Agregátor RSS

Ani omezení spotřeby na zhruba 360 wattů v kombinaci s použitím originálního napájecího adaptéru nezaručilo uživateli bezproblémový chod. Napájecí konektor GeForce RTX 4090 selhal navzdory tomu…

Mrchožroutům můžeme závidět, že nakonec vždycky najdou nějakou potravu. Jsou to ale mrtvoly, které hnijí a jsou plné mikrobů, s nimž byste se nechtěli setkat. Jak je možné, že tohle mrchožrouti přežijí, a ještě si to užívají? Odpověď nabízí fascinující výzkum mrchožroutů ve španělském mokřadu.

Byla vydána nová verze 2.56.0 distribuovaného systému správy verzí Git. Přispělo 104 vývojářů, z toho 39 nových. Přehled novinek v příspěvku na blogu GitHubu a v poznámkách k vydání.

Manufacturing security tends to fail at the seam between information technology and operational technology. 

Keio Corporation (Keio), a major private railway operator in Japan, said its network was hit by a ransomware attack over the weekend, disrupting  some of its business systems. [...]

Japanese car-sharing service Times Car has confirmed that approximately 6.6 million user accounts were compromised in a cyberattack disclosed late last week. [...]

The cyber criminal behind JadePuffer, the first known agentic ransomware infection reported over the summer, has also used stolen Azure identities to conduct destructive attacks on cloud storage and other resources, according to Microsoft. In July, Sysdig threat hunters uncovered JadePuffer, the first-ever documented agentic ransomware infection in which an LLM drove the entire extortion operation, from gaining initial access to compromising a production database server and destroying data. Now Redmond says that it has detected the same attacker, which it tracks as Storm-3168, up to new mischief. Over an 18-hour period in early June, Storm-3168 compromised two service principals and used these machine identities for “extensive Azure-focused resource destruction” and “cloud credential collection that could be used to facilitate future exfiltration,” researchers Yossi Weizman and Tushar Mudi wrote on Friday. The two compromised service principals belonged to the same cloud tenant. The crims used one of them to conduct reconnaissance and resource discovery, and the other to carry out destructive operations and credential collection. The Redmond researchers don’t know how Storm-3168 initially hijacked the service principals, but noted that an employee of the same organization previously exposed client IDs, client secrets, and tenant IDs in plaintext in a public GitHub issue. “Since the beginning of this year, we also observed repeated probing from Storm-3168 linked infrastructure against multiple Azure App services for different customers,” the duo wrote. The entire attack took about 18 hours, with the discovery piece lasting about 15 hours and 30 minutes. During this time, the compromised service principal collected detailed information about Azure Virtual Machines, subscriptions, resource groups, and resources, completing more than 300 successful read operations. “This breadth of activity would give the threat actor visibility across the organization’s Azure environment,” Weizman and Mudi wrote. About 90 minutes after the first machine identity began hoovering up Azure information, the second compromised service principal started its work, reading Azure VMs and resource groups across two subscriptions in just five seconds. According to Redmond, both of these service principals used Storm-3168 linked infrastructure, the same network fingerprint, and the user agent python-requests/2.34.2. About 16 hours after the initial target reads, the second service principal successfully discovered Azure App Service configuration stores - it was likely looking for exposed credentials, we’re told - and unsuccessfully attempted to find Azure OpenSearch resources. Seventy seconds after this, it also attempted a ListKey operation against a non-existent storage account. Then, the destruction began. During this part of the operation, the compromised service principal attempted more than 150 destructive or credential-stealing attempts in 35 minutes. The destructive activity only lasted about 7 minutes with the machine identity attempting to delete more than 100 Azure Storage accounts. Most of these were successful, although Azure resource locks and storage account-level deletion did block a few. Additionally, the attacker deleted an Azure Key Vault, Function App, App service plan, all of which belonged to the same resource group and likely supported the Function app. “The same service principal also attempted to delete multiple Azure SQL databases in parallel with the storage account deletions mentioned earlier, but every deletion attempt failed because it used an unsupported API version for the Azure SQL database resource type,” Weizman and Mudi wrote. About 28 minutes after the destruction ended, “the same service principal made an inventory request for Azure Storage Accounts and sent more than 30 successful ListKeys requests, asking ARM to return each storage account’s access keys,” they added. “These storage accounts included Azure Site Recovery related storage accounts.” Multiple unsuccessful deletion attempts were also made against Azure Site Recovery locks and Azure Backup protection locks protecting storage accounts. According to Microsoft, the destructive activity - deleting numerous Azure resources, while also targeting backup and recovery-related resources - seems to indicate that Storm-3168 was setting up a ransomware attack. “Taken together, the resource destruction, attempts to interfere with recovery mechanisms, and collection of credentials that could provide access to data are consistent with tactics that can support ransomware and extortion operations,” Weizman and Mudi wrote. However, no ransom note was ever sent. "We did not observe a ransom note or confirm successful data exfiltration in the activity described here," they wrote. ®

Dutch police have confirmed that a 24-year-old Amsterdam man arrested earlier this month was detained as part of an investigation into the ShinyHunters hacking group. [...]

Hackerská skupina ShinyHunters oznámila průnik do informačních systémů FBI, prostřednictvím zero-day zranitelnosti v platformě Oracle PeopleSoft, kterou úřad využívá mimo jiné pro náborový portál FBIJobs.gov. Útočníci tvrdí, že získali až 3 TB dat o současných i bývalých zaměstnancích a uchazečích o práci. Jako důkaz zveřejnili vzorek přibližně 5 000 záznamů obsahující jména, adresy, telefonní čísla, data narození, čísla sociálního zabezpečení a v některých případech dokonce údaje o rodinných příslušnících a nouzových kontaktech. Nezvyklá je motivace tohoto útoku, ShinyHunters tvrdí, že nejde o finanční vydírání, ale o odvetu za údajné nepravdivé informace o skupině v bezpečnostním varování FBI a požaduje nápravu.

Apple has released security updates to address a vulnerability in older versions of iOS, iPadOS, and macOS that it said may have been exploited in targeted attacks. The vulnerability, tracked as CVE-2026-86950, refers to an out-of-bounds write impacting the CoreGraphics component that could lead to arbitrary code execution when processing a maliciously crafted file. The iPhone maker said the Ravie Lakshmananhttp://www.blogger.com/profile/[email protected]

Doba kompilace linuxového jádra se díky rychlejšímu hardwaru a optimalizacím kbuildu snižuje k deseti sekundám. Nejnovější patche Lorenza Stoakse (vznikají i s pomocí SI) zkrátily na testovacím stroji dobu sestavení z dlouhých 22 vteřin na pouhých 15, a to bez použití RAMdisku. Testovací systém tvořily dva procesory AMD EPYC 9575F (oba dohromady poskytují celkem 128 jader a 256 vláken), čtyřiadvacet 64GB DDR5-6400 paměťových modulů a SSD PM1743 od Samsungu (detaily sestavy jsou na druhé stránce článku). U konfigurace allmodconfig se čas sestavení snížil ze 169 na 134 sekund. Další generace procesorů AMD Zen 6, rychlejší paměti MRDIMM a úložiště PCIe 6.0 by dle očekávání mohly hranici deseti sekund prolomit.

Researchers found more than 16,000 misconfigured Supabase databases exposing readable tables with personally identifiable information, passwords, or authentication tokens. [...]

Hackers have used a malware family called NeedyMantis to maintain long-term access to networks they had already breached, Microsoft said in a technical analysis. The malware has been seen in a small number of targeted intrusions at telecommunications organizations, universities, medical nonprofits, intergovernmental organizations, and government contractors. Its use goes back to at least Swati Khandelwalhttp://www.blogger.com/profile/[email protected]

What is IAM for AI agents? AI agents authenticate, invoke tools, and act across enterprise systems with delegated authority. IAM for AI Agents is the identity-control architecture that governs those actors. This guide covers the limits of conventional provisioning, the components that matter, how to evaluate framework choices, and what runtime evidence proves an agent behaved as intended. [email protected]

The attacker who stole about $388 million from the cryptocurrency exchange Bitget gained access through a vulnerability in a third-party security product the exchange used, Bitget said on Monday. The attacker exploited the flaw to obtain high-level internal credentials and then, on September 24, used them to send fraudulent withdrawal commands to Bitget's wallet system. Exchanges keep most Swati Khandelwalhttp://www.blogger.com/profile/[email protected]

RatHat's operators build and publish the Android banking trojan and control infected phones from a web console, according to security company Cleafy. Cleafy has traced nearly 100 deployments of that console since April 2026. It said this fits a malware-as-a-service model, in which each customer runs a separate copy. The console stores what the malware collects from each phone, Swati Khandelwalhttp://www.blogger.com/profile/[email protected]

The JadePuffer ransomware operator is targeting Azure tenants with agent-driven attacks that conduct reconnaissance, steal credentials, and destroy core components. [...]

Bezpečnostní analytici Cisco Talos popsali škodlivý program CLOSEDQUORUM pro Windows, který po spuštění svěřuje rozhodování o svém dalším kroku jazykovým modelům. Místo pokynů od útočníka se může ptát až čtyř různých AI a podle jejich odpovědí jednat. Zatím však není potvrzené, že byl použit při ...

Bezpečnostní analytici Cisco Talos popsali škodlivý program CLOSEDQUORUM pro Windows, který po spuštění svěřuje rozhodování o svém dalším kroku jazykovým modelům. Místo pokynů od útočníka se může ptát až čtyř různých AI a podle jejich odpovědí jednat. Zatím však není potvrzené, že byl použit při ...

A domain used as harmless placeholder text showed up in roughly 1,700 repositories. Then somebody registered it and started serving malicious lures. That is the kind of week this was: forgotten assumptions turning into live attack surface. Elsewhere, weak service accounts, old bugs, exposed systems, phishing kits, and strangely easy exploit paths kept doing useful work for attackers. Nothing Ravie Lakshmananhttp://www.blogger.com/profile/[email protected]