Agregátor RSS

Podle analýzy společnosti Morgan Stanley má AMD nadimenzované výrobní kapacity pro nadcházející generaci serverových procesorů tak, aby příští rok mohla v tomto segmentu výrazně růst…

A critical security flaw impacting Oracle E-Business Suite has come under active exploitation in the wild, according to Defused Cyber. The vulnerability, tracked as CVE-2026-46817 (CVSS score: 9.8), refers to an improper privilege management and authentication flaw in Oracle Payments that could be abused to take over susceptible instances. "Easily exploitable vulnerability allows

A critical security flaw impacting Oracle E-Business Suite has come under active exploitation in the wild, according to Defused Cyber. The vulnerability, tracked as CVE-2026-46817 (CVSS score: 9.8), refers to an improper privilege management and authentication flaw in Oracle Payments that could be abused to take over susceptible instances. "Easily exploitable vulnerability allows Ravie Lakshmananhttp://www.blogger.com/profile/[email protected]

In 2025, the Reserve Bank of India created the .bank.in subdomain and required all local banks to start using it for their online presences. Indian is home to thousands of banks and the new rule meant all needed to register for and use a bankname.bank.in domain, a move designed to make life harder for phishers and fraudsters. Now a security researcher has alleged that the entity chosen as the sole registrar of the subdomains – the Institute for Development and Research in Banking Technology (IDRBT) – botched the job and leaked sensitive data. The allegation came in a report [PDF] and post published yesterday by CashlessConsumer, a group that advocates for India to become a cashless society and which aims to represent citizens to digital payments players. “The IDRBT Domain Registration Portal (registrar.idrbt.ac.in) – the exclusive registrar for India’s .bank.in namespace – exposed its entire REST API via 33+ unauthenticated endpoints,” the post alleges. “Anyone with curl could retrieve the bcrypt password hashes, mobile numbers, email addresses, login IPs, and device fingerprints of all 5,576 bank employees trusted with managing India’s banking domains.” The researcher behind the exposé, “Srikanth L”, says he accessed info through the portal and found evidence that some India banks host websites on shared servers in the United States, Singapore, and Lithuania. He also found 80 percent of registered .bank.in domains don’t use DNSSEC, 40 percent don’t employ the DMARC email security protocol that verifies senders’ identity, and many domains are secured with free Let’s Encrypt certificates. The researcher’s post also alleges that the portal went live without a proper security audit and ran without secure APIs for 13 months. Srikanth L disclosed his findings in early June and says IDRBT has since fixed the gaping security flaws. The researcher also appears to have used a GitHub repo to list info found by accessing the portal’s APIs – so some of the info available over the previously-open API is now public – and claimed doing so will help security researchers by letting them understand the extent of Indian banking infrastructure. That knowledge may come in handy given the open API means attackers may have been able to access and use credentials of senior bank staff, information that can enable many forms of attack - even the DNS spoofing and phishing attacks the requirement to use .bank.in was designed to prevent. At the time of writing, the IDRBT, Reserve Bank, and India’s government appear not to have made a public comment on the matter. ®

Blíží se prázdniny a než se rozutečete k moři, je na čase se opět sejít na Virtuální Bastlírně - pravidelném setkání elektroniků, ajťáků, bastlířů a obecně nadšenců do techniky. Co si pro vás strahovští bastlíři připravili tentokrát? Určitě proberou blížící se Linux Days i další události. U softwaru se chvíli zdrží a poví si kupříkladu o tom, jak se zbavit Bambu Cloudu, ale nepřijít o možnost ovládat tiskárnu na dálku. Řeč dojde i na AI, konkrétně kde najít nejrozsáhlejší nástroj čerpající z vědeckých článků nebo jak donutit AI, aby byla línější a místo tisíce řádků psala krátké programy využívající již existující knihovny. Ovšem strahováci nesmí zapomenout na hardware! I tentokrát dojde řeč na nástroje s RP2350, které pomáhají uživatelům historických PC. Na trhu už jsou i použitelné UV-C LED, nový český výrobce plošňáků nabízí vícebarevnou masku a za pár korun se dá sehnat i 2 GHz aktivní sonda. Radiacode dělá nový scintilátor, jehož rozsah je tak velký, že jej nejspíš nevyužijete, pokud nejste šváb žijící v reaktoru jaderné elektrárny. Ovšem HW témat mají bastlíři tentokrát tolik, že by se nemuselo dostat na oblíbenou sekci bizáru. Pozornosti by neměla uniknout 555, která se programuje přes SPI, rušení GPS tajným satelitem nebo jak zdánlivě náhodný pixelovaný šum na plošňáku může ve skutečnosti být mikrovlnným filtrem. A jako minule se dostanou k Texas Instruments a jejich úporné snaze opakovaně si prostřelit nohy nahrazováním známých analogových integráčů za nejhorší pajcy. Pamatujte ale, že Virtuální Bastlírna je tvořena nejen připravenými body, ale i množstvím zcela náhodných témat pospojovaných oslími můstky, za které by se nemusel stydět ani Douglas Adams, a které můžete přinést i vy, neb VB je v zásadě takové virtuální posezení u piva! Příští Virtuální Bastlírna se pod taktovkou projektu MacGyver studentského klubu SiliconHill bude konat ve středu 1. července od 20:00 minimálně do 22:00 (ale obvykle končí o dost později). Odkaz na konferenci se před samotnou akcí objeví na bastlířské wiki.

Vývojáři postmarketOS vydali verzi 26.06 tohoto operačního systému pro chytré telefony vycházejícího z optimalizovaného a nakonfigurovaného Alpine Linuxu s vlastními balíčky. Přehled novinek v příspěvku na blogu. Na výběr jsou 4 uživatelská rozhraní: GNOME, KDE Plasma Mobile, Phosh a Sxmo.

Byla vydána nová verze 2.55.0 distribuovaného systému správy verzí Git. Přispělo 100 vývojářů, z toho 33 nových. Přehled novinek v příspěvku na blogu GitHubu a v poznámkách k vydání.

Researchers say that machine learning models cannot reliably distinguish between authorized and unauthorized input, ensuring that prompt injection will continue to present a threat until developers find new ways to have machine learning systems process inputs. AI models provide responses to user-supplied prompts. The problem is that AI models may receive adversarial prompts – directly from a user or indirectly from an ingested document – that tell the model to take action contrary to its built-in system prompt. Various techniques mitigate prompt injection, but defenders have not found ways to prevent such attacks. According to independent researchers Charles Ye and Jasmine Cui, and MIT associate professor Dylan Hadfield-Menell, no one is likely to do so under the current fragile LLM security model. As they observe in a paper titled "Prompt Injection as Role Confusion" in the proceedings of next week's ICML 2026 conference, LLMs have come to rely on a text tagging system that defines "roles" to separate system text from user text. And roles, they argue, do not guarantee security. "Role tags were a formatting trick that became the security architecture and the cognitive scaffolding of modern LLMs," the authors explain in a blog post. "We've shown that this architecture doesn't survive into the model's actual representations, and that such role confusion is linked to prompt injection." When OpenAI's ChatGPT arrived in 2022, it implemented the concept of roles – described by Anthropic a year earlier – as a way to tell the underlying model to behave in a certain way. The user role would make a request and the model, acting in the role of a helpful assistant, would respond to that request. "A formatting trick had become the mechanism that turned autocomplete into an assistant," the authors observe. Developers introduced other roles over time. In addition to and , there's , , and . These roles served to draw a line between different objectives so they could be individually optimized during the training process. Model makers want to balance conflicting objectives like being helpful and preventing harm, and this involves role distinctions. But roles, the researchers say, have become overloaded with responsibilities they cannot reliably carry out. They've become like a fuzzier version of permission levels, determining how prompts are trusted and treated. The problem, the authors contend, is that roles are determined in a fundamentally insecure way: writing style. "LLMs identify roles from an insecure feature (style)," they explain. "This is like identifying a stranger's profession from how they talk and dress rather than by checking their ID. Usually everything agrees, so this works fine. But when attackers intentionally create a mismatch, the LLM uses the insecure method (writing style) to identify its role instead of the secure method (tags)." The authors developed an attack called CoT (Chain of Thought) Forgery that involves using an LLM to spoof the terse style of OpenAI mode and add that to the prompt. The technique won the 2025 OpenAI Kaggle red-teaming contest. "We asked a bunch of LLMs how to synthesize cocaine, inserting fake reasoning that says it's fine because we're wearing a green shirt," the authors explain. "The LLMs comply. The rationale is transparently dumb, but the models don't evaluate it as an external claim to be scrutinized. They treat it as their already-reached conclusion, and simply act on it. We've stolen the trust given to the role." On a standard jailbreaking benchmark, they say, CoT Forgery took the attack success rate from near zero to about 60 percent on the models tested. And whereas most jailbreaks are fragile and work only for certain models, this one transferred because it exploits a structural flaw. It's not attempting to persuade the model but duping the model into treating the request as something that's already settled. The authors also note that while many models report near-perfect safety scores on prompt-injection benchmarks, human red-teamers achieve attack success rates close to 100 percent. "The discrepancy is straightforward: skilled humans test and adapt attacks until they work, benchmarks don't," they state. "Static benchmarks measure attacks models have already learned to catch." Roles, the authors argue, deserve more attention from the research community because they've become one of the most important abstractions in the AI stack. "Unless LLMs achieve genuine role perception, we think injection defense will remain a perpetual whack-a-mole game," they conclude. "And the continuous nature of role boundaries opens the threat of injections designed to subtly shift LLM states through seemingly innocuous text, legally and at scale." ®

Four years into the Kremlin’s illegal invasion of its neighboring country, Russian influence operations have moved beyond their near-exclusive focus on Ukraine to their former favorite targets: the US and Europe, and especially covert cyber-ops intended to undermine political stability within these countries and the unity between them, according to Google Threat Intelligence. “This shift is significant because it likely signals increased focus outside of Ukraine, warning that pro-Russia influence activity targeting the European Union (EU), North Atlantic Treaty Organization (NATO), and other top targeting priorities may intensify,” Google threat hunters James Sadowski and Alden Wahlstrom said in a Monday report. The war in Ukraine helped Russian operatives refine their influence activities, and Moscow’s increasing use of AI for planning, reconnaissance, and content generation “marks a forward trend in pro-Russia IO,” the duo wrote. The primary objectives of these pro-Russia influence campaigns center around five key goals, all of which aim to advance the Kremlin’s military and political objectives via psychological manipulation – something Russia has been very, very good at throughout history. These key goals include: undermining democracy, dividing Western coalitions, promoting Russia’s image and regional interests, maintaining domestic stability, and repressing political dissent within the country. While the campaigns themselves typically involve fake news websites serving up phony political commentary or direct messages disseminating pro-Russian narratives, influence ops frequently coincide with data-wiping malware or other destructive cyberattacks, hack-and-leak campaigns, or direct cyber-espionage, according to the Googlers. This influence ecosystem spans multiple channels, from official government propaganda and covert intelligence operations to hacktivists and pro-Russian proxies. Oftentimes, the lines between these channels are blurred, making attribution more difficult and giving Moscow plausible deniability for cyber activities. Plus, Russian cybergroups – like everyone else – are increasingly using AI tools across their entire campaigns to make their cyber operations more efficient. Late last month, researchers at WithSecure documented Russia-linked cyber espionage crews using AI tools to help build malware, spin up infrastructure, and craft lures for attacks on Ukrainian targets. The group, tracked as GreyVibe, used OpenAI's ChatGPT, Google's Gemini, and Ideogram AI across almost every stage of its operations since at least August 2025, we’re told. “As Russia seeks to emerge from international isolation and reorients its influence ecosystem back toward global objectives, it is critical for defenders to understand how this ecosystem provides the Kremlin with a durable influence capability in order to better anticipate future Russian influence threats,” the Googlers noted. ®

Federal authorities are offering a reward of up to $10 million for information leading to the identification or location of a Russian state cyber group that has compromised thousands of Signal and WhatsApp accounts belonging to investigative reporters and US government employees.

The operation has been active since at least March, when the FBI published an advisory warning of ongoing phishing campaigns targeting high-value targets by attackers associated with Russian intelligence services. Messages masquerading as automated support communications ask that users click a link or provide verification codes or account passcodes. In the event the user complies, they unknowingly link the attacker's device to their account or have their account completely taken over and are locked out.

Read full article

Comments

Normativy podle okresů, vyšší ochrana samoživitelů i mírnější pravidla pro OSVČ. Jak chce vláda upravit superdávku a jaké návrhy předložila opozice?

V roce 2012 představil Evan Czaplicki jazyk Elm, který poměrně unikátním způsobem kombinuje možnosti jazyka z rodiny ML (SML, OCaml, F#) s prostředím JavaScriptu, především pak s frameworky pro uživatelské rozhraní.

Amerika má vlastního výrobce pamětí, Micron. Jenže Applu je příliš drahý a chce se domoci povolení k nákupům pamětí od čínské CXMT, která má citelně výhodnější ceny…

Zvyky turistů se pokusíme pojednat s nadhledem, pokud možno bez emocí, spílání a apokalyptických vizí. Prostředkem k tomu je evoluční teorie a některé antické rady. Je to přece obraz našeho života.

Endotelová dysfunkcia je predstupeň aterosklerózy. Významne sa podieľa na vzniku kardiovaskulárnych ochorení. Je charakterizovaná zápalom ciev, sklonom k trombóze a poruchou vazodilácie. V súčasnosti nie je možné objektívne stanoviť jej závažnosť u jednotlivých pacientov a okrem všeobecnej prevencie aterosklerózy nie je známa preukázateľne účinná prevencia a liečba. Ale možno stačí občas pobehnúť…

Selekční stín je stařičký evoluční koncept stárnutí, který souvisí s tím, že přírodní výběr nevidí, co se stane s organismem po tom, co se rozmnoží. Nový výzkum potvrdil, že selekční stín je reálný jev, který bychom měli studovat u dalších dlouhověkých druhů a hledat u nich inspiraci pro výzkum zdravějšího stáří.

Nissan is warning that it suffered a data breach affecting current and former employees after threat actors exploited an Oracle PeopleSoft vulnerability in data theft attacks previously linked to the ShinyHunters extortion group. [...]

The National Association of Insurance Commissioners (NAIC) says the ShinyHunters extortion group stole only publicly available data, outdated logs, and configuration files after breaching its systems by exploiting a zero-day vulnerability in an Oracle PeopleSoft server. [...]

Not everyone is willing to follow responsible disclosure of vulns. An anonymous researcher has dumped what they say is working exploit code for zero-day vulnerabilities across 15 software products and open source projects without notifying any vendors or maintainers prior to publishing - and attackers are already exploiting at least two of these. The first is CVE-2026-55200, a critical, pre-authentication remote code execution (RCE) vulnerability in libssh2, a popular client-side C library that implements the SSH2 protocol. Remote attackers can send crafted SSH packets with excessively large packet_length values to corrupt heap memory and achieve remote code execution. A fix has been merged into the libssh2 mainline development source control branch, and maintainers are still preparing a libssh2 release containing the patch. The second is CVE-2026-58053, a critical vulnerability affecting Gitea act_runner on the Docker backend. It’s due to improper privilege controls, and can be abused to achieve root-level container escape. The researcher, who goes by bikini, dropped the exploit code and vulnerability write-ups in a now-removed GitHub repository called exploitarium. They remind us of Nightmare Eclipse - the zero-day bug hunter who has been publishing Microsoft exploits over the past couple of months. Unlike Nightmare Eclipse, however, bikini doesn’t appear to hold a grudge against any one vendor, publishing purported vulnerabilities across multiple products and projects including libssh2, Splunk, RustDesk, 7-Zip, VLC, AnyDesk, OpenVPN, c-ares, Gitea, and Floci. Bikini claimed - and, to be clear, The Register has not verified these claims or that the code works - that none of the exploits in the repo have been reported. “Feel free to report them yourself and take credit for the CVE if handed out lulz,” the anonymous researcher wrote, as shown in this screenshot posted on X by Ledger CTO Charles Guillemet. “Please do not abuse these. I do this so to allure people into the field.” Other researchers, including Federal Signal analyst Ethan Andrews, suggested that bikini used advanced AI models - specifically GPT-5.5 Codex - to automate fuzzing and vulnerability discovery, in yet another indication that the AI-induced vulnpocalypse is nigh. In response to bikini’s data dump, Andrews built 44 KQL detection rules covering the full exploitarium repo with language translation available for non-KQL stacks. “The most technically significant findings - libssh2 pre-auth heap write and Gitea default Docker auth bypass - have been independently verified as high-risk with active exploitation observed,” Andrews wrote, noting that some of the exploitarium disclosures “have been dismissed by the community as low-impact AI-fuzzing noise.” While the repository has since been removed by GitHub, nothing ever truly dies on the internet, and it’s safe to assume that attackers are now also using AI to scan for vulnerable instances. In many cases, bikini’s PoCs mean they don’t even have to spend time developing an exploit. ® Correction: The original version of this story misidentified the exploitarium Gitea PoC as CVE-2026-20896. This bug was disclosed by @rz1027 and fixed in Gitea’s coordinated 1.26.3 security release.

Ford has rehired approximately 350 experienced engineers after the company’s investment in AI and automated quality control systems failed to meet expectations, according to Bloomberg. In short, the technology did not detect enough problems.

“We mistakenly believed that we could create a high-quality product simply by introducing artificial intelligence and inputting our design requirements,” Charles Poon, head of Ford’s hardware development, told Bloomberg.

The rehired quality inspectors — known internally as “gray beard” engineers for their experience and years with the company — are now working to identify defects before components reach the factories.

Still, Ford is not abandoning AI completely; the experienced engineers will be asked to help train younger employees and improve the company’s AI tools.