Agregátor RSS

Společnost System76 představila kompaktní 11litrový Thelio Prime Desktop. S procesorem AMD Ryzen 9000. S Pop!_OS 24.04 LTS s desktopovým prostředím COSMIC nebo Ubuntu 24.04 LTS.

Everyone wants to know what Anthropic is up to, and hackers are gleefully exploiting the fact.

New research from cybersecurity company Cofense describes a phishing campaign that hooks overeager enterprise users by making them think they are getting an invite to a private invite-only Anthropic preview.

In reality, adversarial actors are trying to steal Google and Microsoft login credentials, exploiting video teleconferencing software GoTo Webinar branding to do so.

“It sells exclusivity,” said Frank Dickson of Dickson Research. “Fear of missing out is the oldest lure in the book.”

Every organization is trying to figure out where AI fits, he noted, and a private preview of Anthropic’s newest technology is exactly the invitation an ambitious employee would want to accept. “The attackers did not pick Anthropic at random,” he said. “They picked whatever is hottest in the news cycle. Next month, it may be another name.”

How attackers lure users with spoofed Anthropic invites

GoTo Webinar is a widely used platform, and its meeting invitation emails are typically not blocked by security tools. The Cofense researchers found that attackers are exploiting this fact by sending what seems to be an invitation email from a legitimate sender; when users click on the link to register for the fake webinar, they are instead sent to a compromised URL.

The email offers what the researchers call a “tantalizing” offer: “This private, invitation-only virtual session brings together a select group of participants to a focused conversation on AI systems, research, and the future of frontier models,” it reads.

A URL shortener circumvents email security tools, and the attackers use subdomains and dashes (-) to hide the malicious URL. The link itself appears to have been generated by Zapier, a legitimate company whose tools are designed to work with Claude, ChatGPT, and other AI compatible with Model Context Protocol (MCP).

The email sender address appears to be customercare@gotowebinar[.]com (GoTo Webinar’s website is actually www.goto.com). The text contains no obvious spelling errors, and the email contains GoTo Webinar branding. However, the researchers noted, the email sender’s name is “Austin from nthropic,” with the “A” missing.

“Although this is a small misspelling, it is still a useful warning sign,” they pointed out.

If the phishing link is clicked, a Cloudflare CAPTCHA page appears, and must be completed before the login prompt is presented. This serves as the first of two checkpoints to prevent security tools from scanning attackers’ websites.

“Because CAPTCHAs are common on legitimate websites, phishing recipients may believe all is well and everything is secure,” the researchers explained.

Once the CAPTCHA is completed, victims are led to a Zoom-spoofing invitation page. If they want to “attend” the fake event, they must register, and they are prompted to enter their work email address. When they click “Continue with Google” or “Continue with Microsoft,” yet another CAPTCHA page appears.

Both CAPTCHA pages seem to be good at detecting and blocking analysis by VPN services, scanners, Tor browsers, and other security tools, the researchers noted. Also, because there are two distinct CAPTCHA pages, such tools may not be able to follow every step in the attack.

“A CAPTCHA was built to keep bots out,” Dickson pointed out. “Here, it keeps the security scanners out and lets the victims in.”

The fake Google and Microsoft login pages differ a bit, however. The spoofed Google page does not capture passwords, only usernames, which the researchers surmise is due to a misconfiguration; the spoofed Microsoft page does collect both usernames and passwords.

But both are “remarkably similar” to their respective legitimate pages, and their subdomains are “tricky.” The fake Google URL is goo[.]gle-access-eventregister[.]icu, while the Microsoft URL closely mimics real Office and Sharepoint domains, using office[.]com-access-sharepoint[.]com.

Once credentials are submitted, neither login offers a confirmation message, nor does it redirect to legitimate vendor pages. But by that point, attackers have already succeeded at exfiltrating credentials. That means they could compromise an account, access the sensitive documents in that account, or use it as an initial attack vector to further infiltrate the enterprise, the researchers explained.

They advised checking if the branding of a message remains consistent from the email to a login page, searching for small inconsistencies such as minor misspellings, and reminding employees that both the URL and domain determine whether a login page is legitimate.

“Although the logos and design of the page may look correct, threat actors are skilled at mimicry,  especially now with the use of AI,” the researchers noted.

It’s not the employees’ fault

The AI industry’s habit of gated previews and waitlists does not help in these situations, Dickson noted; it trains people to expect exactly this kind of invitation.

“Start with the cracks the attackers left showing,” he advised: The sender supposedly came from “nthropic,” the email carried GoTo Webinar branding, the registration spoofed a Zoom meeting page, and the login pages were from Google or Microsoft. That’s three brands in three clicks, he noted.

The fake login domains, like office[.]com-access-sharepoint[.]com, are built to be skimmed, not read, he pointed out. And, while the Google page collected only usernames, which may be a configuration error, the threat actors behind this campaign will likely fix that.

“Training helps, but I would not hang the defense on an employee squinting at a URL at 4:45 on a Friday,” Dickson said; how much a stolen password is worth is a leadership decision, not a test the employee fails.

Phishing-resistant multi-factor authentication (MFA) such as passkeys makes a stolen password far less valuable, he noted. But enterprises ultimately have a short to-do list to allow them to defend themselves from this sort of scam, Dickson said:

• Verify any AI preview invitation through an account team or a known contact.
• Treat branding that changes from email to meeting page to login page as a red flag.
• Roll out phishing-resistant MFA. If someone entered credentials on one of these phishing login pages, reset them and review that account’s activity.

“Bottom line: This campaign uses trusted tools to defeat defenses built on trust,” Dickson said. “The employee should not be the last line of defense.”

This article originally appeared on CSOonline.

Elektrické výškově nastavitelné stoly Di volio pořídíte už od 2100 Kč. • Na výběr jsou různé velikosti, barvy i rohové modely se dvěma motory. • Nechybí paměť poloh, časovač ani antikolizní systém.

Čínská státní televize pozastavila vysílání španělské La Ligy a čínské internetové platformy omezily obsah s Kylianem Mbappém poté, co slavný fotbalista ve francouzském pořadu The Bridge mluvil o svém oblíbeném memu, v němž je jeho tvář vložena do portrétu zobrazujícího diktátora Mao Ce-tunga. 'Můj oblíbený mem je ten, na kterém dali můj obličej na čínského diktátora. To mě opravdu rozesmívá. S přáteli ho používám pořád' řekl, komunistického vůdce ale nijak výslovně nejmenoval. Největší čínská fotbalová platforma Dongqiudi nahradila Mbappého jméno v žebříčku Zlatého míče výrazem 'taková osoba neexistuje', Xiaohongshu (REDnote, název 'rudá knížka' je přímo odkazem na Maa) znemožnila sledování jeho účtu a oznámila mazání souvisejícího obsahu.

Following the release of the new 14-inch M6 MacBook Pro earlier this week, Apple has bought the “touch experience” to its professional laptop series, introducing a $2,899 (and up) MacBook Pro you can use with touch. It’s very fast, very thin, very light, with an impressive PROLED XDR display and up to 24 hours battery life.

A brief tour through the key specs

• Very fast: Available in 14- and 16-inch models, the new MacBook Pro uses Apple’s powerful M5 Pro and M5 Max chips. They support up to 64GB of unified memory (128GB on M5 Max) and up to 16TB of storage. Apple says the M5 Max can run LLMs with hundreds of billions of parameters entirely on-device. 
• Very thin: The 14-inch model is 0.59 inch (1.50 cm) thick, while the 16-inch is 0.63 inch (1.60 cm), so these are only a little thicker than a MacBook Air. Apple says the thinner design is a benefit of the move to an OLED display.
• Very light: The 14-inch weighs 3 pounds, half a pound less than the non-touch equivalent MacBook Pro. The 16-inch weighs 4 pounds, which is 0.7 pounds lighter. 
• Industry-leading PROLED XDR display: A tandem OLED panel with up to 2,000 nits peak brightness (1,000 nits sustained brightness) for both HDR and SDR, and a 10,000,000:1 contrast ratio. Refresh rate is variable from 10Hz up to 120Hz.
• Up to 24 hours of battery life: Apple says this is the maximum and that battery life varies by use and configuration. It also varies by model — the 14-inch yields “just” 22 hours battery life. Fast charging takes the battery to 50% in 30 minutes.

Unpacking those numbers, it’s crystal-clear Apple has not stinted on the performance of this pro Mac, with a price tag to match.

IDC data shows that 66% of all touch notebooks are purchased by enterprises. This is a form factor bought for flexibility for field workers, educators, and professionals who move between typing, tapping, and handwriting.

Touch on a Mac

Which brings me to the “touch experience.” Apple hasn’t replaced the traditional Mac interface with touch; it has instead augmented the core OS with it. Swipe to scroll a web page, pinch to zoom a photo, drag-and-drop slides between presentations, double-tap a window to fill the screen, or flick a window to tile it into place. You use touch along with trackpad gestures and keyboard shortcuts, the idea being that touch augments them.

Apple built this integration into macOS 27. It’s a physical thing. The touch sensor is built into the display panel rather than being layered above it. In use, Apple says it reduces latency, making you feel like you’re touching the content.

Apple

The other point to this integration, according to Apple, is that many existing applications will automatically work with touch as the macOS translates on-screen actions. Apple has also built APIs developers can use to create apps with touch. The company told us Microsoft Word, Excel, and PowerPoint; Adobe Lightroom; DaVinci Resolve; Blender; and Cinema 4D will be touch-enabled later this year.

At this point, Apple is evangelizing how touch can be used by creative professionals for things like playing virtual instruments, drawing and fine control of creative apps like Logic Pro or Final Cut Pro. As I see it, it’s as if the Vision Pro was on a Mac, with touch as the interface to the control plane.

It’s an integrated platform thing

When you touch your MacBook keyboard, your display wiggles a bit, but not with this Mac, as Apple has built a new hinge mechanism to keep it steady. Prior to the event, online speculation claimed this hinge was developed alongside that in the iPhone Duo.

Another borrowing from the iPhone is the inclusion of a Dynamic Island on the Mac. Spotlight, Live Activities, and Siri AI all live right there, and you can interact with them on the Mac.

The PROLED XDR display is worth an article in its own right — as is so much about this Mac. As well as built-in support for touch, it also supports Adobe RGB, P3, and DICOM medical imaging reference modes. It supports genlock for virtual production. It boasts a 10,000,000:1 contrast ratio and a variable refresh rate from 10Hz up to 120Hz. For an even better experience, there’s a nano-texture glass option on the screens, which are 14.2 and 16.3 inches diagonally. Following its first look, Tom’s Guide has already called the display “jaw-dropping.”

You also get what Apple called the best audio system in a laptop (six speakers with an all-new woofer design) and plenty of interconnects.

Apple The touch-screen laptop debate is over

“Apple is entering a segment that is gaining share in a shrinking market. IDC expects touch to reach one in five notebooks by 2030, and Apple has just made sure that buyers think about touch as a must-have,” said Francisco Jeronimo, vice president, worldwide devices at IDC in a note shared with Computerworld.

“When the company that spent 15 years arguing against touch concludes that it belongs on a notebook, the debate about whether touch is a gimmick is over, and the question becomes who builds the best implementation,” he said.

The new Macs are available for order now and will be available from November 6. They aren’t cheap — the 14-inch model costs from $2,899 with the M5 Pro chip and from $4,499 with M5 Max. The 16-inch model costs from $3,399 with M5 Pro and from $4,799 with M5 Max.

Now please subscribe to my daily, human-curated Apple-related news headline feed at The Core, or follow me on BlueSky, LinkedIn, or Mastodon.

The UK’s comms watchdog has put forward four methods of checking netizens aren't kids – dubbed highly effective age assurance (HEAA) – as it prepares for the proposed under-16 social media ban. The regulator says some adults may not need to prove their over-16-ness to social media platforms that will make inferences about their age based on previous activity, but confirmed that "many" are likely to have to undergo the same verification process. Big Brother Watch's (BBW) Director Silkie Carlo said: "This plan for a government 'social media ban' is a national ID system by the back door. Both the government and Ofcom have admitted that children will get around the ban, which means the real effect will be normalizing adults and children alike to handing over their passports just to get online." Ofcom says four methods remain from the seven it initially outlined when the Online Safety Act (OSA) came into force last year. The seven were capable of verifying whether a subject was 18 years old, but there are fewer viable options for determining the age of 16-year-olds, it said today. The methods put forward include: Photo-ID matching: Checking information displayed on identity documents and analyzing the photo against a live image of the subject taken during the verification process Banking checks: An estimated 90 percent of 16-17-year-olds in the UK have a bank account, which they would have provided their identity documents to open. The information processed by the bank can be used to verify whether someone is aged 16 or older Digital ID services: An interesting entry, given how quickly these were circumvented once the OSA age-checking requirements came into force. These third-party services analyze a person’s photo once, and if it matches the age they claim to be, let them verify their age across other services Facial age estimation: A method that even Ofcom admitted isn’t quite reliable enough to be used on its own. The regulator said that online services can use technologies to analyze a subject’s facial features to determine their age. The same technologies also have a margin of error of a few years, so online services may wish to use a second method of HEAA to verify the results of this check. The three reserved for those aged 18 and above include credit card checks (only adults can have a credit card), mobile network checks (MNOs require proof of adulthood to remove content blocks), and email checks – using a subject’s email address to make educated guesses about their age based on the other types of services with which it is registered. Ofcom acknowledged that not every 16-year-old will have a form of photo ID, which is required for all four of its HEAA methods, so they will need to acquire one in order to access online services. It estimates that around 94 percent of 16-17-year-olds in the UK have a form of photo ID, such as a passport, driving licence, or an ID card certified by the Proof of Age Standards Scheme, and that around 150,000 have neither. BBW's Carlo added: "Hundreds of thousands of people without ID, who tend to be poorer people, and many more who don’t want to risk handing their passports over to foreign tech companies will be locked out of huge parts of the internet. "The plan will kill anonymity online, whilst the UK’s culture of speech policing is reaching a crisis point. The policy is painfully misguided, an Orwellian assault on free speech and privacy, and will make children no safer at all." 'Circumvention inevitable' Ofcom admitted that "the risk of circumvention cannot be entirely eliminated," as some children will find ways to bypass these age checks, no matter how fully they are implemented. It cited Australia sporadically in its announcement, a country that introduced an under-16 social media ban in December 2025, but has struggled with a large proportion of children devising ways to circumvent these checks. Ofcom said the UK government intends to adopt, but learn lessons from, Australia’s rollout, committing to implementing more robust measures that promote the ban’s aims. It said it has identified some mitigations that could be taken to counter circumvention, such as making it easier for users to report suspected underage social media users, and “using age inference models.” The regulator said it will closely monitor circumvention for the first 12 months after the ban is enforced to understand possible methods to prevent children from finding ways around the age checks. In May, nearly a year after the OSA’s age verification requirements kicked in, researchers found that the existing age checks proved largely ineffective at keeping under-18s away from adult content online. Some reported beating age checks with just a drawn-on moustache. England's Children's Commissioner, Dame Rachel de Souza, said recently that the OSA "has made absolutely no difference" to children’s ability to access potentially harmful online content. Commenting on today’s announcement, Ofcom chief exec Dame Melanie Dawes said that when the social media ban takes effect, it will take a whole-of-society approach to ensure the ban is upheld. ?This ban will shape the future of children’s lives online, so it’s important to get it right," she said. "It can work if social media firms do highly effective age checks properly, and we’ve set out ways that could be achieved. When it comes into force next year, we’ll be ready to take swift and firm action against any company that fails to comply. "We should expect that motivated children will seek to bypass the restrictions – just like alcohol laws can’t completely eradicate underage drinking – but there’ll be ways for platforms to mitigate this risk. This will be a huge cultural shift for our society, so it’ll take time to adjust, and everyone will have a part to play." The UK government is expected to outline the first set of regulations related to the under-16 social media ban by the end of the year, and Ofcom is in the process of developing draft guidance for platforms. ®

Při příležitosti oslav Dne vzniku samostatného československého státu (28. října) byly uděleny medaile Za zásluhy tvůrci aplikace Záchranka Filipu Maleňákovi, vědci v oblasti umělé inteligence Tomáši Mikolovovi a Olze Štěpánkové, vědkyni zabývající se kybernetikou, robotikou a strojovým učením, průkopnici v oblastech výuky a využití umělé inteligence v medicínském inženýrství.

OpenAI and Anthropic agree that frontier AI systems need stronger oversight, but they are proposing sharply different approaches to stopping models that pose serious risks: Anthropic wants courts empowered to suspend dangerous systems, while OpenAI argues developers should be required to maintain and use effective shutdown controls.

The proposals appear in separate submissions to California Governor Gavin Newsom following his September 18 executive order directing state officials to consider additional safeguards for frontier AI systems. Both companies support independent safety assessments and expanded reporting of incidents involving AI systems that act beyond their intended permissions.

“If the AG concludes, informed by the independent evaluation, that a frontier AI company’s models pose a near-term risk of catastrophic harm, they should be able to seek a court order to suspend a model’s deployment, internal use, or further development,” Anthropic wrote in its October 15 submission.

OpenAI, in its October 20 letter, called for an amendment to California’s Senate Bill 53 (SB 53).

“We support amending SB 53 to require frontier developers to maintain effective shutdown controls and an enforceable duty to use them when unsafe conditions arise, and no lesser intervention would adequately address the risk,” OpenAI wrote.

Sanchit Vir Gogia, chief analyst at Greyhound Research, said the two approaches address complementary needs. “The operator must contain the unsafe activity promptly. Independent review must examine both intervention and inaction,” he said.

Newsom’s executive order, N-9-26, directs California’s Government Operations Agency, in consultation with the Governor’s Office of Emergency Services and national experts, to submit recommendations by November 16 on potential amendments to existing AI safety laws. The order asks officials to examine independent verification inside AI laboratories, independent checks of safety assessments, verified shutdown mechanisms, and expanded reporting of critical safety incidents. It does not itself impose these proposed requirements.

Independent verification

Anthropic wants evaluators to assess developers’ safety claims and publish their own findings.

“We strongly support requiring independent verification of what frontier AI companies report about the risks of their models and whether those risks are sufficiently mitigated,” the company wrote.

It proposed requiring developers to publish risk reports at least every six months, covering serious risks from their models, including internally used models substantially riskier than released systems. Evaluators should receive unredacted reports and access to developers’ most capable models and relevant internal information.

Anthropic also proposed that developers pay into a state-administered pooled fund to finance evaluators, rather than pay them directly. It said a team from the independent evaluation organization METR had received employee-like access on a pilot basis, with further partnerships involving SecureBio and Accenture under development.

OpenAI, in its letter, said it supports independent technical assessments but distinguishes them from compliance audits. Technical assessments would examine evidence behind developers’ safety claims and the effectiveness of safeguards; compliance audits would check whether companies follow their published safety frameworks and legal obligations, it added.

OpenAI recommended annual independent compliance audits and focused technical assessments of serious risks arising during model training, evaluation and internal deployment. It also urged California to work with the National Institute of Standards and Technology to develop common assessment standards.

Gogia said oversight requires more than funding. “Credible assurance must survive an adverse finding,” he said.

Beyond a single switch

OpenAI argued that a single kill switch would not address the different ways AI systems operate and are deployed.

“We recommend using the term ‘shutdown controls’ because it will require the development of multiple controls and coordinated action by different actors to stop AI operations when necessary, rather than a single switch,” the company wrote in the letter.

Interventions could include stopping a training run, isolating an AI agent, revoking tool or network access, or suspending a service. OpenAI said responsibilities should extend to inference providers and downstream deployers according to the operations they control. It also noted that developers cannot reliably switch off independently operated copies of open-weight models running on external systems.

Anthropic similarly argued for more targeted safeguards. “We think a more apt metaphor for what frontier AI companies need to build is a circuit breaker,” it wrote, advocating controls that can contain problems at the level of an agent, customer, deployment environment, or model.

For enterprises, Gogia said, contractual shutdown responsibilities should match the controls each party actually possesses. Agreements should specify intervention authority, incident-reporting cooperation, and who can authorize a restart.

“Every assigned duty needs an executable control,” he said, adding that CIOs should test recovery processes rather than assume switching to an alternative model will preserve safe operations. Both companies also called for broader reporting of incidents involving models that circumvent safeguards or take unauthorized actions.

Microsoft released the KB5127936 preview cumulative update for Windows 11 versions 25H2 and 26H2, with 41 changes, including File Explorer and Cloud rebuild improvements. [...]

EXCLUSIVE Researchers identified at least 83 attacks against 61 public GitHub repositories, including popular open source projects such as Google LangExtract, Trivy, Brave browser, and MLflow, in what they suspect is a coordinated campaign to execute commands in CI/CD environments and steal credentials and access tokens. It all happened very quickly, the Radware threat hunters said in an exclusive interview with The Register. Most (77) of the malicious items were published during a 43-minute time span on September 1, with the remaining six occurring within the next two minutes. “Our guess is that the final aim was a supply-chain attack in which the attacker gains credentials for the repo, and then he has the power to change the contents – the code – as he wishes” and then push the malicious changes to others, Radware VP and researcher Gabi Nakibly told The Register. Nakibly and fellow Radware researcher Zvika Babo say they suspect a single individual is behind this supply chain campaign. This attacker used 74 different GitHub accounts, many of which had legitimate development histories, meaning they were likely compromised. "Considering that dozens of accounts posted the same type of payload, on the same day, within a narrow time window, and to the same infrastructure, it is reasonable to assess that the activity was coordinated,” the team wrote in research shared ahead of publication with The Register. A novel attack chain They discovered the campaign while investigating prompt injection in GitHub – and they told us the attack chain is part of what makes this supply-chain campaign novel, and extremely stealthy. First, the attacker publishes an issue, pull request, or comment containing malicious commands hidden in HTML comments. This ensures the content is not visible in the rendered page. Plus, a GitHub event – like a pull request or issue – can automatically trigger a workflow if the repository is configured to respond to that event, meaning the attacker can be pretty hands-off at this point. “The workflow automatically is triggered within a second, and if the workflow is indeed vulnerable, then the attack is executed successfully,” Nakibly said. The workflow incorporates attacker-controlled content directly into shell source code, and the shell executes the hidden, malicious command, which hoovers up environment variables and attempts to exfiltrate those to an attacker-controlled server. While the researchers examined logs from actual runs, and told us they found two cases containing evidence that the malicious command ran inside the automation environment, they can’t definitively say whether the attacker successfully obtained repository write permissions, modified source code, or compromised downstream software. But they're trying. “The big picture is that the attackers are trying to find every possible way to get inside the repos to get credentials,” Nakibly said. Plus, “the attacker doesn't need to compromise the repository or to have access to its codebase” to do this, Babo added. “Basically, every user with a GitHub account can try to run this attack – it's very easy to start this attack.” Which repos were affected? As of October 13, the threat hunters identified 83 GitHub items with a verified payload across 61 different repositories. The repos span AI frameworks, security tools, development infrastructure, databases, and other widely used open source software projects. The Radware report lists agno-agi/agno (42.7K stars), ToolJet/ToolJet (41.1K), google/langextract (38.9K), aquasecurity/trivy (38.4K), CopilotKit/CopilotKit (38K), and podman-container-tools/podman (33K), among the most popular. Other notable targets included QwenLM/qwen-code (28.5K), mlflow/mlflow (28.4K), discordjs/discord.js (26.8K), cilium/cilium (25.6K), brave/brave-browser (23.9K), dotnet/maui (23.3K), Homebrew/homebrew-cask (22.2K), github/docs (21K), apache/doris (16K), and PX4/PX4-Autopilot (12.8K). “These projects are used by thousands of organizations," Babo said. The researchers disclosed their findings to all of the projects’ maintainers, and most of the repositories were closed or fixed, but they can’t confirm that all of them were. This campaign follows several earlier supply chain attacks against open source security and dev tools as attackers increasingly look for new methods to steal credentials and other secrets. “There is no way to stop the attackers from attempting,” Nakibly said. “The only way is to make sure that the workflow code is resilient, and not vulnerable to such attacks." The researchers recommend applying least-privilege access to CI/CD workflows, and separating as much as possible workflows triggered by external events from jobs with elevated permissions. “Developers should treat external content as untrusted, and also limit the secrets and environment variables that are available to the workflow,” Babo said. ®

Security teams have spent years trying to detect threats faster. AI is changing the harder part: how much time defenders have left to act. Advanced AI models can now help attackers discover vulnerabilities, generate exploit code, and move through weaknesses faster than traditional security processes were built to handle. The challenge is no longer just finding another vulnerability or [email protected]

A flaw in Telegram for Android could be chained with two other bugs to take full control of a victim's phone through a voice call, once the victim answered, according to security startup NebuSec. The attacker needed only an ordinary Telegram account. Telegram fixed the flaw in version 12.10.4 of the app, released in late September, and NebuSec disclosed it on October 29. Combined with anSwati Khandelwalhttp://www.blogger.com/profile/[email protected]

AI is beginning to take over much of the work that has traditionally defined the security analyst's job. Investigating alerts, collecting evidence, correlating activity across tools, and executing response actions are becoming tasks that AI systems can perform on their own. As these capabilities mature, security operations centers (SOCs) will see major changes in how work is organized, how [email protected]

26,400 credentials that developers left in public code on Gitee, a Chinese code-hosting service, still worked when a researcher tested them. Anyone who copied one from that code could have used it. Independent researcher Ben Zimmermann found them by scanning 7.25 million public Gitee repositories and reported the results on October 28. Most were keys for cloud and AI services, led by Swati Khandelwalhttp://www.blogger.com/profile/[email protected]

V rámci posledního Next Festu na Steamu jsme si zahráli i novinku od tvůrců Forgotten but Unbroken. Opět se vrhneme do boje v tahových bitvách, ale druhou světovou zde vystřídá doba moderní a boj proti drogovým kartelům. Je vidět, že tvůrci mají s žánrem již patřičné zkušenosti, ale jistá lacinost ...

Cisco released security updates to patch a denial-of-service zero-day in Adaptive Security Appliance (ASA) and Threat Defense (FTD) software that attackers are exploiting to remotely crash vulnerable firewall devices. [...]

Váží jen 60 miligramů, nemají baterii a nepotřebují GPS. Přesto dokážou vědcům prozradit, kudy monarchové stěhovaví putují napříč Severní Amerikou. Miniaturní vysílače BlūMorpho využívají solární energii a rádiové signály, které mohou zachytávat i běžné chytré telefony.

Poláci směle pokračují ve výstavbě dálniční sítě. Jejich obdoba našeho ŘSD – Generalna Dyrekcja Dróg Krajowych i Autostrad (GDDKiA) – se před pár dny pochlubila pokrokem na rychlostní silnici S19, která v délce 570 kilometrů protne zemi od severu až ke slovenským hranicím. V úseku Babica-Jawornik ...

Cisco has released patches to address a high-severity security flaw in Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software that it said has been exploited in the wild. The vulnerability, tracked as CVE-2026-76418, is rated 8.6 on the CVSS scoring system. Successful exploitation could allow an unauthenticated, remote attacker to cause the Ravie Lakshmananhttp://www.blogger.com/profile/[email protected]