Kategorie

Researchers remotely disabled a vulnerable updater in the abandoned Time4Popcorn app, a fork of the Popcorn Time BitTorrent client, closing a security flaw that could have allowed attackers to execute malicious code with elevated privileges on millions of computers. [...]

Microsoft has announced plans to add AI-powered phishing detection to Teams messages starting in early November 2026. [...]

Diplomatic organizations in Central Asia have been targeted by a sophisticated new Unified Extensible Firmware Interface (UEFI) bootkit called BlackX. The activity, which singled out diplomatic entities in Tajikistan, Uzbekistan, and Turkmenistan in early 2026, is suspected to be orchestrated by a China-linked state-sponsored hacking group known as APT41, Kaspersky said in a technical report Ravie Lakshmananhttp://www.blogger.com/profile/[email protected]

Google has an answer to some of the electricity supply problems that data center construction is causing: It has signed an agreement with energy supplier Voltus to build what it’s calling a 1-gigawatt virtual power plant, expanding on an earlier 100 megawatt deal the two signed earlier this year.

This power plant is virtual in the sense that it doesn’t generate any electricity itself, but aggregates so-called flexible grid capacity into one central resource that can be deployed at times of peak demand. This flexible capacity can be in the form of batteries or of load-shedding: asking others to temporarily stop consuming electricity by shutting down industrial processes or adjusting tens of thousands of smart thermostats at once, effectively moving their electricity usage to a time when there is less demand.

Voltus operates by offering incentives to companies to reduce their power consumption temporarily, and also offers inducements to electricity resellers that they can pass on to their customers.

The Google-Voltus deal will serve the PJM grid region, the largest power grid in the US supplying 67 million people across 13 states and Washington DC.

It’s a PR coup for Google, as increased demand for electricity for its new data centers and those of other hyperscalers is pushing up prices. The additional load is also straining local infrastructure in some areas, increasing utilities’ capital costs and further increasing prices for existing electricity consumers.

Hyperscalers are getting decidedly twitchy about citizens’ reactions to their secretive data center construction plans, and are looking for ways to de-escalate some of the conflicts.

Earlier this month, Amazon announced its Data Center Commitment which, among other things, would disclose more information about energy and water use and consider a moratorium asking government officials to sign non-disclosure agreements covering their planning applications.

Amazon is not alone in this. Earlier this week, Meta said that it was reviewing its use of NDAs after the company was widely criticized for its secrecy in proposing Hyperion, a Louisiana data center in July.

Microsoft was an early pacesetter here, announcing in March that it would “cease to use NDAs as a tool in its data center site selection and development.” Google has since followed suit.

The action of the hyperscalers will be seen as a sign that the rise in protests against data center construction are beginning to have an effect. We have already seen major projects being delayed and we can probably expect to see greater campaigns against data centers as their electricity consumption rises further and as they use more and more water. We are beginning to see initiatives to cut the way that water is being used, to meet these objections head on.

It is unclear whether the hyperscalers’ efforts to be more open about their plans and greater efforts to seek renewable energy sources will assuage the anger against new data center plans. The backlash against them may just be too great.

This article first appeared on Network World.

Ruby has released versions 4.0.9, 3.4.12, and 3.3.13 to fix three bugs in Onigmo, the regular expression engine built into the language. The bugs lie behind four critical security flaws that GitLab patched over the past month. GitLab found that a specially crafted pattern could corrupt memory while Ruby compiles it, potentially leading to code execution on its own servers. Ruby says any Swati Khandelwalhttp://www.blogger.com/profile/[email protected]

Cybersecurity researchers have discovered an artificial intelligence (AI)-driven intrusion ecosystem run by affiliates of the INC and The Gentlemen ransomware groups. Central to the operation is an "Autonomous Red Team Kill Chain Framework" referred to as Phantom. The threat actor is assessed to be Russian-speaking and functions both as an intrusion and data-extortion operator, as well as an Ravie Lakshmananhttp://www.blogger.com/profile/[email protected]

Microsoft says Windows Server 2016 will stop receiving security updates after it reaches the end of support in January 2027. [...]

Matrix-based messaging tools are gaining traction among European governments that seek to gain greater control over sensitive communications data and lessen their reliance on US technology suppliers.

The growing interest reflects a broader push toward open-source applications in Europe amid geopolitical uncertainty. Yet the costs and complexity of replacing established applications such as Microsoft Teams mean any shift away from proprietary software is likely to be gradual, with some organizations choosing to run Matrix-based tools alongside existing platforms.

Launched in 2014, Matrix is an open messaging standard for decentralized communications. Similar to email, the standard allows users to send messages between Matrix-compatible apps from different software vendors, including the open-source Element, Rocket.Chat, and Automattic’s Beeper.

Matrix began as an “interesting experiment” in creating a communications standard for the wider internet, but has since become “the poster child for digital sovereignty, especially in Europe,” said Matthew Hodgson, co-founder of the Matrix Foundation.

There are 65 “national- and international-scale” Matrix deployments being tracked in Europe, said Hodgson, who is also co-founder and CEO of Element, during a keynote presentation Wednesday at the Matrix Conference in Malmö, Sweden. He cited growing concerns that US technology suppliers could restrict access to services for political reasons, following the suspension of an International Criminal Court prosecutor’s Microsoft account last year.

There are already some notable deployments in the European public sector.

France’s Interministerial Directorate for Digital Affairs (DINUM) was an early Matrix adopter, with the protocol underpinning its messaging app, Tchap, that’s used by more than 400,000 civil servants each month. Notable deployments in Germany include BwMessenger for the German Armed Forces (Bundeswehr) and TI-Messenger in the healthcare sector.

As interest in Matrix broadens, other public sector organizations are at an earlier stage in their deployments.

European Commission’s Matrix rollout

The European Commission recently rolled out Element’s Matrix-based application, with the eventual goal of enabling secure internal communications for more than 40,000 employees.

The project began in summer 2025, with a proof of concept completed in December. The rollout of the desktop client to Commission laptops was completed in September 2026, with a mobile rollout planned.

The Commission is now working to encourage employees to use Element and gathering feedback to improve the application, said Diana Gheorghe, head of sector for Communication and Collaboration Services within the European Commission’s Digital Workplace Foundations team, during a presentation at Matrix Conference.

The aim is to improve the resilience of the Commission’s communications services and ensure business continuity. “We also wanted to have data control and ownership of the platform,” she said, while the deployment could also provide “contractual leverage” in procurement — an at-times-overlooked aspect of digital sovereignty, she added.

The deployment has presented some technical challenges, including difficulties with users finding colleagues across different servers. The Commission also opted to disable the live presence feature following performance problems.

Element is not intended as a direct replacement for Teams at this stage, however. It will instead “complement” the Commission’s existing workplace applications, Gheorghe said.

She cautioned against direct comparisons with Teams, which has broader functionality than the Matrix-based application: “It’s communication, it’s collaboration, it sits on a platform that has multiple features, so there’s no ‘one-to-one’ parity,” she said. It’s also important to manage expectations among employees accustomed to consumer messaging apps such as Signal, she said, and encourage them to assess Element on its own merits.

A recent Politico article highlighted reaction from European Commission employees to the Element rollout, which negatively compared it to Microsoft Teams.

Against the backdrop of heightened sovereignty concerns, the comparison with Teams misses the point of the deployment, said Dario Maisto, principal analyst at Forrester.

“The risk is material that an organization tomorrow morning is not able to open the Outlook solution, the Teams solution, the collaboration tools, whatever. The risk is material — it has happened already,” he told Computerworld.

“Employees should hopefully be aware of why they’re making trade-offs in terms of the applications that they’re using.”

Adoption of sovereign communications tools requires change management with support from senior leadership, rather than leaving responsibility solely to IT teams, Maisto said.

“There are some changes that you just need to push ‘top-down’ to the organization. This is a broader strategic problem,” he said. “This is not an IT problem, this is a board-level decision.”

Kenneth Edwall, an IT architect within Försäkringskassan, the Swedish Social Insurance Agency, said gaining greater control over communications matters more than matching the features of established applications.

“The idea is not that these solutions need to be exactly like Microsoft Teams,” he told Computerworld. “That’s not the driver — it’s the sovereignty part. Then we can live with not having the latest, coolest feature, because that’s not the driver.”

He acknowledged that there will inevitably be some resistance to new technology from employees that are accustomed to established tools such as Teams, Zoom, or Slack. At the same time, sovereign applications can make life easier for employees by removing uncertainty about whether a tool is appropriate for sharing sensitive information.

“I would say most users prefer that they know they can use this communication tool for almost everything they do during the day. This lowers the digital stress rather than ‘okay, here I cannot send sensitive information, so then I need to go to tool number two,’” he said.

Swedish agencies explore federated messaging

As with other parts of Europe, Edwall said that digital sovereignty has quickly risen up the agenda within the Swedish public sector. Försäkringskassan is a member of eSam, a program that supports digital transformation across 42 Swedish government agencies.

“I would say the last two years we have seen an increase [in interest]. We are seeing it within eSam, we see it within the healthcare of Sweden, we see it within municipalities as well,” Edwall said.

eSam is currently working with member agencies to connect Matrix-compatible applications in order to improve communiciation across government departments.

Five years ago, most eSam member agencies used Skype for Business, allowing employees at different agencies to communicate through the same platform.

But as Microsoft prepared to end support for older versions of Skype for Business, agencies began adopting a range of different applications. This raised concerns that their messaging systems would no longer be able to communicate with one another.

There are now three broad approaches among eSam members.

Many larger agencies use Teams alongside separate communications platforms for sensitive information. “They have Teams up to a certain extent and then they have a complementary solution,” Edwall said. Alternatives include messaging applications such as Element, Rocket.Chat and Mattermost, as well as videoconferencing tools such as Pexip and Jitsi.

Not all agencies have the resources or expertise to manage and maintain two platforms, however. Others have opted for sovereign communications systems rather than public-cloud services, while relying entirely on public-cloud offerings such as Teams or Zoom is less common.

Försäkringskassan’s Matrix-based SAFOS Chatt service is currently used by 19 Swedish public authorities, with interest continuing to grow, according to Edwall.

A lack of interoperability between the various applications presents potential security risks, said Edwall. When agencies use systems that cannot communicate directly, employees may need guest accounts on another agency’s platform, for example, creating governance challenges around managing access, such as when an employee leaves.

“The other thing is usability. If you are used to Rocket Chat and then you are invited as a guest in another tool, it may become a bit complicated,” Edwall said.

A recently completed proof of concept seeks to address this, with federation between two eSam member agencies running separate Matrix-compatible applications; Försäkringskassan on Element and Trafikverket on Rocket.Chat. The test demonstrated interoperability between the two applications, successfully meeting most of the project’s requirements, although some capabilities still need improvement.

eSam will publish a final report on the project in spring 2027, highlighting the work completed and providing recommendations members interested in undertaking further work to introduce federation of Matrix-compatible applications. Feedback from general directors and CIOs at eSam agencies so far has been very positive, Edwall said.

There are some questions about interoperability between applications without Matrix protocol support, he said. While it’s possible to implement “bridges” between some Matrix applications and Teams or Slack (Element no longer offers its Teams and Slack bridges to new customers), access to certain features is limited.

Other public sector organizations are also looking at federation.

For the European Commission, interoperability is one of the key reasons for using Matrix. The Commission is assessing the technical feasibility of federation across European Union institutions and member states, though no decision has been made on whether to implement it. “Federation, for us, is an unwritten story … At this point there’s no firm decision,” said Gheorghe, with considerations around security and regulations such as the GDPR.

During the Matrix Conference, Edwall participated in a live federation demo that connected Matrix applications at the Commission, France’s DINUM, Sweden’s Försäkringskassan, NATO, and the authority for Germany’s state of Schleswig-Holstein.  

This was a proof of concept that highlighted the potential for the federation more broadly across the European public sector.

Such a project is realistic from a technical perspective, said Edwall, as eSam’s work has demonstrated. “It’s only a few firewalls away to France and Germany, so it’s the same approach, the same philosophy. I think the challenge is going to be maybe, first of all, who should interoperate with each other and how open should it be and who is allowed in.”

A longer road to digital sovereignty

Interoperability is a key benefit of the Matrix protocol, said Forrester’s Maisto. “This is a huge differentiator when we talk of enterprise-scale solutions,” he said.

Maisto expects more organizations to adopt open-source sovereign tools, whether as primary or backup communications platforms. “There’s going to be more adoption, there’s going to be more awareness,” he said.

However, any change is likely to be gradual. “This is not a shift that will happen overnight,” he said. For some organizations, this could be a process that starts with a proof of concept, progressing to production deployments alongside proprietary tools, before an eventual full migration.

For those that wish to take this path, there are plenty of challenges to overcome. Not all public and private sector organizations have adequate IT resources to develop missing features or maintain open-source applications, for instance.

Then there are the existing investments in applications such as Teams. Many organizations invested heavily in migrating to cloud communications platforms during the Covid-19 pandemic, with some projects still underway. “If I’m still amortizing the cost of those migrations, those upgrades, those deployments, I’m not going to get started on a €10 million project anew,” Maisto said.            

He also pointed out that communications applications are just one part of a larger digital sovereignty challenge for organizations. “If I’m using the Microsoft productivity suite for everything else, how much does it help adding just the communication tool on a sovereign platform?” Maisto said.

“This is not just implementing an alternative to Teams. This is discovering a whole new world in terms of tools that have to be deployed. If we start thinking in these terms, we realize it’s not a shift that we can do overnight.”

Ensuring communications systems can continue operating is an important part of business continuity and makes sense for organizations to address, said Maisto. “It’s a great place to start. Just be mindful that if you start there, there might be a lot more to consider very soon.”

American clinical laboratory company Quest Diagnostics disclosed that patient records have been exposed after a threat actor gained unauthorized access to its Quanum LSM system. [...]

OpenClaw, the AI digital assistant, is looking to establish itself as an essential tool for users — but if it is as profligate in its use of tokens as its creator, Pete Steinberger, then users could be in for some huge usage bills.

Steinberger, now working for OpenAI, spent $10 million on AI tokens there last month, he told Cloudflare CEO Dane Knecht at the Cloudflare Connect 2026 Conference in San Francisco.

The conversation was reported by The Register, which noted Knecht’s remark that Steinberger had “a virtually unlimited token budget, which not all of us in the room have,” and Steinberger’s response, “What people don’t always understand is not all of that is useful.”

Steinberger went on to question the adequacy of companies’ infrastructure, musing, “Why is this still using my computer? Shouldn’t this all be in the cloud?”

Adding cloud costs into the equation, as well as shoving privacy issues to one side would not reassure the audience.

This was scarcely a conversation to reassure those CFOs who were getting palpitations about the real cost of AI tokens, whether this was the best way to introduce AI into the system and whether there are better ways of managing costs. However, such dizzying heights of spending may be music to the ears of Steinberger’s employer as it prepares for its upcoming IPO.

This article first appeared on InfoWorld.

The PHP security team has shared mitigation measures for a new remote code execution vulnerability that affects systems with non-default configurations and has no patch. [...]

A judge in New Mexico has fined Meta $25 billion for its flouting of data privacy laws between 2010 and 2021, including its controversial passing of data to Cambridge Analytica.

The action serves as a stark reminder to enterprises not to play fast and loose with data protection legislation, as the consequences could be highly damaging.

Meta faced the court action after it was revealed that data company Cambridge Analytica had improperly obtained personal data that Facebook was holding.

It could have been even worse for Meta. Under New Mexico law, the damages could have been as high as $219 billion, which would have exceeded its revenue for 2025.

Judge Francis Mathew reduced his demand to $25 billion without explanation, but was scathing in his judgment on the social media company. “The harm in this matter is difficult to overstate, and goes to the heart of Facebook’s basic business proposition,” he wrote in his order.

The company had committed more than 43 million violations of New Mexico’s consumer protection laws and had deceived its users by giving third-party app developers access to personal information without consent.  The company is set to appeal against the judgment.

It’s been a bad couple of months for Meta. In August, the company agreed to an $18 billion settlement over claims that Facebook and Instagram failed to prevent children from accessing its platforms. And in July, another judge in New Mexico fined the company just under $1 billion for, again, failing to protect minors.

In Europe, companies are also under pressure over data protection. Last year, breaches of the General Data Protection Regulation (GDPR) rose 22%, with a record €1.2 billion in fines issued, as legislators look to get tougher on big tech companies.

AI agents can be manipulated through malicious emails, websites, and plugins into executing commands, stealing data, or deleting files using their legitimate permissions. Gen Digital explains how its Agent Trust Hub helps protect agents through skill verification, secure connectivity, and runtime controls that intercept dangerous act [...]

Cybersecurity researchers have disclosed details of a large-scale campaign that has targeted exposed network edge devices such as Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls. "Artifacts from this investigation also indicate that operators in this campaign have obtained access to numerous organizations worldwide, and have attempted to further compromise some victims, Ravie Lakshmananhttp://www.blogger.com/profile/[email protected]

Hewlett Packard Enterprise (HPE) released security updates to patch 72 vulnerabilities in the Aruba Operating System (ArubaOS), including eight maximum-severity authentication bypass and code execution issues. [...]

It seems clear by now that one of the most widely shared criticisms of the iPhone Duo picked up by many of those who got to take an early look at the device was a little unfair. 

They complained that there weren’t many third-party apps when they looked at the device. But what made that point such weak sauce was when those reviews were written.

I don’t think most developers build apps with the media reviews schedule for new hardware in mind. (Perhaps they’d get more publicity if they did.) Instead, they tend to target products at the point when people can buy them, which in the case of the iPhone Duo meant October 23.

The apps are on the way. Many landed today

After those first reviews appeared, Apple published a press release describing more than 50 apps it knows are coming for its folding smartphone. These include key streaming services Netflix, Amazon Prime, and Paramount+. They include Microsoft Office products, Zoom, Slack, and Instagram.

While not included in Apple’s release, the Omni Group has released its first iPhone Duo products, while the team behind Ulysses have already updated their much-loved pro writing app. 

“The response to iPhone Duo from our developer community has been incredible, and we’re inspired by how quickly they’ve embraced its larger display and new ways to interact,” said Susan Prescott, Apple’s vice president of Worldwide Developer Relations. While you would expect Apple’s developer lead to say something like that, it remains a polite rebuttal to some of the objections critics raised to the device.

Not every criticism is unfair

That’s not to say every criticism can be rejected. You’d expect people to find weaknesses in a product aimed at the mass market with a two-thousand-dollar price tag. It is fair to let people know that the apps aren’t available yet, but it is also appropriate to say they’re on the way.

Finding those weak spots and reporting honestly on them is exactly what gadget reviews are all about. Apple did have to make some compromises to get the product out the door. That means no Face ID and a slightly poorer camera — you won’t be purchasing the Duo for pro photography or making a movie.

What the iPhone Duo 2 might fix

You need to think about tech as a continuum. Even as you read the critics slamming the lack of Face ID support and camera choice, you can somehow already tell those limitations will become improvements Apple will introduce in just over 11 months when the iPhone Duo 2 hits stores. 

Bloomberg’s well-connected Apple reporter, Mark Gurman, claims Apple is already working on an under-display Face ID sensor, with a view to introducing it in the next version of the device. Wait for v.2 if you really want those things.

Knowing the limitations doesn’t seem to have dented the enthusiasm for the product. Crowds gathered outside Apple Stores to greet the new iPhone dawn as Apple’s iPhone Duo (briefly) hit stores worldwide. Everyone knew availability was limited, but still they came, hoping to get ahold of the device. Seeing what was coming, Apple increased its iPhone Duo manufacturing orders.

Meanwhile, Apple just seems to have sold millions of phones at an astonishing $2,000 each in the middle of a cost-of-living crisis that has knocked around 20% off the size of the global PC and smartphone markets. How on earth did it manage to achieve that?

How Apple sold millions of Duos at $2,000 each

I think it’s a mix of things.

Apple’s customer loyalty helped. Good trade in deals and Apple’s shrewd introduction of Apple Upgrade earlier this year also helped. Carriers also seem to be offering decent deals on iPhone Duo; partly because they are feeling the pain of smartphone sales slowing down and must maintain customer sign-ups to bolster revenue. 

Excitement at the new product plus the well-covered perception that Apple had few units to sell probably stimulated interest; as did the fact that the people with $2,000 to spend on a first-generation device are unlikely to be feeling the same squeeze on household budgets as the rest of us. Apple’s brand certainly helped, as did the fact we’ve been talking about foldable iPhones since around 2011.

The market was primed. The market was ready. The apps arrived when the phone did.

Now please subscribe to my daily, human-curated Apple-related news headline feed at The Core, or follow me on BlueSky, LinkedIn, or Mastodon.

SAP professionals can now renew their certifications through AI-based roleplays. The new service builds on SAP’s revamp of its certification program last year, shifting the focus from rote learning of facts towards real-world use cases.

“The evolution of Stay Certified reflects a broader shift already taking place across SAP Certification: moving beyond assessing what someone knows toward validating how they can apply that knowledge. AI-powered roleplays bring that principle into the annual certification renewal experience,” the company said in a blog post announcing the new option.

The AI-based scenarios across more than 100 certifications simulate customer interactions with a defined knowledge goal. “The scenarios are grounded in content reflecting the latest SAP product releases, helping learners demonstrate applied, up-to-date knowledge,” SAP said. Immediate feedback is provided to highlight what went well during the roleplay, and what needed improvement.

However, the use of the AI isn’t mandatory: IT pros can still choose to complete a standalone assessment quiz when renewing their certifications.

The process

Users have a 90 day renewal window before certification expiry to complete their recertification. To do so, they must have a subscription to the SAP Learning Hub, at $1452 per user per year, which provides expert-led live sessions to help prepare them, access to hands-on practice systems, four SAP certification exam attempts per year and access to “enablement and assessment to keep certifications valid.” Alternatively, SAP said, users can purchase and retake a certification exam each year.

Yet another option, being piloted at SAP TechEd in Berlin, will be an event-based approach giving eligible users the ability to fulfill their Stay Certified requirement via on-site, hands-on sessions.

A move in the right direction

Analysts are guardedly impressed with the revised approach.

“I think SAP is moving in the right direction, and the ERP industry could have addressed this sooner,” said Robert Kramer, managing partner at KramerERP. “With cloud, AI and automation advancing at their current pace, traditional certification models are struggling to keep up. Knowing the software is one thing. Understanding how to apply it to a customer’s business is another.”

He likes the idea of AI-powered roleplays, because they move certification closer to the application. “Evaluating how someone handles a customer conversation, understands a business problem and recommends a solution is more meaningful than testing whether they memorized product features,” he said.

Frank Dickson, principal analyst at Dickson Research, agreed. The quiz-based approach to renewals was inconsistent, he pointed out: “A credential earned by doing should not be maintained by answering trivia. Airline pilots do not stay current by retaking a written test. They go back into the simulator. That is the right model for cloud software that changes constantly.”

Valence Howden, an advisory fellow at Infotech, added, “SAP’s revised approach to certification is a positive step and a good idea, although it’s not a new or novel approach. In-room and virtual confirmation of the ability to apply training beyond the exam has existed in the industry for a long time, from Cisco certifications a few decades ago to ITIL and other frameworks where top-level certification created scenarios to be solved and addressed in order to validate the ability to apply learning.”

So, he said, “SAP has taken an old but valuable method that will improve the value of their certification, the value of those who achieve it, and provide some assurance around their skills for those who hire them.”

Sanchit vit Gogia, principal analyst at Greyhound Research, agreed. “The AI roleplay is not new to SAP certification,” he said. “It arrived in first-time exams a year ago. What is new is that it has reached renewal, across more than a hundred certifications, and renewal is where SAP’s installed base lives.”

But, he said, “The deeper question is who comes to own the definition of competence, because SAP supplies the AI that helps the consultant, plays the customer, and assesses the exchange. That is the part history will weigh.”

Questions remain

While Kramer approves of the model, he still has reservations about the new testing regime. “A successful roleplay doesn’t necessarily make someone a capable consultant,” he said. “ERP implementations are rarely textbook exercises. They involve decades of customer processes, customizations, industry requirements, questionable data and competing business priorities. Sometimes the best recommendation is not to implement the latest capability, but to address the customer’s readiness first.”

And, he added, “there’s also the question of governance and accountability. Who decides what counts as a correct response? How are assessments validated? What happens when the AI gets it wrong? These questions matter when professional credentials and customer confidence are at stake.”

Dickson, too, has concerns. “The umpire is now an algorithm. Every roleplay is graded by AI, so the strike zone has to be the same for every batter,” he said. “SAP has not said how scoring is calibrated, audited, or appealed. Two consultants giving the same answer should get the same result. Staying certified also requires an SAP Learning Hub subscription, according to SAP’s own FAQ. SAP sells the training and grades the test. That makes transparency on scoring more important, not less.”

SAP is right to test whether certified people can still apply what they know, he noted, and the roleplay is a good simulator. “But a simulator still needs a fair, transparent grader,” he said.

He also has questions about the testing methodology. “Last fall’s exams allowed candidates to use AI tools,” he said. “The announcement does not say what is permitted during a roleplay. If AI assistance is allowed, the roleplay partly measures how well someone works with an assistant. That may be perfectly fine. SAP should simply say so.”

Kramer, too, is looking for more detail. “I support the direction, but I would recommend SAP provide metrics that AI-powered certification produces better professionals, not just a more efficient certification process,” he said. “If it does, this could help close the ERP adoption gap.”

This article first appeared on CIO.

PHP has warned of another way an attacker could run code on a web server, two days after it shipped emergency fixes for the critical PHP2Shell flaws. The new issue, assigned CVE-2026-115560, affects only web applications configured in an unusual way, and PHP considers it an unlikely risk.The project is not issuing an emergency fix for it. Instead, it recommends turning off a feature called Swati Khandelwalhttp://www.blogger.com/profile/[email protected]

The Russian state-sponsored hacking group Sandworm teamed up with another threat actor to carry out a destructive wiping attack targeting a Ukrainian logistics company last year. According to ESET, the attack involved UAC-0099 (aka Earth Sirrush) obtaining initial access to the target on July 16, 2025, via a spear-phishing email bearing a malware-laced attachment that led to the deployment ofRavie Lakshmananhttp://www.blogger.com/profile/[email protected]