Agregátor RSS

Databáze DuckDB (Wikipedie) byla vydána ve verzi 2.0.0 LTS. S kódovým názvem Cinnamon Teal (čírka skořicová). S vyladěným protokolem Quack.

Security researchers at Amazon Threat Intelligence say attackers began targeting the PHP2Shell flaws four days before security patches were released on Wednesday. [...]

Attackers are hammering servers with millions of attempts to exploit the critical PHP2Shell vulnerabilities, with Amazon revealing that someone was already going after the flaws four days before they were publicly disclosed. Cloudflare says it has recorded a staggering increase in attacks targeting the two vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, since details began circulating earlier this week. According to Cloudflare CEO Matthew Prince, the company spotted thousands of exploitation attempts in the 10 hours before the vulnerabilities were publicly announced. That figure jumped to tens of thousands within 45 minutes of disclosure, hundreds of thousands within two hours, and has since climbed into the millions. And the attackers aren't simply recycling the same exploit. Cloudflare said it has seen miscreants tweaking their payloads in an attempt to sneak past its web application firewall (WAF) protections, apparently using feedback from blocked requests to work out what might get through. Security outfit Hadrian also sounded the alarm on October 21, reporting that PHP2Shell was being "exploited in the wild at scale." "Most of the attacks we observe abuse PHP's session upload-progress path, and we expect more exploit paths to appear before and after the fix ships," the company warned. More worrying, some attackers appear to have started before the vulnerabilities were even public knowledge. Amazon Threat Intelligence says it detected an attempt to exploit PHP2Shell on October 17, four days before patches were released. The activity was picked up by MadPot, Amazon's network of honeypots designed to lure attackers and record what they get up to. "While the vulnerability was under embargo, the targeting of a honeypot from an anonymized IP address suggests the activity was conducted by a threat actor, though it remains unclear how the actor acquired exploit information prior to disclosure," Amazon said. The retail and cloud giant said it detected multiple proof-of-concept exploits on October 21, with the earliest appearing around 0200 UTC, some 12 hours before the patches were released. Over the following six hours, further attempts arrived from different anonymized infrastructure, using a variety of payloads. Amazon reckons this points to multiple attackers rather than a single group. Whether any of those attempts would have worked against real-world systems remains unclear. The findings add another layer to an already messy disclosure. As The Register reported on Wednesday, the PHP Foundation has accused supply-chain security vendor Chainguard of putting websites at risk by publishing patched PHP builds before the agreed disclosure deadline. However, Amazon's October 17 detection suggests at least one cybercrim was already trying to exploit the bugs days before that incident. The vulnerabilities themselves are particularly nasty. Both carry a critical 9.2 severity rating and affect PHP's handling of memory, potentially allowing unauthenticated attackers to execute malicious code on vulnerable servers. Unlike flaws in individual plugins or applications, these bugs affect the PHP runtime itself, putting a potentially enormous number of websites at risk regardless of which content management system they use. Cloudflare says it has deployed WAF protections across its free and paid plans, although it has stressed that these are no substitute for patching. With attackers already trying their luck before the fixes were available, admins may have more than just a patching backlog to worry about. Amazon is advising organizations to investigate suspicious activity dating back to at least October 17, rather than assuming their systems were safe until the vulnerabilities became public. ®

Někdy si chcete jen odpočinout, na chvíli vypnout a nemáte náladu na nic dlouhého. V takových situacích se hodí seriály s krátkými epizodami. Když chcete, můžete sjet i několik dílů za sebou.

Asus Zenbook 14 zlevnil na 17 990 Kč, ještě v létě stál 31 490 Kč. • Má hezké hliníkové tělo, dotykový OLED a dostatek výkonu. • Vydrží celodenní práci a má i tiché chlazení.

GitLab has released security patches for a maximum-severity Regular Expression Compiler flaw that can let remote attackers run arbitrary code on vulnerable servers. [...]

Unknown hackers hijacked more than 300 Tor exit nodes and reconfigured them to favor unencrypted email traffic and redirect SSH connections through servers they controlled, a researcher reported Tuesday.

The hijacking began in late August, when, according to Tor volunteers, the attacker used a valid password that had been reused to gain access to a Tor management server. The attacker then installed Ebury, a backdoor written for Linux that was discovered 12 years ago.

Mysteries remain

Then the attacker connected from the management server to a second Tor server, called Switzerland2, through SSH, using an RSA key that, for unknown reasons, investigators couldn’t find among Switzerland2’s authorized keys. With administrative control of Switzerland2, the attackers installed Ebury there as well. Finally, the attacker reconfigured settings on two exit nodes that Switzerland2 hosted.

Read full article

Comments

China-aligned attackers used AI agents and compromised ConnectWise application credentials to target more than 2,250 Microsoft 365 tenants, Microsoft says. The Windows giant revealed this week that the attackers, tracked as Storm-0940, used an open source AI penetration-testing tool called ARTEX to automate attacks against Microsoft 365 environments. In some cases, they went from picking a target to gaining privileged cloud access in less than three hours. The findings shed more light on the ConnectWise security incident, which saw the IT management vendor pull the plug on its Cloud Backup, SaaS Security, and Cloud Management services after discovering unauthorized access to application identities. ConnectWise didn't initially identify who was responsible, but Microsoft has now pointed the finger at Storm-0940, a China-linked espionage crew that's been operating since at least 2021. The group has traditionally relied on the usual tricks, including password spraying and exploiting internet-facing applications, but this time it used AI to do some of the heavy lifting. ARTEX is an open source penetration-testing framework written in Go that uses AI agents to automate everything from reconnaissance and vulnerability discovery to credential attacks and data theft. Microsoft says Storm-0940 began using it as early as September to target organizations worldwide, including government agencies, defense contractors, banks, manufacturers, and tech firms. Between October 10 and 14, the hackers made more than 151,000 failed sign-in attempts against 327 accounts at eight organizations. Microsoft observed no successful logins from that password-spraying campaign, but then the attackers shifted to compromised ConnectWise application identities. The compromised application credentials let the attackers exploit permissions customers had already granted to ConnectWise services, without needing an interactive user login. Armed with ARTEX, Storm-0940 attempted to authenticate against more than 2,250 Microsoft 365 tenants, at times reaching 2,900 attempts a minute. Microsoft also observed AI-accelerated activity through Microsoft Graph, including reconnaissance, application credential changes, and attempts to modify privileges, potentially allowing the attackers to stick around even after the original credentials were revoked. Most attempts failed, though Microsoft says the hackers still managed to establish persistent privileged access at numerous organizations. It hasn't disclosed how many customers were compromised or whether any data was stolen, cautioning that a successful login doesn't necessarily mean information was accessed. ConnectWise CEO Manny Rivelo said the company had contained the affected application connections and was gradually restoring services, although shutting down those connections wouldn't necessarily boot out attackers who had already established a foothold in customer environments. ConnectWise has been here before. In May 2025, it admitted that a "sophisticated nation-state actor" had broken into its systems and compromised a small number of customers using its ScreenConnect remote access software. There's nothing to suggest the two attacks are linked. Nor is Storm-0940 alone in making use of ARTEX. Microsoft says it has spotted attackers from several geographic regions using the framework, which is freely available for penetration testing. The underlying techniques are nothing new – stolen credentials, password spraying, and application abuse – but Microsoft says AI helped Storm-0940 execute them faster, with some attacks progressing from initial targeting to privileged cloud access in under three hours. ®

Platform-as-a-Service (PaaS) provider Railway on Wednesday disclosed "anomalous activity" related to systems that store customer environment variables. Upon further investigation, the company found that an unauthorized third party may have gained access to encrypted environment variables, and, in some cases, obtained the decrypted contents. The impact, it said, is limited to a "subset of users,

Platform-as-a-Service (PaaS) provider Railway on Wednesday disclosed "anomalous activity" related to systems that store customer environment variables. Upon further investigation, the company found that an unauthorized third party may have gained access to encrypted environment variables, and, in some cases, obtained the decrypted contents. The impact, it said, is limited to a "subset of users,[email protected]

Sledujeme nové funkce, které s aktualizacemi přibývají do oblíbené mobilní mapové a navigační aplikace Mapy.com od českého Seznamu.

Na cizoměnové účty si klienti mBank počkali téměř 19 let a teď jsou konečně tady. Banka nabízí pět měn, čtyři úročí a k placení vám stačí jediná debetní karta.

A flaw in the OpenCode AI coding agent allowed a malicious or hijacked MCP server to run code on a developer's Windows or WSL machine when the developer signed in. OpenCode connects to MCP (Model Context Protocol) servers to add outside tools, and such code would run with the developer's own access. Anomaly, the company behind OpenCode, fixed the flaw in version 1.18.33 on September

A flaw in the OpenCode AI coding agent allowed a malicious or hijacked MCP server to run code on a developer's Windows or WSL machine when the developer signed in. OpenCode connects to MCP (Model Context Protocol) servers to add outside tools, and such code would run with the developer's own access. Anomaly, the company behind OpenCode, fixed the flaw in version 1.18.33 on SeptemberSwati Khandelwalhttp://www.blogger.com/profile/[email protected]

30 svíček na dortu a 30% sleva na Živě Premium. Slavíme narozeniny 30 let na internetu → 30 % dolů. Velká narozeninová sleva na Živě Premium

Welcome back to PWNED, the column where we talk about companies and organizations that leave the doors wide open to attackers. This week’s sad story involves a major American pharmacy chain that couldn’t fill a prescription for password security. Have a story about someone leaving a gaping hole in their network? Share it with us at [email protected]. Anonymity is available upon request. Our tale comes courtesy of red team and pen testing specialist Dahvid Schloss, who currently serves as COO of Suzu Labs, a cybersecurity company that boasts “we break your systems before adversaries do.” Over a career spanning more than 15 years, Schloss has assessed the security of numerous businesses, including a large US pharmacy retailer that he asked us not to name. He wasn’t asked to break in, just to do an audit on all of the org’s corporate switches, routers, and firewalls. “So, I come across this firewall,” Schloss said. “That is an edge firewall, meaning this is what touches the internet. This part will add its enable password, which is the term Cisco uses for administrator. It had the enable password as 'password.' Just p-a-s-s-w-o-r-d.” As Schloss noted, the enable command on Cisco devices allows the user to gain administrative rights to the firewall, controlling network traffic. If someone connected to that firewall, either via SSH or through an exploit, and got normal user privileges, they could then elevate those privileges to admin and do something like shut off all traffic from the intranet to the outside world. Schloss actually didn’t guess that the password was “password,” but instead was able to decrypt the file holding the passwords by breaking Cisco’s own protection, something he said is easy to do. “That enable password was stored as Cisco IOS type 7, which isn’t really a hash,” he said. “It’s more of a reversible encoding with a publicly known key. Even back then, it was best practice not to use it.” But even if the password were stored in a secure place, it would be very easy for a threat actor to guess. So he marked the password failure down as a “high find,” a bad type of vuln that needs to be fixed right away. When he brought the password to the company’s auditing department, they put him on a phone call with the auditing team, the entire IT team, his own manager, and others. On the packed call, the auditing team, who had commissioned Schloss’s work, was very concerned about the firewall password, but the IT team didn’t think it was a very serious problem. The two sides screamed at each other for more than an hour while Schloss and his colleagues sat there quietly, staring at their cameras. “The audit team is like ‘yeah, we gotta fix this.’ And the directors were really harping on ‘this needs to be done’ and the IT team starts firing back,” Schloss explained. “It’s like ‘Why? Who’s gonna? What does it matter? No, this isn’t a high-priority find. This is maybe a medium. Yeah, it’s bad, but it’s not that bad.’” The call dragged on so long that Schloss was unable to finish presenting his findings and recommendations. The conflict was so severe that the client continued to follow up and ask him to explain what he found again for the next three years – long after he had moved on to other projects. He later learned that the auditing department controlled the bonuses for the IT team and there was a stipulation that any “high finding” would eliminate those bonuses. So they weren’t just arguing about “password” - they were really talking about the compensation for an entire division. The lesson here is more than “don’t use the word ‘password’ as a password.” It's also about misaligned incentives. Tying security posture to compensation seems like a good way to incentivize workers to follow best practices, but it also leads them to deny responsibility and minimize mistakes when they're found. ®

Americké ministerstvo energetiky a ABS podepsaly dohody o využití jádra na moři • Plovoucí reaktory a jaderné lodě mohou fungovat bez tankování celá desetiletí • Projekt vyžaduje vyřešení legislativy, licencování reaktorů i přípravu infrastruktury

Jan Růžička (na X vystupuje jako Alan Kooper) už zaujal svým e-mailovým klientem Mailer, který je rychlejší než konkurenti a který si tvoří na míru vlastních potřeb. Nezůstane ale jen u něj. Chystá totiž také webový prohlížeč. Nepůjde přitom o další odnož Chromia nebo Firefoxu. Růžička už ...

V implementaci Broadcom 802.11 byla zjištěna chyba ve zpracování WPS/EAP, týká se to SDK od roku 2010. Broadcom podle výzkumníka Quentina Kaisera odmítl CVE přidělit. Modemy Huawei a Technicolor jsou používány i v ČR, v LTE routerech, běžných domácích routerech a firemních přístupových bodech, jejich současný počet a zranitelnost konkrétních verzí však zatím neznáme. Více detailů a demo. GitHub / Broadcom 802.11 SDK Detection Toolkit.

LiteLLM on Wednesday disclosed that threat actors compromised "multiple independent security controls" to push a malicious version of the Python package containing a credential stealer and a backdoor. On October 21, 2026, LiteLLM's release pipeline was compromised to push 1.107.0 to the Docker Hub registry and the Python Package Index (PyPI) repository. The incident took place around 4:00 a.m.