Other
Cybersecurity news in this category
Building Your First Home Network Lab: Essential Tools and Experiments to Understand Corporate Networks
PSLC and Agent-Ops: From Product Support to Infrastructure Transformation
Russian Organizations Allocate 4.5 Trillion Rubles to Innovation Spending in 2025
Telegram macOS Developer Says 99.9% of Client Code Is Now Written by AI and Suggests Firing Manual Coders
Mike, the developer of the official Telegram client for macOS, stated that artificial intelligence now generates 99.9 percent of the messenger's client code. He argued that programmers who continue writing code manually should be dismissed. In a Telegram discussion, Mike cited the gram.org website as an example created entirely with AI assistance in a single day, with domain support from Pavel Durov. He also described adapting the iOS client for a foldable iPhone Duo overnight using Claude. According to Mike, even designers are now contributing to client code, and 80 to 90 percent of Telegram developers share his positive view of AI tools. When participants raised questions about code quality and security, Mike replied that AI also identifies and fixes vulnerabilities, claiming the resulting code is superior to human-written equivalents. He further announced plans to open a new GitHub repository for the macOS client source code, as the previous repository had not been updated for over a year.
Secure Boot on Arch Linux: Enabling Protection for UKI Without Replacing Factory Keys
A detailed guide explains how to configure Secure Boot on Arch Linux for Unified Kernel Images without replacing the motherboard's factory keys or relying on Microsoft certificates. The author chose the minimal-intervention approach of adding a custom key to the existing DB section via the UEFI interface instead of using sbctl enroll-keys or shim. The process begins with backing up existing keys to a FAT-formatted USB drive directly from the BIOS menu. New keys are then generated using sbsigntools and openssl, converted to DER format, and enrolled through the ASUS Prime 790-P UEFI interface. A post-hook script for mkinitcpio automatically signs the UKI after every kernel update, ensuring the entire unified image remains protected. The method preserves the original Microsoft and vendor certificates while adding only the user's own signing key.
What Server Logs Reveal About Attackers: Analyzing Suspicious Requests on Linux
Server logs provide critical insights into potential intrusions by recording events from the operating system, SSH authentication, and web applications. The guide explains how to examine Linux system journals with journalctl, review authentication logs on Debian and RHEL systems, and inspect Nginx access logs for unusual HTTP requests. Analysts learn to identify patterns such as rapid failed login attempts using multiple usernames from a single IP address, which may indicate brute-force or automated scanning activity. The article also covers counting the most active IP addresses with awk and sort commands while stressing the need to compare findings against normal traffic baselines. Additional recommendations include logging structured security events in JSON format with fields for timestamp, user ID, resource, and outcome, following OWASP guidelines. The text warns against storing sensitive data like passwords in logs and highlights limitations such as possible log tampering or unsynchronized server clocks. A practical seven-step investigation plan helps responders preserve evidence and verify hypotheses before taking action.
UserGate Details FPGA Acceleration to Turbocharge Next-Generation Firewalls
UserGate product manager Pavel Molodan explains why adding security features like IDS/IPS, SSL/TLS inspection, and application control turns a high-performance NGFW into a bottleneck. The company outlines four groups of acceleration methods, with a focus on FPGA-based hardware offloading for packet parsing, firewall rules, NAT, and encryption tasks. Research from 254 respondents shows strong demand for these functions in data center B2E segments at 50-200 Gbit/s. Experimental platforms including Katun-2 PCIe cards and the FG system demonstrate concrete gains, such as scaling IDPS from 5 to 90 Gbit/s and achieving 85 Gbit/s firewall throughput on EMIX profiles. FPGA delivers microsecond latency and better energy efficiency compared with CPU-only designs while preserving full NGFW functionality for elephant flows.
Curator Reveals Detailed Architecture of Its Network Filtering System After October 2026 Outage
Curator published a technical post-mortem analyzing the 38-minute outage that affected its entire traffic filtering network on October 8, 2026. The company operates nine filtering sites across Russia, each containing multiple nodes connected via high-performance switches to upstream providers. Traffic is isolated using two VRF contexts—external for inbound dirty traffic and internal for cleaned traffic—ensuring sequential processing through the protection system. Each node runs a custom Linux kernel firewall and a watchdog service that monitors BGP sessions to detect failures and remove unhealthy nodes from rotation. Centralized configuration management via CControl allows rapid rollout of rules but also introduces systemic risk when faulty changes propagate across all nodes. The post-mortem emphasizes the need for isolation, staged deployments, and independent recovery mechanisms in large-scale filtering infrastructures.
Testing Sinonix Controlled Data Exchange System with VEGMAN R220 G3 Servers and TATLIN.BACKUP.M Storage
YADRO and IT Bastion conducted extensive performance testing of the Sinonix information exchange control system using high-capacity VEGMAN R220 G3 servers and TATLIN.BACKUP.M storage arrays. The tests simulated one-way data transfer scenarios for disaster recovery and air-gapped backup environments required by Russian presidential decree No. 604 on critical infrastructure protection. Multiple fio workloads were run for up to five hours under both light and heavy queue-depth profiles with MTU sizes of 1500 and 9000. Results showed that Sinonix introduced minimal overhead in moderate workloads and up to 27 percent reduction under heavy parallel loads when using jumbo frames. The setup replicated multi-tier protective perimeters including synchronous replication, one-way safe zones, and remote immutable storage. The testing confirmed stable long-term operation without degradation or failures across all configurations.
Developers Achieve Native iOS 16 Boot on Redmi Note 10 Pro and Note 12 4G Using Modified Apple XNU Kernel
A team known as dipa-studio has successfully booted iOS 16 natively on Redmi Note 10 Pro and Redmi Note 12 4G devices without any Android layer or emulation. The project relies on an adapted Apple XNU kernel and system components taken from the iOS 16.7.16 firmware of the iPhone X. While basic interface elements such as the Control Center, Notification Center, and Settings app function, the majority of hardware features remain non-operational. No Wi-Fi, Bluetooth, cellular connectivity, audio, cameras, or GPS are available, and the App Store along with Apple ID login are inaccessible. The port disables a significant portion of iOS security mechanisms, and installation wipes all user data from the original Android system. Performance is limited because the CPU renders the interface at roughly 20-30 frames per second without a dedicated graphics driver. The effort is described as purely experimental, with the Redmi Note 12 4G variant currently reaching only the lock screen.
How to Earn a Living Writing Technical Articles on Information Security
A detailed guide examines multiple platforms where technical writers can get paid for publishing articles on information security topics. Skillbox offers payments starting from 3,000 RUB but requires a civil-law contract and tax reporting. Codeby pays 250 RUB per 1,000 characters for relevant technical pieces without contracts, making it suitable for remote workers and privacy-conscious authors. Duty-Free provides a fixed 200 USD per article paid in cryptocurrency, yet operates in a gray area under law-enforcement scrutiny. Xakep.ru compensates authors with variable fees around 150 USD for pentest-related material plus subscription perks. The article also discusses risks of writing for high-paying but questionable resources and provides a roadmap based on long-term career goals.
True Crime from Investigators: Solar Group to Premiere Real Cyber Investigation Series at Russian Cybersecurity Week 2026
The Solar Group has announced that its Cyberculture project will shift from poster exhibitions to a short true-crime series titled True Cyber Crime. The series draws directly from real investigation cases handled by the company's security practitioners. Episodes will air on Cyberbez TV during the SOC Forum, which forms the centerpiece of Russian Cybersecurity Week running from 26 to 30 October 2026. In parallel, the Cyberbez-Likbez track will deliver lectures and meetings across more than twenty universities between 5 and 26 October, targeting both specialized and non-specialized audiences. The main SOC Forum itself is scheduled for 27-28 October at the Lomonosov cluster in Moscow. Organizers state that the narrative format is intended to hold viewer attention longer than static posters while explaining concrete digital threats and recommended protective behaviors.
Personal Experience Passing HTB CJCA: What to Know Before the Junior Cybersecurity Analyst Exam
A cybersecurity professional who recently transitioned careers shares a detailed account of completing the Hack The Box Certified Junior Cybersecurity Analyst certification. The exam combines practical red team and blue team tasks in a lab environment rather than multiple-choice questions. Preparation involved completing the full Junior Cybersecurity Analyst path in HTB Academy, practicing on Easy and Medium machines, and following the SOC Analyst Path on LetsDefend. The five-day exam requires separate passing scores in both offensive and defensive sections, with strong emphasis on professional reporting using SysReptor. Key lessons include maintaining organized notes per host, documenting findings with MITRE ATT&CK mappings, and preparing thoroughly for the second phase of alert triage and incident handling.
OpenAI Rolls Out ChatGPT Integration with Google Chrome for Direct Tab Interaction and Task Automation
OpenAI has introduced a deeper integration between ChatGPT and Google Chrome that allows the AI assistant to access content from open tabs and execute user-directed actions directly within the browser. Home users and corporations can now leverage the tool for tasks such as form filling, file downloads, message sending, and organizing multiple tabs without manually copying information into the chat. The update enables complex workflows, including comparing products across several pages by characteristics, delivery times, and return policies, or analyzing tariffs from multiple services to identify the best match. A sidebar mode in Chrome lets users discuss articles, generate report summaries, or draft emails while staying on the relevant page. Combined with conversation history and connected plugins, the system supports advanced scenarios like extracting receipts from Gmail and transferring data into expense reimbursement forms. OpenAI demonstrated examples where the assistant completes registration forms but pauses before final submission, marking a shift from instructional guidance to direct task execution in active tabs.
Yandex Restores Taxi, Delivery and Mobility Services After Major Infrastructure Outage
Yandex has announced that its core transport and delivery services are once again available to all users following a large-scale infrastructure failure. The affected services include ride-hailing, food and grocery delivery, car-sharing, electric scooters, and smartphone charging stations. Additional platforms such as Lavka, Zapravki, and Transport have also returned to normal operation. Recovery remains gradual, with some Yandex 360 features intentionally disabled to manage load after earlier partial restoration of search, Alice, Maps, and Mail on 11 October. The company is providing free resource usage for Yandex Cloud and Yandex 360 customers in Russian availability zones from 8 to 31 October, with automatic billing adjustments. Director of Strategic Marketing Andrei Sebrant stated that the incident exceeded the severity of a single data-center loss scenario practiced in drills.
Microsoft Expands Android Integration in Windows 11 with Start Menu Notifications and File Explorer Access
Microsoft has outlined plans to integrate Android smartphones more deeply into Windows 11, reducing the need to reach for a physical phone. Messages and notifications from linked Android or iPhone devices will appear directly in the Start menu, while conversations can be opened in resizable separate windows. Quick Settings will include controls to mute the phone or trigger its ringer for locating a lost device. For compatible Android phones, users will be able to run mobile apps in independent windows and browse phone files through File Explorer. A notification will appear on the desktop after taking a photo on the phone, allowing one-click access to the image. The Resume feature will also enable seamless continuation of supported tasks when switching between devices. These enhancements build on the existing Phone Link app but embed the functionality more natively into the Windows interface.
R-Vision SIEM Demonstrates Resilience During Intense Standoff 17 Cyber Defense Exercise
A mixed team from akPots defended the Telecom sector at Standoff 17 using R-Vision SIEM as the central correlation platform while facing more than ten simultaneous red-team groups. The exercise featured nine realized critical events out of 37 planned scenarios, including satellite tracking disruption, IPTV broadcast manipulation, and unlimited eSIM issuance. Team members had to master the SIEM in real time rather than through pre-loaded logs, relying on raw search, custom dashboards, and grouping features to cut through massive alert volumes. Additional tools such as PT Application Firewall, PT NAD, PT Sandbox, and PT Container Security provided visibility into network traffic, file behavior, and Kubernetes environments. The team organized work through dedicated chat threads, a shared living document for IOCs, and a captain role to balance workload across distributed participants. Feedback highlighted the need for one-click widget-to-raw-event navigation, vendor-supplied detection scenarios, and nested grouping to improve future investigations.
Avanpost Launches Identity Cloud Service, CURATOR Becomes First Partner
Avanpost has begun commercial operation of its Identity Cloud platform, a subscription-based service for multi-factor authentication and single sign-on aimed at employees and contractors. The service removes the need for heavy on-premises IAM deployments by allowing organizations to adopt cloud identity protection through flexible subscription plans. CURATOR became the first partner to roll out the platform, offering it under the CURATOR.IDENTITY brand. Four tariff tiers are available, ranging from basic Start to the upcoming Zero Trust package that includes device verification and continuous trust assessment. Each customer receives an isolated environment with its own database, while Access Bridge keeps infrastructure secrets on-premises and supports offline authentication during connectivity loss. Partners can either resell the Avanpost service or deploy the platform in their own infrastructure and sell it under their own branding.
Microsoft 365 Admin Tool Exposes Pitfalls in Graph, Exchange PowerShell and Intune Management
An open-source developer has released version 2.0 of SwissKnife for MS Graph, a tool that adds a safe preview-and-apply layer on top of Microsoft 365 administration. The project addresses the lack of a native what-if mode in Microsoft Graph and the incomplete coverage of Exchange tasks in the Graph API. It implements a two-step plan-and-apply workflow, supports fallback to Exchange Online PowerShell or the Admin API, and runs community scripts under strict constraints. The author details multiple real-world obstacles including named-location ID drift in Conditional Access policies, masked secrets returned by Intune, and limitations when restoring Transport Rules from snapshots. The tool also provides a worker mode for macOS and Linux users and enforces script signing plus AST-based command whitelisting. Feedback is requested on error messages and tasks that still require manual PowerShell use.
Neuromorphic Processors Lag Behind GPUs for Large AI Models Despite Energy Advantages
Neuromorphic chips such as Intel Loihi promise major energy savings by activating only when events occur, yet data centers remain dominated by GPUs optimized for dense matrix operations in generative AI. The mismatch arises because modern large language models rely on high-precision linear algebra, massive memory bandwidth, and mature software stacks that neuromorphic architectures currently lack. Researchers are exploring spiking transformers and on-chip plasticity via mechanisms like STDP, but scaling to billions of parameters remains challenging. Companies including BrainChip, SynSense, and SpiNNaker2 have released commercial neuromorphic hardware, yet the absence of standardized tools and clear performance gains for mainstream workloads slows adoption. Hybrid approaches combining neuromorphic blocks with in-memory computing, analog circuits, and photonic accelerators may define future heterogeneous systems rather than outright replacement of GPUs.
Russia Expands Digital Birth Certificates via MAX App for Transport, Healthcare and Public Services
The Russian government has broadened the list of situations where parents can use the electronic version of a child’s birth certificate stored in the Digital ID section of the MAX service. The digital document can now be presented when buying transport tickets, claiming free or discounted travel, boarding public transport, receiving medical care under OMS, visiting MFC offices, museums, cultural and sports events, and purchasing discounted tickets. The measure also covers any other services requiring proof of a minor’s identity. Use of the QR code remains voluntary, and the paper certificate continues to be valid. The service activates gradually as organizations connect their systems, with more than 3,000 hotels already integrated.
PT AF Cloud Uses Machine Learning to Detect Shifts in Web Attack Patterns from Millions of WAF Events
Positive Technologies has detailed how its PT AF Cloud service applies anomaly detection to WAF events, turning tens of millions of daily security events into actionable weekly alerts for SOC teams. The system builds traffic profiles based on the distribution of triggered protection rules for each tenant and compares current hourly or daily profiles against a weighted historical baseline using Jensen-Shannon distance. This approach identifies meaningful changes in attack composition even when overall event volume remains stable, catching the start of scans, exploitation of newly published vulnerabilities, or post-release application changes that trigger new rules. Two detection modes operate in parallel: an hourly mode for rapid spikes and a daily mode for gradual shifts distributed across multiple hours. Alerts include comparative tables of top rules, unique attack vectors, and direct links to the relevant events in the PT AF interface. Over four weeks the detector surfaced roughly 1,100 anomalies across the cloud, with expert review confirming that 69 percent indicated either an attack or a protection misconfiguration.
How to Prepare Your Website for Data Center Outages: Business Resilience Checklist
Following strikes on Yandex data centers, many businesses discovered that their sites and all backups were stored in a single location, leading to complete outages. The article provides a detailed checklist to mitigate such risks by separating critical components across different providers. Key recommendations include moving DNS to an independent provider, lowering TTL values, maintaining a live mirror site on separate hosting, and isolating corporate email. Additional steps cover local backups, monitoring, access management, and CDN usage. The guidance differentiates between virtual hosting, VPS or dedicated servers, and website builders like Tilda, while emphasizing compliance with Russian data localization laws such as 152-FZ.
How to Properly Compare CDNs: TTFB, p95 Latency, Caching, DDoS Protection and True Pricing
Selecting a CDN based solely on the number of points of presence is as unreliable as choosing a car by dashboard buttons. Networks with dozens of global PoPs may underperform for audiences concentrated in Novosibirsk or Yekaterinburg, while smaller regional providers often deliver superior peering with Russian operators. The article evaluates CDNVideo, EdgeCenter, Curator, NGENIX and Yandex Cloud CDN across verifiable features, network design, caching behavior, security controls, operations and commercial models. Performance data is separated because marketing claims cannot substitute for independent measurements from services such as CDNMON. Emphasis is placed on p95 metrics, cache hit ratios, origin shielding, raw logs and API limits rather than marketing scores. The analysis shows that no single universal ranking exists; optimal choice depends on traffic profile, audience geography, security requirements and operational workflows.
Innostage Lab Benchmarks PT NGFW 1.10.3 Performance in Eight Load Scenarios
Innostage researchers conducted extensive performance testing of PT NGFW version 1.10.3, the certified release at the time of trials. The evaluation covered TCP connection setup rates, concurrent session capacity, and throughput on a custom EMIX traffic profile with varying security modules enabled. Tests used Cisco TRex generators and a high-rule-count policy of 100,000 entries to simulate realistic enterprise conditions. Results showed the device sustaining 700,000 CPS and 6.4 million concurrent connections, matching or approaching vendor claims under HA-cluster configuration. Throughput remained above 27 Gbps even with IPS, application control, antivirus, NAT, URL filtering, and logging active. The report highlights differences in test methodology compared with vendor figures, including packet sizes and clustering setup.
Java Card Tutorial: Implementing Supplementary Security Domain to Limit ISD Privileges
A detailed technical guide demonstrates how to create a Supplementary Security Domain (SSD) on Java Card platforms to isolate applet management from the Issuer Security Domain (ISD). The approach prevents full card compromise if ISD keys are exposed by restricting SSD privileges to specific functions such as accepting extradition only from the ISD. Using the FunGP library and SCP02 protocol, the tutorial walks through installation, personalization with encrypted keys, and extradition of applets under the new domain. GlobalPlatform specifications including GP CS v2.3 and GP CIC v2.0 are followed for install parameters, privileges, and STORE DATA commands. After personalization the SSD reaches the PERSONALIZED lifecycle state, allowing secure delegation of applet control while the ISD retains overall card management rights. The method eliminates the need for custom operating systems and provides a standards-compliant way to enforce least-privilege access on smart cards.
Linus Torvalds Embraces Generative AI for Coding After Initial Skepticism
Linus Torvalds has publicly shared his evolving views on generative AI tools for programming during the Open Source Summit Europe. The Linux creator noted that AI assistance makes small personal projects more enjoyable by accelerating the path from idea to working result. He described using an AI model to modernize the outdated C-based user interface of a custom guitar pedal project. Initial AI output proved unusable until Torvalds supplied the existing implementation and clear instructions on required changes. Torvalds emphasized that AI helps newcomers achieve tangible outcomes that feel meaningful compared to professional-grade software. At the same time he urged caution when applying these tools to serious kernel development work. He also highlighted the growing burden on maintainers who must review increasing volumes of low-quality, AI-generated vulnerability reports and superficial patches.
Hacker or Engineer? Reconstructing Attack Chains in Industrial OT Networks
Positive Technologies expert Anton Kutepov presents a detailed educational scenario from the Standoff online polygon to demonstrate how security teams can trace an attack from initial perimeter compromise to unauthorized writes on a PLC. The case begins with an unexpected SCADA server command to a hydrocracking unit controller outside the maintenance window. By correlating network traffic, endpoint telemetry, authentication logs, and asset context, analysts reconstruct the full path: exploitation of a vulnerable DMZ system, lateral movement via Kerberoasting and Active Directory certificate abuse, RDP access to an engineering workstation, and finally weakening of Windows Defender on the SCADA server before issuing the control command. The analysis shows that a single permitted industrial protocol operation becomes suspicious only when placed in the context of prior defensive control changes and anomalous access routes. The article stresses that protecting OT environments requires continuous asset inventory, unified telemetry from traffic and endpoints, and pre-approved response playbooks that avoid disrupting the physical process.
Russia Sets 2030 Deadline to Deliver LTE Internet to Small Settlements
The Russian Ministry of Digital Development has outlined a timeline to provide mobile LTE internet access to small settlements with populations between 100 and 1,000 people by the end of 2030. Minister Maksut Shadaev stated in the State Duma that the next major milestone involves connecting an additional 1,800 settlements by 2027. Over the past six years, LTE service has already reached more than 8,000 such localities through the ongoing federal program. The initiative focuses on building the necessary mobile infrastructure rather than guaranteeing signal coverage at every geographic point. Residents in these areas are expected to gain reliable access to standard digital services without needing to search for optimal signal locations. Progress will be measured by actual deployed infrastructure and operational connectivity at the 2027 checkpoint.
Russian Woman Fined 15,000 Rubles for ChatGPT-Generated Bear Image That Sparked Police Hunt
A resident of Magdagachi in Russia's Amur region used ChatGPT to add a bear to a photo of Krasnoarmeyskaya street as a prank on her friend. The realistic image spread through messengers, prompting residents to alert police and sending hunters with equipment to search for the nonexistent animal. The incident reached the district head, causing widespread fear, with one local resident too afraid to leave home or visit the store. The woman later confessed to police that the image was AI-generated, admitted guilt in court under part 9 of article 13.15 of the Russian Code of Administrative Offenses, and received a reduced fine of 15,000 rubles due to her remorse and first offense. Her iPhone 15 was not confiscated after she explained its necessity for work. This marks the second similar case involving AI-generated bears, following a 30,000-ruble fine and iPhone 11 confiscation in Duldurga, Zabaykalye region, in September.
Molniya Messenger Debuts in RuStore as Paid Alternative with End-to-End Encryption
Russian company Red Soft and Chinese partner Passion Tech have released the Molniya messenger on the RuStore platform. The Android application requires a one-time payment of 750 rubles with no additional in-app purchases. Key features include personal and group chats, audio and video calls, channels, a social feed, and short videos, all protected by default end-to-end encryption. Users can send files up to 4 GB, organize up to 30 chat folders, pin 15 conversations or channels, and subscribe to as many as 1,000 channels. The developers aim to reach 15 million users within 18 months after launch. The project was originally scheduled for early 2026 but became available earlier than planned.
Enthusiasts Bring Xbox Cloud Gaming and Native Windows Titles to PlayStation 5 via Homebrew
Homebrew developers have created two separate projects that expand the capabilities of modified PlayStation 5 consoles. The first project, PSBox Cloud Gaming by RafaelNGP, turns the console into a client for Microsoft’s Xbox Cloud Gaming service, streaming games at 1080p and 60 frames per second while supporting full DualSense features. The second project, prospero-win, uses Wine and compatibility layers to run Windows games locally on the PS5 hardware. Reported performance includes Half-Life 2 at high settings and 60 FPS, GTA IV at approximately 55 FPS in open-world areas at 1080p, and older titles such as Counter-Strike 1.6 and Warcraft III exceeding 60 FPS. Both projects require a console capable of running unofficial software and, for cloud gaming, a Game Pass Ultimate subscription for most of the library. The work remains experimental and depends on individual game compatibility.
Yandex Data Center Attacks Trigger Outages, Cloud Disruptions and Stock Decline
A series of physical attacks has disabled or partially damaged multiple Yandex data centers in Russia, leading to prolonged service outages across cloud and consumer platforms. Fires and power failures struck facilities in Sasovo, Kaluga and Vladimir between 8 and 11 October, forcing the company to shift workloads to the remaining Mytishchi site. Analysts from Finam, Rikom-Trust and Freedom Global note that recovery timelines now stretch from several months to two years for specialized hardware such as supercomputers. The incidents have already erased nearly 9 percent of Yandex share value and raised concerns over future capital expenditure, client retention in Yandex Cloud and potential sanctions complications for overseas expansion. Experts emphasize that the attacks have moved from isolated technical failures to a systemic business-continuity and investment-risk issue.
Cyber Attack on Danfoss Systems Forces Defrost in 250 French Supermarkets, Spoiling Stock
Hackers compromised refrigeration control systems supplied by Danfoss in French supermarket chains Intermarché and Coopérative U, activating continuous defrost cycles that raised temperatures to 50 °C. The sabotage affected between 150 and 200 Intermarché stores and nearly 100 Coopérative U locations, forcing retailers to discard large quantities of fresh and frozen goods. French authorities confirmed the incidents, with the Paris prosecutor’s office opening an investigation after reports of associated fires. The attackers exploited the normal maintenance function of the Danfoss equipment, turning brief defrost cycles into prolonged warming that broke the cold chain. Coopérative U chairman Dominique Schelcher described the event as unprecedented and stated that technical teams are working with refrigeration specialists to restore operations. No group has claimed responsibility, and investigators continue to examine the initial access vector. The incident illustrates how manipulation of industrial control systems can produce immediate physical and financial damage without traditional data theft or encryption.
Yandex Cloud Cascade Failure October 2026 Exposes Multi-AZ Limits and Capacity Exhaustion Risks
In October 2026, Yandex Cloud suffered a prolonged cascade outage across multiple data centers in Sасово, Калуга, and Владимир, triggered by power failures and a drone-related fire that fully disabled the ru-central1-b zone. The incident revealed that standard Multi-AZ designs reach physical capacity exhaustion when multiple zones fail simultaneously, leaving insufficient resources in remaining zones for automatic failover. Businesses relying on managed Kubernetes, databases, and SaaS platforms such as Salebot and CIAN experienced extended recovery times, with backups becoming inaccessible and RTO stretching beyond 24 hours due to index rebuilds and manual quota allocation. Yandex Cloud responded by manually distributing quotas, partnering with Selectel, K2Cloud, and VK Cloud for emergency capacity, and advising clients to activate external disaster recovery plans. The outage also highlighted single points of failure in DDoS protection configurations and Control Plane dependencies that prevented timely migration of master nodes. Architectural recommendations include deploying independent edge webhook buffers using FastAPI on separate VDS instances to preserve incoming events during primary backend failures. Overall, the events underscore the necessity of true multi-cloud strategies that avoid reliance on any single provider's IAM, billing, and physical infrastructure.
Passkeys in Production: How One Developer Replaced Passwords with Face ID in Three Days Using FastAPI and Next.js
Yaroslav Morozov details a complete production implementation of Passkeys based on the WebAuthn standard and FIDO2 protocols. The article explains why Passkeys eliminate phishing and database breach risks compared to traditional passwords while providing biometric login via Face ID or Touch ID. It covers database schema design with PostgreSQL tables for credentials and challenges, SQLAlchemy models, and minimal dependencies including py-webauthn on the backend and SimpleWebAuthn on the frontend. Full working code for registration and authentication flows is provided, showing how Passkeys integrate with existing JWT token systems without major refactoring. The guide includes environment configuration, error handling, challenge management with five-minute TTL, and security considerations such as sign count verification to detect cloned keys.
Yandex Disk Files Become Partially Inaccessible After Sasovo Data Center Incident
A detailed user report reveals that approximately one percent of files stored on Yandex Disk are currently unavailable for download following reported incidents at the Sasovo data center. The problems manifest in three distinct states: missing thumbnails with downloadable originals, visible thumbnails with inaccessible originals returning 504 Gateway Time-out errors, and cases where both thumbnails and originals fail to load. Technical analysis using curl requests traced the failures to specific storage nodes such as s418klg.storage.yandex.net, indicating that some data shards may reside in affected infrastructure while others remain operational. Yandex support requested original files for diagnosis but closed the ticket without providing an official explanation or confirming data integrity. The author emphasizes that the issue affects files across both the Photos and Files sections and recommends maintaining offline backups due to the lack of guaranteed availability during data center failures.
Keurig K-Supreme Smart Coffee Maker Generates Nearly 1 TB of Outbound Traffic in Ten Days
A Keurig K-Supreme Smart coffee maker unexpectedly produced around 1008 GB of outgoing traffic over ten days, overwhelming a home UniFi access point while generating only 9.94 GB of inbound data. The device had been placed on a separate network segment, yet the traffic remained largely internal to the home LAN rather than traversing the internet connection. The anomaly was discovered by user Nomad while assisting family members with network maintenance through the UniFi dashboard. After the coffee maker was powered off, the issue could not be reproduced in subsequent testing, and no packet captures were available to determine the content or root cause of the traffic. The model requires internet connectivity for remote control, scheduling, capsule recognition, and automatic reordering of coffee supplies. No similar incidents have been reported by other users, and the manufacturer has not issued any statement regarding the event.
Hash Functions Part 1: Core Properties, Security Requirements and Practical Applications
The article provides a detailed introduction to hash functions, explaining how they map arbitrary-length input to fixed-length output while satisfying three fundamental security properties. It covers preimage resistance, second preimage resistance, and collision resistance, along with the avalanche effect that makes even minor input changes produce unrecognizable output. The text explains why a 256-bit digest is required to achieve 128-bit collision resistance, referencing the birthday paradox and its implications for MD5 and SHA-1. Practical guidance includes using OpenSSL for hashing, applying hashes in commitment schemes, enforcing subresource integrity on web pages, and securely storing passwords with Argon2 and bcrypt. The post emphasizes that hash functions alone do not guarantee integrity without proper transmission of the digest and announces a follow-up on SHA-2 and SHA-3 internals.
Digital Twins Enable Pre-Deployment Testing and Post-Change Control in Complex Multi-Vendor Networks
UserGate and Hadal Project experts presented a joint approach at Saint HighLoad++ that combines physical labs, emulation, and simulation into a single lifecycle for validating network changes. The method addresses recurring failures such as IPsec tunnel outages after routine software updates that pass vendor checks yet break branch connectivity. Three complexity sources—multi-vendor environments, historical configuration debt, and continuous dynamic updates—are mitigated by maintaining an always-current network model. Physical laboratories provide hardware-level accuracy for critical devices, while uInfraTwin emulation allows rapid, repeatable testing of configuration scenarios with traffic generators. Simulation tools including Batfish, Hadal, Forward Networks, and IP Fabric deliver end-to-end reachability analysis across tens of thousands of nodes without sending test traffic on production networks. The integrated digital twin continuously updates from live infrastructure, feeds selected segments into safe test environments, and verifies policy compliance after deployment.
Positive Technologies Releases MaxPatrol SIEM 28.0 with Major Resource Optimizations and AI Enhancements
Positive Technologies has launched MaxPatrol SIEM 28.0, enabling security operations centers to process significantly more security events without requiring additional hardware. Internal tests show the new version consumes up to 26% less CPU and 52% less RAM compared to the previous release. Optimized components for event processing and data storage now allow the system to handle 40,000 events per second instead of 20,000 on comparable servers. The architecture has been refined so that unnecessary roles can be omitted when MaxPatrol SIEM operates independently from other platform products such as MaxPatrol VM. The behavioral analysis module MaxPatrol BAD received the new HackTracker component, which detects attackers by behavior patterns rather than only by tools, and now supports Unix event analysis with linked activity chains. The PT Naira AI assistant has been simplified for easier configuration, helping analysts write normalization rules, explain events, and search documentation, with claims of reducing investigation time by up to 50% and rule creation effort by up to 90%. Analysts also benefit from added context in correlation rule cards, quick navigation links, and a native dark theme.
macOS User Investigates Claude Regional Block via Logs and Restores Work Site Access with Targeted WireGuard Routes
A detailed case study describes how a macOS user analyzed Claude application logs after experiencing regional unavailability errors while using WireGuard VPN. The investigation covered ~/Library/Logs/Claude/ files containing markers like app-unavailable-in-region and region_unavailable, cross-referenced with tunnel activity dates from August to October 2026. No direct evidence linked the VPN to the account block, as tunnel logs were overwritten and system journals returned Operation not permitted errors. The user then addressed a secondary issue where WireGuard blocked access to work services including amoCRM, TGBooster, and Geekjob. Custom host routes were added via route add commands to direct specific IPv4 addresses through the local gateway while keeping Claude traffic in the tunnel. A launchd-based PF kill switch was tested for tunnel failure protection but caused a full internet outage on October 5 due to anchor and hook conflicts, leading to its rollback. By October 8, work sites functioned under VPN with verified routes, though persistent kill switch protection remained unresolved.
Publishing Internal APIs from DMZ Without Direct LAN Connections: Five Tested Architectures
When an API gateway resides in the DMZ but security policies forbid outbound connections into the LAN, organizations must adopt alternative patterns to expose internal services synchronously. The article examines five production-ready approaches built on the NEOMSA APIM platform, ranging from custom request-reply logic over Kafka to zero-code solutions using ActiveMQ Artemis and experimental reverse HTTP in HAProxy. Each pattern is evaluated against criteria such as the need for DMZ-to-LAN firewall rules, volume of custom code, support for streaming responses, and measured performance. Load tests on the Artemis-based bridge reached 50 requests per second with a 95th percentile latency of approximately 100 ms, while the Kafka implementation required roughly 2,500 lines of Java to emulate missing reply semantics. The analysis highlights trade-offs in operational complexity, vendor support implications, and security posture, particularly the benefit of preventing any outbound initiation from the DMZ.
FSB in Chelyabinsk Region Proposes QR-Code Passports for Tracking Construction Materials to Combat Theft
The regional branch of Russia's Federal Security Service in Chelyabinsk has suggested introducing an electronic tracking system for construction materials using unique QR codes assigned to each batch. The initiative aims to reduce theft and fraud during the construction of social facilities by creating a verifiable digital record of material movement from supplier to site. According to official representative Tatyana Sosnina, the system would allow real-time comparison between ordered quantities, project documentation, and actual usage on site. This approach is expected to help customers and oversight bodies quickly identify discrepancies between procurement records and physical consumption. The proposal does not yet include any announced timelines or estimated implementation costs. Experts note that the effectiveness of such QR-based tracking will ultimately depend on the accuracy of data entry at every stage of the supply chain rather than on the codes themselves.
Russian Internet Services Hit by Outages After Drone Attack on Yandex Data Center in Sasovo
On October 8, multiple Russian websites and internal corporate systems experienced significant disruptions. Users reported issues accessing media outlets, transport services, and marketplaces, with many problems affecting internal company tools and professional platforms. Cian linked its website and app outage to an infrastructure partner incident, while developers A101, Granel, and Brusnika also faced temporary unavailability. T-Bank reported problems with its corporate messenger and email distributions, and similar internal system issues appeared at Ozon, Wildberries, and HSE. Astral warned of possible delays in electronic reporting and document management services. Yandex confirmed a fire at its Sasovo data center in Ryazan region following a drone attack, with no casualties but full shutdown of the facility. Experts note that not all complaints can be attributed to a single event due to varying scales of impact across companies.
Tools Alone Won't Suffice: Building Systemic Kubernetes Security Across Hundreds of Clusters at Alfa-Bank
Alexander, lead of the K8S and cloud security department at Alfa-Bank, explains how the bank moved from fragmented tools and ad-hoc practices to a comprehensive process-driven security function covering more than 500 Kubernetes clusters. The approach centers on a threat lifecycle model that includes threat modeling, requirements definition, project expertise, auditing, risk assessment, platform operations, and SOC integration. A RACI matrix formalizes responsibilities across security, DevOps, AppSec Business Partners, and IT teams to ensure consistent execution at scale. Four specialized roles—an architect, analyst-engineer, auditor, and platform DevOps engineer—handle the workload that no single individual could manage. The bank emphasizes that commercial scanners and policies deliver value only when embedded in repeatable processes tied to a living threat model and clear accountability.
Luna Decisions Integration with n8n for Real Estate Listing Parsing: Workflow Architecture, Limitations and Open Questions
A detailed technical discussion explores the use of n8n workflows to monitor real estate advertisements by combining scheduled data collection, normalization, and comparison logic with potential AI-driven decision layers. The article examines the boundary between raw parsing and actionable decisions, highlighting how simple code-based event detection can be augmented by structured outputs from models such as OpenAI GPT-6 Luna Decisions. Key components include a Dispatcher node that identifies new listings, price drops, and removals, while storing state in Google Sheets and generating Telegram summaries. Limitations around data completeness, currency conversion, and false positives for sold status are analyzed in depth. The author proposes an experimental branch that routes validated price-change events to Luna Decisions API for typed scoring before any human notification. Overall the piece invites community feedback on whether a dedicated Decisions API provides measurable advantages over rule-based conditions or standard structured LLM outputs.
Bureau 1440 Unveils Satellite Internet Terminals Reaching 700 Mbps for Industrial and Rail Use
Bureau 1440 presented three satellite terminal models at the Digital Solutions forum in Russia. The 1440 ULTRA model supports data speeds up to 700 Mbps and is designed for remote industrial sites and infrastructure, operating both stationary and in motion. The company reduced the terminal's weight by 30 percent while maintaining 600 by 600 mm dimensions and adding IP67 dust and water protection. The 1440 ZEMLYA variant is already undergoing tests on Russian Railways trains, including Lastochka and Sapsan services, and is rated for operation at speeds up to 400 km/h. A compact 1440 MINI concept aims for around 100 Mbps in a 300 by 300 mm portable form factor intended for rescue teams and expeditions. All models are being developed alongside the company's low-orbit satellite constellation, with test connections already active on rail lines and in remote settlements. Sales have not yet begun, and the company will announce availability separately while noting that maximum speeds are not guaranteed in every environment.
GTA V Unofficial Browser Port Runs Locally via WebAssembly Using Leaked Rockstar Sources
Enthusiasts created an unofficial port of GTA V that executes the game directly in the browser through WebAssembly without any cloud streaming. The project compiled the original RAGE engine to wasm64 and built a compatibility layer translating DirectX 11 calls to WebGPU. Game assets were served over HTTP while JavaScript handled input and saves, and AudioWorklet managed audio. The port retained Euphoria physics and Scaleform interfaces but removed Bink video playback. Requirements ranged from 3 to 16 GB of RAM, supporting both story mode and free roam. The site was taken offline shortly after launch, first displaying a thank-you message and later redirecting to adult content. Analysis of the build confirmed debug symbols and developer file paths consistent with leaked Rockstar source code.
PKI Storm: Managing 100,000 Simultaneous Certificate Requests in Kubernetes Recovery Scenarios
A large organization's PKI infrastructure faced a critical bottleneck when a data center outage triggered simultaneous startup of tens of thousands of Kubernetes pods, each requiring mTLS certificates. The existing setup using ESAUS and Citadel routed all requests through external certificate authorities that could only sustain 50-70 RPS against an incoming burst of 100,000 requests. Average daily load of 10-11 RPS had masked the thundering herd risk during mass recovery. Scaling the CA 15x was rejected due to cost and the fundamental dependency on real-time signing. The team introduced pre-issuance of certificates stored in a dedicated Unified Secret Storage (ЕХС) layer that supports 14,000 RPS reads while the CA continues normal operation. This architectural separation of issuance and consumption reduced recovery time from nearly 24 minutes to seconds while shifting focus to secure secret lifecycle management including KRA key protection.
MinTsifry Considers Annual 10 Billion Rubles Support Package for Russian AI Development
Russia's Ministry of Digital Development is discussing a state support package worth up to 10 billion rubles per year aimed at local AI developers. The proposed funding would cover technology development, pilot launches, and compensation for computing resources. According to Kommersant, 8 billion rubles are planned for development and implementation while 2 billion would offset computational costs. Mechanisms under consideration include subsidized loans through authorized banks and grants covering up to 80 percent of pilot project costs in priority sectors. The initiative remains in discussion with no final parameters or launch timelines confirmed yet. Industry experts note that clear selection criteria and transparent reporting will be essential to prevent intermediaries and ensure fair access for independent teams.
Indid Reports Russian Identity Security Market Reaches 17 Billion Rubles Amid High Incident Rates
According to Indid, the Russian Identity Security market reached 17 billion rubles by the end of 2025. The assessment highlights that organizations continue to allocate significant budgets to access protection while account-related problems persist. Survey data shows that 87.5 percent of companies experienced incidents involving user accounts and access rights during the period. Identity Security solutions focus on managing digital identities, controlling permissions, and preventing unauthorized access across corporate systems. The findings indicate ongoing challenges in maintaining secure access despite growing investments in specialized tools and platforms.
How a Node.js Bridge Connects MAX and VK Messengers to Chatwoot with Secure Bidirectional Sync
A detailed technical case study describes building a lightweight Node.js service that links the MAX messenger and VK communities to Chatwoot without scraping or using personal accounts. The bridge uses official bot APIs and community callbacks, separate API inboxes, and persistent state stored in a Docker volume to maintain conversation mappings across restarts. Security measures include webhook secret validation, deduplication of events using ring buffers, SSRF protections when handling images, and strict filtering to prevent loops or private notes from leaking externally. The implementation covers contact and conversation creation via Chatwoot Application API, image transfer for VK, and graceful recovery after partial failures. Limitations such as lack of exactly-once delivery and absence of a durable queue are acknowledged, with recommendations for production use including SQLite, retries, and structured logging. The author provides configuration examples, health checks, and a capability matrix showing current support for text and media in each direction.
NtechLab AI Video Analytics Helps Locate 250 Missing Children in Novosibirsk Region
NtechLab has reported that its generative AI-powered video analytics platform assisted Russian law enforcement in finding 250 missing children in the Novosibirsk region in less than 18 months. The FindFace Multi system operates as part of the Safe City complex and processes live video feeds from cameras installed at transport hubs, streets, squares, and government buildings. Facial recognition capabilities for locating children became available to regional authorities in April 2025. The same technology has also been used to identify more than 3,000 offenders throughout 2025. NtechLab states that its solutions are deployed across more than 70 Russian regions and 34 countries, although the company provided no detailed breakdown of individual cases or average search times. All final decisions and physical searches remain the responsibility of human police officers.
RemoveMacAI Utility Appears on GitHub to Disable Apple Intelligence and Free Disk Space on macOS
A new open-source tool called RemoveMacAI has been released on GitHub, allowing macOS users to fully disable Apple Intelligence features and remove associated AI models from their systems. The utility addresses the lack of a single toggle in macOS 27 for turning off generative AI capabilities while also reclaiming storage space occupied by downloaded models. It supports Apple silicon devices and works by leveraging Apple's own system services rather than directly modifying protected directories. Users can selectively disable components such as Siri, Writing Tools, Genmoji, Image Playground, ChatGPT integration, smart replies, photo cleanup, and Xcode predictive code completion. The tool also installs a configuration profile that prevents models from being redownloaded automatically. Reversion is possible via the removemacai revert command, though this comes at the cost of losing access to certain Apple Intelligence-powered functions in third-party apps and Shortcuts. The project is licensed under MIT and leaves Dictation untouched as it is managed separately.
Secure Personalization of Java Card Applets Using Issuer Security Domain and SCP02
The article explains how to leverage the Issuer Security Domain mechanisms on GlobalPlatform cards to establish secure channels for applet personalization without implementing custom ECDH-based key exchange. It addresses limitations of prior approaches that lacked authentication and required extensive PKI support. The solution uses SCP02 with specific security levels such as C_MAC and C_DECRYPTION to protect commands that store AES-128 keys and personal data on the card. Detailed code walkthroughs cover the applet constructor, process method, mutual authentication via SecureChannel.processSecurity, and unwrap operations for decrypting and verifying APDUs. Practical testing on NXP Java Cards demonstrates installation via FunGP library scripts that allow configurable security levels during mutual authentication. The implementation ensures that secret key updates enforce C_DECRYPTION while personal data writes accept C_MAC, with encrypted reads performed using AES-CBC.
IT Jobs at Major Tech Firms Turn Into Dating Red Flags for Some Women
Working in IT used to be seen as a strong advantage in dating due to high salaries and prestigious employers. However, employees at companies like Palantir and Tesla now report that their jobs trigger uncomfortable conversations about ethics and politics instead of romantic interest. A Palantir engineer named Gary has started hiding his employer after facing sharp reactions from women and even requests from friends to avoid mentioning the company at social events. Tesla employee James encounters questions about his political views simply because of his association with Elon Musk's company. Dating specialist Amy Laurent notes that tech giants face backlash over issues like surveillance, inequality, and AI displacing workers, forcing professionals to present their careers with caveats. The article from Wired highlights how an employer's reputation now overshadows individual values during initial meetings. While IT roles remain attractive in many ways, the automatic boost from big tech brands appears to be fading in personal contexts.
Neuromorphic Chips: Event-Driven Architectures Aim to Cut Energy Use in Always-On AI and Sensor Systems
Modern processors and GPUs excel at massive parallel math yet remain inefficient for continuous sensor streams where little changes most of the time. Neuromorphic chips borrow principles such as local memory, sparse spiking communication and threshold-based activation from biological nervous systems to reduce data movement and idle computation. The approach replaces constant matrix multiplications with asynchronous spikes that propagate only when meaningful events occur, lowering both power and latency for edge devices. Spiking neural networks encode information in the timing and frequency of pulses rather than dense numeric tensors, making them suitable for vibration monitoring, robotic vision and wearable health sensors. Hybrid systems are expected to pair conventional CPUs and NPUs for heavy training workloads with neuromorphic accelerators that stay dormant until events arrive. The architecture does not replace existing accelerators but targets the niche of always-on, battery-constrained perception tasks where conventional von Neumann designs hit the memory wall.
Russia Boosts Digitalization Budget by 58% Using Telecom Operators' Universal Service Fund
The Russian government has significantly increased allocations for digital projects from the universal service reserve funded by telecom operators. In the 2027 draft budget, 16.3 billion rubles are earmarked for digital solutions, up 58% from the previously planned 10.3 billion rubles. The funds will support the national project Data Economy and the state program Information Society, covering state information systems, digital platforms, cloud infrastructure, AI projects, and quantum technologies. The operator contribution rate remains unchanged at 2% of revenue, with no new levies under consideration. Funding for connecting small settlements to the internet stays at 19.3 billion rubles, while allocations from traffic fines for digitalization are being reduced.
GigaChat Creates New Continuation of Gogol's Dead Souls Under Expert Supervision
Sber's GigaChat generative AI model has produced a new version of the second volume of Nikolai Gogol's Dead Souls, which the author himself destroyed in 1852. The project involved training the model on Gogol's writings, letters, drafts, works by his contemporaries, and philosophical and religious texts that may have influenced the writer. Historians, literary scholars, linguists, and engineers guided the process to ensure the creation of original images and meanings rather than recycled phrases. Experts reviewed every fragment of the generated text for authenticity and quality. Illustrations were also produced by an AI model based on the style of Alexander Agin, who illustrated the first volume during Gogol's lifetime. Sber states the goals are to demonstrate AI as a creative and analytical tool in the hands of specialists and to attract younger readers to Russian classics. Vladislav Kreynin noted that the work does not resolve debates about the lost original manuscript.
Why Defending a Company Costs Millions While Attacks Can Succeed for Just Hundreds of Dollars
In the latest episode of Belyaev Podcast, CISO Vyacheslav Kasimov of Tochka Bank and Boris Evdokimov of ASNA pharmacy chain discussed the persistent asymmetry in cybersecurity spending. Attackers increasingly rely on affordable cloud services, automation, and rented infrastructure, while defenders must invest heavily in monitoring, access controls, backups, and skilled teams. The experts stressed that the absence of known breaches does not equal security, as undetected incidents or delayed discovery remain common risks. They advocated shifting from a "no" culture to risk-based decision making that helps business leaders understand potential losses, mitigation costs, and residual risk. The conversation also covered responsible use of AI in SOC operations and the long-term damage caused by loss of customer trust after incidents.
Beeline Offers One Month Free Access to Six Services for Prepaid Customers
Beeline has launched a promotional campaign allowing home users on prepaid plans to try up to six digital services for free over 30 days. The offer, tied to the operator's second annual Cellular Independence Day, runs from October 2 to October 9 and includes services such as Virtual Assistant PRO, unlimited mobile data, internet sharing without speed reduction, custom network name display, 250 GB of cloud storage, and access to over 650,000 e-books and audiobooks. Each selected service activates its own free period starting from the moment of connection and deactivates automatically afterward. Customers already paying for four or more of the listed services will receive 300 bonus rubles for communication instead. The unlimited data option is unavailable in the Chukotka Autonomous Okrug and Norilsk. Activation is handled exclusively through the Beeline mobile app, and users with existing paid subscriptions to any service cannot activate the free trial version of the same service.
Enterprise-Grade Web Protection on a Budget: How Cloud WAF Lowers Barriers for SMBs
A new overview from Reg.cloud explains how cloud-based Web Application Firewalls reduce the cost and complexity of protecting websites, APIs, and web applications for small and medium-sized Russian businesses. According to Positive Technologies data cited in the article, 75% of successful web application attacks in 2025 disrupted organizational operations, while 82% of SMBs faced cyber incidents in the past year. The piece details the differences between traditional on-premises WAF deployments and cloud offerings, emphasizing ready-made protection profiles for CMS platforms, SaaS services, and digital agencies. It outlines a three-stage operational model covering preparation, DNS-based traffic redirection, and ongoing policy tuning that can be handled by existing DevOps or development teams without dedicated security staff. The service currently offers a free tier supporting up to three applications at 50 requests per second, along with seven preconfigured security profiles and dual audit/blocking modes. The article concludes by stressing that WAF remains only one layer and must be combined with patching, access controls, and separate DDoS or anti-bot solutions.
Yandex B2B Tech Integrates Hybrid Full-Text and Vector Search in Single YDB Query
Yandex B2B Tech has added hybrid search to its YDB database, allowing full-text and vector approaches to run together inside one SQL query. The update helps small and medium businesses as well as large corporations locate exact document identifiers while also matching semantic meaning in descriptions, even when wording differs. Full-text search handles precise elements such as policy numbers, codes, and names, whereas vector search identifies conceptual similarity. Results from both methods are merged and ranked within the same transaction, keeping all data inside a single database instance. This removes the need to maintain a separate search engine and vector store or to reconcile information between them. The technology is aimed at chatbots, recommendation systems, and AI assistants that process technical content where both exact codes and human-readable problem descriptions matter equally. Hybrid search is now available in the on-premises YDB 26.3 release and in the cloud-based Managed Service for YDB.
Google Developing Voice-Activated Emergency SOS Feature for Android Devices
Google is working on a voice-activated Emergency SOS function for Android that would allow users to summon help without touching their smartphone. The feature, discovered in the Personal Safety app code by Android Authority, appears to trigger after the user says the word 'Help' three times in sequence. Once activated, the system would automatically determine location, begin emergency video recording, and place a call to emergency services. The current method requires pressing the power button five times, which can be impractical in certain situations. Additional code strings suggest optional voice confirmation with phrases such as 'Say yes to continue' and 'Say cancel to dismiss Emergency SOS'. The function is not yet available to users and may eventually reach non-Pixel devices running the Personal Safety app, though supported languages and models remain undisclosed.
How the Lorenz SZ 42 Teleprinter Cipher Machine Worked: Nazi High Command Encryption and Its 1941 Breakthrough
The Lorenz SZ 42 was a teleprinter attachment used by the German high command for encrypting top-secret communications during World War II, operating on the Vernam cipher principle with twelve wheels generating a keystream. Unlike the portable Enigma, Lorenz integrated directly between teletypes for automatic five-bit ITA2 encryption. British interceptors at Knockholt first encountered its signals in 1940, later named Tunny. A critical operator error on 30 August 1941 allowed cryptanalysts at Bletchley Park to deduce the machine's structure. This led to the development of the Colossus computer in 1944 for automated decryption. The article details the χ, ψ, and μ wheel groups, the stuttering psi mechanism, and Python implementations of ITA2 encoding and XOR operations.
Inside the Fortress: Why Perimeter Security Tools Fall Short and How Microsegmentation Protects Networks Internally
Companies invest heavily in perimeter defenses such as firewalls and intrusion detection systems, yet these measures no longer guarantee safety as attackers increasingly operate from within networks. Traditional L2 domains leave virtual machines unisolated, enabling traffic interception, lateral movement, and malware spread similar to an apartment building with poor soundproofing. Microsegmentation powered by SDN divides VLANs into isolated microsegments down to individual VM ports, enforcing granular policies based on ports, IP addresses, and protocols. This approach implements Zero Trust by placing virtual packet filters directly at VM network interfaces on the hypervisor, independent of guest OS actions. Performance remains high because filtering runs on powerful virtualization servers, and scaling occurs naturally as additional hypervisors absorb new workloads without extra configuration. A real-world case from the oil and gas sector shows one customer creating up to 5,000 new microsegmentation rules per week via open REST API. The technology complements rather than replaces perimeter firewalls, delivering both strict internal controls and operational agility.
Good Bear 1.0 Released: Firefox-Based Browser with Isolated Russian PKI Trust Container
Good Bear 1.0 is a Russian-language browser built on Firefox 156.0 that provides an isolated container for handling Russian PKI certificates without mixing trust contexts or user data with the standard browsing session. The release includes .deb packages for Ubuntu 24.04 LTS amd64 and Windows x64 installers, using Mozilla Public License 2.0 and reproducible build processes from pinned Firefox sources. Instead of globally importing root certificates, the browser performs secondary chain validation only inside a dedicated userContextId container with strict OriginAttributes isolation for caches, storage, and connections. Password autofill and sensitive session data are disabled in the container when separation cannot be guaranteed, and POST requests trigger explicit user choice before reopening in the isolated context. The interface shows both a persistent container marker and a separate RU indicator only when Russian PKI is actively used, along with detailed security panels explaining the trust source. Updates, crash reporting, and automatic MAR mechanisms are intentionally omitted to avoid creating unverified trust chains for the distribution itself.
Survey of 254 Russian Domains Shows 89% DMARC Adoption but Highlights Gaps in Reporting and Subdomain Policies
A manual review of public DNS records across 254 prominent Russian domains from 17 sectors found strong baseline adoption of email authentication mechanisms. MX records appeared in 96.1% of domains, SPF in 93.7%, DMARC in 89.0%, and DKIM records via common selectors in 62.2%. Among domains with DMARC, 40.7% published a reject policy and 42.9% used quarantine, while 16.4% remained at none. Notably, 19% of DMARC-enabled domains lacked any rua address for aggregate reports, including 33 domains enforcing reject or quarantine. The study also identified cases of inconsistent policies between parent domains and subdomains, as well as SPF records ending in ~all paired with strict DMARC settings. Researchers emphasized that DNS data alone cannot confirm actual mail flow alignment or report consumption.
Server Outage Halts Vehicle Registration Across Smolensk Region
A technical failure on a unified server has temporarily suspended vehicle registration services in the Smolensk region of Russia. The outage affects the interdistrict traffic police department No.1 located on Lavochkina street, preventing new registrations from being processed. Regional UMVD officials confirmed that the problem impacts the single server used for the entire oblast's registration system. According to department head Maxim Zykov, the disruption is considered temporary, though no precise restoration timeline was provided. Applicants who submitted requests through the Gosuslugi portal will receive services in the first working days after the system is restored. The UMVD plans to issue an additional announcement once operations resume.
Pivoting in Legacy Hell: Navigating MIPS Servers, BusyBox, and 2014 Kernels During Internal Network Assessments
The article details a complete methodology for pivoting from an initial SSH compromise on an old Debian MIPS server to reach a hidden web admin panel inside a segmented network. It covers environment enumeration with commands like uname -a and ip route, followed by setting up a Chisel-based SOCKS5 proxy when standard SSH dynamic forwarding is disabled by server configuration. Scanning proceeds via proxychains with nmap using -sT, -Pn, and -n flags or by deploying static MIPS binaries directly on the host. Traffic is then routed through Burp Suite chained to the SOCKS proxy for password guessing against the web interface. The piece emphasizes practical constraints such as BusyBox limitations, kernel version incompatibilities with modern binaries, and the need for careful subnet identification. Readers are directed to replicate the full chain in the Forgotten Server task from the free White Hacker Profession course.
Neuromorphic Processors Deliver Reflex-Like Responses for Robots, Drones and Edge Sensors
Neuromorphic chips are optimized for sparse, event-driven data rather than dense matrix operations, making them ideal for always-on peripheral devices that must react instantly while conserving power. The technology pairs naturally with event cameras and temporal sensors in robotics, drones, automotive systems, medical wearables, industrial monitoring and space applications. Platforms such as Intel Loihi 2, BrainChip Akida, SynSense Speck and SpiNNaker2 already demonstrate working prototypes that activate only on meaningful changes in the input stream. Researchers at TU Delft have flown autonomous drones using spiking networks on Loihi, while NASA has tested radiation-tolerant neuromorphic designs for onboard decision making. The approach complements rather than replaces GPUs and NPUs, creating hybrid systems where the neuromorphic layer handles fast reflexes and conventional accelerators manage complex models.
K2 Cloud Adds Native OVN Traffic Mirroring for NTA/NDR Deployment in Public Cloud
K2 Cloud has implemented traffic mirroring for virtual machine interfaces inside overlay networks built on OVN, solving a long-standing gap that prevented NTA/NDR systems from operating in Russian public clouds. The company contributed the feature upstream, and the patch was accepted into the main OVN codebase. The solution supports source, destination, and mirroring session objects together with optional match/action filters that eliminate duplicate packets, reduce load on sensors, and allow traffic distribution across multiple analyzers. Testing with Positive Technologies PT NAD showed sustained throughput above 3 Gbit/s with approximately 400 000 packets per second and minimal packet loss. The feature works inside a single availability zone; multi-AZ deployments require one PT NAD sensor per zone. Management is available through the web console, an EC2-compatible API, and the official Terraform provider.
Bitrix24 Introduces Cowork/Code AI Agent for Corporate Task Automation and App Building
Bitrix24 has launched Cowork/Code, an AI application that combines file management, company data access, and application development inside a controlled corporate environment. The tool features an AI agent capable of executing multi-step workflows such as locating records, comparing documents, generating tables, and saving results to shared folders. It operates in two modes: Cowork for one-time tasks like overdue task reports or client preparation, and Code for creating reusable tools such as dashboards or notification bots. A memory technology called Radiant stores context from chats, tasks, meetings, and employee data to deliver more accurate, personalized responses over time. The platform addresses common risks of vibe coding by keeping code, data access, and distribution within the Bitrix24 ecosystem hosted on Russian infrastructure. A free tier provides limited usage, with paid plans required for sustained team operation.
Klark and Klara Launch Self-Hosted Corporate Messenger and Task Manager for On-Premise Data Control
Klark and Klara are two integrated products designed to keep corporate communication and task management entirely within company infrastructure. Klark functions as a Telegram-like messenger with personal chats, supergroups, channels, voice messages, file sharing, and video calls powered by LiveKit. Klara serves as a streamlined task and knowledge base system replacing complex setups like Jira and Confluence. Both run via Docker Compose on customer servers using PostgreSQL, Redis, FastAPI, and React, with built-in antivirus scanning via ClamAV. Key security measures include mandatory TOTP two-factor authentication, LDAP integration, content security policies, and automatic session invalidation on token reuse. The combination allows direct task creation from chat messages and displays tasks alongside conversations in a unified interface.
Russia's Taxi Market Overrun by Illegal Drivers Using Fake Accounts and Gray Intermediaries
Russian taxi aggregators are increasingly relying on complex chains of intermediaries that allow drivers without proper licenses, experience, or even Russian permits to operate. These gray schemes involve dispatch services, car fleets, individual entrepreneurs, and so-called podklyuchashki that sell ready-made accounts for 3-7 thousand rubles after minimal verification. A high-profile incident in Odintsovo exposed how a driver refusing service to a disabled veteran of the special military operation was later deported, revealing a corporate maze where the vehicle, the connecting IP, and the driver had no direct link to the aggregator. Official data shows over 900,000 vehicles registered in the FGIS Taxi system, yet more than 1.5 million drivers may be operating outside legal requirements. With Russians taking around 10 million taxi trips daily, the lack of accountability has contributed to over 3,100 accidents involving taxis in 2025, resulting in 143 deaths and more than 3,800 injuries. Courts remain inconsistent in assigning liability across aggregators, fleets, and individual drivers. Experts are calling for aggregators to be designated as carriers with mandatory checks and joint liability.
Russians Offered Unofficial 5G Activation on iPhone for 399 Rubles with No Guarantees
A Russian service called 5G First is selling a tool that removes Apple's 5G restrictions on iPhones for 399 rubles without requiring a jailbreak. The method works by modifying carrier profile settings that control which network features are permitted for a given SIM card. A free alternative named CarrierSIM achieves the same result by forcing the device to adopt the Vodafone Hungary carrier profile where 5G is already enabled. Both solutions are described as experimental, depend on specific iOS versions, operators and SIM cards, and offer no assurance they will survive future system updates. The Ministry of Digital Development is already in discussions with Apple about enabling 5G officially on Russian iPhones. Successful activation of the 5G menu option does not create network coverage where Russian operators have not yet deployed it.
CryptoLab: Interactive Educational Platform Turns Cryptographic Protocols Course into Hands-On Alice, Bob and Mallory Experiments
A university instructor developed CryptoLab, an educational testbed that lets students run live cryptographic protocol experiments with active attackers instead of simple encrypt-decrypt exercises. The platform models the classic Alice-Mallory-Bob scenario where each participant runs as a separate application mode, allowing inspection, modification, dropping, and replay of packets. The first lab focuses on AES-GCM, AEAD properties, nonce reuse, replay protection, weak RNGs, key rotation, and metadata leakage. Students can operate in interactive mode to manually attack traffic or execute automated scenarios that verify expected security outcomes. Experiments demonstrate that modifying ciphertext triggers authentication failure and that a valid authentication tag does not guarantee message freshness without additional replay defenses. The tool also includes Python 3.10 assignments for correctly using cryptographic primitives rather than implementing algorithms from scratch. CryptoLab currently supports Windows x64 and macOS Apple Silicon builds and serves as the foundation for upcoming labs on symmetric encryption modes, asymmetric cryptography, key exchange, and TLS.
From Scanner Overload to Manual Insight: A Bug Bounty Hunter's Journey
A young researcher recounts his transition from automated scanning to thoughtful manual analysis in Bug Bounty programs. After completing a broad information security course covering cryptography, networks, Docker, databases, and OWASP Top 10, he initially approached real-world targets with the same scanner-heavy mindset used in labs. Months of fruitless results led to burnout and a six-month break working in construction. Returning with a new focus, he studied hundreds of public HackerOne reports to understand researcher reasoning and anomaly detection. This shift enabled his first valid, unreported finding and fundamentally changed his methodology. Today the 18-year-old university student balances Bug Bounty with reconnaissance, machine learning, and personal projects while emphasizing deep application understanding over tool volume.
Bypassing Paid Export on AI 3D Generation Sites via Browser Network Inspection
A detailed walkthrough shows how users can retrieve AI-generated 3D models in GLB format from services that normally require a paid subscription for export. The method relies on opening the browser developer console, filtering network requests for .glb files after model generation completes, and opening the intercepted asset in a new tab. Examples using Tripo3D and Hi3D demonstrate that the generated model and textures are already present on the client side even when the export button remains disabled. Additional steps address compatibility issues with 3ds Max by recommending conversion through gltf.report with Draco compression before import. The technique also covers post-processing in ZBrush for auto-retopology and format conversion to OBJ. The article notes that such workarounds exist because many AI platforms limit free exports while still rendering full models locally.
National Platform Max Begins Testing Advertising Tools to Monetize User Attention
The Russian national platform Max has started internal testing of new advertising instruments designed to convert user attention into sellable ad inventory. According to the company's press service, the tests are already underway inside the application, although the exact placement, visual format, and eligibility criteria for advertisers remain undisclosed. The move marks a significant shift for the platform, which previously operated without visible commercial advertising. Observers note that Max could become one of the largest domestic digital advertising channels if the tests prove successful. No timeline has been given for a public rollout or for the publication of detailed advertising policies.
Yandex Drops Earbuds Under X-Ray Microtomography: Detailed Internal Analysis of First AI-Powered TWS Headphones
Engineers used non-destructive X-ray microtomography to examine Yandex Drops, the company's first TWS earbuds featuring the Alice AI voice assistant. The scan revealed an eight-layer HDI PCB, three microphones per earbud arranged in a dual feedforward plus feedback ANC configuration, an 11 mm driver, and a QFN-packaged SoC with NPU. No hardware disconnect point was identified in the microphone signal path within visually accessible traces, connectors, and vias. Battery dimensions, coil windings in the case, and internal flex routing were measured directly from calibrated voxel data. The study also confirmed contact-based charging via spring-loaded claw contacts and a Hall-effect sensor in the case lid. The work demonstrates how industrial micro-CT can support hardware security reviews without destroying the sample.
Russia Sets Tech Collection Fees: Smartphones from 250 Rubles, Laptops from 500 Rubles Starting December 2026
The Russian Ministry of Industry and Trade has proposed specific rates for a new technological collection fee that will apply to imported smartphones, laptops, and landline telephones. Payments begin on December 1, 2026, with the final amount depending on whether the device model is registered in the national marking system. Base rates are reduced by 33 percent for registered models and increased by the same margin for unregistered ones. The fees were calculated using 2025 median customs values and a 4 percent inflation target. Manufacturers and importers must pay the collection, though costs are expected to reach consumers through higher retail prices. Separate lower rates apply to corded phones with wireless handsets and basic mobile phones.
How Social Media Recommendation Algorithms Shape Content, Behavior, and Regulation Worldwide
Social media platforms such as TikTok, Instagram, and YouTube rely on sophisticated recommendation systems that analyze user behavior to predict engagement rather than simply ordering posts chronologically. These algorithms form candidate sets and rank content using signals including watch time, likes, comments, and device data, creating personalized feeds that can diverge significantly between users. Research shows mixed effects on political views and mental health, with personalization capable of both amplifying polarization and reducing it depending on optimization goals. Regulatory responses vary: China mandates transparency and youth mode limits on Douyin, the EU's Digital Services Act requires non-profiled alternatives for large platforms, and Russia enforces disclosure rules under Federal Law No. 408-FZ since 2023. Practical steps allow users to reset recommendations and provide negative feedback to retrain feeds. The article debunks myths of dopamine addiction and inevitable radicalization while highlighting both risks and benefits of algorithmic curation.
Russia Proposes 22% VAT and 100-Ruble Customs Fee on All Foreign Online Purchases
The Russian Ministry of Finance has submitted draft amendments to the Tax Code and the federal budget for 2027-2029 that would impose a standard 22% VAT on goods purchased from foreign online stores and marketplaces. In addition, every postal shipment valued at up to 200 euros would incur a separate customs fee of 100 rubles. Electronic trading platforms are designated as tax agents and are expected to pass the new costs directly to buyers through higher final prices. The proposals eliminate the current duty-free threshold for low-value cross-border orders under EAEU rules and replace an earlier plan for gradual VAT increases with an immediate full-rate application. Officials state the measures are intended to create equal competitive conditions for Russian sellers and to further formalize the economy. The changes have not yet been adopted and must still undergo government and legislative review.
VK Tech Rolls Out Unified AI Assistant Across VK WorkSpace Corporate Tools
VK Tech is preparing a unified AI Assistant for its VK WorkSpace platform, along with semantic search and an MCP server to connect autonomous agents. The features target small and medium businesses as well as large corporations by automating routine tasks in messaging, email, and calendar services. Semantic search will allow users to locate documents, emails, and messages by meaning rather than exact titles or phrasing. Meeting recordings will be automatically transcribed with extraction of key topics, decisions, and action items. The AI Assistant launches first in the Messenger module of the On-Premise version, with cloud SaaS availability scheduled for October and later expansion to Mail, Disk, and Calendar. Access remains strictly limited by user permissions and company policies. An MCP server will also be introduced, enabling AI agents to query data, prepare meeting materials, and perform actions inside the platform services, initially supporting Messenger and extending to other modules by year-end.
Russia Weighs Passenger Fees of Up to 1000 Rubles to Fund Domestic Aircraft Leasing
Russian authorities are discussing a new surcharge on air tickets to cover leasing and operating costs of locally produced planes. The proposed fees range from 500 rubles on domestic flights to 1000 rubles on international routes, with some sources mentioning higher figures of 700 and 2000 rubles respectively. The initiative involves the Ministry of Transport, the Ministry of Industry and Trade, and Rostec, though no final decisions on amounts or collection methods have been made. Revenue estimates suggest the measure could generate 68 to 84 billion rubles annually based on 2025 passenger volumes, with total collections targeted at 200-250 billion rubles between 2027 and 2030. Funds would subsidize the gap between high production costs of models such as the MC-21 and SJ-100 and the discounted prices offered to airlines, while also addressing elevated maintenance and fuel expenses. Officials expect serial production after 2030 to lower costs and eliminate the need for the surcharge, yet experts caution that added fees risk raising ticket prices and reducing overall passenger traffic.
EVTX Record Recovery: Advanced Carving Techniques for Damaged Windows Event Logs
Positive Technologies researchers detail methods for carving EVTX records directly from raw disk images, memory dumps, and virtual machine snapshots when standard file system access fails. The approach bypasses corrupted MFT structures or wiped partitions by scanning for ElfChnk and record signatures. Their Go-based library parses both intact and damaged EVTX files, recovering events even when checksums mismatch. The article explains the three-layer EVTX structure including file headers, 64 KB chunks, and BinXML records with template substitution for space efficiency. Two carving strategies are presented: chunk-level recovery that restores full field names via per-chunk caches, and record-level extraction that pulls values without templates. The work supports faster incident reconstruction in ransomware cases where attackers encrypt entire VDI or VHDX images.
Google Testing Optional Google Account Unlock for Forgotten Android PINs
Google is developing a backup unlock method that lets Android users regain access to their devices through a linked Google Account instead of performing a full factory reset. The feature, discovered in Android 17 QPR2 Beta 5, appears under the name Unlock with Google Account and would be disabled by default. Users would need to enable it manually in the Device unlock settings before forgetting their PIN, password, or pattern. The change aims to prevent permanent loss of local data such as photos and documents that lack cloud backups. The mechanism revives a capability removed after Android 4.4, when forgotten patterns could be cleared using Google Account credentials. Factory Reset Protection would remain in place after any reset. The code reference is not yet functional, carries no official announcement, and may be altered or dropped before release.
Implementing 2FA Kubernetes Access via Gateway API, Dex and MULTIDIRECTORY
A Russian cybersecurity company replaced static kubeconfig files with corporate accounts and mandatory 2FA for its Talos Linux Kubernetes clusters. The solution routes all authentication through a single FQDN using NGINX Gateway Fabric, Dex as an OIDC provider connected to MULTIDIRECTORY via LDAP, and kube-oidc-proxy for token validation and impersonation. Groups stored in the directory are passed directly into RBAC bindings, eliminating manual certificate management. A lightweight Python service dynamically generates kubeconfig files that contain no secrets. The team documented several Gateway API migration pitfalls including namespace route restrictions and BackendTLSPolicy hostname validation. The approach keeps the entire configuration in Git and avoids modifying kube-apiserver flags.
Windows File System Tunneling Preserves Old File Metadata for Legacy Compatibility
Microsoft has clarified that Windows sometimes assigns creation dates from deleted files to new ones due to a long-standing mechanism called File System Tunneling. The feature keeps metadata in a short-term cache for about 15 seconds after a file is deleted or renamed. If a new file with the same name is created quickly in the same folder, it inherits the previous file's timestamps and short-to-long name mappings. This behavior exists to support safe saving patterns used by many applications and to maintain compatibility with old DOS-era 8.3 filename formats. The actual file content is never restored, only the metadata. The cache is temporary and clears over time, so the effect does not occur with files deleted long ago. The explanation came after users noticed unexpected dates in Windows Explorer and questioned whether it was a bug.
Amazon Confirms Irrecoverable Data Loss in UAE and Bahrain Data Centers After Drone Attacks
Amazon Web Services has officially confirmed that data stored in specific availability zones within its Middle East regions was permanently destroyed following physical attacks on data centers in the UAE and Bahrain. The incidents began on March 1 and continued through April and July, damaging infrastructure tied to AI development projects. In the UAE region mec1, only zone mec1-az2 was completely destroyed with no external backups, while mec1-az3 suffered severe damage and mec1-az1 remained operational but overloaded. All three zones in the Bahrain region me-south-1 were rendered inoperable. AWS had spent six months attempting recovery before issuing the final statement on September 15, 2026, and has advised customers to migrate workloads to unaffected regions. The event highlights growing risks to data from physical-world attacks beyond traditional network threats.
Bots Overload OT Commerce Store on OT Box, Spike Paid OTAPI Calls Mistaken for DDoS Attack
An online store running OT Commerce experienced CPU loads reaching 98-100% and a 6-7x increase in paid OTAPI calls over three days due to automated bot traffic rather than a traditional DDoS. The site owner had already deployed a paid anti-bot module on the VPS, yet behavioral bots continued to bypass protections and force expensive calls to the external OTAPI platform for product data from Taobao, Tmall, 1688 and other marketplaces. Traffic analysis after switching to the CRONARMOR WAF revealed that 41.9% of page requests were automated, with 99.3% of early-stage automation blocked before reaching the origin server. Only 0.5% were behavioral bots visible in analytics, while legitimate search crawlers accounted for 27,190 requests that were explicitly allowed. The WAF approach stopped requests at the reverse proxy layer, preventing PHP execution, database queries and OTAPI billing events on the origin. Post-deployment CPU dropped to single digits for most of the day, eliminating both performance issues and the anomalous rise in paid API usage.
Teenage Smartphone Addiction: Causes, Consequences, and Treatment Approaches
Smartphone use has become an integral part of adolescent life, but problematic usage patterns rather than device ownership itself are the focus of concern. Medical experts avoid the term smartphone addiction and instead address issues like disrupted self-control, social media overuse, and gaming disorder that interfere with sleep, studies, relationships, and mental health. Data from Pew Research indicates nearly 50% of U.S. teens aged 13-17 are online almost constantly, while CDC findings link four or more hours of daily screen time to elevated anxiety and depression symptoms. Family digital habits strongly influence teen behavior, and rigid bans often fail without addressing underlying issues such as boredom, anxiety, or social isolation. Parents are advised to track specific disruptions over a week and consider professional help when signs of depression, bullying, or self-harm appear alongside device overuse.
VK WorkSpace Federation Enables Secure Multi-Organization On-Premise Messaging Without Infrastructure Merge
VK Tech has released federation capabilities for its VK WorkSpace corporate messenger that connect independent On-Premise installations while preserving each organization's full control over data, administration, and security policies. The feature, first piloted in November 2025 and expanded in the July 2026 26.2 release, supports multi-party chats across more than two separate environments. Federation relies on mutual trust establishment and per-user access grants rather than full directory replication or proxy access to a single host instance. Each participating organization maintains local copies of messages, files, and chat metadata, allowing continued access even if a partner installation becomes unavailable. The architecture deliberately avoids both centralized hosting and open protocols such as Matrix to keep changes to the existing messenger core minimal. Administrators retain independent levers to create or revoke trusts and to limit which employees may communicate externally.
Sergey Volkov of Cloud.ru Named Top CISO in Russian IT Sector Ranking
Sergey Volkov, Director of the Cyber Protection Center at Cloud.ru, has secured first place in the information security category of the annual Top-1000 Russian Managers ranking. The ranking, published by the Association of Managers in the Kommersant newspaper since 2001, is compiled through peer evaluations by top executives followed by review from expert commissions. Volkov oversees information security strategy and operations for Cloud.ru, and his top position reflects professional recognition of his leadership results. The Association also analyzed broader achievements among laureates and identified key trends in Russian management. Artificial intelligence adoption for business process optimization appeared in 80 percent of reviewed accomplishments. Client orientation through user experience analysis and personalized solutions ranked second, while operational efficiency via cost reduction, automation, and digitalization took third place.
Russia Hands Down First Conviction Under New Criminal Article for Online Drug Propaganda
A resident of Orenburg became the first person in Russia to receive a criminal sentence under Article 230.3 of the Criminal Code, which criminalizes online drug propaganda following repeated administrative violations. The man was fined 100,000 rubles and had his mobile phone confiscated after he printed and posted leaflets containing a QR code that directed users to job advertisements linked to drug distribution. The scheme began when he was recruited via messenger to place the leaflets for 10 rubles each, without realizing the content involved narcotics-related vacancies. Prior to this case, the individual had already been sanctioned twice within the same year for illegal drug advertising, allowing prosecutors to escalate the matter to the new criminal provision that took effect on 1 March. The court considered his prior record as a recidivism aggravating factor yet imposed the minimum fine after he admitted guilt, expressed remorse, and cooperated with investigators. The ruling has already entered into force, marking the initial application of the statute that permits penalties up to two years of imprisonment or fines between 100,000 and 300,000 rubles.
Where to Find Scientific Articles and Full Texts in 2026: Russian and International Databases Guide
Finding complete scientific papers often requires navigating multiple platforms because search engines show only titles and abstracts while publishers may demand payment for PDFs. The guide explains the differences between bibliographic databases that help locate publications and full-text repositories that provide actual documents. It covers Russian resources such as CyberLeninka, eLIBRARY.RU with RINC, Math-Net.Ru, and the national platform of scientific journals, along with international tools including Google Scholar, PubMed, arXiv, ACM Digital Library, IEEE Xplore, Scopus, and Web of Science. Additional sections address book catalogs, archives, AI-powered search tools like Consensus, and scientific social networks such as ResearchGate. The material emphasizes that presence in any database does not guarantee quality or validity, urging readers to verify methods, results, and publication status independently. Practical advice is given on locating open-access versions, using library subscriptions, and contacting authors directly.
WAF Connected — What Next? How to Configure Web Application Firewalls for Real Protection Without Disruption
After successful pilot testing, organizations often struggle when scaling WAF protection across dozens or hundreds of applications. Each app brings unique technology stacks, traffic patterns, and legitimate anomalies that can break existing rules. The article stresses starting in monitoring mode rather than blocking to avoid false positives that frustrate users and damage business operations. A structured Risk Score and Priority Score system helps teams prioritize applications based on exposure, business impact, control weaknesses, technical risks, and data sensitivity. Regular tuning, log analysis, and quarterly re-evaluation of the application registry are required because applications evolve constantly. Well-configured WAF solutions must deliver low false-positive rates, rapid exception handling, and resilience under peak loads without creating new operational burdens for security teams.
Avanpost SmartPAM Adds 60 MITRE ATT&CK Signatures for Privileged Session Threat Detection
Avanpost has released an update to its SmartPAM 1.4 solution that incorporates a library of 60 signatures mapped to the MITRE ATT&CK framework. The new capability allows the Privileged Access Management system to monitor and analyze actions performed by administrators inside privileged sessions rather than simply controlling initial access. The signatures cover common attack techniques including credential access, persistence, lateral movement, and defense evasion such as disabling audit logs, antivirus, or firewalls and clearing system events. A built-in signature analysis engine normalizes session data, matches observed behavior against known attack patterns, and triggers automated responses including command blocking, session termination, or SIEM alerts. Customers can combine the vendor-supplied rules with custom policies and will receive regular subscription-based updates at no cost until the end of 2026. Avanpost claims SmartPAM is the first PAM product to offer a MITRE ATT&CK-structured signature library, shifting the tool from a basic access gatekeeper to an active behavioral observer capable of identifying malicious activity even when valid credentials are used.