Die Logitech-Maus MX Master 4 gibt es neuerdings in einer speziellen Ausführung für Software-Entwickler. Die Developer Edition wird dabei künstlich verknappt. (Logitech, Maus)
Quelle: Golem
Diebe fälschen GPS-Daten und kapern Frachtkonten. Seit Juni stehlen sie Rechenzentrumsfracht für über 100 Millionen US-Dollar. (Cybercrime, Rechenzentrum)
Quelle: Golem
Proton will laut einer internen E-Mail die Angestellten finden, die mit der KI-Strategie kompatibel sind. Andere werden gehen müssen. (Softwareentwicklung, KI)
Quelle: Golem
Sony streicht die künftige Unterstützung physischer Medien, Valve fügt sie dem Steam Frame hinzu – nachdem ein Nutzer einen alten Film schauen wollte. (Steam, Headset)
Quelle: Golem
Two security events landed side by side this week, PHP2Shell and the eMudhra certificate compromise. Both reached the same place, the foundation their applications are built on.
PHP2Shell is a pair of critical flaws in the PHP engine itself, CVE-2026-109618 and CVE-2026-109619. They let an unauthenticated request become code execution on the server, on any PHP application, however careful its own code is, and PHP runs about 69% of the websites whose server-side language is known.
The eMudhra compromise is a different kind of problem. Eight intermediate certificates from the certificate authority eMudhra turned out to have private keys that can be computed from the public certificates, which let anyone issue a certificate for any website and have it accepted. Browsers revoke certificates like these on their own, but a container image carries its own trust store and keeps trusting them until it is rebuilt.
Docker Hardened Images published a fixed PHP image within 24 hours
The dhi.io/php image was rebuilt on the patched PHP and published early on October 22, within 24 hours of the upstream release and after the DHI testing and verification steps. Pulling the current tag puts you on the fixed version. The few DHI images that bundle their own PHP application, such as composer and nextcloud, follow as their upstream projects release.
Rebuilt across the catalog, verifiable tag by tag
The certificate compromise touched the whole catalog, because every image carries a trust store. In the 48 hours after the PHP release, the DHI build system ran 16,567 package and image builds across the catalog. By 10pm UTC on October 22, almost all catalog tags were on the fixed CA store, with most of the rest in the build queue. That percentage comes from the SBOM that ships with every image, read for every published tag to check which CA store and which PHP version it carries, and you can run the same check on anything you pull.
How to make sure your environments are covered
If you run PHP on Docker Hardened Images, pull the current tag for your branch and redeploy, and rebuild anything you built on top of a DHI image so it picks up the new base docker pull dhi.io/php:8.4
Customizations built through the DHI Enterprise workflow are rebuilt automatically when the base layer is patched. For the certificate fix the same applies to every image you build from a DHI base, PHP or not. The Docker Security update from October 22 lists the affected PHP versions and the support path.
If you run PHP in any other container, check the PHP version running inside it rather than the tag on the outside, and rebuild it on a patched base.
Build from a trusted foundation
Weeks like this one will keep coming, but a trusted foundation will make all the difference.
If you are not building on hardened images yet, this week is the wake-up call and the week to start. Both events landed on the foundation, and that is where the fix has to happen, in the image itself, rebuilt from fixed sources before anyone pulls it.
This is exactly what Docker Hardened Images were built for. Docker builds, patches and maintains the system packages inside each image from source, and the build system is event-driven, so an upstream release or a changed package triggers rebuilds of everything that depends on it. Each image ships signed, with its SBOM, SLSA Build Level 3 provenance and VEX data attached, which is why a rebuild of this size can be measured as well as done.
The catalog is free and open source under Apache 2.0, with near-zero CVEs on every image. It stays compatible with the Alpine and Debian your teams already run, so adoption is a one-line change to the FROM line in your Dockerfile, with no migration project attached. DHI Select and DHI Enterprise add SLA-backed remediation with critical CVE fixes within 7 days, FIPS and STIG variants, image customization with the guarantees kept, and Extended Lifecycle Support for the versions upstream has stopped patching. All of it is in the Docker Hardened Images catalog, free to pull today.
Quelle: https://blog.docker.com/feed/
AWS EC2 Auto Scaling now lets you enable Launch Before Terminate as the default replacement behavior across all Auto Scaling groups in your account. When enabled, Auto Scaling launches a replacement instance and waits for it to pass health checks before terminating the instance it replaces, helping your applications maintain full capacity and availability during instance replacement events. This applies to replacement events such as instance refreshes, rebalancing, health checks, and maximum-instance-lifetime replacements.
You can enable Launch Before Terminate through AWS EC2 Auto Scaling account settings, which let you configure the behavior once at the account level instead of on each Auto Scaling group individually. You can manage the setting with the new `PutAccountSetting` and `DescribeAccountSettings` APIs, available through the AWS Management Console, AWS CLI, or AWS SDKs.
Launch Before Terminate is available in all AWS Regions at no additional cost.
To learn more, see Launch Before Terminate in the AWS EC2 Auto Scaling User Guide and AWS EC2 Auto Scaling API Reference Guide.
Quelle: aws.amazon.com
Amazon Connect Customer now scores the outcome of your customer interactions. It shows whether the customer left satisfied, is at risk of churning, made a purchase, or resolved their need in self-service. You can now see whether an interaction worked, not just how efficiently it ran. Each metric comes with a default definition you can adjust to match how your business defines success and are available both through the analytics dashboards and APIs.
Quelle: aws.amazon.com
Now you can view your metrics across customer segments: customer lifetime value (LTV) and repeat callers. See how any metric differs for repeat callers versus the rest of your contacts, or how results hold up among your highest-LTV customers; so you can spot the groups trending the wrong way before it shows up in the aggregate. Where a segment is underperforming, you can act. Route high-LTV customers to your most effective people, adjust the knowledge bases and self-service flows that repeat callers are falling back from, or refine agent guidance for segments where satisfaction is slipping. The segment tells you where to look; the metrics tell you what to fix.
Quelle: aws.amazon.com
Amazon WorkSpaces Core Managed Instances now supports the ModifyVolume API, which lets you change volume size, volume type, IOPS, or throughput in place, without detaching the volume or restarting the instance. Previously, changing storage capacity or performance on a deployed managed instance required rebuilding it.
With ModifyVolume, you can increase volume size up to 16,384 GiB, switch between supported Amazon EBS volume types, adjust IOPS for gp3, io1, and io2 volumes, and modify throughput for gp3 volumes. The API supports idempotency tokens to prevent duplicate changes, and you can track progress with the Amazon EC2 DescribeVolumesModifications operation.
ModifyVolume is available in all AWS Regions where Amazon WorkSpaces Core Managed Instances is available.
To get started, call ModifyVolume directly, or use it through your WorkSpaces Core partner solution once available. To learn more, see ModifyVolume in the WorkSpaces Instances API Reference and Limitations in the Amazon EBS User Guide, or visit WorkSpaces Core.
Quelle: aws.amazon.com
Today, AWS announces the general availability of OpenAI GPT-6.1 Terra on Amazon Bedrock. GPT-6.1 Terra expands the GPT-6 family with a balance of capability, speed, and cost efficiency for everyday workloads.
As the newest model in the Terra line, GPT-6.1 Terra combines detailed visual reasoning, accurate computer use, and improved factuality and natural writing over GPT-5.6 Terra, for complex workflows. In OpenAI’s Agents’ Last Exam evaluation, it scored 15 percentage points higher than GPT-5.6 Terra, performed on par with GPT-6 Astra, and completed tasks more than three times faster than GPT-6 Astra and GPT-6.1 Sol. GPT-6.1 Terra offers balanced performance with input and output token prices at least 50% lower than those of GPT-6.1 Sol and GPT-5.6 Terra. It supports a context window of up to 1 million input tokens and accepts both text and image inputs. The Amazon Bedrock inference engine delivers the performance, security, and scale required for enterprise workloads.
You can call GPT-6.1 Terra directly through Amazon Bedrock APIs or configure ChatGPT Work and Codex to use the model on Amazon Bedrock. Use it to draft proposals, interpret technical drawings, investigate codebases, and build agents that operate across business systems. Established AWS controls help you secure workloads, govern access, and audit model invocation activity.
You can get started in the Amazon Bedrock console or programmatically through supported Amazon Bedrock APIs. For information about supported AWS Regions, endpoints, APIs, features, inference profiles and pricing, see the Amazon Bedrock documentation.
Quelle: aws.amazon.com
