Workday’s CEO Bets on AI Agents to Fuel Growth Without Adding Headcount

Aneel Bhusri returned to the chief executive role at Workday in February with a clear directive. The co-founder wanted the company to operate like a startup again. He established an AI task force, consolidated product teams, and slashed the number of agents in development from 50 down to about 20. Focus sharpened on those that matter. Results from the fiscal first quarter ended April 30 delivered early validation.

Revenue climbed 13.5 percent to $2.542 billion. Net income tripled to $222 million from $68 million a year earlier. The company raised its full-year non-GAAP operating margin guidance to 30.5 percent while holding subscription revenue outlook steady. Shares jumped in after-hours trading. Yet the most telling signal came not from the numbers alone but from Bhusri’s stated goal.

“I’d love to see us continue the growth that we had in Q1, but keep headcount as close to flat for the year as possible because we are getting the benefits of using our own products and other AI tools,” he said. The Register reported on the remarks Friday. Additional margin expansion would follow. The stance marks a shift from earlier workforce moves that included an 8.5 percent cut of 1,750 positions in 2025 followed by mixed signals on rehiring.

Workday now positions its AI offerings as direct substitutes for incremental staff. Sana, the superintelligence platform acquired for $1.1 billion, became generally available worldwide. New agents for IT service management and corporate travel joined the lineup. These tools pull real-time data from HR and finance systems. They handle IT ticketing, equipment provisioning, access requests, travel booking, and expense reconciliation. All while respecting existing identity, policy, and approval structures. No extra governance layers required.

The approach stands apart from competitors that bolt on copilots needing separate controls. Futurum Group noted on May 21 that 52 percent of buyers now list agentic AI as a top purchasing criterion. Workday’s integration creates end-to-end automation rooted in its own data foundation. Customers avoid the fragmentation that comes with third-party agents.

Recruiting provides the clearest illustration. Workday’s Recruiting Agent processed 14 million hiring processes in the quarter, a 44 percent increase from the prior year. Over 4,000 customers now run at least one organically developed agent, more than double the count from the previous period. New annual contract value tied to agentic AI products grew more than 200 percent. The company approaches $500 million in annualized revenue from these solutions. Contract Intelligence reviewed 1.1 million agreements, up 53 percent sequentially.

These figures point to measurable productivity gains inside customer organizations. Managers spend less time on routine coordination. Recruiters focus on higher-value judgment calls rather than administrative volume. The pattern echoes Workday’s own internal plan. Flat headcount. Sustained revenue growth. Wider margins. Bhusri described the moment as a re-founding. “It leverages what we built in the past, but we have to think like a startup again,” he told The Wall Street Journal in an article published May 21.

Yet the strategy carries an inherent tension. Workday built its business on human capital management. Its success once scaled with corporate hiring. Now the company demonstrates how organizations can expand output without proportional staff increases. Some observers question whether this example undercuts demand for its core HR software over time. Others see opportunity. Enterprises gain tools to manage complex global workforces without swelling payrolls.

Legal clouds hover over AI-driven screening. The ongoing Mobley v. Workday case alleges the company’s tools created disparate impact on candidates over 40 by factoring in employment gaps or medical leave. A federal judge allowed age discrimination claims to proceed. The court ordered disclosure of customers who activated certain AI features. Workday maintains its systems do not use protected characteristics and emphasize human oversight. Plaintiffs amended complaints in March. The litigation, covered by HR Dive, continues to draw attention from HR leaders weighing vendor accountability.

Despite those risks, momentum builds. Sana for IT Service Management automates tasks triggered by HR events such as new hires or role changes. The Travel Agent unifies planning and reconciliation. Both inherit Workday’s compliance framework. Peter Bailis, chief technology officer, has described the broader shift from process automation to outcome automation. Agents act as engines for the latter. A Workday report found 68 percent of organizations either pilot or deploy such agents in production. Eighty-eight percent expect productivity gains.

Bhusri reduced the agent portfolio to eliminate marginal efforts. Fifteen new agents are slated for release this year. The company no longer chases every possible feature in HR or finance. “The 150th feature in HR or finance is not going to move the needle for our business. The next agentic application will,” he signaled on the earnings call. Teams now operate with clearer ownership. Joel Hellermark, chief AI officer, speaks of polymathic groups where small cohorts achieve what once required hundreds.

Analysts at Constellation Research highlighted the quarter’s strength in a May 21 note. Subscription backlog reached $8.81 billion, up 15.5 percent. Total backlog hit $27.3 billion. CFO Zane Rowe stressed execution on the agentic roadmap alongside operational efficiencies. Headcount stood at roughly 20,800 at quarter end, described as flattish.

Customers appear willing to pay premiums for agents embedded in the system of record. Permissions, data lineage, and audit trails reduce deployment friction. Standalone agents face steeper hurdles in regulated environments. This advantage helps explain why Workday, once viewed as vulnerable to pure AI-native disruptors, posted results that reversed recent share weakness. The stock had fallen sharply year to date amid fears that large language models would commoditize enterprise software layers.

But data and context matter. HR and finance involve global rules, localized compliance, and intricate workflows. Bhusri noted that model companies show little appetite for entering that swamp. “If they do, I’d say, ‘Welcome to the swamp. It’s hard stuff.’” Trust built over years with Fortune 500 buyers provides insulation. Thousands already use Workday agents as teammates rather than replacements. The distinction matters. Agents augment. They absorb volume. Humans retain accountability for exceptions and strategy.

Still, the internal mandate to avoid headcount growth sends a message. Productivity tools have reached a threshold where one person plus agents can accomplish prior team output. Medidata, a customer, saved $1.46 million annually through automated finance and HR workflows. Similar stories multiply. The cumulative effect could reshape talent demand across industries. Recruiters who once processed hundreds of applications now oversee agents that qualify, schedule, and route candidates.

Workday itself experienced the cycle. It cut staff in 2025 citing efficiency priorities. Later statements walked back full rehiring. Bhusri’s return accelerated the pivot toward AI-centric operations. The company acquired Sana, Paradox for candidate experience, and other assets to fill gaps. Integration now yields compound returns. Conversational AI handles initial candidate qualification via text or chat. Scheduling agents sync calendars without recruiter intervention. The Recruiting Agent scales screening without proportional staff.

Questions remain about long-term equilibrium. If every enterprise adopts similar agents, what happens to overall labor markets? Workday’s earnings call avoided grand predictions. Executives pointed to usage metrics instead. Fourteen million hiring processes. Doubling customer adoption. Accelerating ACV. Those numbers suggest tangible substitution effects today. Flat headcount at the vendor level may foreshadow broader patterns.

Bhusri expressed optimism. Customers trust the platform for complexity that generic models cannot easily replicate. The re-founding focuses on agentic workflows that deliver measurable outcomes. Sana’s worldwide availability removes earlier geographic limits. New IT and travel agents extend the footprint beyond traditional HR and finance.

Industry watchers will track whether competitors match the depth of integration. ServiceNow, SAP, and Oracle face pressure to demonstrate native governance rather than add-on layers. Workday’s recent recognition as a leader in the 2026 Gartner Magic Quadrant for Talent Acquisition suites adds external credibility. The combination of recruiting scale, agent momentum, and margin improvement paints a picture of a company adapting faster than many expected.

Yet adaptation includes trade-offs. Emphasis on outcome automation implies some roles evolve or contract. Bhusri’s hope for flat headcount at Workday tests whether the math holds without quality loss. Early results support the thesis. Profitability rose sharply. AI-driven backlog growth outpaced the core business. If the pattern continues, other software providers may adopt parallel strategies. The era of hiring to grow gives way to agents that punch in. Outcomes, not headcount, define success.

And the market responded. Investors who had grown skeptical now see a path where AI bolsters rather than erodes Workday’s position. The coming quarters will reveal whether that confidence proves durable. For now, the numbers and the CEO’s words align. Growth without proportional staff. Automation that inherits policy rather than circumvents it. A bet that enterprises will pay for agents grounded in trusted systems. Workday aims to prove the model at scale. Its own operations serve as the first testbed.

from WebProNews https://ift.tt/PiIBqzM

Samsung’s One UI 8.5 Strips Video Filters From Camera App

Samsung just rolled out One UI 8.5 to millions of Galaxy devices. The update promises refined interfaces and fresh AI tools. Yet users discovered something missing the moment they opened the camera in video mode. Filters vanished.

The change caught many off guard. For years Galaxy phones let shooters apply color effects or artistic looks directly while recording at 1080p. That option sat prominently in the quick controls. Now the icon is gone. It stays absent across 1080p at 30 or 60 frames per second and in 4K. Photo mode still shows the full set of filters. The split feels arbitrary.

Android Authority tested the behavior on a Galaxy S26 Ultra running the One UI 9 beta. Filters simply do not appear in video. The site noted the removal spans both the stable One UI 8.5 and early beta builds of the next version. Such consistency points away from a simple glitch.

Complaints surfaced quickly on Reddit and TikTok. One user on a Galaxy S23 Ultra described hunting through every menu only to find the feature excised. Another posted a short video demonstrating the empty spot where the filter button once lived. The outcry echoes older frustrations. Samsung previously limited beauty effects on rear video cameras years ago. This time the entire filter palette took the hit.

Why drop the capability? Samsung has offered no public explanation. The company did not highlight the shift during the One UI 8.5 beta program. Nor has it responded to direct inquiries from journalists. That silence leaves owners to guess. Perhaps the move aligns with a broader redesign that favors post-capture editing. Or maybe engineering priorities shifted toward new AI video features that demand cleaner raw footage.

One UI 8.5 does bring genuine advances in video handling. Auto trim can identify highlights across multiple clips and assemble them automatically. Audio eraser isolates and removes background noise with surprising accuracy. Log recording support arrived for older flagships too. These additions target serious creators who plan to edit on desktop or in dedicated apps. They do not replace the quick creative spark a live filter once provided.

Some owners already found imperfect fixes. Record first without effects. Then open the Gallery editor and apply a look afterward. The process works but compresses the file. Quality takes a noticeable step down. A second workaround starts in photo mode. Choose a filter there. Then hold the shutter button to begin video recording. The effect carries over. The method feels clumsy. It breaks the natural flow many users expect from a flagship camera app.

The pattern of quiet feature cuts appears across recent One UI releases. Earlier versions removed face smoothing from the video editor on S23 and S22 models. Another update dropped a sharpen tool from the Gallery. Each time users voiced disappointment. Each time Samsung offered little comment. The company instead directs feedback through the Members app. Reports pile up. Occasionally a fix returns. More often the change stands.

This latest decision lands at an awkward moment. Samsung spent the past year promoting creative freedom. One UI 7 introduced custom AI filters generated from reference images. The Gallery gained undo and redo for every adjustment. Studio app received animation tools for text and stickers. Marketing emphasized expression. Removing a basic filter option during video capture undercuts that message.

Professional videographers may shrug. They shoot flat log footage anyway and grade later. Casual users who film family events or social clips feel the loss more acutely. A parent recording a child’s birthday wants warm tones in the moment. A traveler capturing street scenes wants instant drama. Post-production adds steps and requires more time. Not everyone carries the patience or skill.

Broader context matters. Samsung’s camera software now competes against Google’s computational photography and Apple’s Photographic Styles. Both rivals keep live creative controls accessible. Google offers real-time color grading in video. Apple lets users select tonal presets that apply across photo and video without switching modes. Samsung’s split approach looks like a step backward.

Yet the company shows no sign of reversing course quickly. One UI 8.5 continues its phased rollout. Millions more phones will lose the feature in coming weeks. Affected owners can submit reports through Samsung Members. Past experience suggests volume of complaints can influence outcomes. When enough voices highlight a pain point the software team sometimes listens.

Meanwhile the video editor in Gallery remains capable. It supports the same filter library that disappeared from live recording. Tones adjust with sliders. Effects stack. The tools simply arrive after the fact. For users willing to adapt the workflow stays viable. For those who prized immediacy the experience diminished.

And the silence from Samsung frustrates most. A short statement could clarify intent. Is this permanent? Will future betas restore the option with new refinements? Without answers speculation fills the gap. Some fear the change foreshadows further simplification that prioritizes AI automation over manual control.

Recent coverage adds weight to the frustration. PiunikaWeb cataloged user reports from multiple platforms and confirmed the interface no longer displays the filter icon even though surrounding controls stayed intact. Sammy Fans tested pre- and post-update devices side by side. The difference proved stark. Filters that appeared in One UI 8.0 simply evaporated in 8.5.

The episode reveals tensions inside Samsung’s product strategy. Hardware keeps improving. Sensors grow larger. Processing power expands. Software choices sometimes pull in the opposite direction. Features that once felt core become optional or absent. Owners who upgraded expecting continuity instead confront adaptation.

Whether the removal sticks remains unknown. Samsung has reversed course before when backlash grew loud enough. For now the camera app in video mode offers one less creative lever. The change is small on paper. Its effect on daily use feels larger. Users will keep filming. Many will keep wishing for the filter button that used to sit right there.

from WebProNews https://ift.tt/oICYcQ4

SEC Overhauls IPO Rules to Ease Post-Listing Fundraising and Reporting Burdens

The Securities and Exchange Commission proposed sweeping changes Tuesday that would let companies raise capital far more easily after their initial public offerings. The moves mark the most significant rewrite of public offering and reporting rules in more than two decades. They come as Chair Paul Atkins pushes an agenda to “Make IPOs Great Again.”

Two separate proposals target different pain points. One simplifies who qualifies as what kind of filer. The other expands access to shelf registrations and related flexibilities. Taken together, they would extend scaled disclosure benefits to roughly 81% of current public companies. New public firms would keep those accommodations for at least five years regardless of size.

Current rules force many freshly listed companies to wait 12 months before they can use a shelf registration to sell shares quickly. They also cap smaller floats in certain ways. The SEC wants to scrap much of that. Companies could file a shelf right after their IPO. They could sell from it over three years without separate registrations for each raise. The $75 million public float requirement for unlimited primary offerings would vanish.

Broader Access, Fewer Hurdles

The changes don’t stop at timing. The threshold that triggers large accelerated filer status would jump from $700 million to $2 billion in public float. Companies would need to exceed that mark for two consecutive years before facing the strictest audit and reporting demands. Even then, all new issuers get a 60-month grace period before large accelerated status kicks in. This IPO on-ramp builds on accommodations first created for emerging growth companies under the JOBS Act.

Smaller public companies would gain extra breathing room too. Those with less than $35 million in assets could file their annual report 30 days later and quarterly reports five days later than peers. Non-accelerated filers would generally escape the auditor attestation requirement on internal controls over financial reporting. Scaled disclosures on executive compensation and fewer years of financial statements would become standard for a much larger group.

But why now? Atkins pointed to a simple reality in his statement. Investors already enjoy easy access to every public company’s SEC filings online. The old distinctions, born in a paper-based era, no longer match today’s information environment. “The approach under the proposed amendments recognizes that investors can now easily access SEC filings for all public companies,” he wrote.

Industry groups cheered the announcement. The American Securities Association called it a step toward keeping more companies public longer. Yet critics pushed back. Better Markets warned the SEC was “needlessly increasing the risk of corporate misconduct.” Ben Schiffrin of the group told Reuters that public offerings have declined precisely because firms can raise unlimited capital in private markets without the scrutiny.

The SEC insists investor protections remain intact. Ineligible issuer concepts would still bar bad actors from using the new shortcuts. Foreign private issuers, blank-check companies and penny stocks would largely stay excluded from the broadest new benefits. State blue sky registration requirements would be preempted for all registered offerings, removing another layer of friction.

Market reaction on X reflected the split. Some posts hailed lower barriers for mid-sized and volatile firms, especially in sectors like crypto. Others questioned whether faster capital raises would simply lead to more dilution for existing shareholders. One analyst noted the proposals could prove particularly useful for companies burning cash on infrastructure yet sitting on strong user growth.

These ideas didn’t appear in a vacuum. They follow months of talks between the SEC, Nasdaq and NYSE about easing rules that push promising firms to stay private. A Reuters report from last year first detailed those conversations. The current package goes further than many expected. It doesn’t just tweak. It rewrites categories, merges benefits once reserved for the smallest players, and extends well-known seasoned issuer-style advantages to a wider tier of listed companies.

Details still matter. The proposals remain open for 60 days of public comment. Final rules could shift. Yet the direction is unmistakable. The SEC under Atkins seeks to make public markets competitive again with private ones. Fewer reporting burdens. Faster capital. Simpler categories. All aimed at companies that have already taken the plunge but still face heavy compliance costs in their early public years.

One proposal would let broker-dealers publish research on more issuers without current restrictions. Another modernizes how companies incorporate information by reference into Form S-1. Advertising rules for certain insurance products would loosen too. The cumulative effect could reshape how mid-cap and newly public firms think about their capital strategies.

Numbers tell part of the story. Today only about one in five public companies would still qualify as large accelerated filers under the new $2 billion threshold. Those firms, however, represent roughly 90% of total market capitalization. The bulk of listed companies would operate with lighter loads. For smaller names, that could mean meaningful savings on audit fees, legal work and management time.

Atkins framed the package as foundational. Future steps may include broader Reg S-K revisions. For now, the focus stays on post-IPO life. Companies fresh off a listing often need capital to scale operations, fund acquisitions or simply provide liquidity. Waiting a full year under current rules can mean missed opportunities when markets turn favorable. The proposed shelf changes aim to close that gap.

Whether this revives the IPO market remains an open question. Private capital still flows freely for many high-growth names. Yet for firms squeezed between venture expectations and public demands, these adjustments could tip the balance. They won’t eliminate all regulatory costs. They do reduce some of the most immediate ones.

The Yahoo Finance article first brought the proposals to wider attention on May 19. Its coverage highlighted the “make IPOs great again” framing and the direct benefits for companies with smaller floats. Subsequent reporting from CoinDesk noted particular advantages for crypto and other volatile businesses that might otherwise avoid public markets.

Implementation won’t happen overnight. Comments will pour in from issuers, investors, law firms and advocacy groups. The SEC will sift through them. Yet the proposals already signal a philosophical shift. Disclosure obligations should match company maturity and information availability, not rigid timelines set decades ago.

That shift carries risks. Less frequent or detailed reporting could leave gaps. Scaled back internal control audits might miss weaknesses. The agency argues modern data access and market discipline provide sufficient checks. Time and final rules will test that claim.

For capital markets professionals, the message is clear. A new set of tools may soon become available for newly public companies. Shelf eligibility from day one. Delayed large accelerated status. Broader scaled disclosures. These aren’t minor tweaks. They reshape the cost-benefit equation of going and staying public. And in a market where private funding remains abundant, that equation matters more than ever.

from WebProNews https://ift.tt/TEMVdHP

Colossal Biosciences Hatches Chicks From Artificial Eggs. Scientists Aren’t Impressed

Colossal Biosciences just announced a milestone. The Dallas biotech firm hatched 26 live chickens from a 3D-printed lattice that mimics an eggshell. No hen. No natural shell for most of development. The chicks now range from days to months old. They look ordinary. Yet this step feeds directly into the company’s larger ambition: bringing back extinct giants like the South Island moa.

Ben Lamm, Colossal’s CEO, framed the work as practical engineering. “We wanted to build something that nature has done a pretty good job of developing and make it better and scalable and even more efficient,” he said, according to Fortune. The firm had already produced mice with mammoth-like hair and wolf pups modeled on dire wolves. Now it turns to birds. The moa, a flightless New Zealand species that stood over 3 meters tall, laid eggs roughly 80 times the volume of a chicken’s. No living bird could incubate one. An artificial system might.

The Technical Claim

Colossal’s platform uses a printed lattice structure with a silicone membrane. Scientists transferred contents from fertilized chicken eggs into these constructs, added calcium, and incubated them. Real-time imaging tracked embryo growth. The system supplies oxygen without supplemental gas in later stages. Twenty-six chicks emerged healthy. The company calls it the first full end-to-end success from a fully artificial construct, per its press release.

But independent researchers push back. Vincent Lynch, an evolutionary biologist at the University at Buffalo, examined the details. “They might be able to use this technology to help them make a genetically modified bird, but that’s just a genetically modified bird. It’s not a moa,” he told the Associated Press. He added a sharper distinction: “That’s not an artificial egg because you’ve poured in all the other parts that make it an egg. It’s an artificial eggshell.”

Lynch’s critique lands on substance. Natural eggs contain temporary organs that nourish the embryo, manage waste and stabilize development. Colossal’s version supplies the shell and gas exchange but relies on the original egg’s internal material. Earlier experiments decades ago used plastic films or sacks to create transparent shells for developmental studies. Nicola Hemmings, who researches bird reproductive biology at the University of Sheffield, noted the precedent. “Producing a chick from an artificial vessel is not necessarily new,” she said.

Yet Colossal insists the advance matters. The lattice scales. It avoids the physical limits of surrogate birds. For the dodo or moa, whose genomes the company has sequenced and compared to living relatives, this platform could one day support edited primordial germ cells grown in chicken hosts before transfer. Recent coverage in Nature captured the caution from the field. Researchers there urged restraint even as they acknowledged potential conservation uses for endangered species.

Bioethicist Arthur Caplan at New York University’s Grossman School of Medicine raised a different question. “The big challenge is, what environment is this animal going to live in?” The moa vanished centuries ago. New Zealand’s forests have changed. Predators, plants and climate differ. Releasing approximations of extinct megafauna carries ecological risk no lab test can fully predict.

Hemmings offered a blunter priority. “My personal interests lie more in preserving what we’ve got than trying to bring back what is already gone.” Her stance echoes a divide in conservation biology. Some see de-extinction as distraction. Others view the underlying tools—gene editing, synthetic gestation, high-fidelity genomes—as applicable to species still hanging on. Ben Novak at Revive & Restore, a nonprofit focused on passenger pigeon revival, told Nature the artificial egg could find immediate takers in zoos and breeding programs.

Colossal has moved fast. It raised hundreds of millions in venture capital. Its dire wolf pups, announced in 2025, drew both wonder and accusations of overstatement; critics noted the animals were genetically edited gray wolves, not true clones of the extinct Pleistocene predator. The chick announcement follows the same pattern. Public excitement spikes. Scientific skepticism follows.

And the skepticism has merit. Full de-extinction demands more than a bigger printed shell. It requires accurate reconstruction of ancient DNA, functional expression of extinct traits, viable germline transmission and, eventually, self-sustaining populations. Each layer compounds technical difficulty and ethical weight. So far Colossal has demonstrated edited mammals and now scalable avian incubation. Impressive. Not resurrection.

Still, the engineering deserves credit. Real-time imaging inside an artificial construct offers data hard to gather in opaque natural eggs. Scalability could lower costs for conservation breeding of rare cranes or parrots whose eggs suffer high mortality. If the platform works at moa scale without supplemental oxygen, as claimed, it removes one physical barrier that once seemed absolute.

Recent reporting adds texture. Gizmodo described the shell as titanium and bioengineered silicone in some components. Dallas Innovates highlighted the company’s local roots and the shell-less incubation platform’s potential for giant bird revival. NPR explored the dodo and moa targets directly, noting Colossal already prepares larger artificial eggs for those species.

Public reaction on X mixed awe with Jurassic Park jokes. One post asked whether society stands “on the verge of real Jurassic Park-style de-extinction.” Another summarized the 26 chicks as proof of concept but reminded followers that true moa revival remains distant. The conversation reveals the tension. Audiences love the spectacle. Experts fixate on the gaps.

Colossal’s leadership shows no signs of slowing. Lamm has said the firm did not want to wait until moa-ready before tackling birth engineering. That choice makes sense from a product development view. Solve the small problems first. Iterate. Scale. Yet it invites criticism that announcements outpace substantive leaps toward genuine revival.

The chicks themselves offer the clearest data point. They hatched. They live. The system functions. Whether that system can ever produce a functional proxy for a 3-meter flightless bird with an entirely different developmental timeline is another matter. Scientists will watch the next iterations closely. So will investors. And so will anyone who remembers the original warning from a 1993 film: life finds a way. The question now is whether humanity should help it do so.

One fact remains undisputed. The technology Colossal demonstrated this week did not exist in public view a year ago. Its refinement will shape debates over conservation priorities, synthetic biology limits and the very definition of extinction for years ahead. Short of creating a moa, the firm has already altered the conversation.

from WebProNews https://ift.tt/NQYAyCE

CISA Contractor’s GitHub Blunder Exposes AWS GovCloud Keys and Internal Blueprints

A contractor working for the Cybersecurity and Infrastructure Security Agency left highly privileged credentials to AWS GovCloud accounts sitting in plain sight on a public GitHub repository. The exposure went on for months. Security researchers who found it called the incident one of the worst government leaks they had seen.

The repository, named Private-CISA, contained far more than stray keys. It held plaintext passwords for dozens of internal CISA systems. Files detailed exactly how the agency builds, tests and deploys its software. Logs, tokens and other sensitive assets sat alongside them. And the administrative credentials to three AWS GovCloud servers? They stayed valid for two full days after researchers alerted authorities.

Guillaume Valadon, a researcher at GitGuardian, spotted the material on May 15. He reached out to the repository owner. No response came. So he contacted KrebsOnSecurity. The account and its contents vanished from public view soon after. KrebsOnSecurity reported the full details the following Monday.

The contractor worked for Nightwing, a government contractor based in Dulles, Virginia. He used an email address tied to CISA as well as a personal one. The GitHub account itself dated back to September 2018. The problematic repository launched on November 13, 2025. Commits arrived regularly from that point forward. This was no one-off upload. It served as a working scratchpad. A way to move files between a work laptop and a home computer.

That habit produced staggering oversights. The repository disabled GitHub’s built-in feature meant to block secrets from public repos. Passwords appeared in a CSV file with names as obvious as each platform followed by the current year. Backups lived directly in the Git history. Valadon could hardly believe what he saw. “Passwords stored in plain text in a csv, backups in git, explicit commands to disable GitHub secrets detection feature… I honestly believed that it was all fake before analyzing the content deeper. This is indeed the worst leak that I’ve witnessed in my career.”

Philippe Caturegli, founder of Seralys, examined the material at the request of KrebsOnSecurity. He confirmed the AWS keys worked. They granted administrative access to three separate GovCloud accounts. Those environments exist specifically to hold sensitive government data under strict controls. “That would be a prime place to move laterally,” Caturegli said. He pictured an attacker slipping a backdoor into software packages. Every new build would spread the compromise across CISA systems.

Caturegli also pieced together the contractor’s likely routine. Regular commits stretching back to late 2025 suggested routine synchronization between devices. “This would be an embarrassing leak for any company, but it’s even more so in this case because it’s CISA.”

The agency itself operates under strain. It has lost nearly a third of its workforce since the start of the second Trump administration. Early retirements, buyouts and resignations have left it running with reduced staff and budget. A CISA spokesperson acknowledged the exposure. “Currently, there is no indication that any sensitive data was compromised as a result of this incident,” the statement read. “While we hold our team members to the highest standards of integrity and operational awareness, we are working to ensure additional safeguards are implemented to prevent future occurrences.” The agency directed further questions about the contractor to Nightwing. The company declined to comment and pointed back to CISA.

News of the breach spread quickly on X. Multiple accounts shared the KrebsOnSecurity story within hours of publication. Some posts highlighted the continued validity of the keys. Others noted the plaintext passwords and the artifactory credentials that could have let an intruder poison CISA’s internal code repository.

This event arrives against a backdrop of repeated cloud credential exposures. Researchers have documented thousands of similar mistakes across private industry and government alike. Yet the CISA case stands out. The agency exists to guide others on proper security practices. Its own contractor handed adversaries a roadmap to sensitive federal systems.

The files went beyond credentials. They mapped internal processes in detail. An attacker could study deployment pipelines. Identify weak points in the build chain. Craft attacks that blend into normal CISA operations. Lateral movement becomes simpler when you understand the target’s own logic.

AWS GovCloud adds another dimension. The platform enforces stricter compliance than standard AWS regions. Federal customers rely on its isolation. Administrative keys there open doors that should stay bolted. The fact those keys survived 48 hours after notification raises fresh questions about detection and response speed.

GitGuardian’s discovery method relied on routine scanning of public repositories for secrets. Many organizations now run similar tools. The fact that a CISA-linked repo escaped notice for months shows gaps remain. Contractors, personal devices and synchronization habits create persistent risks.

Security teams have long warned about these patterns. Plaintext storage. Disabled guardrails. Reuse of repositories for convenience. Each element appears in countless breach reports. Their convergence inside a federal cybersecurity agency carries extra sting.

CISA says it is adding safeguards. Rotation of the exposed credentials happened. Investigations continue. Yet the episode underscores a truth many inside government already know. Human error still defeats the most sophisticated technical controls. Especially when budgets shrink and experienced staff depart.

Industry observers will watch closely for follow-up disclosures. Any evidence of actual exploitation could shift this story from embarrassing lapse to active compromise. For now, the public record stops at the exposed repository and the swift takedown once outsiders rang the alarm.

Even without confirmed breach of sensitive information, the damage sits in lost trust. Federal partners and private sector organizations look to CISA for leadership. A contractor’s personal GitHub habits just delivered a visible reminder that vigilance must extend to every endpoint. Every sync. Every commit.

from WebProNews https://ift.tt/k0aGXiN

Mac Infostealers Turn to AppleScript and Trusted Brands as Attacks Grow Sharper

Security researchers have uncovered a new macOS infostealer that slips past defenses by pretending to be routine Apple security software. Called SHub Reaper, the malware represents the latest evolution in a two-year campaign built around the SHub Stealer family. It no longer relies on crude fake installers or obvious Terminal tricks. Instead it weaves itself into familiar system processes. And it does so with striking precision.

The discovery comes at a moment when macOS threats have accelerated. Reports from the past several months show infostealers expanding from Windows roots into Apple systems. Microsoft detailed how such campaigns now use social engineering and native tool abuse across platforms. Microsoft’s analysis from early May traces similar ClickFix-style tactics that Reaper builds upon. The pattern is clear. Attackers study Apple’s latest protections and adjust quickly.

Reaper starts its work on malicious websites that quietly profile visitors. These pages gather system details, WebGL fingerprints, VPN usage signs, browser extensions and hints of virtual machines or analysis environments. They scan for installed password managers such as 1Password, Bitwarden and LastPass. Crypto wallet extensions like MetaMask and Phantom draw special interest. Anti-analysis tricks follow. The sites interfere with developer tools, capture F12 keystrokes and trigger endless debugger loops. Some even switch to a Russian “Access Denied” page once they smell trouble.

Once a target engages, the delivery shifts to the applescript:// URL scheme. This opens Apple’s Script Editor and prompts the user to click Run. Here the deception sharpens. A fake XProtectRemediator security update window appears. Behind it the malicious AppleScript executes. Attackers pad the script with fake installer text and ASCII art. The dangerous commands stay hidden below the visible edge of the window. Victims see what looks like a normal Apple process. They rarely suspect anything.

But the theft runs deep. Reaper targets browsers including Chrome, Firefox, Brave, Edge, Opera, Vivaldi, Arc and Orion. It grabs data from crypto wallets such as Exodus, Atomic Wallet, Ledger Live, Electrum and Trezor Suite. macOS Keychain entries, Telegram sessions, browser extensions and developer files all fall into its net. An AMOS-style document stealer adds another layer. It combs Desktop and Documents folders for Word files, spreadsheets, JSON data, wallet backups and remote desktop configurations. Files larger than certain thresholds are skipped. PNG images over 6 MB stay behind. The total haul caps at 150 MB before compression and chunked upload to command-and-control servers.

Wallet applications face direct sabotage. The malware kills active wallet processes, swaps their internal app.asar resources with attacker-controlled versions, removes quarantine attributes and applies ad hoc code signing. The modified apps keep running. Funds can vanish later. After data collection the victim sees a fake compatibility error. Suspicion fades. The password prompt that appeared earlier has already delivered admin credentials.

Persistence marks Reaper’s biggest advance over prior SHub variants. The malware drops a LaunchAgent disguised inside a fake GoogleUpdate.app bundle. It registers as com.google.keystone.agent.plist. This mimics Google’s legitimate Keystone update service and runs every 60 seconds. From there remote servers feed new commands, execute additional payloads under the current user and clean up temporary files. What began as a one-time theft now becomes a lasting foothold. Future modules or remote access become possible.

SentinelOne first detailed these tactics in its report on the campaign. The firm noted how Reaper expands on earlier SHub methods that used fake installers and ClickFix social engineering. Those older attacks pushed victims to paste commands into Terminal. Apple responded in macOS Tahoe 26.4 with new warnings for suspicious paste operations. Reaper sidesteps that by routing through Script Editor. Different stages rotate disguises. Early lures mimic WeChat or Miro installers from typo-squatted domains that resemble Microsoft infrastructure. Later stages pose as Apple updates. Persistence hides in Google-branded directories. The malware borrows trust from three major technology brands in one chain.

This approach exploits how users and security tools perceive normal activity. AppleScript and shell scripts blend into everyday macOS behavior. Traditional file-based scanning like XProtect struggles to flag them. Monitoring for unusual osascript processes, unexpected LaunchAgents or Script Editor network traffic offers better signals. Yet many organizations and home users lack such visibility. The result is a stealthier threat that scales.

Broader industry data supports the trend. Jamf’s Security 360 report for 2026 shows Trojan detections on Macs jumping sharply. Infostealers now dominate many threat lists. Related families such as Atomic Stealer, also known as AMOS, DigitStealer and MacSync continue to evolve. A 9to5Mac report from April described additional undetected macOS samples that evade major antivirus engines. The shift toward Go, Rust and modular designs makes cross-platform operation easier. Attackers no longer treat macOS as an afterthought.

Microsoft has warned repeatedly about this expansion. Its February analysis highlighted campaigns delivering DigitStealer, MacSync and AMOS through malvertising, fake DMGs and ClickFix prompts. The firm urged monitoring for suspicious Terminal flows involving curl, Base64 decoding, osascript or JavaScript for Automation. Reaper fits neatly into that pattern while adding its own refinements. The malware’s use of fingerprinting and anti-analysis shows growing operational maturity.

Apple itself has tightened controls. Gatekeeper, notarization requirements and the Tahoe 26.4 Terminal warnings all aim to raise the bar. Yet social engineering remains the weak point. Users still click Run in Script Editor when prompted by what looks like an urgent security update. They enter passwords when asked. Fake error messages reassure them. The human element gives these campaigns their reach.

Experts advise sticking to official download sources. Avoid unsolicited links, ad-driven installer pages and claims that a manual security fix requires opening Script Editor. Check URLs carefully. Watch for unexpected password prompts paired with vague errors. Advanced users can review LaunchAgents in their Library folders and monitor for suspicious AppleScript activity. Simple habits still matter most.

Reaper does not rewrite the rules of macOS security. It exploits existing gaps with care and patience. Its success signals that threat actors now invest time studying Apple’s updates and user workflows. They test anti-analysis measures. They refine persistence. They rotate brands to stay under the radar. The days when macOS malware meant obvious Trojans appear to be fading. A more calculated, script-driven style is taking hold.

Security teams and individual users face a choice. They can treat every unexpected update prompt as suspect. Or they can hope their defenses catch what file scanners miss. The evidence from recent months suggests the first option carries less risk. Because once Reaper or its successors gain persistence, the data they seek is already on its way out the door.

from WebProNews https://ift.tt/cRiMCn3

Post-SaaS Reckoning: How AI Shockwaves Reshape Software Valuations and Debt Markets

Software stocks cratered early this year. More than one trillion dollars in market value disappeared in a matter of weeks. Traders coined a blunt phrase for the bloodbath. They called it the SaaS apocalypse.

Yet the dust has begun to settle. Secondary loan prices have climbed back. Repricing activity for certain borrowers has resumed. And industry voices now describe a more measured transition. The market, according to a recent Yahoo Finance report, has entered a post-SaaS-pocalypse thaw. Not every credit benefits. But the selective recovery reveals how investors now separate durable platforms from vulnerable point solutions.

The trouble started in February. Advances in AI tools, particularly from Anthropic, triggered a sharp sell-off. Free plug-ins promised to automate business processes that once required dedicated software licenses. Enterprise buyers paused. Public valuations plunged. Hundreds of billions vanished almost overnight. The North American Tech Software Index dropped roughly 30 percent from its mid-September peak, PwC analysts noted in late February.

Private markets felt the aftershocks too. Private equity vintages from 2021 and 2022 faced markdowns. Limited partners demanded clearer proof of lasting value. Some pulled capital from private credit funds worried about software exposure. The term SaaS apocalypse spread from trading floors to boardrooms.

But the narrative was always too simple. AI agents excel at processing information. They still need reliable access to decades of mission-critical data. “The reality is more nuanced than either extreme,” wrote Jon Markham in Forbes. “AI agents are only as useful as the data they can access and work with. Think of it this way: an AI assistant is brilliant at processing information, but it still needs a filing cabinet.”

Those filing cabinets sit inside established enterprise systems. Moving that data proves expensive, slow, and risky. Companies therefore prefer to bring AI capabilities to where the data already lives. The result? Incumbents with deep workflow integration and proprietary context gain rather than lose.

Steve Banker explored this dynamic further in the same Forbes piece. He initially saw workflow applications at risk. AI-assisted development lets teams prototype in hours instead of months. The buy-versus-build equation appeared to tilt. Yet hidden costs quickly surface. Architecture, reliability, integration, compliance, and long-term maintenance consume the bulk of effort. “Where most internal builds fail is not in version one, it’s everything that comes after,” Chuck Fuerst told Banker.

Maintenance demands ongoing work on evolving APIs, regulatory shifts, data privacy rules, and edge cases. Software vendors maintain dedicated teams for exactly these tasks. Enterprises hesitate to bet their core operations on homemade tools that may break at scale. They extend existing platforms instead.

This nuance explains why the panic has cooled. ServiceNow executives declared the worst behind them. The company identified a $30 billion opportunity in AI-driven workflows. Josh Bersin highlighted the claim in early May analysis. Sentiment improved. Loan markets reflected the shift.

By mid-May, the leveraged loan index weighted average bid recovered to 95.40. That matched mid-February levels and erased a 123-basis-point drop from the early March low. Repricing volume jumped. Seven speculative-grade borrowers filed spread-lowering amendments on May 11 alone. The month-to-date total reached $17.2 billion. It surpassed the combined activity from February, March, and April.

Yet the thaw remains uneven. Double-B rated borrowers dominate. Their share of loans priced at par or above climbed back to 76 percent for double-B-minus credits by May 11. That matches January peaks. B-plus and B-flat names also gained ground. Single-B credits and those with heavy tech or AI-disruption exposure lag. Sponsor-backed single-B borrowers stay largely on the sidelines.

Investors now draw sharper lines. They reward companies with sticky data moats, regulatory entrenchment, and workflow gravity. They penalize seat-based tools that AI agents can replicate. PwC consultants advise private equity teams to focus diligence on defensibility beyond code. Domain depth, proprietary context, and mission-critical ties to financial or regulatory outcomes matter most.

Pricing models face pressure too. Traditional per-seat arrangements lose appeal when one AI agent performs the work of three analysts. Forward-looking firms experiment with outcome-based or value-based fees. Gross revenue retention gains favor over net figures as a truer test of durability.

Private equity dealmakers have grown more selective. Software still represents an attractive asset class. AI simply accelerates the gap between winners and laggards. Vertical solutions in healthcare, financial services, and cybersecurity often hold up better. Complex integration requirements and compliance burdens create natural barriers.

Free cash flow at the strongest SaaS businesses sits at record levels. EBITDA margins have rebounded since 2022. These fundamentals support selective buying. But 2021-era multiples no longer apply. Residual value in 2036 depends on how well companies embed AI into their core platforms rather than bolt it on.

The market has moved past the initial shock. Panic selling gave way to disciplined analysis. Companies that own the data layer and the workflow layer stand to benefit as AI agents proliferate. Those offering narrow, easily automated features face continued pressure.

And the repricing window? It favors the prepared. Higher-rated credits with limited disruption risk now access cheaper debt. Others wait. The post-apocalypse environment rewards clarity of strategy over hype. Software hasn’t died. Its economics have simply grown more demanding.

Buyers and lenders alike now ask tougher questions. Does this system embed itself so deeply that replacement costs dwarf any AI alternative? Can the vendor demonstrate measurable outcome improvements rather than feature lists? Answers separate survivors from casualties.

from WebProNews https://ift.tt/B23FCUV