Agregátor RSS

PHP has warned of another way an attacker could run code on a web server, two days after it shipped emergency fixes for the critical PHP2Shell flaws. The new issue, assigned CVE-2026-115560, affects only web applications configured in an unusual way, and PHP considers it an unlikely risk.The project is not issuing an emergency fix for it. Instead, it recommends turning off a feature called

PHP has warned of another way an attacker could run code on a web server, two days after it shipped emergency fixes for the critical PHP2Shell flaws. The new issue, assigned CVE-2026-115560, affects only web applications configured in an unusual way, and PHP considers it an unlikely risk.The project is not issuing an emergency fix for it. Instead, it recommends turning off a feature called Swati Khandelwalhttp://www.blogger.com/profile/[email protected]

The Russian state-sponsored hacking group Sandworm teamed up with another threat actor to carry out a destructive wiping attack targeting a Ukrainian logistics company last year. According to ESET, the attack involved UAC-0099 (aka Earth Sirrush) obtaining initial access to the target on July 16, 2025, via a spear-phishing email bearing a malware-laced attachment that led to the deployment of

The Russian state-sponsored hacking group Sandworm teamed up with another threat actor to carry out a destructive wiping attack targeting a Ukrainian logistics company last year. According to ESET, the attack involved UAC-0099 (aka Earth Sirrush) obtaining initial access to the target on July 16, 2025, via a spear-phishing email bearing a malware-laced attachment that led to the deployment ofRavie Lakshmananhttp://www.blogger.com/profile/[email protected]

Na americkém poli přistál třímetrový ohořelý kus čínské rakety • Trosky zřejmě pocházejí ze zářijového startu rakety Ču-čchüe-2E • Mezinárodní právo sice vyžaduje odškodné, to ale Čína ignoruje

Indian digital trust company eMudhra has announced that it is exiting the global SSL/TLS certificate business and is offering customers certificates issued by Sectigo as an alternative, following the compromise of private keys behind eight of its intermediate certificate authorities.

The company’s board decided “to voluntarily withdraw from the global SSL/TLS certificate business,” eMudhra said in a press note. It added that data sovereignty and compliance requirements had increased the business’s complexity and cost.

“The level of social media amplification around this incident has brought scrutiny that is out of proportion to SSL/TLS’s place in our business,” eMudhra Chairman V Srinivasan said in the announcement.

The company said it will contact affected customers to replace certificates free of cost. It also said it will keep revocation and certificate status services running until every issued certificate has expired or been replaced.

Sectigo offered as an alternative

In the customer update, eMudhra said it is making Sectigo-issued certificates available to all its customers.

“Our G1 root certificates remain active and continue to be fully supported,” the company said in the update. The October 22 release said the G1 RSA roots “will continue to serve customers until this transition is complete.”

eMudhra said it would provide replacement certificates free of charge through its partners and continue operating revocation and certificate-status services until all certificates it issued had expired or been replaced. CertiNext users can request Sectigo certificates through their accounts; other customers can contact eMudhra support, the statement added.

Niyati Daftary, principal analyst at Gartner, said organizations should view the G1 roots “as a possible bridge, not automatically as the final destination.”

“With the company exiting global SSL/TLS and its remaining roots still subject to browser scrutiny, the prudent course is to move critical services to an independent, fully trusted CA wherever the deadline allows,” Daftary said.

If G1 is used to prevent an immediate outage, she recommended setting a firm deadline and documenting a subsequent migration plan.

She recommended including issuing authorities, intermediate and root certificates, cross-signing arrangements, revocation infrastructure, and browser trust status in third-party risk assessments.

Yash Kadakia, co-founder and CTO of Security Brigade, said that moving to another root operated by the same company does not necessarily address concerns over trust and governance.

“The last thing organisations need is to migrate twice,” Kadakia said.

Sectigo did not immediately respond to a request for comment.

Java and other systems may need separate fixes

Replacing a website’s certificate may not address every dependency in an enterprise environment, according to Sakshi Grover, research director at IDC. She said residual exposure lies in systems that maintain their own trust stores and do not update on the same schedule as browsers. These include Java keystores, language runtimes, container images, mutual TLS configurations, proxies, load balancers, VPN and security appliances, and embedded devices.

“The harder finding for many organizations will be that they can’t answer these questions at all,” Grover said, referring to where certificate trust decisions are made outside browsers and operating systems.

Grover noted that Google reported finding no certificates chaining to the affected intermediates in Certificate Transparency logs before they were blocked. She said that was reassuring for clients that enforce Certificate Transparency, but some non-browser applications and devices do not. Exploitation would also require an attacker to be positioned to intercept traffic, she said, describing the remaining risk as limited and targeted rather than broad.

Azul, a Java vendor, said in a statement that Java does not check certificate revocation by default. An unpatched Java Development Kit (JDK) could therefore continue to accept a forged certificate signed with a compromised intermediate key if the relevant chain remains trusted.

Azul said it released updated Azul Zulu Builds of OpenJDK and Azul Prime. The updates add the eight affected certificates to the JDK’s blocked-certificate list, the company said.

Grover recommended that security teams first identify where trust decisions occur outside browsers and operating systems, prioritising systems that accept connections from external parties and mutual TLS endpoints. Teams should then determine which systems can be updated to distrust a specific intermediate certificate or public key, she said.

Chrome deadline for certificate holders

Mozilla has removed emSign ECC Root CA – G3, the root that signed the eight compromised intermediates, from its trust store. Google said in a blog post that the root’s removal from the Chrome Root Store is expected to reach all devices on the morning of October 27, Pacific time.

“To avoid breakage, website operators with certificates chaining to emSign ECC Root CA – G3 must immediately acquire and install a new TLS certificate,” Google said in the post.

Daftary said enterprises often know their certificate reseller but not the CA hierarchy underpinning their trust.

“That creates an unrecognized fourth-party risk capable of affecting thousands of services at once,” she said. She added that CISOs should include issuing CAs, roots, cross-signing arrangements, and revocation infrastructure in their third-party cyber risk assessments. “You can outsource a service, but you cannot outsource accountability,” Kadakia said.

Google’s new Googlebooks are packed with potential — and while the systems in their current state may be awkwardly rough around the edges, there are some truly interesting ideas within ’em.

I looked at some of those highlights in my recent “Googlebook work test” hands-on analysis, but in addition to all the surface-level sorcery, Googlebooks hide a handful of nifty and at times quite helpful features you wouldn’t notice until you’d really spent some time using ’em and poking around in their various nooks and crannies.

As a follow-up to my broader Googlebook analysis, I thought it’d be fun to show you some of the more off-the-beaten-path elements of the Googlebook experience — interesting little touches that you almost have to go out of your way to discover (or maybe just stumble onto inadvertently!).

Here are seven such treasures I’ve encountered in my time with the Lenovo Googlebook — provided to me as a short-term loaner review unit — so far.

[Get fresh Googley insight in your inbox with my free Android Intelligence newsletter — one new and useful thing to try every Friday.]

Googlebook highlight #1: Instant context

One of my favorite Googlebook features has been one that’s almost never mentioned and all too easy to overlook, and that’s an innocuous-looking little option within the right-click (or long-press) menu when you’re viewing any kind of content. It’s called “Look up.”

(Click any image in this story to enlarge it.)

The “Look up” option sits quietly in the Googlebook’s right-click context menu.

JR Raphael, Foundry

The way it works is simple: You highlight any word or phrase, anywhere, then right-click and select “Look up” — and you get an instant pop-up definition, if the highlighted text is a basic word, or a broader sliver of Gemini-generated context, if it’s something more complex.

The system excels at surfacing swift definitions.

JR Raphael, Foundry

The definitions are honestly where the system seems most useful to me so far. With the Gemini-aided answers, you inevitably open the door to misinterpretation and misinformation potential — seen most comically in this example, where I looked up the phrase “Googlebooks.”

Well, this is awkward.

JR Raphael, Foundry

But hey, it’s certainly an interesting idea — and that’s what this list is all about.

Googlebook highlight #2: Circle searching

In addition to the “Look up” option, the Circle to Search system familiar to those of us in the Android arena is also quietly present on Googlebooks.

That creates a slightly awkward overlap with the more prominently promoted Magic Pointer feature, but it’s an interesting addition and option to have in the right sort of scenario.

With this one, you have to first find and activate the option within the system settings — tucked away within the “System” section — and then you can hit the Google key and A together to summon Circle to Search and highlight anything on your screen (be it text, images, or whatever) to learn more about it.

Android’s Circle to Search system is there and waiting to be found on a Googlebook.

JR Raphael, Foundry

In concept, it’s pretty darn similar to what Magic Pointer is meant to do. But Circle to Search is a much more developed system, with its own entire ecosystem of built-in actions and shortcuts, so it’s neat (if slightly confusing!) to see it present within the Googlebook environment as well.

Googlebook highlight #3: Custom corner shortcuts

An especially interesting addition for the shortcut-lovers among us is the ability to create your own custom shortcuts for triggering different actions when you move your mouse to the corners of a Googlebook screen.

Custom corner shortcuts are a shell of a useful feature that’ll hopefully be fleshed out soon.

JR Raphael, Foundry

The list of available options is somewhat limited as of now — with no way to map a corner to opening a specific app or an action within an app (or to take things further yet, with a next-level notion like summoning a widget on demand) — but it’s a welcome addition, even so, and hopefully something that’ll only continue to expand and become more versatile with time.

Googlebook highlight #4: Custom keyboard shortcuts

Speaking of shortcuts, while the Googlebook does require a lot of new learning and muscle memory for anyone coming from a Chromebook (or most any other laptop, really), one area where it excels is its ability to let you customize and create your own keyboard shortcuts.

The Googlebook has oodles of keyboard shortcuts for you to learn.

JR Raphael, Foundry

Hitting the Google key and / together opens the list of default keyboard shortcuts, and from there, it’s one more click to customize and change most of the available options to meet your own personal preferences. In an especially cool twist, you can even create new shortcuts for opening any app installed on your device.

Creating your own custom keyboard shortcuts — for apps and all sorts of actions — is an interesting possibility to explore.

JR Raphael, Foundry

Googlebook highlight #5: Automatic file summaries

You know how annoying it can be to look through mountains of screenshots — or any other files — to find the one you want, based solely on meaningless file names? The Googlebook has a trick that makes that hassle a thing of the past: For most (but curiously not all) files saved locally on its storage, the system will give you an automatic summary of what’s inside right alongside the filename in the Googlebook OS Files app.

Automatic file summaries save you from having to figure out which file you need.

JR Raphael, Foundry

The convenience unfortunately doesn’t carry over to files you’re viewing in your Drive storage or on a connected Android phone. But for anything you’ve downloaded or saved locally, it’s a nice extra bit of intelligence to have.

Googlebook highlight #6: Smart screen savers

Being based on Android, the Googlebooks sport a selection of built-in screen savers that can make the laptops meaningfully more useful — or maybe just pleasant to look at — when you aren’t actively using ’em.

You’ll have to head into the “Wallpaper & style” section of the system settings to find the feature. But once you do, you’ll be treated to a host of intriguing options just waiting to be activated.

Screen savers are a useful-seeming Android carryover in the Googlebook world.

JR Raphael, Foundry

Googlebook highlight #7: Notification history

Last but not least is another Android carryover, and it’s one of my favorite easily overlooked Android options.

I’m talkin’ about Android’s notification history system — which, yes, is there in all of its glory on the Googlebook. It’s just up to you to find and activate it first, before it’ll start working.

All it takes, though, is a click on the notification bell icon in the upper-right corner of the Googlebook interface, then a click on the clock icon in the lower-left corner of the pop-up that appears. From there, you’ll click “Notification history” and flip the toggle at the top of the next screen into the on and active position.

Give things a moment to start collecting, and you should then be able to click on that same icon to get to a full history of notifications (both from the Googlebook itself and ones synced over from your phone) that you’ve missed or dismissed.

Android-style notification history is never more than a couple clicks away, once you find and activate it.

JR Raphael, Foundry

The Googlebook is very much still a work in progress, but features like these make me at least cautiously hopeful for its future and the kind of experience it could one day provide — if, of course, Google manages to actually stick the landing and avoid its all-too-common patterns of pivoting, giving up, and failing to follow through when things don’t take off immediately out of the gate.

Be sure to check out my complete Googlebook overview, if you haven’t already, for a much more detailed picture of what the systems are like to use in their current form, as far as productivity is concerned — and stay tuned to see how things progress from here.

Get even more next-level Google knowledge with my free Android Intelligence newsletter — something new and useful in your inbox every Friday and my Android Notification Power-Pack as an instant welcome bonus.

Pillow, the most widely used image library for Python, can be made to run operating system commands on a server by specifying the name of a file it is told to open. The flaw, CVE-2026-112900, is in the way Pillow handles EPS images, which it opens by passing the file's name to Ghostscript, a separate program it runs to turn the image into pixels, without checking the name first.

Pillow, the most widely used image library for Python, can be made to run operating system commands on a server by specifying the name of a file it is told to open. The flaw, CVE-2026-112900, is in the way Pillow handles EPS images, which it opens by passing the file's name to Ghostscript, a separate program it runs to turn the image into pixels, without checking the name first. Swati Khandelwalhttp://www.blogger.com/profile/[email protected]

Britain is threatening subsea cable saboteurs with up to 14 years in prison and unlimited fines, having apparently decided that Victorian-era laws aren't quite up to the job of keeping Russian submarines away from critical infrastructure. The government on Thursday set out plans to overhaul legislation dating back to 1885 and introduce tougher penalties for damaging the underwater cables and pipelines that keep Britain's internet and energy supplies running. According to Whitehall, subsea cables carry around 99 percent of the UK's international data traffic, while underwater pipelines account for 74 percent of its gas supply. Yet much of this infrastructure is protected by laws written when the telegraph was cutting-edge technology. The Submarine Telegraph Act 1885 originally imposed a £100 maximum fine for damaging a cable through culpable negligence. That might have been a reasonable deterrent back then, but it's unlikely to give today's would-be saboteurs much pause. Under the proposals, those who intentionally damage critical subsea energy or telecoms infrastructure could face up to 14 years behind bars. The proposals also set tougher penalties, including unlimited fines, for reckless or negligent damage. Subsea telecoms operators would face new legal duties to identify and manage security risks, while ministers would gain powers to direct companies and cable repair providers to take action where necessary and proportionate to protect national security. The government also wants to regulate fiber-optic sensing technology, which uses subsea cables to detect activity at sea but could pose a security risk if sensitive data falls into hostile hands. Unsurprisingly, Russia features prominently in Whitehall's thinking. In April, British forces exposed a covert Russian submarine operation near critical undersea infrastructure. The operation reportedly involved an attack submarine acting as a decoy while two specialist vessels surveyed Britain's cable routes. "The threats we face have changed dramatically, with suspicious Russian activity around critical undersea infrastructure, yet some of the laws protecting these vital connections date back more than a century," said telecoms minister Ian Murray. The plans aren't entirely new. In May, the government announced its intention to toughen penalties and introduce security obligations for cable operators. Thursday's White Paper spells out the proposed penalties and how far ministers could go in directing operators to act. It also follows warnings from Parliament's Joint Committee on the National Security Strategy, which concluded last year that Britain was insufficiently prepared for a coordinated attack on its subsea infrastructure. MPs and peers warned that government assessments focused too heavily on individual cable failures, rather than what might happen if attackers simultaneously targeted connections to Europe and across the Atlantic. Russian submarines aren't responsible for every severed cable. Fishing boats and ships dragging their anchors do most of the damage, accounting for up to 97 percent of faults, according to previous government estimates. And even when sabotage is suspected, catching those responsible is another matter. Britain already has laws allowing life sentences for serious acts of state-backed sabotage, but they're not much use if nobody can prove who did it. That's rather difficult when the crime scene is at the bottom of the sea. And it might prove equally difficult to extradite suspects from enemy nation states. None of this is law yet. The government has opened a 12-week consultation on the plans, after which ministers will decide how to proceed. Whether the threat of a lengthy prison sentence will trouble Russian submariners is debatable. Even so, after 140 years, Britain's subsea cable laws are finally getting dragged out of the Victorian era. ®

Hlodač byl svého času nejslavnějším českým vyhledávačem, který si veřejnost nikdy nemohla vyzkoušet. Jeho příběh začal v únoru 2010 v investorském pořadu Den D na České televizi, kde brněnský programátor Petr Hejl představil vyhledávač lepší než Google. Recept na poražení Googlu zněl ...

Malicious Brotli data can make an application on an official build of Node.js run attacker-supplied code, security researchers at Imperva have demonstrated. Their "Node2Shell" proof of concept ran code on the official Node.js 24.22.0 image for Linux arm64, with no debugger or custom build, by feeding crafted data to the bundled Brotli decoder (CVE-2026-111497). Node.js disclosed the flaw

Malicious Brotli data can make an application on an official build of Node.js run attacker-supplied code, security researchers at Imperva have demonstrated. Their "Node2Shell" proof of concept ran code on the official Node.js 24.22.0 image for Linux arm64, with no debugger or custom build, by feeding crafted data to the bundled Brotli decoder (CVE-2026-111497). Node.js disclosed the flaw Swati Khandelwalhttp://www.blogger.com/profile/[email protected]

AI agents paying for API calls with the x402 SDKs could sign a payment for their full balance of a supported token if a malicious API asked for it, security firm V12 said on October 22. The cause was the SDKs' default client, which set no spending limit until releases on August 18 added one. The risk was limited to agents who automatically signed payments and whose apps set

AI agents paying for API calls with the x402 SDKs could sign a payment for their full balance of a supported token if a malicious API asked for it, security firm V12 said on October 22. The cause was the SDKs' default client, which set no spending limit until releases on August 18 added one. The risk was limited to agents who automatically signed payments and whose apps setSwati Khandelwalhttp://www.blogger.com/profile/[email protected]

Jazykové modely mohou pomoci s analýzou lidského rozhodování. Nobelova cena za fyziku 2026: Od neutrin k černým dírám. Nově připravená komplexní sloučenina zpochybňuje pravidlo 18 elektronů. Na povrchu Měsíce poběží úlohy umělé inteligence a vůbec první úlohy HPC. Vědci identifikovali oktupólový magnetismus.

Virtuální deratizace, kterou Microsoft rozjel letos na jaře, se dostává do další fáze. Z kontextové nabídky zmizí celkem 8 akcí, které souvisejí s funkcí Copilot pro Windows 11…

Stabilizátor mobilu DJI Osmo 7 zlevnil na 1549 Kč, nedávno stál přes dva tisíce. • Má tříosý gimbal, integrovaný stativ a vydrží až 10 hodin. • Prostřednictvím appky DJI Mimo zpřístupňuje spoustu pokročilých fotofunkcí.

Threat actors have been observed unsuccessfully attempting to exploit the newly disclosed PHP2Shell vulnerabilities to rope infected systems into a Mirai botnet variant called Potassium, as it emerges that weaponizing the flaws may be harder than previously thought. The attacks aim to exploit CVE-2026-109618 and CVE-2026-109619 (CVSS scores: 9.2), which can result in unauthenticated remote