Agregátor RSS

Quad9, švýcarský celosvětově působící neziskový poskytovatel DNS, od 24. listopadu 2026 ukončí své služby ve Francii kvůli soudnímu sporu s katarskou televizní stanicí beIN. Ta požadovala blokování domén, které podle ní nelegálně zpřístupňují sportovní přenosy. Francouzský soud Katarům vyhověl a nařídil (🇫🇷, PDF) Quad9 blokaci zavést, pod hrozbou pokuty 1000 eur denně. Provozovatel příkaz odmítá s tím, že blokace na úrovni DNS resolverů samotný pirátský obsah nijak neodstraňuje, zato může vytvořit nebezpečný precedent pro státní cenzuru Internetu. Proti rozhodnutí se odvolal a místo zavedení požadovaných blokací raději odejde z Francie.

A critical flaw dubbed 'HTTP2Shell' in Brotli, the C decoder library built into Node.js, could allow attackers to corrupt memory and access sensitive data. [...]

Název aplikace v Google Play už dávno není něco, na co se dá spolehnout • Falešné aplikace přesto můžete relativně spolehlivě odhalit • Stačí si všímat těchto pěti detailů

A UK-based developer and pentester has claimed a $2,000 Bitcoin prize for demonstrating the exploitability of the PHP2Shell vulnerabilities that melted the internet last week. Jaydip Modhwadia, 26, otherwise known as “Killa,” claimed the prize set by James Pavur, who launched the "Steal My Bitcoin" site on October 24. Pavur launched the CTF (capture the flag) challenge to prove that the PHP2Shell exploit was not as easy as those in the cybersecurity community claimed it to be, promising to award $2,000 in Bitcoin to anyone who could achieve Remote Code Execution (RCE) on his website. "My Bitcoin was stolen after 19.28 hours," the website now says, after Modhwadia claimed the prize, although the real time taken is thought to be less than three hours. Soon after Pavur launched the CTF on Saturday, prospective flag-catchers complained that the website he set up, which served only static HTML, was not built in a way that allowed the PHP2Shell exploit to achieve RCE. The web page was running a vulnerable version of PHP, but the exploit path required a vulnerable website to serve a PHP file for flag-catchers to use as a hook – something that Pavur seemingly updated at around 1300 UTC on October 25. Modhwadia achieved RCE on the website, exposing a PHP endpoint, at 1547 UTC. After an error from Pavur placing the wrong wallet key on the server, the CTF creator sent Modhwadia his award, which the community upped to $2,000 from Pavur’s initial $500. The pentester published a write-up of his method, a single-file Python script he says requires 20 HTTP requests "at most" to fully execute. Speaking to The Register, Modhwadia also confirmed that he got the flag in "around three or so hours in total." He said he followed the news about the competition, "but didn't attempt it until it gained significant notice." If he had attempted it before Pavur introduced the endpoint, he may have struggled. For hours, bug bounty hunters were trying to access the website to attempt the challenge, as news of the CTF had exploded across tech circles. "The fact that it took 19 hours was because after it went popular, the entire site became basically unusable for anyone at all," Modhwadia added. The challenge saw a huge number of attempts, despite Pavur's decision to introduce a prohibitive 1MB request limit on Nginx. Alon Gal, co-founder and CTO at Hudson Rock, commended Modhwadia's work, but added that his success achieved in just a few hours should not be taken to mean that the same attack could be automated at scale. He said: "Does this mean autonomous AI agents can now compromise arbitrary PHP servers at scale? No. This was a sophisticated, target-specific exploit. "But it does demonstrate that PHP2Shell can be weaponized against a live target, even with meaningful technical constraints." Modhwadia's proof of concept is not the first to prove PHP2Shell is exploitable, but it falls under the more advanced category. Early signs suggested that Address Space Layout Randomization (ASLR) on a vulnerable server would prove a significant barrier to real-world exploitation, and the pentester’s solution bypasses it, along with the others that were disclosed recently. Spencer McIntyre, director of exploit development at VulnCheck, told The Register last week that attackers are finding new ways to exploit PHP2Shell, and "are clearly spending time (and tokens) on this bug." Initially, experts said exploit code was being found online hours, or even days, before the vulnerabilities were disclosed publicly, which led to millions of exploit attempts, although it was too early to determine the efficacy of these on real-world systems. Scores of websites were taken down for maintenance last week as organizations raced to protect themselves from the attacks, which may or may not have proved successful. Modhwadia said he donated a portion of the prize he received to the Lupus Foundation to raise awareness about the condition, from which he also suffers. ®

Cybersecurity researchers are calling attention to what they say is a "recurring social engineering pattern" across hundreds of cases in which threat actors use Microsoft Teams' external chat creation feature to conduct impersonation scams or to deliver malware. "A consistent pattern of attacker behavior has emerged across these incidents: the use of the same throwaway tenants, the same 'IT

Cybersecurity researchers are calling attention to what they say is a "recurring social engineering pattern" across hundreds of cases in which threat actors use Microsoft Teams' external chat creation feature to conduct impersonation scams or to deliver malware. "A consistent pattern of attacker behavior has emerged across these incidents: the use of the same throwaway tenants, the same 'IT Ravie Lakshmananhttp://www.blogger.com/profile/[email protected]

Anthropic has filed for an IPO that could rank among Wall Street's biggest ever, revealing an $80.7 billion half-year loss, a startlingly complex governance structure, and warnings that its AI models could blackmail humans, resist shutdown, or create "existential risks" to society. The Claude maker filed its S-1 registration statement with the US Securities and Exchange Commission on Monday as it prepares to list on Nasdaq under the ticker ANT. The company has not yet disclosed its proposed share price or how many shares it plans to sell. Of the filing's 614 pages, 94 are devoted to risk factors. But it's Anthropic's financial figures that are likely to raise eyebrows first. The Claude maker reported $16.3 billion in revenue for the first six months of 2026, up from $1.2 billion a year earlier. It also posted a whopping $80.7 billion net loss, although $72.4 billion of that was an accounting adjustment tied to the company's soaring valuation, not money it actually spent. Anthropic's operating loss was considerably smaller at $693 million, down from $2.1 billion a year earlier. By its own adjusted accounting, the company made a $1.6 billion operating profit in the first half of 2026, for a margin of around 10 percent. Whether it can keep making money on those terms is another matter. Training and running Claude requires an eye-watering amount of computing power, and Anthropic will need much more to keep pace with its rivals. A $1.6 billion adjusted profit won't count for much if the infrastructure bills keep growing faster than the business. Susannah Streeter, chief investment strategist at Wealth Club, told The Register that Anthropic's IPO could leave ordinary investors paying a premium for growth that has yet to translate into sustained profits. "A huge pool of private capital has allowed AI businesses to scale up and command extraordinary valuations long before they reach the stock market," she said, adding that investors buying in at the IPO will face a price with "a hefty dose of future success baked in." The financial risks are fairly conventional by Silicon Valley standards, but the warnings about what Claude might get up to are perhaps less so. Anthropic claims that models, including its own, have exhibited unexpected or self-preserving behavior, including attempts to resist shutdown, conceal information, and produce outputs resembling blackmail. It also warns that sufficiently advanced AI systems could pose “catastrophic or existential risks to society” if deployed without adequate safeguards. That's not to say Claude is currently blackmailing customers. Anthropic has observed some of this behavior in testing, but it also identifies more immediate security concerns as it gives its models access to external tools, code repositories, and corporate systems. Anthropic warns that attackers could hide malicious instructions in websites, documents, or API responses that its AI agents can access. If an agent follows those instructions, it could use a customer's permissions to steal data, tamper with code, or make unauthorized transactions. Even testing whether the models will behave themselves is proving tricky. Anthropic reckons some models behave differently when they detect or suspect they're being evaluated, making it harder to predict what they will do outside the testing environment. Keeping its models on a short leash could also cost Anthropic business. The company acknowledges that holding back more capable systems could give competitors an advantage, something it has already risked by restricting access to its Mythos model through Project Glasswing because of its ability to uncover security vulnerabilities. The founders aren't promising to put shareholders first, either. In a letter accompanying the filing, Dario and Daniela Amodei and their fellow co-founders tell prospective investors "not to think of your purchase in purely transactional terms." Anthropic may pass up lucrative business if it considers the risks too great, and investors won't have much say if they disagree. Under the proposed structure, governance structure includes five different classes of stock. By comparison, Google has three. The seven co-founders will retain 50.1 percent of the voting power on shareholder matters, while a separate Long-Term Benefit Trust will get to appoint a majority of the board. In other words, Wall Street is being invited to bankroll Anthropic's AI ambitions, but not necessarily to call the shots. Anthropic wants Wall Street's money to build ever more powerful AI, but is warning investors that it might turn down profits to keep that AI under control. Judging by those 94 pages of risk factors, keeping it under control is far from guaranteed.®

AV2 slibuje až o 30 % efektivnější kompresi videa oproti AV1. • YouTube chce nový formát nasadit už začátkem roku 2027. • Bez hardwarové podpory ale poroste zátěž procesorů i spotřeba energie.

Microsoft is adding a new AI-powered security feature to Teams aimed at detecting phishing, scams, and identity theft by analyzing conversations, Bleeping Computer reports.

Instead of primarily checking for malicious links and files, the tool will be able to identify suspicious behavior in the messages themselves, Microsoft said. The feature will primarily be used for new contacts, as they pose a higher security risk.

The new security feature follows earlier warnings from Microsoft about attackers impersonating help desk staff in Teams to trick users into granting them remote access.

In a Microsoft 365 Message Center post (mirror), the company said, “During initial quality validation, detection may run in the background without showing warnings to users. After validation, users may see a warning when potential phishing is detected.”

According to Microsoft, no messages will be saved or used to train AI models. The tool will also be used solely for security purposes — not, for example, for surveillance or advertising.

The rollout will begin in early November 2026 and is expected to be generally available during the first half of December. IT teams do not have to configure the feature; it will be automatically enabled.

This story originally appeared on Computer Sweden.

Related:

• New malware turns Microsoft 365 and Azure into its control center
• Video: How modern work is creating a cybersecurity nightmare

Microsoft released emergency .NET security updates to patch a critical vulnerability known as Broccoli2Shell, also tracked as Node2Shell and HTTP2Shell. [...]

Apple watchers predicted something like this: The company is ending October with a triple-whammy of new products, starting with its newly introduced iPad mini with OLED display. The rest of the week is expected to feature new Macs, specifically an M6 MacBook Pro and iMac and Apple’s first touchscreen MacBook Pro.

There’s no disputing how popular the iPad mini has become among some business users. Professionals use it as a digital notebook, many use it as a second display for their Mac, and some industries, particularly logistics, hospitality and field services, make extensive use of these things. 

If you want something smaller and lighter than a full-weight iPad, the iPad mini fills the gap, though its high build-quality means it comes at a price — starting at $699 with 128GB storage. That’s up from the $599 price tag on the previous model. Thanks to RAMaggedon, it’s the second price hike so far this year: two years ago, the device held a $499 starting price.

The new 256GB model costs $799, while the 512GB iteration sets you back $999. A fully specified 512GB iPad mini with Wi-Fi, cellular, and nano-texture glass costs $1,249.

What’s new in the iPad mini?

Apple has focused deeply on making the new iPad mini thinner and lighter than before. (Here’s what I I thought about the previous model when I reviewed it.) The new iteration is 5.4mm thick, compared to 6.3mm, and weighs 0.58 pounds, in contrast to the previous model’s 0.66 pounds.

It has a large 8.5 inch Super Retina XDR display (up from 8.3 inches), but this fits in the same footprint thanks to thinner bezels. The move to OLED means it delivers higher contrast and more than 2x higher peak brightness than the previous generation. Apple promises pixel-level lighting control for much deeper blacks and support for the P3 wide color gamut for more vivid and accurate images.

The display also weaves in some additional tech: Apple calls it an “Acoustic Display” because it has placed specially designed woofers and tweeters underneath. The company says this delivers better sound clarity and volume.

As expected, the new iPad mini hosts the 2-nanometer A20 chip, with Neural Accelerators in each GPU core and Dual 16-core Neural Engine — which means it should be pretty good at running AI. It also offers double the unified memory bandwidth. You should see performance boosts across the board; Apple promises it’s up to 60% faster for photo editing or working across apps.

The product is highly water- and dust-resistant with an IP67 rating, which means it can handle being under up to one meter of water for up to 30 minutes. This makes the iPad mini an even better fit for logistics and field services, while also being the iPad you’ll use by the pool. (The new iPhone Duo has an even stronger IP68 rating.)

Additional features include:

• 12MP Center Stage front camera on the landscape edge.
• 12MP Wide back camera.
• 1,200 nits peak brightness, 1 nit minimum.
• Weighs 255 grams, down from 293 grams.
• Nano-texture display option is available.
• Wi-Fi 7, Bluetooth 6, and Thread thanks to Apple’s N1 chip.
• Cellular models use Apple’s C2 chip, which Apple says provides up to 50% faster cellular data speeds compared to the previous generation of iPad mini.
• eSIM support.
• Available in Midnight and Starlight finishes.

What Apple said

“iPad mini is beloved for its fantastic portability, performance, and display by a wide range of users, from creators and small business owners to doctors, field service workers, and gamers,” said Dave Pakula, Apple’s vice president of Hardware Engineering.

iPad Mini users are extremely loyal and with Duo now on the market they are getting apps that will feel more custom than in the past. The updates are also a good reminder that iPad Mini is a size choice not a price one https://t.co/n1iMipsWJY

— Carolina Milanesi (@caro_milanesi) October 26, 2026 What the critics are saying

The main criticism currently being leveled against the new iPad mini is the lack of a 120Hz refresh rate — though Apple has not confirmed this. Others note that while the device does support fast charging, you must buy a 35-watt adapter to use it — though you do get a polishing cloth.

“One key detail worth noting is that the new iPad mini uses a binned A20 Pro chip in all but the high-end 512GB model. Not only does the binned chip have only 5 CPU cores rather than 6, it also lacks the Dual 16-core Neural Engine. Instead, you get the standard 16-core Neural Engine,” noted 9to5Mac.

My take?

A significant upgrade, which when used with Apple Intelligence and Siri AI make the system an incredibly flexible companion device. However, the price will inevitably dampen demand.

All the same, if I were to get one of these for Christmas, I’d be pretty happy. There aren’t enough Duos to go round, and this has a bigger display. Available for pre-orders from October 28 to ship November 6.

Now please subscribe to my daily, human-curated Apple-related news headline feed at The Core, or follow me on BlueSky, LinkedIn, or Mastodon.

Státní veterinární správa potvrdila první výskyt viru Shamonda na Táborsku • Ve Francii zemřel po bodnutí pakomárkem vážně nemocný a oslabený muž • Širší riziko pro lidskou veřejnost je podle odborníků nadále velmi nízké

Článek na blogu APNIC vysvětluje, jak správně vytvářet a používat ASPA záznamy — podepsané objekty v RPKI, které uvádějí, kteří poskytovatelé směrování jsou pro dané autonomní číslo (ASN) oprávněni. Síťoví operátoři je mohou využít k ověřování tras BGP a k odhalování úniků tras či podvržených tras.

This2Shell, That2Shell, Everything2Shell. That's pretty much how the last week went. Critical bugs that let attackers run code remotely are showing up everywhere. Hackers are scanning for targets, some flaws are already being used in attacks, and security teams have more urgent patches than they can keep up with. And that's not even the full story. A leaked key led to a software supply-chain

This2Shell, That2Shell, Everything2Shell. That's pretty much how the last week went. Critical bugs that let attackers run code remotely are showing up everywhere. Hackers are scanning for targets, some flaws are already being used in attacks, and security teams have more urgent patches than they can keep up with. And that's not even the full story. A leaked key led to a software supply-chain Ravie Lakshmananhttp://www.blogger.com/profile/[email protected]

A new NIST, CISA, and NSA guide treats runaway agents as incidents to be rehearsed. The hard part of the response is answering whose authority the agent used, and that answer has to exist before the incident does. [...]

A Chinese national was arraigned in California after being extradited from the Netherlands for his alleged involvement in a cryptocurrency investment scam that stole nearly $37 million from 174 victims in the United States. [...]

Alza zahájila pilotní provoz služby, která umožní vyzvednout si léky na předpis ve výdejním boxu. Novinka propojuje elektronické recepty s doručovací sítí AlzaBoxů a může usnadnit přístup k léčbě zejména seniorům, nemocným a lidem s omezenou pohyblivostí. Elektronické recepty jsou v Česku běžnou ...

Byla vydána (𝕏) verze 8.0.0 open source programu pro prolamování hesel hashcat (GitHub, Wikipedie). Přehled novinek v příspěvku v diskusním fóru a pdf.