Agregátor RSS

Zdražování telefonů už není jen na papíře, ale vidíme ho u konkrétních značek • Apple, Samsung a Google nové ceny starších modelů promítly rovnou do ceníku • Další značky plošně nezdražují, ale jejich telefony pořídíte dráž než třeba v létě

I was taking my dog for her perambulation through the leafy valleys and forests of one of the most densely populated parts of London this morning when it struck me how annoying it has become that I must now update multiple Apple devices across my family group. That’s pretty much mandatory given recent security warnings, and may involve additional updates over time.

“Why must I spend so much time updating other people’s stuff?” I asked myself, managing to combine resentment and self-pity within one short sentence. “Why can’t they learn how to update their own stuff?” I muttered, dreaming once again of that inevitable lottery win that absolutely will change my life. “If only there was an easier way.”

The one thing every family admin should do

You can do this in IT. There you have a suite of tools to manage devices. But for families, there are no easy ways, I thought.

That’s not to say you can’t do anything. Number one is the standard thing every family admin should do, though many of us don’t:

1. Open Settings > General > Software Update.
2. There, tap Automatic Updates and turn on Download (iOS, iPadOS, macOS) Updates and also turn on Install (iOS, iPadOS, macOS) Updates.

From then on, that device will automatically download and install updates overnight when it is locked, on Wi-Fi, and charging.

Great. You can forget it. Except you can’t, as not only must you take these steps on each individual device, which is really boring, but, unlike IT admins, you cannot monitor the family fleet to make sure every device is up to date. The first you’ll know they aren’t will probably be when someone has a tech problem you must resolve as a result of them cancelling those updates because they wanted to check their email.

Apple Business isn’t for the home

To resolve this, you can try to use Apple Business or third-party fleet device management tools, such as Jamf Now. Aimed at business users, in theory both tools could extend enterprise-grade device management into family setups, but neither seems ideal. 

Apple Business, for example, demands managed Apple accounts, requires strict registration as a business user and puts in place other barriers that prevent it being easily used to manage family tech. Jamf Now is much more flexible, but the company charges around four dollars for each device after three, which adds up fast when your extended family have iPhones, Macs, and iPads. 

Apple Configurator isn’t enough

Another option could be Apple Configurator. This is free and lets you supervise multiple devices manually. The limitation is that it only lets you manage iOS, iPadOS and tvOS devices — all it can do for Macs is enroll them to enable MDM. Another limitation is that you need to connect each device manually to your Mac for configuration — and during the config process you’ll need to back up the device, as it will be wiped and restored during the configuration process. 

Configurator is powerful — perhaps too powerful. Once it is applied, you can permanently block apps, force web content filtering, and stop AirDrop. You can also prevent people from changing the device name or passcode, or from adding new mail accounts. Much of this is great for family device management, I thought as I leaned over to deal with another canine gift, but the problem remains that it will not automate updates across the family group.

“Why must I always carry the load?” I muttered to myself, resentfully, as I walked toward the park trash can. “All I want is to make sure everybody installs software updates. Is that too much to ask?”

What Apple already offers

I really don’t think it is too much to ask. Apple has already built system hooks inside its operating systems that force devices to upgrade to specific OS versions by defined deadlines. These tools sit inside the Declarative Device Management (DDM) framework and are made available through MDM services. These aren’t APIs, but system-level hooks.

Could Apple provision these services from within Family Sharing?

I think it would be possible, but the problem is a philosophical one. There is a difference between business and family users, and the latter’s are seen as personal devices. What that means is that Apple’s fundamental security model for family devices is based on the individual user, protecting that user and ensuring that no remote user or server should be able to force deep, system changes — like OS updates — on someone else’s personal device. 

This makes a lot of sense, of course, because by adding managed software updates to Family Sharing, Apple would be empowering the administrator at the cost of individual users’ personal agency. It’s not hard to imagine situations in some families where such power might be abused. There’s also the risk of data loss.

Family Sharing does let you control things like content access and set time boundaries but leaves the software updating and other core tasks to the individual. 

Privacy may matter most

Should Apple change this? 

As I walked my deeply reluctant and not even slightly grateful dog back home, I reflected that perhaps individual privacy and agency are worth protecting. It’s what I am raising my family to care about, after all — but surely there should be a tool within Family Sharing that admins can use to remind family members to upgrade? Something a little stronger than a text message, email, or personal request, like perhaps a system message? 

“It would be helpful if I could just pop a pester message on everyone’s device reminding them to upgrade,” I thought as I turned the lock and walked into the family home. 

“Then at least I wouldn’t have to talk to everyone,” I thought as I snuck into my man-cave, where I reached over and began the tedious task of updating a couple of dozen devices all by myself.

“Is that all there is?” I thought, as I watched the morning wane.

Now please subscribe to my daily, human-curated Apple-related news headline feed at The Core, or follow me on BlueSky, LinkedIn, or Mastodon.

Social media giant Meta was ordered to pay 25 billion in penalties by a New Mexico court on Wednesday as part of a data privacy lawsuit that sprang from the company's Cambridge Analytica data scandal, which came to light in 2018. According to multiple reports from the Associated Press, the New York Times, Reuters, and the Wall Street Journal, state District Court Judge Francis J. Mathew called

Social media giant Meta was ordered to pay 25 billion in penalties by a New Mexico court on Wednesday as part of a data privacy lawsuit that sprang from the company's Cambridge Analytica data scandal, which came to light in 2018. According to multiple reports from the Associated Press, the New York Times, Reuters, and the Wall Street Journal, state District Court Judge Francis J. Mathew called Ravie Lakshmananhttp://www.blogger.com/profile/[email protected]

The PHP2Shell security fiasco has forced 32 UK government services offline and left another four partially unavailable as Whitehall scrambles to patch the critical vulnerabilities wreaking havoc across the web. The figures were disclosed in the House of Lords on Thursday, where tech minister Baroness Lloyd of Effra outlined the disruption following the discovery of two critical flaws in PHP. "Currently, the information I have is that 32 government services are unavailable and four are partially unavailable," Lloyd told peers. "That has resulted largely from precautionary measures taken to protect systems while security updates and mitigations are applied." "We are working very carefully with departments to restore the services safely and securely following that remediation activity," she added. Whitehall has not published a full list of affected services, although the Office for Budget Responsibility (OBR) is among those known to have taken their websites offline, rather inconveniently with next week's Budget looming. Peers also raised reports of disruption affecting the DVLA and police services. Britain isn't alone in pulling the plug. Government websites in Germany, France, Belgium, Finland, and the Netherlands have also been taken offline as a precaution, along with Australia's own cybersecurity agency website. Across the Atlantic, the NSA has urged organizations to patch or disconnect vulnerable systems, although the US government has not publicly confirmed any website shutdowns. PHP2Shell comprises two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that could allow unauthenticated attackers to execute code on vulnerable servers. The National Cyber Security Centre (NCSC) warned organizations to patch immediately or consider pulling affected systems offline until they could be fixed. "The NCSC was briefed by OpenAI last week on this potential specific vulnerability and has been working to ensure that disclosure happened in a co-ordinated way with vendors, so there was sufficient preparation to protect customers," Lloyd said. Security firm Calif found one of the PHP bugs using OpenAI's GPT-5.6 Sol model, while Google's Wiz separately uncovered both flaws with the help of AI tools. OpenAI then dug into the vulnerabilities itself and worked with vendors and government agencies to get the word out. The government established a cross-departmental incident response operation before public disclosure, Lloyd said. The NCSC also sent 50,000 warnings to businesses and other organizations. The disruption has spread beyond central government. Liberal Democrat peer Baroness Ludford pointed to several councils whose services had reportedly been taken offline, including Edinburgh, Oxford, Bristol, Lambeth, and Barnet. She questioned why central government and local authorities remain outside the statutory duties proposed under the government's Cyber Security and Resilience Bill, which returns to the Lords on Monday. "We are not currently aware of any confirmed compromise of central government systems resulting from these vulnerabilities," Lloyd told peers, later extending that assessment to the wider UK public sector. AWS says attackers were exploiting the flaws four days before they were publicly disclosed, while Cloudflare has since recorded millions of attempts to weaponize them. ®

Microsoft says IT admins can re-enable the retired Exchange Web Services (EWS) API in Exchange Online to fix EWS apps that have stopped working. [...]

Microsoft představil velký balík novinek pro OneDrive. • Z velké části se týkají AI, která dokáže analyzovat soubory a upravovat fotky. • Odkazy pro sdílení se nemění, pokud upravíte oprávnění.

Drtivá většina čtenářů si pod pojmem 3D tiskárna představí některou z mnoha aditivních technologií, které vytvářejí objekt nanášením jednotlivých vrstviček materiálu. Ať už to bude termoplast, kov anebo třeba fotociltivá pryskyřice. Existují ale i postupy, které trojrozměrný výrobek tisknou celý ...

In a world full of cyber risk, account takeover has emerged as one of the most insidious of all threats. If an attacker can successfully compromise a legitimate email account, they are then able to pose as a trusted individual or organization without triggering any warnings. Traditional email security will see nothing wrong. From there the threat actor can pick their moment to cause havoc with objectives that range from stealing money, expropriating sensitive data and propagating catastrophic malware. Serious financial loss and a damaged corporate reputation are commonplace outcomes. The typical account takeover lifecycle starts with the bad guys obtaining credentials, usually through the medium of phishing. Generative AI (GenAI) has made it easy for an attacker to trick an unwary individual into giving away login data, perhaps by posing as a colleague or other trusted party or by encouraging them to enter confidential information on a fake login page. You might expect, once a legitimate identity has been successfully compromised, that all hell would immediately break loose. These days the typical account takeover artist is more stealthy and sinister than that, in no rush to act at this early stage since no alarm bells have been triggered. Most will take their time to test out and verify their stolen login data, and see where it might take them. “Conventionally attackers would take over an account and immediately start firing off spam and phishing,” says Dave Baggett, SVP Cybersecurity with software developer Kaseya. “Now they are starting to get clever. They’ll get access to an account and sit tight, watching all the email traffic passing and waiting for an opportune moment to inject themselves into the conversation.” From the inside out Once they’ve figured out an organisation’s weak points and come up with a plan of attack, the bad guys will start to weaponize the compromised email account to target other employees and internal systems. Assuming their motivation is financial, they might be on the hunt for a way into payroll or invoicing databases. But their ultimate aim might lie further afield in the form of the organisation’s customers and suppliers, and that’s when the real nightmare can start. So called outbound phishing offers the criminal a way to assert control over a whole new range of sensitive end points. Victims of outbound phishing are highly vulnerable in the face of what seem to be messages from a trusted partner and ally. It is one thing for an organisation to protect its own email accounts with robust controls like multifactor authentication (MFA), but no one has control over the authentication practices of other parties: “Let’s say we have a customer who we’re protecting,” explains Baggett. “They’re safe, but imagine that they start getting suspicious emails from a third party. Our customer has no idea what is or isn’t protecting that third party. Emails coming from that source might appear to be from a real account, but it could be a hacker typing them.” Given that you can’t run checks on third party organisations, something more sophisticated than regular email security is required. Ideally this would be a GenAI-powered solution that can bring language understanding to bear, able to examine conversation histories in depth to see if something anomalous can be spotted. It makes life even harder for defenders when the bad actor has successfully assumed the identity of somebody senior. If they are impersonating a top-tier manager with an extensive and trusted reputation then they have a powerful asset on their hands. All the trust and goodwill of that senior individual is now inherited by the criminal. Conventional email filtering systems will often be configured to allow senior personnel past certain defensive layers with minimal friction, so as not to restrict important business communications. Recipients of mail from such sources may be disinclined to challenge and report them, should suspicions be raised by the nature of what they are asking for. It takes a bold employee to call out as fraud what seems to be a message from somebody at C-level, especially when the email system has apparently green lighted it as authentic. Bringing the power of AI to bear The heat is on not just for IT departments but for MSPs who have multiple organisations under their protection, many of which will have no real in-house security knowledge of their own. Kaseya’s own research shows just how exposed many are. New approaches are needed that deal with the menace of account takeover before damage can be caused. And should a takeover transpire, consideration must be given to containing its impact before vital data and infrastructure are affected. The good news is that modern tools exist that perform just these tasks. INKY is Kaseya's generative AI-driven email analysis tool. It has capabilities that go well beyond any kind of traditional email security, tuned to detect, through the most subtle and marginal signs, when an email conversation is in the process of being infiltrated. Using techniques such as advanced sender profiling, stylometry and machine learning, INKY is adept at identifying inconsistencies between the known writing patterns of a legitimate employee and the slightly unfamiliar tone of a fake message. It can sniff out that something is wrong, even when message headers seem real, just by spotting the kind of contextual anomalies that expose a phoney message. INKY is especially useful when it comes to third party account takeover. It achieves this by building and maintaining detailed profiles of trusted senders based on technical and behavioural characteristics. Over time it learns what “normal” looks like and can see when a third-party email doesn’t match a sender’s established profile. Containing an attack If a takeover attempt has been successful, there’s more to stemming the damage than just putting a block on a suspect account. By the time of its discovery, a compromised identity may have already led to inroads being made into connected SaaS apps, cloud storage and collaboration tools, widening the possible blast zone well beyond a single email thread. Modern IT environments are a jungle of identity-driven endpoints and gateways, and therefore increasingly difficult to defend against intruders armed with legitimate credentials. To compound matters, when the bad guys have AI at their disposal they are able to treat these SaaS-driven ecosystems as a single attack surface. Defence that relies on a patchwork of individual tools, each created to solve a particular challenge in one silo of the organisation, will not be up to countering this kind of threat. That’s why INKY is configured to work with Kaseya SaaS Alerts, a cloud-based detection and response platform designed to help MSPs and others to monitor and protect business applications. Once INKY has picked up that a mailbox has been hijacked, it isolates the user and blocks outbound mail. It then sends an event to SaaS Alerts so that it can lock down that user's access across the rest of the stack. The tools work as a team, INKY blocking the compromised account and SaaS Alerts preventing the damage from spreading. The power of this partnership comes from INKY’s ability to stream real-time email security telemetry into SaaS Alerts, including inbound analysis results and threat detections, user-reported phishing activity and outbound mail protection events. This type of integration helps to automate real-time threat detection across a complex SaaS ecosystem. “It means if we see suspicious mail going out, we can shut the account down, and take other remedial actions,” says Baggett. “The more you understand the meaning of the mail, the more you can catch.” Smart tools to the rescue The battle against account takeover is never won, and future innovation is always needed. We’ve seen how AI is a dangerous weapon in the hands of the attacker. It’s also a very handy tool for the defender – but there are some qualifications: “You can’t just put every inbound and outbound mail through an LLM since the economics don’t add up,” points out Baggett. “You’ve got to be more clever than that.” One of the most important and cleverest emerging uses for GenAI lies in not simply protecting against account takeover but predicting where weakness might lie, helping to stop a problem before it happens. Baggett believes that the security industry is at the very beginning of being able to use models to predict in this way. An essential preliminary is making sure the many different components that go into securing an organisation can share information with each other. That integration work is underway, an early example being the real time dialogue between INKY Mail Protection System and SaaS Alerts. Next step is a unified data layer where any security component can publish an event in real time, and any other component can subscribe. “We’ll continue to make more integrations of this sort over time,” promises Baggett. “We’re also building a centralised capability for AI. With so many of the different components having their own AI, you need an underpinning platform. We also have a service bureau of Machine Learning experts who can make customised models for different tasks. There’s no sleeping on the job. The volume of attacks is clearly going to increase.” Read more in Kaseya’s Cybersecurity Report here Sponsored by Kaseya

Attackers can steal credentials and begin exfiltrating data within minutes, often before security teams can respond. Exaforce examines real-world attacks involving stolen GitHub tokens, malicious AI installers, and MFA phishing, explaining why faster detection and automated containment are critical. [...]

A trio of papers showcases AI-designed molecular scissors and an upgraded tool that builds proteins atom by atom.

The protein universe is about to get bigger.

Scientists can now use AI to build proteins never before seen in nature. These designer proteins may become therapeutics, environmental sensors, or even the building blocks of synthetic life.

Despite enormous potential, however, AI tools still struggle to design complex proteins, like enzymes, from scratch. Unlike small proteins or peptide binders that disrupt cellular signaling, enzymes are shape shifters with a catalytic core. Getting the right shape is only half of the battle. The components must also quickly move, align, and interact at just the right moment.

But effective AI-designed enzymes may be here soon. This month, Nobel laureate David Baker’s lab at the University of Washington unveiled two types of AI-designed proteases. Proteases are like molecular scissors that cut other proteins at specific sites. The enzymes are notoriously tough to engineer, but designer versions could be made into powerful medications.

In test tubes, Baker’s synthetic scissors chopped up proteins associated with Alzheimer’s and ALS, a common motor disease. In cells, they acted like switches for inflammation-related proteins, activating them only after a precise snip and, in turn, changing how the cells behaved.

The findings open the door to destroying disease-related proteins long considered undruggable. “Proteases are just the beginning,” said study author Anqi Chen in a press release.

There’s another reason for optimism too.

In a separate paper, the Baker lab introduced RFdiffusion3, the lab’s latest generative AI model for protein design. Rather than mainly working at the level of amino acids, the tool zooms in on individual atoms, giving scientists finer control over their synthetic creations.

“The field is maturing from predicting and accurately building protein shapes and interactions to designing machinery that physically changes matter at the atomic level, in targeted and programmable ways,” said Baker in the press release.

Tailor-Made

Proteins are finicky things. Strings of molecules called amino acids twist into helices and sheets, then fold into intricate 3D shapes.

Not all amino acids are built the same. Some are relatively sleek; others sport sprawling branches called side chains. These branches influence how proteins fold and interact with their surroundings, affecting how drugs rev up or dampen their activity or change DNA and RNA behavior. Add in a protein’s ability to change shape and engineering one to behave predicably seems like an impossible dream.

With generative AI, the dream is becoming reality. Algorithms are expanding the protein universe, allowing scientists to engineer smaller or wholly new gene-editing tools, for example, or tiny antibodies that fight viruses or serve as antidotes to snake venom.

Enzymes, however, are tougher to crack. Many enzymes orchestrate an intricate dance between metals, target molecules, and other ingredients—such as water—to make a reaction happen. Any hiccups can torpedo the whole process.

Take proteases. These molecular scissors sever the chemical connections linking amino acids. Their core does the cutting, while other parts orient them so they dock to the target or otherwise control activity.

In two new studies, the Baker lab team designed two proteases. One, a zinc protease, uses a metal to drive the reaction. The other, a cysteine protease, forms a vulnerable chemical intermediate with the target, making the bond easier to break. Both strategies depend on getting specific amino acids into precise positions.

The team took inspiration from existing enzymes found in a crayfish’s digestive system and in yeast. With RFdiffusion2, their in-house design tool, the researchers built new protein backbones around each enzyme’s catalytic core to help it dock to the target. They used AI tools to select the best amino acids and built the protein around those structural constraints.

After repeating the process dozens of times, the team turned to AlphaFold3 to predict the resulting structures. Most looked nothing like known proteins, suggesting the AI wasn’t simply borrowing nature’s existing blueprints.

Thirteen of the synthetic cysteine proteases worked in a test tube test, a success rate of nineteen percent. But all were less active than the original yeast enzyme. The zinc proteases were even trickier. The team had to tweak amino acids near the catalytic core to accommodate another molecular player in the reaction. They found 36 percent of the 135 candidates could precisely cut their targets. One of these targets was amyloid-beta, a protein that forms toxic clumps in Alzheimer’s disease. The best designs made the reaction roughly 100 million times faster than when the protein target naturally broke down.

Designer proteases have a leg up compared to other protein-based medicines. Antibodies, for example, require a high dose because they only latch onto one target at a time. But with proteases, “you just need a small amount because each scissor molecule can cut many, many target molecules,” Baker said in a video provided to journalists.

But the overall low efficacy of the enzymes the team designed exposed an uncomfortable truth: Current AI tools still struggle to create more complex molecular machines.

A Magnifying Glass

To build better proteins, the lab developed RFdiffusion3, a protein design tool that zooms into the atomic world. Protein modeling algorithms, like AlphaFold3, already operate at this level, and some design tools can tweak atoms around catalytic cores. But most still focus on shuffling amino acids.

RFdiffusion3 uses atoms as the basic unit when generating the protein backbone and side chains, better accounting for the precise interactions that make enzymes work.

That’s not to say the model fully maps every atom. Each amino acid is represented by 14 atom slots—four for the backbone and 10 for side chains—that capture its structure and dynamics. Think of dots on a motion-capture suit. The dots don’t track every muscle twitch, but they do provide enough information to reconstruct movement.

This extra detail benefits enzyme design. Scientists can specify atomic positions around the catalytic core to better control the enzyme’s shape and chemical properties. The resulting blueprint more precisely maps out which amino acids to use and where to put them.

The team tested the tool on two types of newly designed enzymes in test tubes. One broke down paraoxon, an environmental pollutant. Using quantum chemistry data to model how the enzyme changes shape, the AI produced four active candidates on the first try, which the researchers further improved for speed and precision.

They also tested a zinc protease designed to cut a protein that, when misfolded and clumped, leads to kidney, heart, and nerve disease. Of 96 designs, 56 cleaved more than 10 percent of their target, a low but promising hit rate for enzymes designed from scratch.

Proteins don’t work in isolation. RFdiffusion3 can also design them in the context of other molecules—DNA, RNA, and drugs—accounting for the atomic details of their interactions. This could help researchers build final structures better tailored to their molecular partners.

As with all AI-designed proteins, each candidate will have to be vetted in cells. But the team is hopeful the upgraded tool could unlock more creative possibilities. “We anticipate RFD3 [RFdiffusion3] will be broadly useful for a wide range of biomolecule design challenges and applications,” they wrote.

The post This AI Model Designs Enzymes With Atomic Precision appeared first on SingularityHub.

Dle Phoronixu zveřejnila společnost Trend Micro prostřednictvím programu Zero Day Initiative (ZDI) několik hlášení bezpečnostních zranitelností přímo na veřejném mailing listu LKML, přestože některé chyby dosud nemají opravu začleněnou do hlavní větve jádra. Mezi hlášenými problémy jsou dvě zranitelnosti s hodnocením CVSS 9.0, týkající se SMB Direct a KSMBD, které mohou umožnit vzdálené spuštění kódu. Další hlášení se týkají například síťového subsystému skb_zerocopy, grafického ovladače vmwgfx nebo NVMe targetu. Greg Kroah-Hartman se v reakcích pozastavil nad zveřejněním hlášení na veřejném listu namísto soukromé bezpečnostní komunikace. Zda šlo o omyl, zatím není potvrzeno. Některé opravy jsou údajně ve fázi testování nebo připravovány k začlenění. Identifikátory ZDI-CAN zatím nelze zaměňovat za přidělená CVE.

Ryan Seal je grafik, produktový designér, vývojář a rád si hraje s Claudem. Vytvořil v něm mj. engine, který převádí klasické papírové návody na kompletaci nábytku z IKEA do interaktivní 3D formy. Webovou aplikaci najdete na sael.net/flatpack, v pravém horním rohu si v roletce vyberete produkt – ...

INTERPOL on Thursday announced that a coordinated law enforcement action has disrupted 10,909 malicious networks and recovered more than $105 million in illicit funds. In tandem, the effort saw law enforcement agencies from 21 countries arrest 1,462 suspects. Codenamed Operation Serengeti III, the cybercrime crackdown took place between June 29 and August 31, 2026. "Authorities identified

INTERPOL on Thursday announced that a coordinated law enforcement action has disrupted 10,909 malicious networks and recovered more than $105 million in illicit funds. In tandem, the effort saw law enforcement agencies from 21 countries arrest 1,462 suspects. Codenamed Operation Serengeti III, the cybercrime crackdown took place between June 29 and August 31, 2026. "Authorities identified Ravie Lakshmananhttp://www.blogger.com/profile/[email protected]

Správce hesel KeePassXC byl vydán ve verzi 2.8.0. Přechází na Qt 6, podporuje vkládání hesel s Waylandem, rychlé odemykání pomocí Polkitu nebo možnost nastavení klávesových zkratek (seznam změn).

Databáze DuckDB (Wikipedie) byla vydána ve verzi 2.0.0 LTS. S kódovým názvem Cinnamon Teal (čírka skořicová). S vyladěným protokolem Quack.

Security researchers at Amazon Threat Intelligence say attackers began targeting the PHP2Shell flaws four days before security patches were released on Wednesday. [...]

Attackers are hammering servers with millions of attempts to exploit the critical PHP2Shell vulnerabilities, with Amazon revealing that someone was already going after the flaws four days before they were publicly disclosed. Cloudflare says it has recorded a staggering increase in attacks targeting the two vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, since details began circulating earlier this week. According to Cloudflare CEO Matthew Prince, the company spotted thousands of exploitation attempts in the 10 hours before the vulnerabilities were publicly announced. That figure jumped to tens of thousands within 45 minutes of disclosure, hundreds of thousands within two hours, and has since climbed into the millions. And the attackers aren't simply recycling the same exploit. Cloudflare said it has seen miscreants tweaking their payloads in an attempt to sneak past its web application firewall (WAF) protections, apparently using feedback from blocked requests to work out what might get through. Security outfit Hadrian also sounded the alarm on October 21, reporting that PHP2Shell was being "exploited in the wild at scale." "Most of the attacks we observe abuse PHP's session upload-progress path, and we expect more exploit paths to appear before and after the fix ships," the company warned. More worrying, some attackers appear to have started before the vulnerabilities were even public knowledge. Amazon Threat Intelligence says it detected an attempt to exploit PHP2Shell on October 17, four days before patches were released. The activity was picked up by MadPot, Amazon's network of honeypots designed to lure attackers and record what they get up to. "While the vulnerability was under embargo, the targeting of a honeypot from an anonymized IP address suggests the activity was conducted by a threat actor, though it remains unclear how the actor acquired exploit information prior to disclosure," Amazon said. The retail and cloud giant said it detected multiple proof-of-concept exploits on October 21, with the earliest appearing around 0200 UTC, some 12 hours before the patches were released. Over the following six hours, further attempts arrived from different anonymized infrastructure, using a variety of payloads. Amazon reckons this points to multiple attackers rather than a single group. Whether any of those attempts would have worked against real-world systems remains unclear. The findings add another layer to an already messy disclosure. As The Register reported on Wednesday, the PHP Foundation has accused supply-chain security vendor Chainguard of putting websites at risk by publishing patched PHP builds before the agreed disclosure deadline. However, Amazon's October 17 detection suggests at least one cybercrim was already trying to exploit the bugs days before that incident. The vulnerabilities themselves are particularly nasty. Both carry a critical 9.2 severity rating and affect PHP's handling of memory, potentially allowing unauthenticated attackers to execute malicious code on vulnerable servers. Unlike flaws in individual plugins or applications, these bugs affect the PHP runtime itself, putting a potentially enormous number of websites at risk regardless of which content management system they use. Cloudflare says it has deployed WAF protections across its free and paid plans, although it has stressed that these are no substitute for patching. With attackers already trying their luck before the fixes were available, admins may have more than just a patching backlog to worry about. Amazon is advising organizations to investigate suspicious activity dating back to at least October 17, rather than assuming their systems were safe until the vulnerabilities became public. ®

Někdy si chcete jen odpočinout, na chvíli vypnout a nemáte náladu na nic dlouhého. V takových situacích se hodí seriály s krátkými epizodami. Když chcete, můžete sjet i několik dílů za sebou.