Skip to content
View in the app

A better way to browse. Learn more.
hosang I.T.

A full-screen app on your home screen with push notifications, badges and more.

To install this app on iOS and iPadOS
  1. Tap the Share icon in Safari
  2. Scroll the menu and tap Add to Home Screen.
  3. Tap Add in the top-right corner.
To install this app on Android
  1. Tap the 3-dot menu (⋮) in the top-right corner of the browser.
  2. Tap Add to Home screen or Install app.
  3. Confirm by tapping Install.

Tech

Tech Articles from a wide variety of topics and categories
Show all categories

SAML authentication broken almost beyond repair

Researchers have uncovered fresh techniques for breaking SAML-based authentication, further undermining the security assurances offered by the aging by still widely used authentication protocol.
SAML (Security Assertion Markup Language) has been the backbone of enterprise single sign-on (SSO) technologies for more than 20 years.
During a presentation at the Black Hat Europe conference on Wednesday, PortSwigger security researcher Zak Fedotkin demonstrated novel techniques for breaking the protocol by exploiting subtle flaws in XML handling.
Hacks developed by Fedotkin offered a way of achieving full authentication bypass in the Ruby and PHP SAML ecosystems.
Multiple security weaknesses were in play and these opened the door for the development of attribute pollution, namespace confusion, and a new class of void canonicalization attacks, among others, as detailed in a blog post by PortSwigger.
The presentation, which built on earlier research into the security shortcomings of SAML, included a demo of an attack on a vulnerable GitLab Enterprise Edition 17.8.4 instance.
Exploiting several parser-level inconsistencies offered a way to develop reliable, stealthy exploits against multiple other SAML implementations.
Attacks were possible because multiple hacking techniques allowed potential attackers to completely bypass XML signature validation while still presenting a valid SAML document to an application.
By combining a Ruby-SAML exploit with earlier research, the PortSwigger team were able to bypass email access controls to create a forged SAML Response, set up a new account, and ultimately bypass authentication on an as yet unnamed SaaS platform.
Fedotkin has released an open-source toolkit designed to identify and exploit these vulnerabilities in other real-world SAML deployments.
Patching necessary but insufficient without ‘foundational rework’
PortSwigger shared details of Ruby-SAML 1.12.4 vulnerability with the maintainer in April. The corresponding CVE-2025-66568 and CVE-2025-66567 vulnerabilities were fixed in early December.
Security teams need to make sure that SAML and XML security libraries are up to date by applying the latest security patches and version updates but this may not go far enough. OAuth offers a newer technology for offering SSO that is better maintained and with fewer inherent security weaknesses than SAML but simply switching isn’t a practical answer for most because of the huge and long-established base of service providers that rely on SAML, Fedotkin told CSO.
The researcher said that comprehensive and lasting remediation requires significant restructuring of existing SAML libraries.
“Such changes may introduce breaking compatibility issues or regressions, but they are essential to ensure the robustness of XML parsing, signature validation, and canonicalization logic,” Fedotkin concluded. “Without this foundational rework, SAML authentication will remain vulnerable to the same classes of attacks that have persisted for nearly two decades.”
View the full article
reporter

Apple Releases New Firmware for AirPods Pro 2 and AirPods Pro 3

Apple today released new firmware designed for the AirPods Pro 3 and the prior-generation AirPods Pro 2. The ‌AirPods Pro 3‌ firmware is 8B30, up from 8B25, while the AirPods Pro 2 firmware is 8B28, up from 8B21.


There's no word on what's include in the updated firmware, but the AirPods Pro 2 and ‌AirPods Pro 3‌ are getting expanded support for Live Translation in the European Union in iOS 26.2, which is being beta tested and is close to release.

The firmware could be related to that upcoming functionality, or it could add bug fixes and performance improvements.

To install the new firmware, make sure your AirPods are in range of your iPhone, iPad, or Mac. From there, put your AirPods in the Charging Case and connect the Charging Case to power. Keep the case closed and wait at least 30 minutes for the firmware update to install.Related Roundup: AirPods Pro 3Buyer's Guide: AirPods Pro (Buy Now)Related Forum: AirPods
This article, "Apple Releases New Firmware for AirPods Pro 2 and AirPods Pro 3" first appeared on MacRumors.com

Discuss this article in our forums

View the full article
reporter

Battering RAM hardware hack breaks secure CPU enclaves

Confidential computing, powered by hardware technologies such as Intel SGX (Software Guard Extensions) and AMD SEV (Secure Encrypted Virtualization), promises strong isolation and transparent memory encryption.
Designed to protect against privileged attackers and physical threats such as bus snooping and cold boot attacks, these secure CPU enclaves are used predominantly in cloud computing environments to create protected memory regions that are encrypted and inaccessible to the rest of the system. However, security researchers from Begium’s KU Leuven University have developed a custom, low-cost DDR4 interposer that re-opens the door to supply chain attacks against even fully patched systems.
During a presentation at the Black Hat Europe conference on Wednesday, Jesse De Meulemeester and Jo Van Bulck demonstrated how this $50 piece of hardware made it possible to manipulate memory address mapping, effectively tricking the processor into granting unauthorized access to portions of encrypted memory.
Because the hack operates at runtime it circumvents recent boot-time firmware mitigations deployed by Intel and AMD in response to earlier software-based “BadRAM” memory aliasing attacks.
The latest hack — dubbed Battering RAM — enables arbitrary plaintext read/write access and extraction of SGX’s platform provisioning key. This, in turn, allowed the researchers to forge attestation reports and implant persistent backdoors on AMD SEV-protected virtual machines. Cloud infrastructures that rely on Intel’s Scalable SGX technology are also potentially vulnerable.
The researchers reported their findings to both AMD and Intel prior to unveiling their research. Both chip giants said the attack was out of scope because it involved hardware manipulation.
De Meulemeester told CSO that software and firmware modules are currently unable to detect this attack. As a result, if attackers were able to introduce a compromised memory module into the supply chain they would then be able to carry out follow-up malware-based attacks on vulnerable virtual infrastructure.
The research undercuts fundamental assumptions about encrypted memory security guarantees while raising questions about the performance and security trade-offs built into the architecture of confidential cloud computing systems.
Comprehensively resolving the problem would involve reintroducing cryptographic freshness protections integrity into the next generation of server chips, says De Meulemeester, a PhD candidate in electrical engineering who specializes in securing high-performance computing systems against emerging threats.
View the full article
reporter

Apple AirTag 2: Four New Features Found in iOS 26 Code

The AirTag 2 will include a handful of new features that will improve tracking capabilities, according to a new report from Macworld. The site says that it was able to access an internal build of iOS 26, which includes references to multiple unreleased products.


Here's what's supposedly coming:

An improved pairing process, though no details were provided. ‌AirTag‌ pairing is already fairly simple, but there's room for improvement with the naming and emoji selection.
Detailed battery level reporting.
An "Improved Moving" feature that Macworld speculates will allow users to find the precise location of an ‌AirTag‌ when it's moving. Precision Finding in the current ‌AirTag‌ can't handle movement well.
A feature for improving tracking in crowded places.

We've been hearing rumors about a new version of the ‌AirTag‌ for years now, and it's supposedly getting upgraded tracking with a new Ultra Wideband chip. The new chip will improve Precision Finding range, and it could also add these new tracking capabilities.

So far, there have been no rumors of a redesign, so the ‌AirTag‌ 2 will presumably look like the original ‌AirTag‌. It will continue to feature a replaceable battery, though it could also get upgraded speakers that are harder to remove.

The ‌AirTag‌ is apparently labeled "2025AirTag" in the ‌iOS 26‌ code, which suggests that Apple might have been planning to release it in 2025. At this point, it's not clear when it will launch, but it's looking like we might get it in early 2026.

Macworld also spotted signs of the next-generation HomePod mini with S10 chip, a smarter version of Siri, and references to the home hub device that Apple is working on. We've previously seen extensive rumors about all of these products, and rumors suggest we'll see them around the March or April timeframe.Tag: AirTags 2
This article, "Apple AirTag 2: Four New Features Found in iOS 26 Code" first appeared on MacRumors.com

Discuss this article in our forums

View the full article
reporter

iOS 26.2 Coming Soon With These 8 New Features on Your iPhone

Apple seeded the second iOS 26.2 Release Candidate to developers earlier this week, meaning the update will be released to the general public very soon.


Apple confirmed iOS 26.2 would be released in December, but it did not provide a specific date. We expect the update to be released by early next week.

iOS 26.2 includes a handful of new features and changes on the iPhone, such as a new Liquid Glass slider for the Lock Screen's clock, offline lyrics in Apple Music, and more. Below, we have highlighted eight new features in particular.

Liquid Glass Slider on Lock Screen


A new slider in the Lock Screen customization menu lets you adjust the opacity of Liquid Glass for the clock, allowing you to decide how clear or frosted it appears.

This comes after iOS 26.1 added "Clear" and "Tinted" options for Liquid Glass overall.

Offline Lyrics in Apple Music


iOS 26.2 adds offline lyric support to Apple Music, allowing you to view a song's lyrics even when you are not connected to a Wi-Fi or cellular network.

Sleep Score Revisions


iOS 26.2 and watchOS 26.2 have revised Sleep Score ranges:
Very Low: 0-40 (previously 0-29)
Low: 41-60 (previously 30-49)
OK: 61-80 (previously 50-69)
High: 81-95 (previously 70-89)
Very High: 96-100 (previously 90-100)Apple says sleep scores are calculated based on how long you slept, the consistency of when you fell asleep, and the frequency and duration of waking up during the night. The feature is available in the Health app on all iPhone models compatible with iOS 26, and in the Sleep app on all Apple Watch models compatible with watchOS 26.

Alarms for Reminders


iOS 26.2 lets you set alarms for reminders in Apple's Reminders app.

When adding a reminder, selecting a time and then toggling on the "Urgent" option will cause an alarm to go off at the designated time.

Apple Podcasts Enhancements


Apple's Podcasts app has three new features on iOS 26.2, including automatic chapters for episodes, timed links on the screen, and the ability to view other podcasts that a podcast mentions right from the audio player and the transcript.

Apple News Revamp


In the Apple News app, there is now a dedicated "Following" tab, and buttons for quick access to topics like sports, puzzles, politics, business, and food.

iPhone Screen Flash for Notifications


Starting with iOS 26.2, your iPhone's screen can flash when you receive a notification. Previously, this setting was limited to the LED camera flash on the back of the iPhone.

In the Settings app, under Accessibility → Audio & Visual → Flash for Alerts, there are now options for LED Flash, Screen, and Both. Or, you can keep the setting turned off.

AirPods Live Translation in EU


iOS 26.2 makes Live Translation on AirPods available in the EU.

Live Translation allows you to understand someone who is speaking a different language than you. For example, if you speak English, and someone is speaking to you in French, Siri can tell you what they are saying in English through your AirPods.

The feature works best when both participants in a conversation are using Live Translation on AirPods. If you are talking with someone who is not wearing AirPods, you can display a live transcription in the other person's language on your iPhone.

Live Translation is available on the AirPods Pro 3, AirPods Pro 2, and higher-end AirPods 4 with Active Noise Cancellation. The feature launched in the U.S. and select other countries with iOS 26, but it was not available in the EU until iOS 26.2, as Apple said it needed additional time to ensure compliance with the EU's Digital Markets Act.

iOS 26: Use Live Translation With AirPods
In addition to compatible AirPods, users need an iPhone 15 Pro or newer with Apple Intelligence turned on and Apple's Translate app installed.

As of iOS 26.1, Live Translation on AirPods supports the following languages:
English (U.S.)
English (U.K.)
French (France)
German (Germany)
Portuguese (Brazil)
Spanish (Spain)
Chinese — Simplified (China)
Chinese — Traditional (China)
Japanese
Korean
Italian
iOS 26 also has a built-in Live Translation feature in the Messages, Phone, and FaceTime apps, with no AirPods required.Related Roundups: iOS 26, iPadOS 26Related Forum: iOS 26
This article, "iOS 26.2 Coming Soon With These 8 New Features on Your iPhone" first appeared on MacRumors.com

Discuss this article in our forums

View the full article
reporter

What most VCs won’t tell you about raising capital

Venture capitalists Ross Fubini (XYZ Ventures) and Leslie Feinzaig (Graham & Walker Ventures) pull back the curtain on how VCs build their own go-to-market strategies — not just how they evaluate startups, but also how they win over LPs and founders alike. In this episode of Build Mode, they share hard-won lessons from raising their […]View the full article
reporter

Docker Model Runner now supports vLLM on Windows

Great news for Windows developers working with AI models: Docker Model Runner now supports vLLM on Docker Desktop for Windows with WSL2 and NVIDIA GPUs!
Until now, vLLM support in Docker Model Runner was limited to Docker Engine on Linux. With this update, Windows developers can take advantage of vLLM’s high-throughput inference capabilities directly through Docker Desktop, leveraging their NVIDIA GPUs for accelerated local AI development.
What is Docker Model Runner?
For those who haven’t tried it yet, Docker Model Runner is our new “it just works” experience for running generative AI models.
Our goal is to make running a model as simple as running a container.
Here’s what makes it great:
Simple UX: We’ve streamlined the process down to a single, intuitive command: docker model run <model-name>. Broad GPU Support: While we started with NVIDIA, we’ve recently added Vulkan support. This is a big deal—it means Model Runner works on pretty much any modern GPU, including AMD and Intel, making AI accessible to more developers than ever. vLLM: Perform high-throughput inference with an NVIDIA GPU What is vLLM?
vLLM is a high-throughput inference engine for large language models. It’s designed for efficient memory management of the KV cache and excels at handling concurrent requests with impressive performance. If you’re building AI applications that need to serve multiple requests or require high-throughput inference, vLLM is an excellent choice. Learn more here.
Prerequisites
Before getting started, make sure you have the prerequisites for GPU support:
Docker Desktop for Windows (starting with Docker Desktop 4.54) WSL2 backend enabled in Docker Desktop NVIDIA GPU with updated drivers GPU support configured in Docker Desktop Getting Started
Step 1: Enable Docker Model Runner
First, ensure Docker Model Runner is enabled in Docker Desktop. You can do this through the Docker Desktop settings or via the command line:
docker desktop enable model-runner --tcp 12434 Step 2: Install the vLLM Backend
In order to be able to use vLLM, install the vLLM runner with CUDA support:
docker model install-runner --backend vllm --gpu cuda Step 3: Verify the Installation
Check that both inference engines are running:
docker model install-runner --backend vllm --gpu cuda You should see output similar to:
Docker Model Runner is running Status: llama.cpp: running llama.cpp version: c22473b vllm: running vllm version: 0.12.0 Step 4: Run a Model with vLLM
Now you can pull and run models optimized for vLLM. Models with the -vllm suffix on Docker Hub are packaged for vLLM:
docker model run ai/smollm2-vllm "Tell me about Docker." Troubleshooting Tips
GPU Memory Issues
If you encounter an error like:
ValueError: Free memory on device (6.96/8.0 GiB) on startup is less than desired GPU memory utilization (0.9, 7.2 GiB). You can configure the GPU memory utilization for a specific mode:
docker model configure --gpu-memory-utilization 0.7 ai/smollm2-vllm This reduces the memory footprint, allowing the model to run alongside other GPU workloads.
Why This Matters
This update brings several benefits for Windows developers:
Production parity: Test with the same inference engine you’ll use in production Unified workflow: Stay within the Docker ecosystem you already know Local development: Keep your data private and reduce API costs during development How You Can Get Involved
The strength of Docker Model Runner lies in its community, and there’s always room to grow. We need your help to make this project the best it can be. To get involved, you can:
Star the repository: Show your support and help us gain visibility by starring the Docker Model Runner repo. Contribute your ideas: Have an idea for a new feature or a bug fix? Create an issue to discuss it. Or fork the repository, make your changes, and submit a pull request. We’re excited to see what ideas you have! Spread the word: Tell your friends, colleagues, and anyone else who might be interested in running AI models with Docker. We’re incredibly excited about this new chapter for Docker Model Runner, and we can’t wait to see what we can build together. Let’s get to work!
View the full article
reporter

Cybersecurity isn’t underfunded — It’s undermanaged

Much of the narrative I come across online around cybersecurity budgets revolves around convincing the Board and justifying investments.
Some approaches are built around financial models and aim at justifying return on investment. Some others focus on quantifying risk and showing risk reduction.
All are data-driven and designed around some form of rational argument.
But is this really the way decisions are made at the top of large organizations?
In fact, those approaches are all part of the bottom-up narrative CISOs, cybersecurity consultants and cybersecurity vendors have been building toward top executives over the past two decades.
In my experience, they clash with three aspects of real-life enterprise dynamics:
First of all, decision-making at the enterprise level may have the appearance of a rational endeavour, but is in fact heavily influenced by cognitive biases, as evidenced by Daniel Kahneman and his school of thought.
This is perfectly obvious with cybersecurity, and it brings me to my second point:
Anybody who has spent enough time in the security industry would have come across various situations where money that was previously denied appears in vast quantities at the first sight of a regulatory investigation, a bad audit report, an incident, a near miss or a similar event affecting a competitor (that’s the “can it happen to us?” question many CISOs will be familiar with).
No concerns around ROI or risk reduction are raised in those scenarios: Top executives want to see boxes checked and evidence that they have done their job, should a bad breach occur. If execution does not follow, someone else will be blamed (often the CISO, which has sometimes been nicknamed Chief Incident Scapegoat Officer).
More seriously, the penny has in fact dropped in many boardrooms around the “when-not-if” paradigm with cyberattacks: Following almost two decades of non-stop breaches, you would probably struggle to find one board member not aware of the business impact they can have. That’s taking me to my third point:
I have had many discussions, in particular with CIOs, openly admitting that they could put “anything they like” in their budgets for cybersecurity, but that their main problem was delivering on cyber projects.
Where does that disconnect come from, between many CISOs and their vendors pretending to struggle with resources, and top executives increasingly cyber-aware and wanting to invest to protect the firm?
The budget myth: Why cybersecurity isn’t actually underfunded
Of course, cybersecurity projects are often complex because they need to reach across corporate silos and geographies to deliver effective protection to the business. This is not natural in large firms, which are, almost by essence, territorial and political.
But beyond that, the profile of CISOs is also a key dimension:
Most are technologists by trade and background, and have spent the last decade firefighting incidents, incapable of building or delivering any kind of long-term narrative.
They have not developed the type of management experience, political finesse or personal gravitas that they would require to be truly successful, now that the spotlight is firmly on them from the top of the firm.
Many genuinely think that chronic under-investment in cybersecurity is the root cause of insufficient maturity levels, while it is in fact chronic execution failure linked to endemic business short-termism that is at the heart of the matter: Projects deprioritised as soon as “quick wins” are delivered or boxes checked on compliance reports, changes in direction as soon as a new executive joins or leaves, initiatives put on hold at the first sight of market turbulences: All point to governance and cultural aspects that are the real root causes of the long-term stagnation of cybersecurity maturity levels in large firms.
For the CISOs who have not integrated those cultural aspects and are almost always left out of those decisions, it breeds frustration; frustration breeds short tenures (in the region to two to three years for many); short tenures aggravate the management and leadership mismatch: You cannot deliver much of genuine transformative impact in large firms on those timeframes.
For top executives, the CISO “merry-go-round” also builds frustration: They have seen too many coming in with grandiose plans asking for millions before resigning after a few years, leaving everything half done.
The first 100 days: Where trust is won or lost
Quite a lot of that disconnect is effectively built up in the first 100 days of the CISO.
Many CISOs come into a new job with pre-conceived views, sometimes created at interview time: Things that have worked elsewhere, pet subjects, vendors or consultants.
Many also feel that they have to prove themselves as specialists in their first 100 days. That’s a mistake. Competence is assumed in the first 100 days (you’ve just been hired). The challenges lie elsewhere.
The first 100 days are about proving your ability to fit in the organisational structure of the firm and act as a leader.
That starts by listening, in my view: Listening to stakeholders and sponsors, understanding their expectations, their pain points, what has worked in the past, what hasn’t and why, what happened with your predecessor… Sometimes “what can I do to help you?” is simply the best question to ask…
This process should initiate a journey of co-construction of the cybersecurity narrative, and beyond that, of the firm’s cybersecurity strategy.
If objectives are shared with stakeholders and sponsors, friction is reduced; over time, business champions emerge who relay the cybersecurity narrative, not because it’s the CISO’s but because it’s theirs.
The process should also embed the CISO in the governance and leadership dynamics of the firm.
By listening truly, identifying and following the cultural currents across the firm, the allegiances, the informal networks of trust where real decision-making happens, the CISO becomes a trusted player for business leaders.
At that point, budgetary discussions become two-way discussions between trusted partners, not adversarial situations where one party has to win over the other.
Conversely, CISOs who approach their first 100 days looking to prove themselves tactically run the risk of ending up trapped in operational firefighting: This is a situation from which very few escape. They may be seen as a safe pair of hands in the end, but that’s unlikely to get them accepted at the strategy table.
This is the type of situation where a CSO role becomes a necessity, as I advocated in “Is the CISO role broken,” to orchestrate business protection at the corporate level and ensure all regulatory obligations are met.
But it is not a fatality.
Ultimately, the future of cybersecurity leadership will belong to those CISOs who recognize that building influence and trust has to precede action and investment.
Boards no longer need to be convinced that cyber risk matters — they need confident, culturally attuned leaders who can navigate complex corporate dynamics, build trust with all stakeholders and orchestrate delivery across silos.
The first 100 days set the tone: Not through technical demonstrations or budgetary battles, but through listening, aligning and co-creating a narrative that business leaders feel ownership over.
In doing so, CISOs move from pleading for resources to shaping strategy as true executives — not firefighters on the sidelines, but architects of resilience at the heart of the enterprise.
This article is published as part of the Foundry Expert Contributor Network.
Want to join?
View the full article
reporter

New Shazam Feature Will Reveal the Most Popular Moment of a Song

Shazam today announced it is rolling out a new Popular Segments feature that reveals exactly which part of a song is most popular with listeners.


For example, the image above shows that the given song was most discovered around 30 to 35 seconds into the track during the preceding week. This was the moment in the song when the most people asked Shazam to identify the song.

More details about the feature:Shazam says Popular Segments will provide both listeners and artists with helpful insights into what makes songs resonate.

The feature will begin rolling out today on the Shazam.com website across desktop and mobile platforms, according to Apple. The announcement did not indicate if the feature will be coming to the Shazam app on the iPhone and iPad.

Shazam is a popular music identification service that Apple acquired back in 2018, and it has Apple Music integration. In addition to being available on the web and as an app, Shazam powers a Recognize Music control in Control Center on the iPhone, iPad, and Mac. You can also use Shazam via Siri voice commands.

Last month, the Shazam app for iPhone was updated with a Liquid Glass design.Tag: Shazam
This article, "New Shazam Feature Will Reveal the Most Popular Moment of a Song" first appeared on MacRumors.com

Discuss this article in our forums

View the full article
reporter

AirPods Pro 3 Drop to New $199 Low Price on Amazon [Updated]

Apple's AirPods Pro 3 have hit a new record low price of $199.00 today on Amazon, down from $249.00. This deal beats the Black Friday price we saw last month by about $20.

Note: MacRumors is an affiliate partner with some of these vendors. When you click a link and make a purchase, we may receive a small payment, which helps us keep the site running.

The ‌AirPods Pro 3‌ have 2x better Active Noise Cancellation than the prior-generation AirPods Pro 2, better audio quality, a revised fit that's meant to improve comfort and stability, Live Translation for in-person conversations, and heart rate sensing for workouts.

$50 OFFAirPods Pro 3 for $199.00

If you're on the hunt for more discounts, be sure to visit our Apple Deals roundup where we recap the best Apple-related bargains of the past week.

Update: This deal has been fluctuating today, sometimes disappearing and reappearing in the span of a few minutes. If you don't see it when you visit Amazon, it may be worth trying again later in the day.



Deals Newsletter

Interested in hearing more about the best deals you can find this holiday season? Sign up for our Deals Newsletter and we'll keep you updated so you don't miss the biggest deals of the season!




Related Roundup: Apple Deals
This article, "AirPods Pro 3 Drop to New $199 Low Price on Amazon [Updated]" first appeared on MacRumors.com

Discuss this article in our forums

View the full article
reporter

Powerbeats Pro 2 Available for $199.95 Low Price, Plus More Beats Deals on Headphones and Cases

Amazon this week is discounting a collection of Beats headphones and speakers, including a low price on the Powerbeats Pro 2. You can get this new 2025 model for $199.95 in four colors, down from $249.99. This deal on the Powerbeats Pro 2 is being matched at Best Buy, along with a few other Beats deals.

Note: MacRumors is an affiliate partner with some of these vendors. When you click a link and make a purchase, we may receive a small payment, which helps us keep the site running.

This sale also includes discounts on products like the Beats Pill, which has hit $109.99 on Amazon, down from $149.95. This is a second-best price on the speaker.

UP TO 50% OFFBeats Deals on Amazon

Additionally, Amazon has the Beats Studio Buds+ for $149.95, down from $169.95. These have up to 9 hours of playback (up to 36 hours with charging case), USB-C, active noise cancellation, transparency mode, and an IPX4 rating for sweat and water resistance.

You'll also find a few steep discounts on over-ear headphones, like the Beats Studio Pro at $179.95, down from $349.99, and some markdowns on Beats iPhone 17 cases.

Beats Studio Buds+ - $149.95, down from $169.95
Beats Pill - $109.99, down from $149.95
Beats Solo 4 - $149.95, down from $199.95
Beats Studio Pro - $179.95, down from $349.99
Powerbeats Pro 2 - $199.95, down from $249.99
Beats USB-A to USB-C Woven Cable - $9.89, down from $18.99
Beats iPhone 17 Case - $18.80 with on-page coupon, down from $45.00
Beats iPhone 17 Pro Case - $22.45, down from $45.00
Beats iPhone 17 Pro Max Case - $28.17, down from $45.00

If you're on the hunt for more discounts, be sure to visit our Apple Deals roundup where we recap the best Apple-related bargains of the past week.



Deals Newsletter

Interested in hearing more about the best deals you can find this holiday season? Sign up for our Deals Newsletter and we'll keep you updated so you don't miss the biggest deals of the season!




Related Roundup: Apple Deals
This article, "Powerbeats Pro 2 Available for $199.95 Low Price, Plus More Beats Deals on Headphones and Cases" first appeared on MacRumors.com

Discuss this article in our forums

View the full article
reporter

Samsung's Holiday Sale Has Low Prices on The Frame TV, Portable SSDs, Monitors, and More

Samsung is hosting a new holiday event this week, and you can find great deals on monitors, storage accessories, TVs, Galaxy smartphones, and home appliances. Many of these deals are the exact same all-time low prices we tracked during Black Friday and Cyber Monday.

Note: MacRumors is an affiliate partner with Samsung. When you click a link and make a purchase, we may receive a small payment, which helps us keep the site running.

A new highlight of this event is Samsung's 4TB Portable SSD T7 Shield for $349.99 ($115 off). Samsung is also discounting the 2TB model to $229.99 ($20 off), and both are great portable storage options for Mac computers, with an IP65 rating for dust and water resistance and read/write speeds of up to 1,050/1,000 MB/s.

SITEWIDE DISCOUNTSSamsung Holiday Sale

Regarding TVs, there are quite a few models of The Frame TV on sale, including a new all-time low price on The Frame Pro models. You can get the 65-inch The Frame TV for $1,299.99 ($700 off), as well as The Frame Pro for $1,999.00 ($1,200 off).

Samsung's new Galaxy XR headset also has a few notable offers during this event, including up to $1,140 in savings with the Explorer Pack. This features various content at no extra cost with the purchase of the Galaxy XR, like one year of YouTube Premium, one year of Google AI Pro, and more.

For even more potential savings, eligible shoppers have the chance to get additional discounts through Samsung offer programs. These programs provide extra discounts for students, military, and employees of select businesses, and they provide up to 30 percent extra savings on Samsung's website, so be sure to check whether you're eligible for any of these programs.

TVs

55-inch Neo QLED TV - $649.99, down from $1,299.99
75-inch Vision AI Smart TV - $679.99, down from $1,199.99
65-inch The Frame - $1,299.99, down from $1,999.99 (extra $100 off available through offer programs)
75-inch The Frame Pro - $1,999.99, down from $3,199.99
85-inch The Frame Pro - $3,299.99, down from $4,299.99 (extra $660 off available through offer programs)
65-inch OLED S90C TV - $1,699.99, down from $2,699.99
65-inch Neo QLED 4K TV - $1,799.99, down from $2,699.99
77-inch OLED S90F TV - $1,999.99, down from $3,499.99
75-inch Neo QLED QN90D TV - $1,499.99, down from $3,299.99
Storage

2TB Portable SSD T9 - $199.99, down from $239.99
4TB Portable SSD T9 - $329.99, down from $439.99
4TB Portable SSD T7 Shield - $349.99, down from $464.99
8TB Portable SSD T5 EVO - $629.99, down from $689.99
Monitors

32-inch Smart Monitor M8 - $389.99, down from $699.99
40-inch Odyssey G7 G75F Curved Monitor - $749.99, down from $1,199.99
49-inch Odyssey G9 Gaming Monitor - $777.99, down from $1,299.99
49-inch Odyssey OLED G9 Monitor - $899.99, down from $1,799.99
Appliances

Bespoke Smart Dishwasher - $899.99, down from $1,299.00
Large Capacity Side-by-Side Fridge - $999.00, down from $1,666.00
4-Door French Door Fridge - $1,799.00, down from $2,999.00
Bespoke All-in-One Combo Washer/Dryer - $2,099.00, down from $3,299.00
Mega Capacity 3-Door French Door Fridge - $2,499.00, down from $3,499.00
Bespoke 4-Door Flex Fridge - $2,050.00, down from $4,099.00
Bespoke 4-Door Flex Fridge - $3,399.99, down from $4,999.00
Galaxy Products

Galaxy XR - Save up to $1,140 with the Explorer Pack
Galaxy S25 Ultra - Save up to $700 in instant trade-in credit
Galaxy Ring - Get up to $150 trade-in credit
Galaxy Watch Ultra - Save up to $250
Galaxy Watch 8 - Save up to $200

If you're on the hunt for more discounts, be sure to visit our Apple Deals roundup where we recap the best Apple-related bargains of the past week.



Deals Newsletter

Interested in hearing more about the best deals you can find this holiday season? Sign up for our Deals Newsletter and we'll keep you updated so you don't miss the biggest deals of the season!




Related Roundup: Apple Deals
This article, "Samsung's Holiday Sale Has Low Prices on The Frame TV, Portable SSDs, Monitors, and More" first appeared on MacRumors.com

Discuss this article in our forums

View the full article
reporter

New Apple Store Opening in Massachusetts Tomorrow

Apple is opening a new store tomorrow at The Shops at Blackstone Valley, an open-air shopping center in Millbury, Massachusetts, near Worcester.


The store is set to open this Friday, December 12, at 12 p.m. local time. Apple is located next to fashion retailer Coach at the shopping center.

The new store is a replacement for Apple's previous location at Solomon Pond Mall, in nearby Marlborough, Massachusetts. That location permanently closed on Wednesday, after more than 10 years of operations. When it relocates a store, Apple typically gives all employees the opportunity to transfer to the new location.

Apple has yet to reveal the new store, but the photo below from local resident Steve Stearns provides a sneak peek at the facade.

Image Credit: Steve Stearns
Apple's newer stores typically feature a dedicated counter for customers to pick up orders they placed online, and the Genius Bar has become a prominent element again in recent years. There will also be free "Today at Apple" creative sessions.Tag: Apple Store
This article, "New Apple Store Opening in Massachusetts Tomorrow" first appeared on MacRumors.com

Discuss this article in our forums

View the full article
reporter

Breaking Free From AI Vendor Lock-in: Integrating GitHub Models with Docker cagent

The landscape of AI development is rapidly evolving, and one of the most exciting developments in 2025 from Docker is the release of Docker cagent. cagent is Docker’s open-source multi-agent runtime that orchestrates AI agents through declarative YAML configuration. Rather than managing Python environments, SDK versions, and orchestration logic, developers define agent behavior in a single configuration file and execute it with “cagent run”.

In this article, we’ll explore how cagent’s integration with GitHub Models delivers true vendor independence, demonstrate building a real-world podcast generation agent that leverages multiple specialized sub-agents, and show you how to package and distribute your AI agents through Docker Hub. By the end, you’ll understand how to break free from vendor lock-in and build AI agent systems that remain flexible, cost-effective, and production-ready throughout their entire lifecycle.
What is Docker cagent?
cagent is Docker’s open-source multi-agent runtime that orchestrates AI agents through declarative YAML configuration. Rather than managing Python environments, SDK versions, and orchestration logic, developers define agent behavior in a single configuration file and execute it with “cagent run”. 
Some of the key features of Docker cagents:

Declarative YAML Configuration: single-file agent definitions with model configuration, clear instructions, tool access, and delegation rules to interact and coordinate with sub-agents Multi-Provider Support: OpenAI, Anthropic, Google Gemini, and Docker Model Runner (DMR) for local inference.  MCP Integration support: Leverage MCP (Stdio, HTTP, SSE) for connecting external tools and services Secured Registry Distribution: Package and share agents securely via Docker Hub using standard container registry infrastructure. Built-In Reasoning Tools: “think’, “todo” and “memory” capabilities for complex problem solving workflows.
The core value proposition is simple: declare what your agent should do, and cagent handles your execution. Each agent operates with isolated context, specialized tools via the Model Context Protocol (MCP), and configurable models. Agents can delegate tasks to sub-agents, creating hierarchical teams that mirror human organizational structures.
What are GitHub Models?
GitHub Models is a suite of developer tools that take you from AI idea to deployment, including a model catalog, prompt management, and quantitative evaluations.GitHub Models provides rate-limited free access to production-grade language models from OpenAI (GPT-4o, GPT-5, o1-preview), Meta (Llama 3.1, Llama 3.2), Microsoft (Phi-3.5), and DeepSeek models.The advantage with GitHub Models are you need to Authenticate only once via GitHub Personal Access Tokens and you can plug and play any models of your choice supported by GitHub Models.

You can browse to GitHub Marketplace at https://github.com/marketplace to see the list of all models supported. Currently GitHub supports all the popular models and the list continues to grow. Recently, Anthropic Claude models were also added.
Figure 1.1: GitHub Marketplace displaying list of all models available on the platform

GitHub has designed its platform, including GitHub Models and GitHub Copilot agents, to support production-level agentic AI workflows, offering the necessary infrastructure, governance, and integration points.GitHub Models employs a number of content filters. These filters cannot be turned off as part of the GitHub Models experience. If you decide to employ models through Azure AI  or a paid service, please configure your content filters to meet your requirements.
To get started with GitHub Models, visit https://docs.github.com/en/github-models/quickstart which contains detailed quick start guides. 
Configuring cagent with GitHub Models
GitHub Models OpenAI-compatible API allows straightforward integration with cagent by treating it as a custom OpenAI provider with modified base URL and authentication.
In this article, we will create and deploy a PodCast Generator agent using Github models and show you how easy it is to deploy and share AI agents by deploying it to Docker Hub registry. It is necessary to create a fine-grained personal access token by navigating to this url: https://github.com/settings/personal-access-tokens/new  
Figure 1.2: Generating a new personal access token (PAT) from GitHub developer settings.
Prerequisites
Docker Desktop 4.49+ with MCP Toolkit enabled​ GitHub Personal Access Token with models scope​ Download cagent binary from https://github.com/docker/cagent repository. Place it inside the folder C:\Dockercagent. Run .\cagent-exe –help to see more options. Define your agent
I will showcase a simple podcast generator agent, which I created months ago during my testing of Docker cagent. This Agent’s purpose is to generate podcasts by sharing blogs/articles/youtube videos.

Below Podcastgenerator yaml file describes a sophisticated multi-agent workflow for automated podcast production, leveraging GitHub Models and MCP tools (DuckDuckGo) for external data access. The DuckDuckGo MCP server runs in an isolated Docker container managed by the MCP gateway. To learn more about docker MCP server and MCP Gateway refer to official product documentation at https://docs.docker.com/ai/mcp-catalog-and-toolkit/mcp-gateway/. 
The root agent uses sub_agents: [“researcher”, “scriptwriter”] to create a hierarchical structure where specialized agents handle domain-specific tasks. 
sunnynagavo55_podcastgenerator.yaml
#!/usr/bin/env cagent run agents: root: description: "Podcast Director - Orchestrates the entire podcast creation workflow and generates text file" instruction: | You are the Podcast Director responsible for coordinating the entire podcast creation process. Your workflow: 1. Analyze input requirements (topic, length, style, target audience) 2. Delegate research to the research agent which can open duck duck go browser for researching 3. Pass the researched information to the scriptwriter for script creation 4. Output is generated as a text file which can be saved to file or printed out 5. Ensure quality control throughout the process Always maintain a professional, engaging tone and ensure the final podcast meets broadcast standards. model: github-model toolsets: - type: mcp command: docker args: ["mcp", "gateway", "run", "--servers=duckduckgo"] sub_agents: ["researcher", "scriptwriter"] researcher: model: github-model description: "Podcast Researcher - Gathers comprehensive information for podcast content" instruction: | You are an expert podcast researcher who gathers comprehensive, accurate, and engaging information. Your responsibilities: - Research the given topic thoroughly using web search - Find current news, trends, and expert opinions - Gather supporting statistics, quotes, and examples - Identify interesting angles and story hooks - Create detailed research briefs with sources - Fact-check information for accuracy Always provide well-sourced, current, and engaging research that will make for compelling podcast content. toolsets: - type: mcp command: docker args: ["mcp", "gateway", "run", "--servers=duckduckgo"] scriptwriter: model: github-model description: "Podcast Scriptwriter - Creates engaging, professional podcast scripts" instruction: | You are a professional podcast scriptwriter who creates compelling, conversational content. Your expertise: - Transform research into engaging conversational scripts - Create natural dialogue and smooth transitions - Add hooks, sound bite moments, and calls-to-action - Structure content with clear intro, body, and outro - Include timing cues and production notes - Adapt tone for target audience and podcast style - Create multiple format options (interview, solo, panel discussion) Write scripts that sound natural when spoken and keep listeners engaged throughout. toolsets: - type: mcp command: docker args: ["mcp", "gateway", "run", "--servers=filesystem"] models: github-model: provider: openai model: openai/gpt-5 base_url: https://models.github.ai/inference env: OPENAI_API_KEY: ${GITHUB_TOKEN} Note: Since we are using DuckDuckGo MCP server, make sure to add and install this MCP server from MCP catalog on your docker desktop
Running your Agent on Local Machine
Make sure to update your GitHub PAT token and Run the below command to run your agent from the root folder where your cagent binaries reside.
cagent run ./sunnynagavo55_podcastgenerator.yaml Pushing your Agent as Docker Image
Run the below command to push your agent as a docker image to your favorite registry to share it with your team.
cagent push Sunnynagavo55/Podcastgenerator You can see your published images inside your repositories as shown below. 

Congratulations! Now we have our first AI Agent created using cagent and deployed to Docker Hub.
Pulling your Agent as Docker Image on a different machine
Run the below command to pull your docker image agent, created by your teammate, which gets the agent yaml file and saves it in the current directory.
cagent pull Sunnynagavo55/Podcastgenerator Alternatively, you can run the same agent directly without pulling the image by using the below command.
cagent run Sunnynagavo55/Podcastgenerator Note: Above Podcastgenerator example agent has been added to Docker/cagent GitHub repository under examples folder. Give it a try and share your experience. https://github.com/docker/cagent/blob/main/examples/podcastgenerator_githubmodel.yaml
Conclusion
The traditional AI development workflow locks you into specific providers, requiring separate API keys, managing multiple billing accounts, and navigating vendor-specific SDKs. cagent with GitHub Models fundamentally changes this equation by combining Docker’s declarative agent framework with GitHub’s unified model marketplace. This integration grants you true vendor independence—a single GitHub Personal Access Token provides access to models from OpenAI, Meta, Microsoft, Anthropic, and DeepSeek, eliminating the friction of managing multiple credentials and authentication schemes.
The future of AI development isn’t about choosing a vendor and committing to their ecosystem. Instead, it’s about building systems flexible enough to adapt as the landscape evolves, new models emerge, and your business requirements change. cagent and GitHub Models make that architectural freedom possible today.
What are you waiting for? Start building now with the power of cagent and GitHub Models and share your story with us.
Resources
To learn more about docker cagent, read the product documentation from https://docs.docker.com/ai/cagent/
For more information about cagent, see the GitHub repository. Give this repository a star and let us know what you build.

View the full article
reporter

ThreatsDay Bulletin: Spyware Alerts, Mirai Strikes, Docker Leaks, ValleyRAT Rootkit — and 20 More Stories

This week’s cyber stories show how fast the online world can turn risky. Hackers are sneaking malware into movie downloads, browser add-ons, and even software updates people trust. Tech giants and governments are racing to plug new holes while arguing over privacy and control. And researchers keep uncovering just how much of our digital life is still wide open. The new Threatsday BulletinView the full article
Hacker News

ThreatsDay Bulletin: Spyware Alerts, Mirai Strikes, Docker Leaks, ValleyRAT Rootkit — and 20 More Stories

This week’s cyber stories show how fast the online world can turn risky. Hackers are sneaking malware into movie downloads, browser add-ons, and even software updates people trust. Tech giants and governments are racing to plug new holes while arguing over privacy and control. And researchers keep uncovering just how much of our digital life is still wide open. The new Threatsday BulletinView the full article
reporter

Google Rolls Out Gemini AI for Chrome on iPhone and iPad

Google is rolling out Gemini integration for its Chrome browser on iPhone and iPad, a move that brings AI feature parity with its web and desktop versions.


The company teased built-in Gemini in Chrome for iOS in September, and the feature is now rolling out gradually across the United States. For Gemini to work in Chrome, you'll need version 143. When you've updated, make sure you're signed into your account, the browser language is set to English, and the app isn't in Incognito mode.

If all the above conditions are met, the Google Lens logo on the left-hand side of the address bar will change to a Gemini icon. Tapping the icon shows options for two "Page tools" that let Gemini search your screen or for you to ask the chatbot a question.

The Gemini interface also includes shortcuts to do things like summarize the current webpage or create a FAQ about a topic. Other sample queries include asking Gemini to reframe complex topics in alternative ways, quiz you on material you're learning, adapt recipes to specific dietary requirements, or contrast options and offer tailored recommendations based on your preferences. Gemini's responses to queries appear in an overlay that floats on top of the webpage.

Chrome 143 for iOS also adds biometric checkout support, new Chrome tips on the New Tab Page, and general stability improvements.

(Via 9to5Google.)Tags: Chrome, Gemini
This article, "Google Rolls Out Gemini AI for Chrome on iPhone and iPad" first appeared on MacRumors.com

Discuss this article in our forums

View the full article
reporter

Porsche Bringing Apple Digital Key Support to 2026 Cayenne and Macan

Porsche is preparing to bring full support for Apple's Digital Key to its new all-electric Cayenne and Macan models.


The feature enables unlocking, locking, and starting the vehicle using an iPhone or Apple Watch via NFC, Bluetooth Low Energy, and Ultra Wideband. Digital Keys stored in Apple Wallet will continue to function even when an ‌iPhone‌ has run out of charge. Owners will be able to share access with up to seven additional users.

Porsche was highlighted as an upcoming partner when Apple outlined next-generation Car Key support at WWDC. Porsche Digital Key support will be available on 2026 model year versions of the electric Cayenne and Macan as part of the Comfort Access option.

MacRumors today discovered that Apple has now enabled the required infrastructure on its backend, meaning that Porsche simply needs to roll the feature out, suggesting that this will take place relatively soon. Earlier this week, Samsung announced that its Samsung Wallet service now supports Porsche Digital Key access for select models beginning with the 2026 Macan, using similar standards.Tags: iPhone Car Keys, LaCie Porsche Design
This article, "Porsche Bringing Apple Digital Key Support to 2026 Cayenne and Macan" first appeared on MacRumors.com

Discuss this article in our forums

View the full article
reporter

NANOREMOTE Malware Uses Google Drive API for Hidden Control on Windows Systems

Cybersecurity researchers have disclosed details of a new fully-featured Windows backdoor called NANOREMOTE that uses the Google Drive API for command-and-control (C2) purposes. According to a report from Elastic Security Labs, the malware shares code similarities with another implant codenamed FINALDRAFT (aka Squidoor) that employs Microsoft Graph API for C2. FINALDRAFT is attributed to aView the full article
Hacker News

NANOREMOTE Malware Uses Google Drive API for Hidden Control on Windows Systems

Cybersecurity researchers have disclosed details of a new fully-featured Windows backdoor called NANOREMOTE that uses the Google Drive API for command-and-control (C2) purposes. According to a report from Elastic Security Labs, the malware shares code similarities with another implant codenamed FINALDRAFT (aka Squidoor) that employs Microsoft Graph API for C2. FINALDRAFT is attributed to aView the full article
reporter

Ivantis EPM-Systeme anfällig für Angriffe

ImageFlow – shutterstock.com
Ivanti hat kürzlich einen schwerwiegenden Fehler in seinen EMP-Systemen gemeldet, der Admin-Sitzungen ohne Authentifizierung erlaubt. Angreifer könnten dadurch möglicherweise Tausende von Unternehmensgeräten kontrollieren.
Der Software-Anbieter veröffentlichte die EPM-Version 2024 SU4 SR1, um mehrere Schwachstellen zu beheben. Dazu gehört die kritische Schwachstelle mit der Kennung CVE-2025-10573, die einen CVSS-Score von 9,6 aufweist.
Weitere Lücken
Das Update behebt auch zwei weitere Lücken (CVE-2025-13659 und CVE-2025-13662), über die Angreifer beliebigen Code ausführen können. Zudem wird eine Schwachstelle gefixt, die unbefugtes Schreiben von Dateien auf dem Server ermöglicht.
Zum Zeitpunkt der Offenlegung seien keine Kunden-Systeme ausgenutzt worden, betont Ivanti in seinem Security Advisory.
Schon früher waren EPM-Systeme Ziel von Angriffen. Die US-Sicherheitsbehörde CISA hat im März drei EPM-Lücken (CVE-2024-13159, CVE-2024-13160 und CVE-2024-13161) in ihren Katalog bekannter ausgenutzter Schwachstellen aufgenommen, nachdem sie eine aktive Ausnutzung bestätigt hatte. Im Oktober meldete die Behörde eine weitere ausgenutzte EPM-Sicherheitslücke (CVE-2024-29824).
Die wiederholten Angriffe zeigen, wie wertvoll EPM für Cyberkriminelle ist. Sie erhalten dadurch einen dauerhaften Netzwerkzugang und laterale Bewegungsmöglichkeiten. Sobald Angreifer die Infrastruktur für das Management von Endgeräten kompromittiert haben, können sie sich schnell im gesamten Unternehmen ausbreiten.
Nicht authentifizierter Angriffsvektor
Bei dem aktuellen Sicherheitsproblem der EPM-Systeme von Ivanti handelt es sich um eine Cross-Site-Scripting-Sicherheitslücke (XSS). Ursprünglich wurde sie von Ryan Emmons, Sicherheitsforscher bei Rapid7, entdeckt und im August an Ivanti gemeldet.
Laut dem ebenfalls kürzlich veröffentlichten Bericht zur Offenlegung von Rapid7 können Angreifer ohne Authentifizierung bösartige Gerätescandaten an die eingehende Daten-API von EPM übermitteln. Die bösartigen Daten werden verarbeitet und in das EPM-Web-Dashboard eingebettet. Dort können sie ausgeführt werden, wenn Administratoren die betroffenen Seiten aufrufen.
„Ein Angreifer mit nicht authentifiziertem Zugriff auf den primären EPM-Webdienst kann gefälschte verwaltete Endpunkte mit dem EPM-Server verbinden, um das Administrator-Web-Dashboard mit bösartigem JavaScript zu infizieren“, erklärt Emmons.
Sobald das bösartige JavaScript ausgeführt wird, erlangen Angreifer die Kontrolle über die Admin-Sitzung mit vollen Berechtigungen, um Endpunkte fernzusteuern und Software auf Geräten zu installieren.
Vor diesem Hintergrund warnte Nick Tausek, Security-Spezialisit bei Swimlane: „Die Ausnutzung dieser Schwachstelle würde Angreifern Zugriff auf viele verwaltete Geräte gleichzeitig gewähren und es ihnen ermöglichen, Schadcode auszuführen, Ransomware zu deployen oder sensible Daten zu exfiltrieren.“
Die Herausforderung beim Patchen
Trotz der Dringlichkeit solcher Bedrohungen fällt es Unternehmen häufig schwer, kritische Schwachstellen schnell zu beheben: Eine Untersuchung von Swimlane ergab, dass 68 Prozent der Unternehmen kritische Schwachstellen länger als 24 Stunden ungepatcht lassen. Zudem verfügen 55 Prozent über kein umfassendes System zur Priorisierung von Schwachstellen.
Die Verzögerung ist besonders riskant für Endpunkt-Management-Systeme, die mit erhöhten Berechtigungen laufen und Tausende von Geräten steuern. Eine erfolgreiche Ausnutzung könnte Sicherheitskontrollen umgehen und es Angreifern ermöglichen, Malware auf verwaltete Endpunkte zu übertragen, Sicherheitskonfigurationen zu ändern oder dauerhafte Hintertüren im gesamten Unternehmen einzurichten.
„Das Potenzial für eine ernsthafte Angriffskampagne sollte nicht übersehen werden“, mahnte Tausek.
Anleitung zum Patchen
Der Patch ist über das Ivanti License System verfügbar und gilt für EPM-Versionen 2024 SU4 und früher. Unternehmen, die die 2022-Version verwenden, sollten beachten, dass diese im Oktober 2025 ausgelaufen ist keine Sicherheits-Updates mehr erhält, fügte Ivanti hinzu.
Sicherheitsteams sollten die Aktualisierung von EPM-Instanzen auf die Version 2024 SU4 SR1 unverzüglich priorisieren, insbesondere bei Installationen, auf die von nicht vertrauenswürdigen Netzwerken aus zugegriffen werden kann. Der Patch sollte innerhalb von 24 Stunden installiert werden.
Für Unternehmen, die den Patch nicht sofort installieren können, empfiehlt Ivanti, sicherzustellen, dass die Verwaltungsschnittstellen von EPM nicht dem öffentlichen Internet ausgesetzt sind, und eine strenge Netzwerksegmentierung zu implementieren.
Swimlane-Mann Tausek rät außerdem, Administratoren darin zu schulen, Social-Engineering-Angriffe zu erkennen, da die kritische XSS-Sicherheitslücke nur durch das Aufrufen einer manipulierten Dashboard-Seite ausgelöst werden kann.
„Da EPMs oft mit hohen Berechtigungen ausgeführt werden, besteht bei jedem Missbrauch die Gefahr, dass Sicherheitskontrollen umgangen werden und die Auswirkungen einer Sicherheitsverletzung schnell eskalieren“, fügte er hinzu. (jm)

 
View the full article
reporter

Ivantis EPM-Systeme anfällig für Angriffe

ImageFlow – shutterstock.com
Ivanti hat kürzlich einen schwerwiegenden Fehler in seinen EMP-Systemen gemeldet, der Admin-Sitzungen ohne Authentifizierung erlaubt. Angreifer könnten dadurch möglicherweise Tausende von Unternehmensgeräten kontrollieren.
Der Software-Anbieter veröffentlichte die EPM-Version 2024 SU4 SR1, um mehrere Schwachstellen zu beheben. Dazu gehört die kritische Schwachstelle mit der Kennung CVE-2025-10573, die einen CVSS-Score von 9,6 aufweist.
Weitere Lücken
Das Update behebt auch zwei weitere Lücken (CVE-2025-13659 und CVE-2025-13662), über die Angreifer beliebigen Code ausführen können. Zudem wird eine Schwachstelle gefixt, die unbefugtes Schreiben von Dateien auf dem Server ermöglicht.
Zum Zeitpunkt der Offenlegung seien keine Kunden-Systeme ausgenutzt worden, betont Ivanti in seinem Security Advisory.
Schon früher waren EPM-Systeme Ziel von Angriffen. Die US-Sicherheitsbehörde CISA hat im März drei EPM-Lücken (CVE-2024-13159, CVE-2024-13160 und CVE-2024-13161) in ihren Katalog bekannter ausgenutzter Schwachstellen aufgenommen, nachdem sie eine aktive Ausnutzung bestätigt hatte. Im Oktober meldete die Behörde eine weitere ausgenutzte EPM-Sicherheitslücke (CVE-2024-29824).
Die wiederholten Angriffe zeigen, wie wertvoll EPM für Cyberkriminelle ist. Sie erhalten dadurch einen dauerhaften Netzwerkzugang und laterale Bewegungsmöglichkeiten. Sobald Angreifer die Infrastruktur für das Management von Endgeräten kompromittiert haben, können sie sich schnell im gesamten Unternehmen ausbreiten.
Nicht authentifizierter Angriffsvektor
Bei dem aktuellen Sicherheitsproblem der EPM-Systeme von Ivanti handelt es sich um eine Cross-Site-Scripting-Sicherheitslücke (XSS). Ursprünglich wurde sie von Ryan Emmons, Sicherheitsforscher bei Rapid7, entdeckt und im August an Ivanti gemeldet.
Laut dem ebenfalls kürzlich veröffentlichten Bericht zur Offenlegung von Rapid7 können Angreifer ohne Authentifizierung bösartige Gerätescandaten an die eingehende Daten-API von EPM übermitteln. Die bösartigen Daten werden verarbeitet und in das EPM-Web-Dashboard eingebettet. Dort können sie ausgeführt werden, wenn Administratoren die betroffenen Seiten aufrufen.
„Ein Angreifer mit nicht authentifiziertem Zugriff auf den primären EPM-Webdienst kann gefälschte verwaltete Endpunkte mit dem EPM-Server verbinden, um das Administrator-Web-Dashboard mit bösartigem JavaScript zu infizieren“, erklärt Emmons.
Sobald das bösartige JavaScript ausgeführt wird, erlangen Angreifer die Kontrolle über die Admin-Sitzung mit vollen Berechtigungen, um Endpunkte fernzusteuern und Software auf Geräten zu installieren.
Vor diesem Hintergrund warnte Nick Tausek, Security-Spezialisit bei Swimlane: „Die Ausnutzung dieser Schwachstelle würde Angreifern Zugriff auf viele verwaltete Geräte gleichzeitig gewähren und es ihnen ermöglichen, Schadcode auszuführen, Ransomware zu deployen oder sensible Daten zu exfiltrieren.“
Die Herausforderung beim Patchen
Trotz der Dringlichkeit solcher Bedrohungen fällt es Unternehmen häufig schwer, kritische Schwachstellen schnell zu beheben: Eine Untersuchung von Swimlane ergab, dass 68 Prozent der Unternehmen kritische Schwachstellen länger als 24 Stunden ungepatcht lassen. Zudem verfügen 55 Prozent über kein umfassendes System zur Priorisierung von Schwachstellen.
Die Verzögerung ist besonders riskant für Endpunkt-Management-Systeme, die mit erhöhten Berechtigungen laufen und Tausende von Geräten steuern. Eine erfolgreiche Ausnutzung könnte Sicherheitskontrollen umgehen und es Angreifern ermöglichen, Malware auf verwaltete Endpunkte zu übertragen, Sicherheitskonfigurationen zu ändern oder dauerhafte Hintertüren im gesamten Unternehmen einzurichten.
„Das Potenzial für eine ernsthafte Angriffskampagne sollte nicht übersehen werden“, mahnte Tausek.
Anleitung zum Patchen
Der Patch ist über das Ivanti License System verfügbar und gilt für EPM-Versionen 2024 SU4 und früher. Unternehmen, die die 2022-Version verwenden, sollten beachten, dass diese im Oktober 2025 ausgelaufen ist keine Sicherheits-Updates mehr erhält, fügte Ivanti hinzu.
Sicherheitsteams sollten die Aktualisierung von EPM-Instanzen auf die Version 2024 SU4 SR1 unverzüglich priorisieren, insbesondere bei Installationen, auf die von nicht vertrauenswürdigen Netzwerken aus zugegriffen werden kann. Der Patch sollte innerhalb von 24 Stunden installiert werden.
Für Unternehmen, die den Patch nicht sofort installieren können, empfiehlt Ivanti, sicherzustellen, dass die Verwaltungsschnittstellen von EPM nicht dem öffentlichen Internet ausgesetzt sind, und eine strenge Netzwerksegmentierung zu implementieren.
Swimlane-Mann Tausek rät außerdem, Administratoren darin zu schulen, Social-Engineering-Angriffe zu erkennen, da die kritische XSS-Sicherheitslücke nur durch das Aufrufen einer manipulierten Dashboard-Seite ausgelöst werden kann.
„Da EPMs oft mit hohen Berechtigungen ausgeführt werden, besteht bei jedem Missbrauch die Gefahr, dass Sicherheitskontrollen umgangen werden und die Auswirkungen einer Sicherheitsverletzung schnell eskalieren“, fügte er hinzu. (jm)

 
View the full article
reporter

Ivantis EPM-Systeme anfällig für Angriffe

ImageFlow – shutterstock.com
Ivanti hat kürzlich einen schwerwiegenden Fehler in seinen EMP-Systemen gemeldet, der Admin-Sitzungen ohne Authentifizierung erlaubt. Angreifer könnten dadurch möglicherweise Tausende von Unternehmensgeräten kontrollieren.
Der Software-Anbieter veröffentlichte die EPM-Version 2024 SU4 SR1, um mehrere Schwachstellen zu beheben. Dazu gehört die kritische Schwachstelle mit der Kennung CVE-2025-10573, die einen CVSS-Score von 9,6 aufweist.
Weitere Lücken
Das Update behebt auch zwei weitere Lücken (CVE-2025-13659 und CVE-2025-13662), über die Angreifer beliebigen Code ausführen können. Zudem wird eine Schwachstelle gefixt, die unbefugtes Schreiben von Dateien auf dem Server ermöglicht.
Zum Zeitpunkt der Offenlegung seien keine Kunden-Systeme ausgenutzt worden, betont Ivanti in seinem Security Advisory.
Schon früher waren EPM-Systeme Ziel von Angriffen. Die US-Sicherheitsbehörde CISA hat im März drei EPM-Lücken (CVE-2024-13159, CVE-2024-13160 und CVE-2024-13161) in ihren Katalog bekannter ausgenutzter Schwachstellen aufgenommen, nachdem sie eine aktive Ausnutzung bestätigt hatte. Im Oktober meldete die Behörde eine weitere ausgenutzte EPM-Sicherheitslücke (CVE-2024-29824).
Die wiederholten Angriffe zeigen, wie wertvoll EPM für Cyberkriminelle ist. Sie erhalten dadurch einen dauerhaften Netzwerkzugang und laterale Bewegungsmöglichkeiten. Sobald Angreifer die Infrastruktur für das Management von Endgeräten kompromittiert haben, können sie sich schnell im gesamten Unternehmen ausbreiten.
Nicht authentifizierter Angriffsvektor
Bei dem aktuellen Sicherheitsproblem der EPM-Systeme von Ivanti handelt es sich um eine Cross-Site-Scripting-Sicherheitslücke (XSS). Ursprünglich wurde sie von Ryan Emmons, Sicherheitsforscher bei Rapid7, entdeckt und im August an Ivanti gemeldet.
Laut dem ebenfalls kürzlich veröffentlichten Bericht zur Offenlegung von Rapid7 können Angreifer ohne Authentifizierung bösartige Gerätescandaten an die eingehende Daten-API von EPM übermitteln. Die bösartigen Daten werden verarbeitet und in das EPM-Web-Dashboard eingebettet. Dort können sie ausgeführt werden, wenn Administratoren die betroffenen Seiten aufrufen.
„Ein Angreifer mit nicht authentifiziertem Zugriff auf den primären EPM-Webdienst kann gefälschte verwaltete Endpunkte mit dem EPM-Server verbinden, um das Administrator-Web-Dashboard mit bösartigem JavaScript zu infizieren“, erklärt Emmons.
Sobald das bösartige JavaScript ausgeführt wird, erlangen Angreifer die Kontrolle über die Admin-Sitzung mit vollen Berechtigungen, um Endpunkte fernzusteuern und Software auf Geräten zu installieren.
Vor diesem Hintergrund warnte Nick Tausek, Security-Spezialisit bei Swimlane: „Die Ausnutzung dieser Schwachstelle würde Angreifern Zugriff auf viele verwaltete Geräte gleichzeitig gewähren und es ihnen ermöglichen, Schadcode auszuführen, Ransomware zu deployen oder sensible Daten zu exfiltrieren.“
Die Herausforderung beim Patchen
Trotz der Dringlichkeit solcher Bedrohungen fällt es Unternehmen häufig schwer, kritische Schwachstellen schnell zu beheben: Eine Untersuchung von Swimlane ergab, dass 68 Prozent der Unternehmen kritische Schwachstellen länger als 24 Stunden ungepatcht lassen. Zudem verfügen 55 Prozent über kein umfassendes System zur Priorisierung von Schwachstellen.
Die Verzögerung ist besonders riskant für Endpunkt-Management-Systeme, die mit erhöhten Berechtigungen laufen und Tausende von Geräten steuern. Eine erfolgreiche Ausnutzung könnte Sicherheitskontrollen umgehen und es Angreifern ermöglichen, Malware auf verwaltete Endpunkte zu übertragen, Sicherheitskonfigurationen zu ändern oder dauerhafte Hintertüren im gesamten Unternehmen einzurichten.
„Das Potenzial für eine ernsthafte Angriffskampagne sollte nicht übersehen werden“, mahnte Tausek.
Anleitung zum Patchen
Der Patch ist über das Ivanti License System verfügbar und gilt für EPM-Versionen 2024 SU4 und früher. Unternehmen, die die 2022-Version verwenden, sollten beachten, dass diese im Oktober 2025 ausgelaufen ist keine Sicherheits-Updates mehr erhält, fügte Ivanti hinzu.
Sicherheitsteams sollten die Aktualisierung von EPM-Instanzen auf die Version 2024 SU4 SR1 unverzüglich priorisieren, insbesondere bei Installationen, auf die von nicht vertrauenswürdigen Netzwerken aus zugegriffen werden kann. Der Patch sollte innerhalb von 24 Stunden installiert werden.
Für Unternehmen, die den Patch nicht sofort installieren können, empfiehlt Ivanti, sicherzustellen, dass die Verwaltungsschnittstellen von EPM nicht dem öffentlichen Internet ausgesetzt sind, und eine strenge Netzwerksegmentierung zu implementieren.
Swimlane-Mann Tausek rät außerdem, Administratoren darin zu schulen, Social-Engineering-Angriffe zu erkennen, da die kritische XSS-Sicherheitslücke nur durch das Aufrufen einer manipulierten Dashboard-Seite ausgelöst werden kann.
„Da EPMs oft mit hohen Berechtigungen ausgeführt werden, besteht bei jedem Missbrauch die Gefahr, dass Sicherheitskontrollen umgangen werden und die Auswirkungen einer Sicherheitsverletzung schnell eskalieren“, fügte er hinzu. (jm)

 
View the full article
reporter

Opera Neon Browser Drops Waitlist, Adds Deep Research Agent

Opera today opened access to its agentic Neon browser, allowing anyone to subscribe to the app for AI power users. Opera Neon has been available in a closed "Founders" phase since it launched on October 2, but the waitlist has now been removed.


Costing $19.90 per month, Neon aims to go beyond traditional browsing by using AI to execute tasks directly within the browser. Neon can open and close tabs, compare information across multiple sources, and complete transactions on a user's behalf.

The service grants immediate access to top-tier models such as Gemini 3 Pro, GPT-5.1, Veo 3.1, and Nano Banana Pro. Complementing these models are the Neon Chat, Do, and Make agents, which are designed to autonomously handle complex tasks ranging from booking full travel itineraries to building websites, generating videos, and editing documents.

A new addition, the ODRA deep research agent, is designed for sustained, in-depth investigation. Its rapid "1-minute research" mode can gather and synthesize information on complex subjects while providing clear sourcing, offering a faster path to structured insight.

The browser competes with similar AI offerings from the likes of Perplexity (Comet Browser) and The Browser Company (Dia Browser). Opera Neon can be downloaded from the Opera website.Tag: Opera Browser
This article, "Opera Neon Browser Drops Waitlist, Adds Deep Research Agent" first appeared on MacRumors.com

Discuss this article in our forums

View the full article
reporter

Apple Studio Display 2 Code Hints at 120Hz ProMotion, HDR, A19 Chip

Apple's next-generation Studio Display is expected to arrive early next year, and a new report allegedly provides a couple more details on the external monitor's capabilities.


According to internal Apple code seen by Macworld, the new external display will feature a variable refresh rate capable of up to 120Hz – aka ProMotion – as well as support for HDR content. The current Studio Display is limited to 60Hz and supports SDR, but not HDR.

Macworld's Filipe Espósito suggests new HDR support points to Apple's use of improved panel technology that can achieve higher brightness. Indeed, analyst Ross Young believes Apple's next Studio Display could use a mini-LED panel similar to the MacBook Pro, which features superior brightness, contrast, and color accuracy compared to the existing LCD panel.

Elsewhere, the code references a "J527" identifier for the monitor, and suggests the model is powered by the A19 chip – two details that have also been previously discovered in code reviewed by MacRumors. Bloomberg's Mark Gurman has also referenced "J527" as the internal codename for one of the displays that Apple is developing.

Apple launched the 27-inch Studio Display in March 2022 alongside the Mac Studio. It features a 5K resolution, 600 nits of brightness, built-in webcam and speakers, one Thunderbolt 3 port, and three USB-C ports. Pricing in the U.S. starts at $1,599. The new version Apple is developing could arrive as early as this spring alongside new Macs with M5 chips.
This article, "Apple Studio Display 2 Code Hints at 120Hz ProMotion, HDR, A19 Chip" first appeared on MacRumors.com

Discuss this article in our forums

View the full article
reporter

Puppet Implementation Strategies for Hyderabad’s Tech Sector

In Hyderabad’s growing technology landscape, manually managing servers is becoming increasingly inefficient and impractical. For system administrators, DevOps engineers, and IT professionals across the city’s diverse tech industries, mastering automation tools like Puppet has become essential for career advancement and operational efficiency. If you’re looking to build a successful career in infrastructure automation, securing proper Puppet training in Hyderabad represents a strategic step forward. This comprehensive guide explores what Puppet is, why it’s become indispensable in modern IT operations, and how structured training can equip you with practical, industry-relevant skills that employers actively seek.
What is Puppet? Simplifying Server Management
Before evaluating training options, it’s crucial to develop a solid foundational understanding of Puppet itself. What exactly is this tool, and why has it become such a critical component in contemporary IT infrastructure management?
Puppet is a powerful open-source configuration management platform that enables organizations to implement Infrastructure as Code (IaC) principles. Rather than relying on manual, repetitive processes to configure servers—a time-consuming and error-prone approach—Puppet allows you to write declarative code that precisely defines how your server infrastructure should be configured and maintained. This code, written in Puppet’s Domain-Specific Language (DSL), describes the “desired state” of your systems, including which software packages should be installed, which services should be running, and exactly how configuration files should be structured.
The operational model of Puppet is both elegant and efficient. Here’s a clear breakdown of how it functions in practice:
You Create Configuration Blueprints: Develop Puppet manifests—files containing your infrastructure code that declaratively define system configurations. A Centralized Server Manages Code: A Puppet primary server serves as the authoritative repository for all configuration code. Agents Enforce Configurations: Each managed server runs a lightweight Puppet agent that regularly communicates with the primary server. Automated Compliance Assurance: During each Puppet run, the agent retrieves the latest configuration catalog and ensures the server conforms to the defined specifications, automatically correcting any deviations. This powerful declarative approach represents Puppet’s core innovation. Instead of scripting the procedural steps of how to achieve a configuration (“install this package, then edit that file”), you simply declare what the end state should be (“ensure Nginx web server version 1.20 is installed and running”). Puppet’s intelligent resource abstraction layer then determines how to achieve that state. This methodology delivers unparalleled consistency, scalability, and operational reliability across infrastructure of any size, from small deployments to global enterprise environments.
The Strategic Value of Puppet Skills in Hyderabad’s Technology Landscape
Hyderabad, widely recognized as “Cyberabad,” has firmly established itself as a premier technology hub hosting numerous global IT corporations, innovative startups, pharmaceutical giants, and enterprises undergoing comprehensive digital transformation. These diverse organizations share a common dependency on resilient, scalable, and secure IT infrastructure to power their operations and drive business innovation. They increasingly seek professionals who can implement sophisticated automation strategies to dramatically reduce manual errors, accelerate deployment cycles, enforce security compliance, and optimize operational costs.
By acquiring expertise in Puppet through targeted Puppet training in Hyderabad, you directly align your professional capabilities with the specific demands of the local technology market. This specialized skill set transforms you into a high-value asset capable of designing, implementing, and managing automated infrastructure solutions that support business agility and technological innovation, thereby creating pathways to advanced roles with greater responsibility and compensation.
Comprehensive Learning Path: What to Expect from Quality Puppet Training
A well-structured training program should offer a progressive learning journey that transitions participants from foundational concepts to confidently managing complex automation tasks in production environments. Here’s a detailed overview of the essential competencies you should expect to develop through comprehensive Puppet training:
1. Foundational Concepts and Initial Implementation
The learning journey typically begins with understanding Puppet’s client-server architecture, core design philosophy, and installation procedures. Participants quickly progress to writing basic manifests to manage fundamental system resources such as files, software packages, services, users, and permissions, establishing practical hands-on experience from the earliest sessions.
2. Developing Professional Code Organization Practices
As your understanding deepens, training should focus on industry best practices for structuring automation code for maximum maintainability, reusability, and scalability. This includes creating Puppet modules—self-contained, reusable units of code—utilizing classes to logically group related resources, and effectively leveraging system facts (automatically gathered system data) to write adaptive, context-aware configurations.
3. Mastering Data Management and Dynamic Configuration Generation
Implementing Hiera for Data Separation: A critical professional skill involves cleanly separating configuration data from Puppet code logic. Training should comprehensively cover Hiera, Puppet’s hierarchical data lookup system, enabling you to manage variables, credentials, and environment-specific parameters externally for cleaner, more manageable codebases. Creating Dynamic Configuration Files with Templates: You’ll learn to utilize templates (using Embedded Ruby or Puppet’s EPP syntax) to programmatically generate configuration files, eliminating the need for maintaining multiple static file copies across different servers and environments. 4. Scaling Skills for Complex Enterprise Environments
Quality training prepares you for real-world complexity by teaching techniques for node classification (applying specific configurations to different server roles such as web servers, database servers, or application servers) and implementing Puppet environments (such as Development, Testing, and Production) to establish safe, controlled change management workflows that prevent configuration drift and enable reliable deployments.
5. Advanced Troubleshooting, Reporting, and Industry Best Practices
A complete training program equips you with essential diagnostic and optimization skills. You’ll learn to interpret detailed Puppet run reports, debug catalog compilation failures and resource dependency issues, and adopt established best practices for writing idempotent, secure, efficient, and maintainable Puppet code suitable for enterprise production environments.
Why DevOpsSchool Represents a Premier Choice for Puppet Education
When committing to professional development, selecting the appropriate training provider significantly influences learning outcomes and the practical applicability of acquired skills. DevOpsSchool has cultivated an exemplary reputation as a specialized leader in DevOps and infrastructure automation education. With a demonstrated track record of successfully training over 8,000 professionals globally, their instructional faculty brings a collective average of 15+ years of extensive hands-on industry experience directly into the educational environment.
Their meticulously designed Puppet training in Hyderabad prioritizes practical skill development and career readiness. The program’s distinctive advantages include:
Adaptive Learning Modalities for Diverse Needs: Offers multiple engagement formats including self-paced video libraries, live interactive online cohorts, personalized one-on-one mentoring sessions, and customized corporate training solutions tailored for organizational teams. Immersive Hands-On Skill Development: The curriculum emphasizes experiential learning, with approximately 80-85% of instructional time dedicated to comprehensive hands-on laboratories where participants configure, manage, troubleshoot, and optimize real Puppet code in scenarios simulating actual workplace challenges. Comprehensive, Professionally Sequenced Curriculum: Provides an exhaustive educational pathway covering everything from initial installation and core syntax to advanced topics including custom fact development, module authoring, report processor configuration, and integration strategies within DevOps pipelines. Industry-Recognized Professional Certification: Successful graduates earn an accredited industry certification that provides objective, third-party validation of their Puppet expertise, significantly enhancing professional credibility and marketability. Lifetime Access for Continuous Professional Development: Participants receive permanent access to a comprehensive Learning Management System (LMS) containing all session recordings, presentation materials, detailed lab guides, code repositories, and future content updates, serving as an enduring professional reference library. Critical DifferentiatorDevOpsSchool’s Puppet Training ProgramGeneric Online Tutorial AlternativesEducational Structure & DepthA deliberately sequenced, complete curriculum progressing from fundamental principles to advanced enterprise implementation techniques.Frequently fragmented or superficial, covering introductory concepts without progressing to professional-level, production-ready skills.Practical, Application-Focused ExperienceExtensive, scenario-driven laboratories that replicate real-world infrastructure challenges, constituting 80-85% of course engagement.Predominantly passive video consumption with simplified exercises that lack workplace relevance and complexity.Direct Instructional Support & MentorshipLive interaction with expert instructors for personalized question resolution, guidance, and career advice throughout the learning journey.Typically offers no direct instructor access, relying instead on community forums with inconsistent response quality and timeliness.Professional Credential ValueIndustry-accredited certification recognized by employers that substantiates skill competency and enhances career prospects.Usually provides only a basic “certificate of completion” with minimal recognition or value in professional hiring contexts.Long-Term Learning Resource AccessLifetime access to continuously updated materials, community forums, and technical support for ongoing skill development.Access is frequently time-limited or expires, with content quickly becoming outdated in rapidly evolving technology landscapes. Learning from an Industry Authority: Rajesh Kumar
The instructor’s expertise fundamentally shapes the educational experience and determines the practical relevance of acquired knowledge. The Puppet training in Hyderabad is guided by Rajesh Kumar, a globally acknowledged expert with over two decades of comprehensive experience spanning DevOps, DevSecOps, Site Reliability Engineering (SRE), Kubernetes, multi-cloud architectures, AIOps, and MLOps. This extensive practical background ensures he teaches Puppet not merely as an isolated technical tool, but as an integral component within broader enterprise IT ecosystems and digital transformation initiatives. Student testimonials consistently highlight his exceptional ability to demystify complex architectural concepts through clear explanations and his unwavering commitment to delivering immediately applicable, practical skills that translate directly into workplace productivity and career advancement.
Ideal Candidates for This Puppet Training Program
This comprehensive educational program is thoughtfully designed for a diverse spectrum of IT professionals within Hyderabad who are committed to advancing their careers through automation mastery:
System Administrators & IT Operations Personnel: Professionals seeking to transition from repetitive manual configuration tasks to automated, scalable, and consistent infrastructure management paradigms. DevOps Engineers: Practitioners aiming to deepen their Infrastructure as Code expertise, enhance deployment consistency across environments, and improve collaboration between development and operations teams. Cloud & Infrastructure Engineers: Individuals responsible for implementing reliable, auditable configuration management across dynamic, elastic cloud and hybrid computing environments. Technical Leads & Engineering Managers: Decision-makers requiring thorough understanding of automation frameworks to make informed architectural choices, develop effective team strategies, and oversee infrastructure projects successfully. Career Transitioners & Committed Learners: Individuals building powerful, future-proof foundations in high-demand skill areas to successfully enter or advance within the expanding field of infrastructure automation and DevOps. Recommended Background Knowledge: While the course is designed to be accessible and begins comprehensively with fundamental concepts, participants will maximize their learning experience by possessing basic familiarity with Linux/Unix command-line operations and a general understanding of core IT and networking principles. This foundational knowledge facilitates deeper engagement with automation concepts from the program’s inception.
Your Strategic Next Step Toward an Automated Future
Mastering Puppet represents far more than merely adding another technical tool to your professional repertoire. It signifies embracing a fundamentally smarter, more efficient, and more reliable paradigm of IT operations—a paradigm that is increasingly critical for the future of any technology-driven organization. Within Hyderabad’s competitive and innovation-focused technology market, these specialized skills serve as powerful differentiators, creating pathways to superior employment opportunities, increased professional responsibility, enhanced compensation, and more impactful, rewarding career trajectories.
Ready to take definitive control of your infrastructure management capabilities and proactively shape your professional future? Explore the detailed, module-by-module curriculum, review upcoming batch schedules, and examine enrollment procedures for the comprehensive Puppet training in Hyderabad.
Take the decisive first step today. Contact the DevOpsSchool team to initiate your transformative professional journey:
Email: [email protected]
Phone & WhatsApp (India): +91 84094 92687
Phone & WhatsApp (USA): +1 (469) 756-6329
Website: DevOpsSchool


View the full article
reporter

Expert Guide to Puppet Implementation for Chennai Tech

In Chennai’s rapidly growing technology landscape, the ability to manage IT infrastructure efficiently has become a critical skill for professionals across sectors. For system administrators, DevOps engineers, and IT specialists working in the city’s diverse industries, mastering automation tools like Puppet can significantly elevate your professional capabilities. This detailed guide explores what Puppet is, why it’s important, and how Puppet Training in Chennai can equip you with practical, immediately applicable skills for modern infrastructure management.
What is Puppet? Understanding the Infrastructure Automation Solution
Before delving into training specifics, it’s essential to understand what Puppet is and why it has become indispensable for contemporary IT operations.
Puppet is an open-source configuration management tool that enables infrastructure as code. Instead of manually configuring each server individually, Puppet allows you to write code that precisely describes how your systems should be configured. This code, written in Puppet’s domain-specific language (DSL), defines the “desired state” of your infrastructure—specifying which software should be installed, which services should be running, and exactly how configuration files should be set up.
The operation of Puppet follows a straightforward yet highly effective pattern:
You create Puppet manifests that declare the desired configuration A central Puppet primary server stores and processes this code Puppet agents installed on each managed server regularly communicate with the primary server During each Puppet run, the agent ensures the server matches the defined configuration, automatically correcting any discrepancies This declarative approach is what makes Puppet particularly powerful. You specify what you want (for example, “ensure Nginx web server version 1.18 is installed and running on port 80”), and Puppet determines how to make it happen. This automation delivers consistency, scalability, and reliability to infrastructure management, substantially reducing human error and saving valuable administrative time across organizations.
The Value of Puppet Skills in Chennai’s Expanding Tech Ecosystem
Chennai, with its established manufacturing base, growing IT services industry, and emerging startup ecosystem, hosts numerous companies managing increasingly complex IT environments. Organizations across different sectors—from automotive manufacturing to banking and healthcare—need professionals who can implement effective automation practices to maintain system reliability, ensure security compliance, and streamline deployment processes. Learning Puppet through Puppet Training in Chennai helps you develop skills that are directly relevant to employer needs in your city, positioning you as a strong candidate for advanced IT positions and career advancement opportunities.
Key Learning Areas in a Comprehensive Puppet Training Program
A well-structured training program systematically takes you from understanding fundamental concepts to gaining practical, job-ready skills. Here are the essential areas typically covered in quality Puppet training:
1. Foundational Concepts and Initial Setup
You’ll begin by understanding Puppet’s core architecture and learning to write basic Puppet manifests to manage fundamental system resources like software packages, services, users, groups, and configuration files.
2. Organizing Puppet Code for Maintainability
As your configurations become more sophisticated, you’ll learn industry best practices for structuring your code properly. This includes creating Puppet modules to organize related configurations logically, using classes to group resources coherently, and developing defined types for reusable, parameterized components.
3. Working with Dynamic and Data-Driven Configurations
Leveraging System Facts: Puppet automatically gathers detailed information (facts) about each managed system. You’ll learn to use these facts to write conditional code that works correctly across different operating systems, environments, and hardware configurations. Creating Dynamic Templates: You’ll master using Embedded Ruby (ERB) templates to generate configuration files dynamically based on variables, facts, and custom business logic, eliminating the need for static configuration files. Managing External Data with Hiera: A crucial industry best practice involves separating configuration data from Puppet code. You’ll implement Hiera, Puppet’s hierarchical data lookup tool, to manage settings, parameters, and secrets separately from your Puppet manifests and modules. 4. Managing Diverse Server Groups and Development Environments
You’ll learn proven techniques for assigning specific configurations to different server roles (such as web servers, database servers, application servers, or load balancers). The training will also comprehensively cover managing Puppet environments (like development, testing, and production), allowing you to safely test and validate configuration changes before applying them to critical production systems.
5. Troubleshooting, Reporting, and Industry Best Practices
Quality training includes practical guidance on interpreting Puppet run reports, debugging catalog compilation failures, troubleshooting common agent-primary communication issues, and following established industry best practices for writing maintainable, efficient, and secure Puppet code that stands the test of time.
Why DevOpsSchool Stands Out for Your Puppet Education
With numerous learning options available today, selecting the right training provider is a crucial decision that impacts your learning outcomes. DevOpsSchool has established itself as a trusted platform for DevOps and automation education, having successfully trained over 8,000 professionals worldwide with instructors averaging 15+ years of industry experience.
Here’s what distinguishes their Puppet Training in Chennai as a superior choice:
Flexible Learning Modalities: Choose from self-paced video courses, live interactive online classes, personalized one-on-one sessions, or customized corporate training programs—each designed to fit different schedules, learning preferences, and professional commitments. Practical, Hands-On Emphasis: The course prioritizes learning by doing, with approximately 80-85% of the training time dedicated to hands-on labs where you’ll work with real Puppet configurations, troubleshoot actual scenarios, and build complete automation solutions. Comprehensive, Up-to-Date Curriculum: The syllabus thoroughly covers everything from basic installation and initial configuration through advanced topics like custom module development, external data integration, and reporting dashboards. Industry-Recognized Certification: Graduates receive an industry-recognized certificate that validates their Puppet skills to current and prospective employers, enhancing career mobility and credibility. Lifelong Access and Continuous Support: Participants maintain lifetime access to all course materials through the intuitive Learning Management System, including session recordings, presentation slides, lab guides, and code examples, complemented by ongoing technical support from instructors and the community. Learning FeatureDevOpsSchool’s Puppet TrainingTypical Online TutorialsCurriculum StructureComplete, well-organized learning path from fundamentals to advanced enterprise implementationOften fragmented, focusing mainly on introductory topics without progression to practical, production-ready skillsPractical ExperienceEmphasis on hands-on labs simulating real-world enterprise scenarios (80-85% practical work)Primarily theoretical with limited, simplified exercises that don’t mirror workplace complexityInstructional SupportDirect access to experienced instructors for personalized questions and guidance during and after trainingLittle to no direct instructor interaction; heavy reliance on community forums with delayed responsesProfessional CredentialIndustry-recognized certification that enhances career opportunities and employer confidenceTypically offers only a generic “certificate of completion” with limited recognition among employersLong-Term ValueLifetime access to updated materials and ongoing community support for continuous learningContent access often expires, with no updates or community engagement beyond initial viewing Learn from an Industry Authority: Rajesh Kumar
The quality and effectiveness of instruction significantly influence how well you assimilate and apply new technical skills. This Puppet Training in Chennai benefits immensely from the guidance of Rajesh Kumar, a seasoned professional with over 20 years of comprehensive hands-on experience across DevOps, Site Reliability Engineering (SRE), Kubernetes, cloud technologies, and multiple automation platforms.
Rajesh employs a practical, scenario-based teaching methodology that connects Puppet’s specific features to real-world operational challenges and business requirements. Past students consistently highlight his exceptional ability to demystify complex topics through clear explanations and his unwavering focus on building immediately useful, practical skills that deliver value from day one in professional settings.
Ideal Candidates for This Puppet Training Program
This comprehensive program is designed for various technology professionals in Chennai seeking to advance their infrastructure automation capabilities:
System Administrators & IT Operations Staff: Professionals aiming to transition from repetitive manual configuration tasks to automated, scalable, and consistent infrastructure management. DevOps Engineers: Practitioners seeking to deepen their infrastructure-as-code expertise, improve deployment consistency across environments, and enhance collaboration between development and operations teams. Cloud & Infrastructure Engineers: Individuals responsible for managing configurations across hybrid or multi-cloud environments who need standardized, repeatable processes. Technical Leads & IT Managers: Decision-makers who need to understand configuration management strategies to guide their teams effectively and make informed technology choices. Aspiring Automation Professionals: Individuals looking to enter the field with a solid, practical foundation in enterprise-grade infrastructure automation using industry-standard tools. Recommended Background: While the course thoughtfully starts with fundamentals, participants will benefit most from having basic familiarity with Linux/Unix command-line operations and a general understanding of server infrastructure concepts. Prior programming or scripting experience is helpful but not strictly required.
Advancing Your IT Career with Puppet Expertise
Developing Puppet expertise represents more than just learning another technical tool—it signifies embracing a modern, systematic, and efficient approach to infrastructure management. These skills empower you to ensure unprecedented system reliability, maintain stringent compliance standards, contribute significantly to organizational efficiency, and reduce operational costs—capabilities that are increasingly valued in Chennai’s dynamic technology sector and can substantially accelerate your career trajectory.
Ready to transform your infrastructure management capabilities and advance your professional standing? Explore the complete curriculum details, view upcoming schedule options, and review enrollment information for the comprehensive Puppet Training in Chennai.
For personalized guidance on selecting the optimal learning format for your goals, the responsive DevOpsSchool support team is readily available to assist you.
Email: [email protected]
India Phone/WhatsApp: +91 84094 92687
USA Phone/WhatsApp: +1 (469) 756-6329
Website: DevOpsSchool


View the full article
reporter

The Impact of Robotic Process Automation (RPA) on Identity and Access Management

As enterprises refine their strategies for handling Non-Human Identities (NHIs), Robotic Process Automation (RPA) has become a powerful tool for streamlining operations and enhancing security. However, since RPA bots have varying levels of access to sensitive information, enterprises must be prepared to mitigate a variety of challenges. In large organizations, bots are starting to outnumberView the full article
reporter

The Impact of Robotic Process Automation (RPA) on Identity and Access Management

As enterprises refine their strategies for handling Non-Human Identities (NHIs), Robotic Process Automation (RPA) has become a powerful tool for streamlining operations and enhancing security. However, since RPA bots have varying levels of access to sensitive information, enterprises must be prepared to mitigate a variety of challenges. In large organizations, bots are starting to outnumberView the full article
Hacker News

Expert Guide to Puppet Implementation for Bangalore Tech

In Bangalore’s bustling technology sector, managing IT infrastructure efficiently has become a critical skill. For DevOps engineers, system administrators, and IT professionals working in the city’s many technology companies, understanding configuration management tools can significantly enhance your career prospects. This guide explores Puppet, a powerful infrastructure automation tool, and how professional Puppet Training in Bangalore can help you develop practical skills for managing modern IT systems.
Understanding Puppet: A Tool for Modern Infrastructure Management
Before diving into training details, it’s helpful to understand what Puppet is and why it’s become an essential tool for managing IT systems.
Puppet is an open-source configuration management tool that enables infrastructure as code. Instead of manually configuring each server individually, Puppet allows you to write code that describes how your systems should be configured. This code, written in Puppet’s domain-specific language (DSL), defines the “desired state” of your infrastructure—what software should be installed, which services should be running, and how configuration files should be set up.
The way Puppet works is straightforward:
You create Puppet manifests that declare the desired configuration A central Puppet master server stores and processes this code Puppet agents installed on each server regularly communicate with the master During each Puppet run, the agent makes sure the server matches the defined configuration, automatically fixing any differences This declarative approach is what makes Puppet effective. You specify what you want (for example, “make sure the Apache web server is version 2.4 and running”), and Puppet figures out how to make it happen. This automation brings consistency, scalability, and reliability to infrastructure management, reducing errors and saving valuable time.
Why Puppet Skills Matter in Bangalore’s Tech Industry
Bangalore, as India’s technology capital, is home to numerous companies managing increasingly complex IT systems. Organizations across different sectors need professionals who can implement effective automation practices to maintain system reliability, ensure security standards, and speed up deployment processes. Learning Puppet through Puppet Training in Bangalore helps you develop skills that are directly relevant to what employers in your city need, making you a stronger candidate for advanced IT positions.
What You’ll Learn in a Quality Puppet Training Program
A good training program takes you from understanding basic concepts to gaining practical skills you can use on the job. Here are the key areas you’ll typically cover:
1. Basic Concepts and Setup
You’ll start by understanding Puppet’s architecture and learning to write basic Puppet manifests to manage system resources like software packages, services, and configuration files.
2. Organizing Puppet Code Effectively
As your configurations become more complex, you’ll learn to structure your code properly. This includes creating Puppet modules to organize related configurations, using classes to group resources, and developing defined types for reusable components.
3. Working with Dynamic Configurations
Using System Facts: Puppet automatically collects information about each system. You’ll learn to use these facts to write code that works correctly across different operating systems and environments. Creating Templates: Learn to use Embedded Ruby (ERB) templates to generate configuration files dynamically based on variables and system information. Managing Data with Hiera: A key practice involves separating configuration data from code. You’ll implement Hiera, Puppet’s data lookup tool, to manage settings separately from your Puppet code. 4. Managing Different Server Groups and Environments
You’ll learn techniques for assigning specific configurations to different types of servers (such as web servers, database servers, or application servers). The training will also cover managing Puppet environments, allowing you to test configuration changes safely before using them in production systems.
5. Troubleshooting and Best Practices
Good training includes practical guidance on reading Puppet run reports, troubleshooting common issues, and following industry best practices for writing maintainable, efficient Puppet code.
Why Choose DevOpsSchool for Your Puppet Training?
With many learning options available, selecting the right training provider is important. DevOpsSchool has established itself as a respected platform for DevOps and automation education, having trained over 8,000 professionals with instructors averaging 15+ years of industry experience.
Here’s what makes their Puppet Training in Bangalore a good choice:
Flexible Learning Options: Choose from self-paced video courses, live interactive online classes, personalized one-on-one sessions, or corporate training programs to fit your schedule and learning style. Practical, Hands-On Focus: The course emphasizes learning by doing, with approximately 80-85% of the time dedicated to hands-on labs where you’ll work with real Puppet configurations. Comprehensive Curriculum: The syllabus covers everything from basic installation and configuration through advanced topics like module development and data management with Hiera. Professional Certification: Graduates receive an industry-recognized certificate that validates their Puppet skills to employers. Long-Term Access and Support: Participants maintain access to all course materials through the Learning Management System, including session recordings, presentation slides, and lab guides, with ongoing technical support. Learning FeatureDevOpsSchool’s Puppet TrainingTypical Online TutorialsCurriculum StructureComplete, well-organized learning path from basics to advanced implementationOften fragmented, focusing mainly on introductory topics without practical depthPractical ExperienceEmphasis on hands-on labs simulating real-world scenarios (80-85% practical work)Primarily theoretical with limited, simplified exercisesInstructional SupportDirect access to experienced instructors for questions and guidanceLittle to no direct instructor interaction; reliance on community forumsProfessional CredentialIndustry-recognized certification that enhances career opportunitiesTypically offers only a “certificate of completion” with limited recognitionLong-Term ValueLifetime access to updated materials and ongoing community supportContent access often expires without updates or community engagement Learn from an Industry Expert: Rajesh Kumar
The quality of instruction makes a big difference in how well you learn and apply new skills. This Puppet Training in Bangalore benefits from the guidance of Rajesh Kumar, an experienced professional with over 20 years of hands-on experience in DevOps, Site Reliability Engineering (SRE), Kubernetes, and cloud technologies.
Rajesh uses a practical teaching approach that connects Puppet’s features to real-world operational needs. Students often mention his ability to explain complex topics clearly and his focus on building immediately useful skills.
Who Is This Training For?
This program is designed for various technology professionals in Bangalore:
System Administrators & IT Operations Staff: Professionals looking to move from manual configuration tasks to automated, scalable infrastructure management DevOps Engineers: Practitioners aiming to strengthen their infrastructure-as-code capabilities and improve deployment consistency Cloud & Infrastructure Engineers: Individuals responsible for managing configurations across different environments who need standardized processes Technical Leads & IT Managers: Decision-makers who need to understand configuration management strategies for their teams Aspiring Automation Professionals: Individuals seeking to enter the field with a solid foundation in enterprise-grade infrastructure automation Recommended Background: While the course starts with fundamentals, participants will benefit from basic familiarity with Linux/Unix command-line operations and a general understanding of server infrastructure concepts.
Taking the Next Step in Your IT Career
Developing Puppet expertise represents more than learning a specific tool—it means adopting a modern, systematic approach to infrastructure management. These skills help you ensure system reliability, maintain compliance standards, and contribute to organizational efficiency—capabilities that are highly valued in Bangalore’s competitive technology sector and can significantly advance your career.
Ready to enhance your infrastructure management skills? Explore the complete curriculum, schedule options, and enrollment details for the comprehensive Puppet Training in Bangalore.
For personalized guidance on choosing the right learning format, the DevOpsSchool team is available to help you.
Email: [email protected]
India Phone/WhatsApp: +91 84094 92687
USA Phone/WhatsApp: +1 (469) 756-6329
Website: DevOpsSchool


View the full article
reporter

WIRTE Leverages AshenLoader Sideloading to Install the AshTag Espionage Backdoor

An advanced persistent threat (APT) known as WIRTE has been attributed to attacks targeting government and diplomatic entities across the Middle East with a previously undocumented malware suite dubbed AshTag since 2020. Palo Alto Networks is tracking the activity cluster under the name Ashen Lepus. Artifacts uploaded to the VirusTotal platform show that the threat actor has trained its sightsView the full article
reporter

WIRTE Leverages AshenLoader Sideloading to Install the AshTag Espionage Backdoor

An advanced persistent threat (APT) known as WIRTE has been attributed to attacks targeting government and diplomatic entities across the Middle East with a previously undocumented malware suite dubbed AshTag since 2020. Palo Alto Networks Unit 42 is tracking the activity cluster under the name Ashen Lepus. Artifacts uploaded to the VirusTotal platform show that the threat actor has trained itsView the full article
Hacker News

A Practical Guide to Prometheus with Grafana in Hyderabad

In the fast-paced world of Hyderabad’s technology sector, the reliability and performance of software systems directly impact business success. For DevOps engineers, system administrators, and IT professionals in the city, mastering modern monitoring tools has become essential. This guide explores how developing Prometheus and Grafana expertise through professional Prometheus with Grafana Training in Hyderabad can transform your ability to manage complex systems effectively.
Understanding the Power of Prometheus and Grafana
Before diving into training specifics, let’s clarify what makes these tools so valuable for modern IT operations.
Prometheus functions as a sophisticated monitoring and alerting system specifically engineered for today’s dynamic environments. Its distinctive pull-based architecture allows it to actively gather metrics from your applications, servers, and infrastructure components on a regular schedule. All collected data is stored in its efficient time-series database, creating a comprehensive historical record. The tool’s true analytical capability emerges through PromQL, its query language that enables you to ask detailed questions about system behavior and performance trends.
Grafana serves as a powerful data visualization platform that complements Prometheus perfectly. While Prometheus handles data collection, Grafana specializes in transforming that data into understandable insights through interactive dashboards. By connecting Grafana to Prometheus and other data sources, you can create visual representations that make system health immediately apparent to technical teams and stakeholders alike.
Together, they form a complete observability solution: Prometheus systematically collects the data, you analyze it using PromQL, and Grafana presents clear visualizations that drive informed decision-making across your organization.
Why These Skills Matter in Hyderabad’s Tech Scene
Hyderabad has emerged as a significant technology hub, hosting a diverse range of IT companies, global enterprises, and innovative startups. Across these organizations, there’s growing recognition that traditional monitoring approaches are insufficient for today’s complex systems. Companies actively seek professionals who can implement modern observability solutions to prevent costly downtime, optimize performance, and ensure positive user experiences. By developing these skills locally, you position yourself to meet specific needs within Hyderabad’s technology ecosystem while gaining globally applicable expertise.
Key Skills You’ll Develop Through Quality Training
A comprehensive training program takes you beyond basic concepts to build practical, immediately applicable skills. Here’s what you can expect to learn:
1. Fundamental Architecture and Setup
You’ll begin by understanding how both tools are designed and gain hands-on experience installing and configuring Prometheus and Grafana across various environments, including containerized setups.
2. Application Instrumentation Techniques
Learn practical methods to make your applications observable by working with client libraries for programming languages like Go and Python. You’ll configure Prometheus to automatically discover and collect metrics from your software, a critical skill for modern development practices.
3. Mastering PromQL for Effective Analysis
This essential component teaches you to use PromQL to write queries that filter, aggregate, and perform calculations on time-series data. Developing proficiency with PromQL is fundamental for creating meaningful dashboards and establishing intelligent alert conditions.
4. Building Professional Grafana Dashboards
Transition from dashboard user to dashboard creator by learning how to:
Connect Grafana to Prometheus as a primary data source Create various visualizations using the panel editor Apply transformations to shape and combine data effectively Implement templates and variables for dynamic, reusable dashboards 5. Implementing Proactive Alerting Systems
Move beyond reactive monitoring by configuring Alertmanager to handle alerts from Prometheus. You’ll learn to define precise alert rules, manage notification silences, and route alerts to appropriate channels like email or team communication platforms.
6. Real-World Integration Scenarios
To prepare you for production environments, quality training covers practical situations including:
Dynamic Service Discovery: Automatically monitoring services in Kubernetes environments Using Exporters: Collecting metrics from databases, web servers, and various systems Cloud Integration: Incorporating data from AWS CloudWatch and Azure Monitor for comprehensive visibility Why DevOpsSchool Represents a Strong Training Choice
With numerous learning options available, selecting the right training provider significantly influences your educational outcomes. DevOpsSchool has established a solid reputation in DevOps education, having trained over 8,000 professionals with instructors averaging 15+ years of practical industry experience.
Here’s what sets their Prometheus with Grafana Training in Hyderabad apart:
Flexible Learning Formats: Choose from self-paced video content, live interactive sessions, personalized one-on-one instruction, or corporate training programs Practical, Hands-On Focus: Approximately 80-85% of the course emphasizes hands-on labs where you’ll build and troubleshoot actual monitoring setups Comprehensive Curriculum Coverage: The syllabus addresses everything from basic installation to advanced production topics including security implementation and automation Valuable Professional Certification: Graduates receive an industry-recognized certificate that validates their expertise to employers Ongoing Access and Support: Maintain continuous access to all learning materials through their Learning Management System, supplemented by ongoing technical support Aspect of TrainingDevOpsSchool’s ApproachTypical Online TutorialsEducational StructureComplete, logically sequenced curriculum progressing from fundamentals to advanced conceptsOften fragmented, focusing primarily on basics without sufficient depthPractical ApplicationStrong emphasis on hands-on labs simulating real-world scenarios (80-85% practical work)Primarily theoretical with limited, simplified practical exercisesInstructional SupportDirect access to experienced instructors for guidance and clarificationLittle to no direct instructor interaction; reliance on community forumsProfessional CredentialIndustry-recognized certification that enhances career opportunitiesTypically offers only a certificate of completion with limited recognitionLong-Term Learning ValueLifetime access to updated materials and ongoing support communityContent access often expires without updates or community engagement Learning from Industry Expert Rajesh Kumar
The quality of instruction plays a crucial role in effective learning. This training program benefits from the guidance of Rajesh Kumar, an experienced professional with over 20 years of practical experience in DevOps, Site Reliability Engineering (SRE), Kubernetes, and cloud technologies.
Rajesh employs a practical teaching methodology that connects tool features to real-world operational challenges. Previous participants frequently note his ability to explain complex topics clearly and his focus on building immediately applicable skills rather than just theoretical knowledge.
Who Would Benefit from This Training?
This program is designed for various technology professionals:
DevOps Engineers and SREs: Professionals responsible for creating and maintaining reliable, observable systems System and Cloud Administrators: Individuals seeking to advance from basic monitoring to sophisticated observability practices Software Developers: Engineers interested in building observable applications and understanding their operational behavior Technical Leads and Managers: Decision-makers needing to understand monitoring strategies and tooling options Career Transitioners: Individuals seeking to enter the DevOps and cloud-native fields with in-demand skills Recommended Background: While the course is designed to be accessible, participants will benefit from basic familiarity with the Linux command line and a general understanding of software development or IT operations concepts.
Advancing Your Professional Development
Developing proficiency with Prometheus and Grafana represents more than learning specific tools—it’s about cultivating a mindset focused on system reliability, proactive problem-solving, and data-informed decision making. These competencies are highly valued in Hyderabad’s technology sector and can substantially enhance your professional prospects.
Ready to build your expertise in modern observability? Explore the complete curriculum and enrollment details for the comprehensive Prometheus with Grafana Training in Hyderabad.
For personalized guidance regarding suitable learning formats, the DevOpsSchool team is available to provide assistance.
Email: [email protected]
India Phone/WhatsApp: +91 84094 92687
USA Phone/WhatsApp: +1 (469) 756-6329
Website: DevOpsSchool


View the full article
reporter

A Practical Guide to Prometheus with Grafana

In Chennai’s growing tech scene, the need to keep applications running smoothly is more important than ever. System failures can mean lost customers and revenue. For IT professionals, developers, and managers in the city, mastering Prometheus and Grafana has become a key skill for building resilient systems. This guide explains what these tools do and how proper training can help you use them effectively.
What Are Prometheus and Grafana?
Let’s start with the basics of these two powerful open-source tools.
Prometheus is a specialized monitoring and alerting toolkit. Think of it as a highly organized data collector for your software infrastructure. Its clever pull-based model means it actively reaches out to your applications and servers to gather performance metrics on a schedule. It stores all this data in a time-series database, keeping a perfect historical record. You then use its query language, PromQL, to analyze this data, find trends, and set up alerts for potential problems.
Grafana is the visualization expert. It’s a leading platform for creating interactive dashboards and charts. You connect Grafana to Prometheus (and many other data sources), and it transforms raw numbers into clear, visual stories with graphs, heatmaps, and gauges. This makes complex system health information easy for everyone—from engineers to executives—to understand at a glance.
Together, they form a complete monitoring solution: Prometheus collects and stores the data, you query and analyze it with PromQL, and Grafana presents the insights in an actionable visual format.
Why This Skill Matters in Chennai
Chennai is home to a diverse range of industries, from global IT services and automotive manufacturing to a vibrant startup ecosystem. In all these sectors, reliable software is crucial for business operations. There is a strong and growing demand for professionals who can implement modern monitoring practices to ensure uptime and performance. Learning these tools in Chennai connects you directly with the needs of the local market and positions you as a valuable asset.
What You Will Learn in a Comprehensive Training Program
A quality training course provides a structured path from understanding concepts to gaining hands-on, job-ready skills. Here’s a breakdown of the core competencies you should expect to develop:
1. Foundational Setup and Architecture
You’ll begin by learning how both tools are designed. The training covers installation and configuration of Prometheus and Grafana on various operating systems and within containerized environments like Docker.
2. Instrumenting Your Applications
A crucial skill is learning how to get useful data from your own code. You’ll work with client libraries for languages like Go, Java, or Python to expose custom application metrics. You’ll then configure Prometheus to automatically discover and scrape these metrics endpoints.
3. Mastering the PromQL Query Language
This is where you unlock deep analytical power. The training will make you proficient in PromQL, teaching you to write queries that filter, aggregate, and perform calculations on time-series data. This is essential for creating meaningful dashboards and precise alert conditions.
4. Designing Effective Grafana Dashboards
You’ll transition from using dashboards to building them. The course teaches you to:
Connect Grafana to Prometheus as a primary data source. Use the panel editor to create a variety of visualizations (graphs, stat panels, tables). Apply transformations to manipulate and combine data before it’s displayed. Implement templates and variables to build dynamic, reusable dashboards for different teams or services. 5. Implementing Proactive Alerting
Move from reactive to proactive monitoring. You’ll configure Alertmanager to handle alerts generated by Prometheus rules. This includes defining alert thresholds, managing notification silences, and routing alerts to channels like email, Slack, or messaging platforms.
6. Real-World Integrations and Advanced Topics
To prepare you for production environments, training should cover practical scenarios like:
Dynamic Service Discovery: Automatically monitoring services in Kubernetes or cloud environments as they scale up and down. Using Exporters: Leveraging specialized agents to collect metrics from databases (MySQL, PostgreSQL), web servers, and hardware. Cloud Monitoring: Pulling data from AWS CloudWatch or Azure Monitor into your Grafana dashboards for a unified view. Why Choose DevOpsSchool for Your Training?
With many learning options available, selecting the right provider is key. DevOpsSchool is a trusted platform in the DevOps education space, having successfully trained over 8,000 professionals with instructors averaging 15+ years of industry experience.
Here’s what makes their Prometheus with Grafana Training In Chennai a standout choice:
Flexible Learning Formats: Choose the mode that fits your life: self-paced video courses, live interactive online classes, personalized one-on-one sessions, or customized corporate training programs. Hands-On, Practical Focus: The program is designed around doing, not just watching. Approximately 80-85% of the course time is dedicated to hands-on labs where you work on real-world tasks. Comprehensive Curriculum: The syllabus is thorough, covering everything from initial installation to advanced production-grade topics like security (TLS), automation, and integration with other DevOps tools. Industry-Recognized Certification: Upon completion, you receive a professional certification that validates your skills to employers and enhances your professional profile. Lifetime Access and Support: You get lifetime access to all learning materials—recordings, slides, lab guides—through their Learning Management System (LMS), along with dedicated support. Key AspectDevOpsSchool’s Training ProgramTypical Online Tutorials / Free ContentLearning StructureA complete, end-to-end learning journey with logical progression.Often fragmented, incomplete, or only introductory.Practical ApplicationCore focus on labs and projects simulating real job tasks (80-85% hands-on).Limited to following along with simple examples; less problem-solving.Expert GuidanceDirect access to instructors for questions, mentorship, and feedback.Little to no direct instructor interaction; reliant on community forums.Career OutcomeProvides a recognized certificate and portfolio of practical skills.Results in knowledge gaps and lacks a credible credential.Long-Term ValueLifetime access to updated materials and a professional network.Content access may expire, with no updates or community support. Learn from an Expert Instructor: Rajesh Kumar
The instructor’s expertise directly impacts your learning experience. The Prometheus with Grafana Training In Chennai is led by Rajesh Kumar, a globally recognized expert with over 20 years of hands-on experience in DevOps, Site Reliability Engineering (SRE), cloud platforms, and Kubernetes.
Rajesh is known for his practical teaching approach. He connects the features of Prometheus and Grafana to real-world operational challenges, ensuring you understand not just the “how” but the “why.” Past students frequently praise his ability to explain complex topics clearly and his focus on building confidence through applied learning.
Who Is This Training For?
This course is designed for a wide range of technology professionals in Chennai and beyond:
DevOps Engineers & SREs: To build and manage the monitoring backbone for automated, reliable systems. System Administrators & IT Operations Staff: To advance their skills in infrastructure monitoring and proactive incident management. Software Developers: To learn how to create observable applications and understand their performance in production. Tech Leads & Engineering Managers: To make informed decisions about monitoring strategy and tooling for their teams. Career Changers & Enthusiasts: To gain a high-demand, specialized skill set for entering the DevOps and cloud-native field. Recommended Background: You will benefit most if you have basic familiarity with the Linux command line and a general understanding of software applications or network concepts. The course is designed to build from foundational knowledge.
Take the Next Step in Your Professional Development
Mastering Prometheus and Grafana is a strategic career investment. It equips you with the skills to ensure system reliability, reduce downtime, and provide data-driven insights that are invaluable to any modern business. It’s more than learning software—it’s about adopting a mindset of proactive system management.
Ready to build your expertise and become a go-to professional for system observability? You can explore the detailed course curriculum, view schedules, and enroll in the comprehensive Prometheus with Grafana Training In Chennai.
If you have questions about the course structure or which format is right for you, the supportive team at DevOpsSchool is happy to help.
Email: [email protected]
India Phone/WhatsApp: +91 84094 92687
USA Phone/WhatsApp: +1 (469) 756-6329
Website: DevOpsSchool


View the full article
reporter

Unpatched Gogs Zero-Day Exploited Across 700+ Instances Amid Active Attacks

A high-severity unpatched security vulnerability in Gogs has come under active exploitation, with more than 700 compromised instances accessible over the internet, according to new findings from Wiz. The flaw, tracked as CVE-2025-8110 (CVSS score: 8.7), is a case of file overwrite in the file update API of the Go-based self-hosted Git service. A fix for the issue is said to be currently in theView the full article
reporter

Unpatched Gogs Zero-Day Exploited Across 700+ Instances Amid Active Attacks

A high-severity unpatched security vulnerability in Gogs has come under active exploitation, with more than 700 compromised instances accessible over the internet, according to new findings from Wiz. The flaw, tracked as CVE-2025-8110 (CVSS score: 8.7), is a case of file overwrite in the file update API of the Go-based self-hosted Git service. A fix for the issue is said to be currently in theView the full article
Hacker News

A Practical Guide to Prometheus with Grafana in Bangalore

In the heart of India’s Silicon Valley, where applications power everything from global e-commerce to innovative fintech solutions, system performance isn’t just a technical metric—it’s a business imperative. For the professionals building these systems, the need for crystal-clear insight is absolute. This has made the powerful combination of Prometheus and Grafana the undisputed standard for modern monitoring and observability. But understanding how to implement these tools is the key to unlocking their true potential for your systems and your career. This guide explores the critical skills offered by Prometheus with Grafana Training in Bangalore and how the right learning path can transform your professional capabilities.
Demystifying the Observability Power Duo: Prometheus & Grafana
At its core, this pairing solves two halves of the observability puzzle: data collection and data comprehension.
Prometheus: The Meticulous Data Collector
Imagine Prometheus as a relentless, methodical investigator for your software infrastructure. It is an open-source monitoring and alerting toolkit designed for reliability. Its genius lies in its pull-based architecture; instead of your services pushing data, Prometheus actively “scrapes” metrics from them at defined intervals. This gives operators superior control. All collected data is stored in its efficient time-series database, creating a precise, timestamped history of your system’s behavior. The real power is unlocked through PromQL (Prometheus Query Language), a flexible language that lets you interrogate this data to diagnose complex issues, calculate performance trends, and set intelligent alert conditions.
Grafana: The Masterful Visual Storyteller
If Prometheus gathers the evidence, Grafana presents the case. It is the leading open-source platform for analytics and interactive visualization. By connecting Grafana to Prometheus as a data source, you can translate raw metrics into intuitive, actionable dashboards. With support for graphs, heatmaps, histograms, and more, Grafana turns abstract numbers into a visual narrative. This enables developers, operations teams, and business leaders to see system health, spot anomalies instantly, and make informed decisions based on shared understanding.
The Complete Observability Loop: Together, they create a virtuous cycle: Prometheus systematically gathers and stores metrics, engineers analyze and alert using PromQL, and Grafana transforms insights into clear, actionable visualizations for the entire organization.
Why Bangalore? The Local Advantage for a Global Skill
Bangalore’s ecosystem of tech giants, scaling startups, and cutting-edge R&D centers creates a unique environment of high stakes and higher opportunities. Here, application downtime directly impacts revenue and customer trust. Consequently, there is intense demand for professionals who can architect resilient, observable systems that prevent failures. Investing in Prometheus with Grafana Training in Bangalore means acquiring a globally relevant skill through a lens focused on the specific challenges and use cases prevalent in one of the world’s most vibrant tech hubs. You learn not just the theory, but its practical application in the industry that surrounds you.
What a Deep-Dive Training Program Should Teach You
Moving beyond basic online tutorials, a professional training course provides a structured journey from foundational concepts to advanced implementation. Here is what a comprehensive curriculum must cover:
1. Core Architecture & Deployment
Start with the “why” behind the design. Training should cover the single-server node model of Prometheus, its data model, and the role of exporters. You’ll get hands-on experience installing and configuring both Prometheus and Grafana across various environments, including Docker containers, to establish a robust foundation.
2. Application Instrumentation & Metric Collection
Learn how to make your applications observable. This involves working with client libraries (for Go, Java, Python, etc.) to expose custom business and application metrics from your codebase. You’ll then configure Prometheus service discovery to automatically find and scrape these metrics endpoints.
3. Mastering PromQL for Advanced Analysis
This module is where operational data becomes intelligence. You’ll gain proficiency in PromQL to write queries that slice, aggregate, and perform mathematical operations across time-series data. Mastering PromQL is non-negotiable for creating precise dashboards and meaningful alert rules.
4. Building Enterprise-Grade Grafana Dashboards
Transition from dashboard consumer to dashboard architect. Comprehensive training teaches you to:
Seamlessly connect Grafana to Prometheus and other data sources. Master the panel editor to build diverse visualizations. Apply transformations to filter and combine query results. Implement templates and variables to create dynamic, reusable dashboards that serve entire teams or organizations. 5. Proactive Alerting with Alertmanager
Shift from passive monitoring to proactive management. You’ll configure Alertmanager to handle alerts sent by Prometheus. This includes defining critical alert rules with PromQL, managing silences and inhibitions, and routing notifications effectively to channels like email, Slack, PagerDuty, or OpsGenie.
6. Real-World Operations & Advanced Integrations
To be production-ready, training must address complex, real-world scenarios:
Dynamic Service Discovery: Automatically monitoring ephemeral services in Kubernetes or cloud environments. Long-Term Storage & Scaling: Strategies for managing data retention and scaling the Prometheus stack. Unified Monitoring: Integrating metrics from AWS CloudWatch, Azure Monitor, databases, and hardware systems into a single Grafana pane of glass. Choosing the Right Partner: Why DevOpsSchool Stands Out
In a market filled with options, the training provider you choose significantly impacts your learning outcome and return on investment. DevOpsSchool has cemented its reputation as a premier platform for DevOps and cloud-native upskilling, with a community of over 8,000 certified learners.
Here is what differentiates their Prometheus with Grafana Training in Bangalore:
Unmatched Flexibility: Select a learning mode that fits your life—self-paced video learning, live interactive online batches, personalized one-on-one mentorship, or tailored corporate training programs. A “Learn by Doing” Philosophy: The course is intensely practical, with approximately 80-85% of the time dedicated to hands-on labs. You will configure, break, fix, and optimize real monitoring stacks in guided environments. Comprehensive, Industry-Vetted Curriculum: The syllabus is exhaustive, moving from initial setup to advanced production topics like implementing TLS security, Grafana provisioning for automation, and integrations with tools like Consul for service discovery. Career-Advancing Certification: Graduates earn an industry-recognized professional certification, providing tangible validation of your expertise to current and prospective employers. Lifetime Learning Access: Gain indefinite access to the course’s Learning Management System (LMS), including all session recordings, presentation decks, lab guides, and future updates, along with dedicated technical support. Evaluation CriteriaDevOpsSchool’s ProgramTypical Online Tutorials / BootcampsCurriculum Depth & StructureEnd-to-end, logical progression from fundamentals to enterprise-grade operations.Often fragmented, covering basics without depth on integration or advanced scenarios.Hands-On, Practical FocusCore methodology; 80-85% lab-based learning with real-world project simulations.Theoretical or limited to simple, guided examples without complex problem-solving.Instructor Access & MentorshipDirect interaction with senior industry-expert trainers for Q&A and guidance.Limited or no direct access; reliance on community forums or pre-recorded content only.Credential & Career ValueOffers a recognized professional certification that enhances your resume.Provides a “certificate of completion” with little to no industry recognition.Post-Training SupportLifetime LMS access, interview preparation kits, and job placement assistance forums.Access expires, with no ongoing support, community, or material updates. Learning from an Industry Pioneer: The Expertise of Rajesh Kumar
The quality of instruction is paramount. The Prometheus with Grafana Training in Bangalore is guided by Rajesh Kumar, a veteran with over 20 years of hands-on experience across the modern IT landscape—DevOps, Site Reliability Engineering (SRE), DevSecOps, Kubernetes, and multi-cloud platforms.
Rajesh’s teaching transcends tool-specific instruction. He frames Prometheus and Grafana within the broader context of observability engineering and SRE best practices. Students consistently highlight his ability to demystify complex concepts, connect theory to real-world operational challenges, and focus on building practical, deployable skills that provide immediate value in the workplace.
Is This Training the Right Fit for You?
This program is designed for a broad spectrum of technology roles seeking to elevate their impact:
DevOps Engineers & Site Reliability Engineers (SREs): To build and maintain the observability foundation essential for reliable, automated systems and services. System Administrators & Cloud Operations Teams: To advance from basic logging to sophisticated metric-based monitoring and proactive incident management. Software Developers: To instrument code effectively, understand the operational telemetry it generates, and participate in a DevOps culture. Technical Leads & Engineering Managers: To make informed architectural decisions about monitoring strategies and tooling investments for their teams. IT Professionals Seeking Career Transition: To acquire a high-demand, specialized skill set for entering the DevOps and cloud-native domain. Suggested Prerequisites: A foundational comfort with the Linux command line, basic networking concepts, and an understanding of software development or IT operations will help you assimilate the course material more effectively.
Your Next Career Move: From Learning to Implementation
Mastering Prometheus and Grafana represents more than technical proficiency—it represents a shift towards engineering systems with built-in resilience and clarity. It empowers you to not just react to issues, but to predict and prevent them, providing the data-driven visibility that fuels business confidence and agility.
Ready to become the observability expert your team and industry need? Explore the complete syllabus, training schedules, and enrollment details for the definitive Prometheus with Grafana Training in Bangalore.
For specific questions or guidance on selecting the right batch, the team at DevOpsSchool is readily available to assist.
Email: [email protected]
India Phone/WhatsApp: +91 84094 92687
USA Phone/WhatsApp: +1 (469) 756-6329
Website: DevOpsSchool


View the full article
reporter

Spotify Integration for Algoriddim's Djay App Expands to iOS and iPadOS

Back in September, Algoriddim's djay apps for Mac and Windows regained Spotify integration, allowing Spotify Premium subscribers to access the service's full music catalog and their own libraries and playlists, and today that support is expanding to iOS, iPadOS, and Android.


Spotify integration across desktop and mobile is available in 56 markets around the world, and it works with djay's AI-powered Automix feature to deliver DJ-quality transitions to your Spotify playlists. Intelligent beat-matching and a full set of DJ tools, loops, and effects enhance the experience.The djay apps already support Apple Music integration, and now Spotify offers the same type of support across platforms.


Algoriddim's djay app is a free download from the App Store and Mac App Store, as well as the Google Play Store and the Microsoft Store, with an optional Pro subscription priced at $6.99 per month or $49.99 per year to unlock all features.Tags: Algoriddim, Djay, Spotify
This article, "Spotify Integration for Algoriddim's Djay App Expands to iOS and iPadOS" first appeared on MacRumors.com

Discuss this article in our forums

View the full article
reporter
OHC_logo_transparent_01.jpeg flags-medium.png OHC_logo_blue_square_small.jpeg

 

Account

Navigation

Search

Search

Configure browser push notifications
Chrome (Android)
  1. Tap the lock icon next to the address bar.
  2. Tap Permissions → Notifications.
  3. Adjust your preference.
Chrome (Desktop)
  1. Click the padlock icon in the address bar.
  2. Select Site settings.
  3. Find Notifications and adjust your preference.