AntiMalware•November 10, 2026•🇷🇺Translated from Russian

Yandex Plus Points Expand Beyond Ecosystem but Spending Amount Set Automatically

Yandex has rolled out a new feature allowing Yandex Plus subscribers to spend their points at external partner locations through Yandex Pay. The update opens more than 10,000 partner outlets, including stores, cafes, pharmacies and other businesses, to points that were previously restricted to the Yandex ecosystem.

To redeem points, users need an active Yandex Plus subscription. On websites or in apps, they select Yandex Pay and enable the toggle labeled “Spend points.” In physical stores, customers either scan a QR code at the checkout or display a code from the partner’s application.

The system automatically calculates the number of points applied to each purchase; users cannot manually set the amount. Any remaining balance is paid with a card via Yandex Pay. A single transaction can either use points for payment or earn cashback points, but not both at the same time.

Redemption of Yandex Plus points can still be combined with any loyalty bonuses offered by the merchant itself. According to the report, Yandex intends to grow the partner network further and is including smaller independent stores in the expansion.

Related articles

Securitylab•Other

BGP Anycast and Traffic Filtering: How Distributed DDoS Protection Works

Powerful DDoS attacks can leave servers intact while blocking user access by overwhelming network links or equipment before traffic reaches applications. Scaling server resources offers little help in such cases. One effective defense distributes incoming traffic across multiple geographically dispersed scrubbing centers using BGP Anycast, which advertises the same IP addresses from different locations. Routers then direct packets to the nearest or most appropriate node based on BGP policies. This architecture allows each center to filter malicious traffic locally before forwarding clean data to the protected infrastructure. The approach proves especially useful against volumetric attacks but requires careful management of routing, load distribution, and application health checks. Providers such as Qrator Labs and Akamai Prolexic operate large anycast networks with multi-terabit capacity.

Securitylab•Other

Freedom Holding Corp Builds Integrated Financial Ecosystem Across Banking, Insurance, Telecom and AI

Freedom Holding Corp., listed on Nasdaq under FRHC, has grown from a brokerage founded by Timur Turlov into a diversified group operating in 24 countries with its core market in Kazakhstan. The company now encompasses Freedom Bank Kazakhstan, Freedom Life and Freedom Insurance, Freedom Telecom, Freedom Cloud, and the Arbuz marketplace, all unified through the Freedom SuperApp launched in April 2024. In the financial year ended 31 March 2026 the group reported revenue of $2.19 billion and net profit of $153.3 million, while banking assets reached $5.36 billion. Freedom Holding is also investing heavily in AI infrastructure, planning a 100 MW sovereign data center and a $2 billion AI hub in partnership with NVIDIA and the Kazakh government. The company has expanded into Tajikistan, Turkey and is seeking licenses in Georgia and France while maintaining strong growth in deposits and active users.

AntiMalware•Other

Russia Proposes Fines Up to 5 Million Rubles for Social Networks and Online Cinemas Failing to Restrict Content Discrediting Traditional Values

A Russian State Duma committee has recommended adopting a bill that introduces administrative fines for owners of social networks and online cinemas who fail to limit access to content deemed to discredit traditional Russian spiritual and moral values. The legislation builds on existing requirements by adding financial penalties enforced by Roskomnadzor following decisions from the Ministry of Culture. First-time violations could result in fines of up to 20,000 rubles for individual platform owners, 200,000 rubles for officials, and 1 million rubles for companies. Repeat offenses would escalate these amounts significantly, reaching up to 300,000 rubles, 800,000 rubles, and 5 million rubles respectively. A separate provision targets online cinema operators for distributing such works, with corporate fines capped at 700,000 rubles initially and 3 million rubles for subsequent violations. Platforms can avoid liability if they remove the content within 24 hours after the rental certificate is revoked. Cases would be initiated by the Ministry of Culture for distribution issues and Roskomnadzor for non-compliance, with district courts handling proceedings.

Habr•Other

Formal Verification Proves No Rights Escalation in Fuchsia Zircon Capability Model Using Isabelle/HOL

Researchers built a simplified Isabelle/HOL model of capability delegation in Zircon, the microkernel of Google's Fuchsia OS, and formally proved that transfers through channels never grant recipients more rights than the sender possessed. The model covers handles, rights masks, channel transfers, VMO objects, and duplication while enforcing the TRANSFER right as a gate. Proofs include channel_transfer_no_escalation, channel_write_requires_transfer, and zx_handle_duplicate_no_escalation for all reachable states from a well-formed initial state. The work also demonstrates a concrete negative witness: privileged MMIO writes that bypass the capability layer can still corrupt object state. The study deliberately limits scope to a teaching fragment rather than full seL4-style refinement and highlights differences from real Zircon semantics such as write_etc and independent READ/WRITE bits. The resulting artifact is executable and can be rebuilt with isabelle build.