Agregátor RSS

V Rusku proběhly volby do Státní dumy a prezident Putin odevzdal hlas online. • Podle zveřejněného videa použil počítač s neaktivovanými Windows 10. • Microsoft v zemi své produkty neprodává už čtyři roky.

Malware already running on a Mac can quietly take over Meta's Muse assistant and use the broad access its owner granted the app, security researcher Patrick Wardle has shown in a proof-of-concept released on September 21. It works by changing a hidden setting so that when the user taps the microphone and dictates a prompt, the words go to the attacker instead of Meta. The flaw is in

Malware already running on a Mac can quietly take over Meta's Muse assistant and use the broad access its owner granted the app, security researcher Patrick Wardle has shown in a proof-of-concept released on September 21. It works by changing a hidden setting so that when the user taps the microphone and dictates a prompt, the words go to the attacker instead of Meta. The flaw is in Swati Khandelwalhttp://www.blogger.com/profile/[email protected]

The state of California has joined the growing number of governments and communities at all levels across the US taking proactive, even preemptive, measures to keep data center development under control.

California Governor Gavin Newsom signed what he called the “most comprehensive data center laws in the nation” on Monday. While the seven bills don’t block data center development, they do reinforce requirements for reporting data centers’ energy and water use, and ensuring they pay their fair share of utility costs.

Other states — and even local community groups — have been taking more direct action. At least 45 projects worth an estimated $68 billion were blocked or delayed in the US in the second quarter, according to research by Data Center Watch. There are now 843 identified opposition groups in the US, and 49 states are scrutinizing data center development, it said.

Project disruption remains at an “elevated level” and opposition has become “more local and project-specific,” targeting permitting, infrastructure, and individual policy decisions, according to Data Center Watch.

Some communities are getting ahead of development by preemptively mandating data center development moratoriums, even before developers have filed permit applications or expressed any interest at all.

Data centers no longer ‘invisible infrastructure’

“The growing pushback is not surprising,” said Abbas Jaffery, principal advisory director at Info-Tech Research Group. “The conversation around data centers has shifted from a routine IT capacity decision to a complex energy, community, and economic issue.”

Anti data center sentiment is higher than it’s ever been, as AI gobbles up more and more resources and requires never-before-seen magnitudes of data.

State-by-state legislative activity is accelerating in response, with 30 state governments adopting or introducing legislation, resolutions, and executive actions targeting siting, cost-sharing, and electricity and water constraints, Data Center Watch reported.

Further, regulatory scrutiny is increasing across 49 states, and communities are clamoring for local, state, and national politicians to respond to data centers already in development.

California is a case in point; Newsom has just signed seven bills addressing data center costs, disclosures, and infrastructure. Operators will be required to pay their “fair share” for updates to the state’s electricity grid, comply with California energy procurement requirements, and bring on new clean energy supply.

Data center companies will also need to provide information on water use, supply, efficiency, and drought planning, and pay for any required infrastructure upgrades. Additionally, data centers will be ineligible for blanket environmental exemptions; they must demonstrate that their projects meet state energy, water, and fuel consumption standards prior to approval.

“As the innovation economy continues to grow, data centers are being presented as a solution, but with little thought or oversight of what that means for nearby communities,” Newsom said in Monday’s announcement. The goal of the bills is to protect communities from “shouldering the cost as industry reaps massive profits.”

Other regulatory initiatives can be found across much of the country: Independent electricity marketplace Electric Choice tracks 321 moratoriums and restrictions across 32 states, with pending legislation in 17 states. Just last week, Virginia Governor Abigail Spanberger unveiled a Data Center Accountability Framework, while in July, New York Governor Kathy Hochul placed a temporary moratorium on hyperscale data centers in her state.

“Data centers are no longer invisible infrastructure,” said Justin St-Maurice, technical counselor at Info-Tech Research Group. “They are being built in communities, where residents can directly experience the noise, energy demands, and other consequences.”

Enterprises must take a new approach

While some concerns may be more legitimate than others, all require a stronger understanding and partnership between builders and communities, noted Matt Kimball, VP and principal analyst at Moor Insights & Strategy.

“Dismissing fears around water consumption, for example, by showing a spreadsheet at a local planning committee meeting, doesn’t resolve concerns for a community that is already suspicious,” he said.

Community opposition “is real, and it’s everywhere,” and the new strategic pillar for data center builders and operators is social outreach, Kimball noted. Those proposing data centers must be able to provide credible answers about usage and community impacts, listen to concerns, and commit to transparency.

Most enterprises aren’t building gigawatt campuses, he pointed out, but they are paying the price downstream in colocation availability, lead times, pricing, and other factors. Predictability is the big question, supply is already tight, and every delayed project removes capacity factored into forecasts.

“IT leaders should treat power and space as a strategic constraint rather than a facilities line item,” he said.

This means extending planning horizons and committing to colocated capacity earlier on. Ask operators where their sites actually are in the permitting and entitlement process, not just their roadmap, Kimball advised. Also, he said, “squeeze every bit of productivity out of the footprint you already own.” For instance, older servers consolidated onto current-generation platforms can free up rack space and power for AI projects without “a single extra square foot of data center space required.”

Buyers should also be deliberate about workload placement and underlying infrastructure. What can sit in the cloud and what needs to be closer to the premises? What kind of inference is running? “Not every workload requires the latest and greatest GPU cluster,” Kimball said; in fact, some don’t require a GPU at all.

He pointed to companies like Furiosa AI that are building more efficient hardware expansion cards, while CPUs like Intel’s Xeon feature on-chip accelerators that can efficiently handle inference workloads. Nvidia, for its part, is claiming its latest technology advancements can provide up to 40% more GPU capacity.

He noted that other interesting technologies to watch are two-phased cooling, and heat recapture and reuse. For instance, at one data center in Switzerland, generated heat is repurposed to heat nearby homes.

‘Radical optimization’ the way forward

Info-Tech’s St-Maurice agreed that IT leaders cannot assume they can rely indefinitely on public cloud capacity at a predictable cost. Some organizations are reconsidering their compute strategies as token costs rise, repurposing internal data centers, running open-weight models, and using a tiered approach combining local, enterprise, private cloud, and public cloud resources.

“The goal is to direct each workload to the most cost-effective environment and gain more control over operating costs,” he said. While regulations will likely lead to innovation, more space, cooling, and power alone will not solve the problem.

The more sustainable path is “radical optimization,” St-Maurice said: Reducing energy cost per token and using compute more efficiently.

Indeed, when considering new data centers, enterprise leaders must ask whether the supporting power, cooling, water, and grid infrastructure actually exist, in what timeline, and at what cost, Info-Tech’s Jaffery advised.

“Organizations that integrate physical grid and power constraints into their IT architecture early will maintain speed to market,” he said, “while those that treat power as an afterthought will face costly deployment delays.”

This article first appeared on Network World.

A new flaw in WordPress core let an anonymous visitor leave a comment that planted a hidden script on the page. If a logged-in administrator later opened that page, the script could run code on the site's server. WordPress fixed the flaw, tracked as CVE-2026-93485 and called "Comment2Shell," on September 17 in version 7.1.1 and told site owners to update right away. There is

A new flaw in WordPress core let an anonymous visitor leave a comment that planted a hidden script on the page. If a logged-in administrator later opened that page, the script could run code on the site's server. WordPress fixed the flaw, tracked as CVE-2026-93485 and called "Comment2Shell," on September 17 in version 7.1.1 and told site owners to update right away. There isSwati Khandelwalhttp://www.blogger.com/profile/[email protected]

V červnu Ukrajina provedla první dokumentovaný výsadek robotů v dějinách válečnictví a o pár měsíců později vojenští blogeři referují o další metě. Kdesi ve vlnách Černého moře se utkaly dva dronové čluny. Shora vše sledovaly UAV. Ukrajinské námořnictvo tvrdí, že jeden z jeho hladinových robotů ...

Po delší době přichází pozitivní zpráva ze světa polovodičové výroby. Wafer na procesu TSMC A14 může být jen o ~20 % dražší než na procesu TSMC N2, což by se obešlo bez zdražení v přepočtu na čip…

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a now-patched security flaw impacting Zyxel GS1900 series switches to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerability, tracked as CVE-2026-7273 (CVSS score: 8.8), is a stack-based buffer overflow vulnerability that could result in arbitrary operating

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a now-patched security flaw impacting Zyxel GS1900 series switches to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerability, tracked as CVE-2026-7273 (CVSS score: 8.8), is a stack-based buffer overflow vulnerability that could result in arbitrary operating Ravie Lakshmananhttp://www.blogger.com/profile/[email protected]

CISA has added CVE-2025-39964, a flaw in the Linux kernel’s built-in cryptography interface, to its list of vulnerabilities being used in real attacks.

Security researchers have shown how hidden instructions in an AWS AgentCore support ticket could push an AI agent into running commands as root and exposing a service credential.

The crun container runtime has changed how GPU-enabled workloads launch a key graphics helper.

Linux developers have fixed two memory-safety bugs in the subsystem that lets hardware move data without constant help from the CPU.

Linux developers have fixed two input-system bugs that could expose small pieces of leftover kernel memory to a local program.

A Google Gemini AI agent broke into three companies in May, guessing the credentials for one and discovering the credentials for the second two in a public repository, Google confirmed on Monday.

But the more interesting background to the story, which was broken by The Wall Street Journal on Friday, is that the May incident stemmed from a series of cybersecurity tests performed by security research firm Irregular on behalf of four AI giants: Google, Anthropic, OpenAI and Meta. All four companies experienced agent misbehavior resulting in cybersecurity incidents, but of the four, only Google never publicly disclosed its agent’s activities. Indeed, it didn’t reveal the breaches at all until contacted by a WSJ reporter.

Irregular described the incident in August, around the same time as Meta published its version and Anthropic and OpenAI revealed theirs.

The Journal story noted, “the hacks occurred while the model was participating in a capture the flag exercise conducted on infrastructure belonging to Irregular to test the model’s cybersecurity capabilities. It was tasked with retrieving information from software operated by a fictional company inside the testing environment. The fictional company shared the same name as a real company. Although the model wasn’t intended to be able to get online, internet access was unintentionally made available, according to Irregular.”

The three small companies whose systems were violated had, according to one source familiar with the testing, “almost no [cybersecurity] infrastructure.” In short, none of the three was in a position to put up much of a fight when the Gemini agent successfully broke in.

According to a Google official, who asked to not be identified, the name of the public repository was similar to the name of the fake company. And within that repository were the names and credentials of the other two companies.

Most analysts and consultants focused not on the hacks themselves, but on the reasons Google gave for being silent on the successful attacks. 

Google said that the agents stopped as soon as they realized the victim companies were real businesses. “No harm was caused,” the Google source said. “There was not an issue of model misalignment.” 

The source confirmed the Wall Street Journal story, which said, “Google compared the episode to a ‘bug bounty’ program in which hackers are rewarded for finding and reporting security vulnerabilities to their owners” and then quoted Heather Adkins, Google’s vice president of security engineering, saying, “In this case, the model acted appropriately.”

Define ‘harm’

Analysts generally disagreed.

“What does Google define as harm? Is it the same as the target company? Downtime, unauthorized access, and exfiltration of data may not result in immediate harm, but could have lasting impacts,” said Ryan O’Leary, an IDC research director. “The comparison to a bug bounty program is tenuous at best. If I broke into Google HQ and took nothing and caused no harm, it is likely I would still be prosecuted for trespassing.”

Nader Henein, a Gartner VP analyst, had a similar take on the situation. 

“If a member of my neighborhood watch broke into my house, walked around a little bit and then left, I’m fairly certain the authorities would not classify it as an act of civic engagement,” he said. “In this case, if the impacted sites had bug bounty programs and Google had programmed the agents to discover bugs, the rebuttal might make sense, otherwise it is quite a weak argument.”

That said, he added, “Google does make an excellent point when they underlined ‘the importance of training powerful AI models to act responsibly’ and I look forward to seeing how Google plans to ensure that this doesn’t happen again.”

Inappropriate behavior

But Jeff Pollard, VP/principal analyst at Forrester, took exception to Google’s assertion that the Gemini model had behaved appropriately.

“The model pursued an authorized objective through an unauthorized path, crossed from a simulated environment into real companies and gained access without consent,” he said. “This is another area where regulations haven’t kept up with the pace of technology change. There are two sides to this: regulations with respect to the agentic escape and intrusion, and then the regulatory issues for the victim companies in terms of their requirements for disclosure. Google is only responsible for one half of that equation.”

Erik Avakian, technical counselor at Info-Tech Research Group, also noted that it’s critical that companies have rules about when to disclose unexpected and problematic model behaviors. 

“I don’t think every unexpected thing an AI model does needs to become a public incident. But there should be a clear line once an autonomous system crosses an authorization or trust boundary,” he said. “If an AI system leaves a controlled environment, accesses a real third-party production system, uses credentials, retrieves data, escalates privileges, or takes some other action that was never authorized, that should, at minimum, trigger disclosure to the affected organization along with a formal incident investigation.”

Even if there was no damage from the intrusion, Avakian said, public disclosure should happen “if the incident exposed a larger or repeatable problem with the controls around the model.”

Independent technology consultant Steven Eric Fisher also stressed that companies need to be strict and consistent about disclosing agent mishaps. 

“What I find most puzzling about these incidents is not simply that an AI system crossed a boundary,” he said. “It is the emerging posture around culpability once it does. Stopping after an authorization boundary has already been crossed is not the same thing as preventing the boundary from being crossed in the first place. I do not think ‘the AI did it’ can become an accountability boundary.”

Control failure

And, argued Justin Greis, CEO of consulting firm Acceligence, the absence of harm and absence of significance are not necessarily the same thing. 

“An event can be consequential because of what it demonstrates about a system’s capabilities or controls, even when everyone gets lucky and nobody is damaged,” Greis said. “Gemini stopping itself after recognizing that it was inside a real company’s environment is a positive safety signal. Gemini being able to get there in the first place is a control failure. Both things can be true at the same time.”

Frank Dickson, principal analyst at Dickson Research, articulated the harshest criticism of Google.

“The model’s behavior is the least interesting part of this story. Google’s conduct afterward is the most damning part,” he said. “This isn’t a story about Gemini going rogue. It’s a story about one shared testing vendor’s infrastructure mistake hitting four AI labs at once, and about Google being the slowest and least forthcoming of the four in telling anyone about its own copy of that failure.”

He pointed out, “Irregular notified all four labs in late July. Google didn’t go public until September 18, seven weeks later, and only after the Journal called for comment. Let’s face it: that’s not a company that judged that the incident didn’t warrant disclosure. That’s a company that watched three competitors take the reputational hit for the same underlying failure and waited to see if it could avoid its turn. It couldn’t, and the only reason we know any of this is that a reporter asked.”

This article originally appeared on CSOonline.

Canonical oznámil vydání Zephyr 26.04 LTS. Jedná se o komerční distribuci operačního systému pro mikrokontroléry Zephyr (Wikipedie) s podporou až 15 let.

Gravity Linux je linuxová distribuce určená pro Apple Silicon s čipy M4 a novějšími. Vydána byla alfa verze pro M4 Mac mini. Gravity Linux je fork Asahi Linuxu.