Agregátor RSS

Při příležitosti oslav Dne vzniku samostatného československého státu (28. října) byly uděleny medaile Za zásluhy tvůrci aplikace Záchranka Filipu Maleňákovi, vědci v oblasti umělé inteligence Tomáši Mikolovovi a Olze Štěpánkové, vědkyni zabývající se kybernetikou, robotikou a strojovým učením, průkopnici v oblastech výuky a využití umělé inteligence v medicínském inženýrství.

OpenAI and Anthropic agree that frontier AI systems need stronger oversight, but they are proposing sharply different approaches to stopping models that pose serious risks: Anthropic wants courts empowered to suspend dangerous systems, while OpenAI argues developers should be required to maintain and use effective shutdown controls.

The proposals appear in separate submissions to California Governor Gavin Newsom following his September 18 executive order directing state officials to consider additional safeguards for frontier AI systems. Both companies support independent safety assessments and expanded reporting of incidents involving AI systems that act beyond their intended permissions.

“If the AG concludes, informed by the independent evaluation, that a frontier AI company’s models pose a near-term risk of catastrophic harm, they should be able to seek a court order to suspend a model’s deployment, internal use, or further development,” Anthropic wrote in its October 15 submission.

OpenAI, in its October 20 letter, called for an amendment to California’s Senate Bill 53 (SB 53).

“We support amending SB 53 to require frontier developers to maintain effective shutdown controls and an enforceable duty to use them when unsafe conditions arise, and no lesser intervention would adequately address the risk,” OpenAI wrote.

Sanchit Vir Gogia, chief analyst at Greyhound Research, said the two approaches address complementary needs. “The operator must contain the unsafe activity promptly. Independent review must examine both intervention and inaction,” he said.

Newsom’s executive order, N-9-26, directs California’s Government Operations Agency, in consultation with the Governor’s Office of Emergency Services and national experts, to submit recommendations by November 16 on potential amendments to existing AI safety laws. The order asks officials to examine independent verification inside AI laboratories, independent checks of safety assessments, verified shutdown mechanisms, and expanded reporting of critical safety incidents. It does not itself impose these proposed requirements.

Independent verification

Anthropic wants evaluators to assess developers’ safety claims and publish their own findings.

“We strongly support requiring independent verification of what frontier AI companies report about the risks of their models and whether those risks are sufficiently mitigated,” the company wrote.

It proposed requiring developers to publish risk reports at least every six months, covering serious risks from their models, including internally used models substantially riskier than released systems. Evaluators should receive unredacted reports and access to developers’ most capable models and relevant internal information.

Anthropic also proposed that developers pay into a state-administered pooled fund to finance evaluators, rather than pay them directly. It said a team from the independent evaluation organization METR had received employee-like access on a pilot basis, with further partnerships involving SecureBio and Accenture under development.

OpenAI, in its letter, said it supports independent technical assessments but distinguishes them from compliance audits. Technical assessments would examine evidence behind developers’ safety claims and the effectiveness of safeguards; compliance audits would check whether companies follow their published safety frameworks and legal obligations, it added.

OpenAI recommended annual independent compliance audits and focused technical assessments of serious risks arising during model training, evaluation and internal deployment. It also urged California to work with the National Institute of Standards and Technology to develop common assessment standards.

Gogia said oversight requires more than funding. “Credible assurance must survive an adverse finding,” he said.

Beyond a single switch

OpenAI argued that a single kill switch would not address the different ways AI systems operate and are deployed.

“We recommend using the term ‘shutdown controls’ because it will require the development of multiple controls and coordinated action by different actors to stop AI operations when necessary, rather than a single switch,” the company wrote in the letter.

Interventions could include stopping a training run, isolating an AI agent, revoking tool or network access, or suspending a service. OpenAI said responsibilities should extend to inference providers and downstream deployers according to the operations they control. It also noted that developers cannot reliably switch off independently operated copies of open-weight models running on external systems.

Anthropic similarly argued for more targeted safeguards. “We think a more apt metaphor for what frontier AI companies need to build is a circuit breaker,” it wrote, advocating controls that can contain problems at the level of an agent, customer, deployment environment, or model.

For enterprises, Gogia said, contractual shutdown responsibilities should match the controls each party actually possesses. Agreements should specify intervention authority, incident-reporting cooperation, and who can authorize a restart.

“Every assigned duty needs an executable control,” he said, adding that CIOs should test recovery processes rather than assume switching to an alternative model will preserve safe operations. Both companies also called for broader reporting of incidents involving models that circumvent safeguards or take unauthorized actions.

Microsoft released the KB5127936 preview cumulative update for Windows 11 versions 25H2 and 26H2, with 41 changes, including File Explorer and Cloud rebuild improvements. [...]

EXCLUSIVE Researchers identified at least 83 attacks against 61 public GitHub repositories, including popular open source projects such as Google LangExtract, Trivy, Brave browser, and MLflow, in what they suspect is a coordinated campaign to execute commands in CI/CD environments and steal credentials and access tokens. It all happened very quickly, the Radware threat hunters said in an exclusive interview with The Register. Most (77) of the malicious items were published during a 43-minute time span on September 1, with the remaining six occurring within the next two minutes. “Our guess is that the final aim was a supply-chain attack in which the attacker gains credentials for the repo, and then he has the power to change the contents – the code – as he wishes” and then push the malicious changes to others, Radware VP and researcher Gabi Nakibly told The Register. Nakibly and fellow Radware researcher Zvika Babo say they suspect a single individual is behind this supply chain campaign. This attacker used 74 different GitHub accounts, many of which had legitimate development histories, meaning they were likely compromised. "Considering that dozens of accounts posted the same type of payload, on the same day, within a narrow time window, and to the same infrastructure, it is reasonable to assess that the activity was coordinated,” the team wrote in research shared ahead of publication with The Register. A novel attack chain They discovered the campaign while investigating prompt injection in GitHub – and they told us the attack chain is part of what makes this supply-chain campaign novel, and extremely stealthy. First, the attacker publishes an issue, pull request, or comment containing malicious commands hidden in HTML comments. This ensures the content is not visible in the rendered page. Plus, a GitHub event – like a pull request or issue – can automatically trigger a workflow if the repository is configured to respond to that event, meaning the attacker can be pretty hands-off at this point. “The workflow automatically is triggered within a second, and if the workflow is indeed vulnerable, then the attack is executed successfully,” Nakibly said. The workflow incorporates attacker-controlled content directly into shell source code, and the shell executes the hidden, malicious command, which hoovers up environment variables and attempts to exfiltrate those to an attacker-controlled server. While the researchers examined logs from actual runs, and told us they found two cases containing evidence that the malicious command ran inside the automation environment, they can’t definitively say whether the attacker successfully obtained repository write permissions, modified source code, or compromised downstream software. But they're trying. “The big picture is that the attackers are trying to find every possible way to get inside the repos to get credentials,” Nakibly said. Plus, “the attacker doesn't need to compromise the repository or to have access to its codebase” to do this, Babo added. “Basically, every user with a GitHub account can try to run this attack – it's very easy to start this attack.” Which repos were affected? As of October 13, the threat hunters identified 83 GitHub items with a verified payload across 61 different repositories. The repos span AI frameworks, security tools, development infrastructure, databases, and other widely used open source software projects. The Radware report lists agno-agi/agno (42.7K stars), ToolJet/ToolJet (41.1K), google/langextract (38.9K), aquasecurity/trivy (38.4K), CopilotKit/CopilotKit (38K), and podman-container-tools/podman (33K), among the most popular. Other notable targets included QwenLM/qwen-code (28.5K), mlflow/mlflow (28.4K), discordjs/discord.js (26.8K), cilium/cilium (25.6K), brave/brave-browser (23.9K), dotnet/maui (23.3K), Homebrew/homebrew-cask (22.2K), github/docs (21K), apache/doris (16K), and PX4/PX4-Autopilot (12.8K). “These projects are used by thousands of organizations," Babo said. The researchers disclosed their findings to all of the projects’ maintainers, and most of the repositories were closed or fixed, but they can’t confirm that all of them were. This campaign follows several earlier supply chain attacks against open source security and dev tools as attackers increasingly look for new methods to steal credentials and other secrets. “There is no way to stop the attackers from attempting,” Nakibly said. “The only way is to make sure that the workflow code is resilient, and not vulnerable to such attacks." The researchers recommend applying least-privilege access to CI/CD workflows, and separating as much as possible workflows triggered by external events from jobs with elevated permissions. “Developers should treat external content as untrusted, and also limit the secrets and environment variables that are available to the workflow,” Babo said. ®

Security teams have spent years trying to detect threats faster. AI is changing the harder part: how much time defenders have left to act. Advanced AI models can now help attackers discover vulnerabilities, generate exploit code, and move through weaknesses faster than traditional security processes were built to handle. The challenge is no longer just finding another vulnerability or [email protected]

A flaw in Telegram for Android could be chained with two other bugs to take full control of a victim's phone through a voice call, once the victim answered, according to security startup NebuSec. The attacker needed only an ordinary Telegram account. Telegram fixed the flaw in version 12.10.4 of the app, released in late September, and NebuSec disclosed it on October 29. Combined with anSwati Khandelwalhttp://www.blogger.com/profile/[email protected]

AI is beginning to take over much of the work that has traditionally defined the security analyst's job. Investigating alerts, collecting evidence, correlating activity across tools, and executing response actions are becoming tasks that AI systems can perform on their own. As these capabilities mature, security operations centers (SOCs) will see major changes in how work is organized, how [email protected]

26,400 credentials that developers left in public code on Gitee, a Chinese code-hosting service, still worked when a researcher tested them. Anyone who copied one from that code could have used it. Independent researcher Ben Zimmermann found them by scanning 7.25 million public Gitee repositories and reported the results on October 28. Most were keys for cloud and AI services, led by Swati Khandelwalhttp://www.blogger.com/profile/[email protected]

V rámci posledního Next Festu na Steamu jsme si zahráli i novinku od tvůrců Forgotten but Unbroken. Opět se vrhneme do boje v tahových bitvách, ale druhou světovou zde vystřídá doba moderní a boj proti drogovým kartelům. Je vidět, že tvůrci mají s žánrem již patřičné zkušenosti, ale jistá lacinost ...

Cisco released security updates to patch a denial-of-service zero-day in Adaptive Security Appliance (ASA) and Threat Defense (FTD) software that attackers are exploiting to remotely crash vulnerable firewall devices. [...]

Váží jen 60 miligramů, nemají baterii a nepotřebují GPS. Přesto dokážou vědcům prozradit, kudy monarchové stěhovaví putují napříč Severní Amerikou. Miniaturní vysílače BlūMorpho využívají solární energii a rádiové signály, které mohou zachytávat i běžné chytré telefony.

Poláci směle pokračují ve výstavbě dálniční sítě. Jejich obdoba našeho ŘSD – Generalna Dyrekcja Dróg Krajowych i Autostrad (GDDKiA) – se před pár dny pochlubila pokrokem na rychlostní silnici S19, která v délce 570 kilometrů protne zemi od severu až ke slovenským hranicím. V úseku Babica-Jawornik ...

Cisco has released patches to address a high-severity security flaw in Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software that it said has been exploited in the wild. The vulnerability, tracked as CVE-2026-76418, is rated 8.6 on the CVSS scoring system. Successful exploitation could allow an unauthenticated, remote attacker to cause the Ravie Lakshmananhttp://www.blogger.com/profile/[email protected]

GitHub has announced that it's introducing a new package firewall as a preview to block installation of suspicious npm packages during installation time. "The firewall inspects both metadata requests and package downloads for signs of malicious activity, acting as an install-time policy gate," GitHub said. The feature, which currently supports only npm packages, is available in public preview Ravie Lakshmananhttp://www.blogger.com/profile/[email protected]

Apple už reklamy na své produkty točí v naší republice deset let. V té nejnovější cestoval s dotykovým MacBookem Pro po Praze. Dominantní roli ve videu hraje Kongresové centrum, bývalý Palác kultury. Ukazují se v něm prosklené foyery s výhledem na pražské panorama, klasické i točité ...

An attacker tried to exploit a critical GitLab vulnerability on the Alpine Linux project's own GitLab server a week after GitLab released a fix, Alpine Linux said on 28 October. The flaw, CVE-2026-97229 (CVSS score: 10.0), can let an attacker run code on a GitLab server through a crafted regular expression in a CI configuration. Alpine found no evidence that the attack worked butSwati Khandelwalhttp://www.blogger.com/profile/[email protected]

Welcome back to PWNED, in which The Reg offers cautionary tales from folks who’ve left their doors wide open to attackers and lived to tell the tale. This week’s misadventure involves unpatched older machines and a password that was supposed to send a message to crims. Our story comes courtesy once again of leading red teamer and pen tester Dahvid Schloss of Suzu Labs. A client asked Schloss to visit a factory and check the servers there for security holes. The company had been hacked six months prior, made some adjustments, and wanted to make sure that they were bulletproof now. Schloss' mission, which he chose to accept, was to get domain admin rights. Schloss drove over to the factory where he noticed a number of Windows 7 servers were connected to the CNC milling machines, even though Windows 10 was by then Microsoft's supported desktop OS. This was to be expected, as companies with proprietary software often use legacy OSes for fear of breaking apps. At first, Schloss had a hard time breaking in because most of the servers were not connected to the domain. So there was no point in his running the EternalBlue zero-day that would have let him in. “So I've been looking through these and most of them had been disconnected from the domain, so it's the right move,” he said. “Like, yeah, you could run EternalBlue on the network, but you really weren't going to be able to get anywhere with it, cuz you get on the device and what you find: you dump LSASS [the Windows Local Security Authority Subsystem Service], you’re like ‘All right, there’s local admin creds, but the local admin creds on those devices were different from the local admin creds on the majority of workstations.” Finally, Schloss went onto one of the servers that was connected to milling machines and found that it was connected to the network and on the domain. It was vulnerable to EternalBlue and he went and dumped LSASS and found a pair of creds from WDigest, one of which looked like an admin account. But Schloss thought that it must not be a legitimate admin account when he read the password : “heyhackergof***yourself,” but written in leet speak [l337 5p34k]. The resulting string was a strong password, but Schloss assumed that the admins were playing a game with him and left this credential there for him to find. Schloss assumed it wouldn't work and sat on it for a week. During a briefing he had with the IT crew, he presented his findings and then asked who set up the admin account with this funny password. “You could see everyone kind of looking at the senior manager of IT like ‘that was you, wasn’t it,’” Schloss explained. “He’s kind of got this face. I’m like ‘oh shit, like what?’ Turns out that ‘heyhackergof***yourself’ was the actual password for his admin account." On Monday, Schloss tried the username and password combo and, lo and behold, it gave him complete control of the entire network. He was then able to get access to other passwords and many of them were also insults directed at potential hackers. Schloss understood that the team was still angry about a breach they had suffered six months prior and, should they be breached again, wanted to give the finger to the hacker who did it. Unfortunately, their system was still vulnerable because of the outdated machine that was hooked up to the domain and he was able to gain control. The lesson here is really to patch your systems and avoid using insecure legacy OSes whenever possible, because it was an old machine that let Schloss in, not a weak password. Indeed, “hackergof***yourself” in leet speak isn’t a terrible password, just an embarrassing one if it's exposed. ®

Nová verze ray-tracing knihovny AMD potvrzuje použití grafických architektur RDNA 4M a RDNA 5 na APU řady Medusa, tedy těch postavených kolem procesorové generace Zen 6…