Kategorie

A newly discovered local privilege escalation vulnerability dubbed 'CIFSwitch' in the Linux kernel could allow attackers to forge CIFS authentication key descriptions, abuse the kernel's key request mechanism, and gain root privileges. [...]

Palo Alto Networks has warned that a recently disclosed medium-severity security flaw impacting PAN-OS and Prisma Access has come under active exploitation in the wild. The vulnerability, tracked as CVE-2026-0257 (CVSS score: 7.8), refers to a case of authentication bypass that could be exploited by bad actors to set up VPN connections. "Authentication bypass vulnerabilities in the Ravie Lakshmananhttp://www.blogger.com/profile/[email protected]

Authorities in the Netherlands said they dismantled a botnet that comprised more than 17 million devices and were managed by 200 servers in a joint operation by the police and the National Cyber Security Center.

The action, announced Thursday, came about after a security researcher reported the sprawling network to authorities. The host infrastructure was located in the Netherlands.

Used for criminal purposes

“The police then seized several botnet servers from a hosting provider for investigation,” the NCSC said. “The botnet was taken offline by the provider because it was used for criminal purposes.”

Read full article

Comments

Threat actors are abusing ChatGPT's content-sharing feature to display fake OpenAI outage pages that direct users to download malware disguised as the ChatGPT desktop application. [...]

California Attorney General Rob Bonta filed a lawsuit against 23andMe, now Chrome Holding Co., over the company's failure to protect sensitive customer genetic and personal information. [...]

Cybersecurity researchers have disclosed details of a vulnerability in OpenAI ChatGPT that leverages the artificial intelligence (AI) assistant's implicit trust in Markdown links and images to trigger prompt injections and open the door to phishing attacks. The technique has been codenamed ChatGPhish by Permiso Security. "The chatgpt.com response renderer trusts Markdown links and Markdown Ravie Lakshmananhttp://www.blogger.com/profile/[email protected]

The Euro-Office open source productivity app suite will be available with the first stable release of the software on June 9. 

Euro-Office was unveiled in March with the aim of providing a modern, open source alternative to Microsoft and Google software for European organizations increasingly wary of a dependence on US-based suppliers. 

Euro-Office consists of four browser-based applications: a document editor, spreadsheet program, presentation tool, and a PDF editor, with each application enabling collaborative document editing. It supports Microsoft Office file formats DOCX, PPTX and XLSX, as well as Open Document Format (ODF) files such as ODS, ODT and ODP.

The software is intended to be integrated into collaboration solutions such as file-sharing platforms, online wikis or project management tools, according to Nextcloud, one of several European organizations involved in the Euro-Office project.

Nextcloud will add Euro-Office to its Nextcloud Office next month, where it will be available as an “equal option” alongside an existing open-source productivity suite based on Collabora’s software, Nextcloud CEO Frank Karlitschek said in a briefing. Pricing will depend on factors such as use case and deployment scale, but will sit in a similar range to the Collabora version.

Nextcloud plans to add desktop and mobile apps “later this summer,” said Karlitschek; these will save documents locally and sync to cloud storage tools that customers choose.

German cloud hosting provider Ionos will also integrate Euro-Office into its Nextcloud Workspace subscription at no extra cost, and as an optional paid add-on to its HiDrive and Managed Nextcloud subscriptions. (Pricing information was not immediately available.)

Nextcloud and Ionos are currently hiring a “dedicated development team” to work on Euro-Office, Nextcloud said in a blog post Thursday. Other software vendors, including Xwiki and Office.eu, are expected to incorporate Euro-Office into their products in the coming months, too.

Euro-Office is built on the open-source code base of OnlyOffice and distributed under the GNU Affero General Public License v3 (AGPL v3). 

Following the launch announcement, OnlyOffice — which is owned by Ascensio System SIA — alleged in March that Euro-Office violated its licensing terms and infringed its copyright, due to a lack of attribution to OnlyOffice.

Karlitschek said this week that the conflict with OnlyOffice is “now resolved,” following an agreement to provide attribution to OnlyOffice in Euro-Office. “We came to an agreement that the OnlyOffice people required only attribution, that you basically mention that the code is partly based on top of OnlyOffice, and we are happy to do it.”

But an OnlyOffice spokesperson denied a specific agreement had yet been reached. “OnlyOffice has not entered into any agreement with the Euro-Office project,” said Galina Goduhina, commercial director at OnlyOffice. 

“Our licensing framework is clearly defined, and compliance with its terms is not optional,” Goduhina said. “We will continue to assess the situation based on actual use of our technology.

 “This situation goes beyond attribution— it concerns transparency of technology origin, respect for the original developer — and does not meet the standards of responsible partnership we expect,” Goduhina said. “OnlyOffice remains focused on supporting its users, customers and partners and continuing to develop reliable, enterprise-grade document solutions.”

OnlyOffice recently published a blog post outlining its license and trademark policy in more detail. 

A Nextcloud spokesperson said the blog post indicated a change in the OnlyOffice license to “bring it in line” with AGPLv3. 

“We applaud the removal of the conflicting requirements around the trademark, aligning with our opinion and that of the licensing experts in the open source community,” the spokesperson said. “We will adopt their changes as they are being made to the code, of course ensuring the license compliance is preserved. With these changes we consider the matter resolved.”

Meta has raised the possibility that it could be joining the likes of Amazon, Microsoft and Google in offering cloud services at some point in the future — although potential customers shouldn’t be adding the company to their suppliers list just yet.

When asked about plans for offering such services at the company’s annual shareholders meeting,  Meta CEO Mark Zuckerberg said there was a possibility of the company competing with the major hyperscalers. “It’s definitely on the table.”

He explained that different companies were approaching Meta asking for the company to offer an API service or to buy compute services at a premium price. “We haven’t done it yet, because we think we have a use for the compute, but when we feel we have overbuilt, then that is an option that we have.”

Meta has been active in developing its data centers over the past few years, so there will be a possibility of some excess capacity. It is also developing its own AI chips.

For the moment, though, the company may well need all the capacity it can build: Zuckerberg said that the launch of Muse Spark, a new AI model from Meta Superintelligence Lab, had resulted in large increases in Meta’s AI usage.

This article first appeared on Network World.

A research project examining AI-driven recruitment hires across the US has revealed a systemic racial bias.

Researchers from Stanford University found a startling pattern of racial disparities when looking at the interview offers resulting from 4 million job applications submitted to 156 employers. The situation is aggravated by the “monoculture” in AI hiring software: More than 90% of US employers are screening job applicants with software, with 60% of Fortune 500 companies using the same tool, HireVue, the researchers found.

Applicants who applied to multiple companies using AI had all their applications rejected more often than would be expected if each company’s screening methods were independent. They calculated that Black and Asian candidates were rejected in greater numbers than baseline figures would suggest. According to the survey, 29,000 more Asians would have been interviewed if AI had not been deployed.

The researchers are concerned about the way in which AI is being used. “AI screening tools bring together three properties that should not co-exist in high-stakes decision-making: They are pervasively adopted, highly consequential, and opaque to the public,” they said in a news release presenting their work.

The effect of this will lead to workplaces dominated by a monoculture which may not be beneficial for companies going forward.

This article first appeared on CIO.

I will sit right down (waiting for the gift of sound and vision)
And I will sing (waiting for the gift of sound and vision)

— David Bowie

Apple is planning to sponsor and present 14 AI research papers at the annual IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) in Denver next week, just days before it introduces major new AI features at its Worldwide Developer Conference (WWDC).

The fresh research explores topics such as using LLMs in image generation, quality testing, and user interface prototyping. For months, supply chain rumors have hinted at a radical evolution for the ubiquitous AirPods in the form of built-in ambient cameras. With this in mind, it’s noteworthy that one of the research papers, “From Where Things Are to What They’re For: Benchmarking Spatial–Functional Intelligence for Multimodal LLMs,” specifically seems to cater for such use cases. 

Accessibility for the people

In application, this tech promises profound potential for accessibility. It suggests that someone with limited vision might be able to get their AirPods to guide them through an unfamiliar room. This is something that should fit well inside the company’s ongoing narrative around machine vision intelligence and accessibility. 

Accessibility is central to a second presentation to be made during the Generative AI for Sign Language Workshop at the conference. Led by Apple’s Colin Lea, who presented a session on speech tech for people with speech disabilities at a similar event, this focus on machine vision intelligence and accessibility is entirely deliberate. 

Indeed, even though the industry and critics condemn Apple for lagging behind others in the AI space, the publication of these 14 papers at a key industry session just before WWDC shows the company has been doing a great deal of foundational work behind the scenes. We expect this work to bear its first fruit at WWDC, and it is important to understand the disclosures as a power move. Apple is using the show to celebrate its strengths in AI development, and given its decade work on Apple Car, many of those strengths relate to machine vision intelligence. 

Apple is so advanced in the field it is already deploying advanced models that empower consumers. Just last week, it promised to introduce a new tool called Image Explorer in VoiceOver to help partially sighted customers later this year. Among many other features, this will arrive alongside a system to let disabled users control compatible wheelchairs with spoken word commands. 

Apple is pushing boundaries all the way. Its paper “VSAS-Bench: Real-Time Evaluation of Visual Streaming Assistant Models,” proves it is actively refining models to process live video instantly on consumer hardware. 

What matters, the human or the machine?

The difference between Apple and its competitors is deep and philosophical. I’d argue that while others build cloud-dependent chatbots, Apple is embedding AI tools that solve real human problems in its systems. 

This extends to its plans at WWDC, where it will introduce a raft of AI tools made with help from Google Gemini and a host of AI services it has developed in house. The latter will include a great many accessibility tools of the type it will discuss at the CVPR event, the beauty of which being that they will run privately and on-device. You could argue that while other tech giants are using AI to automate white-collar jobs or build a surveillance dystopia, Apple is searching for applications of machine intelligence that solve real human problems. 

The company seems pretty realistic about the ongoing AI transformation. It recognizes that its own ecosystem must become a peer player in the emerging AI-augmented environment the tech industry seems intent on building. 

With that in mind, Apple is willing to engage in strategic, mutually beneficial partnerships, such as permitting Siri to use third-party AI services to handle requests. But even as it does that, it is also focusing on those areas in which it can make a unique difference, such as the accessibility features Apple as a platform has always provided.

Open up

As the Vision Pro demonstrated, and as these mythical video-enabled AirPods will in the future suggest, computers are steadily getting smarter. So, the way we use them is also changing as we move away from the rigid boundaries of keyboards, mice, and touchscreens. Apple’s quest for ambient computing began long before the sudden gold rush for generative AI chatbots. 

In the end, as the latter services become commodified, the way humans interact with them will define the next generation of hardware. That’s exciting for Apple, given that product design is where it excels. The era of sound and vision may finally have arrived.

You can follow me on social media! Join me on BlueSky,  LinkedIn, Mastodon, and MeWe. 

Researchers in Switzerland claim to have built a perfect random number generator from two quantum superconducting chips, a 30-meter-long pipe, and some software. The resulting device could be used to generate cryptographic keys, or to offer a “public randomness service” for lotteries or blockchain applications, they say.

They’re not the first to make the claim.

Many sources of randomness are biased. For example, coins or dice tend to favor one side. “Even modern random number generators, which are based on quantum mechanical effects like the reflection of photons from beam splitters, are not entirely immune to such a systematic error or ‘bias’,” said Andreas Wallraff, one of the leaders of the research team at ETH Zurich.

Similar biases can be found in purely software-based pseudo-random number generators. This has led to security problems in IoT devices and WhatsApp, among other applications.

To get around that, the researchers set up of two supercomputing chips, each representing one qubit, cooled to near absolute zero. The chips are connected by a 30-meter-long microwave guide, similarly cooled, and the microwave photons flying between them create a situation of quantum entanglement.

The results produced by this process are then transformed via a special algorithm to generate perfect randomness. “The resulting sequence of zeros and ones is now really perfectly random, and we can even certify that,” said Renato Renner, the other team leader. “The technical improvements allowed us to create random numbers that will remain perfectly random for all eternity.”

The team published their results this week in an article entitled “Experimental randomness amplification” in Nature.

This article first appeared on CSO.

An unknown threat actor has been observed using a large language model (LLM) agent to conduct post-compromise actions after obtaining initial access following the exploitation of a publicly-accessible Marimo network using a recently disclosed vulnerability. "The attacker compromised an internet-reachable Marimo notebook via CVE-2026-39987, extracted two cloud credentials from the compromised Ravie Lakshmananhttp://www.blogger.com/profile/[email protected]

DDoS attacks are increasingly being sold like subscription services, complete with pricing tiers, support, and reseller programs. Flare explores how the DDoS-as-a-Service market has evolved from scattered tools into polished attack platforms. [...]

Dutch authorities have taken offline a massive botnet of 17 million devices and seized more than 200 servers at a local provider that supported the operation. [...]

Google says the Chrome Device Bound Session Credentials (DBSC) security feature is now generally available and is rolling out to all users to prevent account takeovers. [...]

A previously undocumented threat actor dubbed GREYVIBE has been attributed to ongoing and persistent attacks targeting Ukraine and Ukraine-related entities since at least August 2025. GREYVIBE, per WithSecure, is assessed to be a Russian-speaking group operating broadly in the Russian time zone, with the activities aligning with Kremlin state interests, specifically when it comes to Ravie Lakshmananhttp://www.blogger.com/profile/[email protected]

A North Carolina man was sentenced to more than 10 years in prison for selling the personal information of over 7 million elderly Americans to Jamaican scammers. [...]

Shadow AI used to mean employees pasting things they shouldn't into ChatGPT. It now means something bigger: employees building full applications with AI, wiring them into production systems, and publishing them on the open internet. Without Security or IT in the loop. The artifact moved from a prompt to a product. The risk surface moved with it. In The Shadow Builders report (get it here), a [email protected]

A Google security engineer was charged with insider trading after winning $1.2 million using confidential company data to place bets on the cryptocurrency-based Polymarket decentralized prediction market. [...]

Cybersecurity researchers have discovered a malicious NuGet package that masquerades as a C# software development kit for Sicoob, one of Brazil's largest cooperative financial systems, to siphon client IDs and PFX certificates. According to Socket, versions 2.0.0 through 2.0.4 of "Sicoob.Sdk" contain functionality to exfiltrate sensitive information, including PFX certificates that are used to Ravie Lakshmananhttp://www.blogger.com/profile/[email protected]