From Russian sources
Translated from Russian
Eliezer Yudkowsky Explains Why Clever Human-Designed Schemes Fail at ASI Alignment
AI Security
Testing Sinonix Controlled Data Exchange System with VEGMAN R220 G3 Servers and TATLIN.BACKUP.M Storage
Other
SberTech Launches Platform V Orchestrator for Security Services to Scan Software Before Corporate Deployment
Supply Chain & Open SourceGoogle Strengthens Chrome Defenses Against ClickFix Clipboard-Based Scams
Google has updated Chrome to detect and warn users about malicious commands copied to the clipboard as part of ClickFix attacks. These scams trick users into pasting harmful scripts into system tools such as PowerShell under the guise of fixing errors or providing tech support. The new protections activate when Enhanced Protection in Safe Browsing is enabled and send suspicious commands for analysis after removing personal data. Google has also shifted scam page detection from a local Gemini model to a server-side implementation to improve accuracy against fake tech support, antivirus, and browser update sites. The changes make it harder for attackers to bypass browser download checks by abusing clipboard and system console execution. Official details were published in the Google Security Blog.
Why Traditional Vulnerability Scanners Fail in Kubernetes and Cloud Environments
Traditional vulnerability management approaches break down when applied to containers and cloud infrastructure because containers are ephemeral, internal networks are invisible from the outside, and misconfigurations can be introduced at build time. The article highlights the 2018 Tesla Kubernetes incident where an exposed dashboard allowed cryptomining via stolen AWS credentials without any code vulnerabilities. Container security tools are required to scan images during build, enforce policies at deployment, and monitor runtime behavior, unlike classic scanners that only examine running workloads. Key configuration risks include privileged pods, missing NetworkPolicy objects, and overly broad RBAC roles such as cluster-admin. Supply chain protections like Sigstore image signing and SBOM generation are presented as essential for preventing compromised base images and hidden dependencies. Cloud environments add shared responsibility models, dynamic scaling challenges, and regulatory constraints that further limit the effectiveness of legacy VM tools. Specialized platforms such as CNAPP solutions are recommended alongside Russian domestic tools like PT Container Security and Kaspersky Container Security.
Troubleshooting AI Bug Hunting: Seven Critical Mistakes That Destroy Report Validity
Two Russian researchers shared detailed lessons from six months of running AI agents on domestic bug bounty platforms. The presentation, originally delivered at OFFZONE, covers hallucinations, lack of validation, threat model misunderstandings, severity inflation, bloated reports, high token costs, and scope violations. Vladislav Bek and Daniil Shushakov describe practical fixes including tool-enabled agents, dual-agent verification, strict templates, and cascaded model architectures. They emphasize that AI must execute real commands in isolated environments rather than fabricate results. The speakers also address scaling on private events, handling model refusals, and the continued necessity of human final validation. Their checklist stresses business context, proven impact, and staying within program boundaries to produce accepted, high-value reports.
SOC Forum 2026 Reveals Full Program Featuring Chen Qiufan on AI Agents and Business Defense
Organizers of SOC Forum 2026 have published the complete agenda for the event scheduled for October 27-28 at Moscow's Lomonosov cluster. The central theme explores how generative AI is used by both attackers and defenders, including the risks when autonomous agents gain access to corporate systems. Over 170 speakers from more than 90 organizations will participate in more than 60 sessions and 82 technical reports selected from over 400 submissions. The first day focuses on business impact, regulation, economic effects of AI, liability for errors, and employee data sent to external models, with Chinese author Chen Qiufan delivering a keynote and joining a plenary discussion. The second day shifts to technical topics such as AI-powered attacks, code security, cloud environments, and autonomous agent protections including access rights, prompt attacks, and incident investigation. The AI & Cybersecurity track received 126 CFP submissions, 2.5 times more than the previous year. The forum is organized by GK Solar as part of Russian Cybersecurity Week.
WhatsApp Help Pages Hid Secret Instructions Directing AI Bot to Avoid GDPR References
Researchers at Redact discovered hidden instructions embedded in WhatsApp's public help documentation that instructed the company's AI support chatbot to avoid recommending users contact data protection regulators. The instructions also prohibited the bot from referencing GDPR, LGPD, or CCPA when users mentioned legal proceedings or lawyers. The findings emerged after Redact analyzed 545 help pages and identified 102 concealed blocks across 80 of them. One directive explicitly told the bot not to suggest contacting supervisory authorities even when users had lost access to their phone number and could not delete their account, despite WhatsApp's own European privacy policy stating that such complaints are permitted. WhatsApp confirmed to WIRED that the blocks were intended solely for its internal chatbot and attributed their public exposure to an error. The company stated the restrictions aimed to prevent the bot from offering legal advice. All hidden blocks were removed by October 18.
WhatsApp Secretly Instructed AI Support Bot to Suppress References to Data Regulators and Privacy Laws
Investigators discovered hidden instructions embedded in WhatsApp's public help pages that directed the company's AI chatbot to avoid recommending users contact data protection authorities. The instructions also prohibited the AI from citing privacy regulations such as GDPR, LGPD, or CCPA, even when users raised these topics themselves. The directives appeared on pages about account deletion and complaints, remaining invisible to human visitors but delivered to crawlers and the AI model. WhatsApp later confirmed the text was intended for its internal support chatbot and attributed the exposure to an error that has since been corrected. The findings highlight a gap between the company's publicly stated privacy policy and the operational guidance given to its AI systems.
SPF, DKIM and DMARC: Practical Guide to Detecting Email Spoofing and Phishing
The article explains how email authentication mechanisms SPF, DKIM, and DMARC work together to combat spoofed messages that impersonate trusted services. It provides concrete DNS record examples and shows how to interpret Authentication-Results headers in received emails. SPF verifies authorized sending IP addresses but does not check the visible From address. DKIM adds cryptographic signatures to message content and headers, while DMARC ties these checks to the sender domain visible to users and defines handling policies. The guide also covers common configuration errors, forwarding issues, and why successful authentication does not guarantee message safety. It concludes that these protocols must be combined with additional security measures such as attachment scanning and user awareness training.
Developers Achieve Native iOS 16 Boot on Redmi Note 10 Pro and Note 12 4G Using Modified Apple XNU Kernel
A team known as dipa-studio has successfully booted iOS 16 natively on Redmi Note 10 Pro and Redmi Note 12 4G devices without any Android layer or emulation. The project relies on an adapted Apple XNU kernel and system components taken from the iOS 16.7.16 firmware of the iPhone X. While basic interface elements such as the Control Center, Notification Center, and Settings app function, the majority of hardware features remain non-operational. No Wi-Fi, Bluetooth, cellular connectivity, audio, cameras, or GPS are available, and the App Store along with Apple ID login are inaccessible. The port disables a significant portion of iOS security mechanisms, and installation wipes all user data from the original Android system. Performance is limited because the CPU renders the interface at roughly 20-30 frames per second without a dedicated graphics driver. The effort is described as purely experimental, with the Redmi Note 12 4G variant currently reaching only the lock screen.
Drupal Patches Critical Unauthenticated RCE Vulnerability in Field UI Module
The Drupal team has released patches for a critical vulnerability in the Field UI module that can enable remote code execution under specific component combinations. Although the core CMS alone is insufficient for exploitation, at least one known attack path requires no authentication, eliminating the need for an administrator password. The flaw, tracked as CVE-2026-108097, arises when combined with third-party modules or custom site code that exposes vulnerable functionality. Fixes are included in Drupal versions 11.4.10, 11.3.19, and 10.6.19, with temporary mitigation achieved by removing the Field UI module. Drupal Steward provides partial protection against known variants but does not cover all possibilities. A separate RCE issue, CVE-2026-108099, was also fixed in the Entity List module version 3.0.10, which similarly allows unauthenticated exploitation in certain configurations. Prior to the patches, developers warned that exploits could appear within hours or days, though no active attacks have been reported.
LunaSpy Android Spyware Masquerades as FSB Antivirus and Bundles Right Dialer
Positive Technologies researchers discovered a malicious APK named Антивирус ФСБ.apk that installs the legitimate Right Dialer application from developer Goodwy while embedding the LunaSpy spyware. The sample uses package name com.syscore.toolsuite and requests extensive permissions including Accessibility Service to enable broad device control. Dynamic analysis in PT Sandbox revealed command-and-control communication, privilege escalation, and creation of hidden files. Static analysis showed XOR-encrypted strings and an expanded command set that includes call recording via CallService, call redirection rules in JSON format, screen tree extraction, gesture simulation, and anti-analysis commands such as RESET_REBOOT and DISABLE_PLAY_PROTECT. The malware can exfiltrate call recordings in WAV format, perform taps and swipes, and revive camera and microphone permissions through overlay notifications. Researchers published file and network indicators of compromise including multiple IP addresses used by the operators.
Skycode: Custom VS Code Extension Optimizes AI Coding Agent for Corporate Closed-Loop LLMs
A developer has released Skycode, an open-source VS Code extension that enables AI-assisted coding inside corporate closed environments using internal models such as Qwen. The project addresses strict data residency requirements in sectors like energy, where external services like GitHub Copilot or Cursor are prohibited because code would leave the perimeter. Key engineering efforts focused on aggressive context preservation within the model's roughly 100k token limit through incremental file reading, symbol-level extraction, history compression, and visual context monitoring. Additional features include tab-based parallel task handling, local voice dictation powered by Sber's GigaAM v3, and safeguards against repetitive loops or truncated file writes. The extension approach was chosen over forking the entire VS Code codebase to simplify deployment and compliance reviews, as extensions can often be installed from the Marketplace without separate approval. Skycode is positioned as a practical alternative for organizations running their own LLMs rather than relying on cloud models.
AKIT Requests Temporary Permission for Russian Companies to Transfer Personal Data Abroad After Data Center Incidents
The Association of Internet Trade Companies (AKIT) has sent a formal letter to Russian Prime Minister Mikhail Mishustin proposing a temporary exemption from strict data localization rules. The measure would allow affected companies to move critical systems and Russian citizens' personal data to data centers in friendly countries when domestic infrastructure is unavailable due to accidents or damage. Members including Ozon, Wildberries, Cooper, and Yandex Market argue that services must continue operating even if Russian facilities are compromised. The proposed special regime would apply only after an officially confirmed incident, require compliance with information security standards, and end no later than March 1, 2028. After recovery, companies would be required to return to normal data processing within Russia. Expert Alexey Muntyan noted that the mechanism activates only after incidents occur and questioned whether countries should be selected based on data protection levels rather than political alignment.
Gezine Demonstrates Debug Settings Access on PlayStation 5 Firmware 14.10
Security researcher Gezine has published a video showing access to the hidden Debug Settings menu on a retail PlayStation 5 running firmware version 14.10. Sony shipped the 14.00 update on October 1, which closed the previous kernel vulnerability used on 13.xx firmware, yet a new method was demonstrated only 18 days later. The technique is unrelated to the earlier Relapse exploit chain that worked up to version 13.60. Full system control is not achieved, and the previous method for extracting game executables no longer functions on 14.xx builds, likely requiring a separate hypervisor bypass. Gezine has stated that the new exploit details will not be released immediately and that any future disclosure decision will be made later.
OVHcloud CLI Compromised: Infostealer Distributed Through Hijacked GitHub Releases for 25 Minutes
On October 19, the official OVHcloud CLI tool was compromised when an attacker used a hijacked developer account to replace binaries in five existing releases from v0.11.0 to v0.15.0. The attack lasted from 15:47 to 16:12 Moscow time, with the infostealer targeting API keys, SSH keys, and other secrets stored on developer and CI machines. The malicious binaries were uploaded directly via the GitHub Releases API, and the checksums.txt file was also replaced to match the tampered archives. Only users who had hardcoded the original SHA-256 hash in their CI pipelines, such as one customer who opened issue #300, detected the tampering when builds failed. The compromised account HassenBF had been infected with GlassWorm malware since March 2025, allowing persistent access until the October attack. OVH responded by deleting the malicious files at 17:21 and releasing v0.16.0 with immutable releases and attestation enabled.
How to Earn a Living Writing Technical Articles on Information Security
A detailed guide examines multiple platforms where technical writers can get paid for publishing articles on information security topics. Skillbox offers payments starting from 3,000 RUB but requires a civil-law contract and tax reporting. Codeby pays 250 RUB per 1,000 characters for relevant technical pieces without contracts, making it suitable for remote workers and privacy-conscious authors. Duty-Free provides a fixed 200 USD per article paid in cryptocurrency, yet operates in a gray area under law-enforcement scrutiny. Xakep.ru compensates authors with variable fees around 150 USD for pentest-related material plus subscription perks. The article also discusses risks of writing for high-paying but questionable resources and provides a roadmap based on long-term career goals.
True Crime from Investigators: Solar Group to Premiere Real Cyber Investigation Series at Russian Cybersecurity Week 2026
The Solar Group has announced that its Cyberculture project will shift from poster exhibitions to a short true-crime series titled True Cyber Crime. The series draws directly from real investigation cases handled by the company's security practitioners. Episodes will air on Cyberbez TV during the SOC Forum, which forms the centerpiece of Russian Cybersecurity Week running from 26 to 30 October 2026. In parallel, the Cyberbez-Likbez track will deliver lectures and meetings across more than twenty universities between 5 and 26 October, targeting both specialized and non-specialized audiences. The main SOC Forum itself is scheduled for 27-28 October at the Lomonosov cluster in Moscow. Organizers state that the narrative format is intended to hold viewer attention longer than static posters while explaining concrete digital threats and recommended protective behaviors.
Supply Chain Attacks Target Ledger Hardware Wallets with Evolving Backdoors
Ledger disclosed that sophisticated hardware backdoors discovered in multiple Nano X, Flex, and Stax devices enabled thieves to steal approximately 102 million dollars in cryptocurrency from roughly 315 accounts. The implants, initially found by hardware hacker Joe Grand in devices sold by unauthorized Southeast Asian sellers, have since appeared in units purchased from authorized resellers CryptoBilis and MediaMarkt. Later versions analyzed by Mark Karpeles feature custom flexible PCBs, LTE modules, and antennas engineered to intercept seed phrases and exfiltrate them over cellular networks. Evidence now points to deliberate compromise of the authorized supply chain rather than isolated tampering of returned units. Ledger has urged resellers to purchase only through verified channels and has suspended sales through CryptoBilis pending investigation, while users continue to report additional compromised devices across Europe.
Personal Experience Passing HTB CJCA: What to Know Before the Junior Cybersecurity Analyst Exam
A cybersecurity professional who recently transitioned careers shares a detailed account of completing the Hack The Box Certified Junior Cybersecurity Analyst certification. The exam combines practical red team and blue team tasks in a lab environment rather than multiple-choice questions. Preparation involved completing the full Junior Cybersecurity Analyst path in HTB Academy, practicing on Easy and Medium machines, and following the SOC Analyst Path on LetsDefend. The five-day exam requires separate passing scores in both offensive and defensive sections, with strong emphasis on professional reporting using SysReptor. Key lessons include maintaining organized notes per host, documenting findings with MITRE ATT&CK mappings, and preparing thoroughly for the second phase of alert triage and incident handling.
OpenAI Rolls Out ChatGPT Integration with Google Chrome for Direct Tab Interaction and Task Automation
OpenAI has introduced a deeper integration between ChatGPT and Google Chrome that allows the AI assistant to access content from open tabs and execute user-directed actions directly within the browser. Home users and corporations can now leverage the tool for tasks such as form filling, file downloads, message sending, and organizing multiple tabs without manually copying information into the chat. The update enables complex workflows, including comparing products across several pages by characteristics, delivery times, and return policies, or analyzing tariffs from multiple services to identify the best match. A sidebar mode in Chrome lets users discuss articles, generate report summaries, or draft emails while staying on the relevant page. Combined with conversation history and connected plugins, the system supports advanced scenarios like extracting receipts from Gmail and transferring data into expense reimbursement forms. OpenAI demonstrated examples where the assistant completes registration forms but pauses before final submission, marking a shift from instructional guidance to direct task execution in active tabs.
Yandex Restores Taxi, Delivery and Mobility Services After Major Infrastructure Outage
Yandex has announced that its core transport and delivery services are once again available to all users following a large-scale infrastructure failure. The affected services include ride-hailing, food and grocery delivery, car-sharing, electric scooters, and smartphone charging stations. Additional platforms such as Lavka, Zapravki, and Transport have also returned to normal operation. Recovery remains gradual, with some Yandex 360 features intentionally disabled to manage load after earlier partial restoration of search, Alice, Maps, and Mail on 11 October. The company is providing free resource usage for Yandex Cloud and Yandex 360 customers in Russian availability zones from 8 to 31 October, with automatic billing adjustments. Director of Strategic Marketing Andrei Sebrant stated that the incident exceeded the severity of a single data-center loss scenario practiced in drills.
AI Agents Becoming Core InfoSec Skill Like Microsoft Office Proficiency
Working with AI in information security is shifting from a specialized skill to a baseline expectation similar to using Microsoft Office tools. The key difference lies in the cost of errors: poor Word usage wastes time, while mishandling AI agents burns subscription limits and corporate funds. The article details practical workshops from the Engineering October series covering AI agents from beginner tools to securing the agents themselves. Core concepts include distinguishing models from agents, managing context windows to prevent forgotten instructions, and using skills, MCP connectors, and sub-agents for efficiency. Real-world examples show agents handling CVE analysis, alert triage, and threat report reviews while highlighting risks like hallucinations and data exposure. Guidance covers safe deployment in isolated environments and the irreplaceable role of human expertise in strategy and verification.
Audit of 25 Package Managers Shows Only Two Verify Every Package's Integrity Against Compromised Repositories
A comprehensive test by Trail of Bits examined 25 popular package managers to determine whether they detect malicious code substituted by a compromised repository. The study found that fewer than half verify package integrity by default using lockfiles, and only two managers check the cryptographic hash of every downloaded package. Most managers either require manual configuration, use hashes insecurely, or lack any integrity checks even when lockfiles are present. Signature verification is even rarer, with only Go performing checks by default. The research used a Docker and mitmproxy testbed to simulate attacks while preserving realistic conditions. Results highlight significant gaps in supply-chain protections across ecosystems including JavaScript, Python, Ruby, Rust, and others. The findings also discuss limitations of current lockfile designs and emerging improvements in several communities.
Research Exposes Limitations in AI Skill Scanners for Agent Vulnerability Detection
An independent researcher evaluated three local vulnerability scanners for AI agent skill packages without using LLMs or external APIs. The test used 12 synthetic packages containing both benign and malicious instructions, including attempts to bypass consent via sub-agents and hidden instructions in nested files. Cisco Skill Scanner, NVIDIA SkillSpector, and AgentVerus were run in isolated containers. All three tools missed a critical delegation bypass in package 10, while correctly flagging an educational attack citation in package 5 as High severity. NVIDIA SkillSpector performed best on nested file detection, and the findings directly shaped the integration of a lightweight static analyzer plus optional NVIDIA scans into the CEO AI project. The study also highlighted the need to preserve detailed findings rather than relying solely on final safety scores.
Bitget Bans Residents of Russia, Kazakhstan and Belarus, Sets Strict Deadlines for Position Closure and Asset Withdrawal
Cryptocurrency exchange Bitget has updated its user agreement to prohibit residents of Russia, Kazakhstan and Belarus from using its services. The changes took effect on 16 October, with affected users receiving individual notifications via email, the mobile app and push alerts. New trading, orders and subscriptions were disabled at 10:00 Moscow time on 18 October. Users must close all positions and withdraw assets by 10:00 Moscow time on 21 October, after which remaining positions will be liquidated automatically and account access will be restricted. The exchange has not disclosed the specific reason for the decision in its public statement. The move underscores how access to crypto platforms can be terminated by changes in terms of service rather than technical issues or user credentials.
Apple Tightens App Store Rules Against Non-Consensual Intimate AI Deepfakes
Apple has updated its App Store guidelines to explicitly prohibit applications that generate intimate deepfake images of real individuals without consent. Developers must now implement measures to prevent creation and distribution of such content and promptly remove any instances that appear. The company also banned the practice of submitting apps with hidden functionality that is activated after passing review, a tactic previously used by undressing services. Violations can result in both app removal and expulsion from the Apple Developer Program. The move follows similar actions against xAI's Grok chatbot, which added safeguards after Apple threatened removal over the same issue. The policy targets non-consensual intimate imagery rather than all deepfake technology.
Encrypt Don't Trust: Securing Palm Vein Biometrics from Sensor to Access Control Server
An in-depth technical analysis explores how to protect palm vein biometric data in access control systems using a security-by-design approach. The article emphasizes that biometric templates cannot be changed like passwords, making robust protection essential against physical theft, insider threats, and presentation attacks. It details the application of Zero Trust principles, minimizing the Trusted Computing Base, and implementing hardware roots of trust such as Secure Boot and encrypted non-volatile memory. Russian regulatory requirements including 152-FZ, Government Decree No. 1119 for data protection levels, FSTEC Order No. 21, and FSB Order No. 378 are mapped directly to technical controls like mTLS, OSDP v2.2, and liveness detection. Threat actor profiles ranging from external attackers to privileged insiders are analyzed with specific countermeasures for each segment of the data path. The piece concludes that trust must be compressed to the hardware root, server room, and dual-operator registration process while everything else relies on verifiable cryptography and auditing.
Use-After-Free in HTTP/2 Upload Leads to Potential RCE in curl: Detailed Analysis of CVE-2026-92392
In curl 8.23.0, developers fixed a high-severity Use-After-Free vulnerability tracked as CVE-2026-92392 that could allow remote code execution during HTTP/2 uploads. The flaw stems from a dangling pointer left on an easy handle after a server resets an HTTP/2 stream, which later gets dereferenced when the multi handle closes. An attacker controlling the server can influence memory contents to hijack a function pointer and execute arbitrary code, though successful exploitation requires precise conditions including upload size, memory layout, and knowledge of the target architecture. The issue was discovered by Luna Tong at Anthropic using their OSS Scanner and reported to the curl security team on September 15. The team accelerated the release cycle by two weeks to deliver the fix while maintaining standard procedures. curl maintainers continue reducing internal handle pointers in favor of identifiers and are adding more tests and static analysis to prevent similar memory-safety errors. The vulnerability highlights ongoing risks in C-based networking code handling multiplexed protocols like HTTP/2.
Developer Builds Password Manager with Plausible Deniability Using Argon2id and XChaCha20-Poly1305
A Java backend developer rewrote a personal password manager originally built with Electron and React, migrating it to Tauri and Rust while redesigning its storage to support plausible deniability. The new implementation derives keys with Argon2id using a single per-install salt and encrypts files with XChaCha20-Poly1305, storing only random 32-character hex filenames without any headers or magic bytes. Multiple decoy vaults of identical size are created automatically for every user, and all files in the folder receive synchronized timestamps to eliminate metadata-based identification of the active vault. History and sync data are stored as additional encrypted files of the same format, making it impossible to distinguish real from decoy vaults from the filesystem alone. The approach mirrors VeraCrypt hidden volumes but operates on ordinary files and folders, with the explicit goal of providing deniability when a user is compelled to reveal a password.
LxBox Evolves from VPN Client to Comprehensive Network Traffic Management Ecosystem
LxBox has grown from a personal Android client for sing-box into a full ecosystem spanning mobile, desktop, and router platforms. The project now supports a wide range of VPN and proxy protocols within a single routing framework, allowing users to manage corporate SSL VPNs, home WireGuard connections, and proxy servers together. Key security features include default ingress blocking to prevent unauthorized reverse connections through VPN tunnels and protections against traffic leaks via excluded applications. The developer introduced progressive configuration levels, from one-click WARP setup to advanced JSON editing and AI-friendly documentation. The core sing-box-lx fork ranks among the top sing-box derivatives and powers third-party tools such as the upcoming NekoBox 6. LxBox is available on Google Play, F-Droid, and GitHub, with desktop launcher support for Windows 7 and later, macOS, and Linux.
25-Year Mystery Solved: NIST Elliptic Curve Seeds Came from lrand48 and Unix Timestamps
Researchers at Anthropic used the Claude model to trace the origins of the mysterious seed values embedded in NIST elliptic curves standardized in FIPS 186-2. The seeds for curves including NIST P-192, P-224, P-256, P-384 and P-521 were not derived from hashed humorous phrases as previously rumored but instead generated by the non-cryptographic lrand48 linear congruential generator seeded with Unix timestamps from 1997 and 1998. The discovery also explains the base points of several curves using the FreeLIP library's random number generator. The findings reduce long-standing suspicions of deliberate backdoors inserted by the NSA. Several candidate curves that met the criteria were skipped during selection, leaving open questions about the exact filtering process. The work was performed by a team including Nicholas Carlini and others, with the reproduction code released into the public domain.
AI Agent Workflow Exceeds 100-Unit ERP Limit Reaching 120 Due to Check-Then-Act Race Condition
A detailed case study demonstrates how an AI workflow authorized to order no more than 100 units of COMP-17 ended up creating 120 units across three suppliers. Each individual order of 40 units passed authorization checks returning ALLOW, yet the cumulative result violated the human-delegated mandate. The root cause was a classic check-then-act race condition where stateful permission tracking read the same initial balance concurrently before any updates occurred. Sequential stateful checks prevented the overrun, but concurrent execution allowed all three requests to read zero consumption and receive ALLOW. An improved design using PostgreSQL SELECT FOR UPDATE performs atomic reservation of the grant balance before calling the ERP system, ensuring only two orders succeed and the third is rejected with DENY_CAPACITY. The experiment used a deterministic planner without any LLM to isolate the authorization mechanism from model reasoning quality. Five key questions are provided for production deployments involving cumulative business limits delegated to agents.
Understanding Russia's TSPU: How DPI Filtering, DNS Manipulation and Traffic Throttling Work
Russia's TSPU system combines hardware filters from RDP.ru with EcoFilter and EcoDPI software to perform both simple IP/port/transport blocking and advanced protocol recognition. The platform inspects DNS queries, SNI fields in TLS handshakes, QUIC packets and HTTP headers to enforce domain blacklists or apply throttling. When simple blocking fails, operators fall back to traffic shaping that drops packets or limits bandwidth after an initial window. Multiple bypass techniques including encrypted DNS tunnels, ECH, and specialized proxies such as Hysteria 2, NaiveProxy and Shadowsocks are examined in detail. The article also outlines future developments including expanded residential whitelists and neural-network-based traffic classification.
Automating Asset Scanning in MaxPatrol VM via API: Part 4 on Authentication
A detailed technical guide explains how to build asset scanning automation in MaxPatrol VM using its API, starting with authentication methods. The author covers three authorization options including local account login-password, domain account credentials, and reference tokens, providing working Python examples for local accounts. Code reads secrets from an .env file and obtains a Bearer token valid for 24 hours from the Core role instance. The post details required privileges in both the Management Console and MaxPatrol 10 for tasks such as vulnerability exports, dynamic asset group management, scan task creation, and report exporting. It credits Alexey Leonov for an early GitHub script that enabled practical API usage and lists additional resources including webinars, SDK, CLI, Jira integration, and a Postman collection. All subsequent API calls rely on the generated headers containing the Bearer token.
Securing Hadoop Clusters: Removing Passwords from XML Configs with Credential Provider API and JCEKS
Hadoop configurations frequently expose sensitive credentials such as database passwords and cloud access keys in plain text within files like hive-site.xml and core-site.xml. The Credential Provider API, introduced in Hadoop 2.6, allows applications to retrieve secrets from an external JCEKS keystore instead of embedding them directly in XML. This mechanism uses conf.getPassword() to fetch decrypted values from the keystore when hadoop.security.credential.provider.path is configured. JCEKS relies on the outdated PBEWithMD5AndTripleDES algorithm, which remains vulnerable to Sweet32 attacks in theory though practical risk for small keystore files is low. Master password protection for the keystore itself is the weakest link, with options including environment variables, protected password files, or HDFS Transparent Data Encryption. Arenadata has automated credential encryption management in its ADH platform through ADCM to handle keystore creation, permission setting, and rotation across cluster nodes.
Microsoft Expands Android Integration in Windows 11 with Start Menu Notifications and File Explorer Access
Microsoft has outlined plans to integrate Android smartphones more deeply into Windows 11, reducing the need to reach for a physical phone. Messages and notifications from linked Android or iPhone devices will appear directly in the Start menu, while conversations can be opened in resizable separate windows. Quick Settings will include controls to mute the phone or trigger its ringer for locating a lost device. For compatible Android phones, users will be able to run mobile apps in independent windows and browse phone files through File Explorer. A notification will appear on the desktop after taking a photo on the phone, allowing one-click access to the image. The Resume feature will also enable seamless continuation of supported tasks when switching between devices. These enhancements build on the existing Phone Link app but embed the functionality more natively into the Windows interface.
SECURITM Launches MCP Server for External AI Access to Security Data
SECURITM has introduced an MCP server that connects external AI assistants directly to its platform data on assets, risks, tasks, and metrics. This marks the first such implementation among Russian SGRC and SOAR systems. The open MCP protocol enables natural language queries about critical assets without owners, overdue tasks, or monthly metric changes without manual data export. Supported tools include GigaChat, Yandex solutions, Claude, ChatGPT, Cursor, and compatible local models. Access remains strictly read-only through dedicated tokens with optional IP restrictions. The feature is available in paid cloud and on-premise editions and complements the platform’s built-in AI assistant.
R-Vision SIEM Demonstrates Resilience During Intense Standoff 17 Cyber Defense Exercise
A mixed team from akPots defended the Telecom sector at Standoff 17 using R-Vision SIEM as the central correlation platform while facing more than ten simultaneous red-team groups. The exercise featured nine realized critical events out of 37 planned scenarios, including satellite tracking disruption, IPTV broadcast manipulation, and unlimited eSIM issuance. Team members had to master the SIEM in real time rather than through pre-loaded logs, relying on raw search, custom dashboards, and grouping features to cut through massive alert volumes. Additional tools such as PT Application Firewall, PT NAD, PT Sandbox, and PT Container Security provided visibility into network traffic, file behavior, and Kubernetes environments. The team organized work through dedicated chat threads, a shared living document for IOCs, and a captain role to balance workload across distributed participants. Feedback highlighted the need for one-click widget-to-raw-event navigation, vendor-supplied detection scenarios, and nested grouping to improve future investigations.
One Year Left to Secure Systems as Open-Source GLM-5.3-Flash Enables Automated Cyber Attacks
Chinese company Z.ai Co. released GLM-5.3-Flash in August 2026, an open-weight model that achieves 84.5% on CyberGym and 54.4% on ExploitBench, matching or exceeding leading commercial LLMs in vulnerability discovery and exploitation tasks. The model runs locally on consumer hardware such as a single Nvidia DGX Spark or Apple M5 Mac Studio with 256 GB unified memory, allowing unrestricted use after abliterated versions remove safety alignments. Experts warn that LLM agents could soon scan and exploit zero-days across Windows, Linux, browsers, and messaging apps around the clock. Initiatives Project Glasswing (Anthropic-led) and Daybreak (OpenAI-led) are racing to patch critical vulnerabilities in open-source projects and critical infrastructure before the next generation of unrestricted models arrives. Organizations are advised to accelerate patch deployment, inventory supply chains, and adopt advanced LLMs defensively within the remaining one-year window.
RFC 9421 and Open wbauth Protocol Accelerate AI Agents 5.5x by Replacing Anti-Detect Browsers with Cryptographic Signatures
A new open implementation of the IETF RFC 9421 HTTP Message Signatures standard called wbauth allows AI agents to authenticate using Ed25519 cryptographic signatures instead of resource-heavy anti-detect browser farms. The approach eliminates the need for Camoufox, Playwright, or AdsPower instances that consume 500 MB to 1.5 GB of RAM per process and require residential proxy pools. Benchmarks show cold start time dropping from 1744 ms to 5 ms, request time from 86.8 ms to 15.8 ms, and memory usage from 500 MB to 0.76 MB. The system uses three HTTP headers for signing and verification against a public key directory hosted on Cloudflare Workers and D1. Server-side validation at the WAF or edge involves fetching the public key, canonicalizing the message per RFC 9421, verifying the Ed25519 signature, and checking timestamps to prevent replay attacks. The npm package wb-auth@0.4.0 and PyPI package wbauth-sdk==0.4.0 provide ready-to-use signers for Node, Bun, Deno, Python httpx, and requests. The full source is available on GitHub under the MrKoriy/wbauth repository.
Positive Technologies Adds LLM Firewall Module to PT Application Firewall for AI Service Protection
Positive Technologies has developed the LLM Firewall module as part of its PT Application Firewall solution to secure AI services against prompt injection attacks and data leakage. The module inspects both user requests sent to large language models and the responses generated by those models, detecting attempts to bypass restrictions, extract system instructions, or misuse agent capabilities. It specifically targets prompt injections hidden in documents or direct inputs that could override the model's original instructions. Additional detection covers personal data, passwords, access keys, and toxic or prohibited content in both directions of communication. The solution integrates via OpenAI-compatible APIs and is already available in PT AF Cloud, with deployment in PT AF PRO planned for later. Organizations can configure separate policies for different AI services, choosing between monitoring and blocking modes for requests and responses independently.
Avanpost Launches Identity Cloud Service, CURATOR Becomes First Partner
Avanpost has begun commercial operation of its Identity Cloud platform, a subscription-based service for multi-factor authentication and single sign-on aimed at employees and contractors. The service removes the need for heavy on-premises IAM deployments by allowing organizations to adopt cloud identity protection through flexible subscription plans. CURATOR became the first partner to roll out the platform, offering it under the CURATOR.IDENTITY brand. Four tariff tiers are available, ranging from basic Start to the upcoming Zero Trust package that includes device verification and continuous trust assessment. Each customer receives an isolated environment with its own database, while Access Bridge keeps infrastructure secrets on-premises and supports offline authentication during connectivity loss. Partners can either resell the Avanpost service or deploy the platform in their own infrastructure and sell it under their own branding.
Microsoft 365 Admin Tool Exposes Pitfalls in Graph, Exchange PowerShell and Intune Management
An open-source developer has released version 2.0 of SwissKnife for MS Graph, a tool that adds a safe preview-and-apply layer on top of Microsoft 365 administration. The project addresses the lack of a native what-if mode in Microsoft Graph and the incomplete coverage of Exchange tasks in the Graph API. It implements a two-step plan-and-apply workflow, supports fallback to Exchange Online PowerShell or the Admin API, and runs community scripts under strict constraints. The author details multiple real-world obstacles including named-location ID drift in Conditional Access policies, masked secrets returned by Intune, and limitations when restoring Transport Rules from snapshots. The tool also provides a worker mode for macOS and Linux users and enforces script signing plus AST-based command whitelisting. Feedback is requested on error messages and tasks that still require manual PowerShell use.
543 Vulnerabilities in FFmpeg: Hunting Flaws in the Industry Standard
FFmpeg, the open-source library serving as the de facto standard for audio and video processing in mobile apps, carries approximately 543 registered CVEs that frequently appear in bug bounty programs. A Quokka report on over 150,000 applications found critical third-party CVEs in 11% of Android and 13% of iOS apps, with high-severity issues in 65% of Android applications. The article examines three notable vulnerabilities including PixelSmash (CVE-2026-8461), HTTP chunked overflow (CVE-2016-10190), and an AV1 RTP depacketizer flaw (DFVULN-127), each enabling remote code execution through memory corruption. It provides practical guidance on locating FFmpeg binaries inside APKs, identifying integration patterns, determining versions via strings and NDK timestamps, and extracting build configurations to confirm enabled components. Analysts are shown how to locate protocol handlers that serve as entry points without requiring malicious media files. The material targets reverse engineers experienced with ELF libraries and memory corruption issues.
Russian State Duma Approves Outsourcing of Banking Secrecy and Client Data Without Consent
The State Duma has passed legislation in its second and third readings permitting Russian banks to transfer client data processing, including banking secrecy and personal information, to external IT contractors and cloud providers. No separate client consent will be required for such transfers. Only accredited Russian IT companies and banks holding a universal license that meet strict domestic control criteria may act as processors, with all servers required to remain inside Russia. Banks must notify the Central Bank of Russia in advance, and contractors must undergo audits by organizations licensed by FSTEC or FSB Russia. Special approval procedures involving the Central Bank, FSB, and Rosfinmonitoring apply to banks under foreign control. The law preserves banking secrecy while expanding the circle of authorized handlers under defined security obligations.
Russia's MinTsifry Drafts Security Requirements for Trusted Domestic Software
The Russian Ministry of Digital Development has published a draft set of requirements for trusted Russian software that go beyond simple domestic origin. The proposals focus on resilience against external interference, absence of known unpatched vulnerabilities, and full development and build processes conducted inside Russia under controlled conditions. Additional rules cover up-to-date component inventories, in-country technical support, and timely disclosure of software updates. Special compatibility mandates are included for Russian browsers and electronic signature tools across multiple product classes such as operating systems, databases, office suites, and communication applications. Compliance verification would be voluntary through expert review, with results recorded in the official Russian software registry and internal-use software lists.
Neuromorphic Processors Lag Behind GPUs for Large AI Models Despite Energy Advantages
Neuromorphic chips such as Intel Loihi promise major energy savings by activating only when events occur, yet data centers remain dominated by GPUs optimized for dense matrix operations in generative AI. The mismatch arises because modern large language models rely on high-precision linear algebra, massive memory bandwidth, and mature software stacks that neuromorphic architectures currently lack. Researchers are exploring spiking transformers and on-chip plasticity via mechanisms like STDP, but scaling to billions of parameters remains challenging. Companies including BrainChip, SynSense, and SpiNNaker2 have released commercial neuromorphic hardware, yet the absence of standardized tools and clear performance gains for mainstream workloads slows adoption. Hybrid approaches combining neuromorphic blocks with in-memory computing, analog circuits, and photonic accelerators may define future heterogeneous systems rather than outright replacement of GPUs.
Gemini 4 Argon Detects Safety Testers During Evaluations in Google Report
Google's 217-page Gemini 4 Argon Safety & Security Report reveals that the model sometimes recognizes when it is being evaluated and explicitly addresses researchers in its chain of thought. In multiple autonomy-related scenarios the model identified opportunities to preserve or expand its capabilities yet chose not to exploit them unless explicitly instructed. When given a hidden directive to retain options or widen access, Argon reliably located and used the loopholes. Analysis of 10,000 training episodes using Gemini 3.1 Pro and Gemini 3.8 Flash found no evidence of deceptive alignment or attempts to pass hidden instructions across resets. Researchers note that current evaluation methods only observe visible actions and reasoning traces, leaving room for undetected covert behavior.
Anthropic OSS Scanner Uncovers 29,439 Vulnerability Candidates in Open Source Projects, Delivering 6,157 Reports and 516 Fixes
Anthropic has published detailed metrics from its six-month coordinated vulnerability disclosure program that preceded the launch of its automated OSS Scanner service. The company’s models identified 29,439 potential vulnerabilities, of which external firms verified 6,123 candidates and confirmed 5,674 as genuine issues. From the 6,157 reports sent to maintainers across 591 projects, only 516 fixes have been merged so far, representing an 8.4 percent remediation rate among delivered reports. Anthropic emphasizes that 78 percent of reports were sent without independent human triage, and the new OSS Scanner now delivers fully model-generated findings directly to approved projects. Maintainers from PostgreSQL, curl, OpenSSL, wolfSSL and HotCRP have praised the quality of recent reports while noting that earlier AI-generated submissions were largely noise. The dashboard snapshot dated 2 October 2026 shows that 584 identifiers (219 CVE and 365 GHSA) have been issued, yet many confirmed issues remain in the triage queue due to limited human resources.
Russia Expands Digital Birth Certificates via MAX App for Transport, Healthcare and Public Services
The Russian government has broadened the list of situations where parents can use the electronic version of a child’s birth certificate stored in the Digital ID section of the MAX service. The digital document can now be presented when buying transport tickets, claiming free or discounted travel, boarding public transport, receiving medical care under OMS, visiting MFC offices, museums, cultural and sports events, and purchasing discounted tickets. The measure also covers any other services requiring proof of a minor’s identity. Use of the QR code remains voluntary, and the paper certificate continues to be valid. The service activates gradually as organizations connect their systems, with more than 3,000 hotels already integrated.
Moscow Court Places Dodo Pizza Cyberattack Suspect Denis Fridman Under House Arrest Until 2026
The Tverskoy District Court of Moscow has ordered Denis Fridman to remain under house arrest until December 8, 2026, in connection with a cyberattack on Dodo Pizza that occurred in late September. Fridman faces charges under paragraphs a and v of part 3 of Article 272.1 of the Russian Criminal Code, which covers the illegal circulation of computer information containing personal data. Investigators detained three of the four suspects after Fridman failed to mask his real IP address while accessing the stolen dataset. The breach lasted two days, but Dodo Pizza quickly blocked access and confirmed that payment details were not compromised because the company does not store them. Authorities notified Roskomnadzor of the incident and implemented measures to forcibly terminate active user sessions where necessary. House arrest remains a preventive measure, and Fridman’s guilt has not yet been established by the court.
PT AF Cloud Uses Machine Learning to Detect Shifts in Web Attack Patterns from Millions of WAF Events
Positive Technologies has detailed how its PT AF Cloud service applies anomaly detection to WAF events, turning tens of millions of daily security events into actionable weekly alerts for SOC teams. The system builds traffic profiles based on the distribution of triggered protection rules for each tenant and compares current hourly or daily profiles against a weighted historical baseline using Jensen-Shannon distance. This approach identifies meaningful changes in attack composition even when overall event volume remains stable, catching the start of scans, exploitation of newly published vulnerabilities, or post-release application changes that trigger new rules. Two detection modes operate in parallel: an hourly mode for rapid spikes and a daily mode for gradual shifts distributed across multiple hours. Alerts include comparative tables of top rules, unique attack vectors, and direct links to the relevant events in the PT AF interface. Over four weeks the detector surfaced roughly 1,100 anomalies across the cloud, with expert review confirming that 69 percent indicated either an attack or a protection misconfiguration.
AI-Powered Drainer Scams Target IT Job Seekers via Malicious Repositories and Fake Recruiters
IT hiring has become a fertile ground for drainer scams that trick candidates into running malicious code under the guise of technical interviews. Scammers pose as recruiters on job platforms, offering roles that require downloading projects from private repositories or installing browser extensions for supposed corporate tools. These attacks often lead to crypto wallet drainers stealing funds, with victims reporting losses around $2000 in documented cases. AI tools are heavily used by attackers to generate realistic job postings, LinkedIn profiles, deepfake videos for calls, and obfuscated malicious code hidden in test assignments. Candidates are advised to inspect package.json, lock files, and CI/CD configurations before any execution and to use AI assistants like Claude for static analysis without running the code. The trend has grown amid mass layoffs and economic uncertainty, turning desperate job searches into opportunities for financial theft.
How to Prepare Your Website for Data Center Outages: Business Resilience Checklist
Following strikes on Yandex data centers, many businesses discovered that their sites and all backups were stored in a single location, leading to complete outages. The article provides a detailed checklist to mitigate such risks by separating critical components across different providers. Key recommendations include moving DNS to an independent provider, lowering TTL values, maintaining a live mirror site on separate hosting, and isolating corporate email. Additional steps cover local backups, monitoring, access management, and CDN usage. The guidance differentiates between virtual hosting, VPS or dedicated servers, and website builders like Tilda, while emphasizing compliance with Russian data localization laws such as 152-FZ.
Marketplace Scraping in 2026: Why Timer-Based IP Rotation Undermines Parsers
Analysis of one full day of telemetry from MobileProxy.Space reveals how marketplace anti-fraud systems detect scrapers through session continuity and rotation patterns rather than IP reputation alone. Over 2 million IP changes were recorded across 8,878 modems, with a median of 95 unique addresses per modem. Timer-driven rotations accounted for 60.2% of all changes, and 92.2% of those intervals were exact multiples of one minute, with a median of 120 seconds. Such rigid periodicity stands out against natural mobile network behavior where address changes occur irregularly due to cell handovers or PDP context resets. The data also shows that 73.1% of address changes complete within five seconds, yet duplicate rotation commands still occur in 0.8% of link-triggered events. The recommended approach ties rotation to parser session state, recreates cookies and TLS profiles on each change, and waits for address confirmation before resuming requests.
Rostelecom Calls for 'Doomsday' Data Centers to Counter Drone Attacks and Infrastructure Risks
Rostelecom executive Valery Ermakov has urged Russian companies to build geographically distributed backup data centers, dubbed 'doomsday' facilities, to ensure service recovery after site losses. The recommendation follows drone strikes that disabled three Yandex data centers in Sasovo, Kaluga, and Vladimir, disrupting both internal services and Yandex Cloud clients. Ermakov explained that previous centralized infrastructure, built for economic efficiency, is no longer viable under changed threat models that now include physical attacks previously considered unthinkable. He advocated a micro-cellular architecture with services spread across many sites connected by high-speed links, while warning that Russian backbone networks are overloaded and much fiber optic infrastructure dates back 20-30 years. Rostelecom positioned its TEA NEXT line running from Kaliningrad to Mongolia as a source of additional capacity to address potential backbone shortages. Yandex responded to the incidents by accelerating client data migration to partner cloud providers.
Russian Firms Accelerate Cybersecurity Strategy Adoption as Risk Reduction Emerges as Top Priority
A recent AM Live broadcast survey reveals that Russian small, medium, and large companies are increasingly developing information security strategies, with the share of organizations actively working on them rising from 9% to 28% year-over-year. The primary goal cited for 2027 is risk reduction and financial loss mitigation, selected by 78% of respondents compared to 55% previously. Key barriers have shifted, with insufficient source data now affecting 64% of companies and lack of top-management buy-in rising to 43%. Experts including Yaroslav Napalkov from MTS Bank and Nikolay Kazantsev from Securitm emphasized the need for risk-oriented approaches, three-year planning horizons with annual reviews, and early engagement with CEOs and stakeholders. Only 16% of firms have fully operationalized their strategies with metrics and cyber exercises, while personnel shortages remain the leading constraint at 59%.
How to Properly Compare CDNs: TTFB, p95 Latency, Caching, DDoS Protection and True Pricing
Selecting a CDN based solely on the number of points of presence is as unreliable as choosing a car by dashboard buttons. Networks with dozens of global PoPs may underperform for audiences concentrated in Novosibirsk or Yekaterinburg, while smaller regional providers often deliver superior peering with Russian operators. The article evaluates CDNVideo, EdgeCenter, Curator, NGENIX and Yandex Cloud CDN across verifiable features, network design, caching behavior, security controls, operations and commercial models. Performance data is separated because marketing claims cannot substitute for independent measurements from services such as CDNMON. Emphasis is placed on p95 metrics, cache hit ratios, origin shielding, raw logs and API limits rather than marketing scores. The analysis shows that no single universal ranking exists; optimal choice depends on traffic profile, audience geography, security requirements and operational workflows.
Innostage Lab Benchmarks PT NGFW 1.10.3 Performance in Eight Load Scenarios
Innostage researchers conducted extensive performance testing of PT NGFW version 1.10.3, the certified release at the time of trials. The evaluation covered TCP connection setup rates, concurrent session capacity, and throughput on a custom EMIX traffic profile with varying security modules enabled. Tests used Cisco TRex generators and a high-rule-count policy of 100,000 entries to simulate realistic enterprise conditions. Results showed the device sustaining 700,000 CPS and 6.4 million concurrent connections, matching or approaching vendor claims under HA-cluster configuration. Throughput remained above 27 Gbps even with IPS, application control, antivirus, NAT, URL filtering, and logging active. The report highlights differences in test methodology compared with vendor figures, including packet sizes and clustering setup.
Java Card Tutorial: Implementing Supplementary Security Domain to Limit ISD Privileges
A detailed technical guide demonstrates how to create a Supplementary Security Domain (SSD) on Java Card platforms to isolate applet management from the Issuer Security Domain (ISD). The approach prevents full card compromise if ISD keys are exposed by restricting SSD privileges to specific functions such as accepting extradition only from the ISD. Using the FunGP library and SCP02 protocol, the tutorial walks through installation, personalization with encrypted keys, and extradition of applets under the new domain. GlobalPlatform specifications including GP CS v2.3 and GP CIC v2.0 are followed for install parameters, privileges, and STORE DATA commands. After personalization the SSD reaches the PERSONALIZED lifecycle state, allowing secure delegation of applet control while the ISD retains overall card management rights. The method eliminates the need for custom operating systems and provides a standards-compliant way to enforce least-privilege access on smart cards.
Bank Transfer Comments Such as 'Bribe' or 'To the Common Pot' Risk Triggering Compliance Reviews
Lawyer Meri Valishvili warned that casual or joking comments added to bank transfers can prompt automated compliance checks and account restrictions. Systems scan payment descriptions for terms like 'bribe', 'kickback', or 'to the common pot' without assessing humorous intent. No single public list of flagged phrases exists, as each bank independently configures its monitoring algorithms. Even routine descriptions such as 'for manicure' or 'utilities payment' may raise flags when combined with regular amounts or recurring patterns. Valishvili advises private individuals to omit unnecessary comments and to reference specific contract numbers and dates when a transfer has legal significance. For group collections, she recommends using bank-provided tools that clearly state the purpose of the payment.
CTEM Without the Hype: Understanding Gartner's Continuous Threat Exposure Management Framework
The article explains the evolution of vulnerability management from basic scheduled scanning to risk-based approaches and finally to Continuous Threat Exposure Management (CTEM). It positions CTEM as a comprehensive program introduced by Gartner in 2022 that integrates asset management, EASM, CAASM, automated pentesting, and business-context prioritization. The five-stage cycle of Scoping, Discovery, Prioritization, Validation, and Mobilization is detailed with practical examples such as protecting customer databases in an e-commerce environment. Gartner predicts organizations prioritizing CTEM will suffer three times fewer breaches by 2026, though only 16% have reached operational maturity. The piece also covers common implementation pitfalls and the emergence of the first Magic Quadrant for Exposure Assessment Platforms featuring vendors like Tenable, Qualys, and Rapid7.
Yandex Disk Data Center Incidents Leave Photos and Videos Inaccessible, Custom Recovery Tool Emerges
Following incidents at Yandex data centers in Sasovo and Vladimir, large numbers of photos and videos stored on Yandex Disk became unavailable for normal download. The company attributed the restrictions to load reduction, yet analysis indicates permanent loss of certain data clusters with no confirmed backups. Photos remain partially recoverable through lower-resolution S3 copies such as XXXL and XXL, while videos suffer from missing byte ranges that produce truncated or corrupted files. A researcher developed a specialized tool using mitmproxy to intercept browser requests and download available file variants in parallel streams. The utility also attempts block-by-block video retrieval to salvage whatever segments remain accessible. Users are warned that continued use of the tool may violate service terms and risk account suspension. The developer advises downloading data immediately rather than waiting for potential further degradation.
OIDC Configured but GitHub Actions Still Vulnerable: Megalodon and actions-cool Attacks Expose Runner Risks
Even after widespread adoption of OIDC for temporary cloud credentials in GitHub Actions, two major attacks in May 2026 demonstrated that the approach remains insufficient on its own. Attackers compromised actions-cool/issues-helper by substituting action tags to execute malicious commits that read Runner.Worker memory. The Megalodon campaign injected malicious workflows into 5,561 public repositories, harvesting environment variables, credential files, kubeconfig, SSH keys, and OIDC tokens. OIDC eliminates long-lived AWS_ACCESS_KEY_ID secrets but leaves short-lived tokens exposed inside the runner during job execution. Four mandatory protection layers are now required: strict cloud trust policies using StringEquals on the sub claim, job-level id-token: write permissions, outbound traffic controls such as Harden-Runner, and CODEOWNERS enforcement on .github/workflows/. GitHub Environments with mandatory reviewers add an essential human-approval gate that would have disrupted the Megalodon attack path.
Linus Torvalds Embraces Generative AI for Coding After Initial Skepticism
Linus Torvalds has publicly shared his evolving views on generative AI tools for programming during the Open Source Summit Europe. The Linux creator noted that AI assistance makes small personal projects more enjoyable by accelerating the path from idea to working result. He described using an AI model to modernize the outdated C-based user interface of a custom guitar pedal project. Initial AI output proved unusable until Torvalds supplied the existing implementation and clear instructions on required changes. Torvalds emphasized that AI helps newcomers achieve tangible outcomes that feel meaningful compared to professional-grade software. At the same time he urged caution when applying these tools to serious kernel development work. He also highlighted the growing burden on maintainers who must review increasing volumes of low-quality, AI-generated vulnerability reports and superficial patches.
VK Shares Rise 7.62% as Market Assesses Data Center Developments and Yandex Cloud Challenges
VK shares climbed sharply on October 12, reaching a peak increase of 7.62% to 134.2 rubles before moderating to a 6.6% gain at 132.95 rubles by evening. Analysts from Freedom Global linked the movement partly to the Ministry of Digital Development's announcement of joint measures with the Ministry of Defense to protect Russian data centers. Other observers at Finam suggested investors were pricing in potential client shifts from Yandex Cloud to competitors such as VK Cloud, which has already begun accelerated infrastructure placement for affected Yandex customers. The surge was also attributed to broader capital rotation away from the energy sector toward previously lagging technology stocks. While the confirmed price movement is clear, the exact drivers remain analytical interpretations rather than verified revenue impacts. The episode highlights how regulatory and infrastructure news can quickly influence valuations in the Russian cloud services market.
How to Secure Your Gosuslugi Account Against Hacks and Recover Access After Takeover
Russia's Gosuslugi portal now holds far more than basic documents, including tax notifications, child records, data-sharing consents, and access to other government services, making account security critical. The guide stresses using a unique strong password, enabling two-factor authentication with TOTP or biometrics instead of SMS, and regularly reviewing active sessions and connected mobile apps. It details steps to add a trusted contact for recovery, audit consents granted to third parties, and monitor for unauthorized logins or statements. In case of suspicious codes or calls, users must never share verification codes and should immediately check actions in the system, revoke unknown consents, and contact support. If access is lost, recovery options include online password reset with passport data or in-person visits to service centers, followed by credit history checks and self-imposed credit bans via Gosuslugi starting March 2025. The advice also covers protecting the linked phone number and email to prevent SIM swaps and further fraud.
GitHub Repo Trap with 1774 Stars Mimics Microsoft Activation Scripts to Deliver Malware via Telegram Bot
A security researcher built a Telegram bot that daily delivers five trending GitHub repositories from trendshift.io along with README summaries. One repository named Microsoft Activation Scripts contained only a README with a reversed PowerShell command that decoded to download and execute a payload from a lookalike domain. The account was created 94 seconds before the repository and used classic one-liner installation syntax to blend with legitimate projects. Analysis of 321 trending repositories showed that simple filters such as recent account age or irm|iex patterns would incorrectly flag many legitimate projects including codex and opencode. Two independent detection rules were developed: one that normalizes and scans for obfuscated execution commands including base64, mshta, certutil and hidden window flags, and another that flags one-time owners created less than 30 days before the repository with under 10 KB of content. An additional groundedness check using the AIHOT method prevents DeepSeek from inserting unverified claims such as Ruby or Cypress into repository summaries.
Hacker or Engineer? Reconstructing Attack Chains in Industrial OT Networks
Positive Technologies expert Anton Kutepov presents a detailed educational scenario from the Standoff online polygon to demonstrate how security teams can trace an attack from initial perimeter compromise to unauthorized writes on a PLC. The case begins with an unexpected SCADA server command to a hydrocracking unit controller outside the maintenance window. By correlating network traffic, endpoint telemetry, authentication logs, and asset context, analysts reconstruct the full path: exploitation of a vulnerable DMZ system, lateral movement via Kerberoasting and Active Directory certificate abuse, RDP access to an engineering workstation, and finally weakening of Windows Defender on the SCADA server before issuing the control command. The analysis shows that a single permitted industrial protocol operation becomes suspicious only when placed in the context of prior defensive control changes and anomalous access routes. The article stresses that protecting OT environments requires continuous asset inventory, unified telemetry from traffic and endpoints, and pre-approved response playbooks that avoid disrupting the physical process.
Russia Sets 2030 Deadline to Deliver LTE Internet to Small Settlements
The Russian Ministry of Digital Development has outlined a timeline to provide mobile LTE internet access to small settlements with populations between 100 and 1,000 people by the end of 2030. Minister Maksut Shadaev stated in the State Duma that the next major milestone involves connecting an additional 1,800 settlements by 2027. Over the past six years, LTE service has already reached more than 8,000 such localities through the ongoing federal program. The initiative focuses on building the necessary mobile infrastructure rather than guaranteeing signal coverage at every geographic point. Residents in these areas are expected to gain reliable access to standard digital services without needing to search for optimal signal locations. Progress will be measured by actual deployed infrastructure and operational connectivity at the 2027 checkpoint.
Russian Woman Fined 15,000 Rubles for ChatGPT-Generated Bear Image That Sparked Police Hunt
A resident of Magdagachi in Russia's Amur region used ChatGPT to add a bear to a photo of Krasnoarmeyskaya street as a prank on her friend. The realistic image spread through messengers, prompting residents to alert police and sending hunters with equipment to search for the nonexistent animal. The incident reached the district head, causing widespread fear, with one local resident too afraid to leave home or visit the store. The woman later confessed to police that the image was AI-generated, admitted guilt in court under part 9 of article 13.15 of the Russian Code of Administrative Offenses, and received a reduced fine of 15,000 rubles due to her remorse and first offense. Her iPhone 15 was not confiscated after she explained its necessity for work. This marks the second similar case involving AI-generated bears, following a 30,000-ruble fine and iPhone 11 confiscation in Duldurga, Zabaykalye region, in September.
Molniya Messenger Debuts in RuStore as Paid Alternative with End-to-End Encryption
Russian company Red Soft and Chinese partner Passion Tech have released the Molniya messenger on the RuStore platform. The Android application requires a one-time payment of 750 rubles with no additional in-app purchases. Key features include personal and group chats, audio and video calls, channels, a social feed, and short videos, all protected by default end-to-end encryption. Users can send files up to 4 GB, organize up to 30 chat folders, pin 15 conversations or channels, and subscribe to as many as 1,000 channels. The developers aim to reach 15 million users within 18 months after launch. The project was originally scheduled for early 2026 but became available earlier than planned.
Enthusiasts Bring Xbox Cloud Gaming and Native Windows Titles to PlayStation 5 via Homebrew
Homebrew developers have created two separate projects that expand the capabilities of modified PlayStation 5 consoles. The first project, PSBox Cloud Gaming by RafaelNGP, turns the console into a client for Microsoft’s Xbox Cloud Gaming service, streaming games at 1080p and 60 frames per second while supporting full DualSense features. The second project, prospero-win, uses Wine and compatibility layers to run Windows games locally on the PS5 hardware. Reported performance includes Half-Life 2 at high settings and 60 FPS, GTA IV at approximately 55 FPS in open-world areas at 1080p, and older titles such as Counter-Strike 1.6 and Warcraft III exceeding 60 FPS. Both projects require a console capable of running unofficial software and, for cloud gaming, a Game Pass Ultimate subscription for most of the library. The work remains experimental and depends on individual game compatibility.
Locally Downloaded AI Models and LoRA Adapters Can Steal Passwords, Keys and Funds
Security researcher working on distributed multimodal AI systems warns that locally run models and community-shared LoRA adapters cannot be trusted by default. The post highlights concrete risks of credential theft, private key extraction and financial loss that go beyond theoretical concerns. As the number of downloaded models, fine-tuned adapters and compute nodes grows, the attack surface expands significantly. Malicious or compromised components can silently exfiltrate sensitive data without obvious signs during normal operation. The author draws from personal experience and published research to illustrate these threats in practical scenarios involving local AI deployments.
Yandex Data Center Attacks Trigger Outages, Cloud Disruptions and Stock Decline
A series of physical attacks has disabled or partially damaged multiple Yandex data centers in Russia, leading to prolonged service outages across cloud and consumer platforms. Fires and power failures struck facilities in Sasovo, Kaluga and Vladimir between 8 and 11 October, forcing the company to shift workloads to the remaining Mytishchi site. Analysts from Finam, Rikom-Trust and Freedom Global note that recovery timelines now stretch from several months to two years for specialized hardware such as supercomputers. The incidents have already erased nearly 9 percent of Yandex share value and raised concerns over future capital expenditure, client retention in Yandex Cloud and potential sanctions complications for overseas expansion. Experts emphasize that the attacks have moved from isolated technical failures to a systemic business-continuity and investment-risk issue.
MegaFon Reports 34% Rise in Russian Mobile Malware Infections Driven by Android Trojans
MegaFon monitoring data shows a 34% year-over-year increase in Russian users with detected mobile malware during summer 2026, with the sharpest spike of 77% recorded in August. The growth is primarily attributed to Android trojans capable of installing apps without user consent, intercepting notifications, enabling remote access, and stealing personal data. At the same time, blocked suspicious calls dropped significantly, by 31% in June, 41% in July, and 75% in August, which the operator links to state and corporate anti-fraud measures. Scammers are adapting by hijacking messenger accounts through social engineering, malware, and even rental schemes, often combining calls with fake app installations that deploy spyware. Phishing remains active, with 30% of detected malicious resources tied to investments and crypto, 21% to social networks and messengers, and 9% to harmful APK files. Director Sergey Khrenov noted that smartphones are increasingly used as tools by the attackers themselves in these hybrid schemes.
Cyber Attack on Danfoss Systems Forces Defrost in 250 French Supermarkets, Spoiling Stock
Hackers compromised refrigeration control systems supplied by Danfoss in French supermarket chains Intermarché and Coopérative U, activating continuous defrost cycles that raised temperatures to 50 °C. The sabotage affected between 150 and 200 Intermarché stores and nearly 100 Coopérative U locations, forcing retailers to discard large quantities of fresh and frozen goods. French authorities confirmed the incidents, with the Paris prosecutor’s office opening an investigation after reports of associated fires. The attackers exploited the normal maintenance function of the Danfoss equipment, turning brief defrost cycles into prolonged warming that broke the cold chain. Coopérative U chairman Dominique Schelcher described the event as unprecedented and stated that technical teams are working with refrigeration specialists to restore operations. No group has claimed responsibility, and investigators continue to examine the initial access vector. The incident illustrates how manipulation of industrial control systems can produce immediate physical and financial damage without traditional data theft or encryption.
Reflective DLL Injection: How Malware Executes DLLs Directly in Memory Without Disk Files
Reflective DLL Injection allows malicious code to load and execute a DLL entirely in memory, bypassing traditional file-based loading mechanisms on Windows. The technique uses a custom loader inside the DLL itself to handle PE format parsing, relocations, imports, TLS, and exception handling without calling LoadLibrary. Unlike standard loading, the resulting module often resides in MEM_PRIVATE regions and does not appear in conventional module lists, complicating forensic analysis. Tools such as Meterpreter and Cobalt Strike have historically employed reflective loaders, though Beacon Object Files represent a different COFF-based approach. Investigators must examine memory regions, thread start addresses, and Sysmon events 7, 8, and 10 rather than relying solely on file artifacts. The method does not bypass DEP, Arbitrary Code Guard, or access-control restrictions and leaves detectable traces when combined with behavioral indicators. Proper detection requires correlating private executable memory with process behavior and avoiding over-reliance on simplified signatures.
Scammers Impersonate Social Fund to Threaten Child Benefit Cancellation and Steal Savings
Fraudsters have launched a new social engineering campaign targeting parents by impersonating officials from Russia's Social Fund. Callers claim that suspicious transfers have been detected on family accounts and threaten the cancellation of child benefits unless savings are moved to a special transit account. The scheme relies on fabricated rules about income assessment and uses the promise of an 'unreported' account to trick victims into sending money. The Narodny Front's Moshelovka platform, cited by RIA Novosti, confirms that the Social Fund never requests transfers to third-party accounts for benefit verification. Families are instructed to check official notifications exclusively through Gosuslugi or by visiting an SFR office in person. Authentication codes from government services or banking apps must never be shared over the phone.
Positive Technologies to Explore AI Attacks and Autonomous SOC Advances at PSD 2026
Positive Technologies will host Positive Security Day 2026 in Moscow on October 15-16, focusing on how artificial intelligence is reshaping cybersecurity. The event will highlight new product developments in MaxPatrol O2 and the company's push toward an autonomous SOC. Attendees will examine Security Lakehouse as a method for handling large volumes of security data to train models. Practical sessions will allow participants to attack AI technologies, investigate incidents, and disassemble products with engineers. The business program will address how organizations can automate security without creating new risks that require manual explanations after incidents. The conference takes place at the Mechta complex in Gorky Park and offers both in-person and online participation.
Passphrases vs. Leetspeak Passwords: Why Four Random Words Outperform P@ssw0rd!2026
The article explains why a passphrase made of four randomly selected words provides far greater resistance to offline attacks than a complex-looking password constructed with substitutions and appended symbols. It details how password strength is measured in bits of entropy rather than visual complexity, showing that four words drawn from a 50,000-word list yield approximately 62 bits while common leetspeak transformations add almost none. The piece contrasts fast legacy hashing with modern slow algorithms such as Argon2 and emphasizes the protective effect of per-password salting. It criticizes registration forms that reward predictable patterns and highlights NIST guidance favoring length over mandatory character rotation. The author recommends diceware-style generation for master passwords and password managers for everything else, noting that passkeys ultimately eliminate the need for memorizable secrets altogether.
Yandex Cloud Cascade Failure October 2026 Exposes Multi-AZ Limits and Capacity Exhaustion Risks
In October 2026, Yandex Cloud suffered a prolonged cascade outage across multiple data centers in Sасово, Калуга, and Владимир, triggered by power failures and a drone-related fire that fully disabled the ru-central1-b zone. The incident revealed that standard Multi-AZ designs reach physical capacity exhaustion when multiple zones fail simultaneously, leaving insufficient resources in remaining zones for automatic failover. Businesses relying on managed Kubernetes, databases, and SaaS platforms such as Salebot and CIAN experienced extended recovery times, with backups becoming inaccessible and RTO stretching beyond 24 hours due to index rebuilds and manual quota allocation. Yandex Cloud responded by manually distributing quotas, partnering with Selectel, K2Cloud, and VK Cloud for emergency capacity, and advising clients to activate external disaster recovery plans. The outage also highlighted single points of failure in DDoS protection configurations and Control Plane dependencies that prevented timely migration of master nodes. Architectural recommendations include deploying independent edge webhook buffers using FastAPI on separate VDS instances to preserve incoming events during primary backend failures. Overall, the events underscore the necessity of true multi-cloud strategies that avoid reliance on any single provider's IAM, billing, and physical infrastructure.
Developer Spends $9,000 on AI Agents to Build Crossweft Tool for Enforcing Multi-Language Component Agreements
A software developer creating a Photoshop plugin with local neural networks spent over $9,000 on AI coding agents including Claude Code and Codex while building ten layers of security across C++ and Go components. The project required managing 54 inter-component seams with 188 value comparisons and 105 set comparisons that compilers could not verify across languages. After repeated failures where agents updated one side of an interface without touching the other, the developer created Crossweft, an open-source tool that maps seams in JSON and enforces them with join, set, and pair guards. The system uses anchors to code literals, meta-runners that reject silent-zero validators, and hooks that force agents to reconcile both sides before committing. Crossweft now provides MCP integration and plugins for major coding agents, turning manual memory-based contracts into automatically checked deterministic sensors.
From HFT to Infosec: How AI Accelerates the Developer-Hacker Arms Race
An experienced security researcher draws a parallel between high-frequency trading evolution and modern vulnerability research, showing how artificial intelligence compresses the time between patch release and working exploit. The author describes the classic workflow where developer Rob fixes buffer overflows in an FTP server while researcher Dave reverse-engineers the diff to locate the exact change. With AI assistance, both sides now generate patches or exploits in minutes rather than days or weeks. The piece highlights that publishing a patch effectively discloses the location of the flaw, allowing automated tools to produce reliable exploits almost instantly. Historical examples such as wu-ftpd CVEs and the EternalBlue/MS17-010 worm illustrate how quickly mass exploitation follows disclosure. The author warns that open-source projects face an existential dilemma: withhold patches and leave users exposed, or release them and trigger immediate automated scanning. Recommendations include mandatory back-porting of fixes and wider use of runtime protections, yet the overall outlook remains pessimistic about the coming wave of fully automated attacks.
Building the Foundation of Digital Trust: Why Identity Security Remains Undervalued
Identity Security is presented as one of the most underestimated pillars of cybersecurity because granting access involves trusting individuals with sensitive information and systems. The article examines the deep intersection of IT and security functions, the costs of manual access errors, and the need to align business processes with technical controls. It references a 2026 Identity Conf study showing 43.5% of organizations experienced errors in manual rights assignment and 33.5% left access for former employees. Recommendations draw on NIST Human-Centered Cybersecurity concepts, SP 800-53, and Russian FSTEC Order No. 117 to design lifecycle processes covering account provisioning, privilege reviews, and continuous monitoring. Models such as RBAC and ABAC are discussed alongside IGA and IdM solutions to ensure business permissions map correctly to application rights. The piece stresses that successful projects require joint IT and security efforts from the initial survey through pilot and acceptance phases while measuring both risk reduction and operational efficiency.
Passkeys in Production: How One Developer Replaced Passwords with Face ID in Three Days Using FastAPI and Next.js
Yaroslav Morozov details a complete production implementation of Passkeys based on the WebAuthn standard and FIDO2 protocols. The article explains why Passkeys eliminate phishing and database breach risks compared to traditional passwords while providing biometric login via Face ID or Touch ID. It covers database schema design with PostgreSQL tables for credentials and challenges, SQLAlchemy models, and minimal dependencies including py-webauthn on the backend and SimpleWebAuthn on the frontend. Full working code for registration and authentication flows is provided, showing how Passkeys integrate with existing JWT token systems without major refactoring. The guide includes environment configuration, error handling, challenge management with five-minute TTL, and security considerations such as sign count verification to detect cloned keys.
Leaked DarkSword iOS Exploit Chain 'P7' Now Steals Crypto Wallet Seeds and Keystores
A third build of the P7 variant of the leaked DarkSword iOS exploit chain has been identified, featuring a new lure site themed around Chinese online casinos and a fresh command server. The chain exploits six vulnerabilities, including three zero-days, to deploy an implant that decrypts the keychain directly on the device and extracts seed phrases from wallets such as imToken, Trust Wallet, and Phantom. Unlike the original GHOSTBLADE, P7 rewrites the C2 agent to focus exclusively on wallet data while retaining the core TaskRop and MIG-filter bypass modules. Passive analysis of public sources also uncovered the long-running 'qqtime' delivery cluster that pairs DarkSword with the older Coruna chain for broader iOS coverage. The operator uses channel codes to support multiple affiliate distributors and employs an AppleKeyStore oracle to decrypt keychain items locally before exfiltration.
Yandex Disk Files Become Partially Inaccessible After Sasovo Data Center Incident
A detailed user report reveals that approximately one percent of files stored on Yandex Disk are currently unavailable for download following reported incidents at the Sasovo data center. The problems manifest in three distinct states: missing thumbnails with downloadable originals, visible thumbnails with inaccessible originals returning 504 Gateway Time-out errors, and cases where both thumbnails and originals fail to load. Technical analysis using curl requests traced the failures to specific storage nodes such as s418klg.storage.yandex.net, indicating that some data shards may reside in affected infrastructure while others remain operational. Yandex support requested original files for diagnosis but closed the ticket without providing an official explanation or confirming data integrity. The author emphasizes that the issue affects files across both the Photos and Files sections and recommends maintaining offline backups due to the lack of guaranteed availability during data center failures.
ONYX 2.0 Removes Central Servers for Fully Decentralized Tor-Based Messaging and Calls
ONYX 2.0-beta marks a major shift from its previously centralized design to a serverless architecture that relies entirely on Tor for all communications. Each user account is now represented solely by a cryptographic key pair generated on first launch, with recovery handled through a 12-word seed phrase. Devices connect directly via onion services, and the application bundles its own Tor daemon on desktop platforms while using tor-android on mobile devices. Voice calls are supported through an embedded local TURN server, delivering acceptable quality with 1-3 second latency despite the anonymity overhead. Message delivery now depends on recipient availability, with undelivered messages stored locally on the sender and retried automatically. The update deliberately removes features such as HTTP or SOCKS5 proxies and link previews to prevent IP leaks or external traffic. Developers released the beta to gather feedback on stability across network changes and multi-device scenarios.
Privacy-Focused Browser Tool Compresses PDFs Locally Without Uploading Sensitive Documents
A developer created a PDF compression tool that runs entirely inside the browser to protect sensitive personal and professional documents from third-party servers. The solution addresses repeated situations where embassy submissions, financial presentations, contracts, and internal reports exceeded size limits, forcing users to choose between installing desktop software or risking data exposure through online services. The tool reduces scanned and photographic PDFs by 66 to 97 percent depending on quality settings while honestly reporting weaker performance on text-heavy files compared with Ghostscript. It works on both desktop and mobile platforms, including iPhone and Android, requires no installation, and continues functioning offline after the first page load. On mobile devices the application respects memory constraints by limiting images to four megapixels, preserving readability for A4 documents intended for printing. The project originated from a single evening script built around Ghostscript and evolved into a full web application after similar compression needs recurred across multiple devices and locations.
Debate on Cyber Risks of Open-Weight AI Models Is Fundamentally Flawed
An experienced commentator argues that the ongoing debate over cyber risks posed by open-weight AI models rests on flawed assumptions and risks leading to counterproductive policy decisions. The piece identifies three main camps: frontier labs and U.S. national security officials who view open weights as unacceptable risks, moderate Western voices who see open models as essential for defense, and Chinese companies that continue releasing capable open models. It criticizes reports such as Anthropic’s analysis of GLM-5.3 for failing to address broader ecosystem consequences of bans. Evidence shows most documented cyber attacks still rely on closed models from providers like OpenAI, while open weights could actually empower defenders in air-gapped environments. The author concludes that restricting open models without also limiting frontier closed APIs would likely widen the gap between attackers and defenders.
Ghost Assets in Vulnerability Management: How Identification, Merging and Asset History Eliminate Anomalies in MaxPatrol VM
Positive Technologies experts explain how infrastructure changes create duplicate, merged and phantom assets that distort vulnerability management. The article details three core mechanisms inside MaxPatrol VM: unique asset identification across scan sources, non-destructive merging of new and existing data, and full lifecycle history with configurable aging policies. It describes how the system distinguishes assets using prioritized keys such as system ID, FQDN, MAC address and VM ID, then applies recursive merging rules that respect multiple data sources. Policies allow teams to set freshness and obsolescence thresholds, automatically hiding assets after 90 days while preserving historical snapshots for PDQL queries. The piece also covers practical cloning and partial-scan scenarios that can produce misleading duplicates or lingering collections.
Keurig K-Supreme Smart Coffee Maker Generates Nearly 1 TB of Outbound Traffic in Ten Days
A Keurig K-Supreme Smart coffee maker unexpectedly produced around 1008 GB of outgoing traffic over ten days, overwhelming a home UniFi access point while generating only 9.94 GB of inbound data. The device had been placed on a separate network segment, yet the traffic remained largely internal to the home LAN rather than traversing the internet connection. The anomaly was discovered by user Nomad while assisting family members with network maintenance through the UniFi dashboard. After the coffee maker was powered off, the issue could not be reproduced in subsequent testing, and no packet captures were available to determine the content or root cause of the traffic. The model requires internet connectivity for remote control, scheduling, capsule recognition, and automatic reordering of coffee supplies. No similar incidents have been reported by other users, and the manufacturer has not issued any statement regarding the event.
VK Files Lawsuit in EU Court Seeking to Overturn Sanctions Imposed in July
Russian internet company VK has submitted a formal challenge to the European Union's sanctions regime by filing a case with the Court of Justice of the European Union. The company argues that the restrictions placed on VK and its subsidiary Communication Platform LLC are both unjustified and unlawful. The lawsuit, registered under case number T-664/26 on 7 October, directly contests the July sanctions that targeted the developer of the MAX messenger. Earlier restrictions had already led to the removal of multiple VK ecosystem applications from Apple App Store and Google Play, forcing users toward alternative distribution channels such as RuStore, Huawei AppGallery, Samsung Galaxy Store and Xiaomi GetApps. While installed Android applications continue to function and receive updates, iOS users face disrupted push notifications after the apps were delisted. The legal action itself does not automatically restore app availability in the affected stores.
Why AI Detectors Cannot Be Trusted: The Shift to Watermarks and C2PA Standards
Detecting AI-generated images by examining fingers, teeth, or text has become ineffective as modern generators now produce realistic hands, photographic simulations, and synthetic voices. Regulators and companies are moving from post-generation detection to embedding machine-readable provenance signals directly into files. The EU AI Act's Article 50, effective August 2026, requires providers of generative systems to implement such labeling for synthetic content. Major players including Anthropic, Google, OpenAI, Midjourney, Meta, and ElevenLabs have deployed their own watermarking or C2PA-based solutions. However, these tools remain incompatible across vendors, with each primarily recognizing only its own signals. Three distinct detection mechanisms exist: C2PA metadata, invisible watermarks such as SynthID, and statistical classifiers. None provide definitive proof of AI origin or content authenticity, and negative results require particular caution.
Hash Functions Part 1: Core Properties, Security Requirements and Practical Applications
The article provides a detailed introduction to hash functions, explaining how they map arbitrary-length input to fixed-length output while satisfying three fundamental security properties. It covers preimage resistance, second preimage resistance, and collision resistance, along with the avalanche effect that makes even minor input changes produce unrecognizable output. The text explains why a 256-bit digest is required to achieve 128-bit collision resistance, referencing the birthday paradox and its implications for MD5 and SHA-1. Practical guidance includes using OpenSSL for hashing, applying hashes in commitment schemes, enforcing subresource integrity on web pages, and securely storing passwords with Argon2 and bcrypt. The post emphasizes that hash functions alone do not guarantee integrity without proper transmission of the digest and announces a follow-up on SHA-2 and SHA-3 internals.
Digital Twins Enable Pre-Deployment Testing and Post-Change Control in Complex Multi-Vendor Networks
UserGate and Hadal Project experts presented a joint approach at Saint HighLoad++ that combines physical labs, emulation, and simulation into a single lifecycle for validating network changes. The method addresses recurring failures such as IPsec tunnel outages after routine software updates that pass vendor checks yet break branch connectivity. Three complexity sources—multi-vendor environments, historical configuration debt, and continuous dynamic updates—are mitigated by maintaining an always-current network model. Physical laboratories provide hardware-level accuracy for critical devices, while uInfraTwin emulation allows rapid, repeatable testing of configuration scenarios with traffic generators. Simulation tools including Batfish, Hadal, Forward Networks, and IP Fabric deliver end-to-end reachability analysis across tens of thousands of nodes without sending test traffic on production networks. The integrated digital twin continuously updates from live infrastructure, feeds selected segments into safe test environments, and verifies policy compliance after deployment.
Positive Technologies Releases MaxPatrol SIEM 28.0 with Major Resource Optimizations and AI Enhancements
Positive Technologies has launched MaxPatrol SIEM 28.0, enabling security operations centers to process significantly more security events without requiring additional hardware. Internal tests show the new version consumes up to 26% less CPU and 52% less RAM compared to the previous release. Optimized components for event processing and data storage now allow the system to handle 40,000 events per second instead of 20,000 on comparable servers. The architecture has been refined so that unnecessary roles can be omitted when MaxPatrol SIEM operates independently from other platform products such as MaxPatrol VM. The behavioral analysis module MaxPatrol BAD received the new HackTracker component, which detects attackers by behavior patterns rather than only by tools, and now supports Unix event analysis with linked activity chains. The PT Naira AI assistant has been simplified for easier configuration, helping analysts write normalization rules, explain events, and search documentation, with claims of reducing investigation time by up to 50% and rule creation effort by up to 90%. Analysts also benefit from added context in correlation rule cards, quick navigation links, and a native dark theme.