Dieser Beitrag GitHub Actions als Angriffsplattform: Kampagne zielt auf cPanel/WHM ab erschien als erstes auf IT BOLTWISE x Artificial Intelligence.

Dieser Beitrag Attacke über GitHub Actions: Scans und Credential-Diebstahl gegen cPanel/WHM erschien als erstes auf IT BOLTWISE x Artificial Intelligence.

Tags: #Cyber Crime | #Ubuntu

Dieser Beitrag CVE-2026-8933: Ubuntu snap-confine ermöglicht lokalen Root-Zugriff auf Standard-Installationen erschien als erstes auf IT BOLTWISE x Artificial Intelligence.

Read more →

The post Ubuntu snap-confine Race Condition Enables Local Privilege Escalation to Root appeared first on IT Security News.

The post Ubuntu snap-confine Race Condition Enables Local Privilege Escalation to Root appeared first on Cyber Security News.

Read more →

The post Attackers Weaponize GitHub Actions Runners to Target cPanel and WHM Servers appeared first on IT Security News.

The post GitHub Actions Abuse Exploits cPanel CVE-2026-41940 to Steal Server Credentials appeared first on Cyber Security News.

Read more →

The post Ubuntu Snap-Confine Vulnerability Allows Unprivileged Users to Execute Code as Root appeared first on IT Security News.

The post Ubuntu snap-confine Flaw Lets Any Local User Gain Full Root Access appeared first on Cyber Security News.

The post Ubuntu Snap-Confine Vulnerability Allows Unprivileged Users to Execute Code as Root appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A Florida teen whose lawsuit claimed Meta’s platforms were to blame ⁠for his depression ⁠and anxiety ​dropped his case against the company just days before the trial in Los Angeles was ⁠set to start, his attorneys said on Wednesday. It was the latest in a massive series of high-stakes lawsuits against social media companies for allegedly designing addictive products that lead to the harm of children.

The lawsuit, brought by a 15-year-old boy known as ⁠RKC, originally named four defendants, Google’s YouTube, Meta’s Instagram, Snap Inc’s ​Snapchat and ByteDance’s TikTok. YouTube and TikTok ‌settled in June and Snap reached a tentative settlement in the case, Bloomberg ‌reported on Monday. The terms of those settlements were confidential.

Read more →

The post Teen Drops Landmark Addiction Case Against Meta appeared first on IT Security News.

Quelle

Read more →

The post CVE-2026-8933: Ubuntu security flaw breaks Snap sandbox protections appeared first on IT Security News.

### Added

• Added support for the OpenTofu .tofu file extension. Because OpenTofu uses the same HCL grammar as Terraform, .tofu files are now automatically detected and scanned as Terraform, so they are picked up by recursive scans and Terraform rulesets (e.g. p/terraform) with no extra configuration. (ENGINE-2884)

### Changed

• The window for collecting git contributor information during semgrep ci has been extended from the last 30 days to the last 90 days, to match the updated usage policy. (contributor-window-90-days)

### Fixed

• Fixed a source of rare, nondeterministic crashes and incorrect results caused
  by an OCaml compiler bug. Semgrep now builds against a compiler fork that
  backports the upstream fix. (ocaml_codegen_fix)
• Fixed excessive heap growth after explicit major garbage collections. Semgrep
  now builds against an OCaml compiler that improves garbage collection duty
  cycle pacing. (ocaml_gc_pacing_fix)
• Improved the Scan Status output when no code rules will run (e.g. a
  Secrets-only or Supply-Chain-only scan). The summary line no longer reports a
  confusing "0 Code rules", and the "Code Rules" section now states explicitly
  either that code scanning is not enabled or that there are no code rules to run,
  instead of printing an empty table. (ENGINE-2878)
• Fixed lockfileless Gradle dependency resolution failing with "Parsing
  dependency output failed (Resolve_gradle.gradle_resolved_dependency)". The
  github-dependency-graph-gradle-plugin used during resolution was fetched
  unpinned, and its 1.4.2 release renamed keys in its JSON output. The plugin is
  now pinned to 1.4.1. (sc-3738)

Read more →

The post Ubuntu snap-confine Flaw Could Give Local Users Root on Default Desktop Installs appeared first on IT Security News.

Read more →

The post IT Security News Hourly Summary 2026-07-22 21h : 12 posts appeared first on IT Security News.

Detection and response

Streamline investigations with bidirectional and enriched Microsoft Defender alerts

Bidirectional synchronization and enriched alert context for Microsoft Defender is now generally available for SIEM and MDR customers, enabling security teams to automatically synchronize alert status between Rapid7's SIEM and the Microsoft Defender console. With added process tree and user identity context, analysts can investigate threats more efficiently while reducing manual effort.

Confidently scale detection engineering with Detection as Code

Detection as Code enables security teams to build, test, version, and deploy detections using Terraform and modern engineering workflows. Built-in validation, guardrails, and version control help teams deliver higher-quality alerts, maintain more consistent coverage, and scale detection engineering more effectively.

Strengthen ransomware resilience with Ransomware Prevention for Incident Command

Ransomware Prevention for Incident Command adds an intent-based layer of protection designed to stop ransomware encryption and endpoint damage before they disrupt operations. Built into the Insight Agent, this capability strengthens ransomware resilience while working alongside existing endpoint security investments, without adding operational complexity.

Compliance

New solutions webpages

Across the globe, cybersecurity regulation is shifting away from static compliance checklists and toward ongoing risk management that blends proactive defense with effective detection and response. Rapid7’s platform, which brings exposure management and CTEM together with detection, response, and MDR, is well positioned to help organizations operationalize compliance across mandates such as NIS2, NIST CSF 2.0, DORA, HIPAA, HITRUST, and GovRAMP. To support that effort, Rapid7 has launched an updated library of dedicated compliance solution pages that map platform capabilities to the requirements that matter most across industries and regions. The first set of pages is live now, with more to follow in the coming weeks.

• NIST CSF 2.0

• HIPAA

• HITRUST

• NIS2

• GovRAMP

Exposure management

Turn prioritized exposures into remediation progress

We improved Remediation Hub to help teams turn prioritized exposures into more actionable remediation progress. Updates to the Top Remediations Report add asset-level context, including operating system, IP address, cloud provider, tags, endpoint protection, and patch management details, so teams can better understand what needs to be fixed and who needs to act.

With clearer patch and endpoint coverage signals, reboot status, customizable filters, exportable reports, and scheduled email delivery, teams can spend less time assembling manual updates and more time tracking the remediation work that reduces risk. Read the full blog to learn more about how Exposure Command helps teams move from prioritized exposures to remediation progress.

AI pre-triage for AppSec findings

Rapid7 is also making application security testing faster and more focused with AI vulnerability pre-triaging for InsightAppSec. Available now for AppSec customers in supported regions, the capability uses AI to automatically remove false positives during the scan process, helping teams spend less time manually reviewing findings and more time remediating actual risk.

Initial coverage started with BlindSQL, and the latest engine release adds AI validation for BlindNoSQL findings, including content-based and timing-based detections. The result is a cleaner, more confident view of application risk, so security teams can focus on high-impact vulnerabilities and accelerate remediation with less manual effort.

Attack surface management

Open-source MCP Server and Agent Skill

We are delighted to announce the introduction of a free, open-source MCP Server and Agent Skill for Bulk Export. Bulk export is a highly efficient way to access all your Rapid7 vulnerability and exposure data to AI assistants and custom AI workflows. Built as an open-source bridge, it helps customers bring their Rapid7 data into the tools and experiences that work best for their teams. Check out our blog for more detail.

Turn exposure filters into live dashboards

Surface Command also made exposure reporting easier with filter-based dashboard widgets. Teams can now turn saved asset and identity filters into live dashboards without writing Cypher queries, making it faster to track high-risk internet-facing assets, identity-driven exposure hotspots, unmanaged cloud infrastructure, and business-unit risk.

For continuous threat exposure management programs, this helps teams move from one-off reporting to repeatable, always-on views of exposure risk and remediation progress. Read this blog to learn more. 

Platform and Labs

Rapid7 Command Platform

Cyber GRC

Rapid7 introduced Cyber GRC to select customers in Q2, giving teams an early look at a new way to connect security, risk, compliance, and third-party risk management in one program. Available to both Exposure Management and Detection and Response customers, Cyber GRC brings governance and compliance workflows closer to the security data teams already use every day.

Cyber GRC will be broadly available in late July. It helps organizations move toward continuous compliance by mapping controls to real environment telemetry, automating evidence collection, and prioritizing risk with live attack surface context. That means teams can spend less time chasing audit artifacts, screenshots, and vendor risk details, and more time understanding which controls, assets, third parties, and risks need attention now.

Rapid7 Labs

Rapid7 Quarterly Threat Landscape Report

The Rapid7 Quarterly Threat Landscape Report examines the key trends shaping today's threat landscape, drawing on MDR incident response, vulnerability intelligence, ransomware monitoring, and dark web telemetry. Q1 2026 data highlights the growing dominance of vulnerability exploitation as an initial access vector, the rise of zero-click vulnerabilities, evolving ransomware operations, and the accelerating pace at which attackers operationalize newly disclosed vulnerabilities. Read the report to explore all key findings and takeaways.

The latest threat research

Rapid7 researchers explored emerging trends shaping the threat landscape, including the growing commercialization of criminal AI-as-a-Service and the evolving tradecraft of advanced threat actors. From the underground adoption of AI tools for fraud and social engineering to an in-depth analysis of the Dropping Elephant malware campaign, these reports provide actionable intelligence on how attackers are adapting their techniques and what defenders can do to stay ahead.

Emergent Threat Response

This quarter's Emergent Threat Response (ETR) coverage highlights a sustained wave of high-impact vulnerabilities affecting widely deployed enterprise technologies, including Oracle PeopleSoft, Palo Alto Networks PAN-OS, Check Point VPN, Ivanti Sentry, cPanel/WHM, and Nginx UI. For each of these CVEs, Rapid7 tracked active exploitation and rapidly evolving attacker activity to provide timely guidance to help defenders assess risk and respond quickly. See all the details, and our latest ETR coverage, here.

From strengthening detection and response to advancing exposure management, expanding governance capabilities, and delivering actionable threat intelligence, Q2 demonstrated Rapid7’s continued focus on helping security teams do more with less complexity. Every enhancement this quarter was designed to reduce manual effort, surface the context that matters, and help organizations make faster, more confident security decisions. We’re carrying that momentum into the rest of the year, so stay tuned to our blog and releases as we continue building the security operations platform that helps defenders stay ahead of what’s next.

Read more →

The post New Ubuntu Desktop Vulnerability Turns Local Access Into Root Control appeared first on IT Security News.

Read more →

The post Ubuntu snap-confine Vulnerability Enables Local Root Access appeared first on IT Security News.

Read more →

The post Snap Reaches Tentative Settlement In Second Addiction Case appeared first on IT Security News.

The post AsyncAPI npm Supply Chain Attack Deploys Miasma RAT via Compromised GitHub Actions appeared first on Cyber Security News.

Read more →

The post Security Is a Platform Property, Not a Pipeline Step appeared first on IT Security News.

Written by: Jules Czarniak

Wo du uns folgen kannst: Facebook, Reddit, Google News, X, Threads

Satechi ergänzt sein Zubehörprogramm um eine Kollektion für das noch junge MacBook Neo. Die Geräte sollen nicht nur zusätzliche Anschlüsse bereitstellen, sondern auch optisch zum günstigsten Apple-Laptop passen. Der Hersteller bietet den OntheGo 5-in-1 Multiport Adapter, den USB-C Snap Hub und die Slim EX Wireless Mouse in den Farben Citrus, Blush, Indigo und Silver an. […]

The post Auf das MacBook Neo abgestimmt: Satechi-Zubehör in vier Farben first appeared on ifun.de.

• Capture offending gem details on bundler registry metadata errors by @kbukum1 in #15512
• Bundler: apply empty-checksum metadata patch to the v2 helper by @kbukum1 in #15513
• [Update graph] Ensure bystander txt files are removed before parsing for Python by @brrygrdn in #15508
• Handle global.json with no SDK version in dotnet_sdk parser by @brettfo in #15510
• Type the cargo ecosystem and remove it from the T.untyped burndown by @JamieMagee in #15492
• Type the conda ecosystem and remove it from the T.untyped burndown by @JamieMagee in #15493
• Type the docker ecosystem and remove it from the T.untyped burndown by @JamieMagee in #15495
• Use shared git-tag cooldown in terraform by @robaiken in #15472
• Retry corepack once on signature metadata error by @thavaahariharangit with @Copilot in #15466
• Type the deno, elm, devcontainers, bazel, and helm ecosystems by @JamieMagee in #15527
• Add word-separator and lowercase formatting for branch name by @AbhishekBhaskar in #15478
• Fix Docker cooldown not respected for multi-arch images missing Last-Modified by @robaiken with @Copilot in #15486
• Reduce redundant git-source probes during npm metadata resolution by @thavaahariharangit with @Copilot in #15480
• Type the maven ecosystem and remove it from the T.untyped burndown by @JamieMagee in #15531
• Add branch name config template format support with validation by @AbhishekBhaskar in #15535
• fix(gradle): prefer local gradlew for lockfile updates by @thavaahariharangit in #15546
• helm: support versioning-strategy (range-preserving updates) by @casey-robertson-paypal in #15218
• Bump gradle from 9.4.1-jdk21-ubi to 9.6.1-jdk21-ubi in /gradle by @dependabot[bot] in #15498
• [Update graph] Add support for requirements.txt 'layering' instead of compressing to a single file by @brrygrdn in #15521
• Allow periods in Helm values file names for Docker ecosystem by @telnet23 in #15557
• Match existing group PRs covering a subset of job directories by @IanButterworth in #15548
• Bump library/golang from 1.26.1-bookworm to 1.26.5-bookworm in /go_modules by @dependabot[bot] in #15562
• Fix npm security updates for transitive dependencies in workspace monorepos by @Swampen in #15514
• Add helm to the smoke-test matrix by @casey-robertson-paypal in #15554
• v0.386.0 by @dependabot-core-action-automation[bot] in #15564

New Contributors

• @telnet23 made their first contribution in #15557
• @Swampen made their first contribution in #15514

Full Changelog: v0.385.0...v0.386.0

Ein neues Notebook fühlt sich an wie ein digitaler Neubeginn: schnell, sauber, bereit für alles. Doch bevor Sie mit dem neuen Gerät loslegen, empfehlen wir einen kurzen System-Check. Denn viele Geräte leiden ab Werk an unnötiger Software, suboptimalen Einstellungen und deaktivierten Sicherheitsfunktionen.

Wir zeigen Ihnen die 10 wichtigsten Schritte, die Sie direkt nach dem ersten Einschalten erledigen sollten – damit Ihr Windows-11-Notebook von Anfang an mit voller Leistung und bestmöglichem Schutz läuft.

1. Windows einrichten und Updates installieren

Der erste Start ist vielleicht der wichtigste. Nehmen Sie sich die paar Minuten und richten Sie Windows sorgfältig ein, das kann Ihnen später manchen Ärger ersparen. Nach der Anmeldung (egal ob mit Microsoft- oder lokalem Konto) sollten Sie sofort nach Updates suchen:

1. Öffnen Sie Einstellungen → Windows Update.
2. Klicken Sie auf „Nach Updates suchen“ und installieren Sie alles, was hier angeboten wird.
3. Starten Sie den Rechner neu – und wiederholen Sie den Vorgang, bis keine Updates mehr anstehen.

Viele neue Notebooks liegen vor dem Verkauf monatelang im Lager. Deswegen fehlen oft wichtige Sicherheits- und Treiber-Updates. Optional können Sie auf der Website Ihres Herstellers (zum Beispiel Lenovo, Dell, HP, Asus) zusätzlich nach aktuellen Treibern für Grafik, WLAN oder Chipsatz suchen. Das sorgt für mehr Stabilität und Performance.

Tipp: Wenn Windows Sie mit Forderungen oder Empfehlungen zum Microsoft-Konto nervt, Sie das aber nicht wollen, dann lesen Sie unseren Ratgeber Windows ohne Microsoft-Konto nutzen – so geht’s.

Sie überlegen, ein neues Notebook zu kaufen? Hier finden Sie unsere Laptop-Tests mit Kaufempfehlung für jeden Einsatzzweck. Notebooks für Schüler und Studenten stellen wir in diesem Beitrag vor. Und wenn Sie auf der Suche nach einem Schnäppchen sind, dann lesen Sie hier unsere Tests der besten Laptops unter 500 Euro.

2. Unnötige Software finden und deinstallieren

Foundry

Hersteller lieben es, Notebooks mit Testversionen, Tools und Mini-Games zu überfrachten – als Nutzer hat man für diese „Bloatware“ oft weniger Begeisterung. Solche überflüssigen Programme fressen Speicher, starten gerne im Hintergrund und können Ihr schönes neues System ausbremsen. Deshalb gilt: Am besten gleich am Anfang ausmisten.

So gehen Sie vor:

1. Öffnen Sie Einstellungen → Apps → Installierte Apps.
2. Sortieren Sie nach Installationsdatum oder Hersteller.
3. Deinstallieren Sie alles, was Sie nicht kennen oder brauchen (etwa „McAfee Trial“, „Candy Crush“, oder die „Booking.com-App“).

Tipp: Noch gründlicher klappt’s mit Tools wie Revo Uninstaller, das auch versteckte Reste in der Registry aufspüren kann. Profi-Tipps zur Tiefenreinigung finden Sie hier. Weitere Tipps zur Beschleunigung von Windows erklären wir in diesem Beitrag.

Übrigens: Sollten Sie Windows 11 Home im Einsatz haben, dann entgehen Ihnen die vielen Vorteile der Pro-Version, die wir Ihnen hier vorstellen. Im PC-WELT Software-Shop ist das Windows-11-Upgrade für günstige 59,99 Euro statt 145 Euro erhältlich.

3. Wichtige Programme und Tools installieren

Jetzt kommt der kreative Teil: Ihr Notebook bekommt seine persönliche Grundausstattung. Diese Software sollte auf keinem neuen Windows-11-Gerät fehlen:

• Browser: Chrome, Firefox oder Brave – je nach Geschmack. Gamer greifen zu Opera GX.
• Office-Suite: Microsoft 365, LibreOffice oder Google Docs.
• PDF-Tool: Adobe Acrobat Reader, SumatraPDF oder PDF24.
• Antivirus: Windows Defender ist solide, wer mehr Kontrolle will, installiert ein externes Tool. Hier finden Sie die aktuell besten Antivirus-Programme.
• Passwort-Manager: Bitwarden, 1Password oder KeePassXC. Mehr Auswahl gibt es hier: die besten Passwort-Manager.
• Cloud-Backup: Onedrive, Dropbox oder iDrive.

Tipp: Installieren Sie Ihre wichtigsten Programme gleich nach dem Update-Durchlauf. So haben Sie bei späteren Problemen einen klaren Systemstand, auf den Sie sich verlassen können. Mit Ninite können Sie übrigens mehrere Programme gleichzeitig installieren, ohne nervige Toolbars oder Zusatzsoftware.

4. Wichtige Windows-Einstellungen für Laptops

Foundry

Windows 11 bringt viele smarte Funktionen mit, die sind aber bei Weitem nicht alle optimal vorkonfiguriert. Ein paar Klicks in den Einstellungen machen den Alltag deutlich angenehmer (und sicherer):

• Datenschutz: Unter Einstellungen → Datenschutz und Sicherheit → Windows-Berechtigungen können Sie überflüssige Telemetrie, Werbung und Standortzugriffe abschalten.
• Windows Defender: Prüfen Sie unter Windows Sicherheit → Viren- und Bedrohungsschutz, ob der Echtzeitschutz aktiv ist.
• Onedrive-Sync: Falls Sie lokale Ordner bevorzugen, deaktivieren oder begrenzen Sie den automatischen Upload.
• Standard-Apps: Wählen Sie Ihre bevorzugten Programme für Browser, Mail und Fotos – sonst öffnet Windows gerne ungefragt Edge & Co. Die Einstellungen finden Sie unter „Standard-Apps“ (einfach ins Start-Fenster tippen). Über Einstellungen → Apps → Standard-Apps kommen Sie ebenfalls ans Ziel.

Tipp: Aktivieren Sie die Option „Dateiendungen anzeigen“ im Datei-Explorer. Das erleichtert das Erkennen verdächtiger Dateien und ist ein einfacher Schutz gegen Phishing und Schad-Software. Klicken Sie dazu in der Menüleiste auf Ansicht und setzen Sie ein Häkchen bei “Dateinamenerweiterungen”.

5. Touchpad, Tastatur und Funktionstasten konfigurieren

Gerade bei Laptops ist das Feintuning der Eingabegeräte Gold wert. Ein zu empfindliches Touchpad oder eine unpraktische FN-Belegung können schnell nerven und Arbeitsprozesse bremsen – solche Probleme sind aber schnell behoben.

• Touchpad-Gesten: Öffnen Sie Einstellungen → Bluetooth und Geräte → Touchpad. Hier können Sie Gesten für Scrollen, Zoomen und Desktop-Wechsel anpassen oder deaktivieren.
• Mausgeschwindigkeit: In denselben Einstellungen lässt sich die Zeigergeschwindigkeit anpassen („Cursergeschwindigkeit“).
• Funktionstasten: Viele Hersteller bieten Tools wie Asus Armoury Crate oder HP Command Center, um FN-Tasten zu konfigurieren. Prüfen Sie dort, ob Helligkeit, Lautstärke und Lüftersteuerung korrekt reagieren.

Tipp: Nutzen Sie Drei-Finger-Gesten für Multitasking. Damit können Sie blitzschnell zwischen Apps wechseln oder zum Desktop springen. Das spart Zeit im Alltag und erlaubt entspannteres Arbeiten.

6. Akku und Energieeinstellungen optimieren

Ein frischer Akku hält am Anfang lange durch – mit den richtigen Einstellungen läuft das neue Notebook aber noch effizienter. Windows 11 bietet mehrere Möglichkeiten, um Laufzeit, Performance und Stromverbrauch fein abzustimmen.

So holen Sie das Maximum heraus:

1. Öffnen Sie Einstellungen → System → Strom und Akku.
2. Unter Energiestatus wählen Sie, was Ihnen wichtiger ist: Beste Energieeffizienz, Ausbalanciert oder Beste Leistung.
3. Sie können die Bildschirmhelligkeit im Akkubetrieb um ein paar Stufen reduzieren – das bringt oft 30 bis 60 Minuten mehr Laufzeit.
4. Aktivieren Sie den Energiesparmodus, wenn der Akkustand unter 30 Prozent fällt.

Tipp für Technikfans: Erstellen Sie mit dem Befehl „powercfg /batteryreport“ im Terminal (Win + X → Terminal (Admin)) einen detaillierten Akkubericht. Der zeigt, wie oft Ihr Akku schon geladen wurde, welche Kapazität er noch hat und wann es Zeit für einen Austausch wird.

Um Ihren Akku dauerhaft zu schonen, empfehlen wir außerdem:

• Regelmäßige Zwischenladungen statt Dauerbetrieb am Netzteil.
• Keine dauerhafte 100-Prozent-Ladung, das stresst die Energiezellen.
• Bei längerer Nichtnutzung: Akku auf circa 50 Prozent laden und kühl lagern (aber nicht kalt).

7. Sicherheit und Datenschutz stärken

Thomas Joos

Sobald Ihr System läuft, sollten Sie den Sicherheitsgurt anlegen – sprich: die wichtigsten Schutzfunktionen aktivieren. Windows 11 bringt dafür schon alles mit, Sie müssen es nur einschalten oder prüfen.

Empfohlene Schritte:

1. Windows Hello aktivieren – unter Einstellungen → Konten → Anmeldeoptionen können Sie eine PIN, Fingerabdruck oder Gesichtserkennung einrichten.
2. Bitlocker oder Geräteverschlüsselung aktivieren – so sind Ihre Daten auch bei Diebstahl geschützt.
3. Firewall prüfen – die sollte immer aktiv sein.
4. WLAN-Sicherheit: Alte Netzwerke löschen, öffentliche Hotspots meiden oder per VPN absichern.

Tipp: Wenn Sie Windows 11 Pro nutzen (das Upgrade auf die Pro-Version bekommen Sie hier für nur 59,99 Euro), sollten Sie Bitlocker aktivieren. Das verschlüsselt die komplette Festplatte und lässt sich mit Ihrem Microsoft-Konto koppeln. Bei Geräten mit TPM 2.0 (Standard seit 2021) funktioniert das ganz automatisch. Wenn Sie maximale Kontrolle über Ihre Privatsphäre haben wollen: Tools wie O&O ShutUp10++ helfen, versteckte Telemetrie-Dienste mit einem Klick zu deaktivieren.

8. Backup und Wiederherstellung einrichten

Nichts ist ärgerlicher, als ein perfekt eingerichtetes System zu verlieren, weil ein Update dazwischenfunkt oder ein Virus zuschlägt. Darum unsere Empfehlung: gleich zu Beginn ein Gesamtbackup anlegen.

So geht’s:

1. Öffnen Sie Systemsteuerung → System und Sicherheit → Sichern und Wiederherstellen (Windows 7). Lassen Sie sich dabei nicht vom Begriff „Windows 7“ irritieren, das ist nur eine alte Bezeichnung, an der Microsoft festhält.
2. Wählen Sie „Systemabbild erstellen“ und speichern Sie es auf einer externen Festplatte.
3. Danach am besten gleich einen Wiederherstellungspunkt setzen. Tippen Sie dafür einfach „Wiederherstellungspunkt erstellen“ in die Suche.

Tipp: Alternativ können Sie auch Cloud-Dienste wie Onedrive oder Google Drive nutzen, um persönliche Dateien automatisch zu sichern. Wer es bequem mag und bereit ist, etwas Geld auszugeben, greift zu Tools wie Macrium Reflect oder Acronis True Image. Damit erstellen Sie komplette Abbilder und planen regelmäßige Backups automatisch.

9. Performance-Tuning und Komfortfunktionen

Ein paar schnelle Handgriffe machen Windows nicht nur schneller, sondern auch komfortabler.
Hier sind die besten Sofortmaßnahmen:

• Autostart-Programme reduzieren: Im Task-Manager (Strg + Shift + Esc → „Autostart“) deaktivieren Sie alles, was Sie nicht ständig benötigen.
• Speicheroptimierung aktivieren: Einstellungen → System → Speicher → „Speicheroptimierung“ einschalten. Windows löscht dann automatisch temporäre Dateien.
• Visuelle Effekte anpassen: „Erweiterte Systemeinstellungen“ in die Suche eingeben und über Erweitert → Leistung → Einstellungen die Funktion „Für optimale Leistung anpassen“ auswählen.
• Snap-Layouts und virtuelle Desktops nutzen: Mit Win + Z Fenster flexibel anordnen und mit Win + Tab zwischen Arbeitsflächen wechseln.

Tipp: Für Power-User lohnt sich ein Blick auf Powertoys. Das kostenlose Microsoft-Tool liefert Zusatzfunktionen wie Fenster-Snap, Tastenkürzel oder Farbpipette.

10. Bonus: Extras für Fortgeschrittene

Wenn Sie es ganz genau nehmen wollen, können Sie jetzt noch ein paar Feineinstellungen vornehmen, die oft nur erfahrene Nutzer kennen:

• BIOS/UEFI prüfen: Mit Entf oder F2 beim Start aufrufen. Dort können Sie Secure Boot, Bootreihenfolge oder Lüfterprofile anpassen.
• Hersteller-Tools checken: Programme wie My Asus, Lenovo Vantage oder HP Support Assistant liefern Firmware-Updates – entscheiden Sie selbst, welche Sie nutzen oder behalten möchten.
• Gaming-Optimierung: Bei Notebooks mit dedizierter GPU lohnt es sich, die Energieprofile in der Grafikkartensteuerung zu prüfen.
• Windows-Features deaktivieren: Systemsteuerung → Programme → Programme und Features → Windows-Features aktivieren oder deaktivieren – hier lassen sich unnötige Dienste wie „Internet Explorer 11“ oder „XPS-Dienste“ abschalten.

Fazit: Traumstart für Ihr neues Notebook

Ein neues Notebook ist wie ein leeres Notizbuch. Es lohnt sich, die ersten Seiten ordentlich zu gestalten. Mit diesen zehn Schritten sichern Sie sich Leistung, Datenschutz und Komfort von Anfang an. Nach der kurzen Einrichtung läuft Ihr Windows 11 dann so stabil, schnell und individuell, wie es sollte. Mit weniger Ballast und Neugier – dafür mit mehr Komfort und Sicherheit.

Extra-Tipp: Wenn Sie noch mehr aus Ihrem System herausholen wollen, lesen Sie auch: kostenlose Tipps, damit Ihr Windows-PC schneller läuft.

• Get our breaking news email, free app or daily news podcast

A new report by Australia’s online safety regulator has found “significant gaps” in how major tech platforms tackle online sexual extortion and child sexual exploitation, as “reports of this abuse continue to rise”.

The findings come from eSafety’s latest transparency report, examining how tech companies – including Apple, Meta, Google, Microsoft, Snap, Discord and WhatsApp – are addressing child sexual exploitation and abuse.

Google Cloud’s Dataproc lets you run native Apache Spark and Hadoop clusters on Google Cloud in a simpler, more cost-effective way. In this blog, we will talk about our newest optional components available in Dataproc’s Component Exchange: Docker and Apache Flink.

Docker container on Dataproc

Docker is a widely used container technology. Since it’s now a Dataproc optional component, Docker daemons can now be installed on every node of the Dataproc cluster. This will give you the ability to install containerized applications and interact with Hadoop clusters easily on the cluster. 

In addition, Docker is also critical to supporting these features:

1. Running containers with YARN

2. Portable Apache Beam job

Running containers on YARN allows you to manage dependencies of your YARN application separately, and also allows you to create containerized services on YARN. Get more details here. Portable Apache Beam packages jobs into Docker containers and submits them the Flink cluster. Find more detail about Beam portability. 

Docker optional component is also configured to use Google Container Registry, in addition to the default Docker registry. This lets you use container images managed by your organization.

Here is how to create a Dataproc cluster with the Docker optional component:

gcloud beta dataproc clusters create <cluster-name> \
  --optional-components=DOCKER \
  --image-version=1.5

When you run the Docker application, the log will be streamed to Cloud Logging, using gcplogs driver.

If your application does not depend on any Hadoop services, check out Kubernetes and Google Kubernetes Engine to run containers natively. For more on using Dataproc, check out our documentation.

Apache Flink on Dataproc

Among streaming analytics technologies, Apache Beam and Apache Flink stand out. Apache Flink is a distributed processing engine using stateful computation. Apache Beam is a unified model for defining batch and steaming processing pipelines. Using Apache Flink as an execution engine, you can also run Apache Beam jobs on Dataproc, in addition to Google’s Cloud Dataflow service.

Flink and running Beam on Flink are suitable for large-scale, continuous jobs, and provide:

• A streaming-first runtime that supports both batch processing and data streaming programs

• A runtime that supports very high throughput and low event latency at the same time

• Fault-tolerance with exactly-once processing guarantees

• Natural back-pressure in streaming programs

• Custom memory management for efficient and robust switching between in-memory and out-of-core data processing algorithms

• Integration with YARN and other components of the Apache Hadoop ecosystem

Our Dataproc team here at Google Cloud recently announced that Flink Operator on Kubernetes is now available. It allows you to run Apache Flink jobs in Kubernetes, bringing the benefits of reducing platform dependency and producing better hardware efficiency. 

Basic Flink Concepts

A Flink cluster consists of a Flink JobManager and a set of Flink TaskManagers. Like similar roles in other distributed systems such as YARN, JobManager has responsibilities such as accepting jobs, managing resources and supervising jobs. TaskManagers are responsible for running the actual tasks. 

When running Flink on Dataproc, we use YARN as resource manager for Flink. You can run Flink jobs in 2 ways: job cluster and session cluster. For the job cluster, YARN will create JobManager and TaskManagers for the job and will destroy the cluster once the job is finished. For session clusters, YARN will create JobManager and a few TaskManagers.The cluster can serve multiple jobs until being shut down by the user.

How to create a cluster with Flink

Use this command to get started:

gcloud beta dataproc clusters create <cluster-name> \
  --optional-components=FLINK \
  --image-version=1.5

How to run a Flink job

After a Dataproc cluster with Flink starts, you can submit your Flink jobs to YARN directly using the Flink job cluster. After accepting the job, Flink will start a JobManager and slots for this job in YARN. The Flink job will be run in the YARN cluster until finished. The JobManager created will then be shut down. Job logs will be available in regular YARN logs. Try this command to run a word-counting example:

This session presents a production-ready approach to securing CI build pipelines against compromised infrastructure by anchoring trust in a physically isolated build machine and leveraging enclave-based builders. The isolated machine compiles and signs a minimal enclave image, which becomes the only entity allowed to build software artifacts in the cloud. The builder enclave image runs inside AWS Nitro Enclaves and enforces strict policy checks such as requiring signed commit hashes before proceeding. Remote attestation is used to verify the AWS Nitro enclave's (the builder) integrity by an Intel SGX enclave verifier before provisioning the build secret, with the SGX enclave serving as a root of trust by encrypting its database with the processor's sealing key.

We'll detail the threat model, including attackers with SSH or root on CI runners, and walk through a complete enclave build pipeline, showing how trust is rooted in the isolated, air-gapped machine and propagated via the SGX enclave to the Nitro enclave builder. The session includes a demo of a real-world implementation that protects production infrastructure from build tampering and secret exfiltration, even under active adversary conditions.

Attendees will learn how to design CI pipelines with isolation guarantees similar to air gapped machines but with the build and deployment velocity they are used to in modern cloud environments, integrate enclave attestation into automated builds, and establish a root of trust for critical workloads.

By:
Ben Liderman | System Architect, Fireblocks
Maayan Keshet | System Architect, Fireblocks

https://blackhat.com/eu-25/briefings/schedule/?#bootstrapping-trust-from-isolated-build-machines-to-enclaved-ci-pipelines-49023

Read more →

The post Why Apple, Meta and Snap Want You to Stop Looking at Your Phone appeared first on IT Security News.

See the installation instructions for details, but it's easy:

• macOS: brew install ddev/ddev/ddev or just brew upgrade ddev.
• Linux: Use sudo apt-get update && sudo apt-get install ddev, see apt/yum installation
• Windows and WSL2: Download the Windows Installer; you can run it for install or upgrade.
  ⚠️ Traditional Windows users (not WSL2): If needed, the installer will prompt you to uninstall the previous system-wide installation to avoid conflicts with the new per-user installation.
• Consider ddev delete images or ddev delete images --all after upgrading to free up disk space used by previous Docker image versions. This does no harm.
• Consider ddev config --auto to update your projects to current configuration.

Highlights

Blog announcement: https://ddev.com/blog/release-v1-25-3/

• New Docker Compose library: Improved UX during ddev start and ddev stop; the separate ~/.ddev/bin/docker-compose binary is no longer needed and can be removed
• Faster ddev start: Reduced startup time by running post-healthcheck tasks concurrently, thanks to @jonesrussell
• Faster ddev stop: Fixed a bug in the webserver startup script that added an unnecessary ~10-second delay
• MariaDB 12.3 LTS support
• Podman and Docker rootless are no longer experimental: Both are now stable and ready for general use:
  • macOS (Podman rootless)
  • Linux/WSL2 (Docker rootless)
  • Linux/WSL2 (Podman rootless)

Breaking Changes

• Remove support for XDG_CONFIG_HOME, replaced by DDEV_XDG_CONFIG_HOME. Support for ~/.config/ddev on Linux is unchanged. This change was needed because some IDEs, such as PhpStorm, don't always see XDG_CONFIG_HOME set in the terminal (see this issue), which caused the IDE to recreate the ~/.ddev directory repeatedly
• Use stricter permissions for world-writable directories inside ddev-webserver. If you had post-start hooks that wrote to /usr/local/bin, update them to use ~/.local/bin instead, thanks to @AkibaAT
• Move N_PREFIX from /usr/local to /usr/local/n. This shouldn't affect most people, unless you referenced a full path such as /usr/local/bin/npm - the new location is /usr/local/n/bin/npm, or simply use npm without a full path
• Remove the ddev dr alias for ddev drush, since dr is now a built-in command for Drupal 11.4+

Features

• Node.js improvements: preserve nodejs_version in .ddev/config.yaml, and install several Node.js versions with n install <version> inside the web container
• Docker rootless on Linux no longer requires no-bind-mounts; disable it with ddev config global --no-bind-mounts=false
• Support the gvisor-tap-vsock network driver in Docker rootless
• Add new ddev dr command for Drupal 11.4+
• Allow using Mutagen together with ddev config global --use-hardened-images=true
• ddev version and ddev config now work even when Docker isn't running or is broken, and ddev poweroff shows progress output instead of appearing to hang
• Improve ddev list and ddev describe layout on narrow terminals
• Add OSC 8 terminal hyperlink support to ddev list, ddev describe, ddev add-on list, and ddev add-on search
• Show human-readable output when checking available disk space, thanks to @wolcen
• Always pull images when using ddev start --no-cache
• Respect the COMPOSER_NO_BLOCKING environment variable from the host in ddev composer
• Add ddev config global --docker-buildx-version to specify which Docker Buildx version to use (advanced use only)
• Respect docker-buildx installed via snap on Linux
• Support Debian, Kali, and eLxr WSL2 distros in the Windows installer, and avoid installing docker-ce over an existing Docker Desktop docker binary
• Add ddev utility addon-update-checker command for add-on maintainers
• Add #ddev-interactive option for add-on actions, thanks to @AkibaAT
• Add x-ddev.omit-ddev-labels extension to skip com.ddev.* label injection for specific services
• Support the Flatpak user binary for DBeaver on Linux, thanks to @nickchomey
• Add a quickstart for Drupal 12 (HEAD), thanks to @rpkoller
• Add troubleshooting for Let's Encrypt certificate failures, thanks to @jonpugh

Bug Fixes

• Windows installer: fix installation on WSL2 Ubuntu 26.04, which previously failed due to the deprecated wslu package
• Suppress 404 logs for favicon.ico and robots.txt; in some cases these caused Nginx to run a PHP script twice
• Prevent recursion in global web command wrappers
• Use the correct settings.ddev.php for each Drupal version
• Fix a bug where .ddev/apache/apache-site.conf went missing when using a custom Nginx config
• Detect a missing docker CLI, which is required when using Mutagen
• Limit the ENV HOME="" workaround for MySQL 8.x to the database context only
• Podman and macOS: restrict the keep-id userns setting to Linux only
• Use the nodejs_version set during the ddev-webserver image build; if you installed global npm packages in post-start hooks, move them to extra Dockerfiles instead
• Use wrapper scripts in ddev-dbserver to avoid mysql deprecation warnings with MariaDB 11.x+
• Warn when the CAROOT environment variable is set but the mkcert CA files (needed for HTTPS in your browser) are inaccessible
• Normalize OSTYPE detection on Linux, thanks to @Mikee-3000
• Avoid double-sourcing bashrc configuration in ddev ssh
• Skip OS-generated metadata files (.DS_Store, Thumbs.db, desktop.ini) during custom-config detection and in .ddev/.gitignore
• Restore path autocompletion for ddev add-on get
• Don't prompt to run ddev poweroff after updating ddev-ssh-agent
• Fix a case typo in ddev sequelace so Sequel Ace is detected on case-sensitive macOS filesystems, thanks to @mficzel

Internal Changes

• Migrate DDEV documentation from Material for MkDocs to Zensical
• Upgrade Bubble Tea (ddev tui) to v2
• Add light/dark/system preference variants for the brand logo
• Remove automated testing on macOS Intel; macOS amd64 binaries are still built and distributed, only CI testing on Intel hardware is removed
• Add automated testing for macOS Podman rootless
• Improve the test embargo system for Go, Bats, and CI workflows; tests can now be skipped when needed
• Add custom GitHub workflows to run tests on branches without opening a PR
• Rework local HTTP test helpers for clearer failure output
• Remove the build step for the Docker image used in ddev auth ssh
• Bump all Go dependencies

Minor Updates

• PHP 8.4.22 and 8.5.7

What's Changed

• test: Reenable Drupal 12 bats test (#8346) [skip ci] by @rpkoller in #8346
• chore(claude): fix PreToolUse hook matcher for git commit static analysis (#8345) [skip ci] by @stasadev in #8345
• docs(add-ons): Minor updates to creating-add-ons.md by @rfay in #8347
• perf: combined startup time optimizations, for #8096 by @jonesrussell in #8145
• fix(windows): remove wslu from installer, fixes #8326 by @stasadev in #8351
• fix(webserver): replace phar.io/filippo.io links with GitHub releases, improve Dockerfile, for #8012 by @stasadev in #8352
• docs(quickstart): add a quickstart for Drupal 12 (#8357) [skip ci] by @rpkoller in #8357
• feat(docker): always pull images with --no-cache by @stasadev in #8363
• fix(download-images): pull webserver image, for #8304 by @stasadev in #8358
• fix(start): use image digest for rebuild detection, fix rand and ssh-agent data races, for #8145 by @stasadev in #8359
• fix(test): skip TestCheckLiveConnectivityWithProject on Rancher/Colima/Lima, fix misleading WSL2 labels by @rfay in #8365
• docs(windows): add WSL2 installation step to Docker docs by @stasadev in #8355
• chore: fix claude hooks and update agent docs [skip ci] by @rfay in #8370
• chore: remove macOS amd64 CI testing (#8372) [skip ci] by @rfay in #8372
• fix(drupal): use configured project type for settings.php version selection by @rfay in #8366
• ci: run golangci-lint by @stasadev in #8375
• docs(mutagen): explain how to reset to the default mode, fixes #8367 by @silverham in #8368
• docs(configuration): Add ddev config --database=<database type>:<version> example command (#8387) [skip ci] by @silverham in #8387
• build: bump fuxingloh/multi-labeler from 4 to 5 (#8385) [skip ci] by @dependabot[bot] in #8385
• docs: clarify --cleanup --name for single snapshot deletion (#8384) [skip ci] by @CallMeLeon167 in #8384
• docs(add-ons): add real example for bats testing (#8377) [skip ci] by @stasadev in #8377
• fix(commands): normalize $OSTYPE detection for linux, fixes #8382 by @Mikee-3000 in #8383
• docs: Add Xcode iOS simulator info (#8371) [skip ci] by @jamesmacwhite in #8371
• feat(utility): add ddev utility addon-update-checker command by @stasadev in #8373
• fix(add-ons): autocomplete for path by @stasadev in #8376
• test(wsl2): fix TestHostDBPort by @stasadev in #8391
• test(windows): fix TestUtilityAddonUpdateCheckerCmd, for #8373 by @stasadev in #8394
• docs(quickstart): Add description to Drupal Git clone example by @gitressa in #8395
• fix(ddev-webserver): ddev stop takes 10s due to bash deferring SIGTERM during foreground cat, fixes #8295 by @rfay in #8396
• docs: unify homeadditions path resolution and Composer auth.json handling by @eiriksm in #8400
• docs(providers): align --environment examples and flags, fixes #8402 by @stasadev in #8403
• test(share): improve cloudflared debug output on unmarshal errors by @rfay in #8398
• ci(github): reorganize test jobs, add custom workflow_dispatch, remove unused workflows by @stasadev in #8401
• feat(add-on): add #ddev-interactive option for actions, fixes #8155 by @AkibaAT in #8381
• refactor(tui): upgrade bubbletea/bubbles/lipgloss to v2 by @stasadev in #8404
• ci: add DDEV_EMBARGO_PHP_VERSIONS to skip specific PHP versions in TestPHPConfig [skip ci] by @rfay in #8407
• feat: use docker-compose library, optionally download docker-buildx, fixes #7915, for #8295 by @stasadev in #8234
• ci(docs): add stable docs branch workflow, fixes #7862 by @stasadev in #8408
• ci(forks): fetch variables from public-variables branch by @stasadev in #8410
• ci(wsl2): read public-variables in pwsh, for #8410 by @stasadev in #8411
• ci: improve test embargo system for Go, bats, and CI workflows by @stasadev in #8413
• docs(config): improve wording for database and docker_buildx_version, for #8387 by @stasadev in #8409
• refactor: improve CheckAvailableSpace reliability and output, fixes #8388 by @wolcen in #8412
• ci(buildkite): fix MSYS path conversion breaking public-variables fetch on Windows, for #8410 by @stasadev in #8416
• docs(brand-guide): add light, dark, and auto logo variants to logos table, fixes #8417 by @stasadev in #8419
• feat(docs): migrate from mkdocs-material to zensical, fixes #7840, fixes #8216 by @stasadev in #8421
• docs(add-ons): mention #ddev-generated in quickstart by @chx in #8420
• ci(docs): enable zensical strict mode, use dynamic Pages base URL, for #8421 by @stasadev in #8423
• fix(ddev-dbserver): unlink stale socket before mysqld init by @stasadev in #8424
• test: add details to TestCmdAddonPHP by @stasadev in #8425
• chore(sponsors): update percentage and api link [skip ci] by @stasadev in #8427
• ci(pr): migrate to ddev/commit-message-checker@v3 by @stasadev in #8428
• test(lima): fix broken cleanup in TestCmdAddonPHP, for #8425 by @stasadev in #8430
• fix: replace remaining world writeable directories, fixes #8251 by @AkibaAT in #8379
• chore(composer): add COMPOSER_NO_BLOCKING by @stasadev in #8432
• fix(exec): allocate TTY only when stdout is also a terminal, for #8234 by @stasadev in #8431
• feat(docker-rootless): remove no-bind-mounts requirement, test gvisor-tap-vsock by @stasadev in #8426
• build: pin Node.js to 24.15.0, fixes #8436 by @stasadev in #8438
• test(linux): wait for nc to bind before asserting in port-diagnose tests by @stasadev in #8446
• test: rework local HTTP test helpers with clearer failure output by @stasadev in #8447
• fix(nodejs): move install to Dockerfile, add ~/n/bin to PATH, fixes #8414, fixes #8415 by @stasadev in #8443
• fix(zensical): retry strict build on false-positive "page does not exist" warnings by @stasadev in #8451
• ci(linux): use full homebrew formulae name, fixes #8450 by @stasadev in #8455
• test(quickstart): update asterios page check by @stasadev in #8454
• feat: add MariaDB 12.3 LTS support, fixes #8452 by @rfay in #8453
• fix(dbserver): use wrapper scripts for MariaDB 11.x+ MySQL compat, fixes #6861 by @stasadev in #8456
• test(buildkite): Fix brew upgrade to use -y for new 6.0.0 release, fix setup-homebrew by @rfay in #8469
• build(gnupg): Remove references to obsolete gnupg2 by @rfay in #8475
• fix: recreate service on ddev utility rebuild -s, support profile services by @stasadev in #8463
• fix(nodejs): preserve nodejs_version in config.yaml, fixes #8186 by @stasadev in #8462
• fix(nodejs): move N_PREFIX to /usr/local/n and make it writable, fixes #8465 by @stasadev in #8467
• fix(nginx): suppress favicon.ico and robots.txt 404 logs, fixes #7010 by @stasadev in #8461
• fix(ssh): use RawCmd to avoid double-sourcing bashrc, fixes #5232 by @stasadev in #8460
• docs: install util-linux-extra in Docker setup, fixes #8350 (#8480) [skip ci] by @rfay in #8480
• feat: improve ddev list/describe table layout, add OSC 8 terminal hyperlinks, fixes #5535, fixes #6113 (#8474) [skip ci] by @rfay in #8474
• fix: skip OS-generated metadata files in custom-config detection and .ddev/.gitignore, fixes #8418 (#8478) [skip ci] by @rfay in #8478
• fix(mutagen): detect missing docker CLI early, fixes #8457 by @rfay in #8479
• docs(docker): add troubleshooting for permission denied, for #8471 (#8483) [skip ci] by @stasadev in #8483
• test(quickstart): update shopware6 by @stasadev in #8482
• fix: warn when CAROOT is set but CA files are inaccessible, fixes #8485 (#8486) [skip ci] by @rfay in #8486
• fix(tui): prevent docker/cli stdin from consuming TUI shortcuts, fixes #8440 by @stasadev in #8489
• fix: add /usr/local/n/bin to sudo secure_path, fixes #8488 by @stasadev in #8490
• fix(start): show warnings from log-stderr.sh on start, fixes #8441 by @stasadev in #8481
• build(deps): bump go dependencies, migrate to go-github v88 by @stasadev in #8492
• test(quickstart): pin @sveltejs/adapter-node@5.5.4 by @stasadev in #8497
• test(docs): Ignore link check URLs [skip ci] by @rfay in #8499
• build: bump actions/checkout from 6 to 7 (#8504) [skip ci] by @dependabot[bot] in #8504
• fix: restrict XDG_CONFIG_HOME to Linux, add DDEV_XDG_CONFIG_HOME for cross-platform overrides, fixes #8493 by @rfay in #8494
• fix(webserver): prevent recursion in global web command wrappers, for #6902 by @stasadev in #8495
• fix(nodejs): always install gulp-cli and yarn, fixes #8496 (#8498) [skip ci] by @stasadev in #8498
• feat(windows): support Debian and Kali WSL2 distros in GUI installer, fixes #8439, fixes #8468 by @rfay in #8464
• build: Fix gomt error that crept in [skip ci] by @rfay in #8509
• test: Add script to compare start time performance [skip ci] by @rfay in #8510
• test(quickstart): remove pin for @sveltejs/adapter-node, for #8497 by @stasadev in #8511
• ci(github): add brew sandbox setup, remove obsolete env, for #8469 by @stasadev in #8512
• fix(mysql): guard ENV HOME injection to db context only, fixes #8508 by @stasadev in #8513
• fix(docker): do not cache build on start, fixes #8433 by @stasadev in #8506
• feat(drupal): Support new dr command built into drupal11.4+, fixes #8500 by @rfay in #8507
• fix(dbeaver): Add flatpak user binary path to search list, fixes #8517 by @nickchomey in #8518
• refactor(auth-ssh): remove build step, fixes #8501 by @stasadev in #8503
• feat: allow mutagen with use-hardened-images, for #3680 by @stasadev in #8491
• feat(docker): respect docker-buildx from snap on linux, fixes #8515 by @stasadev in #8519
• docs: replace newgrp with sg for docker group activation, fixes #8350 by @rfay in #8524
• fix(commands): correct case typo in ddev sequelace, fixes #8521 (#8522) [skip ci] by @mficzel in #8522
• build(deps): bump moby and docker-compose by @stasadev in #8523
• docs: skip codeberg, use stable link for docs in github workflows (#8528) [skip ci] by @stasadev in #8528
• build: remove pin for Node.js, for #8438 by @stasadev in #8527
• fix(start): do not ask for poweroff with new ddev-ssh-agent, fixes #8520 by @stasadev in #8525
• ci(podman): update workflow for Podman 6 by @stasadev in #8526
• fix(podman): restrict keep-id userns to Linux only, fixes #8223, fixes #8529 by @stasadev in #8516
• docs: Remove link to very old processwire thread (#8533) [skip ci] by @rfay in #8533
• fix: continue when #ddev-generated is missing in generate config functions, for #2305 by @stasadev in #8532
• docs: Ignore winaero.com, cert expired [skip buildkite] (#8537) [skip ci] by @rfay in #8537
• ci: add macOS Podman rootless Buildkite pipeline, for #8223 (#8530) [skip ci] by @rfay in #8530
• test(auth-ssh): harden ddevauthssh.expect against passphrase prompt race by @stasadev in #8536
• build: bump actions/cache from 5 to 6 (#8538) [skip ci] by @dependabot[bot] in #8538
• fix: stop honoring XDG_CONFIG_HOME on Linux too, use DDEV_XDG_CONFIG_HOME, fixes #8493 by @stasadev in #8531
• fix: correct typos in global and project config comment docs (#8541) [skip ci] by @stasadev in #8541
• test: fix TestCheckForMultipleGlobalDdevDirs on Windows, for #8531 (#8542) [skip ci] by @rfay in #8542
• feat: add x-ddev.omit-ddev-labels to skip com.ddev.* label injection, fixes #8389 by @stasadev in #8540
• build(docker): bump images to v1.25.3 for release, fixes #8544 by @stasadev in #8547
• ci(buildkite): trim podman machine and run maintenance post-test (#8551) [skip ci] by @stasadev in #8551
• docs(typo3): require Camino theme, drop empty distribution prompt (#8548) [skip ci] by @rfay in #8548
• docs(hosting): add guidance for Let's Encrypt failures by @jonpugh in #8543
• docs(docker): add Podman and Docker rootless setup, fixes #8434 by @stasadev in #8552
• ci(macos): untap pre-installed aws/tap before brew install by @rfay in #8559
• docs(wsl2): use Ubuntu-26.04 instead of Ubuntu-24.04, for #8326, for #8408 by @stasadev in #8553
• fix(webserver): restore nonstandard router port in HTTP_HOST for nginx-fpm, fixes #8554 by @rfay in #8555
• fix(router): temp pin for traefik:3.6.13, for #8562 by @stasadev in #8564
• fix(shopware): pin Twig <3.28 to work around admin HTTP 500 by @rfay in #8557
• docs: add TYPO3 special handling for ddev share, fixes #7799 by @rfay in #8556

New Contributors

• @silverham made their first contribution in #8368
• @CallMeLeon167 made their first contribution in #8384
• @Mikee-3000 made their first contribution in #8383
• @wolcen made their first contribution in #8412
• @chx made their first contribution in #8420
• @mficzel made their first contribution in #8522
• @jonpugh made their first contribution in #8543

Full Changelog: v1.25.2...v1.25.3

You're reading Snap Store will be down for maintenance this weekend, a blog post from OMG! Ubuntu. Do not reproduce elsewhere without permission.

• Improve cluster file synchronization error handling by @TomasTurina in #36129
• Update trojan signatures to avoid false positives on modern distros by @Miguevrgo in #35927
• Improve cluster merged file parameter validation by @vikman90 in #36204
• Create a backup of local_rules.xml during execution of IT analysisd tier 0 1 by @Antoniogm03 in #36201
• Improve tmp_file path validation in cluster DAPI by @vikman90 in #36246
• Revert bump main branch by @wazuhci in #36303
• Bump 4.14.7 branch by @wazuhci in #36312
• Serialize procps access to prevent modulesd crash by @cborla in #36261
• Remove obsolete configuration blocks from API upload_configuration setting by @TomasTurina in #36252
• Restore working vulnerability scanner database workflow by @jotacarma90 in #36332
• Propagate agent merged_sum after hot reload in cluster by @jotacarma90 in #36164
• Merge 4.14.7 into main by @jotacarma90 in #36331
• Authd tier 0-1 flaky tests fix by @jotacarma90 in #36342
• Review agent info logs by @Antoniogm03 in #36234
• Fix the wazuh-manager-modules crash that occurs while downloading the feed by @Antoniogm03 in #36337
• Migrate FIM DB path queries to parameterized statements by @Darioortegaleyva in #36399
• Fix AlmaLinux 9/10 bootloader permissions SCA check regex and optional file handling by @vikman90 in #36396
• Cluster file processing parameter validation by @vikman90 in #36296
• Add missing 4.10.2-4.10.5 and 4.8.2 entries to changelogs by @jotacarma90 in #36407
• Treat the absence of the hash document as expected, not an error by @juliancnn in #36355
• geo_point validation support all compatible formats by @LucioDonda in #36034
• Prevent Syscollector and SCA use-after-free on modulesd shutdown by @nbertoldo in #36359
• Add cluster security model and configuration documentation by @vikman90 in #36405
• Bump CB_SCAN_STARTED timeout and trigger ITs on wm_syscollector.c by @jr0me in #36446
• Fixed an issue in eBPF with LSM hooks and improved the health check by @MarcelKemp in #35838
• Validate cluster node name format by @vikman90 in #36460
• eBPF libraries updated by @MarcelKemp in #36467
• Bump 4.14.6 branch by @wazuhci in #36517
• Revert "Bump 4.14.6 branch" by @MARCOSD4 in #36518
• Bump 4.14.6 branch by @wazuhci in #36519
• Update changelog for 4.14.6 RC 1 by @jotacarma90 in #36562
• Fix policy evaluation errors by @fcontrerasc in #36449
• Release startup hash gate when the reload chain fails by @jr0me in #36302
• Revert "Add missing 4.10.2-4.10.5 and 4.8.2 entries to changelogs" by @MarcelKemp in #36591
• Merge merge-4.14.7-into-main into main [automated] by @wazuhci in #36624
• Restore event counter and classify received messages by @jotacarma90 in #36456
• Unify manager integration tests workflows by @ignaciogalle12git in #36235
• Remove unused Node.js 12 from arm64 deb agent builder by @Miguevrgo in #36156
• Remove unused Node.js 12 from arm deb agent builders (4.14.7) by @Miguevrgo in #36157
• SCA typo bug in SELinux SCA rule for CentOS 8/9/10 by @Miguevrgo in #36361
• Fix detect-changes glob to honour ** recursively and extract logic into a reusable action by @Nicogp in #36617
• Merge merge-4.14.6-into-4.14.7 into 4.14.7 [automated] by @wazuhci in #36623
• Reduce log noise when engine has no synchronized ruleset by @NahuFigueroa97 in #36356
• Update test modules paths by @rovogel in #36668
• Only download external deps when required by @TomasTurina in #36244
• Merge 4.14.7 into main by @jotacarma90 in #36664
• Mail forwarding and reporting 5.0 migration guide by @Ripdiegozz in #36357
• Added Ubuntu 26.04's SCA policy in the SPECS by @MarcelKemp in #36712
• Preliminary support new OSs - Ubuntu 26.04 - Add SCA content by @AwwalQuan in #36708
• Safeguards to inventory sync by @juliancnn in #36469
• Improve the method of detecting duplicates by @NahuFigueroa97 in #36344
• Fix race condition preventing inventory synchronization after agent reload by @nbertoldo in #36682
• Added API integration tests workflow by @MiguelazoDS in #36196
• Fix non-atomic write for file_status.json in logcollector by @nbertoldo in #36722
• Make agent-info shutdown waits interruptible by @lchico in #36719
• Validate IP address in ip-customblock active response by @vikman90 in #36730
• wazuh-agent remains active after uninstall on Fedora 44 / DNF5 by @Miguevrgo in #36727
• Use per-target rpath and remove redundant LD_LIBRARY_PATH/WAZUH_ENGINE_GROUP exports by @jotacarma90 in #36455
• Fix changelog chronological order and update bumper script by @Darioortegaleyva in #36729
• Monitoring a symlink without follow_symbolic_link by @Darioortegaleyva in #36081
• SCA policies migration guide from 4.x to 5.x by @jr0me in #36671
• Fix 5x wazuhdb integration tests by @ignaciogalle12git in #36713
• Downgrade transient manager-reported sync failures logs to debug by @jr0me in #36744
• Show sca timouts as Not Run by @jpcerrone in #36258
• Authd workflow creation for 5.x by @jepalfer in #36404
• Adapt remoted tests to 5.x by @Antoniogm03 in #36609
• Update unclassified event criteria by @LucioDonda in #36681
• use safeloader in yaml file loader by @LucioDonda in #36753
• Downgrade expected modulesd socket warnings/errors during agent restart to debug by @jr0me in #36755
• Documentation: Ciscat and openscap migration to SCA by @jpcerrone in #36723
• Document the deprecation of OSquery in order to use IT Hygiene in version 5.0 by @nbertoldo in #36756
• Preserve wazuh-syscheckd Full Disk Access attribution on macOS reload by @Nicogp in #36754
• Normalize severity Msg by @hernanvalenzuela in #36759
• Agent Groups 5x Migration Guide by @fcontrerasc in #36726
• Add NULL validation for optional FlatBuffer fields in inventory_sync by @vikman90 in #36773
• Fix agent keepalive scheduling after system clock rollback by @Darioortegaleyva in #36338
• Create integratord migration guide to 5.x by @Adman23 in #36750
• Syslog output (csyslogd) 5.0 migration guide by @gonzaarancibia in #36741
• Merge merge-4.14.7-into-main into main [automated] by @wazuhci in #36767
• Migration documentation: syslog input alternative by @rovogel in #36781
• Drop libcrypt dependency from Python dep by @jotacarma90 in #36782
• Change duplicated link to intented one by @Miguevrgo in #36794
• Add centralized input validation for active response framework by @vikman90 in #36745
• Fix sca check for etc/shadow by @Miguevrgo in #36795
• Align remoted metrics shipper with new field names by @jotacarma90 in #36740
• Fix wrap PolicyBanner stat in 'sh -c' so glob expands in macOS SCA check 41062 by @Nicogp in #36783
• Bump main branch by @wazuhci in #36801
• Defer module coordination while FIM first sync is in progress by @anromerom in #36762
• Revert "Bump main branch" by @MARCOSD4 in #36802
• Change log severity for recoverable and expected conditions by @hernanvalenzuela in #36786
• Prevent data race in schema validator factory concurrent initialization by @Nicogp in #36789
• Schema generation for dotted and nested field mappings by @jam300 in #36473
• Engine support null values in schema validation by @LucioDonda in #36470
• docs: add Active Response 4.x to 5.x migration guide by @jcorredor-spec in #36402
• Use env mappings for variable passing in builderpackage workflows by @Miguevrgo in #36738
• Adds 4.x to 5.x migration documentation. by @rjcausarano in #36785
• Fix AWS cross-account SQS queue URL when using iam_role_arn by @fcontrerasc in #36791
• Fix enrollment key validation and improve input handling by @vikman90 in #36807
• Lower agent_sync_protocol and module sync log levels to reduce false-alarm noise by @Nicogp in #36817
• Add unit tests for utils, aws_tools, DockerListener, gcloud and azure modules by @AnDumu in #36761
• Normalize numeric inode to string events (6960) by @hernanvalenzuela in #36837
• Prevent indexer consumer wait during shutdown by @jotacarma90 in #36836
• Update manager 5x documentation by @ignaciogalle12git in #36833
• Add bump-issue-link support to bumper workflow by @jotacarma90 in #36868
• Add guide for migrating manager coordinator from 4.x to 5.x by @jepalfer in #36829
• Add Wazuh Manager Configuration documentation from 4.x to 5.x by @Antoniogm03 in #36779
• Add documentation to migrate filebeat to indexer connector by @Antoniogm03 in #36866
• wazuh-manager: Benchmark and footprint by @juliancnn in #36145
• Update manager upgrade block message by @jotacarma90 in #36987
• 5.x PR workflows improvements by @ignaciogalle12git in #36766
• Add Manager 5.0 release notes and breaking changes by @ignaciogalle12git in #36850
• ci(gha): migrate server/manager workflows to AWS CodeBuild runners [main] by @jotacarma90 in #37012
• chore: update vulnerable Python framework dependencies by @jotacarma90 in #37024
• Add Manager 5.0 wazuh-manager.conf configuration reference by @jotacarma90 in #36999
• Add virustotal migration guide by @jepalfer in #37013
• Add VD migration documentation by @ignaciogalle12git in #37008
• Add documentation for wpk upgrade by @Antoniogm03 in #37015
• Migrate agent build workflows to AWS CodeBuild runners by @Nicogp in #37028
• XML Decoders migration to YAML by @jepalfer in #36959
• CDB to KVDB migration guide by @jepalfer in #36996
• Documentation of Agentless migration to 5.x by @Antoniogm03 in #37025
• Fix manager reload/restart silently fails by @ignaciogalle12git in #36962
• Randomize key generation for installation by @jepalfer in #36861
• Retry vulnerability feed validation failures promptly by @jotacarma90 in #36874
• Bump 5.0.0 branch by @wazuhci in #37040
• Fix agent permanently stuck when TCP connection is silently half-closed by @nbertoldo in #36790
• ci(gha): migrate server/manager workflows to AWS CodeBuild runners [4.14.6] by @jotacarma90 in #37010
• ci(gha): migrate server/manager workflows to AWS CodeBuild runners [4.14.7] by @jotacarma90 in #37011
• fix: correct blob URL refs for release branch by @jotacarma90 in #37046
• Use restricted wazuh-server user for Manager Indexer authentication by @jotacarma90 in #37061
• fix(packages): use wazuh-manager-control in manager init.d scripts by @jotacarma90 in #37059
• fix: Update the unclassified event doc by @juliancnn in #37126
• Skip vanished /proc entries during ports scan by @Nicogp in #36859
• Fix RBAC permission check to verify allow effect in update_config rules by @vikman90 in #37076
• Add destination confinement to worker non-merged and extra file sync paths by @jotacarma90 in #36998
• Patch cluster authentication by @ignaciogalle12git in #37039
• Lower stale-session indexer log to debug by @jotacarma90 in #37150
• Limit recursion depth in XML parser by @vikman90 in #37147
• Add status endpoint by @NahuFigueroa97 in #37022
• Add log collectors reference docs by @AnDumu in #37057
• Run the Windows MSI package test on the AWS CodeBuild runner by @nbertoldo in #37165
• Remove merged.mg hash cache to fix stale syscollector flush by @hernanvalenzuela in #37048
• Enrich MITRE fields with id and names by @fcontrerasc in #37054
• Reduce indexer connection warning noise by @jam300 in #37021
• Remove deprecated wazuh-dbd daemon by @vikman90 in #37035
• Bound decompressed size when processing sync archives by @jotacarma90 in #37119
• Bump 4.14.6 branch by @wazuhci in #37176
• Add libcrypt fix (#36782) to 4.14.6 changelog by @jotacarma90 in #37178
• Delay IndexerDownloader connection warnings until 3 failed attempts by @jotacarma90 in #37177
• Add parameterized target selection to Coverity scan workflow by @lchico in #37171
• Align remoted tier 2 CodeBuild setup by @jotacarma90 in #37155
• Add rules migration guide by @Jorgesnchz in #36305
• Migrate agent Linux/Windows test workflows to AWS CodeBuild runners by @Nicogp in #37051
• Silence spurious keepalive warnings on the Windows agent by @nbertoldo in #37187
• wazuh-engine: Improve log messages and logger by @juliancnn in #36995
• Set default indexer connector credentials by @TomasTurina in #37192
• Fix incorrect snprintf size calculation in winevtchannel decoder by @vikman90 in #37198
• Align VD feed-download log levels with indexer consumer state by @jotacarma90 in #37199
• Recognize renamed indexer consumer status in engine sync by @jotacarma90 in #37204
• Merge 4.14.6 into 4.14.7 by @jotacarma90 in #37210
• Token replacement to avoid permission errors by @MarcelKemp in #37237
• Merge 4.14.7 into 5.0.0 by @jotacarma90 in #37211
• Eliminate TOCTOU races in healthcheck file operations by @rjcausarano in #37160
• Sca file policy block standardization by @Johnng007 in #37179
• Bind agent index selection and scope deletes by cluster by @jotacarma90 in #37154
• Add Null Check for Inode and Dev Fields in FIM Whodata Event Handler by @vikman90 in #37245
• Docs/6764 logcollector whats new 5.0 by @AnDumu in #37056
• Repair RPM builder toolchain downloads by @jr0me in #37130
• Add cluster name validation by @TomasTurina in #37238
• Add cluster readiness endpoint by @NahuFigueroa97 in #37129
• Defer cluster payload buffer allocation until data is received by @jepalfer in #37280
• Indexer connector bulk size and flush interval configurable by @LucioDonda in #37158
• Enable shared-password enrollment by default by @ignaciogalle12git in #37151
• Fix unit test workflow paths and report handling by @jotacarma90 in #37317
• Migrate agent + server CI artifacts to S3 — 4.14.7 (#5300, #5298) by @jr0me in #37186
• Handle eol amazon inspector classic by @rovogel in #37194
• Fix wazuh-modulesd missing after macOS agent restart by @cborla in #37020
• Fix test_worker failing unit test by @jepalfer in #37314
• Improve log messages by @Antoniogm03 in #36876
• Improve changelog format by @jotacarma90 in #37332
• Lower log level of transient cluster IPC failures (#37277, #37276) by @jotacarma90 in #37326
• Fix TypeError when sorting agents by version with empty version strings by @TomasTurina in #37323
• Migrate agent + server CI artifacts to S3 — 5.0.0 (#5300, #5298) by @jr0me in #37185
• Validate asset resource names before policy promotion by @jam300 in #37172
• Revert wazuh-server indexer credentials and propagate log context in indexer connector by @jotacarma90 in #37333
• Add VD readiness status HTTP endpoint by @jotacarma90 in #37213
• Use github.workspace for wodles report paths by @Nicogp in #37342
• Skip FIM whodata cases on the tier-2 Linux job (CodeBuild) by @Nicogp in #37291
• Migrate 4.x Windows test runners to AWS CodeBuild by @Nicogp in #37193
• Lower log level of transient queue send failures in modulesd by @lchico in #37345
• Add changelog check workflow by @TomasTurina in #37343
• Add changelog check workflow for 5.0.0 by @TomasTurina in #37351
• Retry OS_SendUnix on ENOBUFS to stop dropping binary sync messages on macOS by @nbertoldo in #37349
• change: Allow null root_decoder as alias of empty string on policy cr… by @juliancnn in #37347
• Fix eBPF FIM whodata for Amazon Linux by @Miguevrgo in #37014
• Merge 4.14.6 into 4.14.7 by @jotacarma90 in #37358
• Bump 5.0.0 branch by @wazuhci in #37371
• Merge 4.14.7 into 5.0.0 by @jotacarma90 in #37360
• Migrate remaining CI artifacts to S3 for the 5.0.0 branch (#3502) by @jr0me in #37350

New Contributors

• @MARCOSD4 made their first contribution in #36518
• @Ripdiegozz made their first contribution in #36357
• @Adman23 made their first contribution in #36750
• @jcorredor-spec made their first contribution in #36402

Full Changelog: v5.0.0-beta2...v5.0.0-beta3

• Bazel: Fix prerelease filtering with same-release-line scoping by @v-HaripriyaC in #15332
• Respect cooldown for Docker digest updates and suppress multi-arch no-ops by @robaiken in #15354
• Bypass npmrc min-release-age for transitive npm security updates by @robaiken in #15386
• Ratchet the Sorbet T.untyped burndown by @JamieMagee in #15399
• feat(docker): implement single-platform image detection and optimize manifest fetching logic by @jpinz in #15390
• Fix private registry config not found error not being raised issue in npm_and_yarn by @AbhishekBhaskar in #15394
• don't fail if nuget cred is missing url by @brettfo in #15378
• Type commit_message_options with a value object by @JamieMagee in #15400
• Type the Dependabot config file parser by @JamieMagee in #15401
• Fix Terraform registry replacement typing and credential semantics by @thavaahariharangit with @Copilot in #15406
• fix: avoid path collisions for SHA-pinned GitHub Actions by @markhallen in #14806
• Nix: skip flake inputs pinned to a bare commit SHA by @JamieMagee in #15412
• Type the vulnerability version-range renderer by @JamieMagee in #15402
• Add JobCommand enum and Command property to NuGet Job model by @brettfo in #15277
• Upgrade Ruby to 4.0.5 by @Bo98 in #14830
• Bump updater-core image to RubyGems/Bundler 4.0.13 by @JamieMagee in #15256
• Fix issue with PrivateRegistryConfigNotFound error incorrectly firing when scope is configured by @AbhishekBhaskar in #15416
• Fake MSBuild SolutionDir during NuGet discovery (#13756) by @brettfo in #15392
• NuGet: Filter all editable files not present prior to discovery by @brettfo in #15358
• Support Central Package Versions updates in XmlFileWriter by @brettfo in #15409
• [Update Graph] Report empty manifests as present but empty instead of omitting them by @brrygrdn in #15427
• Fix vcpkg empty PRs for up-to-date baselines by @JamieMagee in #15420
• Nix: update NixOS channel tarball inputs by @JamieMagee in #15413
• fix(opentofu): accept terraform_registry credentials for OCI registry tags by @thavaahariharangit in #15422
• Commit changes to workspace member TOML files by @crabbit-git in #15142
• Fix COREPACK_NPM_REGISTRY trailing slash causing pnpm HTTP 404 on private registries by @thavaahariharangit with @Copilot in #15444
• Map additional NuGet feed errors to private_source_bad_response by @brettfo in #15426
• Support version and security NuGet job commands by @brettfo in #15430
• Show the vcpkg release tag instead of master in PR titles by @JamieMagee in #15433
• Register MSBuild before running the job so early NuGet errors are reported by @brettfo in #15431
• Add a baseline to vcpkg projects missing one by @JamieMagee in #15432
• Fix file updater failed to update for all support files sentry error by @AbhishekBhaskar in #15421
• Skip disabled Maven repositories by @adoroszlai in #15443
• v0.384.0 by @dependabot-core-action-automation[bot] in #15438

New Contributors

• @crabbit-git made their first contribution in #15142
• @adoroszlai made their first contribution in #15443

Full Changelog: v0.383.0...v0.384.0

Google hat mit der Pixel 10-Baureihe beim Wireless Charging bereits aufgestockt und das nächste Update könnte bereits auf dem langen Weg sein. Verbesserungen für den…

Dieser Artikel Google Pixel hat künftig vielleicht echtes Schnellladen ohne Kabel erschien zuerst auf SmartDroid.de.

Many organizations generate least-privilege IAM policies but never deploy them. That leaves existing permissions available for attackers to abuse after compromising workloads like CI/CD runners.

Instead of depending on thousands of manually applied policies, Sandy Bird describes a behavioral approach: if an identity suddenly attempts a privileged action it has never performed before—like creating access keys—the request is blocked until approved. The goal is to stop attacker behavior even when permission cleanup hasn't happened.

Is it more effective to continuously reduce permissions, or should organizations focus first on enforcing guardrails around unexpected privileged actions?

Subscribe to our podcasts: https://securityweekly.com/subscribe

#CloudSecurity #IAM #SecurityWeekly #Cybersecurity #InformationSecurity #AI #InfoSec

The post YouTube Exits Teen Addiction Lawsuit as Meta, TikTok, Snapchat Head to Trial appeared first on TechRepublic.

This release marks the completion of UniGetUI's migration from WinUI to Avalonia. With the remaining WinUI components and dependencies now removed, UniGetUI is fully powered by Avalonia. This update also brings Windows 11 Snap Layouts support, refined styling throughout the application, improved log viewing, new illustrations, and significantly smaller release packages.

Highlights

• Further refined the Avalonia user interface to better match WinUI styling and behavior across package lists, navigation elements, dialogs, and controls.
• Added support for Windows 11 Snap Layouts when hovering the maximize button, matching the behavior of native Windows applications.
• Added illustrations for empty and loading package list states, improving visual feedback throughout the application.
• Improved the operation log window so automatic scrolling no longer interrupts users when reviewing previous log entries.
• Reduced installer and application package sizes, resulting in smaller downloads and a significantly leaner Windows distribution.

User Interface Improvements

• Improved package list styling, column headers, backgrounds, hover states, and selection indicators for a more polished and consistent experience.
• Refined sidebar navigation and segmented controls to better align with modern Windows design patterns.
• Improved package tag badges and icon presentation throughout the application.
• Updated several labels, placeholders, and interface elements for improved clarity and consistency.
• Removed the remaining WinUI-specific styling dependencies, further consolidating the application around Avalonia.

Windows Improvements

• Added native Windows 11 Snap Layouts integration for the maximize button.
• Improved maximize button hover and pressed visual states to more closely match native Windows behavior.

Performance & Reliability

• Reduced the size of Windows release packages by removing unnecessary runtime dependencies and optimizing published builds.
• Reduced installer size through improved compression settings.
• Simplified application dependencies and reduced overall maintenance complexity.

Fixes

• Fixed log output auto-scrolling behavior when manually reviewing previous entries.
• Resolved various UI inconsistencies and styling issues across the Avalonia interface.
• Addressed several minor issues and edge cases throughout the application.

Other Changes

• Dependency cleanup and project maintenance.
• Internal code refactoring and infrastructure improvements.
• Additional test coverage and build pipeline optimizations.

Thank you to everyone who reported issues, submitted feedback, and contributed improvements to the project.

Full Changelog: v2026.2.1...v2026.2.2

The post Snap SPECS AR Glasses Put Standalone Wearables Back in Focus appeared first on TechRepublic.

Read more of this story at Slashdot.

A deep technical blog on using phone numbers and email addresses to discover hidden domains, subdomains, and attack surface — with real-world techniques you can use today.

Foreword: Why I Wrote This

In bug bounty and security research, one of the biggest challenges is not finding vulnerabilities — it’s finding the right attack surface.

Many researchers start with traditional reconnaissance: collecting subdomains, checking DNS records, and running automated tools. While these methods are valuable, they often miss assets that are not directly connected to the primary domain.

This is where OSINT becomes powerful.

A simple phone number or email address can become a starting point for discovering hidden digital assets:

• A company email can reveal related domains and third-party services
• Public profiles can expose forgotten infrastructure
• Developer footprints can reveal technology stacks and assets
• Business records can connect organizations to previously unknown domains

The idea behind this research is simple:

Public information creates relationships, and relationships create attack surface.

This blog explores an OSINT-driven acquisition workflow for connecting phone numbers and email addresses with domains, subdomains, and external assets. These techniques are useful for authorized security testing, bug bounty research, and improving reconnaissance skills.

The goal is not just to collect more assets — it is to understand how different pieces of public information connect together to reveal a larger security picture.

Part I: The Conceptual Framework — Why This Works

The Problem with Traditional Subdomain Discovery

Traditional subdomain discovery relies on one thing: the DNS namespace is enumerable. You either brute-force it (guess names) or query passive sources (CT logs, passive DNS).

Both approaches share a fundamental limitation: they only find subdomains that are publicly resolvable or historically logged.

Here’s what they miss:

• Private/internal domains (e.g., internal.company.com that only resolves on the corporate VPN)
• Pre-production domains that were registered but never deployed to DNS
• Acquired company domains that aren’t linked from the parent
• Domains used for third-party services (e.g., company.slack.com, company.atlassian.net)
• Personal domains used by employees for work purposes

The Email-to-Domain Bridge

Every email address user@domain.com tells you:

1. The domain exists (obvious, but foundational)
2. The domain is actively used (someone sent mail from it)
3. The domain has a user (potential credential, potential account)
4. The domain is connected to services (GitHub, Slack, Jira, AWS, etc.)

When you collect thousands of email addresses associated with a company, and you extract every domain from those emails, you build a corporate domain graph that DNS brute-force can never replicate.

The Phone-to-Domain Bridge

Every phone number +1 (415) 555-0199 tells you:

1. The company exists at a physical location (office, data center)
2. The company uses a specific VOIP provider (Twilio, RingCentral, Vonage)
3. The company has registered infrastructure (WHOIS records, business registries)
4. The company has extensions (which map to departments, which map to services)

When you collect phone numbers and reverse-search them, you find domains that were registered with those same phone numbers — often from before the company had a proper security team.

Part II: Phone Number → Domain Discovery

Phone numbers are a persistent identifier. Companies change domains more often than they change phone numbers. A domain registered in 2005 with a phone number is still associated with that company today — even if the domain is forgotten.

Technique 1: WHOIS Phone Number Search

Every domain registration includes a phone number. SecurityTrails, WhoisXMLAPI, and DomainTools allow you to search by phone number to find all domains registered with it.

#!/bin/bash
# phone-to-domain.sh - Find domains registered with a specific phone number
PHONE="$1"

# Using WhoisXMLAPI (paid, but worth it)
curl -s "https://www.whoisxmlapi.com/whoisserver/WhoisService?apiKey=$API_KEY&domainName=$PHONE&outputFormat=JSON" | \
    jq -r '.WhoisRecord.registryData.registrarName // empty'

# Using DomainTools (requires API key)
curl -s "https://api.domaintools.com/v1/$PHONE/domains/" \
    -u "$DOMAINTOOLS_USER:$DOMAINTOOLS_KEY" | \
    jq -r '.response.domains[]'

# Manual: Reverse WHOIS lookup on SecurityTrails
# https://securitytrails.com/list/phone/$PHONE

What this finds: Every domain that was ever registered with that phone number — including domains for subsidiaries, defunct products, and personal projects.

Technique 2: Business Registry Phone Search

Every corporation in the US registers with a state business registry. These registries include phone numbers. You can search by phone number to find all corporations registered under that number.

# OpenCorporates API
curl -s "https://api.opencorporates.com/v0.4/companies/search?q=$PHONE&api_token=$TOKEN" | \
    jq -r '.results[].company.name'

# State-specific registries (examples)
# California: https://businesssearch.sos.ca.gov/
# Delaware: https://icis.corp.delaware.gov/
# Texas: https://mycpa.cpa.state.tx.us/coa/

What this finds: Legal entities, DBAs, and subsidiaries that aren’t publicly linked to the parent company.

Technique 3: Phone Number Reverse Lookup Services

# Twilio Lookup API
curl -s "https://lookups.twilio.com/v1/PhoneNumbers/$PHONE?Type=carrier&Type=caller-name" \
    -u "$TWILIO_SID:$TWILIO_TOKEN" | \
    jq '.carrier.name, .caller_name.caller_name'

# Numverify
curl -s "https://apilayer.net/api/validate?access_key=$KEY&number=$PHONE" | \
    jq '.carrier, .location, .line_type'

# Manual: Whitepages reverse lookup

What this finds: The carrier name (VOIP provider), which tells you what infrastructure to attack, and sometimes the registered business name.

Technique 4: Breach Data Phone Search (Authorized Only)

If you have authorized access to breach databases:

# Dehashed search by phone
curl -s "https://api.dehashed.com/v1/search?query=phone:$PHONE&size=1000" \
    -u "$EMAIL:$API_KEY" | \
    jq -r '.entries[].domain' | sort -u

What this finds: Every domain where an account was registered with that phone number — including internal systems, VPN portals, and employee benefits portals.

Real-World Example: Phone-to-Domain Discovery

Target: Large healthcare tech company. Scope: *.healthtech.com.

I found the company’s main phone number from their contact page: +1 (617) 555-0100.

I ran a WHOIS phone number search:

# SecurityTrails reverse WHOIS by phone
# Result: 47 domains registered with +1.617.555.0100

Among those 47 domains:

Critical find: internal-healthtech.com was registered with the same phone number but was not on any subdomain list. It resolved to a private IP range (10.x.x.x) from the outside, but it hosted an internal tool portal accessible via VPN. The VPN wasn't in scope either — until I found it through the phone number.

Part III: Email Address → Domain Discovery

Every email address user@domain.com is a direct pointer to a domain. When you collect thousands of emails associated with a target company, you build a comprehensive domain inventory.

Technique 1: Cross-Company Email Analysis

When employees from Company A and Company B communicate, email headers reveal both domains. If you find john@company-a.com and jane@company-b.com in the same email chain, they're connected.

# From breach data (authorized): find which domains appear alongside the target domain
# From leaked email threads: extract all sender/receiver domains
# From public mailing lists: find cross-company email patterns

What this finds: Business relationships — partners, vendors, clients, and acquired companies.

Technique 2: The Hunter.io API Multi-Domain Search

Hunter.io allows you to search by domain AND by company name. The company name search returns emails from multiple domains:

# Search by company name
curl -s "https://api.hunter.io/v2/company/domain?company=healthtech&api_key=$KEY" | \
    jq -r '.data.domains[]'

# Result:
# healthtech.com
# healthtech.io
# healthtech.dev
# healthtech-careers.com
# healthtech-benefits.com

What this finds: All domains associated with a company name, including HR, benefits, and internal tool domains.

Technique 3: Email-to-GitHub-to-Domain Chain

This is one of the most powerful discovery chains in bug hunting:

1. Collect employee email: alice@healthtech.com
2. Search GitHub for that email: finds Alice’s GitHub account
3. Look at Alice’s GitHub repos, commits, and organizations
4. Find references to other domains in code, configs, and commit messages

#!/bin/bash
# email-to-github-to-domains.sh
EMAIL="$1"

# Step 1: Find GitHub account
echo "[*] Searching GitHub for $EMAIL..."
curl -s "https://api.github.com/search/users?q=$EMAIL+in:email" | \
    jq -r '.items[].login' > github_users.txt

# Step 2: For each GitHub user, find their repos and orgs
while read USER; do
    echo "[*] Checking user: $USER"
    
    # Get user's repos
    curl -s "https://api.github.com/users/$USER/repos?per_page=100" | \
        jq -r '.[].full_name' >> repos.txt
    
    # Get organizations
    curl -s "https://api.github.com/users/$USER/orgs" | \
        jq -r '.[].login' >> orgs.txt
    
    sleep 2  # Rate limiting
done < github_users.txt

# Step 3: Search repo contents for domain references
while read REPO; do
    echo "[*] Searching repo: $REPO"
    
    # Search code for domain patterns
    curl -s "https://api.github.com/search/code?q=repo:$REPO+healthtech" | \
        jq -r '.items[].html_url' >> code_refs.txt
    
    # Search commit messages for domain references
    curl -s "https://api.github.com/search/commits?q=repo:$REPO+healthtech" | \
        jq -r '.items[].html_url' >> commit_refs.txt
    
    sleep 2
done < repos.txt

What this finds: Internal domains referenced in code comments, config files, READMEs, and commit messages.

Technique 4: Email-to-Breach-to-Domain Correlation

When an employee’s email appears in a breach, you can see what service they were using and what domain was involved:

# Dehashed query (authorized)
curl -s "@healthtech.com&size=10000">https://api.dehashed.com/v1/search?query=email:@healthtech.com&size=10000" \
    -u "$EMAIL:$API_KEY" | \
    jq -r '.entries[] | "\(.domain) \(.email) \(.password)"' | sort -u

# Extract unique domains
curl -s "@healthtech.com&size=10000">https://api.dehashed.com/v1/search?query=email:@healthtech.com&size=10000" \
    -u "$EMAIL:$API_KEY" | \
    jq -r '.entries[].domain' | sort -u > breached-domains.txt

What this finds: Domains where employees had accounts — including personal projects, side businesses, and services they used for work purposes (sometimes on unmanaged infrastructure).

Technique 5: Email-Specific Subdomain Discovery

Services like Have I Been Pwned, Firefox Monitor, and custom tools can tell you which subdomains of a company have accounts registered:

# Check if a subdomain has active accounts
# For Office 365: login.microsoftonline.com will reveal tenant info
# For Atlassian: company-name.atlassian.net
# For Slack: company-name.slack.com
# For GitHub: github.com/orgs/CompanyName

# Using emails to discover the company's Atlassian instance:
for email in $(cat emails.txt); do
    # Check for Atlassian account
    response=$(curl -s -o /dev/null -w "%{http_code}" \
        "https://healthtech.atlassian.net/rest/analytics/1.0/user/is-licensed?username=$email")
    
    if [ "$response" == "200" ] || [ "$response" == "401" ]; then
        echo "Atlassian domain found: healthtech.atlassian.net"
        break
    fi
done

Real-World Example: Email-to-Domain Discovery Chain

Target: Financial services company finsecure.com.

I collected 2,400 emails using Hunter.io, theHarvester, and LinkedIn scraping. Among them was devops@finsecure.com.

GitHub search on devops@finsecure.com: Found a GitHub account finsecure-devops with a private repo (misconfigured visibility).

Repo contents revealed:

• deploy.config with DB_HOST=mariadb.internal.finsecure.com
• terraform.tf with bucket = "finsecure-terraform-state"
• README.md with See internal docs at docs.internal.finsecure.com

New domains discovered:

• internal.finsecure.com — Not in any CT log or DNS record
• docs.internal.finsecure.com — Subdomain of the above
• mariadb.internal.finsecure.com — Internal database hostname
• finsecure-terraform-state.s3.amazonaws.com — S3 bucket with terraform state

The S3 bucket was publicly listable. It contained AWS access keys. The AWS keys gave access to the production environment.

Chain: 1 email → 1 GitHub account → 1 repo → 4 new domains → 1 S3 bucket → AWS root access.

Part IV: Phone Number + Email → Subdomain Discovery (The Real Gold)

When you combine phone numbers and emails, you unlock subdomain discovery that no DNS tool can match.

Technique 1: WHOIS Contact Cross-Reference

Company domains are often registered by the same person. If you find the registrant’s name and email from one domain, you can find all other domains they’ve registered:

# Step 1: Get WHOIS info for the main domain
whois healthtech.com | grep -E "Registrant|Admin|Tech|Email" > whois-info.txt

# Step 2: Extract registrant name and email
NAME=$(grep "Registrant Name" whois-info.txt | awk -F: '{print $2}' | xargs)
EMAIL=$(grep "Registrant Email" whois-info.txt | awk -F: '{print $2}' | xargs)

# Step 3: Search for other domains with same registrant
# Using WhoisXMLAPI
curl -s "https://www.whoisxmlapi.com/whoisserver/WhoisService?apiKey=$API_KEY&domainName=$NAME&outputFormat=JSON" | \
    jq -r '.WhoisRecord.registryData.registrantDomains[]'

# Using DomainTools Reverse WHOIS
curl -s "https://api.domaintools.com/v1/$NAME/domains/" \
    -u "$DOMAINTOOLS_USER:$DOMAINTOOLS_KEY" | \
    jq -r '.response.domains[]'

Technique 2: Social Media Profile Mining

Employee LinkedIn profiles often list multiple domains:

Current: Senior Engineer at HealthTech (healthtech.com)
Past: Lead Developer at MedData (meddata.io)
Education: MIT (mit.edu)

Each of these is a domain that may or may not be in scope. If meddata.io was acquired by healthtech.com, then meddata.io infrastructure is likely part of the target's attack surface.

# LinkedIn scraper (requires authentication)
# Extract: current company, past companies, education
# Cross-reference with known acquisitions

# For each past company found on LinkedIn profiles:
# Check if it was acquired by the target
# If yes: run full acquisition pipeline on that domain

Technique 3: Support Portal and Help Desk Domains

Phone numbers often lead to support portals, which lead to subdomains:

# Call the company's support number
# Listen for automated messages:
# "Press 1 for billing" → billing.helpdesk.com
# "Press 2 for technical support" → support.helpdesk.com
# "Press 3 for sales" → sales.helpdesk.com

# These are subdomains of the support portal domain
# Check if they resolve, check for takeovers

# Also check: support@company.com → Zendesk, Freshdesk, Helpscout
# Zendesk: company.zendesk.com
# Freshdesk: company.freshdesk.com
# Helpscout: company.helpscout.net

Technique 4: Email Header Subdomain Discovery

If you can obtain a legitimate email from the company (e.g., by signing up for their newsletter), the email headers reveal internal infrastructure:

Received: from mail.healthtech.com (192.168.1.10)
Received: from mx1.healthtech.com (203.0.113.5)
Received: from smtp-in.healthtech.com (198.51.100.20)
DKIM-Signature: d=healthtech.com; s=selector1
Authentication-Results: mx.google.com;
       spf=pass (google.com: domain of newsletter@healthtech.com designates 203.0.113.5 as permitted sender)

Each of these IPs and hostnames is a potential subdomain:

• mail.healthtech.com
• mx1.healthtech.com
• smtp-in.healthtech.com

Real-World Example: Phone + Email → Subdomain Discovery

Target: SaaS company cloudserve.com.

Phone number from WHOIS: +1 (425) 555-0100 (Seattle area)

Email from WHOIS: admin@cloudserve.com

Step 1: WHOIS reverse search on phone number Found 12 domains, including:

• cloudserve.io (known)
• cloudserve-backup.com (unknown — registered 2008)
• cs-legacy.com (unknown — registered 2005)

Step 2: WHOIS reverse search on email Found 8 more domains:

• cloudserve-status.com (status page — known but useful)
• cloudserve-dev.com (development — not in scope docs)

Step 3: Emails collected from Hunter.io 1,800 emails. Found devops@cloudserve.com in a GitHub commit.

Step 4: DevOps email → GitHub repos Found a repo with monitoring.cloudserve.com hardcoded in a config file.

Step 5: Subdomain enumeration on new domains

subfinder -d cloudserve-backup.com -silent
# Found: admin.cloudserve-backup.com
# Found: db.cloudserve-backup.com

Result: 14 new domains and 47 new subdomains discovered through phone and email OSINT alone. DNS brute-force against the main domain found none of these.

Part V: Building the Phone-to-Email-to-Domain Pipeline

Here’s a practical automated pipeline that can be used for this workflow.

Phase 1: Phone Number Collection & Analysis

#!/bin/bash
# phase1-phone-collect.sh
TARGET="$1"
DOMAIN="$2"

echo "[*] Phase 1: Phone Number Collection"

# 1a. WHOIS extraction
whois "$DOMAIN" 2>/dev/null | grep -oP '(\+?\d{1,3}[-.\s]?)?\(?\d{3}\)?[-.\s]?\d{3}[-.\s]?\d{4}' > phones.txt

# 1b. Web scraping for phone numbers
katana -u "https://$DOMAIN" -d 2 -silent | \
    grep -oP '(\+?\d{1,3}[-.\s]?)?\(?\d{3}\)?[-.\s]?\d{3}[-.\s]?\d{4}' >> phones.txt

# 1c. Business directories
curl -s "https://api.opencorporates.com/v0.4/companies/search?q=$DOMAIN" | \
    jq -r '.results[].company.phone_number' 2>/dev/null | grep -v null >> phones.txt

# Deduplicate
sort -u phones.txt -o phones.txt
echo "[*] Found $(wc -l < phones.txt) unique phone numbers"

Phase 2: Phone → Domain Mapping

#!/bin/bash
# phase2-phone-to-domain.sh
TARGET="$1"

echo "[*] Phase 2: Phone to Domain Mapping"

while read PHONE; do
    echo "[*] Processing phone: $PHONE"
    
    # 2a. Reverse WHOIS by phone (if you have access)
    # DomainTools API
    # curl -s "https://api.domaintools.com/v1/$PHONE/domains/" -u "$USER:$KEY" | \
    #     jq -r '.response.domains[]' >> phone-domains.txt
    
    # 2b. SecurityTrails (manual or API)
    # curl -s "https://api.securitytrails.com/v1/search?query=whois.phone:$PHONE" \
    #     -H "APIKEY: $ST_KEY" | jq -r '.records[].hostname' >> phone-domains.txt
    
    # 2c. Breach data (authorized)
    # dehashed API
    # curl -s "https://api.dehashed.com/v1/search?query=phone:$PHONE" \
    #     -u "$EMAIL:$DEHASHED_KEY" | jq -r '.entries[].domain' >> phone-domains.txt
    
    sleep 1
done < phones.txt

sort -u phone-domains.txt -o phone-domains.txt
echo "[*] Found $(wc -l < phone-domains.txt) domains from phone numbers"

Phase 3: Email Collection

#!/bin/bash
# phase3-email-collect.sh
DOMAIN="$1"

echo "[*] Phase 3: Email Collection"

# 3a. Hunter.io
curl -s "https://api.hunter.io/v2/domain-search?domain=$DOMAIN&api_key=$HUNTER_KEY" | \
    jq -r '.data.emails[].value' > emails-hunter.txt

# 3b. theHarvester
theHarvester -d "$DOMAIN" -b google,linkedin,github -f /dev/null 2>/dev/null | \
    grep -oP '[a-zA-Z0-9._%+-]+@'"$DOMAIN" > emails-harvester.txt

# 3c. Skymem
curl -s "https://www.skymem.info/srch?q=$DOMAIN" | \
    grep -oP '[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]*\.?'"$DOMAIN" > emails-skymem.txt

# 3d. Web page extraction
katana -u "https://$DOMAIN" -d 2 -silent | \
    grep -oP '[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]*\.?'"$DOMAIN" > emails-web.txt

# 3e. JS file extraction
katana -u "https://$DOMAIN" -jc -silent | xargs -I{} curl -s {} 2>/dev/null | \
    grep -oP '[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]*\.?'"$DOMAIN" > emails-js.txt

# Combine
cat emails-hunter.txt emails-harvester.txt emails-skymem.txt emails-web.txt emails-js.txt | \
    sort -u > emails.txt

echo "[*] Found $(wc -l < emails.txt) unique email addresses"

Phase 4: Email → Domain Extraction

#!/bin/bash
# phase4-email-to-domain.sh
DOMAIN="$1"

echo "[*] Phase 4: Email to Domain Extraction"

# 4a. Extract all domains from email addresses
grep -oP '@[a-zA-Z0-9.-]+' emails.txt | sed 's/@//' | sort -u > email-domains.txt

# 4b. Remove the main domain (keep only non-obvious domains)
grep -v "$DOMAIN" email-domains.txt > other-domains.txt

echo "[*] Found $(wc -l < email-domains.txt) total domains from emails"
echo "[*] Found $(wc -l < other-domains.txt) domains OUTSIDE the main domain"

Phase 5: LinkedIn → Name → Email → Domain

#!/bin/bash
# phase5-linkedin-to-domains.sh
TARGET="$1"
DOMAIN="$2"

echo "[*] Phase 5: LinkedIn Name to Email to Domain"

# 5a. Scrape LinkedIn for employees (manual or with tool)
# linkedin_scraper -c "$TARGET" -o linkedin-employees.csv

# 5b. Extract past companies from LinkedIn profiles
# awk -F, '{print $3}' linkedin-employees.csv | sort -u > past-companies.txt

# 5c. For each past company, check if it's in scope
while read COMPANY; do
    echo "[*] Checking past company: $COMPANY"
    
    # Search for the company's domain
    domain_from_name=$(echo "$COMPANY" | tr '[:upper:]' '[:lower:]' | sed 's/ //g').com
    nslookup "$domain_from_name" > /dev/null 2>&1 && echo "$domain_from_name" >> past-company-domains.txt
    
done < past-companies.txt

# 5d. For each past company domain, check if acquired by target
# Manual step: verify acquisition history

Phase 6: Cross-Reference and Subdomain Enumeration on New Domains

#!/bin/bash
# phase6-subdomain-enum.sh
DOMAIN="$1"

echo "[*] Phase 6: Subdomain Enumeration on All Discovered Domains"

# Combine all domain lists
cat phone-domains.txt other-domains.txt past-company-domains.txt | sort -u > all-discovered-domains.txt

# Run subdomain enumeration on each
while read DISCOVERED_DOMAIN; do
    echo "[*] Enumerating: $DISCOVERED_DOMAIN"
    
    # CT logs
    curl -s "https://crt.sh/?q=%25.$DISCOVERED_DOMAIN&output=json" | \
        jq -r '.[].name_value' 2>/dev/null >> all-subs.txt
    
    # Subfinder
    subfinder -d "$DISCOVERED_DOMAIN" -silent >> all-subs.txt
    
    # DNS brute-force
    puredns bruteforce ~/wordlists/subdomains.txt "$DISCOVERED_DOMAIN" \
        -r ~/resolvers.txt -q >> all-subs.txt
    
done < all-discovered-domains.txt

sort -u all-subs.txt -o all-subs.txt
echo "[*] Total subdomains discovered: $(wc -l < all-subs.txt)"

Part VI: The Complete Real-World Workflow

To understand how this methodology works in practice, let's walk through an anonymized example of how phone numbers, emails, and public intelligence can reveal hidden assets. payflow.com

08:00 — Phone Collection

# WHOIS
whois payflow.com | grep -E "Phone|Tel"
# +1 (415) 555-0100

# Contact page
katana -u https://payflow.com/contact -d 1 | grep -oP '(\+?\d{1,3}[-.\s]?)?\(?\d{3}\)?[-.\s]?\d{3}[-.\s]?\d{4}'
# +1 (415) 555-0100 (same)
# +1 (512) 555-0200 (different — Austin)

# Business registry
curl -s "https://api.opencorporates.com/v0.4/companies/search?q=payflow" | \
    jq -r '.results[].company.phone_number'
# +1 (512) 555-0200
# +1 (512) 555-0300 (NEW — unknown)

Phone numbers collected:

• +1 (415) 555-0100 (San Francisco — HQ)
• +1 (512) 555-0200 (Austin — known office)
• +1 (512) 555-0300 (Austin — UNKNOWN)

08:30 — Phone → Domain

# SecurityTrails reverse WHOIS by phone
# +1 (512) 555-0300 → registered to:
# payflow-holdings.com
# payflow-ventures.com
# pf-internal.com

New domains discovered:

• payflow-holdings.com — Holding company
• payflow-ventures.com — Venture arm
• pf-internal.com — INTERNAL DOMAIN

09:00 — Email Collection

# Hunter.io: 847 emails
# theHarvester: 312 emails
# Skymem: 1,204 emails
# Web scraping: 89 emails
# JS files: 34 emails
# Total unique: 1,892 emails

09:30 — Email → Domain Extraction

grep -oP '@[a-zA-Z0-9.-]+' emails.txt | sed 's/@//' | sort -u

# Unique domains found in emails (excluding payflow.com):
# payflow.io (known)
# payflow.co (NEW)
# payflow-engineering.com (NEW — engineering team domain)
# pf-payments.com (NEW — payments processing domain)
# payflow-benefits.com (NEW — HR/benefits domain)

10:00 — GitHub Cross-Reference

# Searched for devops@payflow.com on GitHub
# Found GitHub user: payflow-devops
# Scanned repos for domain references

# Found in deploy configs:
# monitoring.internal.payflow.com
# logs.internal.payflow.com
# ci.internal.payflow.com

10:30 — Subdomain Enumeration on New Domains

# On pf-internal.com:
subfinder -d pf-internal.com -silent
# vpn.pf-internal.com (LIVE)
# jenkins.pf-internal.com (LIVE)
# git.pf-internal.com (LIVE)

# On payflow-engineering.com:
subfinder -d payflow-engineering.com -silent
# dev.payflow-engineering.com (LIVE)
# staging.payflow-engineering.com (LIVE)
# api.payflow-engineering.com (LIVE)

11:00 — Priority Assessment

P0:

1. vpn.pf-internal.com — VPN portal (potential credential access)
2. jenkins.pf-internal.com — Jenkins (potential RCE)
3. pf-internal.com — Internal domain (potential for more discovery)

P1: 4. payflow-engineering.com — Engineering domain (dev/staging instances) 5. payflow-holdings.com — Holding company (potential subsidiary assets) 6. monitoring.internal.payflow.com — Monitoring (potential Grafana/Prometheus)

11:30 — Attack Phase

Jenkins on pf-internal.com:

• No authentication required
• Created a freestyle project with a reverse shell
• Got shell access to the Jenkins server
• Jenkins had AWS keys in environment variables
• AWS keys had full admin access to production

Chain: 1 phone number → 3 unknown phone numbers → 1 unknown domain → 3 subdomains → 1 Jenkins server → AWS root access.

Part VII: Tool Reference Guide

Phone Number Tools

Email Collection Tools

Cross-Reference Tools

Part VIII: Common Mistakes (From Personal Experience)

Mistake 1: Not Checking All Phone Numbers from WHOIS

A common mistake is finding one phone number in WHOIS and stopping too early, ran my reverse search, and stopped. There were actually three different phone numbers across different domains — I missed two.

Fix: Extract EVERY phone number from EVERY WHOIS record for EVERY domain you find.

Mistake 2: Ignoring Email Domains That Don’t Match the Target

What happened: I collected 2,000 emails for target.com. I filtered out everything that wasn't @target.com. I missed the 200 emails with @target-engineering.com, @target-holdings.com, and @target-benefits.com — all of which were owned by the same company.

Fix: Extract ALL unique domains from your email collection, not just the primary domain.

Mistake 3: Not Checking LinkedIn Past Companies

What happened: An employee’s LinkedIn profile showed they previously worked at acme-solutions.com. I ignored it. Acme Solutions had been acquired by my target three years prior. Its infrastructure was in scope but I never checked it.

Fix: Scrape past companies from LinkedIn profiles and cross-reference with acquisition history.

Mistake 4: Not Running Subdomain Enumeration on Each New Domain

What happened: I found pf-internal.com and added it to my list. I didn't run subfinder or CT log queries against it. vpn.pf-internal.com was sitting there the whole time.

Fix: Run full subdomain enumeration on EVERY domain you discover, no exceptions.

Mistake 5: Stopping After One Round

What happened: I discovered new domains, ran subfinder once, and started attacking. I didn’t recurse. Some of those new domains had their own subdomains, and those subdomains had their own CT logs.

Fix: Recursive enumeration. Every new domain → full acquisition pipeline → find more domains → repeat.

Bug Hunter Acquisition Checklist — Phone & Email Edition

☐ Phone Number Collection

• ☐ WHOIS records extracted for all discovered domains
• ☐ Contact/scraped pages (main site, subdomains, subsidiaries)
• ☐ Business registries checked (OpenCorporates, state registries)
• ☐ SEC filings reviewed (10-K, 10-Q, S-1)
• ☐ Press releases and news articles mined
• ☐ Social media profiles checked (LinkedIn, Twitter, Facebook)
• ☐ Breach data queried (with authorization)

☐ Phone Number Analysis

• ☐ VOIP provider identified for each number
• ☐ Area codes mapped to physical office locations
• ☐ Multi-number comparison for organizational structure
• ☐ Extension patterns identified
• ☐ Reverse WHOIS by phone number completed
• ☐ Business registry search by phone completed
• ☐ Phone number range scanning (if applicable)

☐ Phone → Domain Mapping

• ☐ Reverse WHOIS for every unique phone number
• ☐ Business registry domain mapping
• ☐ Carrier/VOIP provider infrastructure checked
• ☐ Support portal domains discovered (Zendesk, Freshdesk, etc.)
• ☐ VOIP admin console exposure checked
• ☐ Webhook endpoint testing (if Twilio/RingCentral identified)

☐ Email Collection

• ☐ Hunter.io domain search completed
• ☐ theHarvester multi-source harvest completed
• ☐ Skymem cross-reference completed
• ☐ Web page email extraction completed
• ☐ JavaScript file email extraction completed
• ☐ LinkedIn employee name scraping completed
• ☐ GitHub commit email extraction completed
• ☐ Mailing list/public forum extraction completed
• ☐ Breach data email extraction (with authorization)

☐ Email → Domain Extraction

• ☐ All unique domains extracted from email addresses
• ☐ Primary domain filtered out to reveal hidden domains
• ☐ Subsidiary/acquired company domains identified
• ☐ Internal/private domains identified
• ☐ Third-party service domains identified
• ☐ Employee personal domains identified

☐ Email → GitHub → Domain Chain

• ☐ GitHub accounts found for employee emails
• ☐ Repos and commits scanned for domain references
• ☐ Organization discovery completed
• ☐ Config files and environment vars checked
• ☐ Hardcoded endpoints extracted
• ☐ S3 bucket names and cloud resources extracted

☐ Email → Service → Domain Chain

• ☐ Atlassian (Jira/Confluence) instance discovered
• ☐ Slack workspace discovered
• ☐ Microsoft 365 tenant discovered
• ☐ Google Workspace tenant discovered
• ☐ Zendesk/Freshdesk/Helpscout portal discovered
• ☐ Status page hosted domain discovered
• ☐ Documentation/wiki hosted domain discovered

☐ Full Subdomain Enumeration on New Domains

• ☐ CT log queries (crt.sh, certspotter) for each new domain
• ☐ Passive DNS queries (SecurityTrails, VirusTotal)
• ☐ Subdomain brute-force (subfinder, puredns, massdns)
• ☐ Permutation-based discovery (alterx, gotator, dmut)
• ☐ Recursive enumeration (each subdomain → parent as new target)
• ☐ Wayback Machine historical subdomain discovery
• ☐ Technology fingerprinting (httpx, whatweb)
• ☐ HTTP response analysis (live vs. dead, redirects, error pages)

☐ Cross-Reference Validation

• ☐ Phone numbers matched to discovered domains
• ☐ Emails matched to discovered domains
• ☐ LinkedIn past companies cross-referenced with acquisitions
• ☐ GitHub profiles cross-referenced with company email domains
• ☐ Breach data cross-referenced (correlates emails, phones, domains)
• ☐ Scope validation for every newly discovered asset

☐ Continuous Monitoring

• ☐ Daily CT log monitoring for new subdomains on discovered domains
• ☐ Weekly phone number re-check (new WHOIS entries)
• ☐ Weekly email re-harvesting (new employees, new domains)
• ☐ GitHub monitoring for new employee commits
• ☐ Acquisition news monitoring (Google Alerts, Crunchbase)
• ☐ LinkedIn employee movement tracking
• ☐ Quarterly full pipeline re-run

Final Technical Notes

Why This Works at Scale

The average Fortune 500 company has:

• 50–200 registered domains
• 10–50 subsidiaries/acquired entities
• 2,000–20,000 employees
• 5–20 different phone numbers

DNS brute-force will find maybe 30–50% of the subdomains on the main domain. It will find almost none of the subdomains on other domains.

Phone and email OSINT finds the other domains. Then you run DNS brute-force on those. The result is a 3–5x increase in discovered attack surface.

The Data Flow

Phone Number → Reverse WHOIS → New Domains
Phone Number → Business Registry → Legal Entities → New Domains
Phone Number → VOIP Provider → Admin Console → Subdomains

Email Address → Hunter.io → Cross-Company Domains
Email Address → GitHub → Repos → Configs → Domains
Email Address → Breach Data → Service Registrations → Domains
Email Address → LinkedIn → Past Companies → Acquired Domains

New Domains → Subdomain Enumeration → Attack Surface

A Final Word on Authorization

Everything in this blog assumes you have explicit written authorization to test the target’s assets. I do not share the names of actual targets. All examples are anonymized composites of real engagements.

If you’re new to bug bounty:

1. Start with public programs on HackerOne/Bugcrowd that explicitly allow OSINT
2. Never use breach data unless the program explicitly permits it
3. Never use social engineering unless the program explicitly permits it
4. When in doubt, ask the program’s security team

Disclaimer: Only for authorized bug bounty / pentesting environments.

GitHub: SecurityTalent | Medium: Security Talent | Twitter: Securi3yTalent | Facebook: Securi3ytalent | Telegram: Securi3yTalent

#BugBounty #OSINT #CyberSecurity #EthicalHacking #Infosec #PenetrationTesting #AttackSurface #SubdomainEnumeration #ThreatHunting #SecurityResearch #RedTeam #DigitalFootprint #CyberSecurity #BugBounty #BugBountyHunter #EthicalHacking #InfoSec #WebSecurity #ApplicationSecurity #AppSec #CloudSecurity #FrontendSecurity #WebDevelopment #JavaScript #ReactJS #Laravel #NodeJS #DevSecOps #OWASP #SecretsManagement #GitHub #GitHubDorks #SourceMaps #EnvFiles #SecurityResearch #PenetrationTesting #RedTeam #BlueTeam #CloudComputing #AWS #Azure #GoogleCloud #VibeCoding #AI #SecureCoding #DeveloperSecurity #TechBlog #Programming

Phone Numbers and Emails to Hidden Subdomains: The OSINT Acquisition Pipeline That Uncovered a… was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.

• Improved auto mode safety: destructive git commands (git reset --hard, git checkout -- ., git clean -fd, git stash drop) are now blocked when you didn't ask to discard local work, git commit --amend is blocked when the commit wasn't made by the agent this session, and terraform destroy/pulumi destroy/cdk destroy are blocked unless you asked for the specific stack
• Added a warning when the requested model is deprecated or automatically updated to a newer model, shown on stderr in print mode (-p) and now also covering models set in agent frontmatter
• Added attribution.sessionUrl setting to omit the claude.ai session link from commits and PRs in web and Remote Control sessions
• Added /config --help to list all available shorthand keys for /config key=value
• Changed /config toggle behavior: Enter and Space both change the selected setting, and Esc now saves and closes instead of reverting
• Removed the startup "setup issues" line under the logo — run /doctor to see configuration issues or use --debug
• Fixed thinking.disabled.display: Extra inputs are not permitted 400 errors on subagent spawns and session-title generation for affected configurations
• Fixed WebSearch returning empty results in subagents
• Fixed the terminal cursor being stranded above the prompt after navigating history in vim mode with the native cursor enabled
• Fixed fullscreen TUI corruption (statusline mid-screen, duplicated spinner rows, merged text) in Windows Terminal under heavy nested-subagent load
• Fixed turns silently completing with no visible output when the model returned only a thinking block; Claude now re-prompts once
• Fixed user-level skills appearing multiple times in slash-command autocomplete when multiple plugins are enabled
• Fixed MCP servers requiring authentication exposing auth-stub tools to the model in headless/SDK mode
• Fixed tmux teammate panes failing to launch when the shell has slow rc-file initialization, and keystrokes typed during agent spawn leaking into the new tmux pane instead of the leader prompt
• Fixed background tasks started by a teammate being killed when the teammate finishes a turn
• Fixed scheduled task and webhook trigger deliveries being treated as keyboard input; they now classify as task notifications and can no longer approve a pending action or set the session title in auto mode
• Fixed focus mode showing "Ran N PostToolUse hooks" timing lines under each response

The post Snap’s $2,195 Specs Take Aim at Apple Vision Pro, Meta AI Glasses appeared first on TechRepublic.

Der Beitrag Snap stellt „Specs“ vor: Eine neue AR-Brille für 2.295 Euro erschien zuerst auf appgefahren.de.

Im Rahmen der Augmented World Expo 2026 hat Snap die neueste Generation der AR-Brille Specs vorgestellt und sie zur Vorbestellung freigegeben. Die Specs kosten 2.195 US-Dollar vor Steuern und sollen ab Herbst zuerst in den USA, UK und Frankreich verfügbar sein. Die autarke AR-Brille wird von Snap in zwei Größen angeboten.

Read more →

The post Hackers Compromised 140+ Mastra npm Packages to Deploy Password-Stealing Malware appeared first on IT Security News.

The post Terraform Alternatives in 2026: OpenTofu, Pulumi, Crossplane, and What Actually Fits Your Team appeared first on SecureBlitz Cybersecurity.

The post Hackers Compromised 140+ Mastra npm Packages to Attack Users With Password Stealing Malware appeared first on Cyber Security News.

Read more →

The post Snap Debuts $2,195 Augmented Reality Glasses appeared first on IT Security News.

Wo du uns folgen kannst: Facebook, Reddit, Google News, X, Threads

Read more of this story at Slashdot.

The Moft Trackable Snap-on Phone Stand & Wallet

(via Cult of Mac - Your source for the latest Apple news, rumors, analysis, reviews, how-tos and deals.)

Authored with Cursor Composer 2.5 (composer-2.5-fast).

Fixes #186991

Pull Request resolved: #186997
Approved by: https://github.com/huydhn

Read more of this story at Slashdot.

Added

• Added a dependency-free @oh-my-pi/pi-ai/effort module exporting the Effort enum and THINKING_EFFORTS, split out of model-thinking so hot-path consumers can import the thinking levels without pulling in model-thinking and its provider-compat dependency graph. The package barrel still re-exports both names, so existing imports are unaffected.

Fixed

• Fixed Antigravity usage provider emitting one bar per model instead of deduplicating by tier — a single account's 15+ model entries now collapse to one bar per tier, matching the shared-quota reality of the upstream API.

• Fixed Antigravity usage reports missing email and accountId in metadata, so the /usage display and the deduplicator can associate reports with their credentials.

• Fixed usage-report dedup ignoring projectId for Google Cloud providers, preventing duplicate credential entries from being recognized as the same account.

• Fixed Cloud Code Assist (Antigravity / Gemini CLI) rejecting the github tool with HTTP 400 when the pr parameter schema contained anyOf: [string, array]. The CCA mixed-type combiner collapse picked the first non-null type (string) but indiscriminately copied type-specific keys from variant branches — items from the array variant leaked onto the string-typed result, producing {type: "string", items: {...}} which Google's API rejects as invalid. The collapse now filters merged variant fields against the winning type's allowed key set. (#2002)

• Fixed OpenAI Responses-family providers (Codex, OpenAI Responses, Azure Responses) rejecting requests with 400 No tool output found for function call … after the user branched/navigated the session tree to a node that ends on a tool call (the tool-result child is dropped from the reconstructed history) or after a turn was aborted/crashed between the call streaming and its result persisting. The converters now synthesize a placeholder function_call_output/custom_tool_call_output immediately after any unpaired function_call/custom_tool_call, symmetric to the existing orphan-output repair, so the model still sees the call and can recover instead of the whole request 400ing.

• Fixed Anthropic-compatible reasoning endpoints losing prior-turn reasoning on continuation requests when they emit unsigned thinking blocks. convertAnthropicMessages treated unknown endpoints as signature-enforcing and demoted unsigned reasoning to type: "text", which destabilized tool-call argument serialization on the next turn — the upstream symptom behind the args?.ops?.map is not a function crash reported against the todo tool. Official api.anthropic.com keeps the conservative text fallback; non-official anthropic-messages reasoning models now replay unsigned reasoning as native type: "thinking" (#2005).

@oh-my-pi/pi-coding-agent

Breaking Changes

• Replaced the providers.parallelFetch boolean setting with the providers.fetch enum (auto / native / trafilatura / lynx / parallel / jina) that selects the URL reader-backend priority for the read/fetch tool, mirroring providers.image/providers.webSearch. Existing configs are migrated automatically: the legacy key is dropped and the new auto default applies.

Added

• Added a GitHub Actions read handler to the read/web-fetch GitHub scraper. Fetching github.com/{owner}/{repo}/actions/runs/{id} renders the run metadata plus a per-job breakdown (steps listed for any job that did not succeed), and …/actions/runs/{id}/job/{id} (also the API-style …/jobs/{id}) renders a single job's metadata, step table, and full plain-text logs. Logs are fetched via the actions/jobs/{id}/logs redirect using GITHUB_TOKEN/GH_TOKEN when present, with the per-line ISO timestamp prefix and leading BOM stripped; the section degrades to an explicit notice when logs are unavailable (no token, private repo, or expired/unfinalized run).

Changed

• Changed eval agent() subagents so they are never subject to the task.maxRuntimeMs wall-clock cap. The parent cell's idle watchdog is already suspended for the entire bridge call (withBridgeTimeoutPause), so a long-running fan-out/recovery workflow must not be killed by a per-subagent runtime limit. runEvalAgent now passes maxRuntimeMs: 0 to runSubprocess, which honors an explicit ExecutorOptions.maxRuntimeMs override over the inherited setting.
• Changed interactive timing behavior so PI_TIMING=x pi preloads the module timer before the CLI graph loads and includes the (modules) report. PI_TIMING=full now also exits after printing, matching PI_TIMING=x, so full module reports are usable for cold-start measurement without launching the TUI. Added the root dev:timing script for the same profiled startup path.
• Changed coding-agent startup imports so normal TUI launch imports InteractiveMode directly, keeps print/RPC/ACP runners on their branch-only paths, and moves marketplace auto-update work behind a lightweight deferred starter.
• Changed cold-launch setup gating so the full setup wizard (every scene plus the overlay and their TUI/OAuth/web-search/theme dependencies) is no longer statically imported by main.ts. The current setup version now lives in a tiny dependency-free modes/setup-version module, and the wizard barrel is lazy-loaded only when the stored setup version is stale or the wizard is forced — the common up-to-date launch skips loading it entirely.
• Changed cold-launch startup imports so the hot-path CLI files no longer pull the full @oh-my-pi/pi-ai barrel: commands/launch.ts and cli/args.ts import THINKING_EFFORTS/Effort from the tiny @oh-my-pi/pi-ai/effort module, and config/model-registry.ts now imports its ~20 symbols from narrow subpaths (api-registry, model-cache, model-manager, model-thinking, models, provider-models, types, utils/event-stream) instead of the barrel — so launching no longer eagerly loads every provider, auth, OAuth, and usage module re-exported by the barrel.
• Changed the read/fetch HTML reader-backend priority to native > trafilatura > lynx > parallel > jina (was parallel > jina > trafilatura > lynx > native). The in-process native htmlToMarkdown runs first — instant, no network, full-fidelity — so the common case no longer depends on a remote service, and a stalled remote backend can no longer mask it. Selecting a specific backend via providers.fetch tries it first, then the rest fall back. The low-quality gate (>100 chars and not isLowQualityOutput) now applies uniformly to every backend; when none clears it, the highest-priority substantial-but-low-quality output is still surfaced so the llms.txt / document-extraction fallbacks keep running.

Fixed

• Fixed eval agent() failures surfacing as an opaque RuntimeError: bridge call '__agent__' failed with no reason. When a subagent aborted, runEvalAgent built its failure message with result.error ?? result.stderr ?? result.abortReason ?? …, but result.stderr is the empty string on a clean abort (and result.error is gated on a non-empty stderr), so the nullish chain stopped at "" and never reached abortReason. The empty string propagated through the loopback bridge and the Python prelude's RuntimeError(msg or "bridge call … failed"), discarding the real reason. The chain now uses || so an empty stderr falls through to abortReason.
• Fixed subagent aborts being mislabeled as the generic "Cancelled by caller" when the abort originated inside the subagent's own turn (stopReason: "aborted" with no caller signal and no runtime-limit timer). runSubprocess now prefers the aborted assistant message's errorMessage (e.g. "Request was aborted" or a specific stream error) for that case, while a real caller signal or wall-clock abort still reports its precise reason.
• Fixed a long streaming tool preview that alone overflows the viewport dropping its scrolled-off head on ED3-risk terminals (ghostty/kitty/iTerm2/…). When expanded with Ctrl+O, a streaming write (content streaming in) and a streaming eval (stdout streaming below its fixed code cell) render top-anchored and grow append-only, but the tool block never reported itself append-only to the transcript, so the renderer's commit-as-you-go boundary stopped at the block start and the earlier rows that scrolled above the viewport were committed nowhere — they vanished, leaving the preview looking like a viewport-tall circular buffer. ToolExecutionComponent now implements isTranscriptBlockAppendOnly() (gated on isTranscriptBlockFinalized(), so it also covers partial-result streams like eval), delegating to a renderer-declared isStreamingPreviewAppendOnly predicate so the expanded stream commits its head exactly like a streamed assistant reply. Collapsed previews (bounded sliding tail windows) and finalized/result previews (which can collapse to a capped view) stay deferred.
• Fixed read/fetch silently dropping whole list sections on pages with malformed list markup — stray <img>, text, or <video> nodes as direct children of <ul> (e.g. the Alacritty changelog). The Jina reader (previously tried before the local renderers) mis-extracts such lists, returning empty Added/Changed sections; the native in-process renderer now runs first and preserves the full content.
• Fixed /usage aggregate amount fallback using raw limits.length as account count — now counts unique accountId values from limit scopes, so N limits from a single account no longer display as "N accts".
• Fixed /usage account labeling falling back to "account N" for providers that use projectId as their primary identity (e.g. Google Antigravity, Gemini CLI) — projectId from report metadata is now considered before the generic fallback.
• Fixed the todo tool's TUI renderer crashing with TypeError: args?.ops?.map is not a function when a streaming tool-call delta surfaced a non-array ops field (mid-stream parseStreamingJson shapes like { ops: "[{" }, or [null] entries before fields arrive). The renderer now treats non-array ops, non-object entries, and non-array items as missing structure instead of crashing, which also stops the spam-warn cascade that followed each malformed delta. Paired with the Anthropic-side reasoning-replay fix in packages/ai (#2005).
• Fixed Python eval agent() collapsing subagent runtime-limit aborts (and other empty-stderr aborts) into a generic RuntimeError: bridge call '__agent__' failed. runEvalAgent coalesced the failure message with ??, which stopped at the empty stderr and never reached abortReason, shipping an empty error through the loopback bridge. The bridge now prefers abortReason for aborts and trims empty stderr/error out of the fallback chain, so Python surfaces the actionable reason (e.g. Subagent runtime limit exceeded (task.maxRuntimeMs=900000)) (#2006).

@oh-my-pi/pi-tui

Changed

• Reworked the DEC 2026 synchronized-output default policy: a positive DECRQM mode-2026 report now enables sync (previously a report could only disable it), so conservatively defaulted-off hosts that actually support it — current Zellij, tmux master, foot, contour, mintty — are upgraded at runtime. The static allowlist also covers Alacritty and the VS Code terminal, honors a TERM_FEATURES Sy advertisement and WT_SESSION (Windows Terminal / WSL), and no longer blanket-disables SSH (DEC 2026 passes through to the outer terminal). Risky multiplexers still start off and rely on the probe. Added synchronizedOutputUserOverride() as the shared opt-out/force resolver.

Fixed

• Fixed WSL/Windows Terminal row flicker while typing by repainting changed text rows before clearing only their stale suffix (#2011).
• Fixed terminals that support DEC 2026 still tearing/flickering because the renderer ignored a positive DECRQM capability report and kept synchronized output off — most visibly WSL + Windows Terminal, Alacritty (≥0.13), and the VS Code terminal (≥1.108), which were detected yet refused sync.

@oh-my-pi/pi-utils

Changed

• logger.printTimings() (the PI_TIMING startup tree) now surfaces two previously-invisible regions: a (before instrumentation) line for runtime init / uncaptured pre-marker work, and an (unattributed self) line for the root span's own untimed work so the gap between visible top-level spans and Total is no longer swallowed. Total is now labelled (since first marker) to make the window explicit. The restored module-timer.ts preload can feed module spans into the report: each module records onLoad → final top-level marker as total, a prepended body marker → final marker as body/TLA, and resolved static imports as a bounded dependency tree so the report separates graph wait from actual top-level module work.

What's Changed

• fix(ai): strip type-specific keys when CCA mixed-type collapse picks non-matching type by @basedcorp99 in #2002
• fix(usage): sanitize Antigravity /usage display — dedupe by tier, fix account count, merge window data by @basedcorp99 in #2004
• fix(coding-agent): harden todo renderer against malformed streaming args by @roboomp in #2007
• fix(eval): surface subagent abort reason through Python agent() bridge by @roboomp in #2008
• docs(web-search): updated kagi description to v1 endpoint by @roboomp in #2010
• fix(tui): reduce WSL row flicker while typing by @roboomp in #2012
• fix(debug): wait for dlv unix socket before connecting by @roboomp in #2014

Full Changelog: v15.9.69...v15.10.0

https://media.ccc.de/v/gpn24-392-de-spotify-yourself-warum-du-von-streamingdienst-weg-willst-und-wie-wohin

In diesem Talk behandeln wir Gründe von verschiedenen Musik- und Podcast-Streamingdiensten wegzumigrieren und schauen uns mögliche automatische Unterstützung und Alternativen (am Beispiel Spotify) an.

Im Rahmen meiner Großoffensive mich unabhängig(er) von Big Tech zu machen, musste zuletzt Spotify dran glauben.

In diesem Talk erzähle ich Euch zunächst wieso (nein, es ist nicht nur Enshittyfication und Big-Tech böse).
Danach schauen wir uns an welche Alternativen es selfhosted gibt, wie gut ich sie finde, und welche ich jetzt benutze.

Außerdem gibt es einen Git-Link zu den Scripten, die ich dafür geschrieben habe und eine kurze Erklärung wie Ihr Eure Spotify Playlists auf mp3s, die Ihr von physischen Alben, die Ihr besitzt, gezogen habt, mappen könnt :)

j0nas

https://cfp.gulas.ch/gpn24/talk/GSHUB7/

#gpn24 #SoftwareandInfrastructure

Licensed to the public under https://creativecommons.org/licenses/by/4.0/

Release Date: June 5, 2026
Since v0.15.2: 874 commits · 542 merged PRs · 1,962 files changed · 205,216 insertions · 46,217 deletions · 399 issues closed (2 P0, 62 P1, 16 security-tagged) · 170 community contributors (including co-authors)

The Surface Release. Hermes meets you wherever you work. A brand-new native desktop app — built across 100 PRs and 159 commits in a single week — gives you Hermes as a real macOS/Linux/Windows application: one-click install, in-app self-update, drag-and-drop files into chat, an inline model picker in the status bar, concurrent multi-profile sessions, a full Simplified Chinese translation, and the ability to connect to a remote Hermes gateway over OAuth or username/password. Alongside it, the web dashboard grew a full browser-based administration panel (MCP catalog, messaging channels, credentials, webhooks, memory, pluggable OIDC / username-password login), and first-time setup got a "Quick Setup via Nous Portal" path that gets you from install to first message in seconds. The default skill set was trimmed to what you actually need, NVIDIA/skills joined the trusted Skills Hub taps, the model picker is now fuzzy-searchable everywhere (desktop, web, TUI, CLI), and /undo finally lets you take back the last N turns. 2 P0 and 62 P1 closures ride along, plus a security round (CVE-2026-48710 Starlette pin, SSRF off-loop hardening, subprocess credential stripping).

✨ Highlights

• Hermes Desktop — a real native app, not a terminal wrapper — This is the headline. There's now a apps/desktop/ Electron application that installs like any other desktop app on macOS, Linux, and Windows, updates itself in place from inside the app, and gives you a polished GUI for everything Hermes does. You get a proper chat window with streaming, a session list you can archive and search, drag-and-drop files anywhere in the chat area, clipboard image paste, a Cmd+K command palette, and a model picker right in the status bar. If you've been telling friends "it's a CLI agent" and watching their eyes glaze over — now you can just send them an installer. None of this existed a week ago. (#20059, #35607, #37099, #37379, #38631 — @OutThisLife, @jquesnelle, @ethernet8023, @austinpickett, @benbarclay)

• Run the desktop app against a remote Hermes — sign in with OAuth or username/password — The desktop app doesn't have to run Hermes locally. Point it at a remote Hermes gateway (your homelab, a hosted box, a teammate's server) and it connects over a secure WebSocket, authenticating with OAuth or a username/password login — no fiddling with --insecure flags or hand-copied session tokens. Each profile can target its own remote host, and you can run concurrent sessions across multiple profiles in one window with cross-profile @session links. The practical version: your laptop runs a thin GUI, the heavy agent runs wherever your API keys and compute live. (#37888, #38851, #39330, #39778 — @benbarclay, @OutThisLife, @teknium1)

• The web dashboard is now a full admin panel — configure everything from the browser — The dashboard grew from "view your sessions" into a complete administration surface. There's a Channels page that sets up every gateway messaging platform (Telegram, Discord, Slack, etc.) from the browser, an admin panel for the MCP catalog with enable/disable toggles, credential management, webhook and hook creation, memory configuration, gateway controls, and a System page with check-before-update and one-click Debug Share. You no longer have to SSH in and edit config.yaml to wire up a new messaging channel or MCP server — it's all point-and-click now. (#36704, #36736, #37211, #38205, #38600 — @teknium1)

• Hermes Desktop speaks Simplified Chinese — full 简体中文 in the chat GUI — The desktop app now ships a complete Simplified Chinese (简体中文) translation across every UI surface — the chat window itself, sidebar, settings, command center, cron, messaging, profiles, skills, agents, the lot. English stays the default; switch language in Appearance settings and the choice persists to your config (display.language). It's built on a proper typed i18n layer, so adding more languages from here is straightforward. (#38241 — @JimLiu)

• Leaner default skill set — Hermes ships only what you actually need — The bundled skill set got a deliberate trim. Skills that were redundant or dead are gone (spotify — superseded by the native Spotify plugin's 7 tools; linear — superseded by hermes mcp install linear; kanban-codex-lane, debugging-hermes-tui-commands, a stale domain orphan, and several empty category markers). Heavier or niche skills moved from bundled to optional (the Baoyu creative set, dspy, subagent-driven-development, minecraft-modpack-server, pokemon-player, hermes-s6-container-supervision) — still one hermes skills install away, just not loaded by default. And a new environments: relevance gate keeps context-specific skills (kanban, docker/s6) out of the skills index for users who'll never use them, while still loading them on explicit request. The result: a smaller, sharper default skill list, less noise in the picker, and a lighter prompt. The curator can now prune unused built-in skills too (not just agent-created ones), with usage tracked for every skill. (#39028, #36701, #36228 — @teknium1)

• NVIDIA/skills is now a built-in trusted skills tap — NVIDIA/skills joins OpenAI, Anthropic, and HuggingFace as a default trusted tap in the Skills Hub — discoverable, browsable, searchable, and auto-updating through the same pipeline. NVIDIA's verified skills for CUDA-X, AIQ, cuOpt and the rest of their product stack are one install away, with real category labels from the repo's skills.sh.json sidecar. (#34333 — @teknium1)

• Quick Setup via Nous Portal — from install to first message in seconds — First-time setup was thinned down to two clear paths: Quick Setup (sign in with Nous Portal, get a model picker, start chatting immediately) or Full Setup (the detailed wizard for power users). hermes portal is now the human-readable alias that runs the full quick-setup Nous flow. The first-run menu explains the difference inline so newcomers aren't guessing. The goal: a brand-new user shouldn't need to read docs to send their first message. (#35723, #36227, #38449, #38465 — @teknium1, @kshitijk4poor)

• Fuzzy model picker, everywhere — type a few letters, find your model — The model picker now does fuzzy search across the desktop app, web dashboard, TUI, and CLI. Type "v4fl" and deepseek-v4-flash surfaces; multi-endpoint providers are grouped under one row instead of cluttering the list with duplicates, and each row carries a description so you know what you're picking. The catalog refreshes hourly instead of daily, so new models show up the same day they launch. New this window: deepseek-v4-flash, MiniMax-M3 with 1M context, qwen3.7-plus. (#36928, #35227, #35756, #35659, #36214 — @kshitijk4poor, @teknium1)

• /undo [N] — take back the last N turns — Said the wrong thing, or sent the agent down a bad path? /undo backs up N user turns, prefills your last message so you can edit and resend, and soft-deletes the turns in between. It works in the CLI, the TUI, and across messaging platforms (Telegram, Discord, etc.) with full parity. Closes a long-standing request (#21910). (#36229, #36699 — @teknium1)

• Choose your default interface — cli or tui — You can now set whether hermes chat drops you into the classic CLI or the Ink TUI by default, with a --cli flag to override per-invocation. The TUI also got a single unified /model command and a Sessions overlay for switching between live sessions. Use the interface you actually like. (#37782, #37112 — @OutThisLife)

🖥️ Hermes Desktop App (NEW)

Install & lifecycle

• macOS desktop install + in-app self-update; rebuild-and-relaunch cleanly on macOS (#35607, #36198, #38296 — @OutThisLife)
• macOS installer renamed to "Hermes" and turned into a launcher (#37516 — @OutThisLife)
• Build desktop in its own desktop stage on macOS/Linux instead of silently skipping; content-hash build stamp, --build-only / --force-build flags (#36134 — @OutThisLife, #37597 — @ethernet8023)
• Boot-failure recovery + live API-key validation; cancellable install; recover from corrupt cached Electron download (#35864, #37379, #39032 — @OutThisLife, @teknium1)
• Windows: recover from corrupt Electron cache in bootstrap install; stop racing our own backend during in-app update (#39465, #39828 — @teknium1, @OutThisLife)
• Linux: configure Electron sandbox helper; detect linux arm64 binary; disable GPU acceleration on remote displays to stop flicker (#37691, #38594, #37932 — @ethernet8023, @OutThisLife)
• Require Node ≥20.19/22.12 for the desktop build; zero eslint/typecheck debt + prettier pass (#38255, #39100 — @OutThisLife)

Remote-gateway & multi-profile

• Connect to OAuth-gated remote gateways; username/password login for remote gateways; per-profile remote gateway hosts (#37888, #38851, #39778 — @benbarclay, @teknium1, @OutThisLife)
• Concurrent multi-profile sessions, cross-profile @session links; re-mint OAuth WS ticket on gateway reconnect; gate OAuth remote connect on AT-or-RT (#39330, #38886, #39464 — @OutThisLife, @teknium1, @benbarclay)
• Offer remote sign-in on a gated-gateway boot failure; validate live WebSocket in remote gateway test (#39402, #39511 — @teknium1)

Chat UX & settings

• Drop files anywhere in the chat area; clipboard image paste with dedupe; attachments on Enter, IME composition handling (#36262, #38306, #38677 — @OutThisLife, @teknium1)
• Background needs-input indicator, clarify redesign, Cmd+K palette & UI consistency pass; inline model picker in the status bar; YOLO toggle in the status bar (TUI parity) (#38631, #37738, #38517 — @OutThisLife)
• Session-list overhaul, session hygiene/archive, media streaming + connecting overlay; search sessions by id (SQL-bounded) (#37379, #37099, #39062 — @OutThisLife, @teknium1)
• Dedicated Providers settings + polished Accounts/API-keys UX; consolidate skills + tools management into one pane; move model management into Settings (#38551 — @austinpickett, #37310, #37330 — @jquesnelle)
• Render approval/sudo/secret prompts so tools stop silently timing out; surface skill & quick-command slash commands in the palette; first-class xAI Grok OAuth provider in the launcher (#38578, #38531, #37697 — @teknium1, @OutThisLife)
• "Choose provider later" skip on first-run onboarding; onboarding can configure a local/custom endpoint without an API key; custom zoom shortcuts (#39483, #38572, #37894 — @teknium1, @ethernet8023)
• macOS helper microphone entitlement; scroll-jump fixes (native anchoring, at-rest jump, wheel-up snap-back); thinking block stays open mid-streaming (#37745 — @xxxigm, #37866, #38221, #38809 — @OutThisLife, @teknium1, @stremtec)
• GUI quality-of-life triage batch; salvaged AhmetArif0 desktop/dashboard fixes; rename session via session.title RPC so /title works (#37536 — @austinpickett, #39070, #39410 — @teknium1, @benbarclay)
• hermes debug share / /debug / hermes logs now include desktop.log (#38203 — @teknium1)
• Simplified Chinese (简体中文) translation across every desktop UI surface — typed i18n layer, switch in Appearance settings, persisted via display.language (English remains default) (#38241 — @JimLiu)
• Full multi-profile support over one global-remote dashboard; remote-profile sessions are first-class (resume, read, rename/archive/delete); new chats honor their profile in global-remote mode (#39921, #39894, #39993 — @OutThisLife)

📊 Web Dashboard

Administration panel (NEW)

• Full administration panel — MCP catalog with enable/disable toggles, pairing, webhooks, credentials, memory, gateway, hook creation, system settings (#36704, #36736 — @teknium1)
• Channels page — set up every gateway messaging channel from the browser (#37211 — @teknium1)
• System page: check-before-update flow + Debug Share (#38205, #38600 — @teknium1)
• nous-blue theme, bulk sessions, schedule picker; enriched profiles dashboard + de-dupe channel env vars; configurable terminal background via theme (#37383, #37872 — @austinpickett, #37156 — @teknium1)
• Always enable embedded chat; remove dashboard --tui flag (#38591 — @benbarclay)

Auth

• Pluggable username/password login (Option B); generic self-hosted OIDC provider + multi-provider verify fix; hermes dashboard register for self-hosted OAuth client (#38819 — @benbarclay, #38917, #38802 — @teknium1)
• Rotate dashboard sessions via refresh token; share /api/* public allowlist between legacy and OAuth gates; drop /api/* paths from OAuth next= round trip (#37247, #34254, #36244 — @benbarclay)
• Chat tab works in gated (OAuth) mode; trust non-web WS origins on OAuth-gated binds after ticket auth; authenticate server-spawned PTY child WS; sanction plugin WS/upload auth via SDK helpers (#34793, #37870, #37972, #38549 — @teknium1, @benbarclay, @kshitijk4poor)
• Allow desktop websocket origins on remote binds (#37747 — @teknium1)

🏗️ Core Agent & Architecture

Provider & model support

• New models: deepseek-v4-flash (+ trimmed variants, maker-grouped curated lists), MiniMax-M3 with 1M context on native minimax providers, qwen3.7-plus (Nous + OpenRouter), gemini-3.5-flash to Gemini OAuth + API-key pickers (#35659, #36214, #39409, #37046 — @teknium1)
• Model picker: fuzzy search across WebUI/TUI/CLI; group multi-endpoint providers under one row; refresh provider descriptions + describe grouped rows; refresh catalog hourly; stop routing OpenAI selection to OpenRouter (#36928 — @kshitijk4poor, #35227, #35773, #35756, #37175)
• Always show Nous Tool Gateway backends, login on select; surface the Nous free tool pool (entitlement + setup prompt); route FAL video gen through managed Nous gateway (#35792 — @teknium1, #36153, #33259 — @alt-glitch)
• Persist mid-session model switch to database; recover model on post-interrupt recovery turn (#35256, #35381 — @teknium1)
• Credential pool: STATUS_DEAD for terminal OAuth failures; isolate custom provider picker credentials (#34412, #34810 — @teknium1)
• Disable Nous Portal legacy session-key inference fallback — JWT-only (#34508 — @kshitijk4poor)

Agent loop, prompt & tools

• /undo [N] — backs up N user turns with prefill + soft-delete (CLI/TUI + messaging-platform parity) (#36229, #36699 — @teknium1)
• Progressive tool disclosure for MCP and plugin tools (scoped); embedder environment-hint hook for the system prompt; universal task-completion guidance + local Python toolchain probe (#34493, #34574, #34340 — @teknium1)
• Uncap delegation max_spawn_depth (floor 1, no ceiling); broaden Hermes self-knowledge pointer to docs + skill; hermes prompt-size diagnostic (#39772, #38538, #35276 — @teknium1)
• perf(read_file): compact line-number gutter — ~14% fewer tokens per read (now the only format) (#35368, #35532 — @teknium1)
• Resolve agent cwd from TERMINAL_CWD via one reader; align prefill messages key handling; resume relaunches in the session's original working directory (#35028 — @banditburai, #38760 — @helix4u, #38562 — @teknium1)
• Prevent session-id fork from concurrent compressions; observer telemetry hooks + NeMo-Relay plugin (gated tool emit) (#34351, #38232 — @teknium1)

Sessions, state & memory

• perf(state): merge FTS5 segments on VACUUM + hermes sessions optimize; keep /branch sessions visible after parent reopen; survive missing FTS5 runtimes (#34596, #39214 — @teknium1, @kshitijk4poor, #35452 — @helix4u)
• Honcho: make startup fail open; harden self-hosted setup paths (#24847 — @stephenschoettler, #35170 — @kshitijk4poor)
• Supermemory: session-level ingest + kebab aliases (#38756 — @alt-glitch)

🧩 Multi-Agent (Kanban) & Skills

Kanban

• goal_mode cards run workers in a /goal loop; file attachments on tasks; attach images referenced in task bodies to worker vision (#35710, #35395, #34210 — @teknium1)
• default_assignee fallback + per-profile concurrency cap; POST /runs/{run_id}/terminate endpoint; gate notifier watcher on dispatch_in_gateway (#34244, #34449, #37174 — @teknium1)
• CLI dispatch config passthrough + humanizer skill swap (#34337 — @teknium1)

Skills

• Leaner default skill set (#39028 — @teknium1):
  • Removed (redundant / dead): spotify (→ Spotify plugin's 7 native tools), linear (→ hermes mcp install linear), kanban-codex-lane, debugging-hermes-tui-commands, stale domain orphan, empty category markers (diagramming, gifs, inference-sh, mlops/training, mlops/vector-databases)
  • Bundled → optional: baoyu-article-illustrator, baoyu-comic, creative-ideation, pixel-art, dspy, subagent-driven-development, minecraft-modpack-server, pokemon-player, hermes-s6-container-supervision
  • Consolidated: webhook-subscriptions + native-mcp folded into the hermes-agent skill as on-demand references; writing-plans merged into plan (v2.0.0)
  • New environments: frontmatter relevance gate (kanban / docker / s6) — context-specific skills stop appearing in the index for users who won't use them, still load on explicit request
• Curator can now prune unused built-in skills (not just agent-created), with usage tracked for every skill (#36701 — @teknium1)
• Blank-slate skills — install --no-skills + opt-out/opt-in for the default profile (#36228 — @teknium1)
• NVIDIA/skills trusted tap — NVIDIA/skills is now a default trusted Skills Hub tap alongside OpenAI/Anthropic/HuggingFace; skills.sh.json sidecar gives taps real category labels (#34333 — @teknium1)
• Skills Hub: fix browse cap, add source links + copy buttons + category cleanup (#37143 — @teknium1)
• New optional skills: grok (xAI Grok Build CLI), antigravity-cli operator (under autonomous-ai-agents) (#34582, #34583, #34604 — @teknium1)

📱 Messaging Platforms (Gateway)

• Structured stream-event protocol + Telegram draft formatting parity; per-platform streaming defaults (Telegram on, Discord off) + dashboard toggles; surface gateway streaming block in DEFAULT_CONFIG (#37250, #37303, #37285 — @teknium1)
• Discord voice-channel mixer — ambient idle bed + verbal acks that overlap TTS; explain /voice usage when toggled bare (#39659, #39766 — @teknium1)
• Handle Feishu meeting invitations; bluebubbles group mention gating; matrix bang-command aliases; matrix fail-closed approval reaction auth (#39040, #37091, #38175 — @teknium1, @alt-glitch, #34567)
• Clean service restart flow; close ResponseStore + dispose unowned adapter on reconnect failure; weixin asyncio.wait_for timeouts (#36188 — @helix4u, #37679 — @Fearvox, #35117 — @banditburai)

🖥️ CLI, TUI & Setup

• Configurable default interface (cli vs tui) + --cli flag; TUI single /model command + unified Sessions overlay; nudge toward /agents dashboard when delegation starts (#37782, #37112 — @OutThisLife, #34704 — @kshitijk4poor)
• Thin out setup — Quick Setup via Nous Portal + Full Setup defaults; explain Quick vs Full inline; hermes portal human-readable Portal onboarding alias + full quick-setup Nous flow (#35723, #36227, #38449, #38465 — @teknium1, @kshitijk4poor)
• Set process title to hermes in ps/top/htop; warn on unsupported pip installs + fix stale update-check cache (#35143, #34846 — @teknium1)
• TUI perf: stop slow/dead MCP servers from freezing startup; stop eager MCP discovery from blocking agent-capable startup; stop persisting full tool output in trail lines (silent OOM) (#35273, #35397, #38224 — @teknium1)
• TUI fixes: auto-recover session on unexpected gateway death; reassemble split SGR mouse sequences; preserve UTF-8 in PowerShell clipboard; reset terminal input modes on exit; /save snapshots under Hermes home (#35893, #38564 — @OutThisLife, #35222 — @teknium1, #36864 — @maxmilian, #38251 — @austinpickett)
• Setup model/provider pickers migrated off simple_term_menu to curses (ESC + ghost-row fixes); default browser/TTS picker to free local backend, not paid Nous (#35806, #37800 — @teknium1)

🔧 Tool System & Installer

• single managed-uv path, delete fts5 installer escalation; installer commit pinning opt-in (default branch-follow); shallow clones (#37660 — @ethernet8023, #37123 — @jquesnelle, #39423 — @ethernet8023)
• ensure_uv() survives the update boundary (no first-run crash); harden venv rebuild + verify core deps after install; require managed marker before destructive clean; stash/restore by default for non-interactive updates (#39780 — @OutThisLife, #38887, #39568, #39645 — @teknium1, @helix4u)
• MCP: stop reporting false OAuth success when no token was obtained; vision honors model.supports_vision in vision_analyze + browser_vision; MiniMax t2a_v2 TTS raise_for_status (#34807, #34562, #39057 — @teknium1)
• yuanbao: cache resolved media resources by resourceId (#34474 — @teknium1)

🐳 Docker & Deployment

• Container reuse + bounded-sync cleanup + orphan reaper; auto-join Docker socket group for docker-in-docker backend; boot non-root containers (skip s6-setuidgid drop when already unprivileged) (#33645, #34407 — @benbarclay, #34837 — @IAvecilla)
• Skip unnecessary boot chown when volume ownership matches remapped UID; seed gateway_state.json from HERMES_GATEWAY_BOOTSTRAP_STATE on first boot; tag containers with hermes-agent labels for identification (#35027 — @Foldblade, #37896 — @benbarclay)
• Point TUI launcher at prebuilt bundle via HERMES_TUI_DIR; consolidate node/nix workspace lockfile + update all consumers (#37923, #36171 — @benbarclay, @ethernet8023)

🔒 Security & Reliability

• CVE-2026-48710 (Starlette BadHost) — pin patched Starlette ≥1.0.1 (#35118 — @teknium1)
• Run URL SSRF checks off the event loop in async paths; strip Bedrock inference bearer token from subprocess env; add bws_cache.json to file-safety read guard; neutralize file paths in mutation-verifier footer (#39046, #34498, #34421, #35684 — @teknium1)
• Restore approval/sudo context in execute_code + guard entry points; add docker restart/stop/kill to DANGEROUS_PATTERNS; sanitize invisible unicode in vetted skill content; deepcopy tools before in-place xAI mutation (#34497, #33438 — @teknium1, @Sarbai, #37245, #34416)
• Sandbox-mirror soft guard for writes to per-task .hermes mirrors; honcho fail-open on startup (#32213 — @briandevans, #24847 — @stephenschoettler)

🐛 Notable Bug Fixes

• 399 issues closed this window (2 P0, 62 P1, 16 security-tagged, 262 bug-labeled).
• Desktop: keep in-flight new chats from vanishing on refresh; Stop button actually interrupts when a turn is queued; stop background session messages bleeding into the active transcript; slash/@ completion menu navigable & Esc-dismissable; IME Enter no longer splits messages (#37908 — @OutThisLife, #37948, #37975, #37937 — @kshitijk4poor, #38333 — @stremtec)
• Update: stop stash/restore from clobbering desktop source on managed clones; don't fail desktop rebuild/skills sync on mid-rebuild venv; export launcher virtualenv to uv (#38542, #38885, #35224 — @teknium1)
• Voice: honor PIPEWIRE_REMOTE in PortAudio fallback; allow /voice over SSH when a sound server is reachable; restore mistralai (2.4.8 clean, ban lifted) (#33473 — @Dusk1e, #35719, #34841 — @teknium1)

📚 Documentation

• New Desktop App guide + remote-backend sections (session token, --tui requirement, username/password connect, dashboard/gateway prerequisites) (#37457, #38144, #38180, #38534, #39128 — @teknium1)
• Dashboard auth-provider suitability + registration across dashboard/Docker/Desktop; network egress isolation guide for Docker (#39633 — @benbarclay, #26385 — @Manzela)

👥 Contributors

A huge thank-you to the 170 community contributors (including co-authors) who shipped work in this release.

Core

• @teknium1

Top community contributors (by merged-PR count)

• @OutThisLife (52) — built the desktop app end to end: install, self-update, remote-gateway connect, multi-profile sessions, chat UX, status-bar model picker
• @benbarclay (44) — Docker hardening, dashboard auth (OIDC, username/password, refresh-token rotation), desktop OAuth remote connect
• @kshitijk4poor (29) — fuzzy model picker, setup/portal onboarding, desktop completion-menu & Stop-button fixes, honcho hardening
• @ethernet8023 (18) — desktop build pipeline (content-hash stamp, build flags), Linux/arm64 desktop support, managed-uv consolidation
• @austinpickett (8) — dashboard nous-blue theme + bulk sessions, desktop Providers settings, GUI QoL triage
• @alt-glitch (7) — Nous tool-pool entitlement surfacing, FAL video-gen managed gateway, supermemory session ingest, matrix aliases
• @helix4u (6) — gateway service-restart flow, update destructive-clean guard, config prefill alignment
• @jquesnelle (4) — installer commit-pinning opt-in, desktop skills/tools + model-management consolidation
• @JimLiu — full Simplified Chinese (简体中文) desktop translation + typed i18n layer

All Contributors

@0xharryriddle, @a1245582339, @adybag14-cyber, @AhmetArif0, @alaamohanad169-ship-it, @alelpoan, @alt-glitch,
@Aman113114-IITD, @amathxbt, @aminvakil, @annguyenNous, @aqilaziz, @Archerouyang, @ashishpatel26, @asimons81,
@austinpickett, @banditburai, @baofuen, @Bartok9, @bbednarski9, @beardthelion, @bedirhancode, @benbarclay,
@benfrank241, @blackpilledsoftware-prog, @bluefishs, @brian-doherty, @briancl2, @briandevans, @BROCCOLO1D,
@caojiguang, @CharZhou, @counterposition, @coygeek, @CryptoByz, @davetist, @davidgut1982, @dchenk, @dirtyren,
@donovan-yohan, @dparikh79, @dskwe, @Dusk1e, @dvir-pashut, @EloquentBrush0x, @emozilla, @ErnestHysa, @erosika,
@ethernet8023, @f3rs3n, @faisfamilytravel, @Fearvox, @ferminquant, @fesalfayed, @firefly, @flooryyyy,
@Foldblade, @Frowtek, @gbarany, @Glucksberg, @GodsBoy, @haran2001, @harjothkhara, @HashClawAI, @hayka-pacha,
@helix4u, @HeLLGURD, @Hinotoi-agent, @hllqkb, @IAvecilla, @inchargeautomation-lab, @Interstellar-code, @isair,
@ITheEqualizer, @jeffrobodie-glitch, @JezzaHehn, @JimLiu, @Julientalbot, @julio-cloudvisor, @karmeleon,
@Kenmege, @Kewe63, @Kolektori, @konsisumer, @kshitijk4poor, @kurobaryo, @kweiner, @kyssta-exe, @Kyzcreig,
@LengR, @leonardsellem, @LeonSGP43, @libre-7, @liuboacean, @liuhao1024, @LoongZhao, @luyao618, @MaheshtheDev,
@Manzela, @mathijsvandenhurk, @MattMaximo, @maxcz79, @maxmilian, @Moikapy, @MustafaKara7, @nateGeorge,
@nepenth, @nielskaspers, @ninjmnky, @octavioturra, @OCWC22, @ohMyJason, @ousiaresearch, @outsourc-e,
@OutThisLife, @Pluviobyte, @polnikale, @pxdsgnco, @Que0x, @r266-tech, @redpiggy-cyber, @rewbs, @rexdotsh,
@rob-maron, @SaguaroDev, @sahibzada-allahyar, @Sarbai, @sarvesh1327, @scubamount, @SeaXen, @seppegadeyne,
@shannonsands, @SHL0MS, @SimoKiihamaki, @SiTaggart, @solaitken, @sprmn24, @stephenschoettler, @steveonjava,
@stremtec, @Subway2023, @sweetcornna, @Sylw3ster, @ThyFriendlyFox, @tillfalko, @tmchow, @TonyPepeBear,
@Tranquil-Flow, @truenorth-lj, @tuancookiez-hub, @Twanislas, @tymrtn, @uzunkuyruk, @ViewWay, @VinciZhu,
@vinoth12940, @vladkvlchk, @vynxevainglory-ai, @WadydX, @wenchengxucool, @whyhkzk, @worlldz, @wysie, @x1am1,
@xxxigm, @ygd58, @youngstar-eth, @zapabob, @zhaoleibd, @Zyrixtrex

Full Changelog: v2026.5.29.2...v2026.6.5

The two aarch64 image builds now run on mt-rel-l-arm64g4-16-62 (still in the release-runners group, so the GHCR mirror step keeps its egress exemption) instead of the x86 runner. amd64 builds are unchanged.

This makes the runner scale set per-arch and 1:1 with its BuildKit arch, so gha_assigned_jobs per scale set is a clean signal for autoscaling each BuildKit pool.

Test plan

• ciflow/docker: confirm the two aarch64 jobs schedule on the arm64 runner and the arm64 images build/push as before.
  Pull Request resolved: #186317
  Approved by: https://github.com/malfet

Der Artikel Ubuntu 26.04: KI-Betriebssystem oder Canonicals nächste Marketing-Offensive? erschien zuerst auf TARNKAPPE.INFO

You're reading Canonical’s Steam Snap for ARM64 is now stable , a blog post from OMG! Ubuntu. Do not reproduce elsewhere without permission.

"This is effectively a Mini Shai-Hulud campaign: it uses the same core tactics of install-time execution, credential harvesting, CI/CD targeting, encrypted exfiltration, and potential downstream propagation," Socket said.

Attribution Remains Unclear as TeamPCP Tools Continue to Circulate

Affected redhat-cloud-services Packages

• @redhat-cloud-services/vulnerabilities-client
• @redhat-cloud-services/tsc-transform-imports
• @redhat-cloud-services/topological-inventory-client
• @redhat-cloud-services/sources-client
• @redhat-cloud-services/rule-components
• @redhat-cloud-services/remediations-client
• @redhat-cloud-services/rbac-client

Encrypted Data Theft and GitHub-Based Propagation

"It commits the encrypted result envelope through the GitHub API," Socket said. "The commit message can include: IfYouInvalidateThisTokenItWillNukeTheComputerOfTheOwner:."

GitHub Abuse Enables Verified Malicious Commits

• Attempting privilege escalation by launching containers that bind-mount the host's /etc/sudoers.d directory and grant passwordless sudo access to CI runners.
• Detecting endpoint protection products such as CrowdStrike, SentinelOne, Carbon Black, and StepSecurity Harden-Runner before executing malicious activities.
• Establishing persistence by modifying Anthropic Claude Code through a SessionStart hook.
• Creating Visual Studio Code tasks.json files configured with "runOn": "folderOpen" to ensure automatic execution whenever a project is opened.

Red Hat GitHub Account Believed to Be Initial Entry Point

Recommended Response and Remediation Steps

• Rotating all potentially exposed credentials.
• Reviewing GitHub and npm activity for suspicious behavior.
• Auditing environments for persistence mechanisms.
• Investigating modifications to configuration files such as:
• • ~/.claude/settings.json
  • .vscode/tasks.json
  • .github/workflows/codeql.yml
  • .github/setup.js
• Enforcing stronger access controls across development environments.

"Because the malware includes background execution and potential developer-tool persistence mechanisms, uninstalling the npm package or deleting node_modules should not be considered sufficient cleanup," Socket explained.

The post Apple preps smart bill-splitting in Apple Cash for iOS 27 and watchOS 27: Snap a receipt photo and let AI handle the math appeared first on MacDailyNews.

Tech billionaires have shelled out hundreds of millions of dollars ahead of the 2 June primary election in California, in an unrivaled attempt to influence who gets to run the state that Silicon Valley calls home.

The industry has used a cover-all-bases approach, funding candidates and ballot measures big and small, contributing to what looks to be the most expensive primary season in California history. The goal, experts say, is to gain both political and regulatory leverage that will perpetuate dominance in business.

Google co-founder Sergey Brin has spent $66m since January, more than any other donor, to fight a billionaire tax that’s up for a vote on the November ballot.

Democratic gubernatorial candidate Matt Mahan has received more donations than any other candidate, including from top executives at Google, Amazon, Snap, LinkedIn, Reddit and Palantir.

Crypto mogul Chris Larsen has funded three Super Pacs with $26m to sway campaigns across California, including giving $1m to back a primary candidate for state insurance commissioner.

Google and Meta have collectively funded a Super Pac with $10m to back assembly and senate candidates in local district races across the state.

Silicon Valley money is flowing toward city primaries as well as state-level ones, with tech-backed Pacs sponsoring voter guides suggesting how to vote on local tax measures.