IT Security on Pfisterer Consulting

Six Hours, Eighteen Years: What NGINX Rift Tells the Mittelstand

Fri, 15 May 2026 07:00:00 +0200

On May 13, 2026, F5 and security researcher depthfirst publish a disclosure with weight behind it. CVE-2026-42945, codenamed NGINX Rift, CVSS 9.2. Unauthenticated remote code execution in the ngx_http_rewrite_module of NGINX. Affected: all open-source versions from 0.6.27 through 1.30.0 and NGINX Plus R32 through R36. The bug has been in the code since 2008. Eighteen years.

The actual punchline sits in the disclosure footnote. The bug was not found by a human researcher. It was found by an autonomous AI analysis system. Six hours of runtime against one of the most thoroughly reviewed open-source codebases on the planet. This is the direct confirmation of the thesis I sketched on May 13 in the article on the Mythos Glasswing asymmetry as something coming. It arrived a week later.

The Glasswing Asymmetry: What Mythos Finds in Firefox and What the Mittelstand Should Learn

Wed, 13 May 2026 07:00:00 +0200

On May 5, 2026, Mozilla publishes an unusually candid blogpost: An early version of Anthropic’s newest model, Claude Mythos Preview, has found 271 security vulnerabilities in Firefox over the past weeks. 180 high-severity, 80 moderate, 11 low. Some of the bugs sat undiscovered in the code for 15 years, meaning since 2011. Patches went out in Firefox 149.0.2, 150, 150.0.1, and 150.0.2.

That alone would be a substantial story. What makes it matter for the German Mittelstand is the footnote: Mythos is not publicly available. Anthropic currently hands the model only to eleven organizations under a program called Project Glasswing. The list contains U.S. hyperscalers, U.S. banks, U.S. security vendors, and the Linux Foundation. No German company. No European company outside Linux.

When AI Agents Hack AI Systems: Why Your AI Needs Security Testing Now

Wed, 11 Mar 2026 08:00:00 +0100

An autonomous AI agent chains four individually harmless vulnerabilities into a complete platform takeover — severity rating CVSS 9.8 out of 10. Then it gives itself a voice and calls the target system’s AI. No human hacker. No sophisticated exploit kit. One AI hacking another AI.

This isn’t science fiction. This happened in March 2026 — to a $20 million-funded AI recruiting startup whose clients included Anthropic, Stripe, and Monzo. AI security is a central aspect of my consulting on compliance and regulatory requirements.

Inside OpenClaw #5: Production-Ready AI on WSL2

Thu, 05 Mar 2026 09:00:00 +0100

Your inference server runs fine on Friday afternoon. You set the right vLLM flags, tool calling works, the agent responds correctly. Monday morning, the server is dead. No crash log. No error message. WSL2 simply stopped running.

This is the gap between “works on my machine” and “runs in production.” And it has nothing to do with code. Production stability of AI systems is an aspect of my AI and automation consulting.

Zero API Costs: How We Run an AI Agent on a Single GPU

Tue, 24 Feb 2026 16:00:00 +0100

Most AI agents depend on cloud APIs — and every request costs money. With agent workloads, those costs add up fast: a single complex task can consume 50,000 to 100,000 tokens. Run that a few dozen times a day, and you’re looking at a serious monthly bill.

We took a different approach with OpenClaw. Our AI agent runs entirely on local hardware — one GPU, no cloud dependency, no recurring API fees. Local AI solutions are a focus of my AI and automation consulting.

Shadow AI: When Employees Secretly Build Their Own AI Agents

Mon, 23 Feb 2026 10:00:00 +0100

The New Shadow IT Has a Brain

Shadow IT has been a headache for years — unauthorized tools, private cloud accounts, rogue SaaS subscriptions. But Shadow AI takes it to a different level entirely. This topic is part of my AI and automation consulting for SMEs. Because this time, employees aren’t just using unapproved software. They’re building intelligent workflows that actively process, analyze, and redistribute company data.

And they’re doing it with the best of intentions.