Post Syndicated from LastWeekTonight original https://www.youtube.com/watch?v=RVqm-L6QAME
[$] Zig’s 0.14 release inches the project toward stability
Post Syndicated from daroc original https://lwn.net/Articles/1012809/
The Zig project has
announced the release of the 0.14 version of the language,
including changes from more than 250 contributors. Zig is a low-level,
memory-unsafe programming language that aims to compete with C instead of
depending on it. Even though the language has not yet had a stable release,
there are a number of projects using it as an alternative to C with better
metaprogramming.
While the project’s release
schedule has been a bit inconsistent, with the release of version 0.14 being
delayed
several times, the release contains a number of new convenience features,
broader architecture support, and the next steps toward removing Zig’s
dependency on LLVM.
Below: local privilege escalation (SUSE security team blog)
Post Syndicated from jzb original https://lwn.net/Articles/1013842/
The SUSE Security Team blog has a post with a
detailed analysis of a vulnerability (CVE-2025-27591)
in the below
tool for recording and displaying system data.
In January 2025, Below was packaged and submitted to openSUSE
Tumbleweed. Below runs as a systemd service with root privileges. The
SUSE security team monitors additions and changes to systemd service
unit files in openSUSE Tumbleweed, and through this we noticed
problematic log directory permissions applied in Below’s code.
The LLVM project stabilizes its Fortran compiler
Post Syndicated from daroc original https://lwn.net/Articles/1013844/
The LLVM project’s Fortran compiler, which has for many years gone by the name “flang-new”, will now simply be “flang”, starting from LLVM’s 20.1.0 release on March 4. The
announcement, which includes details about the history of flang, comes after a long period of development and discussion. The community has considered renaming flang several times before now, but has always held off out of a feeling that the compiler was not yet ready. Now, the members of the project believe that flang has become stable and complete enough to earn its name.
We are almost 10 years from the first announcement of what would
become LLVM Flang. In the LLVM monorepo alone there have been close
to 10,000 commits from around 400 different contributors. Undoubtedly
more in Classic Flang before that.
GStreamer 1.26.0 released
Post Syndicated from jzb original https://lwn.net/Articles/1013840/
Version
1.26.0 of the GStreamer cross-platform multimedia framework has
been released. Notable changes in this release include support for the
H.266
Versatile Video Coding (VVC) codec, Low Complexity Enhancement
Video Coding (LCEVC) support, closed caption improvements, and JPEG XS image codec
support.
Develop and test AWS Glue 5.0 jobs locally using a Docker container
Post Syndicated from Subramanya Vajiraya original https://aws.amazon.com/blogs/big-data/develop-and-test-aws-glue-5-0-jobs-locally-using-a-docker-container/
AWS Glue is a serverless data integration service that allows you to process and integrate data coming through different data sources at scale. AWS Glue 5.0, the latest version of AWS Glue for Apache Spark jobs, provides a performance-optimized Apache Spark 3.5 runtime experience for batch and stream processing. With AWS Glue 5.0, you get improved performance, enhanced security, support for the next generation of Amazon SageMaker, and more. AWS Glue 5.0 enables you to develop, run, and scale your data integration workloads and get insights faster.
AWS Glue accommodates various development preferences through multiple job creation approaches. For developers who prefer direct coding, Python or Scala development is available using the AWS Glue ETL library.
Building production-ready data platforms requires robust development processes and continuous integration and delivery (CI/CD) pipelines. To support diverse development needs—whether on local machines, Docker containers on Amazon Elastic Compute Cloud (Amazon EC2), or other environments—AWS provides an official AWS Glue Docker image through the Amazon ECR Public Gallery. The image enables developers to work efficiently in their preferred environment while using the AWS Glue ETL library.
In this post, we show how to develop and test AWS Glue 5.0 jobs locally using a Docker container. This post is an updated version of the post Develop and test AWS Glue version 3.0 and 4.0 jobs locally using a Docker container, and uses AWS Glue 5.0 .
Available Docker images
The following Docker images are available for the Amazon ECR Public Gallery:
- AWS Glue version 5.0 –
ecr.aws/glue/aws-glue-libs:5
AWS Glue Docker images are compatible with both x86_64 and arm64.
In this post, we use public.ecr.aws/glue/aws-glue-libs:5 and run the container on a local machine (Mac, Windows, or Linux). This container image has been tested for AWS Glue 5.0 Spark jobs. The image contains the following:
- Amazon Linux 2023
- AWS Glue ETL Library
- Apache Spark 3.5.2
- Open table format libraries; Apache Iceberg 1.6.1, Apache Hudi 0.15.0, and Delta Lake 3.2.1
- AWS Glue Data Catalog client
- Amazon Redshift connector for Apache Spark
- Amazon DynamoDB connector for Apache Hadoop
To set up your container, you pull the image from the ECR Public Gallery and then run the container. We demonstrate how to run your container with the following methods, depending on your requirements:
spark-submit- REPL shell (
pyspark) pytest- Visual Studio Code
Prerequisites
Before you start, make sure that Docker is installed and the Docker daemon is running. For installation instructions, see the Docker documentation for Mac, Windows, or Linux. Also make sure that you have at least 7 GB of disk space for the image on the host running Docker.
Configure AWS credentials
To enable AWS API calls from the container, set up your AWS credentials with the following steps:
- Create an AWS named profile.
- Open cmd on Windows or a terminal on Mac/Linux, and run the following command:
In the following sections, we use this AWS named profile.
Pull the image from the ECR Public Gallery
If you’re running Docker on Windows, choose the Docker icon (right-click) and choose Switch to Linux containers before pulling the image.
Run the following command to pull the image from the ECR Public Gallery:
Run the container
Now you can run a container using this image. You can choose any of following methods based on your requirements.
spark-submit
You can run an AWS Glue job script by running the spark-submit command on the container.
Write your job script (sample.py in the following example) and save it under the /local_path_to_workspace/src/ directory using the following commands:
These variables are used in the following docker run command. The sample code (sample.py) used in the spark-submit command is included in the appendix at the end of this post.
Run the following command to run the spark-submit command on the container to submit a new Spark application:
REPL shell (pyspark)
You can run a REPL (read-eval-print loop) shell for interactive development. Run the following command to run the pyspark command on the container to start the REPL shell:
You will see following output:
With this REPL shell, you can code and test interactively.
pytest
For unit testing, you can use pytest for AWS Glue Spark job scripts.
Run the following commands for preparation:
Now let’s invoke pytest using docker run:
When pytest finishes executing unit tests, your output will look something like the following:
Visual Studio Code
To set up the container with Visual Studio Code, complete the following steps:
- Install Visual Studio Code.
- Install Python.
- Install Dev Containers.
- Open the workspace folder in Visual Studio Code.
- Press Ctrl+Shift+P (Windows/Linux) or Cmd+Shift+P (Mac).
- Enter
Preferences: Open Workspace Settings (JSON). - Press Enter.
- Enter following JSON and save it:
Now you’re ready to set up the container.
- Run the Docker container:
- Start Visual Studio Code.
- Choose Remote Explorer in the navigation pane.
- Choose the container
ecr.aws/glue/aws-glue-libs:5(right-click) and choose Attach in Current Window.

- If the following dialog appears, choose Got it.

- Open
/home/hadoop/workspace/.

- Create an AWS Glue PySpark script and choose Run.
You should see the successful run on the AWS Glue PySpark script.

Changes between the AWS Glue 4.0 and AWS Glue 5.0 Docker image
The following are major changes between the AWS Glue 4.0 and Glue 5.0 Docker image:
- In AWS Glue 5.0, there is a single container image for both batch and streaming jobs. This differs from AWS Glue 4.0, where there was one image for batch and another for streaming.
- In AWS Glue 5.0, the default user name of the container is hadoop. In AWS Glue 4.0, the default user name was glue_user.
- In AWS Glue 5.0, several additional libraries, including JupyterLab and Livy, have been removed from the image. You can manually install them.
- In AWS Glue 5.0, all of Iceberg, Hudi, and Delta libraries are pre-loaded by default, and the environment variable
DATALAKE_FORMATSis no longer needed. Until AWS Glue 4.0, the environment variableDATALAKE_FORMATSwas used to specify whether the specific table format is loaded.
The preceding list is specific to the Docker image. To learn more about AWS Glue 5.0 updates, see Introducing AWS Glue 5.0 for Apache Spark and Migrating AWS Glue for Spark jobs to AWS Glue version 5.0.
Considerations
Keep in mind that the following features are not supported when using the AWS Glue container image to develop job scripts locally:
- Job bookmarks
- AWS Glue Parquet writer (see Using the Parquet format in AWS Glue)
- FillMissingValues transform
- FindMatches transform
- Vectorized SIMD CSV reader
- The property customJdbcDriverS3Path for loading the JDBC driver from an Amazon Simple Storage Service (Amazon S3) path
- AWS Glue Data Quality
- Sensitive data detection
- AWS Lake Formation permission-based credential vending
Conclusion
In this post, we explored how the AWS Glue 5.0 Docker images provide a flexible foundation for developing and testing AWS Glue job scripts in your preferred environment. These images, readily available in the Amazon ECR Public Gallery, streamline the development process by offering a consistent, portable environment for AWS Glue development.
To learn more about how to build end-to-end development pipeline, see End-to-end development lifecycle for data engineers to build a data integration pipeline using AWS Glue. We encourage you to explore these capabilities and share your experiences with the AWS community.
Appendix A: AWS Glue job sample codes for testing
This appendix introduces three different scripts as AWS Glue job sample codes for testing purposes. You can use any of them in the tutorial.
The following sample.py code uses the AWS Glue ETL library with an Amazon Simple Storage Service (Amazon S3) API call. The code requires Amazon S3 permissions in AWS Identity and Access Management (IAM). You need to grant the IAM-managed policy arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess or IAM custom policy that allows you to make ListBucket and GetObject API calls for the S3 path.
The following test_sample.py code is a sample for a unit test of sample.py:
Appendix B: Adding JDBC drivers and Java libraries
To add a JDBC driver not currently available in the container, you can create a new directory under your workspace with the JAR files you need and mount the directory to /opt/spark/jars/ in the docker run command. JAR files found under /opt/spark/jars/ within the container are automatically added to Spark Classpath and will be available for use during the job run.
For example, you can use the following docker run command to add JDBC driver jars to a PySpark REPL shell:
As highlighted earlier, the customJdbcDriverS3Path connection option can’t be used to import a custom JDBC driver from Amazon S3 in AWS Glue container images.
Appendix C: Adding Livy and JupyterLab
The AWS Glue 5.0 container image doesn’t have Livy installed by default. You can create a new container image extending the AWS Glue 5.0 container image as the base. The following Dockerfile demonstrates how you can extend the Docker image to include additional components you need to enhance your development and testing experience.
To get started, create a directory on your workstation and place the Dockerfile.livy_jupyter file in the directory:
The following code is Dockerfile.livy_jupyter:
Run the docker build command to build the image:
When the image build is complete, you can use the following docker run command to start the newly built image:

Appendix D: Adding extra Python libraries
In this section, we discuss adding extra Python libraries and installing Python packages using
Local Python libraries
To add local Python libraries, place them under a directory and assign the path to $EXTRA_PYTHON_PACKAGE_LOCATION:
To validate that the path has been added to PYTHONPATH, you can check for its existence in sys.path:
Installing Python packages using pip
To install packages from PyPI (or any other artifact repository) using pip, you can use the following approach:
About the Authors
Subramanya Vajiraya is a Sr. Cloud Engineer (ETL) at AWS Sydney specialized in AWS Glue. He is passionate about helping customers solve issues related to their ETL workload and implementing scalable data processing and analytics pipelines on AWS. Outside of work, he enjoys going on bike rides and taking long walks with his dog Ollie.
Noritaka Sekiyama is a Principal Big Data Architect on the AWS Glue team. He works based in Tokyo, Japan. He is responsible for building software artifacts to help customers. In his spare time, he enjoys cycling with his road bike.
Security updates for Wednesday
Post Syndicated from jzb original https://lwn.net/Articles/1013838/
Security updates have been issued by Debian (libmodbus), Fedora (thunderbird and vyper), Mageia (firefox, nss, python-django, python-jinja2, and thunderbird, thunderbird-l10n), Oracle (bind, kernel, rsync, and tigervnc), Red Hat (.NET 8.0, .NET 9.0, and libxml2), SUSE (iniparser and kernel), and Ubuntu (dotnet8, dotnet9, freerdp2, jinja2, libreoffice, linux, linux-hwe, linux-aws, linux-aws-hwe, linux-gcp, linux-gcp-4.15, linux-kvm, linux-oracle, linux-kvm, and opensc).
Explaining External Network Assessment with Vector Command
Post Syndicated from Ed Montgomery original https://blog.rapid7.com/2025/03/12/explaining-external-network-assessment-with-vector-command/

Learn how external network assessment works within Vector Command, Rapid7’s continuous red team managed service.
Understanding threat exposure management
Let’s start by providing some context around where Vector Command fits into a security program and more specifically Continuous Threat Exposure Management (CTEM). Threat exposure management involves identifying, assessing, and mitigating exposures within an organization’s digital environment CTEM has emerged as a dynamic program designed to address this expanding footprint and help organizations achieve a consistent and actionable security posture.
According to Gartner, some of the different technologies that can support a wider CTEM program can be organized into three distinct pillars:

“Your ‘always on’ red team”
Vector Command sits within the validation pillar, your ‘always on’ red team – validating results from technologies or services as well as validating that the controls in place are working as anticipated.
Explaining an external network assessment
An “external network assessment” refers to evaluating the security posture of an organization’s publicly accessible network perimeter. This essentially simulates a hacker’s perspective to identify vulnerabilities on systems and services directly reachable from the internet. This will include web servers, email servers, and exposed ports, to assess potential risks and weaknesses that could be exploited by malicious actors.
Goals of an external network assessment:
- Our red team is looking to discover potential entry points for attackers.
- Identify misconfigurations and weak security practices on exposed systems.
- Evaluate the overall security posture of the external network perimeter.
Rapid7’s Vector Command red team testing approach
Our Vector Command red team experts conduct comprehensive security assessments using a multi-faceted approach:
Initial discovery and assessment
We begin by leveraging EASM-discovered assets and IVM scan results to map your approved attack surface. Our experts validate IVM findings and conduct service discovery to ensure complete coverage.
Vulnerability identification
Our team searches for common web misconfigurations through directory testing, reviews exposed administrative functions, and checks for unauthenticated access to sensitive areas. We also conduct limited, non-intrusive password testing against services like email, IAM, and VPNs using information gathered during EASM scanning.
Continuous monitoring and testing
As an always-on managed service, we:
- Perform vulnerability scans using InsightVM
- Validate potentially exploitable findings before publishing them to your portal
- Monitor Rapid7’s Emergent Threat Response channels for new critical vulnerabilities
- Evaluate and test public Proof of Concept exploits when applicable
- Execute payloads to demonstrate successful breaches
- Assess credentials obtained through phishing campaigns
- Continuously retest your environment to ensure ongoing security
Throughout this process, we build comprehensive documentation of your attack landscape to inform future security assessments.
Take command of your attack surface
Rapid7 strengthens your organization’s security strategy through Vector Command, delivering comprehensive CTEM alongside our other exposure management solutions.
With Vector Command, customers can now have a team of experts continuously assess their external attack surface. This includes identifying any security gaps, and receiving remediation guidance on an ongoing basis.
Our series of Vector Command blog posts will continue and next up we will cover the TTP Post-Compromise Breach Simulation.
If you would like to hear more about the world of red teaming from one of our experts behind Vector Command, Rapid7 is running a virtual session at our 2025 Take Command Summit, find out more about it here.
Announcing support for upgrades to Java 21 in Amazon Q Developer
Post Syndicated from Brian Beach original https://aws.amazon.com/blogs/devops/announcing-support-for-upgrades-to-java-21-in-amazon-q-developer/
On February 14, Amazon Q Developer announced support for upgrades to Java 21. As a Java developer, I’m excited about this new capability, which will make it easier for me to keep my applications up-to-date and take advantage of the latest language features and performance improvements. In addition, the latest version of Amazon Q Developer includes improved summarization and recommendations that simplify the upgrade process and increase confidence in the results.
Amazon Q Developer is a generative AI-powered assistant that helps accelerate the modernization of enterprise applications. It can perform complex tasks like analyzing legacy code, mapping dependencies, and executing migration and modernization workflows. Amazon Q Developer frees up your team to focus on more strategic initiatives rather than getting bogged down in the undifferentiated heavy lifting of upgrading Java applications.
Staying current on Java versions is crucial, as each new release brings important security fixes, performance enhancements, and support for emerging frameworks and libraries. However, the effort required to manually migrate large Java codebases can be daunting. That’s where Amazon Q Developer has been invaluable. By offloading the tedious, labor-intensive parts of the upgrade process, your team can deliver important updates to users much faster while minimizing disruption.
The Benefits of Java 21
With the addition of Java 21 upgrade capabilities, Amazon Q Developer now supports upgrading applications from Java 8, 11, and 17 to Java 17 or 21. Some of the key benefits of Java 21 that I’m looking forward to include:
Virtual Threads: Virtual Threads are a new concurrency primitive introduced in Java 19 that reduce the effort of writing, maintaining, and debugging high-throughput concurrent applications. This unlocks significant performance improvements for your applications.
Improved Performance: Java 21 includes a variety of other language enhancements like Sequenced Collections, Record Patterns, and Pattern Matching that deliver tangible speed and efficiency gains.
Better Memory Management: Enhancements to the Z Garbage Collector in Java 21 result in more predictable garbage collection pauses and reduced memory footprint, leading to more stable and responsive applications.
Upgrading your team’s Java applications to Java 21 with Amazon Q Developer is a game-changer. It saves countless hours of manual effort that would otherwise be required to migrate all of your Java components.
Simplifying the Upgrade Process with Amazon Q Developer
Upgrading Java applications to Java 21 with Amazon Q Developer is easy. After configuring your project and ensuring it meets the prerequisites, you can simply invoke the /transform command in the Amazon Q Developer chat window of your integrated development environment (IDE). The following screenshot is from VS Code; however, Q Developer also supports JetBrain’s IDEs including IntelliJ IDEA and the qct command line.

Amazon Q Developer will then analyze your codebase, determine the necessary changes to upgrade to Java 21, and provide a detailed diff so you can review and accept the transformations. This not only saves you time, but also helps ensure a consistent, high-quality upgrade across all of your Java applications.
In addition to adding support for upgrading to Java 21, the latest version of Amazon Q Developer also enhances the summarization and recommendations it provides after completing the transformation. Once the upgrade to Java 21 is complete, Q Developer generates a detailed summary of the changes made, such as deprecated APIs removed and code refactored to leverage new Java features. It also includes tailored recommendations to further improve the application, taking advantage of the capabilities introduced in Java 21. For example, Q Developer suggested upgrading the logging framework and implementing pattern matching to make the code more concise. These summary and recommendation capabilities help ensure a smooth and comprehensive upgrade process.

Finally, Q includes recommendations to further improve the application beyond the upgrade to Java 21. For example, Q provided the following recommendations.

The summary and recommendation capabilities help ensure a smooth and comprehensive upgrade experience. Developers can review the detailed changes, understand the rationale behind them, and then selectively apply the suggested optimizations to fully unlock the benefits of Java 21. This level of transparency and guidance from Q Developer greatly simplifies the upgrade process and increases confidence in the resulting codebase.
Conclusion
In summary, the new Amazon Q Developer transformation capabilities for upgrades to Java 21 offload the labor-intensive task of keeping your Java applications up-to-date. The detailed summaries and tailored recommendations provided by Q Developer ensure a smooth and comprehensive upgrade process, and significantly streamline the upgrade process. I’m excited to start rolling this out and freeing up the team’s time to focus on higher-value work. If you’re a fellow Java developer, I’d highly encourage you to try out Amazon Q Developer for yourself. To get started, visit the Amazon Q Developer getting started page.
Best of: Dogs
Post Syndicated from The History Guy: History Deserves to Be Remembered original https://www.youtube.com/watch?v=DPUs04iRKf0
China, Russia, Iran, and North Korea Intelligence Sharing
Post Syndicated from Bruce Schneier original https://www.schneier.com/blog/archives/2025/03/china-russia-iran-and-north-korea-intelligence-sharing.html
Former CISA Director Jen Easterly writes about a new international intelligence sharing co-op:
Historically, China, Russia, Iran & North Korea have cooperated to some extent on military and intelligence matters, but differences in language, culture, politics & technological sophistication have hindered deeper collaboration, including in cyber. Shifting geopolitical dynamics, however, could drive these states toward a more formalized intell-sharing partnership. Such a “Four Eyes” alliance would be motivated by common adversaries and strategic interests, including an enhanced capacity to resist economic sanctions and support proxy conflicts.
Celebrating young tech creators at Coolest Projects Ireland 2025
Post Syndicated from Sophie Ashford original https://www.raspberrypi.org/blog/celebrating-young-tech-creators-at-coolest-projects-ireland-2025/
Earlier this month, young creators gathered at the Sport Ireland Campus National Indoor Training Centre in Dublin for Coolest Projects Ireland 2025, an inspiring showcase of creativity, coding, and problem solving. With more than 80 participants sharing over 60 incredible projects, this year’s event highlighted the passion and innovation of young creators from across Northern Ireland and the Republic of Ireland.
The day offered the chance for young people to share their digital projects, engage with a like-minded community, chat with VIP judges, and take part in exciting coding activities like Astro Pi Mission Zero. The event was once again supported by Meta, who sponsored the new AI category, continuing their commitment to promoting the importance of digital skills to young people.

Celebrating creativity
Coolest Projects is a space for all digital projects, across all levels and categories, from hardware inventions to AI to Scratch. The event celebrates not just the finished products, but also the learning journeys of young creators and skills such as problems solving and creativity.
Helen Gardner, Programme Manager at the Raspberry Pi Foundation, shared her enthusiasm about this year’s showcase:
“Returning to Dublin for Coolest Projects is always such a joy! It’s incredible to see the enthusiasm, creativity, and talent of young creators as they bring their ideas to life. This event is all about celebrating the community and inspiring the next generation of problem-solvers. It’s always so inspiring to witness their amazing projects and the energy they bring to the day!”
Participants at Coolest Projects Ireland included young people from schools, coding clubs such as Code Club and CoderDojo, and independent makers. Many were returning participants, excited to showcase their latest projects and connect with fellow creators. The sense of community and encouragement was felt throughout the event, with mentors, parents, and judges offering valuable support and feedback to support growth and celebrate achievements.
Spotlight on the judges favourites
This year, judges were particularly impressed with the originality and impact of the projects. We caught up with four of the creators to find out why being involved in Coolest Projects Ireland was important to them.

Sister duo, Riddhiba and Aarushiba, created Innovaid, a project that uses technology to improve safety at events.
“We wanted to solve a problem that was affecting a large number of people. Having read news articles, and having talked to people who have had bad experiences at concerts and large events, we wanted to solve this problem that has been ongoing for many years. Although technology has advanced rapidly in the past years, there are still flaws in large event management leading to incidents and deaths. We wanted to incorporate safety, medical aid, crowd management, and inclusivity.”
“Coolest Projects Ireland was an amazing experience for both of us, we got the opportunity to meet with so many people that were so passionate about technology and coding. We met many people who also wanted to make a change in society, or wanted to solve problems.”
Coolest Projects also welcomed an AI category, supported by Meta, for the first time, which included Kirsty’s entry, A haon, dó, trí – Learn with me. Kirsty’s entry used machine learning to help learners master the Irish language in an engaging and interactive way. Kirsty shared a little about her journey with the project

“I really enjoyed some of the machine learning with Scratch projects on the Raspberry Pi site. While doing the ‘Alien language’ project, it occurred to me that I could use a similar approach to build a game to help young kids learn Irish.”
“I had to build my own Irish language training data set so I recorded lots of speech samples from my school friends. However, I go to an all-girls school, which would have meant my training data would have been very limited! So I recorded some boys’ voices at my CoderDojo to make my data set more varied and balanced.”
In the Games category, Timi received acknowledgement for his project, Stakes & Laughters Maximus.
“I got the idea from a story my dad told me about when I was younger. I apparently got really upset when I lost a game of Snakes and Ladders. So, I wanted to make a Snakes and Ladders game that wasn’t just about luck. I wanted players to have to think strategically about how to use their luck.”
“There were many challenges! Everything from the character movement to the turn system and the items presented roadblocks. But I broke through them by carefully thinking about what I wanted to achieve and then using code to create the logic for it.”

Get involved
The Coolest Projects online showcase is open for entries, providing young people worldwide the opportunity to share their digital creations.
We also have upcoming in-person events in the US, UK, and around the world thanks to our partner organisations. You can find out more and get involved with these through the Coolest Projects website.
Finally, we want to say a huge thank you to everyone who made Coolest Projects Ireland 2025 such a fantastic experience! We can’t wait to see what young innovators create next year.
The post Celebrating young tech creators at Coolest Projects Ireland 2025 appeared first on Raspberry Pi Foundation.
В социалното огледало на „Берлинале 2025“. Някои впечатления
Post Syndicated from Лина Кривошиева original https://www.toest.bg/v-sotsialnoto-ogledalo-na-berlinale-2025/

„Всичко е политика“ – твърдят го философи и икономисти, държавници и поети, историци и режисьори. Любопитното е, че фразата може да се тълкува в целия спектър между две противоположни значения: като критика на прекомерната политизация на всеки елемент от обществения и личния ни живот или като признание за неизбежното влияние на политиката върху ежедневието ни.
Малко политически контекст
Усещането около 75-тото издание на „Берлинале“ (13–23 февруари 2025 г.) е силно белязано от федералните избори в Германия, провели се в последния ден на фестивала. Тревогите около съкращаването на културния бюджет съвпадат по време и настроение с многохилядните демонстрации срещу крайнодясната Алтернатива за Германия (АзГ) и общото опасение, че в цяла Европа по-радикалните десни течения набират сила.
Опитът на Християндемократическия съюз (ХДС) да прокара точно преди изборите миграционен закон, който предвижда затягане на граничния контрол и други крути мерки срещу търсещите убежище в страната, скандализира обществото и разкрива тревожни паралели между позициите на социалдемократите и крайнодясната АзГ. Вместо в търсене на конструктивни решения за проблемите днес и възможностите на бъдещето, всички партии се впускат в спорове за и против бежанците, превръщайки миграцията в централен предизборен сблъсък.
Питам се: възможно ли е политиката и тук да е залитнала към лозунгите и бързите обещания? Да е загубила способност да влиза в диалог с хората, които страдат от грешни управленски модели?
Нима това чака Европа и света: да се лутаме между поляризации и сблъсъци, без да ни е грижа дали историята ще ни запомни като варвари? Тази вълна от въпроси намери естествено продължение в някои от филмите, които имах удоволствието да гледам на тазгодишното „Берлинале“ и които добре илюстрират характерните за сегашния момент безпокойства.
Румънският „Континентал ’25“
Един от най-силните участници в състезателната програма на фестивала беше „Континентал ’25“ на румънския режисьор Раду Жуде, който черпи вдъхновение от „Европа ’51“ на Роселини. Филмът проследява падението на Оршоя – бивша преподавателка по право, която сега работи като съдебен изпълнител. Задачата ѝ е да изгони бездомник, обитаващ мрачен сутерен, който предстои да бъде съборен от германска фирма, за да отстъпи място на луксозен хотел. Разпадането на стария свят и безразличието към по-слабия са в центъра на този мрачен, но сатиричен разказ. Създаден с почти подръчни материали (заснет за десетина дни на смартфон), той е страхотна деконструкция на източноевропейската социална дисфункция. Привидният му минимализъм се оказва изключително силен инструмент за разкриването на дълбока междуличностна и морална криза.
Един от най-въздействащите моменти е разговор на пейка, в който главната героиня изброява за какви каузи дарява по 2 евро на месец: за Украйна, за Газа, за местната ромска махала, за хора в затруднено положение… Списъкът расте, а у зрителя се натрупва усещане за абсурд и безпомощност: колко много неща се нуждаят от внимание и колко безсилно е едно SMS дарение, ако не променим неработещите системи, липсата на емпатия и самозатварящите се миниобщества. Съвсем логично „Континентал ’25“ получи „Сребърна мечка“ за сценарий.
Сръбският „Реституция, или сънят и явето на старата гвардия“
Филмът на Желимир Жилник и Таня Шливар беше прожектиран във „Форум“ – раздела за „новаторско, експериментално и неконвенционално кино“. Във Виена, докато издирва плочи на своята джаз група от 60-те, възрастният Стеван Арсин получава изненадващо обаждане. Сръбската държава е решила да върне на семейството му къщата, конфискувана по време на Втората световна война. Известието го мотивира да се завърне в родината си. Следва поредица от забавни образи и сцени, провокиращи въпроси за съвременната сръбска идентичност на фона на избледняващия спомен за бивша Югославия.
Зад тази на пръв поглед лека история за остаряването се крие метафора за балканската социална трансформация. От филма лъха усещането, че продължаваме да преповтаряме стари модели, които уж сме отхвърлили. Откриват се много паралели и с типичното българско недоволство, което често се оказва симптом на по-дълбока криза, а не просто моментно настроение. (Покрай „Съня и явето“ се замислих сериозно за това какво е да остаряваш в България: да станеш невидим, неактуален, често и неуважаван. Сведен само до един гласоподавател за една конкретна партия…)
Китайският „Място за живот“
Филмът на Хуо Мън (в състезателната програма с английското си заглавие Living the Land) следи живота на 10-годишния Ли Чуан в откъснато китайско село през 1991 г. Мястото изглежда спряло във времето – без индустрия, с фермери, жънещи на ръка, и ковачи на открити огнища. През погледа на Чуан виждаме сложните отношения в общността и суровия ѝ, но сплотен живот. Семейни истории, включващи тази на психично болния му братовчед, се смесват с моменти на споделена радост, като ядене на сладолед по време на жътва.
Модерността обаче настъпва – младоженци тръгват на меден месец с автобус, инвеститори търсят петрол под нивите. Докато някои виждат възможност за забогатяване, други се боят за земята си. Филмът завършва с чувство за несигурност – селото е между миналото и непредвидимия „прогрес“.
Въпреки тъгата „Място за живот“ улавя издръжливия дух на общността – хора, които оцеляват независимо от промените. Кадрите са бавни, поетични и отварят пространство за размисъл, вместо да дават готови отговори. Хуо Мън заслужено получи „Сребърна мечка“ за режисура.
Африканският „Древни гледки от бъдещето“
Филмът (включен в раздел Berlinale Special) представлява визуално изследване на темите за произход, дом, съдба и наследственост и е дело на Лемоан Джеремая Мосесе от Лесото, който работи в изгнание в Берлин. Въпреки че наративът се гради върху еднообразен монолог зад кадър, цялото е истински въздействащо благодарение на забележителната си атмосфера и операторската работа. Сред най-ярките моменти е митологичната сцена с орач, заравящ очите си в пръстта – акт на саможертва, чрез който идните поколения ще придобият прозрение.
За да предаде своето послание, Мосесе майсторски използва както великолепни природни гледки, така и енергични градски сцени. Визуалната естетика не служи просто като декор, а е и самостоятелен разказвач, придаващ дълбочина и емоционалност.
Монологът съдържа значими и лични послания, но повторяемостта му сякаш намалява силата на внушението. Независимо от това обаче, съчетанието между текст и образ създава силно кинематографично преживяване. Заключителната фраза – „Може би съм вече у дома“ – обобщава същността на филма: грандиозните идеи за съдба и идентичност намират своето разрешение в чувството за принадлежност.
Другият – това съм аз
Намирам нещо истински важно в това, че в два от по-горните филми се разпознах, а в останалите два срещнах „другия“, който ми е чужд. Все повече си давам сметка колко е необходимо да чуваме нуждите на хората, които са различни от нас, имат други потребности и дори мироглед, отричащ нашия. И колко е важно да търсим начин да се свържем помежду си, вместо взаимно да заклеймим позициите си – не да оправдаваме омразата, а да разбираме нуждите, страховете и усещането за изключеност на опонента си.
Голямата награда „Златна мечка“ беше присъдена на норвежкия „Мечтите“ (от трилогията от 2024 г. на Даг Йохан Хаугерюд, включваща „Сексът“ и „Любовта“) – куиър разказ за съзряването, – с което фестивалът още веднъж доказа, че е свободна сцена и за маргинализирани или по-рядко огласявани наративи. На берлинския фестивал е лесно да се почувстваме директно представени в част от сюжетите, а в други да подложим любопитството и емпатията си на изпитанието на съвсем непознати култури.
Затова и „Берлинале 2025“ беше колкото празник на киното, толкова и аудитория, в която се провежда сериозен разговор за травмите от миналото, проблемите в настоящето и несигурността на бъдещето.
Бюрокрацията, отчуждението, глобалната несправедливост и неспособността да общуваме нормално, когато не сме на едно мнение – в огледалото на тазгодишното „Берлинале“ видях много от нещата, които ме тревожат и иначе. Но и си припомних, че зад втвърдените политически позиции, зад речите и популизма има реални хора с драми и надежди. И че макар в живота да не е шумна, надеждата намира достойно място в киното, което продължава да търси мостове, изходи и нови начини да разкаже нашите истории.
Efficiently manage Amazon EC2 On-Demand Capacity Reservations (ODCRs) with split, move, and modify
Post Syndicated from Art Baudo original https://aws.amazon.com/blogs/compute/efficiently-manage-amazon-ec2-on-demand-capacity-reservations-odcrs-with-split-move-and-modify/
This post is written by Ninad Joshi, Senior Solutions Architect, Ballu Singh, Principal Solutions Architect, and Ankush Goyal, Enterprise Support Lead AWS.
Introduction
In today’s cloud-first world, managing compute capacity efficiently while making sure of application availability is crucial for your business. Amazon EC2 On-Demand Capacity Reservations (ODCR) is a valuable tool for organizations looking to manage their reservations, but managing reservations across multiple teams and accounts is challenging. Recently, AWS introduced new capabilities – split, move, and modify – that improve how organizations can manage their Capacity Reservations. In this post, we explore how these features can transform your operations.
Common ODCR management challenges
As a consumer of ODCR, you might face several challenges managing your Capacity Reservations. These challenges include but are not limited to the following:
- Underused reserved capacity in some accounts
- Inability to redistribute excess capacity efficiently
- Difficulty in managing existing capacity across multiple AWS accounts
- Difficulty in modifying reservation attributes post-creation
With multiple development teams and various projects running simultaneously, you might struggle with efficient capacity allocation. You might also find yourself dealing with situations where one team has excess capacity while another desperately needs it.
Use case 1: Redistributing capacity across teams
The unused capacity dilemma
Consider a scenario where your machine learning (ML) team has an ODCR for ten c5.2xlarge instances, but they’re only using five. Meanwhile, your Analytics team urgently needs three Amazon Elastic Compute Cloud (Amazon EC2) instances of the same type for a new project. Previously, your Analytics team would have had to create a new reservation, leading to unnecessary overhead of managing their own Capacity Reservation. Meanwhile, the five unused capacity slots of the ODCR owned by your ML team results in unnecessary costs.
Split capability to the rescue
Using the new split capability, you can now divide the existing ODCR (see ODCR-1 in the following figure), which has a total capacity of ten EC2 instances, and create a new ODCR with three of the unused capacity.
Figure 1: Before split, ODCR-1 with original total and unused capacity
This results in the creation of two ODCRs:
- Original ODCR: total capacity of seven instances for the ML team
- New ODCR: three instances for the Analytics team
The following figure illustrates the split result:
Figure 2: After split, ODCR-1 with updated total and unused capacity, and newly created ODCR-2
Sharing across accounts
The split operation creates the new ODCR in the same AWS account. If your teams operate under the same AWS account, then the split operation is direct without any further steps. However, if your teams use different AWS accounts, then you would need to use AWS Resource Access Manager (AWS RAM) to share the newly created ODCR after the split operation. This enables cross-account capacity management while maintaining centralized control.
Refer to the API and CLI documentation for further information on the split capability such as parameters, exceptions, and limits.
Use case 2: moving capacity between reservations
Scaling for growth
After a few days, when your Analytics team needs one more capacity to launch an instance for their expanding project, you need to add more capacity to ODCR-2.
Move capability to the rescue
Instead of creating a new ODCR for this purpose, you can move one of the unused slots from ODCR-1 to ODCR-2. This flexibility saves you multiple steps involved in reserving new capacity, removes any disruptions to running existing workloads, and helps with simpler ODCR management. This rebalancing makes sure of optimal resource usage without further procurement.
Figure 3: Before move, ODCR-1 with unused capacity and ODCR-2 with current capacity
Figure 4: After move, ODCR-1 with reduced capacity and ODCR-2 with additional capacity
Refer to the API and CLI documentation for further information on the move capability such as parameters, exceptions, and limits.
Use case 3: adjusting reservation attributes for changing workload patterns
Dynamic workload requirements
When your data processing workload patterns change significantly, you must adapt. Initially, you might have set up your ODCR with specific instance matching criteria, making it a targeted reservation for predictable workloads. However, as you introduce more dynamic, impromptu analysis projects, you need more flexibility in how instances can be launched against your reservation.
Modify feature to the rescue
Using the modify capability, you can now change the reservation’s attributes without creating a new reservation or disrupting running workloads. You can modify your ODCR by:
- Changing instance quantity
- Changing instance eligibility from Targeted to Open
- Adjusting the reservation’s end date to align with your project timeline
This modification allows you to:
- Launch new instances more flexibly without strict instance eligibility
- Improve the usage of reserved capacity across different projects
- Maintain cost optimization while adapting to changing business needs
The modify feature provides this flexibility while making sure that your existing workloads continue running uninterrupted, making it an invaluable tool for dynamic environments. See the following figures for an example where the instance quantity of ODCR-2 is modified from four to six:
Figure 5: Before modify, ODCR-2 with total capacity of four and instance eligibility of targeted
Figure 6: After modify, ODCR-2 with new total capacity of six and instance eligibility of open
Increasing ODCR size or creating a new one is subject to capacity availability in Amazon EC2 on-demand availability. Therefore, if unused capacity is available in an existing ODCR, then moving/splitting that could be a better option than modifying an ODCR.
Refer to the AWS Documentation for more information on pre-requisites and considerations when modifying Capacity Reservations.
Refer to the API and CLI documentation for further information on the modify capability such as parameters, exceptions, and limits.
Special considerations for split capacity
In the preceding sections, we saw how you can use the split capability to detach excess unused capacity to create an ODCR for another team. However, you can also use this capability to split used capacity to create new ODCRs. This capability is particularly helpful when you want to split partially used ODCRs to create a new one for easier tracking and management. Along with the considerations for splitting unused/excess capacity, the following considerations apply for splitting used capacity:
- The used capacity can only be split for an ODCR with open instance eligibility that isn’t shared with any account.
- The instances running inside the reservation are of open eligibility (in other words they are not targeting the reservation).
- When you split the used capacity, the eligible instances are randomly selected. You cannot specify which running instances are split. If a sufficient number of eligible instances aren’t found to fulfill the split quantity, then the split operation fails. When you specify the quantity of instances to be split, by default any unused capacity is moved first, followed by any eligible running instances (the used capacity in your reservation).
In the next section we different scenarios where you can or can’t use split capability.
Scenario 1: managing internal ODCRs (Capacity Reservation not shared with any other AWS account)
For your internal projects, when managing ODCRs that aren’t shared with external partners (other AWS accounts) and all have open instance eligibility, consider this example with ODCR-1:
- Total capacity of ten c5.2xlarge instances, all with open instance eligibility
- Eight instances currently in use by your ML team
- Two unused instances
Figure 7: Before split, ODCR-1 with total capacity of 10 and 2 unused instances
This ODCR isn’t shared with any external AWS accounts, thus you have maximum flexibility in splitting the reservation. You can split up to nine instances into a new reservation (total capacity minus one), regardless of how many instances are currently in use. In this scenario, you can share used as well as unused capacity. This gives you significant freedom in restructuring the capacity allocation for your internal teams.
Figure 8: After split, ODCR-1 remains with total capacity of one, and ODCR-2 with total capacity of nine with two unused capacities
Scenario 2: managing shared ODCRs with partners (Capacity Reservation shared with other AWS account)
When you need to share your ODCR with a partner’s AWS account, consider this scenario where ODCR-1 has:
- Total capacity of ten c5.2xlarge instances
- Eight instances in use by both your team and your partner’s team
- Two unused instances
Figure 9: Before split, ODCR-1 shared with another AWS account
In this case, your options are more limited. ODCR-1 is shared with your partner’s AWS account, thus you can only split the unused capacity (maximum of two instances). After split, the newly created ODCR (ODCR-2) remains in your AWS account and isn’t shared with any other AWS account. This restriction helps prevent any disruption to your partner’s running workloads while still allowing for some flexibility in capacity management.
Figure 10: After split, ODCR-1 remains shared with another AWS account, and newly created ODCR-2 isn’t shared
These scenarios demonstrate important factors about capacity management in both internal and partner-shared environments. You should carefully consider the sharing status of ODCRs before planning any splits or modifications, making sure of smooth operations for both your teams and your partners.
Special considerations for move capability
The move capability enables you to redistribute available (or excess) capacity between ODCRs. However, in certain cases, you can also use this capability to move used instances between ODCRs. This capability is particularly helpful if you want to merge partially used ODCRs into one for easier tracking and management. Along with the considerations for moving unused capacity, the following considerations apply for moving used capacity:
- Both source and destination ODCR are of open instance eligibility and in active state.
- The instances running inside the reservation are of open eligibility (in other words they are not targeting the reservation).
- Both source and destination ODCRs are owned by the same account.
- The source and destination ODCRs can be shared, but with the same list of accounts when moving used portion. This sharing to same accounts condition doesn’t apply to the unused portion of the ODCR.
When you specify the quantity of instances to be moved, by default any unused capacity is moved first, followed by any eligible running instances (the used capacity in your reservation).
In the next sections, we review where you can or can’t use this capability.
Scenario 1: source and destination ODCRs not shared with other account(s) (Team Transfers)
When managing capacity between your internal teams using the same AWS account (Account-A), you find the process clear. For example, when consolidating the ML team’s resources:
- ODCR-1 (ML Team A): had ten capacities total (all with open eligibility), with eight in use and two unused.
- ODCR-2 (ML Team B): had five capacities (all with open eligibility), all in use.
Figure 11: Before move, ODCR-1 and ODCR-2 both in the same AWS account, unshared
Both ODCRs belonged to the same account and weren’t shared externally, and the ODCRs have open instance eligibility. Therefore, you could freely move all ten instances from ODCR-1 to ODCR-2, creating a unified pool of 15 instances for the consolidated DevOps team.
Figure 12: After moving capacity from ODCR-1, ODCR-2 has combined total capacity of 15 with 2 unused
Scenario 2: source and destination ODCRs shared with the same account(s) (External Partner Collaboration)
If your ML team (ODCR-1) collaborates with an external AI research partner (Account-B), your setup might look like the following:
- ODCR-1: ten instances (eight used, two unused), all with open instance eligibility, shared with the research partner through AWS RAM.
- ODCR-2: Five instances (all used), all with open instance eligibility, for internal Analytics team.
Figure 13: Before move, ODCR-1 and ODCR-2 both in the same AWS account, with ODCR-1 shared with other AWS account
When your Analytics team needs more capacity, you can only move the two unused instances from ODCR-1 to ODCR-2, as the other eight are actively used in the partner collaboration.
Figure 14: Since ODCR-1 is shared with other AWS account, only unused capacity is moved to ODCR-2
Scenario 3: source and destination ODCRs shared with different account(s) (Multi-Partner Projects)
In this scenario involving managing capacity across different partner engagements:
- ODCR-1: Ten instances (eight used, two unused), shared with a database partner (Account-B).
- ODCR-2: Five instances (all used), shared with a security partner (Account-C).
Figure 15: ODCR-1 and ODCR-2 are shared with different AWS account
Due to the different partner arrangements, in other words ODCRs shared with another accounts, you can only move the two unused capacities from ODCR-1 to ODCR-2. This makes sure that there is no disruption to database partner workloads.
Figure 16: Only unused capacity moved to ODCR-2 due to shared capacity reservations
These scenarios teach valuable lessons about capacity management in multi-account environments. You can develop a comprehensive sharing strategy that balances flexibility with partner commitments, enabling you to optimize your resource usage while maintaining strong partner relationships.
Conclusion
The new ODCR features of AWS –a split, move, and modify – represent a significant advancement in cloud capacity management. For your organization, these features transform how you handle compute resources, enabling more efficient operations and cost management. The ability to dynamically adjust and share Capacity Reservations provides the flexibility you need while maintaining the stability necessary for your critical workloads.
As cloud infrastructure continues to evolve, these features demonstrate the AWS commitment to addressing real-world challenges that you face when managing complex cloud environments. If you’re looking to optimize your AWS infrastructure, then these new ODCR capabilities offer powerful tools for better capacity management and resource usage.
To enhance your understanding of these capabilities, we’ve created a GitHub repository containing APIs for implementation purposes. For more details, refer to the updated Capacity Reservations documentation. If you have any questions or feedback, feel free to share them in the comments section or contact AWS Support.
A Corps of Engineers
Post Syndicated from The History Guy: History Deserves to Be Remembered original https://www.youtube.com/watch?v=kO6Xy4XqqYY
Comic for 2025.03.12 – Crime
Post Syndicated from Explosm.net original https://explosm.net/comics/crime-2
New Cyanide and Happiness Comic
Off By One
Post Syndicated from xkcd.com original https://xkcd.com/3062/

Announcing the end of support for Node.js 14.x and 16.x in AWS CDK
Post Syndicated from Adam Keller original https://aws.amazon.com/blogs/devops/announcing-the-end-of-support-for-node-js-14-x-and-16-x-in-aws-cdk/
On May 30th, 2025, the AWS Cloud Development Kit (CDK) will no longer support Node.js 14.x and 16.x, which reached end of life on 4/30/2023 (14.x) and 9/11/2023 (16.x). This change applies to all AWS CDK components that depend on Node.js, including the AWS CDK CLI, the Construct Library, and broader CDK ecosystem projects such as JSII, Projen, and CDK8s.
We encourage you to upgrade to a Node.js Active Long Term Support (LTS) version, which is Node.js 22.x as of March 11th, 2025. Given that Node.js 14.x and 16.x are past end of life, we recommend migrating your CDK projects to newer Node.js LTS versions as soon as possible.
Why are we doing this?
Node.js 14x and 16.x are past their End of Life and are no longer supported by the Node.js community. This means that there have not been any bug fixes or security updates to these versions. To make sure that we are providing up-to-date and secure libraries, we will drop support for these versions.
What’s changing?
After May 30th, 2025, the AWS CDK will no longer support Node.js 14.x and 16.x. While your existing deployments may continue to work, we will not address issues specific to these versions. Any bug reports or support cases that stem from using Node.js 14.x or 16.x will require reproducing the issue on a supported version of Node.js (18.x, 20.x, 22.x – as of February 26th, 2025) before further assistance can be provided.
Key points
- New features for the AWS CDK may rely on APIs or functionalities only available in supported versions of Node.js.
- Critical security patches and fixes related to Node.js 14.x or 16.x will not be backported.
- Compatibility testing will no longer be performed for Node.js 16.x, making it difficult to guarantee the CDK’s behavior with that runtime.
Timeline
- March 11, 2025 through May 30, 2025
- We will continue to support that arise for Node.js 14.x and 16.x during this period.
- Use this time to plan and test upgrades for your CDK projects to a Node.js Active Long Term Support (LTS) version.
- May 30, 2025 and onwards
- The AWS CDK is officially dropping support for Node.js 14.x and 16.x.
- Any bug fixes or security patches will target only supported versions of Node.js (18.x, 20.x, 22.x – as of March 11th, 2025)
Version validation and update steps
- Check your current Node.js version
- Run node -v in your environment or CI/CD pipelines to see which version of Node.js you’re currently using.
- Update your environment
- Install or switch your runtime to Node.js using a supported version via a version manager (e.g., nvm) or by downloading an official installer from nodejs.org.
- Validate your AWS CDK projects
- Ensure your deployment scripts, and any third-party dependencies work correctly under a supported version. Test thoroughly in non-production environments.
- Looking ahead
- For more information on our deprecation strategy moving forward, please see this RFC, which provides more details.
Conclusion
This deprecation is part of our ongoing commitment to provide a secure, high-quality experience for AWS CDK users. By moving to a Node.js Active Long Term Support (LTS) version, you’ll benefit from improved performance, ongoing security patches, and continued AWS CDK innovations. If you have any questions or concerns about this deprecation, please reach out and open an issue in our GitHub repo.
Patch Tuesday – March 2025
Post Syndicated from Adam Barnett original https://blog.rapid7.com/2025/03/11/patch-tuesday-march-2025/

Microsoft is addressing 57 vulnerabilities this March 2025 Patch Tuesday, which is a similar volume to last month. However, Microsoft has evidence of in-the-wild exploitation for as many as six of the vulnerabilities published today, and CISA KEV already lists all of them. Microsoft is also aware of public disclosure for one other vulnerability. This is now the sixth consecutive month where Microsoft has published zero-day vulnerabilities on Patch Tuesday without evaluating any of them as critical severity at time of publication. Today also sees the publication of six critical remote code execution (RCE) vulnerabilities. Ten browser vulnerabilities have already been published separately this month, and are not included in the total.
Win32 kernel subsystem: zero-day EoP
Older Windows products receive a patch today for CVE-2025-24983, which is an elevation of privilege vulnerability in the Win32 kernel subsystem. Microsoft is aware of exploitation in the wild. Since no user interaction is required, and successful exploitation leads to SYSTEM privileges, this isn’t one to ignore, even if the attacker must win a race condition, which does raise the bar for entry somewhat. Microsoft Windows 11 and Server 2019 onwards are not listed as receiving patches, so are presumably not vulnerable. It’s not clear why newer Windows products dodged this particular bullet; the Windows 32 subsystem is still presumably alive and well, since there is no apparent mention of its demise on the Windows client OS deprecated features list.
NTFS USB attack: zero-day information disclosure
Defense-in-depth practitioners have been limiting and monitoring access to USB ports for years now, and today brings further evidence for the value of locking things down, in the form of CVE-2025-24984, an information disclosure vulnerability in NTFS. Microsoft has evidence of exploitation in the wild, and functional exploit code. This vulnerability has a thus-far-unique combination of attributes: the attack vector is physical — the advisory describes a malicious USB drive as the delivery mechanism — and the weakness is CWE-532: Insertion of Sensitive Information into Log File. The advisory doesn’t quite join the dots, but successful exploitation appears to mean that portions of heap memory could be improperly dumped into a log file, which could then be combed through by an attacker hungry for privileged information. A relatively low CVSSv3 base score of 4.6 reflects the practical difficulties of real-world exploitation, but a motivated attacker can sometimes achieve extraordinary results starting from the smallest of toeholds, and Microsoft does rate this vulnerability as important on its own proprietary severity ranking scale.
NTFS VHD attack: zero-day information disclosure
If you like NTFS zero-day vulnerabilities, then today’s your lucky day! CVE-2025-24991 describes an out-of-bounds read in NTFS leading to information disclosure, specifically disclosure of small portions of heap memory. An attacker would need to trick a user into mounting a malicious VHD (Virtual Hard Disk), and that alone would be enough to trigger the vulnerability. The advisory does not explain how the attacker would exfiltrate the data, but clearly it’s practically possible, since Microsoft claims evidence of exploitation in the wild.
NTFS VHD attack: zero-day code execution
If you like NTFS zero-day vulnerabilities, but find information disclosure a bit pedestrian, then CVE-2025-24993 might be just what you’re after: exploitation requires that the user mount a malicious VHD, which then leads to heap-based buffer overflow, and the potential for local code execution. As is standard for a certain type of code execution vulnerability, the advisory somewhat awkwardly clarifies that the word “remote” in the title refers to the location of the attacker, and that the attack itself is carried out locally. The advisory doesn’t specify the context of code execution, but it’s a safe assumption that the end goal here is SYSTEM, since the attacker or a user must already execute code in the context of the user to trigger the vulnerability. The CVSSv3 base score of 7.8 reflects the potentially valuable reward for exploitation and low attack complexity, but is held back by the requirement for user interaction.
Fast FAT VHD attack: zero-day code execution
The Windows Fast FAT file system driver is the site of CVE-2025-24985, which Microsoft describes as a code execution vulnerability. Exploitation requires that the user mount a malicious VHD, leading to integer overflow or wraparound. Microsoft claims to have confirmed evidence of exploitation in the wild. The acknowledgments sections for CVE-2025-24984, CVE-2025-24991, CVE-2025-24993, and CVE-2025-24985 all credit an anonymous reporter. More than likely this is the same entity in each case, given the similarities between the four vulnerabilities.
Microsoft Management Console: zero-day security feature bypass
It’s been a few months since we saw a zero-day vulnerability in the Microsoft Management Console, but today brings us CVE-2025-26633, a security feature bypass for which Microsoft is aware of exploitation in the wild, as well as functional exploit code floating around somewhere out there on the internet. Successful exploitation leads to an outcome which isn’t specified by the advisory, but since the Microsoft Management Console has a feature set which includes the creation, hosting, and distribution of custom tools for the administrative management of both hardware and software for any supported version of Windows, it’s easy enough to see why an attacker might be interested. The advisory does mention that both preparation of the target environment and subsequent user interaction are required for successful exploitation, which would require the user to open a malicious file.
Microsoft Access: zero-day code execution
CVE-2025-26630 describes a remote-but-actually-local code execution vulnerability in Microsoft Access. Exploitation requires that the user open a malicious file. Microsoft is aware of public disclosure, but considers exploitation less likely. The weakness is our old friend CWE-416: Use After Free. Beyond that, the advisory is short on detail, but does claim that the Preview Pane is not an attack vector, so that’s a silver lining for this particular cloud. Going by the acknowledgements section of the advisory, it seems likely that relative newcomer Unpatched.ai intends to continue to shake things up, since they were also credited with a trio of zero-day Access vulnerabilities published back in January.
WSL magic email attack: critical RCE
The Windows Subsystem for Linux (WSL2) kernel receives a patch today for an arbitrary code execution vulnerability. Microsoft doesn’t claim evidence of public disclosure or in-the-wild exploitation for CVE-2025-24084, but does rank it as critical using its own proprietary severity ranking scale, which goes beyond what the already-significant CVSSv3 base score of 8.4 would suggest. The advisory describes multiple possible attack vectors, but in the worst case, there is no requirement for user interaction, since simply receiving a malicious email would be enough to trigger the vulnerability. The advisory does not clarify the context of code execution, but the magic email attack vector is alarming. Patch accordingly.
Malicious RDP server: critical RCE
How much do you trust the RDP server you’re about to connect to? An attacker in control of a malicious RDP server simply has to wait for a client vulnerable to CVE-2025-26645 to connect in order to achieve remote code execution on the client. Microsoft has assigned a CVSSv3 base score of 8.8 and a severity ranking of critical. While none of us should be connecting to RDP servers we’re not familiar with, an attacker might well see CVE-2025-26645 as a great opportunity for lateral movement and footprint expansion through the network.
Microsoft lifecycle update
In Microsoft product lifecycle news, SQL Server 2019 moved from mainstream support to extended support on 2025-02-28. Looking ahead, Visual Studio App Center will be retired on 2025-03-31, and Dynamics GP 2015 moves past the end of extended support on 2025-04-08.
Summary charts



Summary tables
Azure vulnerabilities
| CVE | Title | Exploited? | Publicly disclosed? | CVSSv3 base score |
|---|---|---|---|---|
| CVE-2025-24049 | Azure Command Line Integration (CLI) Elevation of Privilege Vulnerability | No | No | 8.4 |
| CVE-2025-26627 | Azure Arc Installer Elevation of Privilege Vulnerability | No | No | 7 |
| CVE-2025-21199 | Azure Agent Installer for Backup and Site Recovery Elevation of Privilege Vulnerability | No | No | 6.7 |
| CVE-2025-24986 | Azure Promptflow Remote Code Execution Vulnerability | No | No | 6.5 |
Browser vulnerabilities
| CVE | Title | Exploited? | Publicly disclosed? | CVSSv3 base score |
|---|---|---|---|---|
| CVE-2025-26643 | Microsoft Edge (Chromium-based) Spoofing Vulnerability | No | No | 5.4 |
| CVE-2025-1923 | Chromium: CVE-2025-1923 Inappropriate Implementation in Permission Prompts | No | No | N/A |
| CVE-2025-1922 | Chromium: CVE-2025-1922 Inappropriate Implementation in Selection | No | No | N/A |
| CVE-2025-1921 | Chromium: CVE-2025-1921 Inappropriate Implementation in Media Stream | No | No | N/A |
| CVE-2025-1919 | Chromium: CVE-2025-1919 Out of bounds read in Media | No | No | N/A |
| CVE-2025-1918 | Chromium: CVE-2025-1918 Out of bounds read in PDFium | No | No | N/A |
| CVE-2025-1917 | Chromium: CVE-2025-1917 Inappropriate Implementation in Browser UI | No | No | N/A |
| CVE-2025-1916 | Chromium: CVE-2025-1916 Use after free in Profiles | No | No | N/A |
| CVE-2025-1915 | Chromium: CVE-2025-1915 Improper Limitation of a Pathname to a Restricted Directory in DevTools | No | No | N/A |
| CVE-2025-1914 | Chromium: CVE-2025-1914 Out of bounds read in V8 | No | No | N/A |
Developer Tools vulnerabilities
| CVE | Title | Exploited? | Publicly disclosed? | CVSSv3 base score |
|---|---|---|---|---|
| CVE-2025-24043 | WinDbg Remote Code Execution Vulnerability | No | No | 7.5 |
| CVE-2025-24998 | Visual Studio Elevation of Privilege Vulnerability | No | No | 7.3 |
| CVE-2025-25003 | Visual Studio Elevation of Privilege Vulnerability | No | No | 7.3 |
| CVE-2025-26631 | Visual Studio Code Elevation of Privilege Vulnerability | No | No | 7.3 |
| CVE-2025-24070 | ASP.NET Core and Visual Studio Elevation of Privilege Vulnerability | No | No | 7 |
ESU Windows vulnerabilities
| CVE | Title | Exploited? | Publicly disclosed? | CVSSv3 base score |
|---|---|---|---|---|
| CVE-2025-24056 | Windows Telephony Service Remote Code Execution Vulnerability | No | No | 8.8 |
| CVE-2025-24051 | Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability | No | No | 8.8 |
| CVE-2025-26645 | Remote Desktop Client Remote Code Execution Vulnerability | No | No | 8.8 |
| CVE-2025-24035 | Windows Remote Desktop Services Remote Code Execution Vulnerability | No | No | 8.1 |
| CVE-2025-24045 | Windows Remote Desktop Services Remote Code Execution Vulnerability | No | No | 8.1 |
| CVE-2025-24064 | Windows Domain Name Service Remote Code Execution Vulnerability | No | No | 8.1 |
| CVE-2025-21180 | Windows exFAT File System Remote Code Execution Vulnerability | No | No | 7.8 |
| CVE-2025-24044 | Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability | No | No | 7.8 |
| CVE-2025-24993 | Windows NTFS Remote Code Execution Vulnerability | Yes | No | 7.8 |
| CVE-2025-24985 | Windows Fast FAT File System Driver Remote Code Execution Vulnerability | Yes | No | 7.8 |
| CVE-2025-24059 | Windows Common Log File System Driver Elevation of Privilege Vulnerability | No | No | 7.8 |
| CVE-2025-24072 | Microsoft Local Security Authority (LSA) Server Elevation of Privilege Vulnerability | No | No | 7.8 |
| CVE-2025-24071 | Microsoft Windows File Explorer Spoofing Vulnerability | No | No | 7.5 |
| CVE-2025-24983 | Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability | Yes | No | 7 |
| CVE-2025-26633 | Microsoft Management Console Security Feature Bypass Vulnerability | Yes | No | 7 |
| CVE-2025-24987 | Windows USB Video Class System Driver Elevation of Privilege Vulnerability | No | No | 6.6 |
| CVE-2025-24988 | Windows USB Video Class System Driver Elevation of Privilege Vulnerability | No | No | 6.6 |
| CVE-2025-24996 | NTLM Hash Disclosure Spoofing Vulnerability | No | No | 6.5 |
| CVE-2025-24054 | NTLM Hash Disclosure Spoofing Vulnerability | No | No | 6.5 |
| CVE-2025-24991 | Windows NTFS Information Disclosure Vulnerability | Yes | No | 5.5 |
| CVE-2025-24992 | Windows NTFS Information Disclosure Vulnerability | No | No | 5.5 |
| CVE-2025-24984 | Windows NTFS Information Disclosure Vulnerability | Yes | No | 4.6 |
| CVE-2025-24055 | Windows USB Video Class System Driver Information Disclosure Vulnerability | No | No | 4.3 |
| CVE-2025-21247 | MapUrlToZone Security Feature Bypass Vulnerability | No | No | 4.3 |
| CVE-2024-9157 | Synaptics: CVE-2024-9157 Synaptics Service Binaries DLL Loading Vulnerability | No | No | N/A |
Microsoft Office vulnerabilities
| CVE | Title | Exploited? | Publicly disclosed? | CVSSv3 base score |
|---|---|---|---|---|
| CVE-2025-24077 | Microsoft Word Remote Code Execution Vulnerability | No | No | 7.8 |
| CVE-2025-24079 | Microsoft Word Remote Code Execution Vulnerability | No | No | 7.8 |
| CVE-2025-24057 | Microsoft Office Remote Code Execution Vulnerability | No | No | 7.8 |
| CVE-2025-24080 | Microsoft Office Remote Code Execution Vulnerability | No | No | 7.8 |
| CVE-2025-24083 | Microsoft Office Remote Code Execution Vulnerability | No | No | 7.8 |
| CVE-2025-26629 | Microsoft Office Remote Code Execution Vulnerability | No | No | 7.8 |
| CVE-2025-24081 | Microsoft Excel Remote Code Execution Vulnerability | No | No | 7.8 |
| CVE-2025-24082 | Microsoft Excel Remote Code Execution Vulnerability | No | No | 7.8 |
| CVE-2025-24075 | Microsoft Excel Remote Code Execution Vulnerability | No | No | 7.8 |
| CVE-2025-26630 | Microsoft Access Remote Code Execution Vulnerability | No | Yes | 7.8 |
| CVE-2025-24078 | Microsoft Word Remote Code Execution Vulnerability | No | No | 7 |
Windows vulnerabilities
| CVE | Title | Exploited? | Publicly disclosed? | CVSSv3 base score |
|---|---|---|---|---|
| CVE-2025-24084 | Windows Subsystem for Linux (WSL2) Kernel Remote Code Execution Vulnerability | No | No | 8.4 |
| CVE-2025-24061 | Windows Mark of the Web Security Feature Bypass Vulnerability | No | No | 7.8 |
| CVE-2025-24048 | Windows Hyper-V Elevation of Privilege Vulnerability | No | No | 7.8 |
| CVE-2025-24050 | Windows Hyper-V Elevation of Privilege Vulnerability | No | No | 7.8 |
| CVE-2025-24995 | Kernel Streaming WOW Thunk Service Driver Elevation of Privilege Vulnerability | No | No | 7.8 |
| CVE-2025-24046 | Kernel Streaming Service Driver Elevation of Privilege Vulnerability | No | No | 7.8 |
| CVE-2025-24066 | Kernel Streaming Service Driver Elevation of Privilege Vulnerability | No | No | 7.8 |
| CVE-2025-24067 | Kernel Streaming Service Driver Elevation of Privilege Vulnerability | No | No | 7.8 |
| CVE-2025-24076 | Microsoft Windows Cross Device Service Elevation of Privilege Vulnerability | No | No | 7.3 |
| CVE-2025-24994 | Microsoft Windows Cross Device Service Elevation of Privilege Vulnerability | No | No | 7.3 |
| CVE-2025-25008 | Windows Server Elevation of Privilege Vulnerability | No | No | 7.1 |
| CVE-2025-24997 | DirectX Graphics Kernel File Denial of Service Vulnerability | No | No | 4.4 |
Build an enterprise API management solution using Amazon API Gateway
Post Syndicated from Roger Zhang original https://aws.amazon.com/blogs/architecture/build-an-enterprise-api-management-solution-using-amazon-api-gateway/
Enterprises face many challenges when they build and manage application programming interfaces (APIs). These challenges include security controls, version management, traffic control, and usage analytics. As digital businesses expand, a mature API management (APIM) solution is crucial for ensuring scalability, security, and operational efficiency.
This blog post shows how you can use Amazon API Gateway—along with AWS Lambda, Amazon DynamoDB, and other AWS services—to create a comprehensive and customizable APIM solution. This solution addresses the complex requirements of large enterprises managing APIs at scale.
Core features of APIM
API Management (APIM) centralizes the management and publishing of APIs for the entire enterprise, acting as a hub between clients, applications, and administrators on one side, and internal services, external systems, and large language models (LLMs) on the other, as shown in the following figure.

The key features of APIM include:
- Security and governance
- Authentication, authorization, rate limiting, and security policy enforcement.
- Helps ensure APIs meet organizational or industry standards.
- Monitoring and logging
- Provides monitoring, alarms, and logging to track API performance and troubleshoot issues quickly.
- Customization and transformation
- Offers protocol and field transformations, plus orchestration and aggregation.
- Makes it easier to integrate with different systems and meet various client needs.
- API lifecycle management
- Publishing, rollback, version control, and documentation.
- Streamlines development and maintenance throughout the API lifecycle.
- Developer and business tools
- Portals for developers, business owners, and administrators to manage documentation, billing, and analytics.
- Integration with LLMs
- Specialized adapters, proxy configurations, and switching to integrate AI models seamlessly.
- Flexible deployment options
- Canary releases, pipeline automation, and other advanced release strategies.
- Helps ensure stable, controlled API updates.
Unified management of multiple API gateways
API Gateway enforces resource limits of 300 resources per gateway, with a hard limit of 600. For enterprises that require more resources, managing multiple gateways individually can be time-consuming and error prone. APIM simplifies this by integrating API Gateway, Lambda, and DynamoDB; creating a centralized platform for managing APIs across multiple gateways. This integration streamlines the process, making it easier to scale and maintain APIs.
API lifecycle management
Managing API versions, publishing updates, and maintaining documentation often requires separate tools and manual processes, leading to inefficiencies. APIM centralizes these tasks in one portal, offering version control, publishing workflows, and rollback options. This streamlines the API lifecycle, ensuring consistency and reducing the chances for errors.
Enhanced security
Enterprises often need to implement different authentication strategies for various clients. These configurations typically require custom Lambda logic and database lookups, adding complexity and cost. APIM introduces configurable security policies that allow client-specific authentication without the need for additional custom code, reducing both complexity and operational overhead.
Customization and transformation
Enterprises frequently handle diverse client requests that involve different formats and protocols. Traditional API management approaches might struggle to support such variations. APIM allows for seamless protocol and field transformations, enabling integrations that meet a wide range of client requirements without additional development effort.
Developer portal
Developers need clear documentation, easy testing environments, and efficient API key management to work effectively. Traditional systems often lack these features, slowing down adoption. APIM provides a developer portal that consolidates API documentation, offers sandbox environments for testing, and simplifies API key management, reducing onboarding time and improving the developer experience.
Logging and monitoring
Log management is key to maintaining API performance, diagnosing issues, and gaining insights into usage. APIM uses API Gateway custom access logging, allowing teams to define logs based on business needs; whether creating separate CloudWatch metrics for each API path or exporting data to external platforms like ELK or Grafana.
Architecture overview
The APIM architecture, shown in the following figure, includes a management state (represented by numbers) and a runtime state (represented by letters). Both parts use a serverless paradigm.

Management state
The management state includes the following elements:
- Administrator portal access: Administrators access the APIM solution through a secured web portal.
- API Requests to APIM Lambda: Requests from the administrator’s API go through API Gateway, which then invokes the APIM Lambda function. This function handles logic related to configuration changes and other administrative actions.
In the following example, we show you how the APIM Lambda function dynamically applies different middleware based on the route configuration. This approach allows for flexible handling of authentication, client access restrictions, and request/response transformations. Here’s a quick breakdown of the key elements:
By using a middleware chain, you can customize how each request and response is processed on a per-route basis. This architecture not only keeps your code organized but also makes the API Gateway-integrated Lambda function far more adaptable to changing requirements. You can add or remove configurations from APIM portal as new use cases emerge—such as data transformations, custom logging, or additional security checks—without rewriting core logic.
- Configuration management: Administrators set up server-side and client-side settings, such as API Gateway parameters, authentication requirements, transformations, and more.
- Persistence: DynamoDB stores these configurations, providing persistent data storage and auditing capabilities.
- Asynchronous resource provisioning: After administrators save configurations and release them from the APIM portal, APIM creates or updates AWS resources—such as API Gateway, Lambda functions, and AWS Identity and Access Management (IAM). Lambda runs these updates in the background, so administrators can continue working uninterrupted.
Runtime state
The runtime state includes the following elements:
A. Client request: Clients send requests to the APIM endpoint.
B. Routing to the correct gateway: APIM uses the URI prefix in the API mappings associated with custom domain names to route requests to the appropriate API gateway, as shown in the following figure. Each mapping defines a specific API, stage, and an optional path. When a request arrives, APIM checks the path and directs the request to the correct stage and API if it matches. Unmatched requests default to the mapping with no path defined.
C. APIM core processing: A Lambda function (APIM CORE) uses DynamoDB configurations to handle authentication, authorization, protocol conversion, field transformation, and routing.
D. Downstream service call: APIM forwards each request to the configured internal or external endpoint.
E. Logging and monitoring: API Gateway access logs and custom logs track requests in detail.
F. Alarm: Metrics and alarms detect anomalies and notify stakeholders. Use Amazon CloudWatch or self-hosted solutions such as ELK to enable real-time monitoring and alerting.

Conclusion
In this post, we’ve demonstrated how to build an enterprise API management (APIM) solution using Amazon API Gateway, AWS Lambda, Amazon DynamoDB, and other AWS services. We’ve also shown how APIM centralizes critical features—such as version management, security policies, and request/response transformations—to accommodate large-scale enterprise requirements.
You can use the APIM portal to store and manage configurations in DynamoDB, dynamically applying these settings to multiple API gateways without rewriting code. This approach ensures consistent governance across diverse client types and business scenarios, helping to keep APIs both secure and flexible.
Finally, you’ve seen how the APIM architecture unifies the management state and runtime state, streamlines administrative tasks, and provides end-to-end monitoring and alerting. By adopting these best practices, your enterprise can establish a robust, scalable, and secure API management foundation, all within a serverless paradigm.














