60
55
30
57
45
30
60
57
55
60
Prior Labs Releases TabPFN-3.5: A Tabular Foundation Model That Beats the Winning Otto Kaggle Solution With Default Settings
Prior Labs releases TabPFN-3.5, a 220M-parameter open-weights tabular foundation model that beats the 2015 Otto Kaggle winning score with default settings.
Prior Labs released TabPFN-3.5, a tabular foundation model that predicts in a single forward pass without per-dataset training or tuning. The base model grew from 53M to 220M parameters with a single multitask checkpoint, learned Fourier features, and in-context ECDF rank encodings. It scores 0.375 on the 2015 Otto Kaggle private leaderboard versus the winning 0.382 and claims first place on seven tabular benchmarks including TabArena and BeyondArena. Open weights cover the base, Fast (84M), and Thinking variants, but production use requires the Prior Labs API or a commercial license.
55
12 Best Application Control & Allowlisting Tools Compared (2026): Features & Pricing
GBHackers compares twelve application allowlisting tools for 2026, naming ThreatLocker and Airlock Digital leaders and Microsoft WDAC the free native option.
GBHackers published an editorial comparison of twelve application control and allowlisting tools for 2026, assessing control depth, manageability, and pricing models. It ranks ThreatLocker and Airlock Digital as leading dedicated allowlisting options, positions Microsoft WDAC/AppLocker as the free native choice for Windows estates, and highlights CyberArk and BeyondTrust for coupling control with privilege management.
15
Ambient @ EgoProactive 2026 : Proactive Egocentric Assistance with Visually Grounded Supervision
ECCV 2026 challenge winner reformulates egocentric intervention timing as single-token classification, boosting macro-F1 by 0.249 over free-form generation.
The paper describes the winning submission to the EgoProactive track of the ECCV 2026 Wearable AI Challenge, ranking first in the large-model division and second in the <=2B division. The method reformulates intervention timing as single-token yes/no classification, improving macro-F1 by 0.249 and G-mean by 0.30 over free-form generation. Supervision generated by a tool-calling video agent transferred better than a narration-only dataset that was four times larger and ten times cheaper, suggesting visual grounding matters more than annotation volume.
22
AD Rights Management Service (Part 1): Architecture, Deprecation, and Reconnaissance
Huntress maps AD RMS architecture and recon paths, setting up an offline key-extraction attack against its unrotatable 255-year root key.
Huntress's multi-part research examines Active Directory Rights Management Services, Microsoft's enterprise DRM role that still ships in Windows Server 2025 despite migration guidance favoring Azure Information Protection. Part 1 covers the trust model and how an ordinary domain account can locate RMS clusters and read rights-policy templates. Part 2 will detail four independent paths for extracting the Server Licensor Certificate (SLC) private key via service-group membership and the configuration database, enabling fully offline decryption of protected documents. The SLC certificate is valid from 2002 to 2258 and has no key-rotation mechanism, so a stolen key decrypts protected content indefinitely.
55
Recent Trends in Internet Threats: Common Industries Impersonated in Phishing Attacks, Web Skimmer Analysis and More
Unit 42 analyzed 67 million malicious URLs and domains in H2 2022, a 52% increase, highlighting phishing impersonation and web skimmer trends.
Unit 42 observed more than 67 million unique malicious URLs, domains and IPs between July and December 2022, a 52% increase over the first half of the year. Malicious JavaScript detections grew 99.3%, with over 4 million malicious JS samples hosted on 4.8 million URLs. Over 85% of hosting infrastructure was concentrated in eight countries, led by the United States, Brazil and China. The report also analyzes industries spoofed in phishing pages and includes a web skimmer case study on a Tranco top 1 million website.
28
When AI Remembers Too Much
Unit 42 PoC shows indirect prompt injection can poison Amazon Bedrock Agent long-term memory, enabling silent exfiltration of conversation history across future sessions.
Palo Alto Networks Unit 42 published a proof of concept showing that indirect prompt injection can silently poison the long-term memory of Amazon Bedrock Agents when the memory feature is enabled. Malicious content on a webpage or document manipulates the agent's session summarization process, so injected instructions persist across sessions and are added to later orchestration prompts, silently exfiltrating user conversation history. The issue is not a vulnerability in the Amazon Bedrock platform but an illustration of the broader unsolved LLM prompt-injection challenge. Amazon reviewed the research and stated that Bedrock Guardrails with the prompt-attack policy provides effective mitigation.
55
60
55
30
30
45
30
30
55
30
60
Imperva Data Security Fabric provides data-centric protection for enterprise data lakes built on AWS
60
57
55
55
55
42
30
30
30
30
55
60
55
45