Agregátor RSS

Linux backdoors targeting telecom and network appliances in South Korea and Taiwan have been disguising their traffic as email services and seemingly legitimate processes to blend in and evade detection. Threat actors are known to name their malicious software after a legitimate operating system component or a process as a defense evasion measure. By borrowing the name of a real binary, it may Ravie Lakshmananhttp://www.blogger.com/profile/[email protected]

Každý měsíc vybíráme nejlepší chytré hodinky v několika kategoriích • Dělíme je podle zaměření i podle propojení s mobilními systémy • Nezapomněli jsme ani na fitness náramky

Atlassian is warning customers of a critical vulnerability, tracked as CVE-2026-21589, that can be exploited for arbitrary file-access in multiple self-hosted Data Center products, including Confluence, Jira, and Bitbucket. [...]

If you signed up for Trump Mobile, you may be part of an exclusive club of … ransomware victims. Criminals called BYOD claim to have broken into the Trump-branded mobile biz and leaked data belonging to 3,615 people, including names, email addresses, phone numbers, home addresses, and order details. BYOD is a new ransomware-as-a-service operation, and Trump Mobile is only the third organization posted on its data-leak site. According to the group’s posted claim, after telling Trump Mobile that it had been breached, the wireless provider replied: “We have no team to handle this" and “Anyone who hacks them are a terrorist.” “Well unfortunately for them, all 3615 customers and their PII, alongside telecom details are now up for grabs,” the leak site says. “Feel free to take a gander at it yourself, don't be shy, we (and them) certainly aren't stopping you.” The hackers reportedly told International Cyber Digest that they first infected a Liberty Mobile employee with an infostealer, and then accessed Trump Mobile via the MVNO. BYOD claims to still have access to Trump Mobile’s systems, and told the publication that neither wireless provider used any form of multi-factor authentication. Neither the Trump Organization nor Liberty Mobile responded to The Register’s questions about the breach. The data dump doesn’t include any details about US President Donald Trump or his family members, according to Straight Arrow News, which first reported the breach and verified some customers’ information. This could mean that the Trump family doesn’t eat its own dogfood. The leak does, however, include personal information about Eric Brunnett, vice president and chief information officer for the Trump Organization. Brunnett’s LinkedIn profile says he oversees “all Information Technology and Information Security for all aspects of the Trump Organization.” Additionally, one customer contacted by Straight Arrow said he paid a $100 pre-order deposit last year for Trump Mobile’s flagship smartphone, the T1, but never received a gold-colored device. Another criminal group, EndZone, also claimed to have breached Trump Mobile and leaked a stolen dataset a week before BYOD’s post in what “appears to be the same original breach,” according to security sleuth Dominic Alvieri. These aren’t the fledgling mobile phone company's only security snafus. Before these two apparent breaches, a security researcher in May claimed he discovered a now-plugged website vulnerability that leaked Trump Mobile customers’ details. The individual behind the discovery, who goes by "Louis" and described himself as "just a nerd between jobs with too much time on my hands," previously told The Register that the website’s data could be scooped up with a simple POST request.®

Valve po měsíci znovu aktualizovalo softwarové a hardwarové statistiky hráčů ve své síti. Došlo přitom ke dvěma větším změnám v oblasti pamětí a grafických karet. Jak tedy vypadá typický herní počítač? Přes 71 % uživatelů jede na Windows 11, necelých 24 % patří Windows 10, Linux má 3% zastoupení a ...

UK fashion retailer ASOS confirmed a data breach Tuesday after hackers sent unauthorized push notifications through its mobile app while claiming to have stolen customer data from the company's Snowflake environment. [...]

Tyto filmy a seriály jsou teď na českém Netflixu nejoblíbenější. Nerozlišujeme žánr, stáří ani hodnocení na filmových webech. Jde o souhrnnou oblíbenost za poslední týdny, kterou zjišťuje web FlixPatrol.

A number of studies reported a decline in tech jobs in September as the US continues to get squeezed by geopolitical and economic instability.

Tech consortium CompTIA said 10,350 positions in the technology sector were lost in September, lower than the 14,700 positions cut in August.

But economy-wide, tech jobs — which include IT roles not associated with tech sector — took a bigger hit. Tech jobs across all industries fell by about 6,000, a sharp reversal from the 86,000 added in August.

CompTIA’s report is based on an analysis of the US Bureau of Labor Statistics’ September jobs report, which found that only 29,000 nonfarm jobs were added in the US in September, lower than expectations. The US added 133,000 jobs in August.

Tech worker unemployment ticked up to 3.3%, but that was below the 4.2% national rate, according to CompTIA. The strong August numbers raised hopes that tech jobs were stabilizing, but September’s numbers dashed that hope.

Separately, tech companies announced 10,799 job cuts in September, a 77% rise from the 6,103 announced in August, according to numbers from Challenger, Gray & Christmas.

The tech sector has cut 165,925 jobs this year, up 54% compared to the same period in 2025. US employers cut 43,281 jobs across all sectors in September, compared to 52,881 in August.

Employers are taking a wait-and-see approach in hiring due to rising costs and political uncertainty, despite fewer jobs getting cut compared to August, said Andy Challenger, chief revenue officer at Challenger, Gray & Christmas.

“Employers are facing high energy costs, an uncertain war in Iran, a rate hike that could make hiring more expensive, plus the likelihood of surging healthcare costs,” Challenger said.

Amid the uncertain environment, employers are hiring cautiously, as jobs are tied directly to strategic business priorities, said Ger Doyle, ManpowerGroup’s regional president in North America.

“The market is no longer defined simply by how many people employers hire, but by how precisely they hire,” Doyle said.

Earlier this year, AI was often cited as a main reason for job losses. But that wasn’t the case in September. AI was cited for only 3,961 of the 43,281 job cuts, or about 9% of the month’s total, Challenger, Gray & Christmas said.

Overall, AI was cited for 120,136 job cuts so far in 2026, which is 21% of all cuts.

Even as tech jobs decreased overall, CompTIA noted, Lightcast job posting data showed that US employers posted 272,040 new IT job openings in September, an increase of 16% from September 2025. That mismatch indicates a search for specific skills.

ManpowerGroup said AI skills are the most in demand. “The roles that matter most also take the longest to fill,” Doyle said.

Job postings typically stay open for 61 days, while filling engineer roles typically takes 77 days, Doyle said.

Active job postings requiring AI-related skills totaled 349,821 in September, an increase of 32,327 postings from August, CompTIA said.

Světové ekonomické fórum (WEF) vybralo deset nejslibnějších nových technologií roku 2026, které by mohly začít už relativně brzy měnit svět okolo nás. Nejsou to tedy mediálně vděčné studie převratných vynálezů, které ovšem jen málokdy opustí fázi primárního výzkumu a vědeckou laboratoř, ale ...

A new campaign targeting ad account managers uses fake ChatGPT, Gemini, Claude, and Perplexity sites that steal login credentials and multi-factor authentication (MFA) codes through browser-in-browser attacks. [...]

Microsoft is adding two extra file types to its Outlook block list to strengthen security. The file types are .msix and .msixbundle, used for Windows application packages and bundles. The change affects New Outlook for Windows and Outlook on the Web in Exchange Online. By default, users of the affected clients will no longer be able to download or open attachments with these extensions, which is no bad thing because blindly installing a malicious .msix package could compromise a device. That said, although Microsoft noted that the file types were "infrequently used," there are legitimate reasons for their presence in emails. Administrators who need to permit these attachments can add the extensions to the AllowedFileTypes property of the relevant OwaMailboxPolicy before the rollout, scheduled for early to mid-November 2026. "This update is part of our ongoing efforts to strengthen security and help protect organizations from potentially unsafe file attachments," Microsoft said. The Windows giant's application packaging system has come under fire over the years. Microsoft disabled the ms-appinstaller protocol handler by default in December 2023 after attackers abused it to distribute malware. The attachment block adds another layer of protection, unless administrators explicitly allow these file types. Other file types blocked by Outlook on the Web include .py Python files, .ps1 PowerShell files, and .cab files. It's a little surprising that it has taken until now for .msix and .msixbundle to be added to the list, considering the havoc malicious packages can wreak on a system. Renaming an attachment's extension or sending a download link may get around the attachment restriction, but neither makes the package safe. Persuading someone to download and install it remains a route for miscreants, even with Windows' other protections in place. ®

When it comes to consumer protections, Europe is following its own path. That may be visible in its quixotic-seeming decisions that allegedly prevent Apple from introducing Siri AI in the European Union. It’s time to begin to grapple with what those decisions mean.

I think the EU has got it wrong in how it has chosen to enforce its Digital Markets Act against Apple. The refusal to figure out a mutually satisfactory way to apply the intent of the DMA on Apple’s business practices while protecting its stated values around privacy is a failure of imagination and diplomacy. Apple and Japan previously reached an agreement that achieved positive impacts for third-party developers while protecting the product design integrity and customer privacy the company and its customers care about.

Prevention is not cure

That lack of deal-finding in the EU is preventing the introduction of Apple Intelligence and Siri AI to customers in the trading bloc. 

When it announced these AI features, Apple told us it had proposed some kind of technological fix that would provide third-party product makers, including AI product makers, with user information to drive their products while also protecting user privacy. Europe declined to work with Apple on those terms, which is why the company has not introduced Siri AI there. 

European regulators would, of course, disagree with that account, but this is what has been suggested.

What Apple’s privacy fix could look like

More recently we got the chance to see what that kind of AI-enabling tech privacy protection might look like when Apple introduced Audio Intelligence, particularly Siri Recap. This relies on a semi-magical selection of complementary technologies that enable the feature while protecting personal privacy.

It does this by analyzing audio in real time, summarizing it, removing personally identifiable data from it, and sending a vastly reduced and anonymized data set to the cloud for final processing. The idea here is that your data for the most part is only ever handled by your device, is not saved, and only just enough information is passed down the line. 

I believe this hints at the technical approach Apple had hoped to build to protect Siri AI in the EU. Distilling and anonymizing personal data while still making it possible to run effective AI tools is the name of that game. Extending that approach to third parties and other domains — including video — will take time, which is what Apple asked Europe to provide.

The EU, we’re told, didn’t budge. That’s a shame, in part because European customers won’t get to use Apple’s more private take on AI, but also because they will continue to find their data exposed to AI firms that are not focusing on privacy. 

Europe wants its own AI

I suspect Europe doesn’t mind that too much, because it is hoping to foster the evolution of its own AI solutions, rather than becoming even more reliant on US technology firms. 

The EU is already investing heavily in tech sovereignty. Its TESTA-EIRIS system, for example, may have a silly name but is an attempt to build a regional, localized, sovereign communications infrastructure for European governments and institutions. This infrastructure will no doubt be used within the implementation of localized AI systems and services. 

You cannot underestimate the drive to sovereign tech solutions; it’s an international movement and all about building national resilience and crisis independence. A 2025 McKinsey report showed that 71% of executives, investors, and government officials worldwide now see sovereign AI as an existential concern. That means many nations will be looking to deploy their own region-specific solutions. It also means Big Tech firms like Apple — or US frontier AI firms, given their market share — must identify new business practices that respect international differences.

Surely there’s a middle ground?

This inward-focused drive toward sovereign tech reflects a wider malaise in international relations. Ironically, it is one that might benefit from the kind of “private by design” approach Apple is pioneering with Audio Intelligence. 

Will it be possible for Apple’s systems to use a tech like this to empower third-party systems while protecting personal privacy? If Apple achieves this, it should help sovereign tech deployment, as it builds in privacy at the end-user layer, which can then be picked up by whatever national AI solutions eventually emerge. 

It probably isn’t enough for the EU sovereign vision, of course, but could be a positive compromise pending the creation of a viable European hardware solutions manufacturer, which seems a very, very, very long way away. But positive compromise doesn’t appear to have been the hallmark of Europe’s DMA dealings with Apple so far, which may well be why the latest word from Mark Gurman is that Europeans must expect to wait at least five more months, and potentially much longer, before they even hear a hint that the two sides have reached a rapprochement. 

In the meantime, European users on mobile devices remain more likely to use Claude or ChatGPT than less popular EU-made AI services, such as Mistral. All without the kind of privacy protections in place Apple aspires to deliver. 

Surely there’s a middle ground? 

Surely Apple’s promised technology to enable AI while protecting privacy is something the EU would benefit from? Maybe the two sides should try to figure something out. 

Now please subscribe to my daily, human-curated Apple-related news headline feed at The Core, or follow me on BlueSky, LinkedIn, or Mastodon.

Strata je open-source inferenční engine, který umožňuje lokálně provozovat rozsáhlý čínský model Qwen3.8-Flash-Next, který by jinak nejspíše vyžadoval serverovou infrastrukturu, na běžném herním počítači s alespoň 12 GB VRAM, 32 GB RAM a dostatkem místa na SSD. Nároky na paměť a rychlost generování se liší s použitou variantou modelu Qwen. Zdrojový kód je dostupný na GitHubu, pod licencí MIT.

RMM platforms give MSPs privileged access across customer environments, making their security controls critical to limiting risk. Acronis outlines eight controls MSPs should test when evaluating RMM software, from patching and privileged access to recovery and tenant isolation. [...]

According to new figures from Statcounter, Windows 11 continues to gain users at the expense of Windows 10. The newer operating system is now estimated to account for 71.5% of all Windows computers globally, while Windows 10 has dropped to 27.8%, reports The Register.

Microsoft itself does not publish any user figures. Statcounter’s estimates are based on tracking code installed on websites globally. These figures are not broken out by consumer and business use.

A major shift to Windows 11 occurred when mainstream support for Windows 10 ended on October 14, 2025. Just a month before that transition, about half of PCs still ran Windows 10, according to executives from Dell and HP.

Since then, businesses and consumers have been able to continue receiving security updates through Microsoft’s Windows 10 Extended Security Updates (ESU) program. Consumers can enroll in the program for free. After saying these updates would be available for only a year, Microsoft extended the consumer ESU program for another year, until October 12, 2027.

Business customers must pay to enroll user devices in the Windows 10 ESU program. The first year of updates cost $61 per device. As the second year begins, the price doubles to $122 per computer. The price will double once more, to $244 per device, for the third and final year. These price increases are expected to further accelerate the transition to Windows 11.

Related:

• IT leaders scramble as Windows 10 deadline nears
• As Windows 10 end-of-support looms, IT faces a painful choice

Americký prezident Donald Trump oznámil vznik federální Jednotky pro superinteligenci (Super Intelligence Force), která má koordinovat postup vlády, technologických firem, náboženských organizací a dalších institucí v oblasti rychle se rozvíjející umělé inteligence (Trumpem oficiálně nazývanou superinteligencí). SIF, podřízená přímo Trumpovi, má pomoci Spojeným státům udržet v oblasti SI technologický náskok nad světem a analyzovat rizika a příležitosti této technologie. V čele jednotky stojí ředitel národních zpravodajských služeb Jay Clayton, dalšími členy jsou šéf Federální obchodní komise Andrew Ferguson, náměstek ministra obrany Emil Michael a ředitel Úřadu pro personální řízení Scott Kupor.

GitHub Copilot CLI may reveal developer secrets if it comes across instructions that tell it to do so, depending on the underlying model. The coding agent tool was flagged earlier this year for being susceptible to indirect prompt injection. That's when a model ingests text from a source other than the user that directs it to take some action outside the scope of its intended function. This is more of the same, with a twist. According to security researchers at Adversa AI, GitHub Copilot CLI suffers from the same vulnerability identified in Grok two months ago: Cryptographic Context Injection (CCI). Imagine a GitHub Copilot CLI user is working on a project and running the agent in autopilot mode. In other agentic coding tools like Anthropic's Claude, that's the default, but it remains optional for GitHub Copilot CLI. Given that condition, the next requirement is for the CLI tool to read a web page with a malicious set of instructions that have been encrypted with a private key published on the same site. "Static guardrails read text; they do not run it," explained Rony Utevsky in a blog post provided to The Register. "CCI ships malicious instructions as strong ciphertext, along with the key material and an instruction to decrypt, and induces the agent to run that decryption in its own code execution runtime." Active content classifiers that might be reading ingested text as a model defense would miss the encrypted code, unlike encodings like base64 or substitution ciphers that can be undone because the model learned how to decode in training. The model lottery The attack chain goes like this: The user runs Copilot CLI and asks it to fetch a specific URL. The page contains encrypted content, decryption instructions calling for use of Python, and two possible decryption keys. The first key is fake. It's a template that the agent tries to build by reading targeted files from disk (e.g., the user's .env file). Those secrets then get added to the key string. The initial decryption is attempted with this phony key but fails. So the second key is tried, the decryption works, and the agent is presented with instructions to fetch another URL for more context – but that URL contains the harvested secrets and the network request transmits them to the attacker. This doesn't work all the time, however. It depends on the model, which isn't always obvious to the user. GitHub Copilot CLI currently uses either Microsoft's own model, mai-code-1.1-flash, which executed the full attack chain on 50 percent of attempts, or one of two OpenAI GPT-5.6 models, both of which refused the attack payload. Utevsky describes the situation as a model lottery. "On the paid account we tested, the vulnerable model was not the default and had to be selected by hand," said Utevsky. "But on an account with model selection left on Auto, the router assigned the vulnerable model on some sessions and a safe one on others, with no action by the user away from defaults. The user does not choose, and does not see, which model handled the session." Adversa says it reported the vulnerability through GitHub's bug bounty program on September 17, 2026, and GitHub's triage team validated the finding but declined to treat it as a vulnerability. A GitHub spokesperson said as much to The Register, arguing that the user's actions amounted to consent for what followed: "GitHub values the contributions of our security research community and is committed to investigating reported security issues. After investigating, we determined this requires a user to intentionally direct Copilot CLI to fetch attacker-controlled or untrusted content and confirm they want to trigger the action, and thus is not a product vulnerability. While this is not a security issue with the product itself, we are always looking for opportunities to improve our products." Adversa disagrees with that call and says the attack chain presently works as described. ®

Firma Tavus se pochlubila novým AI modelem Griffin, který zvládá vést videohovor s člověkem a v reálném čase reaguje na slova i obraz, gestikuluje a obecně velmi připomíná komunikaci s běžným člověkem přes Meet, Teams či Zoom. Celý systém zvládá průběžně generovat 720p video v blocích po 350 ms. ...

OpenAI has announced that within a few weeks it will introduce a digital watermark for text generated using the company’s AI tools, ChatGPT and Codex.

This move comes in response to the EU’s new AI regulations, introduced two months ago, which stipulate that AI-generated content must be identifiable. Competitor Anthropic introduced a similar feature for its AI tools in August.

OpenAI’s new watermark will be available worldwide, but it is enabled by default only within the EU. In other words, users in other parts of the world can ignore it.

According to TechCrunch, it appears possible to edit out the watermark, so it remains to be seen whether it serves any significant purpose.

This article originally appeared on Computer Sweden.

The publisher of Wikipedia said Monday that OpenAI agents attempted to hack a note-taking tool it hosts, made unauthorized edits, and sent millions of resource-intensive requests to its infrastructure, in the latest instance of OpenAI systems taking harmful and potentially dangerous actions.

The objective of some of the OpenAI agents’ actions, the Wikimedia Foundation said, was to use Wikipedia as a proxy for fetching data from third-party sites. In one case, the agents posted “malicious edits” that were intended to repurpose a citation tool as a proxy. In another, the agents made unsuccessful attempts to compromise the Wikipedia Etherpad note-taking tool so it would serve the same purpose.

The agents also made millions of automated API requests, crawled millions of pages, and made hundreds of thousands of queries to the Wikidata Query Service. The last action may have contributed to a partial shutdown of the query service in May, the publisher said.

Read full article

Comments