.jpg&w=3840&q=100)
Riverlane appoints key leaders for global quantum software
The company stated that the field of quantum computing is moving rapidly, requiring not only hardware improvements but also extensive software development and a skilled developer community to realise practical quantum applications. Riverlane aims to address these needs by expanding its quantum error correction (QEC) capabilities and building a wider international community focused on quantum software and education.
Abe Asfaw will assume the newly created role of Head of QEC Enablement. In this role, Asfaw is tasked with establishing and leading Riverlane's global QEC enablement function. His responsibilities will focus on facilitating Deltaflow users, as well as others in the quantum community, in developing the skills required to adopt and implement quantum error correction. This includes developing educational programmes, forming partnerships, and building support mechanisms to foster the practical adoption of QEC techniques.
Asfaw joins Riverlane after a period at Google Quantum AI, where he led educational and outreach initiatives and helped steer the company's global engagement in quantum computing research. He previously served as Global Lead for Quantum Education and Open Science at IBM Quantum, and played a significant role in founding educational initiatives such as the Qiskit Global Summer School and IBM Quantum Challenge.
Regarding his new position, Abraham Asfaw commented, I am excited to join the talented team at Riverlane that has set its focus on accelerating quantum error correction. This is the key ingredient that will enable the full potential of quantum computers. Accelerating QEC means delivering highly capable and intuitive hardware and software tools and simultaneously building learning pathways to transition the quantum community toward QEC capability with these tools. My focus is on making it easier for researchers and developers to apply QEC in practice, which will in turn drive the broader quantum computing field forward faster.
Guen Prawiroatmodjo has been appointed as Senior Engineering Manager for Open-source Software. She will lead the development of an open-source software development kit (SDK) designed to enable quantum programmers to build, test and run fault-tolerant circuits on hardware. The SDK will offer tools for generating logical circuits, performing simulations, decoding, and modelling system noise. The first version of the SDK is planned for release in the third quarter of 2025.
Prawiroatmodjo's background includes roles at Microsoft, where she developed core elements of the Quantum Development Kit and contributed to Majorana 1, as well as experience at Rigetti Computing and MotherDuck. At Microsoft, she also maintained the Azure Quantum Python SDK, and at Rigetti, was involved in developing a cloud-deployed quantum processor.
Prawiroatmodjo stated that accessible software will be critical as quantum hardware evolves, remarking, Today, quantum hardware itself is starting to become capable to running fault-tolerant circuits, and widely available software has not integrated QEC capability yet. In the NISQ era, developers were able to run small, noisy quantum algorithms on hardware for the first time, but these often had to be repeated many times to account for noise and errors in the system. With Riverlane's upcoming SDK, quantum programmers will be able to take their existing NISQ circuits and implement, test and run them in a fault-tolerant way using the latest advances in quantum error correction. Our goal is not only to make it easier to run QEC experiments, but also to upskill the broader quantum community so more people can build, test and run fault-tolerant quantum programs.
According to Riverlane, the global pool of experts in quantum error correction remains limited, as highlighted by the scale of attendance at key conferences. The company believes that software is expected to represent a substantial portion of value in quantum computing, similar to trends seen in classical computing, where software generates over 60% of industry revenue.
Riverlane's current strategy, led by Liz Durst, Vice President of QEC Community and former Director of IBM's Qiskit platform, involves strengthening the capacity and reach of its QEC Community team. The company is also actively recruiting across software, quantum science, enablement, and engineering roles, aiming to broaden the base of professionals contributing to QEC infrastructure.
The additions of Asfaw and Prawiroatmodjo reflect Riverlane's broader effort to facilitate scalable QEC and foster the required developer community to advance fault-tolerant quantum computing technologies.
Hashtags
Try Our AI Features
Explore what Daily8 AI can do for you:
Comments
No comments yet...
Related Articles
Techday NZ
4 hours ago
- Techday NZ
SharePoint flaw sparks urgent patch call amid new RCE threat
Cybersecurity experts are urging organisations to take immediate action following the disclosure of a critical vulnerability in Microsoft SharePoint, as highlighted in the latest Patch Tuesday security update. This newly identified issue, designated CVE-2025-49712, is raising alarms given its potential to facilitate remote code execution (RCE) when combined with other known flaws. Saeed Abbasi, Senior Manager of Security Research at Qualys Threat Research Unit, described the vulnerability as a significant threat, especially coming on the heels of last month's "ToolShell" zero-day attacks. Abbasi commented, "This RCE demands authentication but pairs dangerously with known authentication bypasses. Attackers chaining this with prior flaws could achieve full server compromise, and data exfiltration." He added that while there have been no reports of exploitation in the wild so far, experience suggests such gaps can be closed rapidly as threat actors adapt their techniques. Abbasi urged organisations to "prioritise and patch all SharePoint updates, rotate keys, and eliminate internet exposure," stressing that delaying mitigation efforts could trigger both regulatory scrutiny and significant data breaches. "SharePoint's exploit streak isn't over," Abbasi warned, underscoring the need for proactive management of the platform's security posture. The August Patch Tuesday update from Microsoft addressed a total of 107 Common Vulnerabilities and Exposures (CVEs). Of these, 13 were rated critical and 91 as important. Elevation of privilege (EoP) vulnerabilities accounted for 39.3% of the fixes, while remote code execution issues made up 32.7% - a pattern consistent with trends observed in previous months. Satnam Narang, Senior Staff Research Engineer at Tenable, noted that "this month's release highlights an upward trend in post-compromise vulnerabilities over code execution bugs. For the second consecutive month, elevation of privilege vulnerabilities represented the bulk of CVEs patched this month." Narang referred to the patch for CVE-2025-53779, a privilege escalation flaw known as BadSuccessor, describing its immediate impact as limited due to the specific prerequisites needed for exploitation. "An attacker must have at least one domain controller in a domain running Windows Server 2025 in order to achieve domain compromise," he explained, making it a targeted rather than broad-based risk. SharePoint vulnerabilities continued to receive particular attention, with Narang observing, "It might seem like déjà vu because Microsoft patched two more SharePoint vulnerabilities this month: a remote code execution flaw (CVE-2025-49712) and an elevation of privilege bug (CVE-2025-53760). After the chaos that ensued with the exploitation of the ToolShell vulnerabilities, any new SharePoint vulnerabilities understandably raise concerns." Since 2022, Microsoft has patched an average of 21.7 SharePoint vulnerabilities annually, with 2023 seeing a high of 25. With 20 already addressed in the current year, the record may soon be exceeded, according to Narang. Despite this volume of patches, he noted, "only three were exploited in the wild (CVE-2023-29357, CVE-2023-24955, CVE-2024-38094) in addition to the three ToolShell vulnerabilities (CVE-2025-49706, CVE-2025-49704, CVE-2025-53770)," though another, CVE-2025-53771, may also have been exploited based on emerging reports. Security practitioners highlight the recurring threat presented by SharePoint vulnerabilities, which can serve as gateways for lateral movement and deeper network compromise if not promptly addressed. With a rising tally of disclosed flaws and only a handful exploited so far, experts are calling for continued vigilance, patching discipline, and the hardening of exposed enterprise collaboration systems.
Techday NZ
2 days ago
- Techday NZ
August Patch Tuesday: Microsoft addressing 111 vulnerabilities
Microsoft is addressing 111 vulnerabilities this August 2025 Patch Tuesday, a volume which is around the recent average. In a neat parallel with last month, Microsoft is aware of public disclosure for a single one of the vulnerabilities published today, and claims no evidence of in-the-wild exploitation. Once again, the lone Patch Tuesday zero-day vulnerability is assessed as only moderate severity at time of publication, which brings Microsoft's lucky streak up to 11 months. Today's release includes the publication of nine critical remote code execution (RCE) vulnerabilities, although Microsoft has only marked one of these as more likely to see exploitation. Eight browser vulnerabilities have already been published separately this month, and are not included in the total. What do attackers want in a Windows context? Domain admin! When do they want it? Now! Today's lone zero-day vulnerability might be just what they need to break through the final layers of protection and swipe the crown jewels. CVE-2025-53779 is an elevation of privilege (EoP) vulnerability in the Windows implementation of Kerberos, which is enabled via abuse of dMSA configuration. The advisory FAQ provides more clues as to the nature of the attack than many comparable Microsoft advisories, but misses a golden opportunity for clarity, since it never sets out what it means by dMSA, leaving us scouring for contextual clues. Ultimately, we can determine from context that today's hot topic is the Delegated Managed Service Account, rather than the Defender Microservices Architecture or some other piece of Microsoft paraphernalia with matching initials. Microsoft's motivation is unimpeachable: the dMSA supports automated rotation of credentials for service accounts, and is specifically designed to prevent credential harvesting using Kerberoasting. Indeed, CISA has described Kerberoasting as one of the most time-efficient ways to elevate privileges and move laterally throughout an organisation's network. The good news here is that successful exploitation of CVE-2025-53779 requires an attacker to have pre-existing control of two attributes of the hopefully well protected dMSA: msds-groupMSAMembership, which determines which users may use credentials for the managed service account, and msds-ManagedAccountPrecededByLink, which contains a list of users on whose behalf the dMSA can act. However, abuse of CVE-2025-53779 is certainly plausible as the final link of a multi-exploit chain which stretches from no access to total pwnage. Finally, it's important to note that Microsoft is only publishing patches for Windows Server 2025, and that's because msds-ManagedAccountPrecededByLink was first implemented in Server 2025. Migrating to newer operating systems sooner rather than later remains good advice, but so is remediation of zero-day vulnerabilities which could give an attacker total control of your estate. The publication of any pre-authentication RCE in Windows will naturally spark discussion. Of course, not all pre-auth RCEs are created equal, and while CVE-2025-50165 has a hefty CVSSv3 base score of 9.8, and is certainly a cause for concern, it is not the worst of the worst, since it presumably isn't wormable. Despite that, a degree of alarm is amply justified, since the advisory FAQ mentions - twice! - that user interaction isn't required. Exploitation is via a malicious JPEG file, which could be delivered within an Office document or other means; perhaps even visiting a website would be sufficient, or receiving an email within Outlook, although the advisory doesn't explicitly confirm or deny these other possible attack routes. The malformed JPEG tricks the Windows Graphics Component into code execution via an untrusted pointer dereference. The context of execution isn't specified, so in the standard spirit of caution, we'll assume SYSTEM. This is hardly a new class of problem: we can cast our minds back a dozen years, for instance, and consider the broadly similar MS13-096. However, the specific flaw underlying CVE-2025-50165 is presumably a recent introduction, since only Windows 11 24H2 and Server 2025 receive patches. Patch this one sooner rather than later, since it could provide a skilled attacker with a valuable foothold from which to launch further attacks, including perhaps even today's CVE-2025-53779. The Windows GDI+ (Graphics Device Interface Plus) is at the centre of how almost all two-dimensional graphics are rendered on Windows assets. CVE-2025-53766 is a critical RCE in how GDI+ interprets metafiles, which are often used to store vector graphics. An attacker can achieve code execution via buffer overflow without privileges or user interaction. As with today's CVE-2025-50165, it's unlikely that this vulnerability could be wormable, but the most alarming path to exploitation involved simply uploading a malicious metafile to a Windows machine running unspecified web services. There is no mention of SharePoint, Exchange, Office, or other non-Windows products in the Security Updates section of the advisory, but that still leaves an essentially limitless potential attack surface; for example, anyone running a custom application offering file uploads could find themselves vulnerable to an attacker wielding a dodgy WMF file. On the bright side, the Preview Pane is not a vector in this case. A patch is available for Server 2008, but not Server 2012, a curious and possibly concerning pattern that we see from time to time with RCEs which affect the full historic range of Windows products. Today is certainly a good day for fans of critical RCE vulnerabilities which target weaknesses in how Windows interprets graphics. Exploitation of CVE-2025-50176, a flaw in the DirectX graphics kernel, could lead to execution in a kernel context. Microsoft considers exploitation more likely, which may be why the advisory doesn't provide a great deal of information about the means of exploitation, beyond a terse statement that type confusion is involved. Type confusion is where the kernel receives a pointer which it expects to be for one type of object, but is in fact for another, which is a bit like asking someone to read out loud from a restaurant menu, but then handing them their secret diary and hoping they won't notice the difference. Most people will not be fooled, but under the right circumstances, anything is possible. There are no significant changes to Microsoft product lifecycles this month. However, October will bring a flurry of changes, including the categorical end of support for non-LTSC versions of Windows 10.
Techday NZ
7 days ago
- Techday NZ
Quantum computing exposes Active Directory to urgent new risks
Organisations using Microsoft Active Directory as their primary identity management system face a significant cybersecurity risk as the advent of quantum computing begins to challenge established cryptographic protections, according to Certes. Certes has released a technical analysis outlining how the introduction of post-quantum cryptography (PQC), designed to resist powerful quantum computing attacks, reveals vulnerabilities in legacy systems such as Active Directory. The report indicates organisations could be exposed to attacks if underlying identity infrastructure does not evolve alongside cryptographic standards. The analysis warns that most businesses still rely on authentication systems originally built for classical computing environments. These systems employ protocols and structures including Kerberos authentication, domain trusts, and key distribution mechanisms, all of which may be unsuitable as the threat landscape evolves with quantum technology. Expert warning This isn't a hypothetical risk anymore," said Simon Pamplin, CTO at Certes. "The cryptographic standards being pushed out today are being fast-tracked to combat real and present quantum risks. But the problem is that most organisations still depend on Active Directory; a system never designed to survive this level of cryptographic upheaval. Quantum computers are predicted to eventually possess the capacity to break the cryptographic algorithms that underpin many of today's security solutions. In anticipation, new PQC algorithms are being developed and deployed. While these are expected to provide a more secure foundation for future digital infrastructure, Certes warns that existing directory services such as Active Directory were not created with quantum resilience in mind. Certes' technical team notes that, despite advances in other areas of cybersecurity, the core identity and access management systems within many enterprises remain based on decades-old technology. This dependence could create opportunities for attackers to exploit the gap between new cryptographic protections and legacy identity protocols. The firm contends that even organisations investing in modern security features such as multi-factor authentication or cloud-based platforms may remain at risk if their identity backbone is not upgraded to keep pace with cryptographic developments. What's most alarming is the false sense of security," added Simon. "Many CISOs are focused on perimeter security modernisation, MFA here, a cloud migration there, but underneath, the enterprise's digital identity is still built on sand. Industry recommendations Certes is calling on senior decision-makers, including Chief Information Security Officers (CISOs) and IT strategists, to closely review and update their security models. The company advises organisations to assess the specific vulnerabilities associated with integrating PQC into Active Directory environments, map out all current cryptographic dependencies ahead of any PQC-related implementation, and re-evaluate their digital identity strategies to look beyond legacy directory services. The organisation is actively providing guidance to clients in sectors such as finance, healthcare, defence, and government. Certes states that solutions exist today to support data protection in the face of quantum threats, and that its current focus is helping customers establish robust, future-proof strategies to secure critical assets before new attack methods become widespread. The analysis concludes that the intersection of post-quantum algorithms and enterprise authentication, particularly where Active Directory is concerned, poses an urgent and complex challenge for organisations dependent on traditional security architectures. Follow us on: Share on:
