Associate Product Manager

Metabase sqli zero-day exploited: data theft attacks confirmed. This article was written by a language model from the source above and was not reviewed by a human before publication. Verify anything operational against the original. Editorial policy Key points * " Metabase Cloud and self-hosted instances are compromised via a critical SQL injection zero-day, leading to customer data theft. * " Affected systems include Metabase versions 1.58 and above, including 0.58.x through 0.63.x branches. * " Immediately upgrade self-hosted Metabase instances to patched versions and follow post-compromise remediation steps. A critical, unauthenticated SQL injection zero-day vulnerability in Metabase, affecting versions 1.58 and above, has been actively exploited in the wild, leading to data theft from customer instances. Metabase, a popular open-source business intelligence platform, disclosed the attacks, confirming that its Metabase Cloud SaaS platform was compromised. Self-hosted installations are also vulnerable if not updated, posing a significant risk to organizations utilizing the platform, according to BleepingComputer. Metabase has identified and blocked the attack endpoints, subsequently rolling out a fix for the vulnerability. This unauthenticated SQL injection flaw allows a remote attacker to gain administrator access to a customer's Metabase instance. With administrative control, attackers can alter application configurations, steal stored credentials for connected databases, access any data available through those connections, and export sensitive information. Technical details of the Metabase sqli zero-day vulnerability. The zero-day, described by Metabase as a 'CRITICAL' vulnerability with a CVSS score of 10.0, enables attackers to inject arbitrary SQL into the Metabase application database. This critical flaw grants immediate administrative access without requiring any prior authentication. The broad capabilities afforded by this access include: * Configuration Manipulation: Attackers can modify Metabase application settings. * Credential Theft: Stored credentials for any connected databases can be exfiltrated. * Data Exfiltration: Any data accessible via database connections can be read and exported. The exploitation of this vulnerability has already impacted several organizations. Laptop manufacturer Framework confirmed that its Metabase instance was compromised on August 3, leading to the theft of customer information. This data included full names, email addresses, login IP addresses, billing and shipping address information, phone numbers, and company names. For Framework for Business customers, additional data such as VAT, EIN, and billing email addresses may also have been exposed. Online form builder Tally also reported a compromise of its Metabase analytics environment on August 3. Attackers accessed email addresses and cryptographic hashes of user passwords. Tally clarified that user forms and submitted answers, stored separately, were not affected. LexisNexis, while not explicitly linking its incident to this specific Metabase API vulnerability, confirmed that its Metabase API was impacted by a cyberattack on a third-party vendor earlier this week, causing service disruptions. Metabase states that all its Cloud customers have been automatically upgraded and patched. However, organizations running self-hosted Metabase instances must perform manual updates to secure their systems against this active threat. Mitigation and remediation for Metabase 1.58+ unauthenticated SQL injection. Given the active exploitation and critical nature of this vulnerability, immediate action is paramount for all self-hosted Metabase users. The following steps are crucial for Metabase 1.58+ unauthenticated SQL injection remediation: * Immediate Upgrade: Update all vulnerable Metabase installations to the patched versions. The minimum safe releases are 0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9, and 0.63.5. * Temporary Workaround: If immediate upgrading is not possible, temporarily block access to the /api/session/reset_password endpoint. This serves as a critical, albeit temporary, measure to prevent exploitation. * Post-Compromise Actions: For any potentially compromised instances, Metabase strongly recommends: * Revoking all active user sessions. * Reviewing API keys and administrator accounts for any unauthorized changes. * Rotating credentials for all connected databases. * Inspecting application logs and query history for signs of compromise. How to detect Metabase data theft compromise. Organizations should actively look for indicators of compromise (IOCs) in their system logs to detect Metabase data theft compromise. Attacks can be identified by a POST request to /api/session/reset_password returning a 400 status code, immediately followed by a successful GET request to /api/user/current. The presence of these entries in system logs strongly suggests that an instance has been compromised, and a full forensic investigation should be initiated immediately.

LexisNexis opens Customer Innovation Lab, rebuilding how legal AI gets shipped. Legal professionals, LexisNexis engineers, and AI collaborators like OpenAI and Amazon Web Services build side by side, solving workflow pain points with prototypes in hours and trusted products in weeks. NEW YORK - WEBWIRE - Wednesday, August 5, 2026 LexisNexis(R) Legal & Professional announced the opening of its Customer Innovation Lab in New York City, a new model for how legal AI gets built and shipped. The Lab brings legal professionals, LexisNexis engineers, and AI technology collaborators together from the first working session to build as one team. Solutions to real legal challenges and novel ways to accomplish legal work become tested prototypes in hours or days and production-ready capabilities within weeks. Here's how the Lab works: Legal professionals from law firms, corporate legal departments, the judiciary, and academia bring specific pain points and new ideas on legal practice into the Lab. LexisNexis engineers build against them in real time. Prototypes are designed and tested that same day against the problems they were built to solve, then advance only if they clear LexisNexis's standards for quality, accuracy, and security. Successful prototypes advance into new ways of working and new skills or agents within the LexisNexis agentic platform, either customized for the customer or scaled across the core LexisNexis platform. Watch Greg Dickason, LexisNexis Chief Technology Officer, explain this new model. Already shipping from the Lab: The Lab has already turned ideation with dozens of customers into working prototypes and designs that have advanced into Lexis+(R) with Protégé(TM) capabilities coming soon, including: * LexisNexis-developed legal AI models. The Lab is advancing LexisNexis-developed models purpose-built for legal work, using authoritative legal content and deep legal expertise to improve performance, efficiency, and accuracy across complex legal tasks. * An advanced, customer-managed Protégé Vault for analyzing complex multimedia materials. Legal professionals will be able to securely store and analyze documents, videos, images, audio files, and other matter materials. A lawyer could, for example, analyze a two-hour deposition in minutes with Protégé, pinpoint the exact moments when key facts emerge, and trace findings directly to the timestamps and source materials. * Secure Protégé Workrooms for collaboration across teams. Legal professionals will be able to bring together and share documents, analyses, skills, and AI-assisted work related to a given matter with internal teams, outside counsel, clients, experts, and authorized participants, with precise permissions and access controls, all within the same secure LexisNexis environment. What the Lab is solving now: The Lab is addressing legal drafting quality as a top priority in legal work. Independent research shows lawyers spend 40 to 60 percent of their time drafting and reviewing documents and contracts, more than on any other legal task. LexisNexis has confirmed this pattern directly with customers who identify the complex nature of legal drafting - including personalization, tonality, subject matter expertise, strategic positioning, and legal accuracy - as an unmet need. The Lab is building, prototyping, and testing AI and agentic drafting capabilities that: * Adapt to a firm's or organization's drafting style, precedents, and playbooks * Flag risk and suggest redlines against a customer's own standards * Carry context across related documents, enabling legal professionals to draft a primary document and supporting materials without starting from scratch * Provide document-aware editing tools tailored to the type of legal document being created * Preserve lawyer control through visible AI-generated edits, Track Changes, and version history * Surface LexisNexis proprietary trust markers at the point of need, helping users verify their work without the need for multi-step or cut-and-paste accuracy checks * Integrate essential LexisNexis legal and predictive analytics including litigation, judicial, and regulatory analytics to inform more strategic and higher-quality drafting AI technology collaborators, including OpenAI and Amazon Web Services, participate alongside customers and LexisNexis teams to explore how the latest model capabilities can be applied to complex legal work. LexisNexis engineers anchor every Lab session, applying LexisNexis's secure infrastructure, authoritative content, and validation standards to evaluate every model output. "Congratulations to LexisNexis on the opening of its Customer Innovation Lab. This new space reflects a shared belief that the most meaningful AI innovation happens through close collaboration with customers. We are thrilled to support LexisNexis as it turns that collaboration into new products and experiences with real-world impact." - OpenAI "Congratulations to LexisNexis on the launch of its Customer Innovation Lab," said Scott Liska, VP AWSI, Amazon Web Services. "Bringing trusted AI into professional work requires both rapid innovation and a strong technology foundation. We look forward to continuing our collaboration with LexisNexis as it advances secure, authoritative AI capabilities for legal professionals." "Our vision is to empower customers with world-leading, purpose-built, and trusted legal AI," said Greg Dickason, Chief Technology Officer, LexisNexis Legal & Professional. "The Customer Innovation Lab changes who's in the room when legal AI gets built. Customers help originate and shape what we build from day one. Our job is to validate it, ground it in citable legal authority, and decide what's ready to scale into Lexis+ with Protégé, the platform our customers rely on every day." The Customer Innovation Lab launches in New York City as an ongoing operation, with plans to expand globally. Interested law firms and legal departments can learn more at www.lexisnexis.com/lab. About the LexisNexis Customer Innovation Lab The LexisNexis Customer Innovation Lab brings legal professionals, LexisNexis engineers, and AI collaborators together to build legal AI solutions in real time. Rather than validating AI capabilities after they're built, customers help originate and shape them from the first working session, turning their most complex legal work challenges into tested prototype solutions in hours or days, and trusted product-ready capabilities within weeks. Every capability advanced from the Lab is developed within LexisNexis's private, secure, enterprise-grade infrastructure and must meet LexisNexis's standards for quality, accuracy, and legal-domain performance before reaching customers. Capabilities are grounded in LexisNexis's foundation of authoritative legal content that includes 200 billion documents and records with four million additions daily, 150 years of attorney-led curation, and Shepard's(R) citation intelligence. About LexisNexis(R) Legal & Professional LexisNexis(R) Legal & Professional provides AI-powered legal, regulatory, business information, analytics, and workflows that help customers increase their productivity, improve decision-making, achieve better outcomes, and advance the rule of law around the world. As a digital pioneer, the company was the first to bring legal and business information online with its Lexis(R) and Nexis(R) services. LexisNexis Legal & Professional, which serves customers in more than 150 countries with 11,900 employees worldwide, is part of RELX, a global provider of information-based analytics and decision tools for professional and business customers. WebWireID358538 This news content was configured by WebWire editorial staff. Linking is permitted. Distribute your news. * Every day, hundreds of individuals and companies choose WebWire to distribute their news. * WebWire places your news within numerous highly trafficked news search engines generating leads and publicity. * Submit Your Release Now!

LexisNexis bets on Build-A-Bear model for legal AI. New NYC Customer Innovation Lab promises prototypes in hours and products in weeks. By Joe Patrice on August 04, 2026 2:32 pm This morning, LexisNexis announced its Customer Innovation Lab to rebuild "how legal AI gets shipped." Lawyers from firms, corporate legal departments, the judiciary, and academia can walk into LexisNexis's physical space with their specific pain points, and LexisNexis engineers will build against it on the spot. Prototypes get tested that same day, and anything clearing the company's quality, accuracy, and security bar graduates into a skill or agent on the Protégé platform. OpenAI and Amazon Web Services sit in on the sessions. If that model sounds familiar, it's because that's how Build-A-Bear works, except instead of cuddly stuffed animals, LexisNexis builds high-end, customized legal AI solutions. CTO Greg Dickason has a video explaining it: Historically, a company couldn't conceive, design, and build a legal tech solution within a matter of hours. But with advances in AI-assisted coding, LexisNexis engineers can get to a working prototype quickly, which allows them to design with the end user in the room. That eliminates one of the grand roadblocks to effective legal tech design - engineers used to work for months on a product only to find out after it ships that it doesn't exactly meet lawyer expectations. Now the lawyers are right there to provide instant feedback. "Prototypes in hours and trusted products in weeks" is the tagline. It reflects the pressure rapid AI development and the startup mindset have had on legal AI. LexisNexis has mostly watched AI hallucinations proliferate through the legal industry, comfortable that lawyers would prefer to work with an established, careful provider. And while LexisNexis isn't sacrificing its reputation for caution - the press release notes that prototypes only advance if they clear the company's established standards - they must feel that the legal community needs assurances that LexisNexis can deliver speed too. Despite the announcement arriving today, the lab has been running for weeks now: Already shipping from the Lab: The Lab has already turned ideation with dozens of customers into working prototypes and designs that have advanced into Lexis+(R) with Protégé(TM) capabilities coming soon, including: LexisNexis-developed legal AI models: The Lab is advancing LexisNexis-developed models purpose-built for legal work, using authoritative legal content and deep legal expertise to improve performance, efficiency, and accuracy across complex legal tasks. An advanced, customer-managed Protégé Vault for analyzing complex multimedia materials. Legal professionals will be able to securely store and analyze documents, videos, images, audio files, and other matter materials. A lawyer could, for example, analyze a two-hour deposition in minutes with Protégé, pinpoint the exact moments when key facts emerge, and trace findings directly to the timestamps and source materials. Secure Protégé Workrooms for collaboration across teams. Legal professionals will be able to bring together and share documents, analyses, skills, and AI-assisted work related to a given matter with internal teams, outside counsel, clients, experts, and authorized participants, with precise permissions and access controls, all within the same secure LexisNexis environment. The Lab's target list for the future involves building drafting tools that adapt to a firm's own style, precedents, and playbooks; flagging risk against the client's standards; carrying context across related documents; and fold in litigation, judicial, and regulatory analytics so the draft knows something about the audience reading it. I don't know if LexisNexis expected to be compared to Build-A-Bear when they sent along this press release. But the toymaker is one of the few mall-based mainstays that still makes money. Malls were on the decline before the pandemic, but lockdowns turned many a mall into a ghost town. And yet, after cratering to under $2/share in 2020, Build-A-Bear has emerged from hibernation to a comfy $34/share. It's still a destination for shoppers, because the marriage of personalization and getting a product on-the-spot still sells. There's no reason that shouldn't hold true for legal AI too. Joe Patrice is a senior editor at Above the Law and co-host of Thinking Like A Lawyer. Feel free to email any tips, questions, or comments. Follow him on Twitter or Bluesky if you're interested in law, politics, and a healthy dose of college sports news.