Post Syndicated from corbet original https://lwn.net/Articles/1049161/
Inside this week’s LWN.net Weekly Edition:
Post Syndicated from Rohit Kumar original https://www.servethehome.com/gl-inet-gl-mt6000-flint-2-wifi-router-review-mediatek-openwrt/
We test the GL.iNet Flint 2 (GL-MT6000) and see how this OpenWRT-based device performs and what the software offers
The post GL.iNet GL-MT6000 Flint 2 WiFi Router Review A Better BPi-3 Mini appeared first on ServeTheHome.
Post Syndicated from Nava Ajay Kanth Kota original https://aws.amazon.com/blogs/devops/resolve-and-prevent-operational-incidents-with-aws-devops-agent-and-new-relic/
This post was co-written with Muthuvelan Swaminathan (Principal Partner Engineer) and Ruchika Bakolia (Software Engineer) from New Relic.
Modern distributed systems that generate massive volumes of metrics, traces, and logs are inherently complex. The process of correlating logs, comparing configurations and switching between tools during incident management makes manual root cause analysis a bottleneck that dramatically increases the mean time to detect and resolve. Instead of manually sifting through mountains of data, Site Reliability Engineers (SREs) and DevOps teams can leverage Agentic AI to automate and enhance the incident resolution process.
To address these challenges, New Relic partnered with AWS to integrate the New Relic Model Context Protocol (MCP) server with AWS DevOps Agent to access telemetry data providing automated root cause analysis and recommendations with cutting-edge artificial intelligence. AWS DevOps Agent is a frontier agent that resolves and proactively prevents incidents, continuously improving reliability and performance of applications in AWS, multi-cloud, and hybrid environments.
In this blog, we’ll explore the key features of both services, how to configure them and an example that shows how operation teams can correlate telemetry data, predict system anomalies and initiate remediation actions to significantly accelerate MTTR (Mean Time to Resolution).
The New Relic MCP Server is a standardized gateway that connects external AI agents such as AWS DevOps Agent to New Relic’s observability data and functions. It enables autonomous agents to query live data and execute actions without requiring custom API integrations.
As customers and partners build their own AI tools, there is no longer a need to maintain a bespoke API integration. MCP enables AI agents to seamlessly interact with their telemetry data on New Relic platform through an MCP client to leverage its capabilities and enhance their workflows.
AWS DevOps Agent
AWS DevOps Agent is a frontier agent that resolves and proactively prevents incidents, continuously improving reliability and performance. AWS DevOps Agent investigates incidents and identifies operational improvements as an experienced DevOps engineer would: by learning your resources and their relationships, working with your observability tools, runbooks, code repositories, and CI/CD pipelines, and correlating telemetry, code, and deployment data across all of them to understand the relationships between your application resources.
Key benefits for organizations
The integration of in-depth observability with AWS DevOps Agent capabilities is designed to quickly resolve issues when they arise and prevent incidents for SRE and DevOps engineers. Here are few benefits:
Onboarding
The onboarding process involves setting up an Agent Space and registering your existing New Relic servers. Onboarding does not require any new implementation.
Here are the high-level steps to create an AWS DevOps Agent Space and connect it to the New Relic MCP Server using an API-Key.
Setup Agent Space in AWS DevOps Agent
To create Agent Spaces, navigate to the AWS DevOps Agent page within the AWS Management Console. An Agent Space establishes the boundaries for the AWS DevOps Agent when accessing resources within a specific AWS account. To get started, click the create Agent Space button at the top right of the screen and enter the name, description and IAM roles.
AWS DevOps Agent creating agent space
Creating a New Relic association
Navigate to the capabilities tab in the Agent Space
Navigating to the capabilities tab in the Agent space
Go to the Telemetry section, select Add, then choose New Relic and click Next.
Associating New Relic as the Telemetry provider in the Agent space
Upon successful registration of New Relic as a source, AWS DevOps Agent automatically generates a webhook URL. This URL is then used to receive alert notifications and trigger automated investigations.
AWS DevOps Agent Webhook URL and Bearer secret key
The AWS DevOps Agent webhook requires a Bearer token to be included in the HTTP header for authentication purposes. This ensures that only authorized requests are processed. In New Relic, set up Amazon EventBridge as the alert destination. This configuration will trigger an AWS Lambda function that adds the Bearer token to the HTTP header and posts the alert payload to the AWS DevOps Agent webhook URL.
This use case demonstrates how the integration of AWS DevOps Agent and New Relic MCP server empowers SRE and DevOps teams to access the untapped insights in your data to reduce MTTR and drive operational excellence.
Consider the following scenario: AWS DevOps Agent gets paged when the online boutique retail store application cart is experiencing P95 latency > 500ms for more than 2 minutes. This latency spike is critical and far exceeds the normal 5ms threshold, impacting the ability for customers to make purchases. In a typical scenario, the operations team would spend the first 15-30 minutes manually checking dependent services, alerts dashboard, and logs. This manual effort can be significantly reduced by configuring the New Relic observability platform with AWS DevOps Agent to automatically correlate telemetry data and surface the root cause faster.
To automatically remediate this issue, the online boutique application’s microservices are configured with New Relic’s APM agents that collect relevant metrics and send them to New Relic. When the latency exceeds a predefined threshold, an alert condition is triggered within New Relic. The triggered alert sends a notification to EventBridge, which in turn executes the Lambda function. The Lambda transforms the incoming payload into the required AWS DevOps Agent payload template. It then generates an HMAC signature to verify the message’s integrity and authenticity before dispatching it to the AWS DevOps Agent webhook endpoint.
Alert policy notifications in New Relic
The AWS DevOps Agent webhook triggers the agent to begin an automated investigation.
AWS DevOps Agent Incident response page
The New Relic MCP is first queried by the AWS DevOps Agent to retrieve telemetry data for the cart service GUID. Following this, the AWS DevOps Agent makes a second request to the New Relic MCP to formulate an investigation plan, which includes a list of related entities, their key metrics, and any associated change events for those dependencies.
AWS DevOps Agent and New Relic MCP interaction to list entities and related change events
Next, data gathering tasks are executed using New Relic MCP, following the investigation plan.
AWS DevOps Agent and New Relic MCP interaction to explore and analyze traces
AWS DevOps Agent and New Relic MCP interaction to explore and analyze logs and metrics
Continuing its analysis, the agent leverages New Relic’s MCP to examine entity logs, golden metrics, and traces, ultimately identifying the root cause for the latency spike.
AWS DevOps Agent Root Cause Analysis
You can review AWS DevOps Agent’s findings and the suggested root cause. The Site Reliability Engineer (SRE) can interact with the AWS DevOps Agent (side panel) in the chat panel to gain clarification on the steps of the ongoing investigation, enabling more effective monitoring and troubleshooting.
AWS DevOps Agent Chat interface
You can review AWS DevOps Agent’s findings and the suggested root cause. If necessary, the SRE then executes the appropriate mitigation plan.
Conclusion
By integrating the New Relic MCP server with AWS DevOps Agent, organizations can quickly resolve issues when they arise and proactively prevent future incidents. This collaboration reduces Mean Time to Resolution (MTTR) and accelerates SREs and DevOps teams beyond manual, time-consuming investigations. It ensures rapid remediation of technical disruptions to minimize impact to the business. Ultimately, AWS DevOps Agent, the new frontier agent drives operational excellence, working in conjunction with the New Relic One Observability platform.
About New Relic
The New Relic Intelligent Observability Platform helps businesses eliminate interruptions in digital experiences. New Relic is an AI-strengthened platform that unifies and pairs telemetry data to provide clarity over your entire digital estate for proactive and predictive problem solving. That’s why businesses around the world run on New Relic to drive innovation, improve reliability, and deliver exceptional customer experiences to fuel growth.
Authors
Post Syndicated from Home Assistant original https://www.youtube.com/watch?v=-sUA7v1TEzY
Post Syndicated from The Atlantic original https://www.youtube.com/shorts/HX6lNop2cO4
Post Syndicated from jzb original https://lwn.net/Articles/1049965/
Let’s Encrypt has published
a retrospective that covers the decade since it published its first
publicly trusted certificate in September 2015:
In March 2016, we issued our one millionth certificate. Just two years
later, in September 2018, we were issuing a million certificates every
day. In 2020 we reached a billion total certificates issued and as of
late 2025 we’re frequently issuing ten million certificates per
day. We’re now on track to reach a billion active sites, probably
sometime in the coming year.
Post Syndicated from jzb original https://lwn.net/Articles/1049963/
Greg Kroah-Hartman is writing
a series of blog posts about Linux becoming a Certificate
Numbering Authority (CNA):
It’s been almost 2 full years since Linux became a CNA (Certificate
Numbering Authority) which meant that we (i.e. the kernel.org
community) are now responsible for issuing all CVEs for the Linux
kernel. During this time, we’ve become one of the largest creators of
CVEs by quantity, going from nothing to number 3 in 2024 to number 1
in 2025. Naturally, this has caused some questions about how we are
both doing all of this work, and how people can keep track of it.
So far, Kroah-Hartman has published the introductory post, as well
as a detailed
post about kernel version numbers that is well worth reading.
Post Syndicated from Kevin S. Ridolfi original https://aws.amazon.com/blogs/architecture/how-basfs-agriculture-solutions-drives-traceability-and-climate-action-by-tokenizing-cotton-value-chains-using-amazon-managed-blockchain/
BASF Agricultural Solutions combines innovative products and digital tools with practical farmer knowledge. With over a century of experience, BASF offers a broad portfolio spanning seeds, crop protection, soil management, plant health, and digital agriculture solutions. Through collaboration with farmers, scientists, and partners, BASF strives to meet societal needs sustainably while creating a lasting agricultural legacy. Infosys is a global premier consulting and managed services partner of Amazon Web Services (AWS). Through this unique partnership, AWS helps customers integrate software, services, and processes to accelerate business transformation. This post explores the commitment of this partnership to driving positive change in the agricultural industry by using Amazon Managed Blockchain to tokenize food and cotton value chains for traceability, climate action, and circularity.
The world’s population is growing, with the UN projecting an estimated world population of 8.5 billion in 2030 and 10.4 billion by the end of the century. Along with this growth, as well as a global increase in standards of living, comes a rising demand for agricultural products such as fiber and food crops. At the same time, as society becomes more aware of the ecological impact of agriculture, both local communities and farmers are placing larger focus on a sustainable management of natural resources. The agricultural industry is uniquely positioned at the intersection of these two trends.
The agricultural industry faces numerous complex challenges that span both business and technical domains. From a business perspective, today’s agricultural supply chains have become incredibly complex, often involving multiple intermediaries across different countries. This complexity makes it difficult to ensure fair pricing and adequate compensation for farmers, who are often at the bottom of the value chain. Furthermore, verifying sustainable farming practices and organic certifications has become increasingly challenging, even as consumer demand for product authenticity and sustainability information continues to grow. Adding to these pressures, agricultural businesses must navigate increasing regulatory requirements for environmental regulation compliance and reporting, along with complex international trade regulations and documentation.
On the technical front, the industry struggles with limited digital infrastructure in rural farming areas, where internet connectivity and technology adoption remain significant hurdles. Data collection methods vary widely across different farms and regions, making it difficult to establish consistent metrics and reporting standards. Many agricultural businesses still operate with legacy systems that resist integration with modern tracking solutions, and the lack of standardization in agricultural data formats creates additional complications. Maintaining data integrity across multiple stakeholders has proven particularly challenging, as has the implementation of real-time tracking and tracing capabilities.
Cotton is the world’s most important natural fiber crop, with a yearly production of 126.5 million bales in the 2022–2023 season, enough to produce 25.3 billion pairs of jeans or 151.8 billion T-shirts. It also plays a major role in the fast fashion industry, where garments and clothing undergo a fast production and disposal cycle to quickly address customer attention and the latest fashion trends, with around 30% of clothing sold in the US being made with cotton. This accelerated production and disposal cycle comes at the expense of considerable environmental impact, with the fast fashion industry accounting for approximately 20% of the world’s water consumption and 10% of the world’s total CO2 emissions.
The cotton industry faces its own set of distinct challenges. Water usage stands as one of the most pressing concerns, with a single cotton T-shirt requiring approximately 2,700 liters of water to produce. Chemical usage tracking presents another significant challenge, as stakeholders must carefully monitor pesticide and fertilizer application throughout the growing process. Labor practices verification has become increasingly important, with brands and consumers demanding assurance of ethical working conditions throughout the supply chain.
Quality verification poses another crucial challenge, given that maintaining accurate documentation of cotton grade and characteristics is essential for pricing and processing. The industry’s global nature creates additional complexities in cross-border logistics, requiring careful management of international shipping and customs processes. Furthermore, the growing importance of sustainability certification has created new pressures to validate organic and sustainable farming practices with reliable, transparent documentation.
As consumer expectation of guaranteed fair practices, lower carbon emissions, and sustainable use of natural resources grows, so does the demand for traceability systems that can provide near real-time visibility into each step of the value chain by tracking sustainability information such as water consumption and CO2 emissions.
To address this demand, BASF identified blockchain as a foundational technology for a digital solution to deliver transparency along the value chain, targeting specific customer requirements for digital assets backed by information, validation, certificates, and know your business (KYB) policies for value chain partners.
Blockchain technology emerges as a particularly powerful solution to these challenges, offering unique capabilities that directly address many of the industry’s pain points. At its core, blockchain provides immutable record-keeping, creating permanent, tamper-proof records of transactions and events that ensure data integrity throughout the supply chain. This feature proves especially valuable in preventing fraudulent modification of sustainability certificates and maintaining the credibility of organic farming claims.
Smart contracts, a key feature of blockchain technology, enable the automation of compliance with agricultural standards and facilitate automatic payment execution based on predefined conditions. This automation significantly reduces administrative overhead in supply chain management and helps ensure fair compensation for farmers.
The technology’s traceability capabilities provide end-to-end visibility of cotton from seed to garment, enabling real-time tracking of sustainability metrics and creating transparent audit trails for certification purposes. This transparency helps brands and consumers verify the authenticity and sustainability of their cotton products while enabling farmers to demonstrate their commitment to sustainable practices.
Blockchain’s decentralized data management allows multiple stakeholders to maintain shared records without requiring a central authority, eliminating single points of failure in data storage and reducing dependency on central authorities. This decentralized approach proves particularly valuable in agricultural supply chains, where numerous parties need to access and verify information.
The implementation of token economics through blockchain creates new opportunities for incentivizing sustainable farming practices. Through tokenization, farmers can access new revenue streams, including carbon credits, while establishing more direct relationships with buyers. Additionally, blockchain’s digital identity capabilities provide secure authentication for supply chain participants, enabling granular access control to sensitive data and facilitating compliance with know your customer (KYC) and KYB requirements.
Using a permissioned blockchain based on open-source systems, BASF Agricultural Solutions has developed a novel way to promote data democratization and address the challenges of data recording, off-chain processes, and on-chain activities at scale. The solution enables value chain players to independently verify activities progressively, and an organizational structure within chain and off-chain monitors key performance indicators (KPIs) through a DAO (Distributed Autonomous Organization) interface.
To focus on building such a system rather than managing the underlying blockchain infrastructure, BASF selected Amazon Managed Blockchain alongside additional AWS services. Amazon Managed Blockchain simplifies BASF’s approach because it brings a suite of offerings that can be configured to build this solution without the need to add more layers and external or internal sources.
As a foundational system, Amazon Managed Blockchain augments the solution’s ability to generate smart certificates along with off-chain opportunities to further expand the offering as a platform, such as with AI and AWS Lambda. This fits into BASF’s vision to deliver best-in-class solutions for the farming community and deliver trusted information to communities that want to drive a positive impact for the planet.
The following are the key structural components of the solution:
The following diagram illustrates the solution architecture.
The solution architecture is extensible and scalable to meet the dynamic load requirements. It can seamlessly connect various data sources with appropriate connectors such as Salesforce, mobility platforms, third-party services, and more.
External users such as value chain players, retailers, and others who could benefit from tokens can access the platform through different methods. Generally, access of DAOs is done through business-to-customer (B2C) login, and API streams can be subscribed by end retailers for checkouts, point of sale (POS), and so on. Additionally, we provide internal access for admins and auditors to visualize the product flows.
Climate challenges are quite complex and require a joint approach between technology, the custodians of our planet (namely the farmers), and public chains that deliver the right protocols. BASF Agriculture Solutions represents the farming needs and the link to the right communities and crops on the ground, AWS brings in the right infrastructure and support of the cloud and scale, and Infosys brings in development support as a partner to both AWS and BASF.
BASF is connected to millions of farmers. BASF considers farming to be the biggest job on earth. Sustainable farming means bringing back lost biodiversity and increasing carbon capture within the soil. And sustainability overall requires additional effort by the farmers. Additionally, consumers like us make choices daily when it comes to our own purchase decisions, such as to buy sustainable products or take action that brings positive impact to the climate.
The solution outlined in this post creates a solution using blockchain as the base technology to enable a secure and reliable method for information sharing across all stakeholders. It’s the baseline to onboard use cases in the agriculture industry to enable end-to-end traceability with a 360-degree view. Smart contracts incentivize farmers and other stakeholders to follow the sustainable measures based on the information in the system, which is reviewed and authorized by validators. All the actions in the system are monitored and logged as immutable records, which enforce the information trust by default. This acts as a baseline for 100% traceability, tokenization for sustainable measures, and digital assets that can be exchanged and create a positive economy around sustainability. The design discussed in this post is flexible to onboard different use cases and can auto scale to meet dynamic data volumes.
We encourage you to join BASF, Infosys, and AWS in driving sustainability through trusted value chains that incentivize farmers, empower consumers, and create a positive economy around climate action. If you want to dive deep into topics surrounding sustainability and AWS architecture, we suggest visiting the AWS Architecture Blog.
Post Syndicated from Crosstalk Solutions original https://www.youtube.com/shorts/T4_k38yQHF8
Post Syndicated from jzb original https://lwn.net/Articles/1049423/
Linux containers have made it reasonably easy to develop, distribute, and
deploy server applications along with all the distribution dependencies that they
need. For example, anyone can deploy and run a Debian-based PostgreSQL container
on a Fedora Linux host. Distrobox is a project that is designed to
bring the cross-distribution compatibility to the desktop and allow users to
mix-and-match Linux distributions without fussing with dual-booting, virtual
machines, or multiple computers. It is an ideal way to install
additional software on image-based systems, such as Fedora’s Atomic Desktops
or Bazzite, and also
provides a convenient way to move a development environment or
favorite applications to a new system.
Post Syndicated from The Atlantic original https://www.youtube.com/watch?v=W9dezs4O0bo
Post Syndicated from BeardedTinker original https://www.youtube.com/watch?v=KpyQYUgwZ_w
Post Syndicated from Анахит Хачикян original https://www.toest.bg/noviyat-byudzhet-na-es-obsht-portfeyl-ili-vsekimu-spored-zaslugite/
В свят, който се променя със скоростта на светлината, дългосрочното планиране е като нощен преход по слабо осветен маршрут: имаш обща представа за посоката, но трябва да внимаваш къде стъпваш, и почти не виждаш какво те очаква в далечината. Планирането на следващата многогодишна финансова рамка (МФР) 2028–2034 на Европейския съюз изисква същата бдителност и далновидност. От една страна, трябва да се отделят достатъчно средства за проблемни области, за които отсега се знае, че се нуждаят от инвестиции. От друга, трябва да се осигури достатъчно голямо поле за промяна на скоростта и посоката на движение в зависимост от новите предизвикателства, които все още не виждаме по пътя.
Задачата се усложнява допълнително от броя на замесените действащи лица в процеса на вземане на решения. Първоначалното предложение се изготвя от Европейската комисия (ЕК) и трябва да бъде одобрено от Европейския парламент и от всички страни членки, представени в Съвета. Преговорите продължават около две години, а ако не се постигне съгласие, процесът започва отначало.
когато Комисията представи за първи път своето предложение за МФР 2028–2034. Урсула фон дер Лайен пледира за гъвкава и опростена структура: 2 трилиона евро за срок от 7 години, разпределени в 4 (вместо 7, както досега) т.нар. функции:
Данни: Европейски парламент
Съществената разлика в сравнение с предишната финансова рамка 2021–2027 е, че средствата по функция 1 ще се управляват от всяка държава членка в рамките на т.нар. Национални и регионални партньорски планове. Почти половината от 7-годишния бюджет – 44%, са заложени в тези планове. Комисията нарича това опростяване: вместо досегашния „пачуърк“ от 52 програми ще има 16 и всяка държава ще изработи в сътрудничество с ЕК своя национален план.
Страните ще имат достъп до същия размер средства както преди, но изплащането им ще е обвързано с изпълняването на цели и реформи и със спазването на върховенството на закона. В речта си в пленарната зала на 12 ноември Урсула фон дер Лайен подчерта, че така ще пребори една от основните слабости на сегашния бюджет – непълното усвояване на средствата. Според изчисления на ЕК до края на 2027 г. почти една четвърт от настоящия бюджет – около 340 млрд. евро, няма да е достигнала до бенефициерите.
Според противниците на новата бюджетна структура прехвърлянето на тези самостоятелни фондове в един общ пакет, управляван самостоятелно от всяка столица, нарушава принципите на единодействие и солидарност на Съюза. То омаловажава ролята на регионите и поставя в риск европейското земеделие и регионалната политика, тъй като за тях няма заделени отделни бюджетни пера, както е в настоящата финансова рамка.
И това е само една от няколкото сериозни критики, отправени от евродепутатите към бюджетното предложение на ЕК. Дни преди обсъждането му в пленарната зала през ноември групите на Европейската народна партия (ЕНП), социалистите и демократите, „Обнови Европа“ и зелените се обединиха в обща ултимативна позиция, че обсъждането по МФР не може да започне, ако ЕК не поправи първоначалното си предложение.
Фон дер Лайен привидно склони на компромис, като заложи минимум 10% от неразпределените средства от функция 1 да отидат за селските райони. Тя обеща и частично възстановяване на значимостта на регионите и засилване на ролята на Европарламента в бюджетните решения.
ЕНП, от която е и Лайен, приветства предложените промени като стъпка в правилната посока, но другите политически групи определиха поправките като козметични и недостатъчни.
В страни с корумпирани или клонящи към авторитарност правителства, като някои от настоящите в Централна и Източна Европа, прехвърлянето на почти половината бюджет към националните планове крие опасности от злоупотреби и невъзможност да се достигне до средства, ако не си близък до властта. Това и досега беше отчасти така, тъй като немалка част от програмите на ЕС минаваха през националните министерства, но новото предложение ще даде още повече власт на столиците.
За този риск предупреди председателката на „Обнови Европа“ Валери Айер по време на пленарния дебат за МФР. Тя посочи Унгария като пример за корумпирана държава, а България – като държава, в която политически опоненти могат да се озоват зад решетките без съд и присъда, намеквайки за арестите на Благомир Коцев и Николай Барбутов.
„Обнови Европа“ ще бъде безкомпромисна! Нито един цент от нашия бюджет не трябва да се дава на корумпираните и на автократите, които стават все повече и повече, злепоставят нашите ценности, но никога не се оплакват, когато трябва да усвоят чековете на Комисията,
каза още Айер.
ЕК смята, че ще избегне злоупотребите, като въведе изисквания за извършени реформи, преди да отпусне финансиране. Така субсидиите ще са основани не на предварително изчислени разходи, а на постигнати резултати, както е в момента с Механизмa за възстановяване и устойчивост на ЕС. За България вече са задържани 215 млн. евро от второто плащане по този план заради неизпълнени ангажименти в борбата с корупцията. Ако ЕК започне да прилага този подход и за следващата МФР, средствата от функция 1 за земеделие и регионално развитие в бъдеще също може да се окажат под въпрос за нас.
Новият подход на ЕК, особено по отношение на парите за земеделие, притеснява не само България. По инициатива на Италия още пет държави (Полша, Чехия, Унгария, Словакия, Португалия) се присъединиха към страната ни. Те отправиха искане на заседанието на Съвета по селско стопанство и рибарство на 17 ноември за запазване на Общата земеделска политика като самостоятелна политика със стабилен бюджет, както е в момента. Много от евродепутатите от различни политически групи са на същото мнение, тъй като неведнъж са виждали отблизо гнева на европейските земеделци, окупиращи периодично Брюксел с трактори през изминалите години.
Докато земеделието и кохезионните фондове се считаха за традиционни приоритети на ЕС в миналото, сега на преден план изпъква втората функция в новата МФР – „конкурентоспособност, просперитет и сигурност“, за която са отделени 21% от общия бюджет. Фон дер Лайен се опира на доклада на Марио Драги, бивш президент на Европейската централна банка и бивш министър-председател на Италия. Той беше натоварен със специалната мисия да го изготви с конкретни съвети как Съюзът да се върне на световната сцена. Според Драги, ако ЕС не стане по-производителен и конкурентоспособен, не само бъдещето му, но и смисълът на съществуването му ще бъдат поставени под въпрос.
Вземайки присърце заключенията на Драги, ЕК предложи създаването на нов фонд за конкурентоспособност, който да финансира декарбонизацията, дигиталния преход, биотехнологиите и биоикономиката, здравето и отбраната. Към тази втора функция ще спадат и „Хоризонт Европа“ за научноизследователска дейност, Механизмът за свързване на Европа за транспорт, енергия и телекомуникации, „Еразъм +“ и „ЕС – Агора“.
Макар че заложените цели са амбициозни, редица заинтересовани страни вече отбелязаха, че отделените средства не са достатъчни. Според Лигата на европейските изследователски университети има опасност много от ресурсите на новия фонд да отидат за разработването на стратегически технологии, а не за чисто научни изследвания. В дългосрочен план това би подкопало научната автономност на Европа. Европейската мрежа на регионите за научни изследвания и иновации пък смята, че средствата ще облагодетелстват големите играчи и няма да стигнат до по-дребните регионални или независими научни инициативи.
Външнополитическата роля на ЕС е взета под внимание и в третата функция – „Глобална Европа“, на която се полагат 10% от общия седемгодишен бюджет. Тя включва:
Предишните седем инструмента сега са обединени в един фонд, разделен на пет географски области. Въпросът, който възниква, е как може да се определят геополитическите интереси на ЕС по географски признак. Особено като се има предвид, че всяка от европейските държави има различни стратегически интереси извън Европа в зависимост от историческото си минало и търговските си партньорства.
Бюджетът на ЕС представлява само около 1% от общия брутен вътрешен продукт на Съюза. Това е нищожна част в сравнение с парите, идващи от националните бюджети, които финансират около две трети от общата му каса. Останалите 99% идват от т.нар. собствени ресурси: мита, вноски от ДДС и глоби.
Данни: Европейски парламент
Всяка страна има своите национални интереси, но структурата и начинът на функциониране на Съюза са тези, които трябва да споят 27-те в едно цяло и да ги поведат напред в един ритъм. Бюджетът е един от основните инструменти в тази спойка.
Колкото и колосални да изглеждат сумите в трилиони за обикновения гражданин, важната дискусия в момента не е единствено за размера и структурата на МФР, а за цялостната философия на Съюза. Ще функционират ли 27-те държави на основата на общи солидарни политики в различни области, които да създават единство и да спояват „сглобката“, или финансовата рамка ще се превърне в механичен сбор от 27 национални плана, в който последните никога няма да станат първи и пропастта ще расте с всеки изминал ден?
Изразеното мнение е лично и не представлява позицията на Европейския парламент.
Post Syndicated from jzb original https://lwn.net/Articles/1049939/
Security updates have been issued by AlmaLinux (abrt and kernel), Debian (libpng1.6, libsoup2.4, pdns-recursor, webkit2gtk, and wordpress), Fedora (imhex, libwebsockets, lunasvg, python3-docs, and python3.14), Mageia (python3 and webkit2), Red Hat (abrt, firefox, mysql8.4, and postgresql:15), Slackware (mozilla), SUSE (gegl, gnutls, go1.24, go1.25, libpng16-16, openssh, postgresql13, python-Jinja2, and sssd), and Ubuntu (fonttools and netty).
Post Syndicated from The History Guy: History Deserves to Be Remembered original https://www.youtube.com/watch?v=5KguOUYpkMM
Post Syndicated from Bruce Schneier original https://www.schneier.com/blog/archives/2025/12/fbi-warns-of-fake-video-scams.html
The FBI is warning of AI-assisted fake kidnapping scams:
Criminal actors typically will contact their victims through text message claiming they have kidnapped their loved one and demand a ransom be paid for their release. Oftentimes, the criminal actor will express significant claims of violence towards the loved one if the ransom is not paid immediately. The criminal actor will then send what appears to be a genuine photo or video of the victim’s loved one, which upon close inspection often reveals inaccuracies when compared to confirmed photos of the loved one. Examples of these inaccuracies include missing tattoos or scars and inaccurate body proportions. Criminal actors will sometimes purposefully send these photos using timed message features to limit the amount of time victims have to analyze the images.
Images, videos, audio: It can all be faked with AI. My guess is that this scam has a low probability of success, so criminals will be figuring out how to automate it.
Post Syndicated from Explosm.net original https://explosm.net/comics/hatchet
New Cyanide and Happiness Comic
Post Syndicated from Bozho original https://blog.bozho.net/blog/4549
Този вот на недоверие е внесен заради факта, че под командването на Пеевски, управляващите бутат страната към икономическата пропаст. Бюджетът и арогантното поведение на управляващите бяха последните капки, които преляха чашата на търпението на широки обществени групи, които излязоха по площадите в цялата страна и извикаха “оставка”, в т.ч. много млади хора.
Днес управляващите вероятно ще извадят няколко числа от торбата със статистиката и ще кажат “какво ни говорите, всичко е наред”. От опозицията ще извадим други числа, с които да аргументираме, че нещата вървят надолу. Че индустриалното производство намалява, че износът се свива, че държавната политика стимулира инфлацията, че административната тежест върху малките и средни предприятия расте. И т.н. И т.н.
Но извън числата, хората на площада усещат, че нищо не е наред. И това не е заради еврозоната, която много от тях очакват. Това правилно усещане е заради нелегитимния начин, по който функционира това управление. Заради политическият паразит Делян Пеевски, който изсмуква легитимността от всяка власт и изважда десетки хиляди хора по улиците.
А какво общо има това с икономиката?
Икономиката страда от прекомерната държавна намеса с корупционен корен.
Икономиката страда от липсата на справедливо правосъдие.
Икономиката страда от рейдърството чрез репресивните органи, под контрола на Пеевски.
Икономиката страда от това, че в регулаторите са сложени зависими и в много случаи тежко некомпетентни хора, които да са там за да “удрят” организирано по команда едни и да слагат чадър на други.
Икономиката страда от това, че докато изпълнявате спуснатите задачи от Пеевски по телефона, модернизацията на страната се отлага за пореден път.
Икономиката изисква инвестиция в човешкия капитал, а не държане на хора в зависимост в държавни дружества – единствен работодател в даден район. Изисква инвестиция в млади лекари, а не наливане на пари в още и още схеми с лекарства и фиктивни хоспитализации вместо това.
Икономиката не може да издържи дълго тежестта на голямото Д, което фалира и проваля всеки бизнес, до който се докосне.
Оставката е необходима, защото не може икономиката на страната да бъде жертва на безграничния властови апетит на Пеевски и безграничния страх на Борисов заради собствените му грехове.
А партиите, които уж формират коалиционното управление, нямат думата. Защото ги е страх, защото са зависими. А ако погледнат политически на настоящата криза, всички трябва с двете ръце да гласуват за този вот на недоверие, защото съм сигурен, че и ГЕРБ, и ИТН, и дори БСП виждат и разбират какво причиняват и на страната, и на собствените си партии.
Вижте довечера колко хора има по площадите, които за пореден път ще викат срещу Пеевски и Борисов. Вижте гнева на тези хора за това, че искате да им бръкнете в джобовете и да ги осъдите да плащат дълговете, които теглите, за да угодите на един самозабравил се олигарх. Някои от тях са ваши бивши избиратели. И колкото по-дълго отказвате да го признаете пред себе си, толкова повече този протестен заряд ще ескалира. И не се надявайте, че като дойдат празниците, сте запазили властта. Вие властта вече сте я загубили, остава само това да бъде обективирано във формален акт.
Българите са свободни хора по душа. И като видят тази несвобода, която Пеевски и неговите парламентарни прислужници генерират, се разгневяват. Тревожат се за икономиката, за страната си, за бъдещето.
Като контрапункт на всички тези аргументи ще чуваме напоително мантрата за стабилността, която чуваме всеки път, когато властта на Пеевски се разклати. Не това чувахме от партиите, които свалихте последните два редовни кабинета, обаче. Имаше ли нужда от стабилност през 2021 г., когато ГЕРБ, ДПС, ИТН и Възраждане свалиха редовния кабинет? Имаше ли нужда от стабилност, когато при ротацията ГЕРБ през ден прекратяваха преговорите и после се връщаха, докато накрая не се направиха на обидени, само и само Пеевски да си получи квотата във ВСС, която ние отказахме да му дадем. Превърнахте думата “стабилност” в евфемизъм за “още крадене”.
Ще чуваме и за еврозоната. Изключително важен стратегически приоритет за страната, за който работиха последните редовни правителства. Но еврозоната, за щастие, вече е факт. И колкото и да не ви се иска, този успех ще трябва да го споделите с част от опозицията, които в моменти на колебание ви подтиквахме към искането на конвергентен доклад. И които се подписахме под декларацията на премиера и гуверньора, за да бъде ясен политическият консенсус за европейските ни партньори. Но ако искаме еврозоната да бъде успех за България, трябва властта да бъде легитимна и да има поне някакво остатъчно доверие, чрез което да може да омекоти първоначалния скептицизъм. Тази власт вече не е такава. И с оставането си, създава повече рискове за еврозоната.
Това е вотът на недоверие на протеста. Над сто хиляди души миналата седмица извикаха “Оставка” и вероятно още толкова довечера ще извикат същото.
И ще очакват избори веднага. И то честни и прозрачни избори, без измами и с възстановяване на машинното гласуване и отчитане. А след изборите ще очакват от нас да решим системната политическа криза като изолираме причините за нея. Санитарният кордон около голямото Д от началото на този парламент беше такъв опит, който вие, мнозинството в тази зала, отхвърлихте. Предпочетохте да бъдете мнозинство на страха и създадохте едно марионетно правителство – слабо и напълно подчинено на ненаситното Ново начало. Без воля за реформи, напомнящо свлачище, което започна да поглъща бъдещето и хората излязоха на улица, за да защитят доходите и бизнеса си от разрушителния ви нагон.
Да, политическата стабилност ще има позитивен ефект върху икономиката. Но такава стабилност не може да има, докато не решим фундаменталния проблем на упражняването на власт по демократични правила. И че не може властта да се упражнява с компромати, бухалки, чадъри, заплахи за наказателна репресия.
Още при вота на недоверие за завладяната държава ви казахме – превзетите институции водят до влошаване на благосъстоянието. Връзката е правопропорционална. Икономиката пряко се влияе от качеството на институциите, а вие правите точно обратното – подчинявате институциите на голямото Д. Тогава не ни послушахте. Затова ви го казаха хората на площадите. Оставка!
Материалът Вот на недоверие за икономическата политика в държавата с главно Д е публикуван за пръв път на БЛОГодаря.
Post Syndicated from Adam Barnett original https://www.rapid7.com/blog/post/em-patch-tuesday-december-2025
Microsoft is publishing a relatively light 54 new vulnerabilities this December 2025 Patch Tuesday, which is significantly lower than we have come to expect over the past couple of years. Today’s list includes two publicly disclosed remote code vulnerabilities, and a single exploited-in-the-wild vulnerability. Three critical remote code execution (RCE) vulnerabilities are also patched today; Microsoft currently assesses those as less likely or even unlikely to see exploitation. During December, Microsoft has already patched 14 browser vulnerabilities and more than 80 vulnerabilities in open source products, which are not included in the Patch Tuesday count above.
Microsoft has evidence that attackers are already making full use of CVE-2025-62221, a zero-day local elevation of privilege (EoP) vulnerability in the Windows Cloud Files Mini Filter Driver leading to SYSTEM privileges. File system filter drivers, aka minifilters, attach to the system software stack, and intercept requests targeted at a file system, and extend or replace the functionality provided by the original target. Typical use cases include data encryption, automated backup, on-the-fly compression, and cloud storage.
The Cloud Files minifilter is used by OneDrive, Google Drive, iCloud, and others, although as a core Windows component, it would still be present on a system where none of those apps were installed. Microsoft ranks CVE-2025-62221 as important rather than critical, since an attacker would need to have an existing foothold on the target system, but since it’s already exploited in the wild and leads to SYSTEM privileges, all but the most optimistic blue team threat models will surely treat CVE-2025-62221 as a top priority for remediation.
Under normal circumstances, PowerShell does a decent job of looking out for the unwary end user, and will wait for confirmation or even outright block unexpected attempts to run code from the internet that isn’t signed by a trusted publisher. Windows Mark-of-the-Web (MotW) functionality tracks files that were downloaded from the internet, but CVE-2025-54100 is a zero-day vulnerability which allows attackers to sidestep security controls that rely on MotW by the simple expedient of relying on code execution before the file is ever written. Microsoft is aware of public disclosure.
The Windows security updates published today address CVE-2025-54100 by altering the default functionality of Invoke-WebRequest in PowerShell 5.1 so that it will prompt the user, instead of simply executing potentially malicious code as it processes the full Document Object Model of the requested remote resource. Scripts that rely on the impacted functionality may hang indefinitely when encountering the new prompt, unless updated to pass the -UseBasicParsing parameter to Invoke-WebRequest, since this explicitly avoids the potential for script execution. PowerShell 7 avoids all of this by moving beyond dependency on the legacy MSHTML/Trident engine, which used to power Internet Explorer. However, PowerShell 5.1 is what’s installed by default with a fresh Windows installation, even for Server 2025 and Windows 11 25H2, because Microsoft has a hard time telling enterprise customers that continuing support for legacy business applications comes with an ever-increasing security cost.
The GitHub Copilot for Jetbrains plugin promises users that they can take control of their code using Copilot Edit Mode. Unfortunately, an attacker exploiting CVE-2025-64671 will be aiming to do something very similar. Microsoft is aware of public disclosure. In this scenario, cross-prompt injection, where an attacker hides malicious instructions inside a malicious file or within MCP server data, can lead to arbitrary command execution, where unsafe commands sneak past security boundaries while appended to safe, allowlisted commands. This issue is by no means specific to Copilot or Jetbrains; as the original researcher points out, this is an example of an entire class of vulnerabilities, where the addition of agentic AI to an IDE extends and alters the attack surface. Other well-known IDE vendors have assigned CVEs and/or published patches for broadly similar issues.
Microsoft Office is widely deployed, and it’s a rare Patch Tuesday when it doesn’t receive at least a few security updates. Two Office RCEs are particularly noteworthy this month. The advisory FAQs for both CVE-2025-62554 and CVE-2025-62557 mention that the Preview Pane is a vector, so a user who scrolls past a malicious email in Outlook or a sketchy file in Explorer could trigger exploitation without doing anything obviously wrong. However, it gets worse, because even receiving a specially-crafted email could trigger exploitation, without any requirement that the user open, read, or click on the malicious link within it. CVE-2023-23397, a widely-discussed critical Outlook vulnerability from some two-and-a-half years ago shares these characteristics. In that case, Microsoft detected in-the-wild exploitation by a Russia-based threat actor targeting government, military, and critical infrastructure targets in Europe. While there’s no suggestion that either of the vulnerabilities patched today necessarily result in NTLM hash disclosure in the same vein as CVE-2023-23397, the potential for exploitation without the need for any user interaction is a serious concern.
There are no significant Microsoft product lifecycle changes this month. Visual Studio 2022 LTSC 17.10 will reach end of life in January.
|
CVE |
Title |
Exploited? |
Publicly disclosed? |
CVSSv3 base score |
|
Azure Monitor Agent Remote Code Execution Vulnerability |
No |
No |
8.8 |
|
CVE |
Title |
Exploited? |
Publicly disclosed? |
CVSSv3 base score |
|
Microsoft Edge (Chromium-based) for Mac Spoofing Vulnerability |
No |
No |
4.3 |
|
|
Chromium: CVE-2025-13721 Race in v8 |
No |
No |
N/A |
|
|
Chromium: CVE-2025-13720 Bad cast in Loader |
No |
No |
N/A |
|
|
Chromium: CVE-2025-13640 Inappropriate implementation in Passwords |
No |
No |
N/A |
|
|
Chromium: CVE-2025-13639 Inappropriate implementation in WebRTC |
No |
No |
N/A |
|
|
Chromium: CVE-2025-13638 Use after free in Media Stream |
No |
No |
N/A |
|
|
Chromium: CVE-2025-13637 Inappropriate implementation in Downloads |
No |
No |
N/A |
|
|
Chromium: CVE-2025-13636 Inappropriate implementation in Split View |
No |
No |
N/A |
|
|
Chromium: CVE-2025-13635 Inappropriate implementation in Downloads |
No |
No |
N/A |
|
|
Chromium: CVE-2025-13634 Inappropriate implementation in Downloads |
No |
No |
N/A |
|
|
Chromium: CVE-2025-13633 Use after free in Digital Credentials |
No |
No |
N/A |
|
|
Chromium: CVE-2025-13632 Inappropriate implementation in DevTools |
No |
No |
N/A |
|
|
Chromium: CVE-2025-13631 Inappropriate implementation in Google Updater |
No |
No |
N/A |
|
|
Chromium: CVE-2025-13630 Type Confusion in V8 |
No |
No |
N/A |
|
CVE |
Title |
Exploited? |
Publicly disclosed? |
CVSSv3 base score |
|
Untrusted search path in auth_query connection in PgBouncer |
No |
No |
7.5 |
|
|
Apache HTTP Server: NTLM Leakage on Windows through UNC SSRF |
No |
No |
7.5 |
|
|
Apache HTTP Server: CGI environment variable override |
No |
No |
6.5 |
|
|
Apache HTTP Server: mod_userdir+suexec bypass via AllowOverride FileInfo |
No |
No |
5.4 |
|
CVE |
Title |
Exploited? |
Publicly disclosed? |
CVSSv3 base score |
|
Microsoft SharePoint Server Spoofing Vulnerability |
No |
No |
8.8 |
|
|
Microsoft Office Remote Code Execution Vulnerability |
No |
No |
8.4 |
|
|
Microsoft Office Remote Code Execution Vulnerability |
No |
No |
8.4 |
|
|
Microsoft Word Remote Code Execution Vulnerability |
No |
No |
7.8 |
|
|
Microsoft Word Remote Code Execution Vulnerability |
No |
No |
7.8 |
|
|
Microsoft Outlook Remote Code Execution Vulnerability |
No |
No |
7.8 |
|
|
Microsoft Excel Remote Code Execution Vulnerability |
No |
No |
7.8 |
|
|
Microsoft Excel Remote Code Execution Vulnerability |
No |
No |
7.8 |
|
|
Microsoft Excel Remote Code Execution Vulnerability |
No |
No |
7.8 |
|
|
Microsoft Excel Remote Code Execution Vulnerability |
No |
No |
7.8 |
|
|
Microsoft Excel Remote Code Execution Vulnerability |
No |
No |
7.8 |
|
|
Microsoft Excel Remote Code Execution Vulnerability |
No |
No |
7.8 |
|
|
Microsoft Access Remote Code Execution Vulnerability |
No |
No |
7.8 |
|
|
Microsoft Word Remote Code Execution Vulnerability |
No |
No |
7 |
|
CVE |
Title |
Exploited? |
Publicly disclosed? |
CVSSv3 base score |
|
hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent() |
No |
No |
9.8 |
|
|
gfs2: Fix unlikely race in gdlm_put_lock |
No |
No |
9.8 |
|
|
devlink: rate: Unset parent pointer in devl_rate_nodes_destroy |
No |
No |
9.8 |
|
|
Input: imx_sc_key – fix memory corruption on unload |
No |
No |
9.8 |
|
|
sctp: avoid NULL dereference when chunk data buffer is missing |
No |
No |
8.6 |
|
|
usb: cdns3: gadget: Use-after-free during failed initialization and exit of cdnsp gadget |
No |
No |
7.8 |
|
|
most: usb: Fix use-after-free in hdm_disconnect |
No |
No |
7.8 |
|
|
mm/secretmem: fix use-after-free race in fault handler |
No |
No |
7.8 |
|
|
bpf: Sync pending IRQ work before freeing ring buffer |
No |
No |
7.8 |
|
|
Vim for Windows Uncontrolled Search Path Element Remote Code Execution Vulnerability |
No |
No |
7.8 |
|
|
drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE |
No |
No |
7.3 |
|
|
x86: fix clear_user_rep_good() exception handling annotation |
No |
No |
7.1 |
|
|
ocfs2: clear extent cache after moving/defragmenting extents |
No |
No |
7.1 |
|
|
jfs: Verify inode mode when loading from disk |
No |
No |
7.1 |
|
|
fbdev: bitblit: bound-check glyph index in bit_putcs* |
No |
No |
7.1 |
|
|
KVM: arm64: Check the untrusted offset in FF-A memory share |
No |
No |
7.1 |
|
|
Bluetooth: hci_event: validate skb length for unknown CC opcode |
No |
No |
7.1 |
|
|
Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF |
No |
No |
7.1 |
|
|
virtio-net: fix received length check in big packets |
No |
No |
7 |
|
|
tipc: Fix use-after-free in tipc_mon_reinit_self(). |
No |
No |
7 |
|
|
sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto |
No |
No |
7 |
|
|
net: bridge: fix use-after-free due to MST port state bypass |
No |
No |
7 |
|
|
mptcp: fix race condition in mptcp_schedule_work() |
No |
No |
7 |
|
|
NFSD: free copynotify stateid in nfs4_free_ol_stateid() |
No |
No |
7 |
|
|
9p/trans_fd: p9_fd_request: kick rx thread if EPOLLIN |
No |
No |
7 |
|
|
nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() |
No |
No |
6.6 |
|
|
hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits() |
No |
No |
6.6 |
|
|
wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode |
No |
No |
6.5 |
|
|
vsock: Ignore signal/timeout on connect() if already established |
No |
No |
6.3 |
|
|
mptcp: fix a race in mptcp_pm_del_add_timer() |
No |
No |
6.3 |
|
|
scsi: sg: Do not sleep in atomic context |
No |
No |
6.2 |
|
|
net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() |
No |
No |
6.1 |
|
|
xfrm: delete x->tunnel as we delete x |
No |
No |
5.5 |
|
|
usb: gadget: f_fs: Fix epfile null pointer access after ep enable. |
No |
No |
5.5 |
|
|
smb/server: fix possible refcount leak in smb2_sess_setup() |
No |
No |
5.5 |
|
|
smb/server: fix possible memory leak in smb2_read() |
No |
No |
5.5 |
|
|
s390/ctcm: Fix double-kfree |
No |
No |
5.5 |
|
|
regmap: slimbus: fix bus_context pointer in regmap init calls |
No |
No |
5.5 |
|
|
pidfs: validate extensible ioctls |
No |
No |
5.5 |
|
|
orangefs: fix xattr related buffer overflow… |
No |
No |
5.5 |
|
|
ntfs3: pretend $Extend records as regular files |
No |
No |
5.5 |
|
|
nios2: ensure that memblock.current_limit is set when setting pfn limits |
No |
No |
5.5 |
|
|
net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak |
No |
No |
5.5 |
|
|
net: sched: act_connmark: initialize struct tc_ife to fix kernel leak |
No |
No |
5.5 |
|
|
net: openvswitch: remove never-working support for setting nsh fields |
No |
No |
5.5 |
|
|
net/mlx5: Clean up only new IRQ glue on request_irq() failure |
No |
No |
5.5 |
|
|
iommufd: Don’t overflow during division for dirty tracking |
No |
No |
5.5 |
|
|
fuse: fix livelock in synchronous file put from fuseblk workers |
No |
No |
5.5 |
|
|
fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds |
No |
No |
5.5 |
|
|
fbcon: Set fb_display[i]->mode to NULL when the mode is released |
No |
No |
5.5 |
|
|
exfat: validate cluster allocation bits of the allocation bitmap |
No |
No |
5.5 |
|
|
exfat: fix improper check of dentry.stream.valid_size |
No |
No |
5.5 |
|
|
drm/msm: Fix pgtable prealloc error path |
No |
No |
5.5 |
|
|
drm/amdgpu: hide VRAM sysfs attributes on GPUs without VRAM |
No |
No |
5.5 |
|
|
cifs: client: fix memory leak in smb3_fs_context_parse_param |
No |
No |
5.5 |
|
|
btrfs: ensure no dirty metadata is written back for an fs with errors |
No |
No |
5.5 |
|
|
be2net: pass wrb_params in case of OS2BMC |
No |
No |
5.5 |
|
|
amd/amdkfd: resolve a race in amdgpu_amdkfd_device_fini_sw |
No |
No |
5.5 |
|
|
accel/habanalabs: support mapping cb with vmalloc-backed coherent memory |
No |
No |
5.5 |
|
|
PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV |
No |
No |
5.5 |
|
|
NFSD: Fix crash in nfsd4_read_release() |
No |
No |
5.5 |
|
|
Input: cros_ec_keyb – fix an invalid memory access |
No |
No |
5.5 |
|
|
Bluetooth: bcsp: receive data only if registered |
No |
No |
5.5 |
|
|
Bluetooth: SCO: Fix UAF on sco_conn_free |
No |
No |
5.5 |
|
|
Bluetooth: MGMT: cancel mesh send timer when hdev removed |
No |
No |
5.5 |
|
|
Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern() |
No |
No |
5.5 |
|
|
Bluetooth: 6lowpan: reset link-local header on ipv6 recv path |
No |
No |
5.5 |
|
|
ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd |
No |
No |
5.5 |
|
|
drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU devices |
No |
No |
4.7 |
|
|
ALSA: usb-audio: Fix potential overflow of PCM transfer buffer |
No |
No |
4.3 |
|
|
mm/damon/vaddr: do not repeat pte_offset_map_lock() until success |
No |
No |
4.1 |
|
|
Improper validation of tag size in Text component parser |
No |
No |
N/A |
|
CVE |
Title |
Exploited? |
Publicly disclosed? |
CVSSv3 base score |
|
Excessive resource consumption when printing error string for host certificate validation in crypto/x509 |
No |
No |
7.5 |
|
|
LIBPNG has an out-of-bounds read in png_image_read_composite |
No |
No |
7.1 |
|
|
Improper application of excluded DNS name constraints when verifying wildcard names in crypto/x509 |
No |
No |
6.5 |
|
|
A denial-of-service vulnerability exists in github.com/sirupsen/logrus when using Entry.Writer() to log a single-line payload larger than 64KB without newline characters. |
No |
No |
5.9 |
|
|
Quadratic complexity in node ID cache clearing |
No |
No |
N/A |
|
|
Out-of-memory when loading Plist |
No |
No |
N/A |
|
|
KissFFT Integer Overflow Heap Buffer Overflow via kiss_fft_alloc |
No |
No |
N/A |
|
|
Excessive read buffering DoS in http.client |
No |
No |
N/A |
|
CVE |
Title |
Exploited? |
Publicly disclosed? |
CVSSv3 base score |
|
GitHub Copilot for Jetbrains Remote Code Execution Vulnerability |
No |
Yes |
8.4 |
|
CVE |
Title |
Exploited? |
Publicly disclosed? |
CVSSv3 base score |
|
Microsoft Exchange Server Elevation of Privilege Vulnerability |
No |
No |
7.5 |
|
|
Microsoft Exchange Server Spoofing Vulnerability |
No |
No |
5.3 |
|
CVE |
Title |
Exploited? |
Publicly disclosed? |
CVSSv3 base score |
|
Windows Resilient File System (ReFS) Remote Code Execution Vulnerability |
No |
No |
8.8 |
|
|
Windows Storage VSP Driver Elevation of Privilege Vulnerability |
No |
No |
7.8 |
|
|
Windows Storage VSP Driver Elevation of Privilege Vulnerability |
No |
No |
7.8 |
|
|
Windows Storage VSP Driver Elevation of Privilege Vulnerability |
No |
No |
7.8 |
|
|
Windows Shell Elevation of Privilege Vulnerability |
No |
No |
7.8 |
|
|
Windows Projected File System Elevation of Privilege Vulnerability |
No |
No |
7.8 |
|
|
Windows Projected File System Elevation of Privilege Vulnerability |
No |
No |
7.8 |
|
|
Windows Projected File System Elevation of Privilege Vulnerability |
No |
No |
7.8 |
|
|
Windows Projected File System Elevation of Privilege Vulnerability |
No |
No |
7.8 |
|
|
Windows Projected File System Elevation of Privilege Vulnerability |
No |
No |
7.8 |
|
|
Windows DWM Core Library Elevation of Privilege Vulnerability |
No |
No |
7.8 |
|
|
Windows DWM Core Library Elevation of Privilege Vulnerability |
No |
No |
7.8 |
|
|
Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability |
No |
No |
7.8 |
|
|
Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability |
No |
No |
7.8 |
|
|
Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability |
Yes |
No |
7.8 |
|
|
Application Information Service Elevation of Privilege Vulnerability |
No |
No |
7.8 |
|
|
Windows File Explorer Elevation of Privilege Vulnerability |
No |
No |
7.5 |
|
|
Windows File Explorer Elevation of Privilege Vulnerability |
No |
No |
7.3 |
|
|
Windows Camera Frame Server Monitor Information Disclosure Vulnerability |
No |
No |
7.1 |
|
|
Microsoft Brokering File System Elevation of Privilege Vulnerability |
No |
No |
7 |
|
|
Microsoft Brokering File System Elevation of Privilege Vulnerability |
No |
No |
7 |
|
|
DirectX Graphics Kernel Elevation of Privilege Vulnerability |
No |
No |
7 |
|
|
Windows DirectX Information Disclosure Vulnerability |
No |
No |
6.5 |
|
|
DirectX Graphics Kernel Denial of Service Vulnerability |
No |
No |
6.5 |
|
|
DirectX Graphics Kernel Denial of Service Vulnerability |
No |
No |
6.5 |
|
|
Windows Defender Firewall Service Information Disclosure Vulnerability |
No |
No |
4.4 |
|
CVE |
Title |
Exploited? |
Publicly disclosed? |
CVSSv3 base score |
|
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability |
No |
No |
8.8 |
|
|
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability |
No |
No |
8.8 |
|
|
Windows Remote Access Connection Manager Elevation of Privilege Vulnerability |
No |
No |
7.8 |
|
|
Windows Remote Access Connection Manager Elevation of Privilege Vulnerability |
No |
No |
7.8 |
|
|
Windows Installer Elevation of Privilege Vulnerability |
No |
No |
7.8 |
|
|
Windows Common Log File System Driver Elevation of Privilege Vulnerability |
No |
No |
7.8 |
|
|
Windows Client-Side Caching Elevation of Privilege Vulnerability |
No |
No |
7.8 |
|
|
Win32k Elevation of Privilege Vulnerability |
No |
No |
7.8 |
|
|
PowerShell Remote Code Execution Vulnerability |
No |
Yes |
7.8 |
|
|
Microsoft Message Queuing (MSMQ) Elevation of Privilege Vulnerability |
No |
No |
7.8 |
|
|
Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability |
No |
No |
6.5 |
|
|
Windows Hyper-V Denial of Service Vulnerability |
No |
No |
5.3 |
Post Syndicated from Achraf Souk original https://aws.amazon.com/blogs/security/how-to-customize-your-response-to-layer-7-ddos-attacks-using-aws-waf-anti-ddos-amr/
Over the first half of this year, AWS WAF introduced new application-layer protections to address the growing trend of short-lived, high-throughput Layer 7 (L7) distributed denial of service (DDoS) attacks. These protections are provided through the AWS WAF Anti-DDoS AWS Managed Rules (Anti-DDoS AMR) rule group. While the default configuration is effective for most workloads, you might want to tailor the response to match your application’s risk tolerance.
In this post, you’ll learn how the Anti-DDoS AMR works, and how you can customize its behavior using labels and additional AWS WAF rules. You’ll walk through three practical scenarios, each demonstrating a different customization technique.
The Anti-DDoS AMR establishes a baseline of your traffic and uses it to detect anomalies within seconds. As shown in Figure 1, when the Anti-DDoS AMR detects a DDoS attack, it adds the event-detected label to all incoming requests, and the ddos-request label to incoming requests that are suspected of contributing to the attack. It also adds an additional confidence-based label, such as high-suspicion-ddos-request, when the request is suspected of contributing to the attack. In AWS WAF, a label is metadata added to a request by a rule when the rule matches the request. After being added, a label is available for subsequent rules, which can use it to enrich their evaluation logic. The Anti-DDoS AMR uses the added labels to mitigate the DDoS attack.
Figure 1 – Anti-DDOS AMR process flow
Default mitigations are based on a combination of Block and JavaScript Challenge actions. The Challenge action can only be handled properly by a client that’s expecting HTML content. For this reason, you need to exclude the paths of non-challengeable requests (such as API fetches) in the Anti-DDoS AMR configuration. The Anti-DDoS AMR applies the challengeable-request label to requests that don’t match the configured challenge exclusions. By default, the following mitigation rules are evaluated in order:
event-detected AND challengeable-request THEN challenge.high-suspicion-ddos-request OR medium-suspicion-ddos-request OR low-suspicion-ddos-request) AND challengeable-request THEN challenge. Its sensitivity can be changed to match your needs, such as only challenge medium and high suspicious DDoS requests.high-suspicion-ddos-request THEN block. Its sensitivity can be changed to match your needs, such as block medium in addition to high suspicious DDoS requests.This customization can be done using two different approaches. In the first approach, you configure the Anti-DDoS AMR to take the action you want, then you add subsequent rules to further harden your response under certain conditions. In the second approach, you change some or all the rules of the Anti-DDoS AMR to count mode, then create additional rules that define your response to DDoS attacks.
In both approaches, the subsequent rules are configured using conditions you define, combined with conditions based on labels applied to requests by the Anti-DDoS AMR. The following section includes three examples of customizing your response to DDoS attacks. The first two examples are based on the first approach, while the last one is based on the second approach.
Let’s suppose that your main business is conducted in two main countries, the UAE and KSA. You are happy with the default behavior of the Anti-DDoS AMR in these countries, but you want to block more aggressively outside of these countries. You can implement this using the following rules:
high-suspicion-ddos-request or medium-suspicion-ddos-request labelsAfter adding your Anti-DDoS AMR with default configuration, create a subsequent custom rule with the following JSON definition.
Note: You need to use the AWS WAF JSON rule editor or infrastructure-as-code (IaC) tools (such as AWS CloudFormation or Terraform) to define this rule. The current AWS WAF console doesn’t allow creating rules with multiple AND/OR logic nesting.
Similarly, during an attack, you can more aggressively mitigate requests from unusual sources, such as requests labeled by the Anonymous IP managed rule group as coming from web hosting and cloud providers.
Suppose that your application has sensitive URLs that are compute heavy. To protect the availability of your application, you have applied a rate limiting rule to these URLs configured with a 100 requests threshold over 2 mins window. You can harden this response during a DDoS attack by applying a more aggressive threshold. You can implement this using the following rules:
event-detected label, configured with a 10 requests threshold over a 10-minute windowAfter adding your Anti-DDoS AMR with default configuration, and your rate-limit rule for sensitive URLs, create a subsequent new rate limiting rule with the following JSON definition.
Suppose that you are operating a legacy application that can safely scale to a certain threshold of traffic volume, after which it degrades. If the total traffic volume, including the DDoS traffic, is below this threshold, you decide not to challenge all requests during a DDoS attack to avoid impacting user experience. In this scenario, you’d only rely on the default block action of high suspicion DDoS requests. If the total traffic volume is above the safe threshold of your legacy application to process traffic, then you decide to use the equivalent of Anti-DDoS AMR’s default ChallengeDDoSRequests mitigation. You can implement this using the following rules:
ChallengeAllDuringEvent and ChallengeDDoSRequests rules configured in count mode.CapacityExceeded—when its thresholds are met.ChallengeDDoSRequests but only when the CapacityExceeded label is present: Challenge if ddos-request, CapacityExceeded, and challengeable-request labels are presentFirst, update your Anti-DDoS AMR by changing Challenge actions to Count actions.
Figure 2 – Updated Anti-DDoS AMR rules in example 3
Then create the rate limit capacity-exceeded-detection rule in count mode, using the following JSON definition:
Finally, create the challenge-if-ddos-and-capacity-exceeded challenge rule using the following JSON definition:
By combining the built-in protections of the Anti-DDoS AMR with custom logic, you can adapt your defenses to match your unique risk profile, traffic patterns, and application scalability. The examples in this post illustrate how you can fine-tune sensitivity, enforce stronger mitigations under specific conditions, and even build adaptive defenses that respond dynamically to your system’s capacity.
You can use the dynamic labeling system in AWS WAF to implement customization granularly. You can also use AWS WAF labels to exclude costly logging of DDoS attack traffic.
If you have feedback about this post, submit comments in the Comments section below.