Agregátor RSS

Apple představil nový iPad mini, iMac s čipem M6, 14palcový MacBook Pro s čipem M6 a MacBook Pro s PROLED XDR displejem – první Mac s dotykovým ovládáním.

Soudní spor vás může stát desetitisíce i statisíce korun, přestože jste v právu. Pojištění právní ochrany pomáhá s advokátem i náklady řízení. Jak se změnila nabídka po vstupu značky LEXIA, co kryje konkurence a na které výluky si dát pozor?

Vliv zvýšení minimální mzdy sahá dál než jen na minimální úrovně mezd a platů. Podívejte se na náš přehled, který shrnuje všechny důsledky na jednom místě.

Switch 2 má rychlejší menu, ale hlavně rychlejší hry. Mario Kart World vás probudí líp než espresso, Fast Fusion ukazuje technický strop a Cyberpunk 2077 je port, který by ještě nedávno zněl jako městská legenda.

V Linuxu je k dispozici takřka nepřeberné množství různých textových editorů. Dnes se seznámíme s editorem nazvaným mikro, jenž kombinuje přehledné ovládání s pokročilejšími operacemi: více oken, makra a pluginy.

Vzpomínáte na analýzy KeyBanc, podle které už má smlouvy s Intelem na výrobu prakticky každý významný výrobce hardwaru včetně AMD? Vypadá to, že už je jasné, odkud se to vzalo…

Nedávno představený projekt mapSTL.com řeší budoucnost. 𝕏: "Netušil jsem, kolik patentů na generování map existuje. Existují patenty na generování fantasy map 🫣. Cokoliv je na 3D tiskárnu a tvoří to produkt, bude to mít patenty. Tak bacha na to!" Nové modely v mapSTL.com jsou bez rámu v barvách OpenStreetMap Richer. Samostatné barevné označení konkrétního domu bylo odstraněno.

U.S. law enforcement has seized the primary domain of Virtualine, a bulletproof hosting service advertised on cybercrime forums for facilitating illegal activities. [...]

Attackers are probing a critical Oracle E-Business Suite vulnerability that can lead to remote code execution (RCE), despite Oracle issuing a patch earlier this month. Meanwhile, new analysis indicates that an Oracle PeopleSoft zero-day exploited by ShinyHunters as early as May involves three distinct vulnerabilities that can be combined to achieve RCE. Patching alone may not remove attackers from already compromised systems, particularly if they've installed web shells. First up: CVE-2026-101767, a critical, unauthenticated SQL injection bug in Oracle EBS that can lead to RCE. “Our Oracle E-Business Suite decoys recorded exploratory exploits against CVE-2026-101767, an unauthenticated SQL injection in EBS's Thin Client Framework servlet that chains to remote code execution, this morning, Oct 27,” Defused Cyber said in an X post. Horizon3 researchers found and disclosed the bug to Oracle, and the vendor patched the issue in its October release. “An attacker can send a crafted request to the vulnerable servlet to execute SQL with the privileges of the APPS database user,” Horizon3 explained at the time. “The attack chain also enables operating system command execution with the privileges of the EBS application account.” This means an unauthorized user can modify application data accessible to APPS, and execute commands. “Depending on the deployment, affected data may include financial, payroll, HR, and procurement records,” the bug hunters said. The Register reached out to Oracle with multiple questions for this story - including whether it has documented any successful exploitation of CVE-2026-101767 - and did not receive an immediate response. Moving on to the PeopleSoft-ShinyHunters fiasco: TrendAI’s Zero Day Initiative (ZDI) found and reported the PeopleSoft issues on June 10, and Oracle issued a patch under one vulnerability identifier: CVE-2026-35273. In early June, ShinyHunters told The Reg that the group hacked more than 100 organizations via an Oracle PeopleSoft zero-day, CVE-2026-35273. Google’s consulting and incident response biz, Mandiant, later confirmed the data theft and extortion crew exploited CVE-2026-35273 as a zero-day, mostly against schools and the education sector. By late September, however, Mandiant said ShinyHunters massively expanded its targeting, “deploying web shells on dozens of systems globally, spanning higher education, technology, IT services, healthcare, agriculture, transportation, and government.” According to ZDI bug hunter Bobby Gould, there are actually three distinct vulnerabilities across multiple PeopleSoft components, and each should receive its own CVE identifier rather than being grouped under CVE-2026-35273. Gould, along with TrendAI researchers Minh Giang and Lucas Miller, originally found and reported three distinct bugs to Oracle in June. “We are coordinating with Oracle to assign separate CVEs for each issue,” he said in a Tuesday blog. The first issue is a Server-Side Request Forgery (SSRF) vulnerability in the PeopleSoft Integration Gateway (PSIGW), which gives attackers a foothold in the PeopleSoft application. In June, Oracle introduced a “validateClient” method to allow PeopleSoft system administrators to restrict access to certain functionality. The SSRF bug, however, allows crims to make requests that satisfy the validation requirement to access endpoints vulnerable to RCE, Gould wrote. “While this solution does restrict access, an attacker on any trusted host can still reach PSEMHUB,” he said, referring to PeopleSoft Environment Management Hub (PSEMHUB). “Because Oracle allows localhost by default, the PSIGW SSRF provides exactly that access.” The second bug is an external control of file path vulnerability in PSEMHUB’s ExecuteProcessActivityCommand handler. This message handler is designed to allow remote clients to write log entries to the PeopleSoft server’s filesystem - but it doesn’t properly validate requests, which allows an attacker to write a web shell into a file path and achieve RCE. The third vulnerability, also in PSEMHUB, is a deserialization of untrusted data flaw. An attacker can use a file-write vulnerability to plant a malicious XML file inside a PeopleSoft directory that stores environment configuration data, then wait for PSEMHUB to initialize, such as after a service or system restart. This triggers deserialization of the malicious XML file, potentially allowing the attacker to achieve RCE. “Attackers can combine these vulnerabilities to compromise affected instances of PeopleSoft,” Gould warned.®

Apple představil MacBooky Pro s dotykovým OLED displejem. • Novinky jsou lehčí, jasnější, mají Dynamic Island a svítící logo. • Výkon zůstává vysoký, ceny ale šplhají až na 434 490 Kč.

Discord will allow search engines to index discussions in Discoverable Servers and make them accessible on the web to users outside the platform without an account or invitation. [...]

The China-nexus cyber espionage group known as Volt Typhoon has been attributed to a now-disrupted covert access network dubbed Silent Train that has been put to use for zero-day exploitation and strategic access. "First identified in late 2023, Silent Train uses rotating chains of compromised SOHO, IoT, and enterprise infrastructure," Lumen Technologies Black Lotus Labs said in a report sharedRavie Lakshmananhttp://www.blogger.com/profile/[email protected]

Multiplatformní emulátor terminálu Ghostty byl vydán ve verzi 1.4 (𝕏). Přehled novinek a vylepšení v poznámkách k vydání.

Otestovali jsme skládací Vivo X Fold6 • Není ve všem nejlepší, ale ve všem patří mezi ty nejlepší • Líbily se nám fotky a výdrž, méně pak větší vyčnívající fotomodul a koncová cena

Byla objevena zranitelnost Tailworm v Tailscale a Headscale umožňující lokální eskalaci práv přihlášeného uživatele. Následně byla v Tailscale v opravené verzi 1.104.4+ změněna architektura aplikace. Viz příspěvek na blogu Tailscale.

Third-party Android app stores can now apply to Google for permission to install apps with one tap, without Android's usual confirmation screens, and to update them in the background. To qualify, a store must pass identity checks and send Google its full catalog, along with every new app and update, for ongoing malware scanning. Approved stores get the features from December 1, but only onSwati Khandelwalhttp://www.blogger.com/profile/[email protected]

Sony Network Communications has confirmed a data breach that compromised approximately 2.5 million records containing current and former customers' personal information. [...]

Vyhledávání ve Windows 11 projde výraznou proměnou. • Nové prostředí bude čisté a díky WinUI 3 také svižné. • Testování v programu Insider začalo, ale jen v angličtině.

A chain of logic flaws, with no memory corruption, can turn a malicious web page into code running on a Windows computer outside Microsoft Edge's sandbox, a security researcher has shown. Orange Tsai of DEVCORE published the full method on October 28, five months after the chain won $175,000 at the Pwn2Own Berlin contest in May. Microsoft fixed the Edge bugs the day after the contest,Swati Khandelwalhttp://www.blogger.com/profile/[email protected]