Kategorie

A new UEFI bootkit named BlackX, deployed in an espionage campaign in early 2026, exploited the old Baton Drop vulnerability to bypass Secure Boot and load a malicious driver designed to interfere with security solutions from Kaspersky and Avast. [...]

A memory-corruption flaw in Google's Brotli decoder sits in many programs that unpack Brotli-compressed data, among them Bun, the Python Brotli and brotlicffi packages, and Envoy proxies set up to decompress Brotli. Tracked as CVE-2026-111497, the flaw allows crafted compressed data to overwrite past the end of a buffer and corrupt a program's memory, potentially Swati Khandelwalhttp://www.blogger.com/profile/[email protected]

LiteLLM on Friday revealed that an Agent Platform master key accidentally published to a public GitHub repository in late May 2026 ultimately allowed the threat actor to push a malicious version of the popular Python package. "On May 27, 2026, a configuration file was committed to the public LiteLLM-Labs/lite-harness repository which inadvertently contained the master key to a deployment of Ravie Lakshmananhttp://www.blogger.com/profile/[email protected]

Google has updated its privacy policy to spell out that using personalized artificial intelligence (AI) features in Search or Gemini could allow the company to serve targeted ads to users based on their activity on other connected Google services. "You may choose to allow certain Google services, including services like Search or Gemini Apps, to access data from other Google services you use,Ravie Lakshmananhttp://www.blogger.com/profile/[email protected]

Between November 2025 and March 2026, the Dutch security firm Eye Security pushed more than 2 million updates to computers it did not own to switch off a background updater that it said could have allowed an outsider to take over the machine. The updater belongs to Time4Popcorn, an abandoned copy of Popcorn Time, a free app that streamed pirated films and TV over BitTorrent. Popcorn Time was Swati Khandelwalhttp://www.blogger.com/profile/[email protected]

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two vulnerabilities impacting Collabora Online Built-in CODE Server and Arista VeloCloud Orchestrator (VCO) to its Known Exploited Vulnerabilities (KEV), citing reports of active exploitation in the wild. The critical-severity vulnerabilities are listed below - CVE-2026-110447 (CVSS score: 9.2) - An operating Ravie Lakshmananhttp://www.blogger.com/profile/[email protected]

Start Linux server monitoring with the checks you would otherwise make by hand.

Plan Linux log management around the records needed to investigate a break-in or an unauthorized change.

Researchers remotely disabled a vulnerable updater in the abandoned Time4Popcorn app, a fork of the Popcorn Time BitTorrent client, closing a security flaw that could have allowed attackers to execute malicious code with elevated privileges on millions of computers. [...]

Microsoft has announced plans to add AI-powered phishing detection to Teams messages starting in early November 2026. [...]

Diplomatic organizations in Central Asia have been targeted by a sophisticated new Unified Extensible Firmware Interface (UEFI) bootkit called BlackX. The activity, which singled out diplomatic entities in Tajikistan, Uzbekistan, and Turkmenistan in early 2026, is suspected to be orchestrated by a China-linked state-sponsored hacking group known as APT41, Kaspersky said in a technical report Ravie Lakshmananhttp://www.blogger.com/profile/[email protected]

Google has an answer to some of the electricity supply problems that data center construction is causing: It has signed an agreement with energy supplier Voltus to build what it’s calling a 1-gigawatt virtual power plant, expanding on an earlier 100 megawatt deal the two signed earlier this year.

This power plant is virtual in the sense that it doesn’t generate any electricity itself, but aggregates so-called flexible grid capacity into one central resource that can be deployed at times of peak demand. This flexible capacity can be in the form of batteries or of load-shedding: asking others to temporarily stop consuming electricity by shutting down industrial processes or adjusting tens of thousands of smart thermostats at once, effectively moving their electricity usage to a time when there is less demand.

Voltus operates by offering incentives to companies to reduce their power consumption temporarily, and also offers inducements to electricity resellers that they can pass on to their customers.

The Google-Voltus deal will serve the PJM grid region, the largest power grid in the US supplying 67 million people across 13 states and Washington DC.

It’s a PR coup for Google, as increased demand for electricity for its new data centers and those of other hyperscalers is pushing up prices. The additional load is also straining local infrastructure in some areas, increasing utilities’ capital costs and further increasing prices for existing electricity consumers.

Hyperscalers are getting decidedly twitchy about citizens’ reactions to their secretive data center construction plans, and are looking for ways to de-escalate some of the conflicts.

Earlier this month, Amazon announced its Data Center Commitment which, among other things, would disclose more information about energy and water use and consider a moratorium asking government officials to sign non-disclosure agreements covering their planning applications.

Amazon is not alone in this. Earlier this week, Meta said that it was reviewing its use of NDAs after the company was widely criticized for its secrecy in proposing Hyperion, a Louisiana data center in July.

Microsoft was an early pacesetter here, announcing in March that it would “cease to use NDAs as a tool in its data center site selection and development.” Google has since followed suit.

The action of the hyperscalers will be seen as a sign that the rise in protests against data center construction are beginning to have an effect. We have already seen major projects being delayed and we can probably expect to see greater campaigns against data centers as their electricity consumption rises further and as they use more and more water. We are beginning to see initiatives to cut the way that water is being used, to meet these objections head on.

It is unclear whether the hyperscalers’ efforts to be more open about their plans and greater efforts to seek renewable energy sources will assuage the anger against new data center plans. The backlash against them may just be too great.

This article first appeared on Network World.

Ruby has released versions 4.0.9, 3.4.12, and 3.3.13 to fix three bugs in Onigmo, the regular expression engine built into the language. The bugs lie behind four critical security flaws that GitLab patched over the past month. GitLab found that a specially crafted pattern could corrupt memory while Ruby compiles it, potentially leading to code execution on its own servers. Ruby says any Swati Khandelwalhttp://www.blogger.com/profile/[email protected]

Cybersecurity researchers have discovered an artificial intelligence (AI)-driven intrusion ecosystem run by affiliates of the INC and The Gentlemen ransomware groups. Central to the operation is an "Autonomous Red Team Kill Chain Framework" referred to as Phantom. The threat actor is assessed to be Russian-speaking and functions both as an intrusion and data-extortion operator, as well as an Ravie Lakshmananhttp://www.blogger.com/profile/[email protected]

Microsoft says Windows Server 2016 will stop receiving security updates after it reaches the end of support in January 2027. [...]

Matrix-based messaging tools are gaining traction among European governments that seek to gain greater control over sensitive communications data and lessen their reliance on US technology suppliers.

The growing interest reflects a broader push toward open-source applications in Europe amid geopolitical uncertainty. Yet the costs and complexity of replacing established applications such as Microsoft Teams mean any shift away from proprietary software is likely to be gradual, with some organizations choosing to run Matrix-based tools alongside existing platforms.

Launched in 2014, Matrix is an open messaging standard for decentralized communications. Similar to email, the standard allows users to send messages between Matrix-compatible apps from different software vendors, including the open-source Element, Rocket.Chat, and Automattic’s Beeper.

Matrix began as an “interesting experiment” in creating a communications standard for the wider internet, but has since become “the poster child for digital sovereignty, especially in Europe,” said Matthew Hodgson, co-founder of the Matrix Foundation.

There are 65 “national- and international-scale” Matrix deployments being tracked in Europe, said Hodgson, who is also co-founder and CEO of Element, during a keynote presentation Wednesday at the Matrix Conference in Malmö, Sweden. He cited growing concerns that US technology suppliers could restrict access to services for political reasons, following the suspension of an International Criminal Court prosecutor’s Microsoft account last year.

There are already some notable deployments in the European public sector.

France’s Interministerial Directorate for Digital Affairs (DINUM) was an early Matrix adopter, with the protocol underpinning its messaging app, Tchap, that’s used by more than 400,000 civil servants each month. Notable deployments in Germany include BwMessenger for the German Armed Forces (Bundeswehr) and TI-Messenger in the healthcare sector.

As interest in Matrix broadens, other public sector organizations are at an earlier stage in their deployments.

European Commission’s Matrix rollout

The European Commission recently rolled out Element’s Matrix-based application, with the eventual goal of enabling secure internal communications for more than 40,000 employees.

The project began in summer 2025, with a proof of concept completed in December. The rollout of the desktop client to Commission laptops was completed in September 2026, with a mobile rollout planned.

The Commission is now working to encourage employees to use Element and gathering feedback to improve the application, said Diana Gheorghe, head of sector for Communication and Collaboration Services within the European Commission’s Digital Workplace Foundations team, during a presentation at Matrix Conference.

The aim is to improve the resilience of the Commission’s communications services and ensure business continuity. “We also wanted to have data control and ownership of the platform,” she said, while the deployment could also provide “contractual leverage” in procurement — an at-times-overlooked aspect of digital sovereignty, she added.

The deployment has presented some technical challenges, including difficulties with users finding colleagues across different servers. The Commission also opted to disable the live presence feature following performance problems.

Element is not intended as a direct replacement for Teams at this stage, however. It will instead “complement” the Commission’s existing workplace applications, Gheorghe said.

She cautioned against direct comparisons with Teams, which has broader functionality than the Matrix-based application: “It’s communication, it’s collaboration, it sits on a platform that has multiple features, so there’s no ‘one-to-one’ parity,” she said. It’s also important to manage expectations among employees accustomed to consumer messaging apps such as Signal, she said, and encourage them to assess Element on its own merits.

A recent Politico article highlighted reaction from European Commission employees to the Element rollout, which negatively compared it to Microsoft Teams.

Against the backdrop of heightened sovereignty concerns, the comparison with Teams misses the point of the deployment, said Dario Maisto, principal analyst at Forrester.

“The risk is material that an organization tomorrow morning is not able to open the Outlook solution, the Teams solution, the collaboration tools, whatever. The risk is material — it has happened already,” he told Computerworld.

“Employees should hopefully be aware of why they’re making trade-offs in terms of the applications that they’re using.”

Adoption of sovereign communications tools requires change management with support from senior leadership, rather than leaving responsibility solely to IT teams, Maisto said.

“There are some changes that you just need to push ‘top-down’ to the organization. This is a broader strategic problem,” he said. “This is not an IT problem, this is a board-level decision.”

Kenneth Edwall, an IT architect within Försäkringskassan, the Swedish Social Insurance Agency, said gaining greater control over communications matters more than matching the features of established applications.

“The idea is not that these solutions need to be exactly like Microsoft Teams,” he told Computerworld. “That’s not the driver — it’s the sovereignty part. Then we can live with not having the latest, coolest feature, because that’s not the driver.”

He acknowledged that there will inevitably be some resistance to new technology from employees that are accustomed to established tools such as Teams, Zoom, or Slack. At the same time, sovereign applications can make life easier for employees by removing uncertainty about whether a tool is appropriate for sharing sensitive information.

“I would say most users prefer that they know they can use this communication tool for almost everything they do during the day. This lowers the digital stress rather than ‘okay, here I cannot send sensitive information, so then I need to go to tool number two,’” he said.

Swedish agencies explore federated messaging

As with other parts of Europe, Edwall said that digital sovereignty has quickly risen up the agenda within the Swedish public sector. Försäkringskassan is a member of eSam, a program that supports digital transformation across 42 Swedish government agencies.

“I would say the last two years we have seen an increase [in interest]. We are seeing it within eSam, we see it within the healthcare of Sweden, we see it within municipalities as well,” Edwall said.

eSam is currently working with member agencies to connect Matrix-compatible applications in order to improve communiciation across government departments.

Five years ago, most eSam member agencies used Skype for Business, allowing employees at different agencies to communicate through the same platform.

But as Microsoft prepared to end support for older versions of Skype for Business, agencies began adopting a range of different applications. This raised concerns that their messaging systems would no longer be able to communicate with one another.

There are now three broad approaches among eSam members.

Many larger agencies use Teams alongside separate communications platforms for sensitive information. “They have Teams up to a certain extent and then they have a complementary solution,” Edwall said. Alternatives include messaging applications such as Element, Rocket.Chat and Mattermost, as well as videoconferencing tools such as Pexip and Jitsi.

Not all agencies have the resources or expertise to manage and maintain two platforms, however. Others have opted for sovereign communications systems rather than public-cloud services, while relying entirely on public-cloud offerings such as Teams or Zoom is less common.

Försäkringskassan’s Matrix-based SAFOS Chatt service is currently used by 19 Swedish public authorities, with interest continuing to grow, according to Edwall.

A lack of interoperability between the various applications presents potential security risks, said Edwall. When agencies use systems that cannot communicate directly, employees may need guest accounts on another agency’s platform, for example, creating governance challenges around managing access, such as when an employee leaves.

“The other thing is usability. If you are used to Rocket Chat and then you are invited as a guest in another tool, it may become a bit complicated,” Edwall said.

A recently completed proof of concept seeks to address this, with federation between two eSam member agencies running separate Matrix-compatible applications; Försäkringskassan on Element and Trafikverket on Rocket.Chat. The test demonstrated interoperability between the two applications, successfully meeting most of the project’s requirements, although some capabilities still need improvement.

eSam will publish a final report on the project in spring 2027, highlighting the work completed and providing recommendations members interested in undertaking further work to introduce federation of Matrix-compatible applications. Feedback from general directors and CIOs at eSam agencies so far has been very positive, Edwall said.

There are some questions about interoperability between applications without Matrix protocol support, he said. While it’s possible to implement “bridges” between some Matrix applications and Teams or Slack (Element no longer offers its Teams and Slack bridges to new customers), access to certain features is limited.

Other public sector organizations are also looking at federation.

For the European Commission, interoperability is one of the key reasons for using Matrix. The Commission is assessing the technical feasibility of federation across European Union institutions and member states, though no decision has been made on whether to implement it. “Federation, for us, is an unwritten story … At this point there’s no firm decision,” said Gheorghe, with considerations around security and regulations such as the GDPR.

During the Matrix Conference, Edwall participated in a live federation demo that connected Matrix applications at the Commission, France’s DINUM, Sweden’s Försäkringskassan, NATO, and the authority for Germany’s state of Schleswig-Holstein.  

This was a proof of concept that highlighted the potential for the federation more broadly across the European public sector.

Such a project is realistic from a technical perspective, said Edwall, as eSam’s work has demonstrated. “It’s only a few firewalls away to France and Germany, so it’s the same approach, the same philosophy. I think the challenge is going to be maybe, first of all, who should interoperate with each other and how open should it be and who is allowed in.”

A longer road to digital sovereignty

Interoperability is a key benefit of the Matrix protocol, said Forrester’s Maisto. “This is a huge differentiator when we talk of enterprise-scale solutions,” he said.

Maisto expects more organizations to adopt open-source sovereign tools, whether as primary or backup communications platforms. “There’s going to be more adoption, there’s going to be more awareness,” he said.

However, any change is likely to be gradual. “This is not a shift that will happen overnight,” he said. For some organizations, this could be a process that starts with a proof of concept, progressing to production deployments alongside proprietary tools, before an eventual full migration.

For those that wish to take this path, there are plenty of challenges to overcome. Not all public and private sector organizations have adequate IT resources to develop missing features or maintain open-source applications, for instance.

Then there are the existing investments in applications such as Teams. Many organizations invested heavily in migrating to cloud communications platforms during the Covid-19 pandemic, with some projects still underway. “If I’m still amortizing the cost of those migrations, those upgrades, those deployments, I’m not going to get started on a €10 million project anew,” Maisto said.            

He also pointed out that communications applications are just one part of a larger digital sovereignty challenge for organizations. “If I’m using the Microsoft productivity suite for everything else, how much does it help adding just the communication tool on a sovereign platform?” Maisto said.

“This is not just implementing an alternative to Teams. This is discovering a whole new world in terms of tools that have to be deployed. If we start thinking in these terms, we realize it’s not a shift that we can do overnight.”

Ensuring communications systems can continue operating is an important part of business continuity and makes sense for organizations to address, said Maisto. “It’s a great place to start. Just be mindful that if you start there, there might be a lot more to consider very soon.”

American clinical laboratory company Quest Diagnostics disclosed that patient records have been exposed after a threat actor gained unauthorized access to its Quanum LSM system. [...]

OpenClaw, the AI digital assistant, is looking to establish itself as an essential tool for users — but if it is as profligate in its use of tokens as its creator, Pete Steinberger, then users could be in for some huge usage bills.

Steinberger, now working for OpenAI, spent $10 million on AI tokens there last month, he told Cloudflare CEO Dane Knecht at the Cloudflare Connect 2026 Conference in San Francisco.

The conversation was reported by The Register, which noted Knecht’s remark that Steinberger had “a virtually unlimited token budget, which not all of us in the room have,” and Steinberger’s response, “What people don’t always understand is not all of that is useful.”

Steinberger went on to question the adequacy of companies’ infrastructure, musing, “Why is this still using my computer? Shouldn’t this all be in the cloud?”

Adding cloud costs into the equation, as well as shoving privacy issues to one side would not reassure the audience.

This was scarcely a conversation to reassure those CFOs who were getting palpitations about the real cost of AI tokens, whether this was the best way to introduce AI into the system and whether there are better ways of managing costs. However, such dizzying heights of spending may be music to the ears of Steinberger’s employer as it prepares for its upcoming IPO.

This article first appeared on InfoWorld.

The PHP security team has shared mitigation measures for a new remote code execution vulnerability that affects systems with non-default configurations and has no patch. [...]