#security

A witness reported blown-out windows across several floors of the Aramco Tower, one of the tallest buildings in the capital’s King Abdullah Financial District.

Why is the response from HR and the team for people to buy a new phone, instead of just giving them a yubikey? I was in one of those training sessions, and lots of people are having issues to the point they've extended the deadlines.

They gave everyone who needed it RSA tokens in July, and apparently HAVE the yubikeys because the overseas workers have them. Why is this such an issue?

MPS Security & Protection has released new guidance for employers managing workplace safety during workforce reductions. The advice stresses the importance of advance planning and risk assessment. Employers should implement proportionate security measures to protect employees and facilities. Recent large-scale voluntary exit programs highlight the need for such preparation. The guidance aims to help companies navigate these transitions effectively.

Murrieta, CA

https://www.usatoday.com/press-release/story/54855/recent-workforce-reduction-announcements-raise-need-for-layoff-security-guidance/

Call your shot - with Valero picking up Lyondell Houston, who picks up Alliance? Drove past there for a fishing trip a few months ago - no activity at the site, nothing demo'd, just a security car in the parking lot. Owned by Harvest Midstream now (parent company is Hilcorp, owns the inbound pipelines from LOOP). CEO Jeffrey Hildebrand heavily involved in Trump/Venezuela policy.

Not sure if this applies to all offices, but in ATL just noticed today the elevators are seem to require badge scan to go to lobby area. Maybe this is just an anomaly but if they’re requiring a badge swipe to ride the elevator down to lobby, that’s insane. Just when you think this can’t feel more like a prison…

Happy Tuesday!

SCOOP: Major U.S. banks are detecting unauthorized third-party AI agents inside customer accounts, including some attempting to take actions that appear to be independent of user instructions, sources told Axios.

The findings have alarmed banking executives, who are racing to restrict access to their systems as AI moves at a velocity faster than financial institutions can respond, multiple industry and bank executives told Axios.

Several banks are now preparing for worst-case and even “day after” scenarios, including how to rapidly secure or restore customer accounts if things go wrong, the people said.

Several bank executives told Axios they're struggling to distinguish between human users and AI agents. One executive said banks also struggle to determine whether agents are authorized by customers or potentially operating without their permission, more akin to rogue agent behavior.

https://www.axios.com/2026/10/22/ai-agents-banks-unauthorized-accounts-access

Hey security team. Good luck with the new ciso. In 4 weeks he will bring his own leadership. In 4 months he will cut the team in half all in the name of making things better. He will tell you that its a good thing because you can apply for a completely different job and do something new. If you are a part of that team, be prepared.

Oh, you did notice that he jumps jobs every two years, right? Hatchet man that knows some buzzwords. Actually do a good job? Don’t count on it.

If you look at the security filings for open text, the big picture since Ayman came on board is that open text has refinanced its debt in a way which is costing significant money so that nothing is hanging over them until 2031. That's the tell. Not that open text refinanced everything but that they paid to do it early. The only reason I can think OT would do that is to buy a window in which nothing can force their hand. Basically open text now has 5 years with zero finance events inside it. And why would that be important??

1. Before this refinance, open text had a 2027 wall from the microfocus payment requirement. That would have hung over any negotiation for divestiture. Buyers are going to see that as a pressure and negotiate accordingly. I'll bet debt is why the ADM deal that JM said fell through because open text wasn't going to agree to a fire sale is because that debt was a negotiating point for the buyer. They know open text had to make this huge payment in 2027 and tried to play that. Well that's gone now. Open text has 5 years to sell off business units, products, slim down the company , get what's left attractive for a merger. That's why Ayman's here.

2. Now OT also has a ratings insulation. It's no secret that open text is selling business units. And when those sell it shrinks revenue EBITDA, which presses the credit rating. A long flat maturity profile is the offset rating agencies are going to credit against. open text can shrink the company without the debt story becoming the story.

3. Remember at the beginning of the month when some employees were getting emails letting them know they were migrated to different entities? That came out exactly at the same time the credit documents were repapered with those new entities - same sec filing date. That has got to be for alignment, making the legal chart, the employment chart and the credit chart all the same. I'm going to guess it's to support carve outs so people, assets , and contracts of the same thing being sold are on the same entity. It all moves together in the sale.

4. There's also an amendment to the refi in the sec filings. The payment now runs to 2031 but the extension carries a springing maturity. If more than $500 million under the acquisition term loan (the Micro Focus loan) , is still outstanding within 91 days of that loan's own maturity, the repayment date accelerates to that earlier point. Think about that. Lenders gave Ayman his 5-year runway on the contractual condition that the acquisition term loan be substantially paid down first. There's no way open text is going to sign something like that unless the plan is tethered to selling off huge chunks of the company to pay down that MF loan. It's like someone who takes out a 15 year variable rate mortgage with a low 3 year rate that triples at 3 year day one because they have a plan to pay it off before that 3-year mark.

5. Everything points to open text cutting itself into little pieces, carving out first what they can get the best money for to pay down that huge microfocus loan, until what remains can be absorbed into another company. OT is trying to reshape the parts that aren't on the auction block. That's why some business units and more and more core products are off the investment list.

6. Not sure how great a plan it is because Wells Fargo's Canadian branch declined to fund on the refi. Still though, all of the refinancing gives a credit structure that supports a much smaller de leveraged company on the other side of it. Something slim and showing growth prime to merge or sell.

7. Then add in the stuff that seems like white noise but really isn't. All these extra surveys this year? That OHI survey employees were strong armed by leaders to take, is designed to assess and report on the health of an organization scored against McKinsey's own global database of other companies. All the "PIPELINE is tragic and numbers must increase through the FY focus"..? OT needs information that can be fed to buyers and merger interested companies that they can put the McKinsey label on. OT may not have name trust but McKinsey does.

8. Ayman said he will announce plans publicly including to employees in Feb. You don't offer that unless you already know you have something to announce.

For those of us who have not been there. What exactly is this other than office space and people? The video promos make it look very futuristic, cutting hedge CIA/MI5 type vibe, keen to understand what it looks and feels like and is it locked down, restricted access etc and as military grade as they are making out.

With all the shoplifters and severely mentally ill people coming in our stores you’d think they have better security!

UKG is handling really sensitive stuff like W2s, payroll info, and more for different countries, including the US. Fingers crossed that the White House puts rules in place so only people authorized by the US can actually access information belonging to US citizens.

That approach would put UKG in the crosshairs of some serious pushback.

Anyone know whats going on? Github Actions has been down all day, and its nothing but silence from the Github team. No response when we ask them to open a war room to track the remediation either.

Entire company was mandated to switch to these tools and now we cant even keep them online?

Current or prior Comcast employees. Is the URL "comcastbenefitsbc4.ehr.com" a legitimate URL? I'm getting mailers that I don't believe or real, and if they are, I'm concerned by identity has been stolen and idk where to go to address that first.

Will USAA drop TCS? They operate out of a GCC in India which was named a national security threat. If this happens, will they resort to freezing the layoffs of those recently affected in areas like fraud and aml no be able to make
Up for the work that would be illegal for TCS to do?

Remember these? Do you remember the Sun Microsystems' Sun Ray center? Even prior to Oracle taking Sun over? Talk about the opportunity of extending cloud computing into every home in the country. And, personally, I think Oracle blew it. As someone who was in that transition, they made us get rid of the Sun Rays and use Windows based laptops. Talk about a quantum leap backwards.

Key Advantages of Sun Ray

Stateless Architecture: The Sun Ray client contains no local operating system or persistent user data. If a device loses power or fails, user data remains safe on the server.

Zero Desktop Administration: Because no software runs locally, administrators do not need to patch, update, or configure individual desktop units. Firmware updates are pushed automatically from the server.

High Security: Processing occurs entirely on centralized servers (such as Sun/Oracle servers running Solaris or Linux). Users cannot corrupt or tamper with the local display endpoint, making it ideal for high-security or sensitive environments.

Hot-Desking Mobility: Users can unplug their smart card from one Sun Ray terminal, plug it into another anywhere on the network, and instantly resume their exact desktop session right where they left off.

Cost Efficiency: The hardware endpoints are simpler and cheaper than full traditional desktop workstations, and they do not need hardware upgrades when new applications roll out on the server side.

Quiet and Low Power: The physical desktop units operate silently, generate less heat, and consume minimal power compared to standard desktop PCs.

The misconception was it was Solaris only but it could support Windows or Linux clients as well.

I wonder what AI would say? Probably the same as most humans. Stupid! What Oracle knows about hardware would fit in a thimble and rattle.

Do you think I gave a hoot about some damn ethics or security risk training due? Lol let alone a progress checkpoint? Kick rocks!

Cisco on Wednesday released urgent patches for a critical-severity authentication bypass vulnerability in Identity Services Engine (ISE) that has been exploited in the wild as a zero-day.

https://www.securityweek.com/active-exploitation-triggers-emergency-patch-for-cisco-ise-zero-day/

I am in the department that houses everything security related and was told by a person who actually reports this stuff...
While badge swipes ARE still being tracked - tracked as in making sure you are there 5 days/week, you trolling mongorals - but VPN usage is ALSO being monitored.

This is to prevent coffee badging, basically. When you go to an office, you have to connect to the building's/whatever area you are in WiFi before you can connect to VPN. Therefore your computer is assigned an internal Dell IP address. As soon as you connect to that, it starts getting logged. As soon as you disconnect and go home, that gets logged.

The minimum time they want is 1 hour of connectivity as of now.

Source - work with the guy who literally sends these reports up the chain.

Traffic lights are not enough?

Recently re-orged to Security and GRC from Cerner. Should we expect layoffs? Last rounds security teams were hit but not as strong as other groups.

Cisco FMC Flaws Exploited to Steal Credentials and Deploy Qilin Ransomware

https://thehackernews.com/2026/09/cisco-fmc-flaws-exploited-to-steal.html

You would think after the genpact announcement there would be some more stability, but nope .. they have been quietly making more people in every country redundant. Mind you, these are people with 10-25 years worth of specialised knowledge with essential roles who are being let go… only to keep the people who still don’t know what they’re doing. Seriously what the actual f*ck are wrong with these people and decision makers ?!

Again, everyone is now on edge wondering whether they will get the tap on the shoulder next, especially with all the extra focus on introducing AI and the global standardisation project for OTC (sounds like we won’t have any customer service in the future, only AI bots). I feel bad for all the customer service teams I’ve worked with over the years in EMEA, they truly work hard for their customers and now they are being forced to hand over what they do day to day for their customers to a database.

BB needs to f*ck right off please. Hope this all back fires in his face.

Does anyone know if this is true ? https://threatbeat.com/attacks-and-incidents/iran-hackers-after-denial-of-texas-att-claim-id--ts-dont-even-know-what-we-tampered-with/

For years we were willing to be underpaid at ExxonMobil because of the pension and job security. No bonuses was the trade off. Now with the current state of affairs there is no reason not to leave and go work somewhere else.

No loyalty given no loyalty returned

On 10/30/2025 I was made aware that 2 withdrawals, on 10/17 and 10/21 essentially emptying my account. I immediately contacted customer service to inform them that my account had been hacked, username, password, phone and email information changed. I was told that my account was frozen and referred to the fraud department. The fraud department would be in contact with me in two weeks. On 11/19 I called again, stating that the user name and password continued to be fraudulent and I had not heard from anyone at MoA. Again my email, phone number was taken, I was told there continues to be a freeze on my account and the Fraud Department would be in touch in 2 weeks.

I contacted customer service again on 1/6/2026 stating that I have had no contact with anyone from MoA, my information appeared to still be incorrect and that I had no proof that anything further was being done to address my concerns. Again, apologies were given and I was reassured that someone would be in touch soon. I called 1/13/2026, stating that I have contacted the company numerous times with no results. On 1/15/2026 I called for the 5th time, stating that my information continued to be incorrect and that I needed to speak to someone who could offer more than apologies and the same sad script that I should be hearing from the Fraud Department shortly.

I was connected with the escalation department, who was finally able to correct my contact information. Again, I was reassured that someone from the Fraud Department would contact me within 2 days. On 1/23/2026 I contacted customer service, asking to be connected with someone who can help me. I was told that my account was still under review and there was nothing else that could be done.

This is unacceptable. This was a company run plan, for an annuity that is not due to 2030. That security was so flimsy that someone could change information without the account holder being informed via mail and then funds emptied a few days apart into 2 different bank accounts is nuts.
Claimed loss: 28,900.00

Any idea what happened? Some security incident apparently?

Look like whole network, server, infra and some security teams got fired this week across the globe in IT for Baxter.

Can only go downhill from here..

I recently heard that a former CIO visited our security facilities with his new company. Isn't this something of a privacy concern? I would have expected our security teams to be less than enthusiastic about a former CIO wandering the premises to recruit staff.

Does anyone have more detail on what occurred, or perhaps why it was allowed?

First Oracle is requiring everyone to use an Oracle provided laptop. This means no more BYOD computers of any kind. Furthermore Oracle is going to require everyone to signup with identity scanning AI company own by Palantir. Upload your passport and full face scan. The next big step will be required face scan checks every 15 minutes. This will be an automatic process that will require you to not cover your camera. You will not be notified of this. If your camera is covered you will be locked out. This is where Oracle security is going.

Anyone else’s laptop un usable by the shot security products used at intel??

If it was a WM, it would have been madness!!!

Please use this thread for anything we should consider:

1. write down login details for VSP site
2. update security questions in myPay
3. confirm personal email and address in Workday
4. write down your 6 digit employee ID (I’m an old employee that uses first initial last name so I never memorized this number)

Anything else I’ve missed??

https://www.theregister.com/security/2026/08/20/us-bank-investigates-lockbits-claims-as-ransomware-crims-set-pay-or-leak-deadline/5290560

Any locations out there where security has been removed?

Important change on how you access Webex

Keeping our data and systems secure means evolving how we work, including how we access tools like Webex. With this in mind, Webex will now follow Cisco's Trusted Device Standard and only be accessible from Cisco-trusted devices.

What to expect:
This change will roll out in phases, beginning August 31 and continuing through September. Once it takes effect, you'll be automatically signed out of Webex on all your devices. Simply sign back in on a Cisco-trusted device, such as your Cisco laptop. Going forward, you can only sign in to Webex using a Cisco-trusted device.
If you're using Android, you'll need to use the Webex app in your work profile.

Why this matters:
Adding Webex to our trusted device standard gives us an extra layer of protection for more sensitive data and helps pave the way for new Al capabilities to enhance your Webex experience.

tldr; you wont be able to use Webex on your personal phone without installing Cisco spyware that severely limits your phones usability for security reasons

Heard through co-workers that anyone that arrives on site and not able to find a desk in their zone will be required to work in the cafeteria. I don’t know about you, but I get my best work done with hundreds of people around me and a single laptop screen instead of dual monitors. Not to mention, I’m not sure the cafe workers have the clearance to be around that type of sensitive client information

Use AI and manage AI from inside the US. Outsourcing to 3rd world countries poses security risks.