Summary: Days after Sirius Open Source lowered salaries a couple of cheerleaders appeared, boosting ads from the fake founder of the company

Sophos addressed three vulnerabilities in Sophos Web Appliance, including a critical flaw that can lead to code execution.

Cybersecurity vendor Sophos addressed three vulnerabilities in Sophos Web Appliance, including a critical flaw, tracked as CVE-2023-1671 (CVSS score of 9.8), that can lead to code execution.

The CVE-2023-1671 flaw is a pre-auth command injection issue that resides in the warn-proceed handler, it affects appliances older than

The company also addressed a high-severity code execution issue, tracked as CVE-2022-4934. The issue is a post-auth command injection vulnerability that resides in the exception wizard, it can allow administrators to execute arbitrary code.

The vendor also fixed a medium-severity reflected cross-site scripting (XSS) vulnerability tracked as CVE-2020-36692. An attacker can exploit the vulnerability to execute JavaScript code in the victims browser.

The attacker can trigger the flaw by tricking the victim into submitting a malicious form on an attacker-controlled website while logged into Sophos Web Appliance.

All the above vulnerabilities were discovered and responsibly disclosed to Sophos by external security researchers via the Sophos bug bounty program.

Sophos Web Appliance will reach end-of-life (EoL) status on July 20, 2023. The company recommends customers replace the appliances with Sophos Firewall.

Please vote for Security Affairs (https://securityaffairs.com/) as the best European Cybersecurity Blogger Awards 2022 VOTE FOR YOUR WINNERS
Vote for me in the sections:

• The Teacher Most Educational Blog
• The Entertainer Most Entertaining Blog
• The Tech Whizz Best Technical Blog
• Best Social Media Account to Follow (@securityaffairs)

Please nominate Security Affairs as your favorite blog.

Nominate here: https://docs.google.com/forms/d/e/1FAIpQLSfaFMkrMlrLhOBsRPKdv56Y4HgC88Bcji4V7OCxCm_OmyPoLw/viewform

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

...

The companys victims include blind people

Saturday:

Sunday:

Summary: The crimes of Sirius Open Source turn out to have gone further than the pension fraud; according to a new message, the company withheld payment to staff that did a lot of work and weve seen even worse wage theft before (at one point the company was taken to court over it, almost exactly a decade ago if not many times more)

What is the difference between 78, 45, and 33 RPM records? Obviously most people would say the speed, which of course is true to a degree. But as [Techmoan] covers in a recent video, theres a whole lot more to the playback of 78 RPM records. Especially the older type without so-called microgrooves. Even if you have a record player that can do 78 RPM speeds, you may have noticed that the sound is poor, with a lot of clicking and popping.

The primary reason for this is that on an average 78 RPM record, the groove containing the sound pattern is 3 mil (thousandth of an inch) wide, whereas the grooves on microgroove and 33/45 RPM records is a mere 1 mil wide. This difference translates into the stylus tip, which is comically undersized for the 3 mil grooves and ends up dragging somewhere in the very bottom of the groove, missing entirely out on the patterns etched higher up on the sides. This is why in the past styluses would often come in the flip-style version, as pictured above.

Its also possible to purchase the mono, 3 mil styluses today from Audio-Technica and...

The companys victims include blind people

Saturday:

Sunday:

Summary: The crimes of Sirius Open Source turn out to have gone further than the pension fraud; according to a new message, the company withheld payment to staff that did a lot of work and weve seen even worse wage theft before (at one point the company was taken to court over it, almost exactly a decade ago if not many times more)

On Wednesday, Meta announced an AI model called the Segment Anything Model (SAM) that can identify individual objects in images and videos, even those not encountered during training, reports Reuters.

According to a blog post from Meta, SAM is an image segmentation model that can respond to text prompts or user clicks to isolate specific objects within an image. Image segmentation is a process in computer vision that involves dividing an image into multiple segments or regions, each representing a specific object or area of interest.

Silicon Valley AI company Cerebras released seven open source GPT models to provide an alternative to the tightly controlled and proprietary systems available today.

Generative Pre-trained Transformer models (GPTs) are now all the rage and have inspired op-eds being written by everyone from Henry Kissinger (WSJ) to Noam Chomsky (NYTimes) in just the last month. That sure is some hype level.

Way back in the early history of GPTs, January 1^st this year, I wrote briefly about them and said:

Mozilla has published the Firefox 112.0 binaries today ahead of tomorrow's official unveiling...

upstart writes:

Palantir's Plan to Decipher the Mysteries of Long Covid:

65 million people are still suffering from long Covid, the mysterious cocktail of symptoms that persist in some patients more than 12 weeks after an initial infection. Researchers are still working to understand this illness, but it's been slow progress so far.

This is because long Covid is not just a medical problemit's also a data problem, says Indra Joshi, director of health, research, and artificial intelligence at Palantir, which specializes in analyzing big data.

Before the pandemic, US hospitals kept their data to themselves, Joshi told WIRED Health this March, making it difficult for policymakers and researchers to identify patterns of disease occurring across the country. That's why Palantir worked with the US medical research agency, the National Institutes of Health, to create what Joshi describes as one of the largest collections of Covid-19 health records in the world.

The National COVID Cohort Collaborative, aka N3C, is essentially a giant, collaborative database, enabling clinicians and researchers to study the deidentified data of people suffering from Covid-19 or related conditions. "If you're diagnosed with Covid now, your data goes into this enclave," says Joshi, explaining that N3C now includes 2.1 billion clinical observations. The data enclave also encourages clinicians to enter data in a standardized format, making it easy for their insights to be compared with data collected from other US hospitals.

By harmonizing all this data, the N3C acts as a collective pool of information that researchers can dip into to try to find consensus on the ongoing mysteries of long Covid: What exactly are the symptoms? What treatments are people receiving? And how are they responding to those treatments? Already the N3C data has helped better define the symptoms that make up long Covid. It has also revealed that Black and Hispanic Americans, in comparison to white patients, appear to experience more symptoms and health problems related to long Covid, but are less likely to be diagnosed.

---

Original Submiss...

Theo de Raadt has released OpenBSD 7.3 today as the 54th release for this BSD operating system project...

Theo de Raadt has announced the release of OpenBSD 7.3, the 54th release of the security-oriented operating system. Some of the key features include providing ksh acccess from the system installer, the use of LibreSSL 3.7.2, and OpenSSH 9.3. "We are pleased to announce the official release of....

Iran-linked APT group MERCURY is behind destructive attacks on hybrid environments masquerading as a ransomware operation.

The Microsoft Threat Intelligence team observed a series of destructive attacks on hybrid environments that were carried out by MuddyWater APT group (aka MERCURY). Threat actors masqueraded the attacks as a standard ransomware operation.

MERCURY (aka MuddyWater, SeedWorm and TEMP.Zagros) has been active since at least 2017, in January 2022 the USCYBERCOM has officially linked the Iran-linked APT group to Irans Ministry of Intelligence and Security (MOIS).

The group was observed targeting both on-premises and cloud environments. According to Microsoft, MERCURY likely conducted the attacks in partnership with another actor tracked as DEV-1084, who carried out the destructive actions after MERCURY gained access to the target environment.

MERCURY likely exploited known vulnerabilities in unpatched applications for initial access before handing off access to DEV-1084 to perform extensive reconnaissance and discovery, establish persistence, and move laterally throughout the network, oftentimes waiting weeks and sometimes months before progressing to the next stage. reads the report published by Microsoft. DEV-1084 was then later observed leveraging highly privileged compromised credentials to perform en masse destruction of resources, including server farms, virtual machines, storage accounts, and virtual networks, and send emails to internal and external recipients.

DEV-1084 presented itself as cybercrime group likely as an attempt to hide its real motivation of a nation-state actor.

The link between the DEV-1084 cluster and MERCURY was established based on the following evidence:

• Both DEV-1084 and MERCURY were observed sending emails from the IP address 146.70.106[.]89.
• Both groups used MULLVAD VPN.
• in previous attacks....

OpenBSD 7.3 has been released. As usual, the list of changes and new features is long; click below for the details.

Security updates have been issued by Debian (openimageio and udisks2), Fedora (chromium, curl, kernel, mediawiki, and seamonkey), Oracle (httpd:2.4), Red Hat (httpd and mod_http2 and tigervnc), SUSE (ghostscript and kernel), and Ubuntu (irssi).

Calgary and elsewhere, 2023-04-10: The OpenBSD project today announced the release and general availability of its latest stable version, OpenBSD 7.3.

Eagerly anticipated by users, engineers, enthusiasts and industry pundits all over the world, this release contains a number of improvements over earlier versions, including but not limited to

• Improved hardware support, including new arm64 variants and numerous network and graphics driver updates
• Improved general and network performance due to steadily improving multi-core support
• More flexible network configuration, now supporting lladdr-based config [See earlier report.]
• retguard for amd64 system calls [See earlier report.]
• Enhanced memory and process security [See earlier report]
• Relinking of network exposed daemons at boot time [See earlier report.]
• execute-only (xonly) [See earlier report.]
• pinsyscall(2) [See earlier report.]
• Improved versions of OpenSSH (9.3), LibreSSL (3.7.2), OpenBGPD (7.9)
• Support for disk encryption in the installer [See earlier report.]
• X11 Mesa shader cache enabled.
• More aggressive randomisation of the stack location for all 64-bit architectures except alpha [See earlier report.]

You may notice that the list of OpenBSD Innovations has grown a bit too, while the detailed changelog offers more detail.

All reasonably modern architectures had...

If youve seen the John Wick movies, youve probably had to suspend your disbelief about many things, but the bulletproof suits are perhaps the hardest thing to swallow. They look like stylish suits but are impervious to just about anything at any range. Whats more is when you are hit, they seem to absorb all impact with no effect on the wearer at all.

You can keep running, firing, or karate kicking while the suit takes all of the bullets. You can even pull your jacket up over your face if you want to protect that million-dollar smile. Physics, of course, tells us that a suit like this is pretty much impossible. Except that they actually exist. Granted, the real-life suits dont have the magic physics-defying powers of Mr. Wick&#821...

By Waqas

Alcasec boasted about his hacks in a YouTube podcast.

This is a post from HackRead.com Read the original post: Alcasec Hacker, aka Robin Hood of Spanish Hackers, Arrested

It seems some countries in Europe might ban ChatGPT due to privacy reasons.

---

Italy isnt the only country reckoning with the rapid pace of AI progression and its implications for society. Other governments are coming up with their own rules for AI, which, whether or not they mention generative AI, will undoubtedly touch on it. Generative AI refers to a set of AI technologies that generate new content based on prompts from users. It is more advanced than previous iterations of AI, thanks in no small part to new large language models, which are trained on vast quantities of data.

There have long been calls for AI to face regulation. But the pace at which the technology has progressed is such that it is proving difficult for governments to keep up. Computers can now create realistic art, write entire essays, or even generate lines of code, in a matter of seconds.

We have got to be very careful that we dont create a world where humans are somehow subservient to a greater machine future, Sophie Hackford, a futurist and global technology innovation advisor for American farming equipment maker John Deere, told CNBCs Squawk Box Europe Monday.

Anyone wonder why he might end up serving a longer sentence than Elizabeth Holmes?

---

Former Theranos executive Ramesh Sunny Balwani will be heading to prison later this month after an appeals court rejected his bid to remain free while he contests his conviction for carrying out a blood-testing hoax with his former boss and lover, Elizabeth Holmes.

KTVU delivers the best in-depth reports, interviews and breaking news coverage in the San Francisco Bay Area and California.

Watch KTVUs newscasts on https://www.ktvu.com/live.

Download KTVUs news and weather apps for free at https://www.ktvu.com/mobile-apps.

Follow KTVU on Facebook: https://www.facebook.com/ktvu.

By Corrie Pelc Fact checked by Jessica Beake, Ph.D. The life expectancy of humans on our planet has more than doubled since 1900. Global life expectancy has increased from 31 years in 1900 to 73.2 years in 2023, and is expected to further increase to 77.1 years in 2050.

Imperial physicists have performed the double-slit experiment in time, using materials that can change optical properties in femtoseconds, providing insights into the nature of light and paving the way for advanced materials that can control light in both space and time.

Imperial physicists have recreated the famous double-slit experiment, which showed light behaving as particles and a wave, in time rather than space.

In a groundbreaking development, Imperial College London.

Quantum computing promises to be a revolutionary tool, making short work of equations that classical computers would struggle to ever complete. Yet the workhorse of the quantum device, known as a qubit, is a delicate object prone to collapsing.

Keeping enough qubits in their ideal state long enough for computations has so far proved a challenge.

In a new experiment, scientists were able to keep a qubit in that state for twice as long as normal. Along the way, they demonstrated the practicality of quantum error correction (QEC), a process that keeps quantum information intact for longer by introducing room for redundancy and error removal.

Hunt these 8 hidden or surprising features to make your Linux experience more entertaining.

Read More at Enable Sysadmin

The post 8 open source Easter eggs to have fun with your Linux terminal appeared first on Linux.com.

An Estonian national has been charged in the U.S. for purchasing U.S.-made electronics on behalf of the Russian government and military. The 45-year-old individual, Andrey Shevlyakov, was arrested on March 28, 2023, in Tallinn. He has been indicted with 18 counts of conspiracy and other charges. If found guilty, he faces up to 20 years in prison. Court documents allege that Shevlyakov operated

• GNU/Linux

  • 9to5Linux 9to5Linux Weekly Roundup: April 9th, 2023

    This week...

Threat actors are flooding the npm open source package repository with bogus packages that briefly even resulted in a denial-of-service (DoS) attack. "The threat actors create malicious websites and publish empty packages with links to those malicious websites, taking advantage of open-source ecosystems' good reputation on search engines," Checkmarx's Jossef Harush Kadouri said in a report

Intel has released oneAPI Level Zero Loader 1.10 today, which implements the Level Zero v1.6 specification...

owl writes:

https://www.righto.com/2020/06/die-shrink-how-intel-scaled-down-8086.html

The revolutionary Intel 8086 microprocessor was introduced 42 years ago this month so I've been studying its die.1 I came across two 8086 dies with different sizes, which reveal details of how a die shrink works. The concept of a die shrink is that as technology improved, a manufacturer could shrink the silicon die, reducing costs and improving performance. But there's more to it than simply scaling down the whole die. Although the internal circuitry can be directly scaled down,2 external-facing features can't shrink as easily. For instance, the bonding pads need a minimum size so wires can be attached, and the power-distribution traces must be large enough for the current. The result is that Intel scaled the interior of the 8086 without change, but the circuitry and pads around the edge of the chip were redesigned.

[...] The photo above shows the two 8086 dies at the same scale. The two chips have identical layout in the interior,7 although they may look different at first. The chip on the right has many dark lines in the middle that don't appear on the left, but this is an artifact. These lines are the polysilicon layer, underneath the metal; the die on the left has the same wiring, but it is very faint. I think the newer chip has a thinner metal layer, making the polysilicon more visible.

The magnified photo below shows the same circuitry on the two dies. There is an exact correspondence between components in the two images, showing the circuitry was reduced in size, not redesigned. (These photos show the metal layer on top of the chip; some polysilicon is visible in the right photo.)

Read more of this story at SoylentNews.

As technology advances, cyberattacks are becoming more sophisticated. With the increasing use of technology in our daily lives, cybercrime is on the rise, as evidenced by the fact that cyberattacks caused 92% of all data breaches in the first quarter of 2022. Staying current with cybersecurity trends and laws is crucial to combat these threats, which can significantly impact business development

In time for the upcoming Mesa 23.1 branching and feature freeze, Samuel Pitoiset of Valve's Linux graphics driver team has enabled the graphics pipeline library "GPL" support by default with the Radeon RADV Vulkan driver...

Heres an idea that [Nephlonor] shared a couple years ago, but is worth keeping in mind because one never knows when it might come in handy. He 3D printed a marble run track and kept the generated tree supports. As you can see in the image above, the track resembles a roller-coaster and the tree supports function as an automatically-generated scaffolding for the whole thing. Clever!

As mentioned, these results are from a couple of years ago; so this idea should work even better nowadays. Tree supports have come a long way since then, and are available in more slicers than just Cura.

...

While AMD Zen 4 "Dragon Range" and "Phoenix" laptops are imminent, for those using an older AMD Picasso laptop design from 2019, there are some new Linux fixes on the way for enhancing that older Zen+ experience...

The Intel Media Driver 2023Q1 has been published as the newest feature release for Intel's open-source video acceleration driver providing VA-API support across generations of their integrated graphics as well as newer discrete graphics...

Longtime X.Org release wrangler Alan Coopersmith at Oracle spent some of his Easter working out new releases of seldom-touched X.Org graphics/display drivers...

Over one million WordPress websites are estimated to have been infected by an ongoing campaign to deploy malware called Balada Injector since 2017. The massive campaign, per GoDaddy's Sucuri, "leverages all known and recently discovered theme and plugin vulnerabilities" to breach WordPress sites. The attacks are known to play out in waves once every few weeks. "This campaign is easily identified

Casino 777 Monte Carlo

Since our launches, weve hosted a hundred+ Online video video games for patrons everywhere in the globe the place you could decide your favored one Game and Play Us. ECOGRA is an international testing agency that accredits and regulates the world of on-line playing. It checks to see whether online casinos are honest, fair and safe. ECOGRA is the word on accountable gambling and protects gamers in opposition to unfair practices. Playing for free is a real choice for Indian on-line on line casino gamers in all states, even Maharashtra. Its a nice way to test drive your casino with out having to make any sort of commitment or take on any type of risk.

Let us transfer on to the other segments now, and see if we can find something that could cheer you up. Below you can see answers to the preferred questions on our official Melbet utility. The concept of Roulette is that the table has a wheel with pink numbers, black numbers, and a green zero number. Melbet software has European Roulette, French Roulette, American Roulette, and others. A combo wager is a mix of multiple single bets, where you place a single bet, win it, and place the winnings of the primary single bet on another single guess. The Melbet app is out there not just for Android but also for iOS.

This brings us to some of the important reasons why you would possibly wish to enroll the bonuses. We were disenchanted with the on line casino section, for positive. That is as a end result of the part was there but we discovered no games inside.

• The gaming expertise supplied by Highstakes is of the highest calibre and can be loved at any time and from any location.
• Highstakes supplies its gamers with a wide selection of bonuses and promotions, such as welcome bonuses, free spins, and loyalty rewards.
• The second step will require you to specify your name and choose the account currency.
• We will describe all of the features, otherwise youll have downloaded the app and recognized all its packages on your own.
• If you may be wondering how the flowers look when entrapped on a fairys wing whereas shes taking a full moon bath, heres the visualisation for you.
• Melbet app for iPhone is out there free of charge for anybody and has all the identical features as the website.

Yes, all official Melbet apps for Android and iPhone gadgets are utterly free. You can rapidly set up them in your device using the links on the official web site. Withdraw money in a handy method via the applying. This type of guess is simply a mixture of a number of Accumulator bets.

Bingo, Keno, and Scratch Cards are simply few of the video games that fall into this category. These games offer a refreshing change of tempo from the extra conventional casino games, as properly as the potential for some very profitable winnings. Now that you realize about all of the spo...

777 On Line Casino App Openhot688com$$limitadong Regalo!mag Register Para Makakuha Ng P50 Could 50% Cashback Sayong Unang Deposit!$$bis Bulk And Block Deals

The app will be out there via an icon in the menu of your system. You do not want to fret as a outcome of we have created a website for you and allrummyapps.com on which you shall be able to obtain all these applications. In our website, in the future after one other, new apps are being launched, so at present, a new app has been launched called the Rummy Frenzy Game, if youd wish to know about it.

In case you play for more than a sure quantum on 777, you also get an exclusive invite to the VIP Club of 777. The Welcome Bonus offers you a FreePlay price $200 as soon as you make your first deposit. A welcome bonus email with all the small print might be immediately despatched to your registered email id. You have to enter the coupon code WELCOME777 on the time of registration. The welcome bonus is one hundred pc, so it means that if you make the first deposit of $100, then youll be able to play for $200. This FreePlay can be used in selected video games in Jackpot, Blackjack, and Roulette sections.

• If youre wondering how the flowers look when entrapped on a fairys wing while shes taking a full moon tub, this is the visualisation for you.
• You can divide bonuses for Sports and Casino as you open the Promotions web page.
• To most, residing a lifetime of a star can spell romance, excessive enjoyment and a lavish way of life, even if it lasts for a quantity of days.
• We are a trusted internet primarily based platform with the passion for building healthy relation with our customers Nationally and the world over.

Our payout guide will inform you the means to spot casinos with quick payouts. The object of the game is to foretell the place a small white ball will fall after spinning across the fringe of a roulette wheel. As the carousel rotates in the different way, the ball completes forty rotations. When the ball hits the carousel, it bounces round randomly before touchdown in a number-marked slot. If you are a sports betting enthusiast, then 777 just isnt the portal for you. We have accomplished three segments of this evaluate thus far, and on all three we now have been quite dissatisfied.

Your search query cannot be longer than 128, so we shortened your query. To most, residing a life of a celeb can spell romance, excessive enjoyment and a lavish life-style, even when it lasts for a couple of days. On 18 March 2014, Christies South Kensington will offer the collection of celebrated interior designer Tessa Kennedy inside the sale of Interiors. Around $60 bn is spent on all types of playing in India, however only a fifth of it is legally accounted, in accordance with a 2010 research by KPMG.

This wide range of video games will not go away you bored and just b...

Greatest Casino In Goa

In case you play for greater than a sure quantum on 777, you additionally get an unique invite to the VIP Club of 777. The Welcome Bonus gives you a FreePlay worth $200 as quickly as you make your first deposit. A welcome bonus e mail with all the details will be immediately despatched to your registered e mail id. You must input the coupon code WELCOME777 at the time of registration. The welcome bonus is one hundred pc, so it means that when you make the first deposit of $100, then you can play for $200. This FreePlay can be utilized in chosen games in Jackpot, Blackjack, and Roulette sections.

• All in all, the Live casino section gave the impression to be one of the most attention-grabbing segments of 777.
• Enjoy real-time betting and ensure to not miss out on your favourite sports activities and tournaments!
• For the remaining European international locations, an area licensee operates the providers.
• 777 Live Casino part on the 777 website appears essentially the most vibrant of all.
• Blackjack is a sport of playing cards the place the aim is to have a rating closer to 21 than the supplier with two cards dealt.

Live dealer video games are the following big factor within the on-line casino world. They permit gamers to expertise a level of realism by no means earlier than seen on this format. The primary distinction is that reside on line casino video games are played with an actual dealer who is beamed to your pc or cellular screen by way of a webcam. Youll be able to chat with the dealers just as youd in an actual casino, and so they could even present a quantity of ideas. Sometimes youll find a way to chat with other players too, so make positive to be a friendly opponent. As a results of deregulation and technological developments, the casino world has gone online and now you can play on-line on line casino games from the comfort of your own home or by touching the display screen on a cell system.

Wait Until The Top Of The Download

This brings us to some of the essential the purpose why you may wish to join the bonuses. We were disenchanted with the casino section, for positive. That is as a result of the section was there however we discovered no games inside.

Nice to see that there are such a fantastic application for betting and playing in Bangladesh. You can guess on international cricket matches with a pleasant design. How and Where to Download the Latest Version of the App?

Premium World777 satisfies your every demand for real-time online betting. Money Wheel is a sport of luck that consists of a giant spinning wheel and a desk with numbers and symbols for every section. The gamers win by predicting which image the cash wheel would cease at.

The app is prepared to work, and you might be able to register an account. In the folder of downloaded recordsdata, discover the installation file and...

upstart writes:

NASA's TEMPO Mission Could Bring You Hyper-Local Pollution Alerts:

An advanced tool for monitoring air pollution from space is set to launch on Friday morning, and it'll be hosted on a commercial satellite.

A soon-to-launch NASA mission is set to offer more data on North America's air quality than researchers and public health programs have ever had available before. A new monitoring instrument hosted on a commercial satellite will offer continent-wide, hourly updates on air pollution, at about a four square mile resolution, according to the space agency and partner groups behind the project.

The Tropospheric Emissions Monitoring of Pollution (TEMPO) instrument will keep tabs on the air quality in a region stretching from the oil sands in Canada to south of Mexico City, and from the Atlantic to Pacific coasts, according to a NASA news statement.

The device will use advanced imaging to collect detailed light scattering data (i.e. hyperspectral data) on sunlight reflected off of Earth's atmosphere at varying levels. Using this information, scientists back on the ground will be able to translate those wavelengths of light into local concentrations of different pollutants in the air, explained Dennis Nicks, director of payload engineering at Ball Aerospacethe company that NASA contracted to design and build the TEMPO instrument, during a Wednesday press briefing.

Read more of this story at SoylentNews.

Samsung employees have unwittingly leaked top secret data by providing them to the popular chatbot service ChatGPT.

Samsung employees have shared internal documents, including meeting notes and source code, with the popular chatbot service ChatGPT. ChatGPT uses data provided by the users to train itself and build its experience, with the risk that this data can be available to other users that will query the popular chatbot.

Samsung engineers used ChatGPT to assess the company source code, they asked the chatbot to optimize test sequences for identifying faults in the chips they were designing. According to the website Techradar, in just under a month, the company suffered three data leaks caused by its employees leaking sensitive information via ChatGPT.

In another case, an employee used ChatGPT to convert meeting notes into a presentation, the contents of which were obviously not something Samsung would have liked external third parties to have known. reported TechRadar.

The multinational IT firm has decided to start developing its own AI for internal use. 

Samsung Electronics is warning its employees of the potential risks associated with the use of ChatGPT, explaining that there is no way to prevent the leak of the data provided to OpenAIs chatbot service.

It is not clear if Samsung has requested the deletion of the data provided by its workers to OpenAI.

Early this month, the Italian Data Protection Authority, Garante Privacy, temporarily banned ChatGPT due to the illegal collection of personal data and the absence of systems for verifying the age of minors.

The Authority pointed out that OpenAI does not alert users that it is collecting their data.

According to the announcement, there is no legal basis underpinning the massive collection and processing of personal data to train the algorithms on which the platform relies.

Please vote for Security Affairs (https://securityaffairs.com/) as the best European Cybersecurity Blogger Awards 2022 VOTE FOR YOUR WINNERS
Vote for me in the sections:

• The Teacher Most Educational Blog
• The Entertainer Most Entertaining Blog
• The Tech Whizz Best Technical Blog
• Best Social Media Account to Follow (@securityaffairs)

Please nominate Security Affairs as your favorite blog.

Nominate here: ...

Today, businesses face a variety of security challenges like cyber attacks, compliance requirements, and endpoint security administration. The threat landscape constantly evolves, and it can be overwhelming for businesses to keep up with the latest security trends. Security teams use processes and security solutions to curb these challenges. These solutions include firewalls, antiviruses, data

Posted by Jacques Le Roux on Apr 10

Severity: important

Description:

Arbitrary file reading vulnerability in Apache Software Foundation Apache OFBiz.This issue affects Apache OFBiz: before
18.12.07.

Required Configurations:

Using the Solr plugin

Solution:

Upgrade to release 18.12.07

Credit:

Skay (finder)

References:

https://lists.apache.org/list.html?announce () apache org
https://ofbiz.apache.org/download.html...

An analysis and improvement of the spectral properties of nitrogen-vacancy defects in diamond nanostructures paves the way for efficient entanglement generation necessary for many quantum information applications.

Magnetic spin excitations can combine with photons to produce exotic particles that emit laser-like microwaves.

One of the challenges for building systems for quantum computing and communications has been the lack of laser-like microwave sources that produce sufficient power but dont require extreme cooling. Now a research team has demonstrated a new room-temperature technique for making coherent microwave radiationthe kind that comes from a laser [1]. The device exploits the interaction of a magnetic material with electromagnetic fields. The researchers expect that the work will lead to microwave sources that can be built into chips employed in future quantum devices.

The devices that store quantum bits for quantum computers often require microwave signals to input and retrieve data, so lasers operating at microwave frequencies (masers)and other sources of coherent microwavescould be very useful. But even though masers were invented before lasers, most maser technologies work only at ultracold temperatures. A 2018 design works at room temperature but doesnt produce very much power [2].

Posted by Heping Wang on Apr 10

Severity: important

Description:

In Apache Linkis <=1.3.1, because the parameters are not
effectively filtered, the attacker uses the MySQL data source and malicious parameters to
configure a new data source to trigger a deserialization vulnerability, eventually leading to
remote code execution.
Versions of Apache Linkis <= 1.3.0 will be affected.
1.3.2.

Credit:

sw0rd1ight...

As Nintendos official website for Switch game The Legend of Zelda: Tears of the Kingdom states, The adventure begins on May 12. Officially, at least.

The hotly anticipated sequel to The Legend of Zelda: Breath of the Wild will go on sale next month in digital and physical formats, with the latter also available as a special Collectors Edition.

Targeted at Zelda connoisseurs, the special edition includes The Legend of Zelda: Tears of the Kingdom (physical version), Artbook, SteelBook case, Steel Poster, and a set of four pin badges.

Pre-Release Leak: February 2023

On February 20, 2023, Eurogamer reported that a 200-page Artbook had been leaked online, containing details of new characters, enemies, enemy types, and new locations.

Its currently unclear how this art book managed to leak, so far in advance of Zelda: Tears of the Kingdoms official launch date, the publication noted at the time.

Two months later, its clear that a) Nintendo is very aware of the leak and b) they have a specific internet user in mind as the potential leaker.

DMCA Takedown Sent to Discord

On February 21, Nintendo of America sent a DMCA notice to Discord. The complaint targeted a Discord channel named Tears of the Kingdom Official Discord Server.

The notice went on to target six specific URLs featuring images or links to images from Nintendos copyright-protected and unreleased special edition art book for The Legend of Zelda: Tears of the Kingdom video game in violation of Nintendos rights.

Just eight minutes after the takedown notice was sent to Discord, the platform acknowledged the complaint and told Nintendo that the content will be removed promptly.

Around ten hours after sending the initial takedown notice, Nintendo followed up with a request for immediate review and takedown of the Discord channel, noting that members were still distributing the pre-release artwork using direct messages and links.

Additionally, some members have been assigned the...

Posted by Heping Wang on Apr 10

Severity: important

Description:

In Apache Linkis <=1.3.1, due to the lack of effective filtering
of parameters, an attacker configuring malicious Mysql JDBC parameters in JDBC EengineConn Module will trigger a
deserialization vulnerability and eventually lead to remote code execution. Therefore, the parameters in the Mysql JDBC
URL should be blacklisted. Versions of Apache Linkis <= 1.3.0 will be affected.
We recommend users upgrade the...

Posted by Heping Wang on Apr 10

Severity: important

Description:

In Apache Linkis <=1.3.1, due to the default token generated by Linkis Gateway deployment being too simple, it is easy
for attackers to obtain the default token for the attack. Generation rules should add random values.

And modify the default token value. You can refer to
Token authorization[1]...

Posted by Heping Wang on Apr 10

Severity: important

Description:

In Apache Linkis <=1.3.1, due to the Manager module engineConn material upload does not check the zip path, This is a
Zip Slip issue, which will lead to a potential RCE vulnerability.

1.3.2.

Credit:

4ra1n (reporter)

References:

https://linkis.apache.org
https://www.cve.org/CVERecord?id=CVE-2023-27603