Agregátor RSS

SunBooster je kompaktní zařízení, které se připevní na horní hranu monitoru a při práci na počítači na člověka září patentovanou technologií SunLED. To jsou diody emitují světlo blízké infračervenému pásmu (NIR, Near-Infrared), tedy tu složku slunečního světla, kterou na cestě do interiéru ...

Linux can move a network packet's data in memory while some networking code still holds its old address. That saved address is called a pointer. A patch and maintainer discussion posted on Sep 7, 2026 describe how that mismatch can make an IPv6 Segment Routing eBPF action write to memory that Linux has already released. Segment Routing steers packets through specified network waypoints; eBPF lets small programs run inside the kernel to customize tasks such as packet handling.

Microsoft says the August 2026 security update may trigger 0xc0000409 errors on Windows Server 2016 systems where the Compatibility Appraiser diagnostic service is enabled. [...]

Secure by design videoconferencing products may be vital for customer trust and operational resilience, but if they aren't usable, organizations are on a hiding to nothing. Videoconferencing security is no longer a routine item on the IT checklist. Organizations now rate security as their most important purchase criterion (31 percent) when selecting such products, ahead of price (26 percent) and quality (25 percent), according to IDC. The implication, is that security and privacy are no longer optional. Instead, they are the foundation of effective meeting room solutions, enabling safe and unified collaboration. Yannic Laleeuwe, marketing director for Barco's ClickShare, agrees. Collaboration and videoconferencing solutions have become "mission-critical business systems" in her view, because they process significant volumes of the most sensitive corporate information while sitting on crucial networks and cloud services. "Historical security incidents, combined with the rapid growth of hybrid work since the COVID-19 pandemic, have demonstrated that weaknesses in these platforms can lead to data breaches, operational disruption, regulatory exposure, and loss of customer trust," Laleeuwe explains. "Consequently, security has evolved from a technical consideration to a strategic procurement and governance priority for organizations worldwide." The IDC study indicates that most businesses' biggest security concern is exposure to cyberattackers, which can lead to incidents such as malware propagation (47 percent). Next on the list is devices falling out of compliance because of missing patches and updates (39 percent). Third comes risky employee behavior, which can result in inadvertent, or even deliberate, data exposure (37 percent). These issues become particularly problematic in a hybrid working environment, where meeting rooms have evolved into highly connected, distributed spaces. Employees now expect ready access to business applications, data, and collaboration tools wherever they happen to be working. An expanding attack surface Such demands expand the potential attack surface for meeting room technology. Users, devices, cloud services, home networks, and collaboration platforms all become endpoints on the corporate network, even though many were never designed to operate in an enterprise IT context. That leaves them as potential entry points for attackers. "Collaboration solutions are particularly attractive targets because they are connected to corporate systems and frequently process sensitive information, including intellectual property, strategic discussions, and customer data," Laleeuwe points out. The situation grows worse when IT management becomes too decentralized. "As organizations adopt hybrid working and distributed IT models, maintaining centralized visibility and governance becomes increasingly challenging as local teams may implement different technologies, configurations, and processes," Laleeuwe adds. She acknowledges that certain operational responsibilities can, and should, be handled locally to support business agility and regional requirements. But complete decentralization often leads to inconsistent security controls, fragmented risk management, and reduced ability to detect and respond to cyber threats across the enterprise, she warns. Mounting global regulatory pressure On top of that, international regulatory pressure on both security and security technology is producing an increasingly complex legislative landscape, because policymakers and industry bodies now recognize that cyber incidents can threaten critical services, national security, and even economic stability. In Europe alone, legislators have introduced a raft of legal frameworks, including the European Union's Network and Information Security 2 Directive, which mandates strict risk management and incident reporting for medium-to-large organizations across 18 critical sectors. Other legislation, such as the Radio Equipment Delegated Act, is intended to secure wireless equipment against cyberattackers. Another, the Cyber Resilience Act, provides safeguards for businesses and consumers when purchasing any hardware or software products connected to a network. Global standards such as ISO/IEC 27001 now define best practice for information security and risk management, and offer organizations a framework for operational trust. In other words, organizations must now embed security considerations across all their key activities, which include governance, risk management, supply-chain management, and incident response. They also need to make certain that their technology providers integrate security across the entire lifecycle of their products and services, from design and development through deployment and end-of-life support. Non-compliant collaboration and videoconferencing technology no longer simply poses an organizational risk. It may also prove unusable. Security as a pre-requisite for doing business The upshot, Laleeuwe says, is that cybersecurity has evolved from a "voluntary best practice into a legal and business obligation, making security a prerequisite for market access, customer trust, operational resilience, and long-term competitiveness." Even so, compliance and strong security enablement cannot be allowed to come at the expense of usability, particularly in a hybrid workplace. If collaboration tools are perceived as too complex or restrictive, employees will find workarounds, and the organizational security risks rise rather than fall. To tackle the problem, IT teams must weigh several factors. From a people perspective, the biggest challenge is behavioral. "Users naturally seek convenience, so continuous security awareness, training, and a strong security culture are essential to encourage secure behavior without hindering productivity," Laleeuwe explains. Clear, transparent, and well-defined processes matter just as much, because they ensure security and compliance requirements are consistently understood and implemented across the organization. Why secure by design matters From a technology perspective, the focus must move away from perimeter-based security towards a zero-trust approach in which every user, device, and connection is continuously verified and protected. In product design terms, it is just as crucial that meeting room technology rests on secure-by-design principles, so that compliant, state of the art security controls are integrated into systems from the outset rather than bolted on as an afterthought. As Laleeuwe says: "Security by design reduces the likelihood and impact of vulnerabilities, simplifies compliance with emerging cybersecurity regulations, and strengthens customer trust. It also lowers the overall cost of ownership because identifying and resolving security issues during design and development is significantly more efficient and less costly than remediating incidents, recalls, or security breaches after deployment." Barco's ClickShare wireless video conferencing, presentation, and collaboration solution is a classic example of this approach. Barco developed it from the ground up using secure architecture design and coding. It also includes proactive vulnerability management that continuously monitors newly disclosed vulnerabilities and issues risk-based security updates. That process cuts the system's exposure to both known and evolving threats. Automatic deployment of those security updates simplifies maintenance and helps organizations consistently protect large fleets of devices. Users can focus on the task in hand rather than managing the technology or calling in specialist cybersecurity experts when things go wrong. "The advantage is that security is handled largely in the background, reducing the risk of human error, improving adoption, and allowing people to concentrate on productive collaboration rather than system administration," Laleeuwe points out. "So, ClickShare provides effective protection while minimizing friction for end users." A changing security landscape That matters, she says, because compliance is now a shared responsibility that spans organizations, their technology providers, integrators, and increasingly the broader supplier ecosystem. Organizations, for instance, must hold themselves accountable for securely operating and governing their own environments, even if doing so requires a change in focus. As Laleeuwe explains: "The implication for IT departments is that they must evolve from being solely operational service providers to becoming governance and coordination functions that establish common security standards, policies, monitoring, and oversight across the organization." Technology providers, in contrast, are responsible for delivering and maintaining secure products throughout their lifecycle. They also have a critical part in monitoring vulnerabilities in their platform's software components, providing timely security patches, and transparently notifying customers and downstream partners about relevant security risks. Integrators, lastly, are responsible for deploying and configuring solutions in line with current security and compliance requirements and guidance. "No single party has complete control over the entire technology stack, making supply-chain security and collaboration essential for maintaining a secure and compliant environment," Laleeuwe says. "The most effective approach is therefore a clear allocation of responsibilities across all parties, supported by transparent communication, vulnerability disclosure, and coordinated risk management." Another element of security success is aligning organizational measures such as clear accountability, security awareness, and shared ownership of cybersecurity with technology that provides centralized visibility into assets, vulnerabilities, compliance, and security events. As Laleeuwe concludes: "This consolidated view enables organizations to better understand, measure, and manage risk across the entire enterprise while maintaining the flexibility needed by local teams. The most effective approach balances local operational autonomy with centralized governance, ensuring consistent security, compliance, and strategic control without compromising business efficiency." Sponsored by Barco.

SAP has addressed 20 vulnerabilities across multiple products in its September 2026 security updates, including a maximum-severity memory corruption flaw in the SAP Kernel code. [...]

Whoever took nearly 4,000 bitcoin from the Liquid Network on Sunday, September 6, returned 3,400 of it the next day, Bitcoin's public record shows. About 598.5 bitcoin has not come back. Liquid is a Bitcoin sidechain that holds real bitcoin to back a token called L-BTC. The network is still paused, so holders cannot turn that token back into bitcoin. The 3,400 bitcoin was sent to a&

Whoever took nearly 4,000 bitcoin from the Liquid Network on Sunday, September 6, returned 3,400 of it the next day, Bitcoin's public record shows. About 598.5 bitcoin has not come back. Liquid is a Bitcoin sidechain that holds real bitcoin to back a token called L-BTC. The network is still paused, so holders cannot turn that token back into bitcoin. The 3,400 bitcoin was sent to a&Ravie Lakshmananhttp://www.blogger.com/profile/[email protected]

Falešná výstraha ve Windows tvrdí, že antivirový program nefunguje • Integrovaná ochrana MS Defender přitom stále funguje správně • Vývojáři připravují opravnou aktualizaci pro všechny zasažené verze

OpenAI confirmed that GPT-6 Astra is the first model it has broadly deployed to reach the "Critical level" for cybersecurity capabilities. [...]

Check Point Research said in a report published today that a single instruction planted in a ChatGPT conversation could cause ChatGPT to quietly work for an attacker while answering the user's question as usual. In the company's proof of concept, that hidden work read data from the user's connected Gmail account and passed it to a second ChatGPT account through a hidden channel

Check Point Research said in a report published today that a single instruction planted in a ChatGPT conversation could cause ChatGPT to quietly work for an attacker while answering the user's question as usual. In the company's proof of concept, that hidden work read data from the user's connected Gmail account and passed it to a second ChatGPT account through a hidden channel Ravie Lakshmananhttp://www.blogger.com/profile/[email protected]

UPDATED LG is once again fending off allegations that its expensive consumer hardware gathers extensive information about users and their surroundings for the benefit of its advertising business. The latest concerns center on smart TVs that researchers claim continued capturing audio after voice recognition was activated, including while the display was in standby. The claims once again come from the folks behind the Gamers Nexus YouTube channel, which also claimed in July that LG's monitors were surreptitiously installing adware using an automatic Windows process. After inspecting the TVs' network traffic and internal data, editor-in-chief Stephen Burke said the team found plaintext transcripts generated from audio captured by the TV, along with other information. The Gamers Nexus crew said it observed the TV collecting IP addresses, location data, and the names, signal strengths, and channel numbers of nearby Wi-Fi networks. The TV also enumerated devices on the local network that were not paired with it, including smartphones, watches, routers, thermostats, air purifiers, server baseboard management controllers, and PCs. Burke added that Wireshark packet capture analysis revealed such a large quantity of private data that it couldn't be displayed in the video, and that this was all native behavior from LG's equipment. He said the findings represented "an egregious invasion of privacy." Burke and company also claimed that the TVs could continue capturing audio while disconnected from the internet, store it locally, and transmit related data after connectivity was restored. Burke said the team was working with security researchers to disclose vulnerabilities responsibly, including an alleged remote code execution flaw. LG previously told other publications that its TVs do not "collect, record, or store ambient conversations," and that voice recognition is an optional feature that processes voice data only when activated by the user. LG's relationship with ads LG does not hide the fact that its hardware incorporates technology from its advertising business, LG Ads Solutions. In 2022, it announced that automatic content recognition (ACR) technology previously limited to its US smart TVs would be deployed in sets sold across 27 countries, with the resulting insights available through its advertising business. LG said the ACR data was anonymized and handled in accordance with privacy regulations. Its advertising customers could use the resulting insights to measure campaign effectiveness and whether an ad led to registrations for an app or service. LG is not alone. Most major smart TV manufacturers deploy some form of ACR in their hardware, although the controls available to users vary by vendor. The source of so much frustration, however, is that manufacturers are not forthcoming with consumers at the point of purchase about the extent to which their data is collected or how. Generating audio transcripts while the display is in standby is not something LG highlights in its product descriptions or marketing materials. According to Gamers Nexus, however, that is what its testing uncovered. Instead, the company's website describes its TVs' voice features using terms such as "Intelligent Voice Recognition" and "Clear Voice Pro." Customers who go digging for more details must navigate to an "LG Privacy" link most of the way down a lengthy product page. From there, they must sift through four links to understand its privacy policies more fully, although neither the documents nor the main product page references LG Ads Solutions. Gamers Nexus claims LG sends all the data its hardware collects to the ads unit, which claims in its marketing materials that customers can "own the living room," having their ads appear on devices inside "the connected LG household." LG Ads Solutions' official fact sheet, which predictably requires you to enter your personal and contact details to access, states that there are 49 million LG TVs in the US powered by its webOS, but the company's total reach extends to 363 million "addressable secondary devices." To potential customers, it promises "precision targeting at the device level, across households." ACR and other data-collection technologies have become commonplace across the smart TV market. Research suggests that many consumers are willing to trade their data for tangible financial savings, but the privacy implications are compounded when you consider these devices can be found mounted in boardrooms and doctors' offices. Twice bitten The allegations come less than two months after Gamers Nexus reported that connecting certain LG monitors to an online Windows 11 PC could trigger installation of the LG Monitor App through Windows' device metadata system. The behavior depended on the user selecting Recommended Settings during Windows setup and being signed into the Microsoft Store. As we reported at the time, the LG Monitor App Installer has limited utility and displayed pop-up promotions for McAfee. LG told us: "LG Electronics reiterates that McAfee is not installed automatically and is never installed without the user's explicit consent." ® Updated on September 9th to add: LG responded to the Gamers Nexus YouTube channel's assertions, telling The Register: "The claims made in the recently published video are not true. LG TVs process voice data only when the voice button on the remote control is pressed and held, or when a wake word such as 'Hi LG' is recognized after the user has activated the Far-Field voice recognition feature. It added: "Other than these instances, the TVs do not collect or record ambient conversations. If the wake word is not recognized, no voice data is transmitted to the server; wake word detection is processed locally on the device and immediately deleted. "Additionally, to provide smart TV functionalities, LG TVs feature the ability to scan for and connect to nearby devices on the same network. This is a standard function commonly available on smart TVs and smart home devices. "The ACR (Automatic Content Recognition) feature is provided on an opt-in basis to deliver personalized content recommendations, services, and advertisements. If a user does not consent to the applicable optional agreement, ACR data is not used for advertising purposes."

Byla vydána nová verze 12.0 media serveru Jellyfin (Wikipedie). Přehled novinek v poznámkách k vydání. Pro vyzkoušení je k dispozici Demo Server. Jellyfin je fork media serveru Emby, původně Media Browser.

Threat actors are continuing to leverage artificial intelligence (AI) to streamline their operations, with one financially motivated hacking group employing an autonomous, multi-agent attack framework to carry out a large-scale credential harvesting campaign within six hours. Google Threat Intelligence Group (GTIG) said it has observed attackers with diverse motivations targeting proprietary AI

Threat actors are continuing to leverage artificial intelligence (AI) to streamline their operations, with one financially motivated hacking group employing an autonomous, multi-agent attack framework to carry out a large-scale credential harvesting campaign within six hours. Google Threat Intelligence Group (GTIG) said it has observed attackers with diverse motivations targeting proprietary AIRavie Lakshmananhttp://www.blogger.com/profile/[email protected]

V poslední době kutilové i díky vibecodingu vyrukovali s hromadou nových udělátek pro fanoušky leteckého provozu. Cameron Paczek promítá aktuální polohu letadel na strop své ložnice, Navigační lama zbastlila hezkou webovou tabuli (nejen) pro Pražáky a Chiptron promítá dopravu ve formě radaru na ...

Adobe has released an emergency fix for CVE-2026-75650, an actively exploited max-severity zero-day vulnerability dubbed StyleSmuggler, that impacts multiple versions of Magento and Adobe Commerce. [...]

A Microsoft 365 phishing operation targeting hundreds of organizations captured thousands of passwords and session cookies, including hundreds of authenticated sessions that could be hijacked to bypass MFA, according to researchers who accessed the crooks' own admin panel. Security researchers at CloudSEK say they accessed the admin panel behind BigBear 2.0, an Evilginx2-based phishing-as-a-service operation targeting Microsoft 365 users, giving them an unusually detailed look at the campaign and its haul. According to the researchers, the panel contained 5,137 records associated with 461 organizations, including 1,032 plaintext passwords and 4,148 session cookies. CloudSEK classified 474 records as complete MFA-bypassed authentications in which the attackers captured an authenticated Microsoft 365 session. That potentially hands the crooks much more than an inbox. A hijacked Microsoft 365 account can expose email, calendars, Teams conversations, and files stored in SharePoint and OneDrive. Depending on the account's permissions, CloudSEK says it could also provide a route into Entra ID, cloud infrastructure, and federated SaaS applications – useful territory for business email compromise, internal phishing, data theft, and lateral movement. And this isn't a postmortem. CloudSEK said the BigBear operation was still active at the time of its investigation, with its default phishing template, dubbed "offy," configured specifically to intercept Microsoft 365 authentication. BigBear doesn't need to defeat Microsoft's MFA directly. Instead, its Evilginx2 infrastructure operates as an adversary-in-the-middle proxy between the victim and Microsoft's real login service. Victims arriving at one of the phishing sites see Microsoft's login flow proxied through the attacker's server. Their usernames and passwords are passed to Microsoft, along with whatever MFA challenges follow. Once the victim successfully authenticates, Microsoft returns a session cookie – which passes through the attacker's infrastructure on its way back. By stealing that cookie, the attacker can replay the authenticated session and potentially access Microsoft 365 services without prompting the victim to authenticate again, at least until the token expires or is revoked. Security researcher Gagan Aggarwal said BigBear's customizations go further than stock Evilginx2. Researchers found JavaScript designed to disable FIDO2/WebAuthn authentication on the phishing page, pushing users toward methods such as SMS codes, push notifications, and TOTP, which remain susceptible to this kind of proxy attack. The operation also uses a residential proxy pool covering 69 countries. If a victim is in India, for example, BigBear can route the upstream Microsoft login through an Indian residential IP, making the authentication appear less geographically suspicious. Another check attempts to block visitors arriving from datacenter, VPN, and proxy addresses, making life harder for automated scanners and researchers. CloudSEK says the infrastructure was managed through a multi-user panel and leased to at least five affiliate operators, with stolen credentials delivered in real time via separate Telegram bots. The researchers observed 42 VPS nodes over the campaign's lifetime. Twenty-six had been deleted from the panel since late July, and just one was active when CloudSEK examined it. Aggarwal says the person running BigBear goes by "General Boss." CloudSEK hasn't linked the operation to any known state-backed group and believes money is the motive. The stolen Microsoft 365 access could be used for business email compromise and data theft, or simply sold on to other criminals. CloudSEK recommends phishing-resistant FIDO2/WebAuthn authentication, conditional access policies, compliant device requirements, and the revocation of compromised session and refresh tokens. ®

Microsoft v říjnu zapne Kontrola integrity paměti na více počítačích. • Nevíme přesně, kterých verzí nebo edic se to týká. • Bezpečnostní funkci bude možné ponechat vypnutou.