Upcoming Speaking Engagements

Post Syndicated from Bruce Schneier original https://www.schneier.com/blog/archives/2026/02/upcoming-speaking-engagements-53.html

This is a current list of where and when I am scheduled to speak:

  • I’m speaking at Ontario Tech University in Oshawa, Ontario, Canada, at 2 PM ET on Thursday, February 26, 2026.
  • I’m speaking at the Personal AI Summit in Los Angeles, California, USA, on Thursday, March 5, 2026.
  • I’m speaking at Tech Live: Cybersecurity in New York City, USA, on Wednesday, March 11, 2026.
  • I’m giving the Ross Anderson Lecture at the University of Cambridge’s Churchill College at 5:30 PM GMT on Thursday, March 19, 2026.
  • I’m speaking at RSAC 2026 in San Francisco, California, USA, on Wednesday, March 25, 2026.

The list is maintained on this page.

This Silicom P3IMB-M-P2 is a Neat Intel ACC100 Card We Take a Quick Look

Post Syndicated from Patrick Kennedy original https://www.servethehome.com/this-silicom-p3imb-m-p2-is-a-neat-intel-acc100-card-we-take-a-quick-look/

We take a look at the Silicom P3IMB-M-P2. This is an Intel ACC100 card based on eASIC to accelerate a very specific workload

The post This Silicom P3IMB-M-P2 is a Neat Intel ACC100 Card We Take a Quick Look appeared first on ServeTheHome.

Vim 9.2 released

Post Syndicated from corbet original https://lwn.net/Articles/1058744/

Version 9.2 of the
Vim text editor has been released. “Vim 9.2 brings significant
enhancements to the Vim9 scripting language, improved diff mode,
comprehensive completion features, and platform-specific improvements
including experimental Wayland support.
” Also included is a new
interactive tutor mode.

Седмицата (9–14 февруари)

Post Syndicated from Светла Енчева original https://www.toest.bg/sedmitsata-9-14-fevruari/

Седмицата (9–14 февруари)

Бих искала да започна оптимистично. От миналата седмица до тази се случиха поне две изненадващи в позитивен смисъл събития. На 7 февруари за председател на БСП беше избран Крум Зарков. Дали той ще допринесе Столетницата да заприлича поне малко на европейска лява партия (и има ли такива намерения изобщо), или ще бъде изкупителна жертва за провала ѝ, още не знаем. Президентката пък посочи Андрей Гюров за служебен премиер – единствения от „домовата книга“, който не е по един или друг начин свързан с ГЕРБ и/или Пеевски.

На избора на Гюров е посветен и тазседмичният политически коментар на Емилия Милчева. Според нея новият служебен премиер трябва да предприеме три важни стъпки: да предложи правосъден министър, който да се заеме със смяната на узурпиралия поста на главния прокурор Борислав Сарафов, да сложи малко ред в МВР и службите и да реагира адекватно на трагедията „Петрохан“.

Три стъпки на Андрей Гюров
Служебният премиер по дефиниция е временна фигура. В българската политика обаче временните роли често се оказват съдбоносни. Андрей Гюров влиза в кабинета с биография, висящ казус и очаквания. Въпросът е дали ще управлява процеси, или ще трупа още напрежение. От Емилия Милчева.
Седмицата (9–14 февруари)

Изборът на Гюров дава надежда за по-честни избори (от каквито има сметка и доскорошният президент Румен Радев), но пък всякакви реални и имагинерни негативи ще се лепят на ПП–ДБ. Като написах последните думи на предишното изречение, естествено, се сетих за трагедията при Петрохан и Околчица. И се замислих за двойните стандарти.

Случаят се използва за демонизиране на ПП–ДБ и призиви за оставка на кмета на София Васил Терзиев, защото е бил дарител на организацията на Ивайло Калушев, без да има данни някой, свързан с коалицията, да е знаел за случаи на секс с непълнолетни в групата около Калушев (но пък има данни ДАНС да е назнайвала нещо).

Впрочем какво става с делото за сексуалното посегателство върху 4-годишно момиченце на учителка в детската градина в Каблешково? Припомням, че кметът на Поморие Иван Алексиев – от ГЕРБ – публично защити учителката и обвини родителите ѝ, след като вече имаше достатъчно смущаващи данни за възможно насилие. Прави ли ви впечатление, че този скандал не се лепна на ГЕРБ, а потъна?

Всички сме зациклили около случая „Петрохан“, но кой, ако не Павлина Върбанова ще погледне на темата езиковедски? Замисляте ли се, че хижата е „Петрохан“ – с кавички, а проходът – Петрохан? А (което изглежда още по-странно) гара Подуяне и автогара „Подуяне“? Павлина разяснява някои от чудатите правила за поставяне и непоставяне на кавички.

В тесния проход на кавичките
Любимите на много от нас кавички не са пунктуационна брошка, с която да закичим текстовете си, когато и където ни скимне. Тази седмица Павлина Върбанова строго и методично ни превежда през тесния и често пъти мъглив проход на решението кога да ги забодем на словесния ревер.
Седмицата (9–14 февруари)

Понеже и аз още цикля на петроханската тема, се връщам към проблема за двойните стандарти. Разбрахме, че будизмът и „сектите“ са много страшни. А в затворени християнски общности няма ли сексуална злоупотреба с деца? Католическата църква поне се опитва да поеме някаква отговорност за дългогодишните практики на сексуално насилие върху малолетни и непълнолетни.

За случващото се в Българската православна църква не се знае много. Но през 2009 г. величкият епископ Сионий напусна Семинарията в София, на която е ректор, след като родител на ученик в духовното училище е подал срещу него сигнал за сексуална злоупотреба с момчето. На Сионий не само му се даде думата да се защитава в медиите. През 2014 г. националисти, със специалното съдействие на Мартин Карбовски, „прочистиха“, по собствените им думи, Троянския манастир от „хомосексуалисти“. Кой беше новият игумен на манастира, съдействал за „прочистването“? Сионий. Въпреки че срещу него има и друго свидетелство за сексуални посегателства, той не само не е разследван или поне отстранен, ами между 2019 и 2025 г. е единственият духовник в БПЦ досега, който е игумен не на един, а на два манастира наведнъж.

За да отсяваме зърното от плявата, имаме нужда от качествена журналистика. В първата си статия за „Тоест“ Дарина Сарелска обяснява защо тя е дефицитна в България. Разказът ѝ е суров, ненапудрен, безрадостен и според мен – задължителен за четене. С нетърпение очаквам следващите ѝ публикации.

„Няма места.“ Журналистиката след журналистите
Ако се чудите какво стана с медиите в България, този текст ви е напълно достатъчен, за да си дадете отговори на много въпроси. А иначе, вие въпроси може и да си задавате, но в много медии у нас вече няма кой да ги задава – гледайте какво нещо… Защо стана така – от Дарина Сарелска.
Седмицата (9–14 февруари)

В настоящата ситуация на информационни плаващи пясъци опирането на науката е все по-голяма рядкост. Гледахте ли разговора на Владислав Севов с автора на рубриката „Научни новини“ в „Тоест“ Михаил Ангелов? Ако не, може да наваксате:

Освен че не е любител на науката, Доналд Тръмп е и враг на всичко, което не му изнася, и вместо неудобни факти предпочита да вижда фалшива реалност. В новия брой на бюлетина си „Гласовете на Америка“ Йоанна Елми разказва за измеренията, до които стига паралелната реалност на властта в САЩ.

Гласовете на Америка – брой 12
Когато новините идват като картечен откос, човек започва да се чуди това новини ли са, или организирана подмяна на реалността. Йоанна Елми с нещо като хроника на ускорението в месечния бюлетин, посветен на Америка.
Седмицата (9–14 февруари)

В рамките на година една широко разпространена дума се обезсмисли, или поне значението ѝ силно се стесни. Това е прилагателното име „евроатлантически“. Променените позиции на САЩ по отношение на международната сигурност поставят ЕС пред изпитание. Според Анахит Хачикян отношенията между доскорошните близки съюзници може да се сравнят със заглавието на песента на Серж Генсбур и Джейн Бъркин Je t’aime… moi non plus.

ЕС и САЩ: Je t’aime… moi non plus
Отношенията между ЕС и САЩ, видени през погледа на Анахит Хачикян, все повече навяват асоциации за заглавието на песента на Серж Генсбур и Джейн Бъркин Je t’aime… moi non plus – игра на думи, която може да се преведе като „Обичам те… аз теб също/вече не“. Къде ще е България в новата реалност?
Седмицата (9–14 февруари)

И като минахме на любовна вълна – днес е Свети Валентин. Докато се чудя с каква песен да ви поздравя по този повод, се замислих, че има и хора, които нямат какво или с кого да празнуват, както и такива, които просто не харесват този празник. Затова се опитах да подбера за всеки по нещо (е, почти за всеки, защото – по Толстой – всеки е нещастен посвоему):

Ако сте с разбито сърце – любовта убива, пее Фреди Меркюри в саундтрака на Джорджо Мородер към филма на Фриц Ланг „Метрополис“. Ако точно днес любимият ви човек не е с вас, на помощ идват Love с песен за самотата във връзката. Но ето, Глория Гейнър се притичва, за да ни напомни, че раздялата може да се преживее. А духът на Мишел Фуко, въплътен в Майли Сайръс, ни обръща внимание колко важна е любовта към себе си.

Ако пък днес празнувате и вярвате в щастливата любов, Lovesong на The Cure е точно за вас. Робърт Смит я е посветил на годеницата си Мери в края на 80-те. Двамата се запознават на 14-годишна възраст, значи някъде около 1973-та, и вече повече от 50 години са заедно.

А може би не зачитате Свети Валентин, а Трифон Зарезан. И лирическият герой на Lovestruck на Madness обича чашката, което води до… влюбване в улична лампа. В случай че до никаква любов не ви е – кой може да изпее по-нелюбовна песен от Джони Ротън?

Ако искате да изслушате всички тези песни, подредила съм ви ги в плейлист:

Пък ако обичате „Тоест“ и ни подкрепите с месечно дарение, ще ни помогнете да продължаваме да ви отвръщаме със същото.

Modernizing Prometheus: Native Storage for Composite Types

Post Syndicated from Bartłomiej Płotka (@bwplotka) original https://prometheus.io/blog/2026/02/14/modernizing-prometheus-composite-samples/

Over the last year, the Prometheus community has been working hard on several interesting and ambitious changes that previously would have been seen as controversial or not feasible. While there might be little visibility about those from the outside (e.g., it’s not an OpenClaw Prometheus plugin, sorry 🙃), Prometheus developers are, organically, steering Prometheus into a certain, coherent future. Piece by piece, we unexpectedly get closer to goals we never dreamed we would achieve as an open-source project!

This post starts (hopefully!) as a series of blog posts that share a few ambitious shifts that might be exciting to new and existing Prometheus users and developers. In this post, I’d love to focus on the idea of native storage for the composite types which is tidying up a lot of challenges that piled up over time. Make sure to check the provided inlined links on how you can adopt some of those changes early or contribute!

CAUTION: Disclaimer: This post is intended as a fun overview, from my own personal point of view as a Prometheus maintainer. Some of the mentioned changes haven’t been (yet) officially approved by the Prometheus Team; some of them were not proved in production.

NOTE: This post was written by humans; AI was used only for cosmetic and grammar fixes.

Classic Representation: Primitive Samples

As you might know, the Prometheus data model (so server, PromQL, protocols) supports gauges, counters, histograms and summaries. OpenMetrics 1.0 extended this with gaugehistogram, info and stateset types.

Impressively, for a long time Prometheus’ TSDB storage implementation had an explicitly clean and simple data model. The TSDB allowed the storage and retrieval of string-labelled primitive samples containing only float64 values and int64 timestamps. It was completely metric-type-agnostic.

The metric types were implied on top of the TSDB, for humans and best effort tooling for PromQL. For simplicity, let’s call this way of storing types a classic model or representation. In this model:

We have primitive types:

  • gauge is a “default” type with no special rules, just a float sample with labels.

  • counter that should have a _total suffix in the name for humans to understand its semantics.

    foo_total 17.0
    
  • info that needs an _info suffix in the metric name and always has a value of 1.

We have composite types. This is where the fun begins. In the classic representation, composite metrics are represented as a set of primitive float samples:

  • histogram is a group of counters with certain mandatory suffixes and le labels:

    foo_bucket{le="0.0"} 0
    foo_bucket{le="1e-05"} 0
    foo_bucket{le="0.0001"} 5
    foo_bucket{le="0.1"} 8
    foo_bucket{le="1.0"} 10
    foo_bucket{le="10.0"} 11
    foo_bucket{le="100000.0"} 11
    foo_bucket{le="1e+06"} 15
    foo_bucket{le="1e+23"} 16
    foo_bucket{le="1.1e+23"} 17
    foo_bucket{le="+Inf"} 17
    foo_count 17
    foo_sum 324789.3
    
  • gaugehistogram, summary, and stateset types follow the same logic – a group of special gauges or counters that compose a single metric.

The classic model served the Prometheus project well. It significantly simplified the storage implementation, enabling Prometheus to be one of the most optimized, open-source time-series databases, with distributed versions based on the same data model available in projects like Cortex, Thanos, and Mimir, etc.

Unfortunately, there are always tradeoffs. This classic model has a few limitations:

  • Efficiency: It tends to yield overhead for composite types because every new piece of data (e.g., new bucket) takes precious index space (it’s a new unique series), whereas samples are significantly more compressible (rarely change, time-oriented).
  • Functionality: It poses limitations to the shape and flexibility of the data you store (unless we’d go into some JSON-encoded labels, which have massive downsides).
  • Transactionality: Primitive pieces of composite types (separate counters) are processed independently. While we did a lot of work to ensure write isolation and transactionality for scrapes, transactionality completely breaks apart when data is received or sent via remote write, OTLP protocols, or, to distributed long-term storage, Prometheus solutions. For example, a foo histogram might have been partially sent, but its foo_bucket{le="1.1e+23"} 17 counter series be delayed or dropped accidentally, which risks triggering false positive alerts or no alerts, depending on the situation.
  • Reliability: Consumers of the TSDB data have to essentially guess the type semantics. There’s nothing stopping users from writing a foo_bucket gauge or foo_total histogram.

A Glimpse of Native Storage for Composite Types

The classic model was challenged by the introduction of native histograms. The TSDB was extended to store composite histogram samples other than float. We tend to call this a native histogram, because TSDB can now “natively” store a full (with sparse and exponential buckets) histogram as an atomic, composite sample.

At that point, the common wisdom was to stop there. The special advanced histogram that’s generally meant to replace the “classic” histograms uses a composite sample, while the rest of the metrics use the classic model. Making other composite types consistent with the new native model felt extremely disruptive to users, with too much work and risks. A common counter-argument was that users will eventually migrate their classic histograms naturally, and summaries are also less useful, given the more powerful bucketing and lower cost of native histograms.

Unfortunately, the migration to native histograms was known to take time, given the slight PromQL change required to use them, and the new bucketing and client changes needed (applications have to define new or edit existing metrics to new histograms). There will also be old software used for a long time that never is never migrated. Eventually, it leaves Prometheus with no chance of deprecating classic histograms, with all the software solutions required to support the classic model, likely for decades.

However, native histograms did push TSDB and the ecosystem into that new composite sample pattern. Some of those changes could be easily adapted to all composite types. Native histograms also gave us a glimpse of the many benefits of that native support. It was tempting to ask ourselves: would it be possible to add native counterparts of the existing composite metrics to replace them, ideally transparently?

Organically, in 2024, for transactionality and efficiency, we introduced a native histogram custom buckets(NHCB) concept that essentially allows storing classic histograms with explicit buckets natively, reusing native histogram composite sample data structures.

NHCB has proven to be at least 30% more efficient than the classic representation, while offering functional parity with
classic histograms. However, two practical challenges emerged that slowed down the adoption:

  1. Expanding, that is converting from NHCB to classic histogram, is relatively trivial, but combining, which is turning a classic histogram into NHCB, is often not feasible. We don’t want to wait for client ecosystem adoption, and also being mindful of legacy, hard to change software, we envisioned NHCB being converted (so combined) on scrape from the classic representation. That has proven to be somewhat expensive on scrape. Additionally, combination logic is practically impossible when receiving “pushes” (e.g., remote write with classic histograms), as you could end up having different parts of the same histogram sample (e.g., buckets and count) sent via different remote write shards or sequential messages. This combination challenge is also why OpenTelemetry collector users see an extra overhead on prometheusreceiver as the OpenTelemetry model strictly follows the composite sample model.

  2. Consumption is slightly different, especially in the PromQL query syntax. Our initial decision was to surface NHCB histograms using a native-histogram-like PromQL syntax. For example the following classic histogram:

    foo_bucket{le="0.0"} 0
    # ...
    foo_bucket{le="1.1e+23"} 17
    foo_bucket{le="+Inf"} 17
    foo_count 17
    foo_sum 324789.3
    

    When we convert this to NHCB, you can no longer use foo_bucket as your metric name selector. Since NHCB is now stored as a foo metric, you need to use:

    histogram_quantile(0.9, sum(foo{job="a"}))
    
    # Old syntax: histogram_quantile(0.9, sum(foo_bucket{job="a"}) by (le))
    

    This has also another effect. It violates our “what you see is what you query” rule for the text formats, at least until OpenMetrics 2.

    On top of that, similar problems occur on other Prometheus outputs (federation, remote read, and remote write).

NOTE: Fun fact: Prometheus client data model (SDKs) and PrometheusProto
scrape protocol use the composite sample model already!

Transparent Native Representation

Let’s get straight to the point. Organically, the Prometheus community seems to align with the following two ideas:

  • We want to eventually move to a fully composite sample model on the storage layer, given all the benefits.
  • Users needs to be able to switch (e.g., on scrape) from classic to native form in storage without breaking consumption layer. Essentially to help with non-trivial migration pains (finding who use what, double-writing, synchronizing), avoiding tricky, dual mode, protocol changes and to deprecate the classic model ASAP for the sustainability of the Prometheus codebase, we need to ensure eventual consumption migration e.g., PromQL queries — independently to the storage layer.

Let’s go through evidence of this direction, which also represents efforts you can contribute to or adopt early!

  1. We are discussing the “native” summary and stateset to fully eliminate classic model for all composite types. Feel free to join and help on that work!

  2. We are working on the OpenMetrics 2.0 to consolidate and improve the pull protocol scene and apply the new learnings. One of the core changes will be the move to composite values in text, which makes the text format trivial to parse for storages that support composite types natively. This solves the combining challenge. Note that, by default, for now, all composite types will be still “expanded” to classic format on scrape, so there’s no breaking change for users. Feel free to join our WG to help or give feedback.

  3. Prometheus receive and export protocol has been updated. Remote Write 2.0 allows transporting histograms in the “native” form instead of a classic representation (classic one is still supported). In the future versions (e.g. 2.1), we could easily follow a similar pattern and add native summaries and stateset. Contributions are welcome to make Remote Write 2.0 stable!

  4. We are experimenting with the consumption compatibility modes that translate the composite types store as composite samples to classic representation. This is not trivial; there are edge cases, but it might be more feasible (and needed!) than we might have initially anticipated. See:

    In PromQL it might work as follows, for an NHCB that used to be a classic histogram:

    # New syntax gives our "foo" NHCB:    
    histogram_quantile(0.9, sum(foo{job="a"}))
    # Old syntax still works, expanding "foo" NHCB to classic representation:
    histogram_quantile(0.9, sum(foo_bucket{job="a"}) by (le))
    

    Alternatives, like a special label or annotations, are also discussed.

When implemented, it should be possible to fully switch different parts of your metric collection pipeline to native form transparently.

Summary

Moving Prometheus to a native composite type world is not easy and will take time, especially around coding, testing and optimizing. Notably it switches performance characteristics of the metric load from uniform, predictable sample sizes to a sample size that depends on a type. Another challenge is code architecture – maintaining different sample types has already proven to be very verbose (we need unions, Go!).

However, recent work revealed a very clean and possible path that yields clear benefits around functionality, transactionality, reliability, and efficiency in the relatively near future, which is pretty exciting!

If you have any questions around these changes, feel free to:

  • DM me on Slack.
  • Visit the #prometheus-dev Slack channel and share your questions.
  • Comment on related issues, create PRs, also review PRs (the most impactful work!)

The Prometheus community is also at KubeConEU 2026 in Amsterdam! Make sure to:

I’m hoping we can share stories of other important, orthogonal shifts we see in the community in future posts. No promises (and help welcome!), but there’s a lot to cover, such as (random order, not a full list):

  1. Our native start timestamp feature journey that cleanly unblocks native delta temporality without “hacks” like reusing gauges, separate layer of metric types or label annotations e,g., __temporality__.
  2. Optional schematization of Prometheus metrics that attempt to solve a ton of stability problems with metric naming and shape; building on top of OpenTelemetry semconv.
  3. Our metadata storage journey that attempts to improve the OpenTelemetry Entities and resource attributes storage and consumption experience.
  4. Our journey to organize and extend Prometheus scrape pull protocols with the recent ownership move of OpenMetrics.
  5. An incredible TSDB Parquet effort, coming from the three LTS project groups (Cortex, Thanos, Mimir) working together, attempting to improve high-cardinality cases.
  6. Fun experiments with PromQL extensions, like PromQL with pipes and variables and some new SQL transpilation ideas.
  7. Governance changes.

See you in open-source!

Metasploit Wrap-Up 02/13/2026

Post Syndicated from Christopher Granleese original https://www.rapid7.com/blog/post/pt-metasploit-wrap-up-02-13-2026

SolarWinds Web Help Desk

Our very own sfewer-r7 has developed an exploit module for the SolarWinds Web Help Desk vulnerabilities CVE-2025-40536 and CVE-2025-40551. On successful exploitation the session will be as running as NT AUTHORITY\SYSTEM. For more information see the Rapid7’s SolarWinds Web Help Desk Vulnerabilities guidance.

Contributions

A big thanks to our contributors who have been adding some great content this release. rudraditya21 has added MITRE ATT&CK metadata to lots of our existing modules. Chocapikk has added support for GHSA (GitHub Security Advisory) references support in Metasploit modules. rudraditya21 also added a change which adds negative caching to the LDAP entry cache, which will now mean missing objects are recorded. It also introduces a missing-entry sentinel, tracks misses per identifier type, and updates AD lookup helpers to short‑circuit on cached misses and record misses when a lookup returns no entry.

New module content (5)

FreeBSD rtsold/rtsol DNSSL Command Injection

Authors: Kevin Day and Lukas Johannes Möller Type: Exploit Pull request: #20798 contributed by JohannesLks Path: freebsd/misc/rtsold_dnssl_cmdinject AttackerKB reference: CVE-2025-14558

Description: This adds a new command-injection exploit in the FreeBDS rtsol/rtsold daemons (CVE-2025-14558). The vulnerability can be triggered by the Domain Name Search List (DNSSL) option in IPv6 Router Advertisement (RA) messages, which is passed to the resolvconf script without sanitization. It requires elevated privilege as it needs to send IPv6 packets. The injected commands are executed as root.

Ivanti Endpoint Manager Mobile (EPMM) unauthenticated RCE

Authors: sfewer-r7 and watchTowr Type: Exploit Pull request: #20932 contributed by sfewer-r7 Path: linux/http/ivanti_epmm_rce AttackerKB reference: CVE-2026-1340

Description: Adds an exploit module for the recent command injection vulnerability, CVE-2026-1281, affecting Ivanti Endpoint Manager Mobile (EPMM), formerly known as MobileIron. Exploited in-the-wild as a zero-day by an unknown threat actor.

GNU Inetutils Telnet Authentication Bypass Exploit CVE-2026-24061

Authors: Kyu Neushwaistein and jheysel-r7 Type: Exploit Pull request: #20929 contributed by jheysel-r7 Path: linux/telnet/gnu_inetutils_auth_bypass AttackerKB reference: CVE-2026-24061

Description: This adds an exploit module for the authentication bypass in GNU Inetutils telnetd tracked as CVE-2026-24061. During negotiation, if the USER environment variable is passed in with a value of “-f root” authentication can be bypassed resulting in command execution as the root user.

SolarWinds Web Help Desk unauthenticated RCE

Authors: Jimi Sebree and sfewer-r7 Type: Exploit Pull request: #20917 contributed by sfewer-r7 Path: multi/http/solarwinds_webhelpdesk_rce AttackerKB reference: CVE-2025-40551

Description: This adds an exploit module for SolarWinds Web Help Desk vulnerable to CVE-2025-40536 and CVE-2025-40551. The exploit triggers session opening as NT AUTHORITY\SYSTEM and root.

Xerte Online Toolkits Arbitrary File Upload – Upload Image

Author: Brandon Lester Type: Exploit Pull request: #20849 contributed by haicenhacks Path: multi/http/xerte_authenticated_rce_uploadimage

Description: This adds three RCE modules for Xerte Online Toolkits affecting versions 3.14.0 and <= 3.13.7. Two are unauthenticated while one is authenticated.

Enhancements and features (10)

  • #20710 from Chocapikk – Adds support for GHSA (GitHub Security Advisory) and OSV (Open Source Vulnerabilities) references in Metasploit modules.
  • #20886 from cdelafuente-r7 – Updates services to now also have child services. This allows for more detailed reporting for the services and vulns commands which can now report parent -> child services e.g. SSL -> HTTPS.
  • #20895 from rudraditya21 – Adds negative caching to the LDAP entry cache so missing objects are recorded and subsequent lookups by DN, sAMAccountName, or SID return nil without re-querying the directory.
  • #20934 from rudraditya21 – This adds MITRE ATT&CK tags to modules related to LDAP and AD CS. This enables users to find this content using Metasploit’s search functionality and the att&ck keyword.
  • #20935 from rudraditya21 – Adds the MITRE ATT&CK tag T1558.003 to the kerberoast modules. This enables users to find this content using Metasploit’s search functionality and the att&ck keyword.
  • #20936 from rudraditya21 – This adds MITRE ATT&CK tags to SMB modules related to accounts. This enables users to find the content by using Metasploit’s search capability and the att&ck keyword.
  • #20937 from rudraditya21 – This adds MITRE ATT&CK tags to the two existing SCCM modules that fetch NAA credentials using different techniques. This enables users to find this content using Metasploit’s search functionality and the att&ck keyword.
  • #20941 from rudraditya21 – Adds a MITRE ATT&CK technique reference to the Windows password cracking module to support ATT&CK‑driven discovery.
  • #20942 from rudraditya21 – Adds MITRE ATT&CK technique references to getsystem, cve_2020_1472_zerologon, and atlassian_confluence_rce_cve_2023_22527 modules to support ATT&CK‑driven discovery.
  • #20943 from g0tmi1k – Adds affected versions the description in the ‎exploits/unix/webapp/twiki_maketext module.

Bugs fixed (7)

  • #20599 from BenoitDePaoli – Fixes an issue where running services -p <ports> -u -R to set RHOSTS with values from the database could lead to a silently failing file not found error.
  • #20775 from rmtsixq – Fixes a database initialization failure when using msfdb init with the –connection-string option to connect to PostgreSQL 15+ instances (e.g., Docker containers).
  • #20817 from randomstr1ng – Adds a fix to ensure the output of sap_router_portscanner no longer causes module crashes.
  • #20903 from jheysel-r7 – Fixes an issue so #enum_user_directories no longer returns duplicate directories.
  • #20906 from rudraditya21 – Implements a fix for SSH command shells dying on cmd_exec when a trailing newline was present.
  • #20953 from zeroSteiner – Improves the stability of socket channeling support for SSH sessions opened via scanner/ssh/ssh_login.
  • #20955 from adfoster-r7 – Ensures the cleanup of temporarily created RHOST files when using the services -p <ports> -u -R command to set RHOST values from the database.

Documentation

You can find the latest Metasploit documentation on our docsite at docs.metasploit.com.

Get it

As always, you can update to the latest Metasploit Framework with msfupdate and you can get more details on the changes since the last blog post from GitHub:

If you are a git user, you can clone the Metasploit Framework repo (master branch) for the latest. To install fresh without using git, you can use the open-source-only Nightly Installers or the commercial edition Metasploit Pro

OpenAI GPT-5.3-Codex-Spark Now Running at 1K Tokens Per Secondon BIG Cerebras Chips

Post Syndicated from Patrick Kennedy original https://www.servethehome.com/openai-gpt-5-3-codex-spark-now-running-at-1k-tokens-per-secondon-big-cerebras-chips/

OpenAI GPT-5.3-Codex-Spark is now running on huge Cerebras WSE-3 chips at over 1000 tokens per second for super-fast inference

The post OpenAI GPT-5.3-Codex-Spark Now Running at 1K Tokens Per Secondon BIG Cerebras Chips appeared first on ServeTheHome.

The collective thoughts of the interwebz