabling them to set email filters that redirect messages to attacker-controlled servers.

Advertisement

Malware is getting smarter. The Red Report 2026 reveals how new threats use math to detect sandboxes and hide in plain sight.

Download our analysis of 1.1 million malicious samples to uncover the top 10 techniques and see if your security stack is blinded.

Source link

Continue Reading

Trending

Copyright © 2025