Agregátor RSS

Apache Gravitino 1.2.1 - SSRF

Blocksy Companion 2.1.46 - RCE

PraisonAI praisonaiagents 1.6.77 - Remote Code Execution

mcp-server-kubernetes 3.8.x - Argument Injection

LuCI DHCPv6 - Lease Hostname Stored Cross-Site Scripting

Planyo_Online_Reservation_System 3.0 - Arbitrary File Read via SSRF

Ray 2.56.0 - Directory Traversal & Local File Inclusion

Hackers breached a heat-and-power plant facility in Poland, which supplies heat to about 50,000 residents, using a private APN (Access Point Name) to access an OT (Operational Technology) network. [...]

The system combines quantum dots and an OLED display, translating infrared light into a range of visible colors.

Night-vision technology has changed little for decades, producing grainy green images that make it difficult to distinguish objects and depth. Now, researchers have developed a system that converts infrared light into color images.

Standard night-vision goggles amplify the scant light available and convert it into monochrome green images that only vary by brightness. This is not a good match for our eyes, which are much better at picking out different shades than gradations of brightness.

But now a device built by researchers at the Beijing Institute of Technology translates infrared wavelengths into a color night-vision system. To demonstrate the system’s potential, the team built it into a pair of eyeglasses and even showed it could be bound to light-sensitive cells, making them responsive to infrared.

“We redefine infrared vision by transcending the monochrome paradigm, translating infrared spectral and intensity signatures into discernible color variations rather than mere brightness changes,” the authors write in a paper in Science Advances.

The prototype device, known as an upconverter, consists of a stack of thin films on a glass slide that is only a few hundred nanometers thick. The key component is a film of mercury telluride quantum dots. These semiconductor crystals, which are under four nanometers across and exhibit novel quantum mechanical effects, can detect tiny amount of infrared radiation.

Directly above this layer sits an OLED display, much like those used in phones and televisions. But where a standard display has one light-emitting layer, this one has two. A lower layer that glows red responds to relatively low levels of charge from the detector, while an upper layer that glows cyan needs a much stronger flow before it responds.

The upshot is that a weak infrared signal produces only red, but as the signal strengthens it bleeds into cyan, brightening the image and shifting its color as the two mix. The signal is supplied by the quantum dots, which release more charge when the infrared falling on them is brighter. But they also release more when the wavelength is shorter because shorter wavelength photons carry more energy.

This means the color on the display tracks how strong the infrared signal is and also roughly what wavelength it is. The team calculates a person could register infrared power differences of 0.11 milliwatts per square centimeter using color and brightness together, against 23.71 for brightness alone—a roughly 200-fold improvement.

To demonstrate the idea’s real-world potential, the researchers built the device into a spectacle frame. Exposed to infrared light, the lens shifted from deep red through orange to yellow as the illumination grew stronger. It could also render patterns like letters and track targets as they moved and rotated.

The team also tested the approach’s ability to augment natural vision. In one experiment, they engineered neurons to produce channelrhodopsin-2—a protein that makes a nerve cell fire when hit by blue light—and bound the upconverter to them.

When they hit the system with infrared, their device gave off blue light strong enough to trigger the proteins and stimulate the neurons. Electrical recordings also showed the currents inside those cells grew stronger as the strength of the infrared signal was turned up.

Finally, the team tried taping an upconverter over the eyes of mice and humans and recording the electrical responses in their brains and retinas respectively. Infrared pulses alone produced no reaction, but when the device was in place both reacted strongly.

The device is still a long way from practical use. All the demonstrations took place in highly controlled lab settings, the OLED display needs a power source, and the device also requires an infrared illuminator to generate reflections for the detector to pick up.

Nonetheless, it’s a first step towards far more powerful night-vision technology.

The post Monochrome No More: New Night-Vision Glasses Show Color appeared first on SingularityHub.

Partners Banka nově nabízí možnost koupit si přes její aplikaci bitcoin. Jednoduchá služba potěší ty, kteří do něj chtějí investovat, ale bojí se s ním manipulovat.

Podepsaná smlouva s novým dodavatelem ještě neznamená, že změna skutečně proběhla. Pokud energie dodával dodavatel poslední instance (DPI), musíte mu ji zaplatit, rozhodl Nejvyšší soud.

Dnes si popíšeme projekt nazvaný Lupa, což je zkratka získaná z „lua-python“. Tento projekt umožňuje propojení programů psaných v Pythonu se skripty zapsanými v jazyce Lua. Tyto skripty jsou spouštěny v sandboxu: v izolovaných interpretrech, což mj. zajišťuje větší bezpečnost.

S Gorgon Point (alias Kraken-refresh) vydává AMD i dva modely s deaktivovaným NPU. Liší se i dalšími parametry a uživatelům Windows 11, kteří nevyužívají Copilot+, mohou přinést i jednu malou výhodu…

V Indii se konečně podařilo realizovat klíčové kroky k cestě za vybudováním thoriového cyklu. Do provozu se po řadě zdržení dostaly první tři domácí těžkovodní reaktory s výkonem 700 MWe a začíná jejich hromadná výstavba. Zároveň se štěpná řetězová reakce rozběhla u domácího sodíkového reaktoru s výkonem 500 MWe, který by měl být druhým pilířem systému využití thoria. Podívejme se na jeho současný stav podrobněji.

aneb Presumpce viny jako princip ochrany zdraví před účinky některých látek

Čínský výzkumný tým prověřil teorii slapového točivého momentu, která vysvětluje rotaci dnes pozorovaných galaxií prostřednictvím nejranějších struktur ve vesmíru, kdy na sebe gravitačně působily shluky plynu a temné hmoty. Gravitace tehdy mohla takové shluky plynu roztočit a tuto rotaci mohly zdědit galaxie, které z nich vznikly.

A threat actor compromised the upstream infrastructure of BdThemes, a developer of premium WordPress web-design tools, and modified a remote JSON feed delivered to administrators' browsers to create rogue admin accounts. [...]

DEF CON hackers expanded their efforts to provide free cyber-defenses to rural water systems in the US to include managed detection and response providers, digital twins, and AI agents. On Friday, at the annual hacker’s conference, DEF CON Franklin and the National Rural Water Association (NRWA) announced a new program called the Water Watch Center. It will initially fund five providers - Defendify, Legato Security, L1 Secure, Rapid7, and Sentinel Technologies - to help small water utilities serving fewer than 10,000 people detect and mitigate breaches. The security providers will exchange threat info and share that with the NRWA, which provides technical assistance and operational support to small water and wastewater utilities across all 50 states. “We've had our volunteer experts out for two years in these water utilities, in the trenches with these folks, and the thing that we've realized is that there's just not a scalable delivery mechanism for cyber for these utilities when there’s 150,000 of them, and 98 percent of them are small businesses,” Jake Braun told The Register during an interview at DEF CON. Braun co-founded the Franklin project at DEF CON in 2024, and 350 people signed up that year to donate their time and talent to securing water facilities. “We groped around in the dark for what to do, and eventually realized we already know how to do security for small businesses - it’s MSSPs,” Braun said. “So why don’t we just do that?” He described the new Water Watch Center as a pyramid, with the NRWA at the top, the managed detection and response providers’ sensors hunting for security vulnerabilities across the utilities’ networks, and then Franklin volunteers fixing issues or responding to instructions as needed. “We have five initial MSSPs, which will expand to 10 eventually, based on the 10 CISA regions,” Braun said. “And then below that, we have volunteers who can help, and connect water utilities to MSSPs, so we’re not just sending alerts. We can take the alerts that CISA and the ISAC put out, and deliver cybersecurity. That’s been the missing piece: there has been no delivery mechanism for cybersecurity that’s scalable nationally - that's what this is.” Suspected Iranian hackers have hit numerous water systems in recent weeks, and most were small, community systems that left programmable logic controllers directly exposed to the internet using default or weak passwords. There’s no indication that the attackers used AI to help plan or carry out these digital disruptions. However, as both cyber and national security experts told The Register during conversations on the sidelines of Black Hat and DEF CON, it’s only a matter of time until that happens. DEF CON Franklin has a plan for that scenario, too. The Water Watch Center also partnered with Vanderbilt University to apply research from the DARPA Cyber Agents for Security Testing and Learning Environment (CASTLE) program. This partnership will create digital twins for a few WWC water and wastewater system environments, and then researchers will deploy both red- and blue-team agents across these digital dupes. The red-team attack agents try to hack the water systems, testing the blue-team defenders’ automated detection and response capabilities, with the eventual goal of deploying AI-based defense to water and wastewater facilities across the US. “They let it fight each other a gazillion times, and then they figure out when does the blue team win, so we can train agents to then later drop into these 150,000 water utilities,” Braun said. “There's already a 500,000-person shortage of cyber professionals. The idea that we're magically going to find 150,000 new people is a fantasy. There is no other way to really be able to combat the AI attacks that are going to be coming at these things.” ®

OpenAI has developed a new model called "GPT 5.6 Cyber," designed for vulnerability research, penetration testing, incident response, and remediation. [...]

I came across a LinkedIn post the other day that described “hypegineering,” which the poster explained refers to the moment when AI “marketing becomes more innovative than the technology itself.”

That post came from Ralph Aboujaoude Diaz, the global head of GRC for British consumer services company Haleon. Until last year, Diaz worked in operations cybersecurity for consumer goods giant Philip Morris. 

In his post, Diaz added that “side effects may include believing mediocre tech is revolutionary, confusing hype with progress, buying solutions to problems you don’t have and defending it like your job depends on it.”

As amusing as that might seem, the problem is frighteningly real. The sad truth is that enterprise IT executives are partly — perhaps mostly — to blame for the current hype around AI.

For many decades, senior IT leaders (pre-dating when it was called MIS) were the technology hype-deflators with razor-shape BS detection skills. That level of skepticism was needed. Tech vendors have always exaggerated and left out critical context when they weren’t outright lying about their products. 

Enterprises trusted the IT gate-keepers to ferret out reality from the smoke and mirrors. 

But there was a critical difference back then: senior management (especially CEOs, CFOs and board members) didn’t pay much attention to tech. They wanted the benefits, but they left the details to IT management to sort things out. With senior managers, benign neglect can be an incredibly good thing. 

As much as we might all think that we want our bosses to really care about our efforts, be careful what you wish for. (For Dilbert fans, think of the pointy-haired boss; a boss who has strong beliefs but no understanding of technology is a nightmare.) 

Alas, that is the situation many enterprises find themselves in today. IT management fully understands the level of absurd hype coming from a multitude of AI players. But unlike years and technologies past (RFID? NFC? Biometrics?), deflating hype balloons is easier when it’s comes solely from vendors. When senior managers start spouting this garbage, IT’s hype-deflation ability morphs into contradicting the very people at the top of their own corporate food chain.

That forces IT leaders who want to stay gainfully employed to do a lot of what used to be called lying. “Well, boss, yes these agentic systems have guardrails that will block destruction,” the lie begins, “but we can’t anticipate what any user or attacker might say in a prompt.”

That’s far more corporate acceptable than the actual truth: “Boss, a guardrail that an agent can disregard isn’t a guardrail. It’s more of a mild suggestion.” 

Or IT could say, “Well, yes, boss, autonomous agents could exponentially increase efficiency — as long as you’re OK with the risk that they might send our internal data to the competition.”

For the sake of the company, tech leaders and decision-makers need to reassert themselves and perform serious reality checks on all AI efforts. But this is more fraught than merely contradicting a top boss. IT  could be seen as embarrassing that top boss by pretty much proving that they were either naive or ignorant enough to be conned by the hype. 

Telling them they’re wrong seems nicer than calling them stupid. And yet, someone in IT has to find a politically palatable way to do both.