Tag: Running

Exploring the Metabase Flaw

A significant vulnerability in the Metabase business intelligence (BI) tool was taken advantage of by unidentified attackers to breach the online mathematics learning service Mathspace. Despite Metabase issuing a security alert on August 7, prompting users to immediately upgrade their self-hosted versions, Mathspace’s founder and chief technology officer (CTO) Alvin Savoy stated that this action was not carried out.

Postponed Action and Its Ramifications

“Our vulnerability notification process failed to identify and escalate that alert for action,” Savoy mentioned. “We managed to update our instance on August 29 after a later Metabase communication drew our attention.” That lag in deploying patches was sufficient for hackers to access Mathspace’s Metabase instance and extract data. Savoy reported that a variety of data was taken, relating to students, staff, as well as parents and guardians. This encompasses user IDs, usernames, first and last names, email addresses, and other login-related details.

Simple to Exploit Critical SQLi Vulnerability

The Metabase vulnerability carries a peak severity rating of 10.0 out of a potential 10, and it is simple to exploit. It enables structured query language (SQL) command injection via the /api/session/reset_password endpoint, granting a remote attacker administrator-level access to the Metabase instance without any credential input. Various Metabase versions ranging from x.58.0 to x.63.0 are affected by this vulnerability.

Global Repercussions of the Vulnerability

Laptop manufacturer Framework, Python data science platform Anaconda, and form creation tool Tally have all acknowledged unauthorized data access stemming from the vulnerability, affecting the cloud-hosted Metabase instances of these three companies. Real-time threat and risk intelligence provider Dataminr reported that in the first week of August, slightly over 4300 publicly accessible hosts were running vulnerable versions of Metabase. It noted that many of these organizations belonged to the government, healthcare, energy, finance, telecom, aviation, and public sectors.

Mathspace’s Actions and Future Safeguards

Savoy stated that Mathspace has alerted affected schools and individuals, as well as authorities like the Office of the Australian Information Commissioner, the Australian Signals Directorate’s Australian Cyber Security Centre, and their counterparts in New Zealand. Founded in Sydney in 2010 by Savoy, Mohamad Jebara, and Chris Velis, Mathspace is used by educational institutions in Australia, New Zealand, the United States, Canada, the United Kingdom, Hong Kong, and India. However, this particular data breach solely impacted users from Australia and New Zealand. Savoy cautioned Mathspace users to be vigilant against messages impersonating the platform, schools, and other familiar organizations, utilizing the stolen data.

Conclusion

The infiltration of Mathspace due to a critical Metabase vulnerability highlights the necessity of prompt security updates and effective vulnerability management. This incident underscores the substantial risks related to delayed patching and the extensive consequences such vulnerabilities may have across various sectors.

Q: What led to the breach at Mathspace?

A: The breach was instigated by a serious Metabase vulnerability that Mathspace did not address in a timely fashion.

Q: What information was compromised in the breach?

A: The compromised information consists of user IDs, usernames, first and last names, email addresses, and other login-related details pertaining to students, staff, parents, and guardians.

Q: Who were the users affected by the breach?

A: The breach affected only users located in Australia and New Zealand.

Q: What actions has Mathspace taken in response to the breach?

A: Mathspace has informed the affected individuals and relevant authorities. They have also advised users to be watchful of messages that impersonate the platform or associated organizations.

Q: What is the severity rating of the Metabase vulnerability?

A: The Metabase vulnerability has a highest severity rating of 10.0 out of 10, signifying it is extremely critical and easy to exploit.

Q: How widespread is the impact of the Metabase vulnerability?

A: The vulnerability has affected a multitude of organizations globally, encompassing those in government, healthcare, energy, finance, telecommunications, aviation, and public sectors.

Vulnerable Exchange Servers: An Increasing Issue

Unpatched and old Microsoft Exchange servers susceptible to a serious authentication bypass flaw are prevalent in Australian and New Zealand networks, endangering organizations’ mailboxes with potential total compromise. Compounding the issue, active exploit code is now available to the public for this vulnerability.

Scope of the Vulnerability

The ShadowsServer Foundation, a nonprofit focused on security monitoring, reported that as of August 31, there are 382 Exchange servers in Australia and 56 in New Zealand left vulnerable to CVE-2026-62911, three weeks after Microsoft provided a fix. The versions affected comprise older Exchange Server 2016, 2019, and Subscription Edition, which complicates the patching situation.

Extended Security Updates

Exchange 2016 and 2019 only receive security updates through Microsoft’s Extended Security Updates (ESU) program now. This indicates that organizations operating those versions are incurring costs for ongoing support on infrastructure they have yet to update or transition to cloud-hosted Exchange.

Exploitation Threats and Alerts

The National Cyber Security Centre of the Netherlands (NCSC-NL) announced on August 28 that exploit code proof-of-concept had surfaced online. NCSC-NL upgraded its alert and cautioned that an unauthenticated attacker might execute arbitrary code.

Microsoft’s Position

Microsoft has yet to validate active exploitation occurring in real-world settings, and the vulnerability does not currently show up in the United States Cybersecurity and Infrastructure Agency’s Known Exploited Vulnerabilities (CISA-KEV) database. The flaw is rated with a CVSS 3.1 score of 8 out of 10, permitting an attacker to capture authentication traffic and replay it to obtain elevated privileges on an Exchange server.

Recommendations from Authorities

The flaw was identified by Orange Tsai from the DEVCORE Research Team during the Pwn2Own Berlin 2026 competition. When queried regarding the vulnerability by TechBest, the Australian Signals Directorate (ASD) urged organizations still using legacy Exchange to respond promptly.

ASD’s Suggestions

“Outdated technology lacking critical security updates and patches is an appealing target for cybercriminals and is more susceptible to attacks,” stated an ASD representative. The directorate further recommended that if legacy systems cannot be updated, organizations should segment their networks to safeguard their most vital systems, according to ASD.

Worldwide Context

ASD continues to provide ongoing guidance on Exchange Server security hardening and end-of-support strategies. On a global scale, as of August 31, 2026, ShadowServer reported 21,899 vulnerable Exchange servers, indicating that slow patching and upgrading is not solely an issue localized to the Oceania region.

Conclusion

Outdated Microsoft Exchange servers throughout Australia and New Zealand still exhibit vulnerability to security threats, despite a fix being offered by Microsoft. The ongoing existence of these servers creates significant security challenges, leading authorities like ASD to issue urgent recommendations for organizations to either upgrade or secure their infrastructures.

Q: What is the issue affecting Exchange servers?

A: The issue is a severe authentication bypass vulnerability termed CVE-2026-62911, enabling unauthenticated attackers to potentially execute arbitrary code on the compromised servers.

Q: How many servers are impacted in Australia and New Zealand?

A: As of August 31, 382 servers are vulnerable in Australia, and 56 in New Zealand.

Q: Which Exchange versions are affected?

A: The versions at risk include Exchange Server 2016, 2019, and Subscription Edition.

Q: What measures should organizations with vulnerable servers take?

A: Organizations should either update or replace these servers or, if unable, segment their networks to safeguard critical systems.

Q: Has Microsoft acknowledged active exploitation of this vulnerability?

A: Currently, Microsoft has not verified any active exploitation in real-world scenarios.

Q: What is the position of the Australian Signals Directorate (ASD)?

A: ASD encourages organizations to promptly address the vulnerability and recommends network segmentation if upgrading is not an option.

Quick Overview

• Sportsbet launches a centralized AI gateway for improved governance.
• The TrueFoundry AI gateway is deployed on Sportsbet’s AWS infrastructure.
• Instant use cases are already operational through the gateway.
• AI gateway guarantees complete transparency regarding model deployment and costs.
• Improved product development through integration with Jira.
• Emphasis on evolving AI into a scalable business asset.

Centralized AI Governance at Sportsbet

Sportsbet has made a notable progress in its tech strategy by implementing a centralized control system aimed at managing its increasing use of artificial intelligence (AI). This initiative intends to not only govern AI application but also effectively regulate related expenses.

The TrueFoundry AI Gateway

The organization has incorporated the TrueFoundry AI gateway into its AWS infrastructure. This cutting-edge platform serves as a centralized control system, adeptly handling all LLM traffic, MCP-connected agent tool requests, and AI workloads across Sportsbet’s engineering departments. The gateway guarantees that validation protocols run concurrently with AI model requests, ensuring policy adherence without introducing any delays to vital operations.

Immediate Use Cases and Advantages

Sportsbet has already started to experience the advantages of this setup with several immediate applications. An existing AI agent has been migrated to function through TrueFoundry, delivering important insights into usage statistics, guardrails, and MCP-routed tool oversight. This agent aids business analysts and product managers in creating product requirement documents and user narratives via Jira integration.

Improved Transparency and Expense Management

The introduction of centralized governance enables Sportsbet to implement essential guidelines and regulate expenses with complete visibility into model usage, token consumption, and cost distribution per application and team. This strategic decision aligns with Sportsbet’s broader ambition to not only adopt AI technology but to spearhead the transformation of product development and customer experiences.

Turning AI into a Fundamental Capability

As noted by Niall Keating, Sportsbet’s general manager of data and AI, “AI is transforming our product development and customer interaction, and Sportsbet aims to lead the way.” The challenge lies not in pilot initiatives but in embedding AI as a fundamental capability that functions on a large scale.

Conclusion

Sportsbet’s implementation of a centralized AI gateway signifies a major leap in its AI strategy, concentrating on governance and expense regulation. By leveraging the TrueFoundry AI gateway, Sportsbet enhances its operational capabilities, setting the stage for innovative product development and enhanced customer satisfaction.

Q: What is the TrueFoundry AI gateway?

A: The TrueFoundry AI gateway is a system integrated with Sportsbet’s AWS infrastructure to manage AI workloads and ensure effective governance and cost oversight.

Q: How does the AI gateway benefit Sportsbet?

A: It offers complete transparency regarding AI model usage, token consumption, and cost allocation, assisting in guideline enforcement and expense control.

Q: What are some immediate applications of the AI gateway?

A: Immediate applications include the migration of existing AI agents for improved usage metrics and supporting product development through Jira integration.

Q: How does the AI gateway influence product development?

A: It aids in the creation of product requirement documents and user narratives, enhancing collaboration between business analysts and product managers.

Q: What is Sportsbet’s aspiration for AI?

A: Sportsbet strives to lead the evolution of product development and customer experiences by converting AI into a scalable core business capability.

Runner World’s redesigned site pairs source-labelled running news with evidence-aware guides, clearer navigation and an excellent mobile reading experience.