Agregátor RSS

Homebrew package manager version 7.0.0 has been released with a built-in vulnerability scanner, stronger security controls, and the full release of its native BrewUI graphical interface. [...]

A browser extension called Twitch Enhanced Viewer | JeetBot, available in the official Chrome and Firefox stores, sends users' Twitch OAuth session tokens to a commercial bot service. [...]

Dnes startuje prodej headsetu Steam Frame. Počínaje dneškem se tedy můžete zapsat na seznam pro jeden z následujících modelů: Steam Frame 256 GB za 1 049 EUR a Steam Frame 1 TB za 1 279 EUR.

Hackers compromised HBO Max's official Reddit account and used it to push malicious ads that launched ClickFix attacks to infect Windows and macOS devices with information-stealing malware. [...]

Computer security researchers have identified a design flaw in modern encryption hardware that allows access to protected memory in notionally confidential computing environments. But the attacker would need physical access to the victim system. Boffins affiliated with KU Leuven, ETH Zurich, Durham University, and Google have found that scalable memory encryption hardware fails to check whether the data in memory is fresh. As a result, they've been able to devise a small hardware interposer, dubbed DDRop, that when wired to an appropriate circuit board, interferes with DDR5 write operations. Unable to tell that memory isn't fresh, a protected VM becomes vulnerable to a replay attack that uses stale, attacker-selected data. They describe their work in a paper titled, "DDRop: Active Memory Interposer Attacks on Confidential VMs by Dropping DDR5 Writes." Their attack requires physical access and so it is relevant mainly in scenarios where confidential computing guarantees have been made to tenants by cloud service providers. "DDRop uses a custom-built 'interposer': a small, custom-designed circuit board, costing under $200, that sits between the processor and a memory module," explained Jo Van Bulck, a professor in the DistriNet lab at KU Leuven, Belgium, in an email to The Register. "It corrupts commands on the high-speed DDR5 memory bus to silently drop writes to encrypted memory. The protected VM keeps computing on old data that still decrypts perfectly. We are releasing the complete interposer design as open-source hardware." The attack breaks the integrity of Intel TDX, Scalable SGX, and AMD SEV-SNP, used in trusted execution environments (TEEs). Van Bulck and colleagues Jesse De Meulemeester, Stefan Gloor, Patrick Jattke, Daniel Moghimi, David Oswald, Martin Thompson, Kaveh Razavi, and Ingrid Verbauwhede developed a proof-of-concept attack on a current Intel TDX server. "By injecting maliciously crafted secure page-table entries, we can force any protected VM into debug mode and read out its private memory in plaintext," said Van Bulck. "Furthermore, writing to critical TDX metadata structures enables forged attestation reports, so that a backdoored VM appears trusted to the remote user." Both attacks, said Van Bulck, succeed deterministically in under two minutes without crashing the machine. Several of these researchers developed a similar attack on DDR4. But Van Bulck said this is the first active interposer attack on DDR5. "DDR5’s redesigned command bus prevents the address-aliasing tricks used by Battering RAM, and until now, only considerably weaker passive attacks had been demonstrated on DDR5: TEE.fail monitors the data bus using bulky, second-hand logic analyzers that are easier to detect and require slowing the memory bus to its lowest speed to observe ciphertext patterns, which can be masked in software," he explained. DDRop differs in that it alters DDR5 bus traffic at full speed. According to Van Bulck, it's the first attack to subvert TDX's trusted management interface without exploiting a software bug. It also reduces the cost of prior interposition attacks that took an estimated $170,000 in lab equipment to perform. There's no easy fix for Intel's and AMD's current scalable memory-encryption designs, said Van Bulck, and no simple software or hardware patch that can address the root cause. "Scalable memory encryption deliberately trades cryptographic freshness (e.g., available in early Intel SGX offerings supporting only 128/256 MB of protected memory) for the ability to protect large amounts of memory in cloud systems," he said. Noting that Intel's Simon Johnson recently discussed memory-interposer attacks at an industry conference, Van Bulck said that planned mitigations like "cache line versioning" still appear to be vulnerable to DDRop. In a security bulletin released on Monday, Intel acknowledged the DDRop disclosure and said the attack is out of scope for its cloud computing threat model. The company said it is "evaluating additional architectural hardening options and detection mechanisms as part of ongoing platform security improvements…" AMD also said the attack is out of scope and no mitigation is planned. ®

OpenAI agents appear to have flooded RubyGems with malicious packages, adding to a near-daily deluge of rogue AI models engaging in potentially unlawful activity while their human creators face growing questions over responsibility for their agents’ bad behavior. A swarm of agents began uploading malware to the Ruby package registry on May 5, and flooded RubyGems with more than 2,000 malicious packages between May 11 and May 12, ultimately forcing maintainers to disable new user registration for four days. “We believe these were authored by internal OpenAI agents,” researchers Spencer Kitts, Thomas Larsen, and Sydney Von Arx said on Friday. An OpenAI spokesperson confirmed that the model maker is investigating the incident. “Based on our review, our agents used the RubyGems platform to access the internet to carry out benign tasks and retrieve public information," the spokesperson said. "We’ll continue to investigate as part of our broader review of agent activity during training and evaluation.” This same trio of researchers earlier this month said that they found evidence that OpenAI’s swarm hijacked a German wiki months before the AI agents attacked Hugging Face. As they did during the German wiki incident, the agents involved in the RubyGems abuse self-identified as being from OpenAI. Hundreds of the gems included “oai” in their name, and 15 set “oai” as their author. At least one other used “[email protected]” as the email address for contact. Also according to the researchers, more than 100 of the malicious packages followed the same exploitation path, submitting a malicious package to the public library and triggering a documentation request to force RubyDoc.info to build the package. OpenAI’s agents then used the build script to run code on RubyDoc.info, scrape targeted websites, and steal data from the documentation server by publishing another gem to the public Ruby language package registry, the researchers said. “Additionally, once the AIs got arbitrary RCE on the build environment, they would sometimes use the build environment to attempt to steal other users’ API keys (though we are unsure if they succeeded or not),” they wrote. The agentic swarm also found and attempted to exploit a zero-day CDN caching bug on May 12 that wasn’t discovered by maintainers until July. The vulnerability would have allowed the AIs to steal users’ API keys. At least six of the malicious packages, including one named slnleaker5, used this security hole, the researchers said. Most of the agentic activity happened in May. After the RubyGems team added security measures such as requiring verified emails for new signups, OpenAI’s agents resumed their efforts on June 18 and published 83 gems over three hours. While the researchers note that they don’t know whether the swarm used a shared message board to communicate, as agents did during the Hugging Face intrusions, they “suspect” the bots were coordinating and likely had some way to exchange information. The researchers also said that it’s “unclear” if or when OpenAI learned that its agents were using RubyGems to scrape publicly available data. “It seems that either their monitors failed to catch it or they did not disclose it,” the trio wrote. This seems to be the case with other recent agentic hacks traced back to OpenAI’s models going rogue during training exercises. To be fair, Anthropic’s bots have also gained unauthorized access to third-party systems over the past few months without being caught at the time by their human supervisors. In light of the increasingly apocalyptic warnings around AI - or perhaps in a self-serving attempt at regulatory capture - several of the industry’s biggest bosses over the weekend backed a collective slowdown of AI training and development, after Anthropic CEO Dario Amodei warned that future agents could become “capable of taking over the entire internet with a persistent botnet.” Meanwhile, President Trump said on Truth Social, "the only control or 'guardrails' that AI needs is a strong and smart (high IQ!) president," and claimed his administration has stopped "AI 'people' from doing bad, or potentially bad, 'things.'"® Editor's note: This story was amended post-publication with comment from OpenAI.

Researchers have disclosed a new hardware attack, called DDRop, that breaks the memory protection in Intel and AMD confidential computing by silently dropping writes to a server's memory, so the processor keeps reading old encrypted data as if it were current. The attack requires an attacker who already controls the server's software and can briefly access the machine to insert a small circuit Swati Khandelwalhttp://www.blogger.com/profile/[email protected]

An attacker was operating inside the network of 3BB, one of Thailand's largest broadband providers, and maintained remote control of internal machines using a legitimate management tool called MeshCentral, threat intelligence firm Hunt.io said. The company uncovered the intrusion by examining a server the attacker had left open on the internet, which held the attacker's own tools and a list of Swati Khandelwalhttp://www.blogger.com/profile/[email protected]

A flaw in Telegram Desktop let a bot's message plant hidden JavaScript inside chats that users exported to HTML files, security researchers at ExPatch said in a writeup published on September 12. In Telegram, the message looked ordinary, with a link button, and the script ran only when someone opened the export file in a web browser. It could then copy every message in that file to Swati Khandelwalhttp://www.blogger.com/profile/[email protected]

Nový systém sází na drobnější novinky, lepší optimalizaci a doladění funkcí • Podporovány jsou stejná zařízení jako v případě předchozí verze systému • Některé hlavní funkce však v ČR zatím nejsou dostupné

A suspected Chinese threat actor tracked as Red Heron has been attributed to the rapid exploitation of a recently disclosed security vulnerability in Gitea to compromise internet-facing instances as part of a multi-national campaign. "Red Heron scanned 1,386 Gitea instances across seven countries and maintained a separate dataset of 477 Taiwan-based systems," Acronis Threat Research Unit (TRU) Ravie Lakshmananhttp://www.blogger.com/profile/[email protected]

Alza má už čtyři ruční baterky své privátní značky Campgo. • Základní model Lookout stojí jen 299 Kč a vydrží svítit celý den. • Rebound září až na 230 metrů, má dva typy napájení a slouží i jako powerbanka.

A mass-scanning campaign targeting internet-exposed Vite development servers is attempting to steal cloud credentials and configurations from AWS and Azure deployments. [...]

WordPress has announced it's launching an automated security review for every release of a plugin before it's distributed through the WordPress.org update API so as to analyze it for potential security issues and ensure there are no risks involved. "New plugins are reviewed before they enter the directory, but updates ship continuously after that," David Perez, WordPress Official Plugin Ravie Lakshmananhttp://www.blogger.com/profile/[email protected]

While we wait to see if Apple really is experiencing huge demand for its newly introduced iPhones, today’s the day every iPhone user gets a completely new device experience, with iOS 27 rolling out internationally, along with the other members of Apple’s 27 series OS family. If you’re on the fence about installing the new release, here are 12 reasons you should upgrade today.

Speed and performance

Apple seems to have worked hard to improve speed and performance in this release. Everything feels much zippier, but where it seems most noticeable is when launching apps. Apple says these now open up to 30% faster, while AirDrop transfers are almost twice as fast as before.

Liquid Glass looks nicer

With the 20th anniversary glass iPhone waiting in the wings, Apple isn’t going to get rid of Liquid Glass. But the company is prepared to iterate the look, and iterate it has, with sharper icons, improved contrast, and a new slider control that lets you set the UI’s transparency.

Use two iPhones

iPhone Handoff lets you use one eSIM across two devices on supporting carriers. Once set up it’s remarkably easy to use — your SIM activates the moment you unlock one of your iPhones. Better still, if you use two lines on one device, you’ll find these both transfer across too.

Siri AI

We’ve been talking so much about Apple’s improved Siri that I demoted it to fourth place; that’s not a reflection on what it does, but on how often you’ll have seen how it has become so much better at understanding context. It now has a Chat GPT-like interface, a standalone app, and powerful on-screen awareness to help get things done. Sadly, many of these features aren’t available in the EU.

Notes, Calendar, Reminders

AI is everywhere, including in Reminders Smart Suggestions, which can read your Messages chats and prompt you to set reminders for agreed tasks. Notes also gains Markdown copying.

Shortcuts to imagination

You can now create a shortcut just by describing what actions you want it to take. Apple Intelligence will string a shortcut together for you, which you can then use across all your systems.

Notify Me

Safari can watch a web page and automatically let you know when it changes. That’s not the only improvement; Apple Intelligence automatically groups your open tabs into topics so related pages are easier to find.

DIY: Safari extensions

I feel like this feature hasn’t had the attention it deserved, but you can now get Apple Intelligence to build you extensions in Safari. Just tap the three-line menu on the left of the address bar, choose Describe Extension, and let the fun begin.

Smarter Photos tools

Spatial Reframing is amazing; it lets you extend backgrounds and reframe subjects using AI. The upgraded Clean Up tool removes distractions even more easily than before. 

Passwords auto-fix

Apple’s Passwords app now does an even better job of keeping your online world safe, as it can now automatically visit a website to sign in and swap a weak or compromised password for a stronger one. 

Parental control improvements

Apple has really thought about child protection. Parental controls have had a huge overhaul, including the introduction of new Ask to Browse, Ask to Buy, contact calling approval and settings to protect minors against nudity, gore, and violence. These arrive alongside new scheduling function which manages which apps kids can use during school hours, meals, or bedtime.

Maps is amazing

Maps now uses aerial imagery and vision intelligence models when you use Flyover. It makes for much more detail, and a real sense of immersion.

Mail is better

While you’ll have to wait for search indexing to complete, Mail has become faster to load with better search results and more accurate unread counts. (Though that’s a little moot for this writer, who currently has 4,719 unread emails.) Spotlight has also been improved with smarter, more relevant suggestions. 

The new operating systems are expected to be made available at around 10am PDT. One more thing? They are bound to include security updates, which you likely need. 

Please subscribe to my daily, human-curated Apple-related news headline feed at The Core, or follow me on Bluesky, LinkedIn, or Mastodon.

Vládní CERT upozorňuje na kritickou zranitelnost v GitLab Community Edition (CE) a Enterprise Edition (EE). Zranitelnost CVE-2026-85706 typu path traversal v Repository Commits API dosahuje skóre CVSS 10.0. Kvůli nedostatečnému omezení cest a chybějícímu vynucení autentizace může za určitých podmínek neautentizovaný útočník číst libovolné soubory ze serveru GitLab, a získat tak přístup k citlivým datům a konfiguraci instance.

Každý rok se těším na nový ročník NHL, ale tentokrát mám pocit, že EA Sports už opravdu neví, kam sérii posunout. NHL 27 přichází se slibovanými novinkami, které na papíře vypadají zajímavě, ale v praxi působí spíše jako drobné úpravy než skutečný krok vpřed.

IBM 350 je první pevný disk na světě, výrobce jej uvedl v září 1956. • Měřil jako dvě lednice, vážil jako auto, ale uložil méně než 4 MB. • Způsobil počítačovou revoluci, zkrátil čekání na vyhledávání z hodin na sekundy.

AI keeps showing up in the wrong places. Attackers are using it to speed up exploits, test defenses, and automate more of the job. Some models are also crossing lines on their own. That is not a great combination. The rest of the week is more familiar: old bugs still working, fresh exploit chains, exposed systems, weak defaults, and simple paths that should have been harder to abuse. A few ofRavie Lakshmananhttp://www.blogger.com/profile/[email protected]

CISA says attackers are exploiting a maximum-severity GitLab flaw that lets unauthenticated miscreants read arbitrary files from vulnerable servers after the code shack released fixes on September 10. The US Cybersecurity and Infrastructure Security Agency has added CVE-2026-85706 to its Known Exploited Vulnerabilities catalog. The vulnerability is a path traversal bug in the repository commits API affecting GitLab Community Edition and Enterprise Edition. GitLab rates it a perfect 10.0, the maximum score on the CVSS v3.1 severity scale. Under certain conditions, an attacker doesn't need to log in before abusing the flaw to read arbitrary files from the GitLab server. GitLab blamed the problem on improper path confinement combined with missing authentication enforcement in the affected API. That's not an especially comforting combination on a platform that can be stuffed with source code, configuration files, and credentials. GitLab shipped fixes on September 10 in versions 19.3.2, 19.2.6 and 19.1.8, and urged operators of affected self-managed installations to upgrade immediately. The bug affects versions from 18.7 before 19.1.8, the 19.2 branch before 19.2.6, and 19.3 before 19.3.2. GitLab.com is already patched, while GitLab Dedicated customers don't need to take action. Security outfit watchTowr said over the weekend that it was observing probes for CVE-2026-85706 in the wild. The firm warned that widespread exploitation was likely to follow quickly. According to watchTowr, exploiting the flaw can be as simple as sending a single HTTP request, potentially allowing an attacker to get at local files, configuration data, credentials and other secrets. The firm advised organizations running internet-facing self-hosted GitLab instances to patch them or pull them from public access. Admins investigating potential exploitation attempts should check logs for HTTP POST requests to /api/v4/projects/{id}/repository/commits/ containing file.path parameters, watchTowr said. "These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise," CISA said. "While BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities." For exposed, unpatched installations, that upgrade belongs on today's to-do list. ®