Hackers are actively exploiting the critical CVE-2026-50522 vulnerability in Microsoft SharePoint to steal machine keys and maintain access even after affected servers are patched.

An attacker obtaining them can create valid authentication tokens to impersonate users and access available resources such as SharePoint sites and documents with the privileges of the forged identity.

Microsoft describes the security issue as a deserialization-of-untrusted-data flaw that allows a remote attacker to execute code over a network without authentication.

The flaw was addressed in July’s security updates from Microsoft. It was not marked as actively exploited, but the advisory noted an increased likelihood of being leveraged.

Offensive security company watchTowr has observed that hackers started to leverage CVE-2026-50522 against on-premise vulnerable SharePoint deployments, immediately after a valid proof-of-concept (PoC) exploit became public.

“On July 20th, watchTowr identified proof-of-concept exploit code for this vulnerability,” watchTowr states. “Within hours, our global honeypot network, Attacker Eye, captured exploitation attempts using this PoC that successfully compromised target systems.”

The researchers note that the attackers are stealing machine keys that allow them to maintain long-term access on breached systems.

Early warning threat intelligence company Defused detected “an undocumented SharePoint deserialization vector” being used in attacks as early as July 17 but could not link the activity to a flaw.

Yesterday, the company said that the attacks were likely driven by exploiting the CVE-2026-50522 SharePoint vulnerability.

Exploit released publicly

At least one PowerShell demonstrative exploit for CVE-2026-50522 is available on GitHub from security researcher Janggggg.

The PoC attempts to trigger remote code execution by delivering a malicious .NET ‘BinaryFormatter’ payload as the cookie of a forged ‘SecurityContextToken’ within a WS-Federation sign-in response posted to SharePoint’s ‘/_trust/default.aspx’ endpoint.

If the token is processed by a vulnerable deserialization path, the payload results in arbitrary code execution on the SharePoint server.

BleepingComputer did not test the PoC exploit, but it looks structurally and technically legitimate.

It should be noted that Janggggg’s published the PoC on the same day watchTowr started to detect attacks leveraging it. However, it is unclear if the observed incidents made use of the publicly available exploit.

While applying the latest SharePoint security updates removes the vulnerability, watchTowr advises defenders to also rotate credentials on any asset that may have been exposed.

Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.

The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.

Get the whitepaper

• SK On says solid-state cells can give industrial robots the 8+ hour runtime of a human shift, but adoption might be another story
• While upcoming solid-state batteries boost productivity through longer operating times and lower overall operating costs, they are prohibitively more expensive than some of their lithium-ion peers
• Modern Li-on-based batteries are under 2% of a robot’s manufacturing cost today, and solid-state would push that share to around 8%, a premium that could come with serious tradeoffs for manufacturers

Modern robotics is a field that continues to grow over time, fueled by a mix of smarter AI, manufacturing efficiencies and at times, better materials that change what is possible on the ground.

The robots currently in use in factories and warehouses however have a key limitation that has yet to be addressed properly: Lithium-ion batteries often can not keep up with the power demand that modern robots have.

• Saronic’s Port Alpha facility could expand from 835 acres to nearly 4,400 acres
• The shipyard could eventually build vessels exceeding 1,200 feet long
• Saronic expects Port Alpha to create up to 10,000 direct jobs

Saronic has selected Brownsville, Texas, for ‘Port Alpha‘, a planned shipyard designed to produce autonomous vessels at unprecedented industrial scale.

The project is expected to attract more than $3 billion in private investment and begin construction during 2026.

The company has partnered with Pangram for the new tools.

Google released three new AI models on Tuesday, all built on Gemini 3.5 Flash. The new models are more token-efficient, faster and more reliable across the board. The tech giant also provided an update on the much-anticipated Gemini 3.5 Pro and what’s to come after. 

A new AI model from the likes of Google, Anthropic or OpenAI is released seemingly every week, with the latest, ChatGPT-5.6, released earlier this month. Google’s latest releases aren’t flagship models compared to what’s on the horizon, but each has its place, including a new model solely focused on cybersecurity. 

Here’s what’s new in the latest Gemini models from today’s announcement.

Gemini 3.6 Flash

Google called 3.6 Flash its “workhorse” model that’s now better at coding, knowledge work and multimodal performance. It also promises reduced token usage by up to 17%, and at a lower cost per token versus its predecessor, 3.5.

Google says it built the model based on both developer and customer feedback. A series of benchmarks shows 3.6 Flash’s gains in performance and average tokens per task compared to its predecessor. 

Gemini 3.5 Flash-Lite

Google’s fastest and most cost-effective model can deliver 350 output tokens per second and “significantly” outperforms previous generations when it comes to agentic workflows, according to the blog post.

Like 3.6 Flash, this model now supports computer use as a built-in tool to take on more agentic tasks. 

Gemini 3.5 Flash Cyber

3.5 Flash Cyber is a specialty model that prioritizes cybersecurity workflows in order to find and fix vulnerabilities. It works alongside an infrastructure agent called CodeMender to help cybersecurity teams quickly identify and patch issues.

According to a separate article from Google DeepMind, the new model is already finding and fixing bugs in Google’s internal codebases in Android, Chrome and YouTube. This model will initially be limited to governments and trusted partners, but access will expand in the future.

Gemini 3.5 Pro is still on the way

While the three latest models are the primary focus for Tuesday’s announcements, Google gave a brief update to its upcoming flagship AI model, Gemini 3.5 Pro. The model is said to currently be in testing with partners, and it plans to make it available as soon as it’s ready. How long that will take is anyone’s guess, but Google’s also already looking ahead to the next generation of AI, too.

Google says it has already begun pretraining for Gemini 4, which will be released at an undetermined date.

Both Gemini 3.6 Flash and 3.5 Flash-Lite are available starting today for developers in the Gemini API via Google AI Studio and Android Studio and the Gemini app. 3.6 Flash is also available in Google Antigravity, and 3.5 Flash-Lite is rolling out to Google Search.

Blake has over a decade of experience writing for the web, with a focus on mobile phones, where he covered the smartphone boom of the 2010s and the broader tech scene. When he’s not in front of a keyboard, you’ll most likely find him playing video games or watching horror movies.

See full bio

Advertisement

Disclaimer: Unless otherwise stated, any opinions expressed below belong solely to the author.

Given the number of various support schemes provided by the government in Singapore, one might question whether there aren’t too many of them and if it wouldn’t be simpler to simply disburse one cash payment to every eligible person.

After all, it’s not like the government isn’t doing that already, depositing funds directly for GST Vouchers, Assurance Package payments and cost-of-living support, regularly appearing in recent years.

So why bother with CDC Vouchers, which require an entire digital infrastructure to allow their issuance and redemption? Wouldn’t a simple bank transfer be better?

Cash is not king

At least not for everybody, and certainly not for the government, which is using its power to direct the money to specific parts of the economy.

Cash is liquid, and you can do whatever you want with it, including going for a nice day trip to JB to spend it there instead of Singapore. You may also use it for online shopping on one of the many ecommerce platforms, with most of the funds being sent to sellers in China or other countries.

This sees Singapore dollars exiting the domestic economy, benefiting others instead.

More prudent Singaporeans could opt to save it instead, which isn’t terrible in itself, but does keep the funds out of circulation.

Finally, the more reckless consumers could simply waste it on more “sinful” pleasures, still ending up short of money for daily necessities.

The voucher format allows the government to set strict rules on their use: with 50% allocated to shopping in supermarkets and another half to hawkers and smaller, heartland merchants.

This ensures that this pool of money is spent in the most beneficial way and provides the authorities with data on how the money is spent and where.

There is, however, one other purpose they have served very well since their launch six years ago, which is not spoken of.

Going digital—and staying there

CDC Vouchers originated as a COVID-19-era relief scheme, originally issued on paper and directed to the poorest households.

With the pandemic dragging on throughout 2021, the scheme was ultimately expanded to all citizen households by the end of the year and went digital with the launch of the RedeemSG app. Merchants could use it to accept the vouchers by scanning digital QR codes on customers’ phones, instead of dealing with paper.

In parallel, the government launched the Hawkers Go Digital scheme in Jun 2020, with generous subsidies and transaction fee waivers, which were meant to help hawkers adopt digital payments and reduce the risk of spreading the virus.

It was also a good opportunity to prod them to adopt mobile payments, which have become a staple in many countries around the world (most notably China, through its giant superapp WeChat).

The final waiver of the 0.5% fees ended just recently on Jun 30, 2026, after several past extensions. This means that hawkers are now going to have to bear the cost themselves, which might mean that some of them may prefer to return to cash-only payments.

But this is where the CDC scheme comes in.

Throughout the push for digital payments, the critics lamented that many elderly sellers might be struggling with the transition, not being very tech-savvy. What’s more, a skill once developed needs to be kept in use before it falls out of favour. Old habits die hard, after all.

Well, while we might see some return to cash, there is no returning to paper for CDC vouchers.

And because of the scale of the program, currently exceeding S$1 billion annually, hawkers have a strong incentive to keep their RedeemSG app to accept voucher QR codes.

In other words: there’s no exit from the QR era.

Of course, using the CDC app doesn’t force merchants to accept all digital payments, but since they still have to deal with QR codes to accept the vouchers, it provides very useful stickiness, which is going to keep most of them on the digital train.

• Read other articles we’ve written on Singaporean businesses here.

Featured Image Credit: CDC/ depositphotos

Nvidia is hyping up its new Vera Rubin chip system this week, revealing new performance benchmarks for the GPU and CPU combo ahead of rival AMD’s annual product event in San Francisco on Thursday.

During a lengthy technical workshop last week at the company’s headquarters in Santa Clara, California, Nvidia executives boasted to a small group of journalists about the chip system’s increased power and efficiency capabilities. The biggest takeaway: Nvidia, which has long specialized in making GPUs, is increasingly trying to position itself as a supplier of CPUs that can power AI agents.

While GPUs are still the main hardware that companies use to train and run their AI models, the industry’s shift toward more complex, agentic systems has increased demand for CPUs, which can orchestrate data flows, networking, and other software tasks. That’s likely one reason Nvidia has been eager to promote itself as a supplier of complete AI systems rather than just AI chips.

Vera Rubin is Nvidia’s successor to its hybrid superchip system Grace Blackwell and represents the linchpin of its near-term future powering the AI industry. It’s designed to offer one CPU for every two GPUs. In a single Vera Rubin NVL 72 super chip system, there are 36 Vera CPUs for every 72 Rubin GPUs. Nvidia is also selling the Vera CPU as a stand-alone product, and it has reportedly told Chinese customers these could be ready as soon as August.

The CPU chip Nvidia is using for its new Vera Rubin hardware system.

Courtesy of Nvidia

Nvidia executives emphasized that its new Vera Rubin NVL72 racks—a stack of chips packed into a single liquid-cooled platform—are much more “plug-and-play” than some of its earlier products. During a brief tour of a Nvidia data center lab in Silicon Valley, Nvidia executives shared that OpenAI already has one Vera Rubin rack in use.

Nvidia CEO Jensen Huang didn’t make an appearance at the workshop in Santa Clara last week; he was in Japan announcing the chipmaker’s new partnerships with a number of Japanese firms to develop AI for robotics. The briefings were instead led by Ian Buck, Nvidia’s longtime vice president of accelerated computing and the architect behind the company’s CUDA software.

“We’re on a road map to crank out new architectures, not just GPUs but CPUs,” Buck told reporters. “We’re going to keep innovating, because it’s do this or die in Silicon Valley.”

The meetings were held in Huang’s executive briefing center, where multiple desks nearby were piled with bags of Taiwanese snacks that the CEO brought back from his recent trip to Computex, a massive annual semiconductor trade show in Taipei, an Nvidia spokesperson told WIRED.