Agregátor RSS

Jazyk Action! byl oblíbený proto, že programy v něm napsané byly velmi rychlé, zejména v porovnání s existujícími interpretry jazyka BASIC. Toto tvrzení je však dobré si ověřit na reálných benchmarcích.

Přestože je Čína v současnosti svými výrobními technologiemi schopna odolávat konkurenci západu (a asijských zemí, které rozhodnutí USA respektují), dochází těmto procesům dech. Řešení je ale na cestě…

Bioinženýři ze Stanfordu udělali laboratorní myši bez většiny buněk mozkové kůry i hipokampu. Do části z nich pak vložili lidské kmenové buňky a nechali je, aby vyplnily prázdné místo. Povedlo se a vznikly myši s xenokortexem, které mají téměř polovinu objemu mozku z funkčně zapojených lidských buněk. Podivuhodné také bylo, že myši bez velkých částí mozku fungovaly normálně, až na zhoršenou paměť. Co asi udělají příště?

Byla vydána betaverze Fedora Linuxu 45 (ChangeSet), tj. poslední zastávka před vydáním finální verze, která je naplánována na úterý 20. října. S konzolí kmscon místo fbcon. Současně byla vydána betaverze Fedora Linux Asahi Remixu 45. S podporou čipů M3.

The International Meteor Organization, the nonprofit that coordinates and publishes amateur and professional observations of meteor phenomena, said its infrastructure has suffered a “critical blow” from a cyberattack.

“We recently suffered a cyberattack that dealt a critical blow to aging infrastructure, taking much of our site offline," a static page on its website on Wednesday said. “We expect several weeks of partial downtime as we transition to new infrastructure and services.”

“I am very sad to see the site down”

In the meantime, the IMO said it’s prioritizing the reporting of fireball observations, which can be reported here. The organization is also providing some information on its Facebook page.

Read full article

Comments

Microsoft is investigating reports that the Windows 11 KB5124008 security update is breaking domain trust relationships on some enterprise systems, preventing users from logging in with valid domain credentials. [...]

If you rely on the Cybersecurity and Infrastructure Security Agency’s weekly vulnerability bulletin to keep you up to date on the latest threats, we have bad news. It’s being discontinued at the end of September. CISA announced on Wednesday that its weekly vulnerability bulletin would stop going out on Monday, September 28, saying the move was part of its shift from managing vulnerabilities based on severity to “a modern, risk-based approach.” That approach, as CISA explains, is detailed in a June Binding Operational Directive (BOD) that explains how covered federal civilian agencies should prioritize security updates based on real-world risk rather than treating all vulnerabilities and systems equally. “This Directive evolves upon CISA’s known exploited vulnerabilities catalog and increases mission readiness across the federal government by efficiently prioritizing high-risk vulnerabilities for timely action, while deferring action against low-risk vulnerabilities,” the agency explained in June. Evidence of exposure and exploitation, degree of control granted by exploitation, and whether exploitation of the vulnerability can be automated are all part of what goes into determining severity, according to a remediation table included in the June announcement. The June BOD, in a sense, moves covered federal civilian agencies away from relying on static CVSS scores alone when prioritizing vulnerabilities, which helps explain why CISA might want to eliminate the weekly bulletin. The agency didn’t explain, however, why it chose to scrap the bulletin rather than adapt it to the BOD's new standards. One possibility could be that the list of new vulnerabilities is simply getting too big to fit into a weekly email. Patches are addressing rapidly growing numbers of vulnerabilities every time they roll out thanks to AI-assisted security research, while the National Vulnerability Database is still facing a massive backlog and the broader CVE ecosystem is increasingly having to sift through bogus AI-generated reports to identify genuine vulnerabilities. CISA doesn’t want security professionals to abandon CVEs altogether, however. The announcement mentions that those who need to stay up to date on vulnerability information should instead rely on CISA’s known exploited vulnerabilities catalog, its cybersecurity alerts and advisories, and the CVE catalog itself. That means anyone who currently receives and relies on the weekly bulletin needs to log into the GovDelivery or Granicus account and ensure the KEV Catalog and Cybersecurity Advisories subscriptions are enabled. Critical notices could be missed if not, and CISA clearly isn’t too concerned about the potential hiccups this might cause. “CISA remains committed to strengthening national cyber defense and helping organizations prioritize remediation based on real-world risk,” the agency said. Clearly, it doesn’t believe cutting off a regular method of notifying users of critically ranked vulnerabilities falls inside that new risk paradigm, even if the scores are static. ®

Government agencies are warning that Iranian state-linked hackers are using a Windows malware strain named CHOSEN BRICK to target dissidents, activists, and journalists worldwide. [...]

Microsoft’s top lawyer argued Tuesday that legislators “must make secrecy [orders] the exception” in government subpoenas demanding information about LinkedIn users.

LinkedIn, which is owned by Microsoft, is fighting what it calls overly broad subpoena demands from the US government, which sometimes come with secrecy orders that prevent LinkedIn from alerting customers whose information is being requested.

The company is asking federal courts “to enforce meaningful limits on both the scope of government demands and the secrecy that can accompany them,” wrote Jon Palmer, Microsoft’s chief legal officer, in a Tuesday blog post. “We recognize law enforcement’s important role in protecting public safety and investigating crime, and sometimes that does need to be done covertly. At the same time, customers and users deserve meaningful limits and independent oversight through an adversarial process.”

He pointed out: “People and organizations increasingly entrust their most sensitive information to online services. If providers cannot challenge demands they know are overbroad—or if courts may silence them without a rigorous, adversarial review—the safeguards the law requires will be weakened precisely when they are most needed.”

A tricky issue

The issue is a tricky one. Law enforcement often use this type of subpoena as an investigative tool, seeking those who are engaged in illegal activities. The theoretical justification for secrecy is to avoid alerting the investigative target to make it less likely the suspect will try to destroy evidence or flee the jurisdiction.

Government lawyers are supposed to only make secrecy requests when absolutely essential. Microsoft is suggesting that courts and congress need to step in to curtail blanket government efforts. 

“The Fourth Amendment protects the right to be free from unreasonable searches and seizures. That right applies to papers kept in a desk and it also applies when personal and business records are stored online,” Palmer wrote. “Online service providers, like LinkedIn and Microsoft, also have a First Amendment right to speak to their customers when the government obtains an order to search their private information. Secrecy may sometimes be justified, but it should be tailored to demonstrated needs and subject to meaningful review.”

He added: “The government must seek only relevant information, justify secrecy with specific evidence and infringe on speech to the least extent possible.” In his post, he pointed to a recent legislative effort in the US House of Representatives that might mitigate the issue if it ends up becoming law. 

“On August 31, the House passed legislation to rein in secret surveillance and strengthen notice protections when the government seeks data held by technology providers,” he wrote. “The reforms would place clearer limits on secrecy orders, require greater accountability, and help ensure that secrecy is the exception – not the rule. The Senate should act promptly to send these historic reforms to the President.”

LinkedIn privacy battles

LinkedIn itself is currently fighting litigation that accuses it of directly violating the privacy rights of its customers, and a federal judge this month dismissed another similar case, but gave plaintiffs permission to refile, with a caveat.

“Given LinkedIn’s further arguments that users voluntarily download browser extensions, which by their nature intentionally expose data to websites, it seems unlikely that the plaintiffs will ever be able to allege a privacy violation, much less prevail at the end of the day,” US District Court Judge Vince Chhabria wrote. “But in an abundance of caution, dismissal is with leave to amend.”

But, he added, if the amended complaint isn’t filed within 14 days, “dismissal will be with prejudice.”

Privacy now a ‘data stewardship obligation’

Jeff Valdes, a director at Acceligence, noted, “there is definitely some irony here.”

“If Microsoft wants customers to view it as a steward of their privacy when the government comes asking for their information, customers are naturally going to apply that same standard to how Microsoft and LinkedIn collect, use, protect, and disclose information themselves,” he said. “Privacy is difficult to compartmentalize. You cannot have one philosophy of customer privacy for government access, another for product design, and another for your own commercial data practices without eventually creating a credibility problem.”

Mike Wilkes, enterprise CISO at Aikido Security, agreed, pointing out, “without meaningful limits, judicial scrutiny, and an expiration mechanism, a temporary investigative necessity starts looking a lot like a permanent architecture for invisible surveillance. The individual may never have an opportunity to challenge the scope of the request, because they may never even know the request existed until prosecutors show up with an indictment.”

That, he said, “is why Microsoft’s argument matters, despite the obvious irony of LinkedIn simultaneously defending itself against privacy claims from its own users.”

But Ryan O’Leary, an IDC research director, offered a different perspective.

“Microsoft makes no bones about using the data contained within its own systems for its own purposes. Both things can be true: Microsoft can fight for the privacy of its platform while still not necessarily respecting the privacy rights of its end users,” O’Leary noted. “This seems to come down to protecting its own proprietary data sets, not some altruistic privacy crusade.”

 At the same time, Valdes pointed out, Palmer’s post highlights how deeply privacy has become a top-tier enterprise IT priority.

“Privacy is rapidly becoming a much broader data stewardship obligation,” he said. “Companies holding sensitive information increasingly have to think simultaneously about government requests, third-party access, their own collection practices, AI use, data retention and what they tell customers about all of it. If you want to be trusted as the custodian of the world’s data, customers are going to judge how you protect that data in every direction.”

However, Wilkes noted, “Microsoft does not need to be a perfect privacy saint to be right about this particular problem.”

This article originally appeared on CSOonline.

Po půl roce vývoje od vydání verze 50 bylo vydáno GNOME 51 s kódovým názvem "A Coruña" (Mastodon). Podrobný přehled novinek i s náhledy v poznámkách k vydání a v novinkách pro vývojáře. Videopředstavení na PeerTube a YouTube.

A banking malware operation active since mid-2025 has been using a toolkit named KREMLIN to install malicious Chrome and Edge extensions that steal credentials, session tokens, and sensitive data. [...]

OpenAI spolupracuje s konkurenty Anthropic a Google DeepMind ze skupiny Alphabet na bezpečnosti umělé inteligence (AI). Globální obavy ohledně existenčních rizik umělé inteligence vzrostly poté, co se o víkendu sešli vedoucí předních amerických firem z odvětví AI a vyzvali k pozastavení vývoje technologie.

Evropská unie navrhne zákaz sociálních sítí, online her a chatbotů pro děti mladší 13 let a možnost účtu pro děti do 15 let jen se souhlasem rodičů, oznámila šéfka Evropské komise Ursula von der Leyenová v dnešním projevu ve Štrasburku. Návrh předpisu nazvaného EU Kids Act představí Evropská komise ve čtvrtek. Von der Leyenová zdůraznila, že chce, aby se rovněž změnilo základní pravidlo: platformy budou muset dokázat, že jsou bezpečné. „Mladí Evropané dnes tráví u obrazovek čtyři až šest hodin denně. Algoritmy jsou navrženy tak, aby je udržely co nejdéle u obrazovky a přiměly je pokračovat ve scrollování,“ uvedla šéfka unijní exekutivy. „Rodiče nám říkají, že jejich děti kvůli tomu méně spí, jsou úzkostnější a v některých případech si ubližují,“ dodala. Připomněla přitom případ čtrnáctileté belgické dívky jménem Oléa, která si vzala život poté, co byla vystavena kyberšikaně.

Both Google and Uncle Sam warned that attackers have exploited a zero-day improper authorization bug in Pixel phones' cellular modems that can bypass permission checks and escalate privileges with no user interaction required. The hole has since been closed, provided that you update. Google disclosed the high-severity vulnerability, tracked as CVE-2026-58704, on Tuesday - and, at the time, warned the security hole “may be under limited, targeted exploitation.” In other words: miscreants found and exploited this bug before Google fixed the issue. The Register reached out to Google for more details about the scope of exploitation, and how attackers are exploiting the flaw and what they can achieve. We have very limited details about the vulnerability itself, other than that it exists in Pixel phones' modems, is being exploited in the wild, and can be exploited in zero-click attacks, meaning no user interaction is required. We do know, however, that these types of zero-click attacks are frequently used by commercial spyware makers to surveil targeted individuals. On Wednesday, the US Cybersecurity and Infrastructure Security Agency (CISA) added the CVE to its Known Exploited Vulnerabilities Catalog and gave federal agencies just three days - until September 19 - to patch the flaw. “This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise,” according to the cyber-defense agency. Earlier this month, CISA added two Google Chromium vulnerabilities, CVE-2026-85046 and CVE-2026-87491, to its KEV catalog. CVE-2026-85046 is a type confusion flaw in Chromium’s V8 JavaScript engine that allows remote attackers to execute code inside the sandbox via a crafted HTML page. It affects all Chromium-based browsers including Google Chrome, Microsoft Edge, and Opera. The second flaw, an out-of-bounds write vulnerability tracked as CVE-2026-87491, also exists in the V8 engine, allows for remote code execution, and affects all Chromium-based browsers. Security researchers at Proofpoint last week told The Register that at least four espionage groups, most with suspected links to China, chained three bugs together, including CVE-2026-85046, to break into organizations' networks in the US and Southeast Asia. ®

U spotřební elektroniky jsme zvyklí na jednoduchý cyklus. Novinka přijde na trh za vyšší cenu, během několika let postupně zlevňuje a nakonec ji nahradí novější model. U přehrávačů Ultra HD Blu-ray se ale tento mechanismus prakticky zastavil. Nové generace téměř nevznikají, konkurence zmizela ...

The Spanish Data Protection Agency (AEPD) was notified of an attack allegedly carried out with an AI agent powered by a known large language model (LLM). [...]

The Spanish Data Protection Agency (AEPD) was notified of an attack allegedly carried out with an AI agent powered by a known large language model (LLM). [...]

Bing Wallpaper místo obyčejné tapety nasadil reklamu na Harryho Pottera. • Microsoft tím pracovní plochy počítačů zneužil k výdělku. • Není to první kontroverze kolem malé aplikace na automatickou výměnu tapety.

A growing divide among leading AI companies over how to secure increasingly powerful models is beginning to translate into challenges for enterprise IT, with implications for how organizations access, deploy, and govern AI systems.

The latest flashpoint came after Meta CEO Mark Zuckerberg called for neutral evaluators to independently test AI models, pushing back on calls from rivals to slow development or tighten coordination.

“trust and alignment are quickly becoming the most important capabilities that will differentiate agents and models. Any lab that doesn’t focus on alignment will fall behind,” Zuckerberg wrote in a post on X.

“Engaging independent evaluators and advisors is industry best practice,” he added, noting that Meta already does this in several areas.

His comments follow a series of public proposals from AI industry leaders including Dario Amodei, who argued for a more cautious pace of development, and Sam Altman, who called for collaboration on safety standards.

The debate has intensified amid disclosures from AI labs and policymakers on potential misuse of advanced systems. Anthropic has said it restricted attempts to use its Claude models in sensitive domains, while OpenAI has engaged with policymakers on AI-related risks, according to company statements and reports.

Enterprise concerns

While the debate is often framed as a choice between slowing innovation and strengthening oversight, analysts said enterprises should focus less on which approach prevails and more on the operational consequences already taking shape.

“Divergent safety approaches will make access to advanced AI models less predictable, rather than producing an industrywide slowdown,” said Sushovan Mukhopadhyay, director analyst at Gartner. Vendors are likely to apply different release schedules, regional availability, access tiers, and usage restrictions, he said, meaning enterprises could encounter similar capabilities “at different times and under materially different conditions.”

Mukhopadhyay said enterprises should plan for variability in access rather than assuming consistent availability across providers or geographies.

“I read this week as the point where frontier AI became a managed supply,” said Bhupendra Chopra, chief revenue officer at Kanerika. “For three years CIOs could assume the next model would simply show up. A frontier model now behaves more like a critical component from a supplier whose delivery dates depend partly on outside reviewers and export rules.”

Chopra added that “any AI roadmap built on a specific model arriving on a specific date is carrying supply risk it hasn’t priced.”

Security pressure builds regardless of slowdown

Analysts said slowing development alone is unlikely to materially change enterprise risk, particularly as open-source models proliferate.

“The biggest point isn’t the pause itself. It’s that the leaders of AI companies are agreeing on something,” said Nikhil Gupta, founder and CEO of ArmorCode.

Gupta said the threat landscape has already shifted. “Even if companies hit pause, open-source AI models are already out there,” he said. “I’m not convinced slowing down some companies meaningfully changes what adversaries can do.”

“Even if AI development slows down tomorrow, security must accelerate,” Gupta added. “The job of securing these systems has effectively gotten ten times harder.”

A new ‘AI assurance’ layer emerges

The focus on evaluation is driving what analysts described as an emerging “AI assurance” layer, where third parties assess models for safety and compliance.

“A distinct AI assurance layer is likely to emerge, but enterprises should not expect a single certification to establish that an AI system is safe,” Mukhopadhyay said. “Enterprise risk also depends on data, system instructions, tools, agents and deployment controls.”

Chopra said enterprises risk misinterpreting such evaluations. “Procurement teams may see a third-party evaluation and treat the model as vetted,” he said. “Within a year it becomes a checkbox.”

Instead, he said, enterprises will need to run their own validation. “CIOs who get ahead will test each model against their own data before it touches production.”

Fragmentation complicates multi-model strategies

For CIOs pursuing multi-vendor strategies, differing approaches across providers could introduce additional complexity.

“Fragmentation was already the default. Safety divergence deepens it,” Chopra said.

He said risk is most acute during transitions. “For an enterprise running several models, the exposure sits in the handoff,” he said. “When a model is delayed or replaced, the system can behave differently.”

“I’d rank untested model substitution above vendor lock-in,” Chopra said.

Gupta said open architectures will be important. “The framework needs to be open, not locked to any single vendor,” he said.

Mukhopadhyay added that enterprises should prepare for models becoming unavailable or restricted.

CIOs urged to build resilience

Analysts said enterprises will need to design AI strategies that can adapt to changes in availability, pricing, and governance.

“For critical applications, CIOs should separate application controls and business logic from the underlying model,” Mukhopadhyay said.

Chopra emphasized flexibility. “A routing layer between applications and model providers turns switching into configuration work,” he said, adding that contracts should cover deprecation timelines.

He also pointed to pricing implications. “Scarce access to the frontier starts to carry a premium,” Chopra said.

Nextcloud has developed a desktop app for its Euro-Office-based productivity applications, filling a gap in the software suite that it pitches as a sovereign alternative to Microsoft Office.

Nextcloud, one of the backers of the Euro-Office initiative, integrated the software into its Nextcloud Office suite in June. Until now, it’s been accessible via a web browser or mobile app.

The new desktop client lets users edit documents, spreadsheets, and presentations locally, and sync files online for collaborative editing. It will be available for Linux, macOS, and Windows in the coming weeks.

“For organizations and individuals who prefer a traditional desktop experience, this closes one of the last gaps between Euro-Office and Microsoft Office, without handing control of their data to a non-European vendor,” Nextcloud said in a press release.

Rather than a standalone application suite, Euro-Office is designed as an integration component that’s embedded into productivity applications, such as Nextcloud Hub. Euro-Office handles document editing, while other elements such as storage and permissions managed by the wider platform.

The open-source project, which is built on OnlyOffice’s codebase, is backed by Nextcloud as well as Eurostack, Ionos, Office.eu, Proton, XWiki, and others. More than 40 individuals have contributed code to Euro-Office, according to Nextcloud, with around 15% of contributions from outside of the organizations directly involved in project.

Euro-Office supports OOXML file formats for compatibility with Microsoft Office, as well as OpenDocument Format (ODF) files, including ODT, ODS and ODP. The Document Foundation, which is responsible for development of LibreOffice, another open-source productivity suite, has previously questioned the Euro-Office initiative’s preference for Microsoft file formats over ODF.

Organizations using Euro-Office include Germany’s Deutsche Telekom Security and Destek, a Turkish IT consultancy, according to Nextcloud. Other customers in countries such as France, Switzerland, and Philippines are currently evaluating the software.

But it’s still early days for Euro-Office. Open-source software initiatives often face a challenge in gaining traction among a broad enterprise audience, said Martha Bennett, VP and principal analyst at Forrester.

“Euro-Office hasn’t really proven itself at the kind of scale that large enterprises are looking for. That’s of course not unique to Euro-Office; all potential open-source alternatives face the same issue,” she said.

“Obviously, it’s a bit of a chicken-and-egg situation — without somebody taking the leap, it’s not possible to provide that proof.”

Nextcloud Hub Summer 26 updates

Among the other announcements with the Summer 26 updates are changes to management of teams within Nextcloud Hub. An updated Nextcloud Teams app, which is now available in the app menu, provides users with an overview of the teams they belong to. Each team features a folder with shared resources such as files and tasks, which Nextcloud notes is similar to Microsoft’s approach with Teams and SharePoint.

Nextcloud now also enables the creation of team-owned files, starting with Nextcloud Collectives and Deck, with additional apps in future. The aim is to ensure that all team members can access a file, even if the creator leaves the team workspace. For admins, there are new tools to view and manage team folders, including configuring storage quotas.

Among the other announcements are updates to Nextcloud Text — a lightweight text editor available across several apps — with version comparisons, footnotes, and references available throughout a document, and inline comments. Nextcloud Tables, a database app, now has relational columns that link data in cells across multiple tables, and the ability to import and export table structure — such as columns, views, and table-based apps — without changing data.

With Nextcloud’s AI Assistant, users can now upload an image and ask questions about it or translate text, while the chatbot will also recall information across conversations.

UI improvements include a revamped search experience that displays results from across Nextcloud Hub files, messages, and events, with filter options such as date range and people. App menu icons have been updated to make apps easier to recognize, and new animations throughout the interface make navigation and interactions “feel more fluid and easier to follow,” said Nextcloud.