Agregátor RSS

Byla vydána verze 1.99.0 programovacího jazyka Rust (Wikipedie). Podrobnosti v poznámkách k vydání. Vyzkoušet Rust lze například na stránce Rust by Example.

The Pentagon is informing more than 2 million current and former military members that their personnel records storing sensitive personal information were stolen over a monthslong compromise of one of its networks. The breach is the second one in recent months to expose sensitive government information.

The records, according to one notification letter posted to Reddit, included Social Security numbers, names, addresses, sex, race, and occupational specialty. This last category could be particularly valuable to foreign adversaries because it could help their intelligence agencies in identifying high-value military personnel. Starting last October, hackers gained access to a system operated by the Defense Manpower Data Center, which collates Department of Defense personnel records. The Pentagon says that the breach compromised the records of 2.8 million living individuals.

A potential boon

The incident is the second time a major network breach in recent months has exposed sensitive US government personnel records that criminal groups or foreign adversaries could use. Last month, the ransomware group ShinyHunters claimed it hacked into FBI systems and stole records of thousands of the agency’s current or former employees. Reuters reported the job titles in the records included ones related to investigating China or Russia.

Read full article

Comments

Microsoft says cyberattackers are currently benefiting from artificial intelligence faster than defenders, allowing threat actors to speed up vulnerability discovery, malware development, and post-compromise activity while security teams struggle to keep pace. [...]

Nemáte co hrát? Říjen to hravě změní! Velké i malé tituly, blockbustery i indie kousky ze všech možných žánrů. A majitelé Switche 2 dostanou obrovskou dávku portů starších her. Jestli vás především zajímají právě takové porty, skočte rovnou na poslední část článku.

Micron and Samsung executives this week said the memory shortage will continue for at least the next couple of years.

Micron CEO Sanjay Mehrotra expects demand for the firm’s memory to exceed its available supply over that period, he told investors last night.

Micron no longer sells consumer RAM, and Mehrotra’s statements refer to Micron’s business-to-business sales of high-bandwidth memory (HBM) for AI and DRAM for servers. However, his comments also have implications for consumer devices. Manufacturing capacity is prioritizing memory for AI and servers, limiting the supply of memory manufactured for consumer devices.

Read full article

Comments

Samsung drží nepřerušeně po dvacet let první místo v globálním podílu na trhu s TV. Aby si tuto pozici udržel, neváhá se zbavit dříve vychvalovaných technologií a přeskládat své portfolio nabídky.

Depending on Chinese technology for European infrastructure poses risks that not every country takes seriously. So says the Royal United Services Institute (RUSI), which suggests that the EU needs to do better in helping members assess the risk and take appropriate action to safeguard the entire bloc. The UK-based think tank said in a report today that the EU should develop a new risk assessment framework that applies to all members and strengthens its own powers, without encroaching on members’ rights to set their own national security policies. It must delicately balance the need to secure the union, while maintaining the flexibility that both allows members to set domestic policies and lawmakers to account for different risk profiles across different sectors. The risks affecting telecoms will not necessarily apply to other sectors in the same way. Speaking of telecoms, currently there is only the voluntary EU Toolbox for 5G Security framework – voluntary being the operative word here, as only 10 of 27 members have fully implemented it since it launched in January 2020. On paper, it somewhat sets out to achieve what RUSI is calling for: a harmonized set of standards to mitigate 5G-related security risks affecting member states. Addressing the frustration over the lack of adoption, the European Commission proposed amendments to the Cyber Security Act (CSA) earlier this year that would allow it to build a list of untrusted vendors that members must preclude from the networks of 18 critical sectors. If passed, any countries using equipment from designated vendors would be forced to rip and replace it within 36 months. The EC has already indicated that it would suggest Huawei and ZTE be listed, should the amendments pass. But before the EU gets busy listing vendors it considers high-risk, it first needs to decide what a high-risk vendor even is. There is still no official definition, nor is it a legal category, and at present, it allows countries to wangle their way around these descriptions to buy the tech they want, bypassing whatever scrutiny may come their way should the CSA amendments come into force. RUSI’s researchers used Germany, Spain, and the UK as examples of how three countries can treat foreign tech vendors, such as Huawei and ZTE, very differently. Germany’s most important trading partner is China, a relationship worth €251.8 billion ($284.4 billion) annually, and historically the Bund has opted to preserve these valuable economic ties in favor of reducing supply chain risk. Under Chancellor Friedrich Merz, this is slowly changing, although RUSI does not expect to see a material shift in the makeup of Germany’s 5G RAN stack in the near future. Chinese suppliers accounted for an estimated 59 percent of the country’s 5G RAN in 2024. Chinese equipment accounted for an estimated 32 percent of Spain’s 5G RAN in 2024, although that share is expected to shrink. The debate intensified after last year’s controversy, when Spain awarded Huawei a contract involving the storage of judicial wiretap recordings. Spain’s past procurement decisions have shown it to often favor the most cost-effective option, and its government does not share the same national security concerns about China as the UK or US, or at least not to the same degree. The UK, meanwhile, looks set to completely eradicate Chinese technology from its telecoms network by the end of next year, and has bent to the US’ vehement demands that Huawei is bad, bad news for Western geopolitical security. Real security risks RUSI stated that concerns about Chinese IT vendors “are well-founded,” and that it is true that the Chinese government can empower authorities to exercise control over companies like Huawei. This includes providing the state with data on demand, hosting Chinese Communist Party (CCP) representatives, and reporting activity that signals a threat to national security. There is an additional law that requires tech companies to not just report vulnerabilities to the country’s government within 48 hours of discovery, but also to withhold the same disclosure from China’s overseas counterparts, except for the product vendor. “This converts China’s private sector security research into a state-controlled pipeline that grants intelligence services privileged early access to exploitable vulnerabilities,” RUSI said. Factoring in all of this, the country has also demonstrated the willingness and capability to launch cyberattacks against the critical national infrastructure of political adversaries, according to RUSI. Technical security aside, China’s technological advancements introduce economic risks, too. In some cases, its vendors have developed more capable products than equivalents in the EU or US, and sold them at more attractive prices. This advantage makes it difficult for some countries to justify the extra expense on non-Chinese equipment. In building a global reliance on its products, China could then introduce “unwelcome dependencies,” or cement itself as a dominant player in crucial supply chains, RUSI noted. China has shown in recent years that it is willing to exercise this influence, such as when it threatened Germany with “consequences” for the two countries’ economic ties during the heated 5G debate of 2019. Would a high-risk designation system work? One of the reasons why the think tank is calling for a more considered risk assessment framework for the EU is that there is no guarantee that what the EC is currently proposing in its CSA amendments will have much of an effect. Issuing blanket bans on companies, or countries, does not explicitly address the underlying security issues that make products vulnerable to attack. In other words, even if China were excluded entirely from the EU members’ tech stacks, the other vendors from ‘trusted’ countries have proved that they are unable to deliver penetration-proof software, which would open the door to attacks regardless. Remember, Salt Typhoon’s high-profile attack on US telco networks took place as recently as 2024. It should also be said that CSA-esque designations could apply to US companies, as some countries in Europe see US vendors as similarly risky, albeit for different reasons. Merz’s Germany is concerned about the relationship between the US and EU, for example, and similar concerns about dependence on Chinese technology could easily be applied to vendors in the US, should relations sour. In Spain, US cloud companies dominate, but anti-US sentiment is stronger than many realize, particularly around surveillance concerns. Those, along with higher prices from some non-Chinese suppliers, have reduced Spain’s appetite for ripping out equipment others deem high-risk. “One participant even noted that some officials view US legal instruments such as the Patriot Act as creating equivalent sovereignty risks to China’s National Intelligence Law, a narrative that is flawed when exploring the legislation, but politically convenient,” RUSI stated. The think tank suggested that if it wishes to enact change through policy, the EU must gather “greater economic courage” and a willingness to approach tech procurement as a means to secure its critical infrastructure, rather than “a compliance exercise.” ®

Police in Spain have arrested a 16-year-old whom investigators suspect of running the KillSec ransomware group. KillSec is accused of stealing data from organizations and threatening to publish it on its leak site unless they paid. The 16-year-old was one of 3 people arrested on September 30, when police also took control of that site. Investigators identified him as KillSec's suspected Swati Khandelwalhttp://www.blogger.com/profile/[email protected]

This week, the useful words are boring ones: inspect, cache, compile, store, trust. Each sounds harmless. Each can become an attack path when a system does a little more than people expect. A model check can run code. A cache can mix up requests. A public secret can stay useful for years. That is the lesson running through the list. Attackers do not always need a brilliant new trick. They can Ravie Lakshmananhttp://www.blogger.com/profile/[email protected]

Mapy.com od letoška přecházejí na vektorové mapy místo původních bitmapových. Přinese to řadu výhod, lepší grafiku, ale nasazování nové technologie se neobešlo bez problémů. Na komunitním fóru Seznamu se stále šíří stížnosti na nepoužitelnou pomalost nových map, případně chyby v renderování. ...

A suspected Chinese espionage group impersonated AI policy figures, including a senior Anthropic employee and a former White House official, in phishing campaigns targeting AI policy experts at US universities, think tanks, and law firms, security researchers say. The bulk of these campaigns occurred in July, according to Proofpoint, which discovered the espionage attempts and attributed them to a China-aligned group it tracks as TA419. Proofpoint’s security alert comes a day after OpenAI accused China’s Moonshot AI of stealing the American models’ reasoning and other data in distillation attacks that began on July 1. “In July 2026, TA419 impersonated multiple individuals, including a former member of the White House Office of Science and Technology Policy leadership team, in credential phishing campaigns targeting AI policy experts in the US,” Proofpoint threat-intelligence analyst Mark Kelly said in a Thursday report. Beginning July 8, TA419 sent phishing emails spoofing Lynne Edwards Parker, the former principal deputy director of the White House Office of Science and Technology Policy, and then Heidi Crebo-Rediker, a prominent economist and foreign policy expert, to even more American AI policy experts at think tanks, universities, and law firms. The suspected spies’ emails invited their targets to join a fake AI policy advisory committee or contribute to a Senate foreign relations committee report on AI export controls and supply chains. If the American AI expert replied, the Beijing-linked crew responded with a shortened URL promising to share additional details, but in reality pointing to an attacker-controlled domain. This page conducts a Cloudflare Turnstile check behind a phony OneDrive loading screen, and then redirects the victim to an attacker-in-the-middle (AitM) credential phishing page that steals the victim’s cloud account login information. The July 2026 campaigns used driftshare[.]co as the first-stage domain and globalfileshareplatform[.]com as the second-stage domain. In February - as US military officials pressured Anthropic to remove Claude’s safeguards - the Chinese spies spoofed a senior Anthropic employee to phish an AI policy analyst at a US think tank. This email used the subject line: “Request for Feedback on Military Integration of Claude.” TA419’s phishing chain targets Microsoft 365/Entra ID through the first-party OfficeHome application (client_id=4765445b-32c6-49b0-83e6-1d93765276ca). It’s built on open source Frameless BitB, which contains a Browser-in-the-Browser (BitB) overlay, an Evilginx phishlet to intercept usernames, passwords, and session cookies for Microsoft 365, and server-side substitution rules that inject the kit into proxied pages. TA419 typically uses Cloudflare’s content delivery network to hide the backend hosting IP address for its domains, and its credential phishing domains are usually themed around file sharing sites and cloud services - such as msfile[.]online and onecloudfilesync[.]com. It also impersonates specific organizations, including the Japan-Taiwan Exchange Association (tw-koryu[.]org), The Heritage Foundation (heritiages[.]org and heritiage[.]org), and Japanese Minister of Defense Shinjirō Koizumi’s official website (shinjirou[.]info). In total, the crew uses dozens of phishing and spoofed-sender domains, and phony email addresses. Proofpoint includes all of the ones it discovered in 2026, plus the timeline of when they were registered or first seen, so check out those indicators, too. TA419 and other Beijing-aligned crews will likely continue targeting AI and other policy experts working on technologies of interest to the Chinese government, according to the threat hunters. “Organizations in the scope of TA419 activity should consider phishing-resistant, origin-bound authentication such as passkeys,” they recommend.®

Od 13. do 15. října proběhne v Praze OpenSSL Conference 2026. Na YouTube lze zhlédnout videozáznamy přednášek z loňského roku.

Společnost Raspberry Pi znovu sáhne hlouběji do peněžek kutilů a jiných uživatelů toužících po jejích jednodeskových počítačích. Britská firma tentokrát již potřetí zdražuje varianty Pi 4 a Pi 5 se 2 GB RAM. Ostatních modelů se změny netýkají. Ceny se zvýší o 12,5 dolaru. Pi 4 tak stojí 67,50 ...

Eben Upton oznámil další zdražení jednodeskových počítačů Raspberry Pi. Tentokrát 2 GB varianty o 12,50 dolarů. Nově 2 GB Raspberry Pi 4 stojí 67,50 dolarů a 2 GB Raspberry Pi 5 stojí 77,50 dolarů.

Samsung má dva nové výkonné tablety • Vylepšují výdrž, výkon i displeje a navíc přidávají bonusový obsah • Souběžně oznámený lokátor připojíte i k iPhonům, ale některé funkce budou chybět

Před rokem jsme se poprvé podívali do T-Mobile Areny, teď už se jmenuje T Arena a je těsně před dokončením. K předání stavby má dojít 25. října, první zatěžkávací zkouškou bude Mistrovství Evropy házené žen začátkem prosince, slavnostní otevření proběhne 8. ledna 2027 (obsazení koncertu ještě ...

Attackers were poking at a critical Zimbra mail server bug weeks before it was publicly disclosed, and then moved on to steal credentials, raid mailboxes, and take deeper control of compromised systems. Microsoft Threat Intelligence said it tracked exploitation of CVE-2026-73570, an unauthenticated command injection vulnerability in Zimbra Collaboration Suite that gives attackers a potentially easy route into exposed mail servers. No stolen password or unfortunate employee clicking a dodgy link is required. An attacker can send a specially crafted email to a vulnerable internet-facing server and potentially run commands, though Redmond notes the flaw affects only servers running Zimbra's optional SNMP monitoring package with notifications enabled. Zimbra fixed the flaw in version 10.1.20 on July 20, but CVE-2026-73570 wasn't publicly disclosed until August 13. Between July 28 and August 7, Redmond spotted two different scanning tools probing the same part of Zimbra later used in attacks. At first, the activity appears to have focused on finding vulnerable servers and testing the flaw. The attackers used a collection of common network utilities to make vulnerable systems call back to infrastructure they controlled, confirming they could execute commands. Once they found servers that played ball, things got messier. Microsoft's investigation found attackers deploying web shells and reverse shells, escalating their privileges, installing tools for persistent remote access, and running malicious code directly in memory. Some even tidied up after themselves. Microsoft said attackers temporarily changed permissions on public directories to plant web shells, then restored the original settings afterward in an apparent attempt to make their meddling harder to spot. The intruders also explored the wider Zimbra environments they landed in, identifying other mail servers and looking for trusted connections they could use to move between them. In some cases, existing SSH relationships between Zimbra systems gave them a route to neighboring servers. On at least one compromised machine, attackers turned their initial foothold into root access. They then set things up to keep running commands with the highest privileges without needing a password. Mailboxes were, unsurprisingly, also on the shopping list. Microsoft said attackers hunted for Zimbra credentials and authentication secrets that could potentially be used to access user accounts. One malicious tool it uncovered was built specifically to extract service account credentials and pull mailbox information from Zimbra's databases. In another incident, attackers bundled recent mailbox backups into an archive and tried to ship the haul to Azure Blob Storage using Microsoft's own AzCopy utility. Microsoft said it couldn't confirm from the evidence available whether the transfer actually succeeded. The company saw affected organizations across multiple regions and industries, with the attacks ranging from automated exploitation to more deliberate hands-on-keyboard activity. It hasn't attributed the activity to a particular crew. Admins running versions earlier than Zimbra 10.1.20 should update to 10.1.20 or later, while those unable to patch can reduce their exposure by removing the optional SNMP package or disabling SNMP notifications. Attackers, meanwhile, appear to have gotten there early, with Microsoft spotting probes for the flaw more than two weeks before it was publicly disclosed. ®

Cybersecurity researchers have shed light on a WordPress compromise in which threat actors deployed multiple persistence mechanisms to ensure that the final payload kept returning without having to infect the site again. The backdoor has been codenamed SC after the "SC_" markers present in the injected content. Sucuri has described the malware as a "self-healing mesh" that's Ravie Lakshmananhttp://www.blogger.com/profile/[email protected]

An international law enforcement operation dubbed "Operation KillSwitch" seized the KillSec ransomware gang's data leak site and servers, led to three arrests, and identified a 16-year-old as the group's alleged administrator. [...]

The global memory shortage that has driven up the cost of servers, storage and PCs through 2026 will get worse in 2027 and 2028, according to memory maker Micron Technology.

“We expect memory and storage supply-demand conditions to be much tighter in calendar 2027 and 2028 than they were in 2026,” CEO Sanjay Mehrotra said in prepared remarks for the company’s fiscal fourth-quarter earnings call.

Even with new cleanroom space planned across the industry, “We do not have line of sight to when supply and demand will return to balance,” he said. Earlier industry forecasts had expected the two to return to balance in 2028.

Mehrotra added that new plants would not bring quick relief. “Production from new DRAM and NAND fabrication facilities takes time to ramp and gradually becomes more meaningful starting a few quarters after initial output,” he said.

Neil Shah, vice president of research at Counterpoint Research, said the outlook means CIOs “will have to be prudent about which equipment to upgrade and which to stretch to maintain cost efficiencies.”

Higher prices, less memory

On the same call, CFO Mark Murphy said Micron’s “inventory levels and supply remain extremely tight.” Its DRAM prices rose by a percentage in the high teens in the fiscal fourth quarter, while NAND prices climbed about 30%, he said.

Taiwan-based market research firm TrendForce expects prices across the industry to keep rising. In a Sept. 30 report, it forecast that conventional DRAM contract prices will increase another 10% to 15% in the fourth quarter from the third. It expects NAND flash prices to climb 15% to 20%. The firm said increases are slowing but the market remains undersupplied.

IDC expects PC buyers to pay more as well. The research firm forecast in June that average PC selling prices will rise 17% in 2026.

TrendForce has also tracked a shift toward less memory per server. Cloud providers and OEMs have moved some servers from 96GB and 128GB memory modules to 32GB and 64GB modules since the first half of 2026, the firm said in a July report. Analysts had warned in January of higher prices and lower memory specifications for enterprise PCs.

Supply committed years ahead

Micron has already committed more than 75% of its 2027 output, and most of its customer discussions now concern 2028, Mehrotra told analysts on the call.

Much of that supply is locked into multiyear, take-or-pay contracts that Micron calls strategic customer agreements (SCAs). “Any new discussions on SCAs where pricing is involved are negotiated with higher pricing based on prevailing market conditions and outlook,” Mehrotra said.

Some cloud providers have signed similar long-term agreements with memory makers, TrendForce said in its July report. That has left buyers without such deals as the main source of server DRAM price increases, it said.

Shah said enterprises should lock in pricing too. “Companies should secure multiyear pricing for the computing capacity they know they will need,” he said. Moving workloads to the cloud will not avoid rising hardware and energy costs “because providers will pass them on,” he added.

Which refreshes to delay

When it comes to replacing existing equipment, Shah said, the right call depends on the workload. “For general back-office PCs and routine file servers, stretching lifecycles from three years to five is harmless,” he said. “But for core infrastructure and engineering seats, delaying refreshes can backfire.” Aging equipment can drag on productivity, lose software support and fail more often, he added.

Shah also cautioned against turning to older memory to save money. Memory makers have been converting production lines to high-bandwidth memory and DDR5, so DDR4 is no longer cheap or plentiful, he said. “If you buy legacy platforms today to shave 10% off upfront server costs, you’re buying into systems which won’t have serviceable parts two years from now.”

He recommended starting with the hardware already in place. “Enterprises often waste 30% to 50% of memory by provisioning for peaks that rarely occur,” he said. Right-sizing virtual machines, quantizing AI models and batching workloads more efficiently can cut memory use significantly, according to Shah.

Before buying more hardware, he said, “CIOs should think about optimizing on the silicon already in place.”

What hardware vendors say

Hardware vendors had no helpful advice to offer budget-constrained buyers.

Lenovo did not answer questions directly but pointed to remarks executives made on its Aug. 13 earnings call.

Chairman and CEO Yuanqing Yang said then that he expects memory demand to keep rising and supply to remain constrained at least through the end of 2027. He said Lenovo can respond quickly to rising component costs: “When the material costs rise, we can adjust the pricing at the front end in a timely manner.”

Luca Rossi, president of Lenovo’s Intelligent Devices Group, said he expects the PC market to shrink about 15% in units in the six months to March, with business demand holding up better than consumer demand.

On the server side, Ashley Gorakhpurwalla, president of Lenovo’s Infrastructure Solutions Group, said a “strong server refresh cycle is underway.”

Dell, HPE, HP, Cisco and Supermicro did not respond to requests for comment by publication time.

This article first appeared on CIO.