Skip to content
View in the app

A better way to browse. Learn more.
hosang I.T.

A full-screen app on your home screen with push notifications, badges and more.

To install this app on iOS and iPadOS
  1. Tap the Share icon in Safari
  2. Scroll the menu and tap Add to Home Screen.
  3. Tap Add in the top-right corner.
To install this app on Android
  1. Tap the 3-dot menu (⋮) in the top-right corner of the browser.
  2. Tap Add to Home screen or Install app.
  3. Confirm by tapping Install.

Tech

Tech Articles from a wide variety of topics and categories
Show all categories

Ending Soon: Samsung's Cyber Week Event With Low Prices on The Frame TV, Gaming Monitors, and More

Samsung's Cyber Week event will come to a close later this weekend, and you can still find great deals on monitors, storage accessories, TVs, Galaxy smartphones, and home appliances for a few more days.

Note: MacRumors is an affiliate partner with Samsung. When you click a link and make a purchase, we may receive a small payment, which helps us keep the site running.

Highlights from this event include quite a few models of The Frame TV on sale, including a new all-time low price on The Frame Pro models. You can get the 65-inch The Frame TV for $999.99 ($1,000 off), as well as The Frame Pro for $1,999.00 ($1,200 off).

SITEWIDE DISCOUNTSSamsung Cyber Week Sale

Other deals include savings on monitors like the 32-inch Smart Monitor M8 for $389.99 ($310 off), the 49-inch Odyssey OLED G9 Gaming Monitor for $899.99 ($900 off), and more. We're also tracking big markdowns on home appliances including refrigerators and washer/dryers, and a few Galaxy device discounts.

Samsung's new Galaxy XR headset also has a few notable offers during this event, including up to $1,140 in savings with the Explorer Pack. This features various content at no extra cost with the purchase of the Galaxy XR, like one year of YouTube Premium, one year of Google AI Pro, and more.

For even more potential savings, eligible shoppers have the chance to get additional discounts through Samsung offer programs. These programs provide extra discounts for students, military, and employees of select businesses, and they provide up to 30 percent extra savings on Samsung's website, so be sure to check whether you're eligible for any of these programs.

TVs

65-inch The Frame - $999.99, down from $1,999.99 (extra $100 off available through offer programs)
75-inch The Frame Pro - $1,999.99, down from $3,199.99
85-inch The Frame Pro - $3,299.99, down from $4,299.99 (extra $660 off available through offer programs)
65-inch OLED S90C TV - $1,699.99, down from $2,699.99
65-inch Neo QLED 4K TV - $1,399.99, down from $2,699.99
77-inch OLED S90F TV - $1,999.99, down from $3,499.99
75-inch Neo QLED QN90D TV - $1,499.99, down from $3,299.99
Monitors and Storage

32-inch Smart Monitor M8 - $389.99, down from $699.99
40-inch Odyssey G7 G75F Curved Monitor - $749.99, down from $1,199.99
49-inch Odyssey OLED G9 Monitor - $899.99, down from $1,799.99
57-inch Odyssey Neo G9 Monitor - $1,499.99, down from $2,299.99 (extra $200 off available through offer programs)
Appliances

Bespoke Smart Dishwasher - $749.99, down from $1,299.00
Large Capacity Side-by-Side Fridge - $999.00, down from $1,666.00
4-Door French Door Fridge - $1,799.00, down from $2,999.00
Bespoke All-in-One Combo Washer/Dryer - $1,849.99, down from $3,299.00
Mega Capacity 3-Door French Door Fridge - $2,399.00, down from $3,499.00
Bespoke 4-Door Flex Fridge - $2,050.00, down from $4,099.00
Bespoke 4-Door Flex Fridge - $3,049.99, down from $4,999.00
Galaxy Products

Galaxy XR - Save up to $1,140 with the Explorer Pack
Galaxy S25 Ultra - Save up to $700 in instant trade-in credit
Galaxy Z Fold7 - Save up to $1,000
Galaxy Ring - Get up to $150 trade-in credit
Galaxy Watch Ultra - Save up to $250
Galaxy Watch 8 - Save up to $200

If you're on the hunt for more discounts, be sure to visit our Apple Deals roundup where we recap the best Apple-related bargains of the past week.



Deals Newsletter

Interested in hearing more about the best deals you can find this holiday season? Sign up for our Deals Newsletter and we'll keep you updated so you don't miss the biggest deals of the season!




Related Roundup: Apple Deals
This article, "Ending Soon: Samsung's Cyber Week Event With Low Prices on The Frame TV, Gaming Monitors, and More" first appeared on MacRumors.com

Discuss this article in our forums

View the full article
reporter

Researchers Uncover 30+ Flaws in AI Coding Tools Enabling Data Theft and RCE Attacks

Over 30 security vulnerabilities have been disclosed in various artificial intelligence (AI)-powered Integrated Development Environments (IDEs) that combine prompt injection primitives with legitimate features to achieve data exfiltration and remote code execution. The security shortcomings have been collectively named IDEsaster by security researcher Ari Marzouk (MaccariTA). They affect popularView the full article
reporter

Drones to Diplomas: How Russia’s Largest Private University is Linked to a $25M Essay Mill

A sprawling academic cheating network turbocharged by Google Ads that has generated nearly $25 million in revenue has curious connections to a Kremlin-connected oligarch whose Russian university builds drones for Russia’s war against Ukraine.
The Nerdify homepage.
The link between essay mills and Russian attack drones might seem improbable, but understanding it begins with a simple question: How does a human-intensive academic cheating service stay relevant in an era when students can simply ask AI to write their term papers? The answer – recasting the business as an AI company – is just the latest chapter in a story of many rebrands that link the operation to Russia’s largest private university.
Search in Google for any terms related to academic cheating services — e.g., “help with exam online” or “term paper online” — and you’re likely to encounter websites with the words “nerd” or “geek” in them, such as thenerdify[.]com and geekly-hub[.]com. With a simple request sent via text message, you can hire their tutors to help with any assignment.
These nerdy and geeky-branded websites frequently cite their “honor code,” which emphasizes they do not condone academic cheating, will not write your term papers for you, and will only offer support and advice for customers. But according to This Isn’t Fine, a Substack blog about contract cheating and essay mills, the Nerdify brand of websites will happily ignore that mantra.
“We tested the quick SMS for a price quote,” wrote This Isn’t Fine author Joseph Thibault. “The honor code references and platitudes apparently stop at the website. Within three minutes, we confirmed that a full three-page, plagiarism- and AI-free MLA formatted Argumentative essay could be ours for the low price of $141.”
A screenshot from Joseph Thibault’s Substack post shows him purchasing a 3-page paper with the Nerdify service.
Google prohibits ads that “enable dishonest behavior.” Yet, a sprawling global essay and homework cheating network run under the Nerdy brands has quietly bought its way to the top of Google searches – booking revenues of almost $25 million through a maze of companies in Cyprus, Malta and Hong Kong, while pitching “tutoring” that delivers finished work that students can turn in.
When one Nerdy-related Google Ads account got shut down, the group behind the company would form a new entity with a front-person (typically a young Ukrainian woman), start a new ads account along with a new website and domain name (usually with “nerdy” in the brand), and resume running Google ads for the same set of keywords.
UK companies belonging to the group that have been shut down by Google Ads since Jan 2025 include:
–Proglobal Solutions LTD (advertised nerdifyit[.]com);
–AW Tech Limited (advertised thenerdify[.]com);
–Geekly Solutions Ltd (advertised geekly-hub[.]com).
Currently active Google Ads accounts for the Nerdify brands include:
-OK Marketing LTD (advertising geekly-hub[.]net⁩), formed in the name of the Ukrainian national Alexander (Oleksandr) Korsukov;
–Two Sigma Solutions LTD (advertising litero[.]ai), formed in the name of Olekszij Pokatilo.
Google’s Ads Transparency page for current Nerdify advertiser OK Marketing LTD.
Messrs. Korsukov and Pokatilo have been in the essay-writing business since at least 2009, operating a paper-mill enterprise called Livingston Research. According to a lengthy account from a former employee, Livingston Research mainly farmed its writing tasks out to low-cost workers from Kenya, Philippines, Pakistan, Russia and Ukraine.
In 2011, the two men set up a Cyprus corporation called VLS Research Ltd, which would later change its name to CLS Research Ltd. Pokatilo moved from Ukraine to the United Kingdom in Sept. 2015 and co-founded a company called Awesome Technologies, which pitched itself as a way for people to outsource tasks by sending a text message to the service’s assistants.
The other co-founder of Awesome Technologies is 36-year-old Filip Perkon, a Swedish man living in London who touts himself as a serial entrepreneur and investor. Years before starting Awesome together, Perkon and Pokatilo co-founded a student group called Russian Business Week while the two were classmates at the London School of Economics. According to the Bulgarian investigative journalist Christo Grozev, Perkon’s birth certificate was issued by the Soviet Embassy in Sweden.
Alexey Pokatilo (left) and Filip Perkon at a Facebook event for startups in San Francisco in mid-2015.
Around the time Perkon and Pokatilo launched Awesome Technologies, Perkon was building a social media propaganda tool called the Russian Diplomatic Online Club, which Perkon said would “turbo-charge” Russian messaging online. The club’s newsletter urged subscribers to install in their Twitter accounts a third-party app called Tweetsquad that would retweet Kremlin messaging on the social media platform.
Perkon was praised by the Russian Embassy in London for his efforts: During the contentious Brexit vote that ultimately led to the United Kingdom leaving the European Union, the Russian embassy in London used this spam tweeting tool to auto-retweet the Russian ambassador’s posts from supporters’ accounts.
Neither Mr. Perkon nor Mr. Pokatilo replied to requests for comment.
A review of corporations tied to Mr. Perkon as indexed by the business research service North Data finds he holds or held director positions in several U.K. subsidiaries of Synergy, Russia’s largest private education provider. Synergy has more than 35,000 students, and sells T-shirts with patriotic slogans such as “Crimea is Ours,” and The Russian Empire — Reloaded.”
The president of Synergy is Vadim Lobov, a Kremlin insider whose headquarters on the outskirts of Moscow reportedly features a wall-sized portrait of Russian President Vladimir Putin in the pop-art style of Andy Warhol. For a number of years, Lobov and Perkon co-produced a cross-cultural event in the U.K. called Russian Film Week.
Synergy President Vadim Lobov and Filip Perkon, speaking at a press conference for Russian Film Week, a cross-cultural event in the U.K. co-produced by both men.
Mr. Lobov was one of 11 individuals reportedly hand-picked by the convicted Russian spy Marina Butina to attend the 2017 National Prayer Breakfast held in Washington D.C. just two weeks after President Trump’s first inauguration.
While Synergy University promotes itself as Russia’s largest private educational institution, hundreds of international students tell a different story. Online reviews from students paint a picture of unkept promises: Prospective students from Nigeria, Kenya, Ghana, and other nations paying thousands in advance fees for promised study visas to Russia, only to have their applications denied with no refunds offered.
“My experience with Synergy University has been nothing short of heartbreaking,” reads one such account. “When I first discovered the school, their representative was extremely responsive and eager to assist. He communicated frequently and made me believe I was in safe hands. However, after paying my hard-earned tuition fees, my visa was denied. It’s been over 9 months since that denial, and despite their promises, I have received no refund whatsoever. My messages are now ignored, and the same representative who once replied instantly no longer responds at all. Synergy University, how can an institution in Europe feel comfortable exploiting the hopes of Africans who trust you with their life savings? This is not just unethical — it’s predatory.”
This pattern repeats across reviews by multilingual students from Pakistan, Nepal, India, and various African nations — all describing the same scheme: Attractive online marketing, promises of easy visa approval, upfront payment requirements, and then silence after visa denials.
Reddit discussions in r/Moscow and r/AskARussian are filled with warnings. “It’s a scam, a diploma mill,” writes one user. “They literally sell exams. There was an investigation on Rossiya-1 television showing students paying to pass tests.”
The Nerdify website’s “About Us” page says the company was co-founded by Pokatilo and an American named Brian Mellor. The latter identity seems to have been fabricated, or at least there is no evidence that a person with this name ever worked at Nerdify.
Rather, it appears that the SMS assistance company co-founded by Messrs. Pokatilo and Perkon (Awesome Technologies) fizzled out shortly after its creation, and that Nerdify soon adopted the process of accepting assignment requests via text message and routing them to freelance writers.
A closer look at an early “About Us” page for Nerdify in The Wayback Machine suggests that Mr. Perkon was the real co-founder of the company: The photo at the top of the page shows four people wearing Nerdify T-shirts seated around a table on a rooftop deck in San Francisco, and the man facing the camera is Perkon.
Filip Perkon, top right, is pictured wearing a Nerdify T-shirt in an archived copy of the company’s About Us page. Image: archive.org.
Where are they now? Pokatilo is currently running a startup called Litero.Ai, which appears to be an AI-based essay writing service. In July 2025, Mr. Pokatilo received pre-seed funding of $800,000 for Litero from an investment program backed by the venture capital firms AltaIR Capital, Yellow Rocks, Smart Partnership Capital, and I2BF Global Ventures.
Meanwhile, Filip Perkon is busy setting up toy rubber duck stores in Miami and in at least three locations in the United Kingdom. These “Duck World” shops market themselves as “the world’s largest duck store.”
This past week, Mr. Lobov was in India with Putin’s entourage on a charm tour with India’s Prime Minister Narendra Modi. Although Synergy is billed as an educational institution, a review of the company’s sprawling corporate footprint (via DNS) shows it also is assisting the Russian government in its war against Ukraine.
Synergy University President Vadim Lobov (right) pictured this week in India next to Natalia Popova, a Russian TV presenter known for her close ties to Putin’s family, particularly Putin’s daughter, who works with Popova at the education and culture-focused Innopraktika Foundation.
The website bpla.synergy[.]bot, for instance, says the company is involved in developing combat drones to aid Russian forces and to evade international sanctions on the supply and re-export of high-tech products.
A screenshot from the website of synergy,bot shows the company is actively engaged in building armed drones for the war in Ukraine.
KrebsOnSecurity would like to thank the anonymous researcher NatInfoSec for their assistance in this investigation.
View the full article
reporter

Top Stories: iOS 26.2 Coming Soon, Apple Execs Depart, and More

You'd expect things to be starting to wind down for the holidays by now, but that doesn't seem to be the case yet in the world of Apple news, with Apple just about ready to release iOS 26.2 and other operating system updates to the public.


There was also a flurry of news this week about Apple executive departures, some expected and some not so expected, while we also learned that Apple and Intel may be developing a new chipmaking partnership, so read on below for all the details on these stories and more!

Top Stories

Apple Seeds iOS 26.2 Release Candidate Ahead of Public Launch

With the Thanksgiving holiday in the rear-view mirror and the calendar turned to December, Apple is putting the final touches on iOS 26.2, iPadOS 26.2, macOS Tahoe 26.2, and related updates, with several new features and tweaks. Apple this week seeded release candidate versions of the updates to developers and public beta testers, suggesting an official release for everyone will come next week.


The imminent iOS 26.2 update arrives as Apple has started to more aggressively push users still on iOS 18 to upgrade to iOS 26. Since ‌iOS 26‌ launched in September, it has been displayed as an optional upgrade at the bottom of the Software Update interface in the Settings app, with iOS 18 updates displayed more prominently.

Starting this week, that's changed. iOS 18 users who have not upgraded to ‌iOS 26 now see iOS 26.1 (and soon iOS 26.2) as the recommended iOS update in the Settings app. iOS 18 updates are still an option, but are now displayed at the bottom of the app.

Apple UI Design Chief Alan Dye Leaving for Meta

In a move that came as a surprise to most observers, Apple design chief Alan Dye has decided to leave the company after 19 years and take a role as chief design officer at Meta.


Dye oversaw the major Liquid Glass design update that debuted this year, which has not arrived without controversy, and some both inside and outside of Apple are not exactly sorry to see Dye go.

Dye's departure follows closely on the heels of Apple announcing that AI chief John Giannandrea has stepped down from his position and will serve as an advisor until he retires early next year. Giannandrea has been under pressure as Apple has fallen behind in the race to develop and deploy AI capabilities, and some of his responsibilities had already been shifted to other executives.

As if that wasn't enough, Apple also announced this week that general counsel Kate Adams and environment chief Lisa Jackson will both be retiring in 2026, with the company working to transition their responsibilities to other executives.

Apple and Intel Rumored to Partner on Mac and iPhone Chips in a New Way

While all Macs are now powered by Apple's custom-designed chips, a new rumor claims that Apple may rekindle its partnership with Intel, albeit in a new and limited way.


Apple supply chain analyst Ming-Chi Kuo this week said Intel is expected to begin shipping Apple's lowest-end M-series chip as early as mid-2027.

If this rumor proves accurate, Intel could supply Apple with M6 or M7 chips for future MacBook Air, iPad Air, and iPad Pro models at a minimum. However, while previous Intel chips for Macs were designed by Intel and based on x86 architecture, M-series chips are designed by Apple and use Arm architecture. Intel would only assist with manufacturing.

The partnership may also extend to the iPhone with Intel producing future chips for non-pro iPhone models starting in 2028, which could perhaps mean the A22 chip for devices like the iPhone 20 and iPhone 20e.

iPhone Fold: Launch, Pricing, and What to Expect From Apple's Foldable

Apple is expected to launch a new foldable iPhone next year, based on multiple rumors and credible sources. The long-awaited device has been rumored for years now, but signs increasingly suggest that 2026 could indeed be the year that Apple releases its first foldable device.


As rumors continue to surface, we've collated an updated set of key details that have been leaked about Apple's foldable iPhone so far. Apple will allegedly call the device the "‌iPhone‌ Fold," which is the name the media has already adopted when sharing rumors about the product.

Apple Music Replay 2025 Now Fully Available

The full Replay 2025 experience is now available in the Apple Music app, allowing you to reflect on your listening habits over the past year.


There are two main components of the Replay 2025 experience. First, there is a full year-end playlist containing the Apple Music songs that you listened to the most over the past year, and second, there is a Highlight Reel with images and a video that are designed to be shared on social media platforms like Instagram and TikTok.

iPhone 17 Demand Is Breaking Apple's Sales Records

Apple's iPhone 17 lineup is selling well enough that Apple is on track to ship more than 247.4 million total iPhones in 2025, according to a new report from IDC.


Total 2025 shipments are forecast to grow 6.1 percent year over year due to ‌iPhone 17‌ demand and increased sales in China, a major market for Apple.

Overall worldwide smartphone shipments across Android and iOS are forecast to grow 1.5 percent, primarily because of the success of the iPhone.

MacRumors Newsletter

Each week, we publish an email newsletter like this highlighting the top Apple stories, making it a great way to get a bite-sized recap of the week hitting all of the major topics we've covered and tying together related stories for a big-picture view.

So if you want to have top stories like the above recap delivered to your email inbox each week, subscribe to our newsletter!Tag: Top Stories
This article, "Top Stories: iOS 26.2 Coming Soon, Apple Execs Depart, and More" first appeared on MacRumors.com

Discuss this article in our forums

View the full article
reporter

After you check out your Spotify Wrapped 2025, explore these copycats 

Spotify’s annual Wrapped feature just dropped, giving listeners a fun, personalized summary of their listening habits. It has gained immense popularity over the years, and as a result, many companies have seized the opportunity to create similar year-in-review experiences, offering users a recap of their habits, preferences, or interactions from the past year. Here are […]View the full article
reporter

Advancing AI Implementation with MLOps in the United States

If you work with artificial intelligence anywhere in the United States—in cities like California, San Francisco, Boston, or Seattle—you understand the challenge: building an impressive AI model is an achievement, but making it work consistently in real-world applications is an entirely different story.
That critical gap between AI development and practical implementation is exactly where MLOps proves essential. To gain mastery of these vital skills, consider exploring MLOps Training in the United States, California, San Francisco, Boston & Seattle.
Understanding MLOps in Simple Terms
MLOps stands for Machine Learning Operations. It is the discipline of applying proven DevOps methodologies to the complete lifecycle of machine learning projects. Imagine it as the essential framework that transforms promising AI prototypes into robust, scalable, and maintainable production systems.
Without MLOps, even the most sophisticated AI models encounter significant hurdles: they may excel in controlled testing environments but fail under real-world conditions, or their performance may degrade silently over time due to data drift, all while manual processes create bottlenecks and hinder team collaboration.
The Growing Need for MLOps Across U.S. Industries
Organizations nationwide, from Silicon Valley startups to established enterprises in Boston and Seattle, are accelerating their AI adoption. A common realization is that model development is merely the first step. The greater challenge lies in operationalization: ensuring reliable daily performance, maintaining models over time, scaling solutions effectively, enforcing governance, and fostering seamless teamwork between data scientists and engineers.
This operational challenge is precisely why comprehensive MLOps training has transitioned from a niche advantage to a business necessity. It provides the methodology and tools to ensure AI investments deliver tangible, sustainable value.
The MLOps Transformation: A Clear Comparison
Adopting MLOps fundamentally reshapes how an organization manages its AI initiatives. The contrast between traditional approaches and the MLOps methodology is stark and telling:
Traditional AI DevelopmentThe MLOps MethodologySiloed work by data scientistsCross-functional MLOps teams in collaborationManual, inconsistent deploymentsAutomated, reproducible CI/CD pipelinesMinimal monitoring post-launchProactive, continuous model monitoringArchitectures difficult to scaleSystems designed for efficient model serving at scaleLimited traceability and governanceComprehensive model versioning and experiment tracking Core Competencies from Quality MLOps Training
A well-structured training program should equip you with both foundational knowledge and hands-on skills. Key learning areas typically include:
Foundations & Lifecycle: Grasping the core principles of MLOps and understanding the end-to-end machine learning lifecycle, from data and experimentation to deployment, monitoring, and retirement. Pipeline Engineering: Learning to build automated, reproducible pipelines for data, training, and validation using modern orchestration tools. Deployment & Serving: Mastering patterns for deploying models as APIs or batch processes, often leveraging containerization and orchestration platforms like Kubernetes. Monitoring, Governance & Ethics: Implementing systems to track model performance, detect data drift, and ensure robust model governance and fairness. Cloud-Native MLOps: Effectively utilizing cloud platforms for scalable, managed infrastructure tailored for machine learning workloads. Accelerating Learning with Expert Guidance
The MLOps landscape is dynamic and complex. Navigating its evolving tools and best practices alone can be inefficient. This is where learning from an established, practical source provides significant advantage.
For those seeking to build these competencies, DevOpsSchool offers a structured, practical approach to mastering in-demand technologies. Their training focuses on real-world application, connecting theoretical concepts directly to workplace scenarios.
The Advantage of Learning from an Industry Veteran
The depth and applicability of any MLOps training are profoundly influenced by the expertise of its instructors. Guidance from a practitioner with extensive real-world experience transforms theoretical knowledge into actionable skill.
The curriculum is guided by Rajesh Kumar, whose expertise is grounded in over two decades of hands-on experience across the spectrum of modern IT practices—from DevOps and DevSecOps to SRE, DataOps, AIOps, and MLOps. His deep practical knowledge of Kubernetes and cloud architectures provides learners with a holistic, strategic understanding of implementing MLOps within a broader technology ecosystem.
Identifying the Right Path for Your Career
For data scientists, ML engineers, DevOps professionals, software developers, and technology leaders in the United States, proficiency in MLOps is a powerful career differentiator. It represents the ability to bridge the gap between AI innovation and production-grade delivery, a skill set in high demand across the competitive markets of California, Boston, Seattle, and beyond.
Taking the First Step
Embarking on the journey to MLOps mastery begins with a commitment to structured learning. Assess your current knowledge, define your learning objectives, and explore training pathways that offer a blend of theory, hands-on practice, and expert mentorship.
Ready to translate AI potential into production reality? Building genuine MLOps competency is an investment that yields substantial returns in capability and career advancement.
To explore how you can develop these critical skills:
Email: [email protected]
Phone & WhatsApp (India): +91 84094 92687
Phone & WhatsApp (USA): +1 (469) 756-6329
Website: https://www.devopsschool.com/


View the full article
reporter

Critical React2Shell Flaw Added to CISA KEV After Confirmed Active Exploitation

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday formally added a critical security flaw impacting React Server Components (RSC) to its Known Exploited Vulnerabilities (KEV) catalog following reports of active exploitation in the wild. The vulnerability, CVE-2025-55182 (CVSS score: 10.0), relates to a case of remote code execution that could be triggered by anView the full article
reporter

Creating Effective MLOps Practices in London and Across the United Kingdom

If you work with AI in the UK, especially in London, you’ve likely felt this pattern:
You build an impressive model in testing, but then struggle to make it work reliably in real business situations. That gap between building and using AI is exactly where MLOps makes all the difference.
MLOps Training in the United Kingdom and London helps you turn experimental AI into dependable, everyday tools. It’s the practical system that makes AI work not just in the lab, but in the real world.
Why UK Companies Need MLOps
The UK, with London at the heart of its tech scene, is full of businesses wanting to use AI. But many face the same issues:
Models that work perfectly in testing but fail in real use AI performance that slowly gets worse over time Slow, manual processes that waste time Confusion over which model version is being used Teams struggling to work together effectively Learning MLOps gives you clear, practical methods to solve these problems and build AI systems that actually work.
MLOps in Practice: Before and After
When companies start using MLOps, their approach to AI changes completely:
Traditional ApproachWith MLOpsTeams work separatelyTeams collaborate betterManual, slow deploymentsAutomated, efficient processesNo monitoring after launchContinuous performance trackingDifficult to scaleEasy to grow successful modelsHard to repeat resultsClear records and reproducibility MLOps treats AI like a product that needs ongoing care, not just a one-time project.
What You’ll Learn in Good MLOps Training
Quality training should give you skills you can use right away:
Core Understanding
What MLOps really means and why it matters How it fits with other technical work The complete AI lifecycle Building Systems
Creating automated workflows that save time Using tools to organize complex projects Making processes repeatable and reliable Deployment Skills
How to safely launch models into use Different methods for making models available Modern tools for reliable service Monitoring and Maintenance
Setting up systems to watch model performance Finding and fixing problems early Knowing when to update models Best Practices
Industry standards that save time Common mistakes to avoid Practical tips from experienced professionals Finding the Right Learning Resources
MLOps changes fast, with new tools appearing regularly. Trying to learn everything yourself can be overwhelming. This is where structured learning helps.
A platform like DevOpsSchool focuses on making complex technical topics practical and accessible. They provide training that connects theory with real workplace situations.
Learning from Real Experience
The best training comes from people who have actually used these tools in real projects. That practical experience makes all the difference.
The MLOps training program is guided by Rajesh Kumar, who brings over twenty years of hands-on experience with technology systems. His background includes practical work with:
DevOps practices Cloud platforms Machine learning systems Learning from experienced professionals means you get:
Real-world knowledge from actual projects Practical methods proven in business environments Clear explanations of complex concepts Current expertise with the latest tools Career Benefits of Learning MLOps
If you work with AI, data, or technology in the UK, learning MLOps offers clear advantages:
For Your Current Role
Makes your work more efficient Helps solve complex problems better Increases your value to your team For Career Growth
Builds skills that are in high demand Opens new job opportunities Prepares you for leadership roles For Your Organization
Enables better AI development Increases project success rates Saves time and reduces errors Getting Started with MLOps
Ready to begin? Here’s a simple path:
Learn the basics of MLOps concepts Try small projects with real applications Connect with others using MLOps Consider formal training to accelerate learning Stay current with new developments Ready to build better AI systems? Developing MLOps skills requires focus, but the investment pays off in better results and career opportunities.
Interested in structured training options?
Get in touch to learn more:
Email: [email protected]
Phone & WhatsApp (India): +91 84094 92687
Phone & WhatsApp (USA): +1 (469) 756-6329
Website: https://www.devopsschool.com/


View the full article
reporter

Creating MLOps Solutions in Amsterdam and Across the Netherlands

If you work with machine learning or artificial intelligence in the Netherlands, especially in places like Amsterdam, you might have noticed a common problem. It’s easy to build a smart model in a testing environment, but much harder to get it working reliably in a real business. This gap between creating a model and using it in practice is exactly where MLOps Training in the Netherlands and Amsterdam becomes important.
MLOps, or Machine Learning Operations, is a set of practices that helps manage machine learning projects from start to finish. Think of it as a system that turns AI experiments into reliable, working tools that businesses can use every day.
Why MLOps Matters for Companies in the Netherlands
The Netherlands has a growing tech industry, with Amsterdam at its center. Many companies here want to use AI to improve their work. But without a good system in place, they often run into problems:
Models that work in testing but fail in real use AI performance that gets worse over time Manual processes that take too long and make errors Difficulty keeping track of different model versions This is where learning about MLOps can help. It provides clear methods to build better, more reliable AI systems.
What Changes When You Use MLOps
When companies start using MLOps practices, their approach to AI changes significantly:
Traditional ApproachWith MLOpsTeams work separatelyTeams collaborate betterManual deploymentAutomated processesNo monitoring after launchContinuous performance trackingHard to scaleEasier to grow successful modelsDifficult to repeat resultsClear tracking of all work Using MLOps means treating AI projects like products that need regular care and improvement, rather than one-time experiments.
What Good MLOps Training Should Teach You
If you’re thinking about learning MLOps, look for training that covers practical skills you can use right away:
Basic Concepts: Understanding what MLOps is and why it matters Building Workflows: Learning to create smooth, automated processes Deployment Skills: Knowing how to launch models reliably Monitoring Methods: Setting up systems to watch model performance Best Practices: Learning industry standards and common solutions This knowledge helps everyone involved in AI projects—from data scientists to IT managers—work together more effectively.
Finding the Right Learning Resources
The field of MLOps changes often, with new tools and methods appearing regularly. Finding your way through all this information can be challenging. This is where good learning resources make a big difference.
A platform like DevOpsSchool focuses on making complex technical topics easier to understand and use. They provide practical training that connects theory with real workplace situations.
Learning from Experienced Teachers
The quality of any training depends greatly on who’s teaching it. Having instructors with real-world experience can help you understand not just what to do, but why certain approaches work best.
The MLOps training program is guided by Rajesh Kumar, who has over twenty years of experience working with technology systems. His background includes practical work with DevOps, cloud technologies, and machine learning systems. Learning from someone with this experience provides valuable insights into how to implement solutions that work in real business situations.
Is MLOps Training Right for Your Career?
If you work with AI, data, or technology systems in the Netherlands, learning about MLOps could be a smart career move. These skills help you build AI solutions that aren’t just clever, but also reliable and practical—exactly what companies need.
Ready to learn how to make AI systems work better in practice? Developing MLOps skills requires focused learning and practice.
If you’re interested in learning more about structured training options:
Email: [email protected]
Phone & WhatsApp (India): +91 84094 92687
Phone & WhatsApp (USA): +1 (469) 756-6329
Website: https://www.devopsschool.com/


View the full article
reporter

Constructing MLOps Frameworks for Machine Learning in India

If you work with machine learning in cities like Bangalore, Hyderabad, or Chennai, you know it’s not just about building smart models. The real challenge starts when you try to use those models in real business situations. That moment—when a great model moves from the lab to the real world—is where MLOps Training in India, Bangalore, Hyderabad, and Chennai becomes essential.
Think of MLOps (Machine Learning Operations) as the bridge between data science and real-world use. It’s like taking a brilliant idea and turning it into something that works reliably day after day. Without proper MLOps, even the smartest AI models can fail in practice. They might work perfectly in testing but struggle when people actually use them.
The Real Problem MLOps Solves
Across India’s tech centers—from the startups in Bangalore to the IT parks in Hyderabad and the growing tech scene in Chennai—teams face similar challenges:
Models that work in the lab but fail in real use “Model drift” where AI performance gets worse over time Teams spending more time fixing problems than creating new solutions Difficulty scaling successful models across an organization MLOps addresses these issues by creating systems that manage the entire lifecycle of machine learning models. It’s what turns experimental AI into reliable business tools.
Why Indian Companies Need MLOps Now
India’s technology sector is growing fast, and AI is becoming crucial across industries. Whether you’re working at a tech company in Bangalore, a financial firm in Chennai, or a startup in Hyderabad, the pressure to deliver working AI solutions is real.
Here’s what changes when you implement MLOps:
Traditional ApproachWith MLOpsModels built in isolationComplete workflow automationManual deployment processesAutomated model deploymentNo system to track performanceContinuous model monitoringTeams work separatelyBetter team collaborationDifficult to scaleEfficient model scaling What Good MLOps Training Should Cover
Learning MLOps isn’t just about understanding concepts—it’s about gaining practical skills you can use immediately. A comprehensive program for MLOps Training in India, Bangalore, Hyderabad, and Chennai should include:
Core Concepts: Understanding what MLOps really means and why it matters Workflow Management: Learning to create smooth, automated processes Version Control: Mastering how to track and reproduce your work Deployment Skills: Learning to deploy models reliably and at scale Monitoring Systems: Setting up ways to watch model performance continuously Best Practices: Understanding industry standards and avoiding common mistakes For professionals in India, especially in tech hubs like Bangalore, Hyderabad, and Chennai, this training provides the fastest path to turning AI projects into real business value.
Finding the Right Learning Path
The field of MLOps is constantly evolving with new tools and techniques emerging regularly. Navigating this landscape alone can be challenging. This is where having the right guidance makes all the difference.
Learning with DevOpsSchool
For those seeking practical, effective MLOps training in India, there are structured programs designed specifically for Indian tech professionals. DevOpsSchool has established itself as a trusted platform for technology education, particularly for in-demand skills like MLOps. Their approach focuses on practical, hands-on learning that translates directly to workplace success.
What makes DevOpsSchool particularly effective is their commitment to current industry practices. They regularly update their curriculum to reflect the latest tools and methodologies used in Indian tech companies, ensuring that what you learn is immediately applicable in your job. Their programs are designed with flexibility in mind, accommodating working professionals across different cities in India.
Guidance from an Experienced Professional
The value of any educational program depends greatly on the experience of those leading it. In the case of MLOps training, learning from someone with extensive real-world experience can make a significant difference in how well you understand and apply the concepts.
The MLOps training is guided by Rajesh Kumar, a professional with over 20 years of experience across various technology domains. His background encompasses practical work with DevOps, DevSecOps, Kubernetes, and cloud technologies, giving him a comprehensive understanding of how MLOps fits within the broader technology landscape. Learning from Rajesh Kumar means gaining insights not just from theoretical knowledge, but from real implementation experience that has been tested and proven in actual business environments.
Is MLOps Training Right for Your Career?
If you’re a data scientist, machine learning engineer, DevOps professional, or technology leader in India looking to bridge the gap between AI development and practical implementation, MLOps Training in India, Bangalore, Hyderabad, and Chennai represents a valuable investment in your career.
It equips you with the skills to build systems that are not just intelligent but also reliable, scalable, and manageable—exactly what businesses need as they adopt AI technologies.
Taking the Next Step
Moving from understanding AI concepts to implementing successful AI systems requires specific knowledge and skills. For professionals in Bangalore, Hyderabad, Chennai, and across India, acquiring these skills through structured learning can accelerate career growth and increase your value to employers.
For those interested in exploring MLOps training options suitable for the Indian market:
Email: [email protected]
Phone & WhatsApp (India): +91 84094 92687
Phone & WhatsApp (USA): +1 (469) 756-6329
Website: https://www.devopsschool.com/


View the full article
reporter

Creating MLOps Workflows for Machine Learning in Canada

If you are working with machine learning anywhere in Canada, you have probably faced a common challenge. Your data scientists create great models in the lab, but getting them to work well in the real world is much harder. This is exactly where MLOps becomes important.
Think of MLOps, or Machine Learning Operations, as the key link between creating a model and running it well for real users. It brings together ideas from DevOps with the special needs of machine learning to build a smooth and dependable system for your AI projects.
Without MLOps, even the best model can struggle. Teams deal with “model drift” where performance gets worse over time, have trouble recreating good results, and spend too much time on manual tasks instead of creating new things. For professionals in Canada’s competitive AI field, using MLOps practices is no longer just an option—it is necessary for delivering AI solutions that last, grow, and earn trust.
Why Is MLOps Important for Success in Canada?
Canada is a world leader in artificial intelligence, with strong communities in its major cities. Whether you work at a startup in Toronto, a financial company in Montreal, or a tech firm in Vancouver, the need to make AI work in practice is huge. MLOps gives you the structure to turn research projects into reliable, production-ready tools.
Here is a simple look at what MLOps helps fix:
Without MLOpsWith MLOpsModels work alone and are hard to track or recreateComplete pipeline automation for consistent, repeatable workManual processes that often lead to mistakesAutomated model deployment and watchingNo good way to notice when performance dropsContinuous model monitoring and scheduled retrainingTeams do not collaborate wellOne system that helps team collaborationGrowing models is difficult and expensiveEfficient model scaling and resource use Using MLOps means your team can put models to work faster, make sure they keep working well, and handle their entire life cycle smoothly. It is the key to moving from experimental AI to AI that works reliably every day.
What Does Good MLOps Training Include?
Good MLOps training needs to give you practical skills, not just ideas. A strong program should cover everything you need to build and manage these systems:
Basics & Workflow Management: Learning core MLOps principles and using tools to organize your work. Tracking & Recreating Work: Mastering model versioning and data versioning so you can always find and repeat your results. Automated Launching: Learning how to automatically model deployment using modern tools for reliable, growing service. Watching & Rules: Setting up continuous model monitoring for performance and fairness, plus model governance for following rules. Continuous Processes for ML: Using continuous integration and delivery practices made for machine learning. For professionals all across Canada, from Toronto to Calgary, this training is the quickest way to build the skills needed to make AI investments pay off.
Finding Your Way in MLOps with Helpful Guidance
The world of MLOps changes fast, with new tools and methods appearing often. Figuring this out by yourself can be tough. This is where learning from a trusted, practical source really helps.
DevOpsSchool has made a name for itself by turning complicated technology ideas into useful, career-building skills. Their method for MLOps training is carefully built to be hands-on. They focus on the tools and frameworks you will actually use at work, making sure learners from Vancouver to Montreal can use what they learn right away.
Learning from an Expert: The Benefit of Rajesh Kumar
How good and relevant any training is depends greatly on who is teaching it. The MLOps training program at DevOpsSchool is led by Rajesh Kumar, someone with over twenty years of experience where development, operations, and advanced data work meet.
Rajesh’s teaching comes from real experience. He shares practical knowledge from building strong, growing systems, having worked deeply with Kubernetes, cloud platforms, and everything from DevOps to DataOps to MLOps. Learning from him gives you not just technical skills but also smart insights into building ML pipelines that are strong, efficient, and meet business needs—a valuable view for any Canadian tech worker.
Is MLOps Training the Right Move for You?
If you are a Data Scientist, ML Engineer, DevOps Engineer, or IT leader in Canada who wants to connect AI development with real-world use, MLOps training is a key step. It helps you build systems that are not just smart, but also reliable, scalable, and easy to manage.
Ready to change how your organization uses AI? Building this knowledge needs a clear path from understanding to doing.
To learn how you can master MLOps and lead AI implementation, get in touch with DevOpsSchool:
Email: [email protected]
Phone & WhatsApp (India): +91 84094 92687
Phone & WhatsApp (USA): +1 (469) 756-6329
Website: https://www.devopsschool.com/


View the full article
reporter

Application Development Using Microservices Patterns in Bangalore

Hello! If you’re working in tech in Bangalore, you’ve likely heard people talk about microservices. Maybe your team is discussing this new approach, or you’ve seen it mentioned in job descriptions and wondered what it really means.
Let’s talk about what microservices are and why they matter for your work, without using complicated terms.
What Are Microservices? A Simple Explanation
Think about how we used to build software. In the old way (called a “monolith”), everything was built together in one big application. It was like having your kitchen, living room, and bedroom all in one room without walls. If you wanted to change something in the kitchen, you might accidentally mess up the living room too!
Microservices change this completely. Instead of one big application, you build many smaller, independent services. Each service handles one specific job really well. For example, an online store might have:
A User Service for logins and profiles A Product Service for the catalog A Payment Service for transactions A Shipping Service for delivery These services talk to each other but are developed and managed separately. This approach makes your software:
Easier to update: You can fix the payment service without touching anything else More reliable: If the product service has a problem, users can still log in Simpler to scale: If many people are searching products, you just add power to the search service Faster to build: Different teams can work on different services at once For Bangalore’s growing tech scene, understanding microservices architecture is becoming very important.
Why Bangalore Companies Are Switching to Microservices
From startups to large companies, everyone seems to be exploring this approach. Here’s why it makes sense:
Traditional Apps (Monoliths)Modern Apps (Microservices)One big, connected codebaseMany small, focused servicesHard to make changesEasy to update parts separatelyEverything uses same technologyDifferent services can use different toolsSlow, risky updatesFast, safe updatesOne team manages everythingMultiple teams can work independently This way of building software supports modern application development and fits well with cloud approaches and DevOps practices.
What Good Microservices Training Should Cover
Learning about microservices isn’t just about definitions. It’s about understanding how to build and manage them properly. Good Microservices training should teach you:
The Basics: How to break down a big app into the right services Communication: How services talk to each other (often using APIs) Data Handling: How each service manages its own information Deployment: How to launch and manage many services Monitoring: How to keep track of everything running Security: How to keep all communication safe This is where having the right learning path makes all the difference.
Finding the Right Learning Help in Bangalore
Bangalore has many learning options, but for hands-on skills like microservices design patterns, you need more than just videos. You need structured learning with expert support.
This kind of practical education is what DevOpsSchool specializes in. They’re known for making complex topics understandable. Their courses focus on real skills—teaching you about containerization, API gateways, and service meshes through exercises that feel like real work.
What makes DevOpsSchool special is their focus on helping students succeed. They create clear learning paths with practical projects and ongoing support. Their courses help you not just understand ideas, but actually use them in your job.
Learning from Real Experience
The Microservices training program is guided by Rajesh Kumar, whose knowledge comes from over 20 years of solving real technology problems. Rajesh doesn’t just teach theory—he shares practical solutions from actual work with cloud platforms and DevOps practices.
Learning from someone with Rajesh’s experience gives you more than technical knowledge. You get insights into how decisions are made in real projects and how to avoid common mistakes.
Is This the Right Time to Learn Microservices?
If you work in software development or DevOps in Bangalore, understanding microservices architecture could help your career. This knowledge helps you build applications that are more flexible and reliable—qualities companies value.
Ready to learn how microservices can improve your work? If you want to move from understanding ideas to building skills, structured training can help you get there faster.
Interested in learning more? Contact DevOpsSchool:
Email: [email protected]
Phone & WhatsApp (India): +91 84094 92687
Phone & WhatsApp (USA): +1 (469) 756-6329
Website: https://www.devopsschool.com/


View the full article
reporter

Hands-On Maven Program for Tech Professionals in Bangalore

Ever feel like working on software projects could be simpler? Maybe you’ve written good code, but then spent hours trying to make it work on a different computer. Or perhaps you’ve searched forever for a missing file. You’re not alone!
What if I told you there’s a way to make your coding projects more organized and less stressful? That’s what Apache Maven does. Think of it as your personal helper for coding projects. It keeps things tidy, finds what you need, and makes building software feel much simpler.
If you’re in Bangalore and want to learn Maven in a way that actually helps your daily work, you’re in the right place. Let’s talk about why Maven matters and how you can learn it in a straightforward way.
Understanding Maven: It’s Simpler Than You Think
Maven is a tool that helps developers manage their projects more easily. Let me explain what it does in everyday words:
It creates order: Maven gives every project the same clear folder structure. This means when you start a new project, you’ll know where everything goes right away. It finds tools for you: When your project needs certain libraries or tools, you just tell Maven what you need. It automatically finds and downloads them for you. No more manual searching! It simplifies building: With just one command, Maven can compile your code, run tests to check for problems, and package everything neatly. This is helpful for developers who want to write code more efficiently, and it’s also great for DevOps professionals who set up automated workflows. Basically, Maven helps teams work together better with fewer headaches.
Who Should Consider Learning Maven?
Developers who want to spend more time coding and less time fixing setup issues DevOps Engineers who create automated systems for their teams Team members who collaborate on software projects Students or career-changers building practical tech skills Anyone who works with code and wants their workday to go more smoothly What Makes Good Maven Training?
A helpful course should teach you both the basics and how to apply them in real work. Here’s what to look for in good training:
Getting started properly: Learning how to set up Maven and understanding its approach Managing project parts: Handling all the components your project needs without getting overwhelmed Working with real examples: Practicing with projects that feel like actual work tasks Team collaboration: Learning how Maven works with other tools your team uses Here’s a simple breakdown of what good training offers:
What You’ll LearnHow This Helps YouSetting up new projectsStart coding faster instead of spending hours on setupManaging project componentsAvoid wasting time looking for missing filesRunning automated testsCatch problems before they become seriousTeam collaboration methodsWork effectively with your teammates Why Consider Learning with DevOpsSchool?
When choosing where to learn, you want guidance from people who actually use these tools daily. That’s where DevOpsSchool truly stands out. They focus on teaching practical skills you can use immediately in your job.
Their approach to Maven training is hands-on and relevant. You’ll practice with examples that resemble real work tasks, and they provide support that continues even after your course ends.
Learn from an Experienced Guide
The course is led by Rajesh Kumar, who brings over 20 years of practical experience. He doesn’t just teach theory—he shares real solutions from actual work situations. Learning from someone with his background means you gain insights that are valuable in today’s workplaces.
How This Improves Your Daily Work
Learning Maven isn’t just about adding another skill to your resume—it’s about making your daily work simpler and more enjoyable. Imagine:
Setting up projects in minutes instead of hours Never searching for missing files again Helping your team solve build problems more efficiently Feeling more confident in your technical abilities These practical skills make you more effective at work and can create new career opportunities.
Ready to Enhance Your Skills?
If you’re ready to organize your projects better and work more efficiently, learning Maven is a great next step. Having the right guidance makes all the difference in how quickly you learn and how well you can apply what you’ve learned.
Interested in learning more? Contact DevOpsSchool today!
📧 Email: [email protected]
📞 Phone/WhatsApp (India): +91 84094 92687
📞 Phone/WhatsApp (USA): +1 (469) 756-6329
🌐 Website: https://www.devopsschool.com/


View the full article
reporter

How to block websites with screentime

We as parents find ourselves with the requirement of blocking certain websites from our children. If your child is lucky enough to have an iPhone, Apple has made this easy to do for us parents.
On your childs cell phone, click Settings and scroll down to Screen Time as shown below

Now click on Content & Privacy Restrictions

Find Web Content and click on that as shown below

You should see a screen similar to the one below. Make sure Limit Adult Websites is checked and below under the Never Allow click Add Website and enter the URL of the website you do not want your child to access.

Simply enter the URL and click done and then you can repeat the process as many times as you want.

Why this is so great is no matter if they are using WiFi or Cell Service.. this configured iPhone will never be able to reach the configured sites using a Browser
Now there is a catch… You kid can download a VPN app which will allow them to still connect to the apps. Search the phone for VPN and see if anything comes up. If it does, delete it!
Porn
Gambling
eChat Rooms
Omegle.com
PalTalk.com
TalkWithStranger.com
ChatRoulette.com
chat-Avenue.com
Chatango.com
Teenchat.com
Wireclub.com
ChatHour.com
Chatzy.com
Chatib.us
E-chat.co
Dating Sites

Tinder
Tinder | Dating, Make Friends & Meet New People
With 55 billion matches to date, Tinder® is the world’s most popular dating app, making it the place to meet new people. Match.com
Bumble.com
MeetMe.com
OKCupid.com
Plenty of Fish (POF.com)
eHarmony.com
Zoosk.com
Hinge.co
Grindr.com
AshleyMadison.com

Cowboy Denny

Warning: React2Shell vulnerability already being exploited by threat actors

Plugging the React2Shell vulnerability in the open source React server and Next.js in IT environments has just become even more urgent with reports that exploits are already in the wild.
Researchers at Greynoise said today they are seeing “opportunistic, largely automated exploitation attempts” trying to take advantage of the unsafe deserialization vulnerability in React Server Components (RSC).
There’s an early focus on attacking just this vulnerability, the report adds, “but we’ve already detected a slow migration of this CVE being added to Mirai and other botnet exploitation kits.”
The initial access attempts are using publicly disclosed proof of concept (PoC) code as a base, Greynoise says, with stage 1 payloads performing proof of execution (PoE) probes (for example, PowerShell arithmetic) to validate RCE cheaply, and using coded PowerShell download-and-execute stagers. Then a stage 2 payload that uses reflection to set System.Management.Automation.AmsiUtils.amsiInitFailed = true (a standard AMSI bypass), and iex executes the next stage.
JFrog’s security research team also today reported finding a working proof of concept that leads to code execution, and they and others have also reported finding fake PoCs containing malicious code on GitHub. “Security teams must verify sources before testing [these PoCs],” warns JFrog.
Amitai Cohen, attack vector intel lead at Wiz, also said today that the firm has seen both proof of concept exploits being published and active exploitation attempts in the wild. “Our threat teams have detected these attempts across customer environments, including deployments of cryptojacking malware and efforts to steal cloud credentials from compromised machines,” he said in an email.
The Greynoise report follows one by New Zealand researcher Lachlan Davidson, who discovered the holes and found that a real proof of concept began circulating about 30 hours after those maintaining React revealed the holes.
Separately, Amazon said its threat intelligence teams have seen active exploitation attempts by multiple China state-nexus threat groups, including Earth Lamia and Jackpot Panda.
AWS has deployed multiple layers of automated protection, including the AWS WAF (web application firewall). But the company stresses these protections aren’t substitutes for patching, even for IT departments running React or Next.js in an Amazon environment.
Related content: Cloudflare firewall reacts badly to React exploit mitigation
If exploited, the vulnerability, tracked as CVE-2025-55182 in React RCS and CVE-2025-66478 specifically for the Next.js framework, allows a threat actor to remotely run malicious code.
Maintained by Meta, React is an open source library for building application interfaces. There are several frameworks that build on top of it, with Next.js being highly popular among developers, so exploiting the vulnerability in RCS can spread to these frameworks.
The critical vulnerability in React Server Components has a maximum Common Vulnerability Scoring System (CVSS) score of 10. Affected are React versions 19.x and Next.js versions 15.x and 16.x when using App Router.
The problem specifically is in RCS’s Flight protocol, used for communications with clients such as browsers. RCS, notes Greynoise, is a high value target since it sits in front of application logic that often runs with production permissions.
“Thanks to services such as BuiltWith/Wappalyzer, the exposed services are easy to find and exploit at scale,” Greynoise warned.
However, there are some nuances in these early reports of proofs of concept.
Davidson noted that the day-0 protections from some application security providers are actually runtime-level, and not just web application firewall rules. That means many customers with theoretically vulnerable versions are still protected, he wrote.
Amazon added that analysis of data from its honeypot shows the persistent nature of some exploitation attempts. In one notable example, an unattributed threat cluster associated with IP address 183[.]6.80.214 spent nearly an hour on Thursday systematically troubleshooting exploitation attempts.
This included 116 total requests directed at a target over 52 minutes, attempts at placing multiple exploit payloads, attempts at executing Linux commands, attempts to write files to /tmp/pwned.txt, and attempts to read /etcpasswd.
“This behavior demonstrates that threat actors aren’t just running automated scans,” Amazon said, “but are actively debugging and refining their exploitation techniques against live targets.
Edgar Kussberg, project lead for AI and development tools at Sonar, said to blunt attacks, developers or infosec teams should:
run an analysis: Deploy tests to find vulnerable code and misconfigurations before an attacker can; get a clean signal: Focus on finding and fixing true positives and the most severe vulnerabilities; verify code against updated rules: Ensure all defensive software is updated with the latest rules designed to detect and flag the specific React2Shell pattern, not just generic parameters.
View the full article
reporter

Warning: React2Shell vulnerability already being exploited by threat actors

Plugging the React2Shell vulnerability in the open source React server and Next.js in IT environments has just become even more urgent with reports that exploits are already in the wild.
Researchers at Greynoise said today they are seeing “opportunistic, largely automated exploitation attempts” trying to take advantage of the unsafe deserialization vulnerability in React Server Components (RSC).
There’s an early focus on attacking just this vulnerability, the report adds, “but we’ve already detected a slow migration of this CVE being added to Mirai and other botnet exploitation kits.”
The initial access attempts are using publicly disclosed proof of concept (PoC) code as a base, Greynoise says, with stage 1 payloads performing proof of execution (PoE) probes (for example, PowerShell arithmetic) to validate RCE cheaply, and using coded PowerShell download-and-execute stagers. Then a stage 2 payload that uses reflection to set System.Management.Automation.AmsiUtils.amsiInitFailed = true (a standard AMSI bypass), and iex executes the next stage.
JFrog’s security research team also today reported finding a working proof of concept that leads to code execution, and they and others have also reported finding fake PoCs containing malicious code on GitHub. “Security teams must verify sources before testing [these PoCs],” warns JFrog.
Amitai Cohen, attack vector intel lead at Wiz, also said today that the firm has seen both proof of concept exploits being published and active exploitation attempts in the wild. “Our threat teams have detected these attempts across customer environments, including deployments of cryptojacking malware and efforts to steal cloud credentials from compromised machines,” he said in an email.
The Greynoise report follows one by New Zealand researcher Lachlan Davidson, who discovered the holes and found that a real proof of concept began circulating about 30 hours after those maintaining React revealed the holes.
Separately, Amazon said its threat intelligence teams have seen active exploitation attempts by multiple China state-nexus threat groups, including Earth Lamia and Jackpot Panda.
AWS has deployed multiple layers of automated protection, including the AWS WAF (web application firewall). But the company stresses these protections aren’t substitutes for patching, even for IT departments running React or Next.js in an Amazon environment.
Related content: Cloudflare firewall reacts badly to React exploit mitigation
If exploited, the vulnerability, tracked as CVE-2025-55182 in React RCS and CVE-2025-66478 specifically for the Next.js framework, allows a threat actor to remotely run malicious code.
Maintained by Meta, React is an open source library for building application interfaces. There are several frameworks that build on top of it, with Next.js being highly popular among developers, so exploiting the vulnerability in RCS can spread to these frameworks.
The critical vulnerability in React Server Components has a maximum Common Vulnerability Scoring System (CVSS) score of 10. Affected are React versions 19.x and Next.js versions 15.x and 16.x when using App Router.
The problem specifically is in RCS’s Flight protocol, used for communications with clients such as browsers. RCS, notes Greynoise, is a high value target since it sits in front of application logic that often runs with production permissions.
“Thanks to services such as BuiltWith/Wappalyzer, the exposed services are easy to find and exploit at scale,” Greynoise warned.
However, there are some nuances in these early reports of proofs of concept.
Davidson noted that the day-0 protections from some application security providers are actually runtime-level, and not just web application firewall rules. That means many customers with theoretically vulnerable versions are still protected, he wrote.
Amazon added that analysis of data from its honeypot shows the persistent nature of some exploitation attempts. In one notable example, an unattributed threat cluster associated with IP address 183[.]6.80.214 spent nearly an hour on Thursday systematically troubleshooting exploitation attempts.
This included 116 total requests directed at a target over 52 minutes, attempts at placing multiple exploit payloads, attempts at executing Linux commands, attempts to write files to /tmp/pwned.txt, and attempts to read /etcpasswd.
“This behavior demonstrates that threat actors aren’t just running automated scans,” Amazon said, “but are actively debugging and refining their exploitation techniques against live targets.
Edgar Kussberg, product lead for AI and development tools at Sonar, said to blunt attacks, developers or infosec teams should:
run an analysis: Deploy tests to find vulnerable code and misconfigurations before an attacker can; get a clean signal: Focus on finding and fixing true positives and the most severe vulnerabilities; verify code against updated rules: Ensure all defensive software is updated with the latest rules designed to detect and flag the specific React2Shell pattern, not just generic parameters.
View the full article
reporter

MacRumors 2025 Holiday Gift Guide

If you're looking for the perfect tech or tech-adjacent present for someone who loves Apple products or just uses them daily, I have a few suggestions that might be helpful to you this holiday season.


These are some of our favorite products, many of which I use personally or have gifted to our friends and family members in the past. If you're still looking for a present for someone that's hard to shop for, check out the list.

Maclock

For Apple fans or fans of classic PCs, the Maclock is a tiny Macintosh 128K that works as an alarm clock. It is super detailed and has all of the design touches of the original, and there's even a tiny floppy disk that turns it on when you put it in.


There are multiple display modes, and it can tell you the time, day of the week, and temperature, plus it is a functional alarm clock. There's also a classic Mac face you can set it to. I haven't gifted it yet, but I bought one of these a few weeks ago. It does ship from China, so order ASAP.

I've seen a few different versions of this product, but this variant has no third-party logo on the front, and it's just $30.

If you want to spend a bit more, RayCue has some retro-style Macs that are actually designed to be docks. I haven't used one, but it looks like a fun desktop accessory.


Pico-Mac-Nano

While I'm on the subject of mini Macs, I don't want to leave out the Pico-Mac-Nano from Nick Gillard. The Maclock is palm-sized, but the nano is even smaller at just under 2.5 inches, plus it has an actual Mac operating system. Gillard did sell these fully assembled at one point, but Apple asked him to stop.


You can still get the parts to make one, and Gillard has instructions. There's a full kit for GBP62.00 (around $100 shipped to the U.S.), and it would be a great gift for someone who likes retro items and a project.

Aura Frames

Priced starting at $149, Aura digital frames make a good gift for anyone who has digital photos, which is most of us these days. You can load photos on the frame using the Aura iPhone app, and since images are stored in the cloud, there's no limit.


Multiple people can upload images to a single frame, so it's a great way to share photos with friends and family members. If you know someone that's not technically savvy, like a grandparent, it's still the perfect gift because you can load photos for them remotely. The $149 10.1-inch Carver is Aura's most affordable option, but there are sizes up to 15 inches, like the $299 Walden. Aura also makes higher resolution options, including the $199 Mason, and all the frames come in multiple colors to match any decor.


Everyone I've gifted an Aura frame to has loved it, and it's my go-to for people that are hard to shop for. This year, Aura launched a frame that uses e-ink for a softer, more art-like look. It changes images less often and it's expensive at $449, but it has a different vibe than your standard photo frame.



LEGO Retro Radio

Priced at $100, the Retro Radio from LEGO has a sweet, nostalgic design, complete with a tuner, knobs, and speaker grille. It's actually functional, because you can remove the back plate from the set and place an ‌iPhone‌ inside so that the radio plays music.


There's a built-in smartphone stand that holds the ‌iPhone‌ in place, but if you don't want to use an ‌iPhone‌, there's also a little sound brick that plays different sounds when you turn the knob. I have one of these, and it was a fun build.


There are other LEGO sets that make for good gifts, even for people who aren't LEGO collectors. Anyone that likes a puzzle would probably like a LEGO set, and some have wide appeal. Here are a few I've gotten this year that would make for good gifts:

LEGO Super Mario Game Boy ($60) - This isn't a working Game Boy, unfortunately, but it does come with swappable screens and LEGO game cartridges. It is possible to make a working version if you're so inclined.
LEGO Botanicals Happy Plants ($19) - I'm a fan of the LEGO botanicals, and this set is small, inexpensive, and fun for the desktop.
LEGO Botanicals Hibiscus ($70) - All of the LEGO botanicals make good gifts (I'm gifting a set of flowers and a bonsai this year), but the hibiscus is a newer set that has a unique flower shape and it comes with a pot so it matches sets like the orchid. Other great botanical options include the mini bonsais and the tiny plants set (a personal favorite).
LEGO Kingfisher ($40) - This set was a lot of fun to put together, and it makes a great desk display because of its bright colors. It would be nice for a bird lover.
LEGO Insects ($63) - This set has a butterfly, a Hercules beetle, and a praying mantis, and it's another excellent display piece. This one is delicate and can be a little frustrating, but it's one of my favorites in the ideas series.

I do buy LEGO set gifts for people who aren't into LEGO and who haven't done one before, and it tends to go over well.

Nanoleaf Display Boxes

Earlier this year, I reviewed the Nanoleaf LED Expo Display Cases, and they're one of my favorite Nanoleaf products to date. They're far from cheap at $270, but they would make an excellent gift for someone that collects high-end sneakers, anime figures, or anything in that vein. The boxes can be set to 16 million colors or shades of white, and colors can change in time with music.


I think Nanoleaf designed these for sneaker collectors, but anything can be put inside. Like a lot of Nanoleaf devices, these aren't going to go with every decor choice, but collectors and gamers will love them.


AirPods

You'll never go wrong with AirPods as a gift, and there are two really good options to choose from this year. The AirPods Pro were just refreshed with a third-generation version, and for $249, you get excellent Active Noise Cancellation and sound quality.


The AirPods Pro 3 have a new design that's more ergonomic and foam-infused silicone tips that fit snugly in the ears to drown out sound. With hearing aid support, ‌AirPods Pro 3‌ could be useful for a family member that has mild hearing loss but doesn't wear hearing aids.

If you're purchasing for someone who doesn't like silicone ear tips, the AirPods 4 are an option. You can get them with or without Active Noise Cancellation. The ANC version doesn't cut out as much noise as the ‌AirPods Pro 3‌, but it's enough to make a difference.


The AirPods 4 with ANC are a steal at $99 from Amazon right now, so it's not even worth getting the non-ANC version.

I prefer the AirPods Pro fit and ANC over the ‌AirPods 4‌ because I have smaller ears and the ‌AirPods 4‌ can be painful. The AirPods Pro can drown out the sound of the heater, leaf blowing outside, the TV in the next room, road noise, and other sounds that sometimes drive me nuts. The ‌AirPods 4‌ are so inexpensive, though, that they're a great option on a budget.

Philips Hue Lights

I think I've tried every HomeKit smart bulb and light available at this point, and Philips Hue lights are the best you can get. I have no patience for lights that constantly disconnect or have connectivity issues, and the Hue bulbs don't. There is a $65 to $100 Bridge, but it's worth it. I mostly use Hue lights, and I've invested hundreds of dollars in my setup over time. Bulbs I have from almost 10 years ago are still functional.


The $143 White and Color Starter Kit comes with two Hue bulbs that can go in any lamp that supports E26 bulbs, and it comes with the hub. It's one of the best bets if you're buying a gift for someone who is new to smart home products. The bulbs can be controlled with the Home app or the Hue app, and they can be set to 16 million colors. Hue has great light effects and scenes that really shine when you have multiple bulbs.



For a cheaper option, there's the $99 Essentials Starter Kit that comes with a hub and four lower-power E26 multi-color bulbs. Hue Essentials bulbs don't dim quite as low and the color isn't as precise.



Lightguide bulbs ($99) - These are perfect paired with a simple lamp base, because the bulb is meant to be the star. I have two of the ellipse bulbs, and they're enormous and look great.
String lights ($132) - For holiday fans or those with patio setups crying out for lighting, the Hue Festavia String Lights would make a good gift.
Signe floor lamp ($363) - The Signe floor lamp isn't the most practical light because it doesn't have a wide radius and is meant to face the wall, but it makes for great accent lighting.
Hue Go ($99) - The Hue Go is a portable lamp that you can use plugged in or with the built-in battery, and it supports all of the same features as Hue bulbs. It's a nice accent light and good to have around for power outages.
Hue Go Portable Table Lamp - This is a lot like the Hue Go, but it's a more traditional looking lamp. It's water resistant, so it can go outdoors, too. I haven't tried this one yet, but it's on the wishlist.
Downlights ($66) - If you know someone that has those old can style downlights, a Hue upgrade would make a good gift. Downlights are super simple to swap out, and switching from the older models to Hue saves money and adds new lighting options. I switched all the downlights in my house to Hue and have no regrets.
Outdoor Lights ($176+) - I swapped my porch lights and the lights in the back to Hue lights this year. It's more involved than downlight swaps, but provides fun lighting options for the holidays. I installed two of the Appear and three of the Econic, all of which have been working flawlessly. I use these with motion detectors. Hue also has some Festavia globe outdoor lights that look amazing, but I haven't tried them.


Bambu Lab 3D Printer

Bambu Lab makes a range of 3D printers that you can print to using just an app on your ‌iPhone‌ or your Mac. The A1 Mini is just $219, or $329 with the AMS Lite that lets you print with up to four filament colors. Bambu's printers are sort of the ‌iPhone‌ of 3D printers in that they're relatively easy to operate and have a lot of bells and whistles to streamline printing and cut down on issues. Models like the H2S and P2S come with an enclosure, and there are now several machines like the H2D that also have a laser cutting module.


I've had a Bambu X1C for over two years now and do not hesitate to recommend Bambu printers for those interested in getting into 3D printing. It's easy to use, there are thousands of STLs out there for making everything you can think of, and you can even make your own using software like Tinkercad, Fusion 360, or even Nomad Sculpt on the iPad. I use my 3D printer weekly, if not daily, and Bambu printers get better all the time with new print options from Makerworld.


I haven't personally used the A1 Mini, but it's a much more affordable way to try 3D printing, and it could make a great gift for an older child or a partner who likes to tinker. They're not entirely problem free, but I've been able to solve every issue I've run into, and there are endless settings to optimize.

Portable Anker Chargers

I reviewed portable power banks from several different brands this year, and I have two favorites that I keep coming back to from Anker.


I love the $54 MagGo Nano Power Bank for wireless charging. It's the slimmest MagSafe power bank that I've tried, and it's so much better than thicker, bulkier models. I have a 17 Pro Max and it doesn't bother me to use it with the power bank attached because it doesn't add too much extra weight. It's only a 5,000 mAh battery so I don't get a full charge, but it's more than enough to get me through a day of heavy phone usage.

My other favorite is the $60 Nano Power Bank with Retractable Cable. I didn't love this one right when I tried it because it's thick and rectangular, but it's turned out to be the power bank that I reach for most often. I like the lanyard, and the retractable USB-C cable is useful because I never need to hunt one down. I tend to prefer this power bank even over the magnetic model because the wired charging is much faster. Next time there's a sale, I plan to pick up another in teal.



Ugreen Uno Chargers

Ugreen's "Uno" line features chargers with fun little faces, and I think they're great.


There's a $35 65W charger with four ports, which has legs and a digital panel with face emoji that change based on charging state. When a device is fast charging, for example, there's a face that looks like it has its mouth full, and when charging is finished, there's a little face with sunglasses. I've used this one on my desktop power strip for the last year.


There are also two power banks that have the little emoji faces, one that's 5,000 mAh with Qi2 for $35, and one that's 10,000 mAh with USB-C for $50. They come with built-in stands that look like little headphones, which is a nice touch because you can use the stand for watching videos or FaceTiming. When I want to charge and need a stand, I use these.

Nimble's Wall Chargers

Nimble has $42 65W Wally Wall Chargers that come with a retractable 2-foot USB-C cable, and I love them. The prongs fold down and the cable retracts inside the enclosure, so they're ideal for travel. I have a cat that likes to nibble cables, and these keep the cable out of the way unless I'm charging. There's an extra USB-C port at the bottom so you can actually charge two devices at once.


If you buy them from Apple, you can get fun colors that include deep purple or teal, though they're more expensive at $60. Nimble also has power banks in colors you don't often see, and I am a fan, but I don't love having to supply my own USB-C cable.

Bird Buddy

Available starting at $99, the Bird Buddy is the kind of gift that almost anyone will like, which makes it great for the person that has everything. It's a Wi-Fi connected smart bird feeder that sends you pictures of the birds that come to visit.


You'll need to fill it with seed regularly and charge it up when necessary, but other than that, it operates on its own. To do away with charging, I recommend the solar version, which starts at $149.


I've gifted the Bird Buddy and it's been a huge hit, with adults and kids too.

Birdfy Bird Feeders

Birdfy is a lot like Bird Buddy, but it has product options that Bird Buddy doesn't offer. You can get a standard Bird Feeder for the same $99 price as Bird Buddy, but if you're willing to spend a little more, there's a bigger version with multiple cameras.


The $330 Birdfy Feeder 2 Duo has a triple-lens camera, including a dual-lens front camera and a second side camera to capture birds from every angle. It holds more seed than a standard version and comes with a solar panel. If you've gifted someone a Bird Buddy and they love it, this is the next upgrade option.

Birdfy also sells the Bath Pro, which is a solar-powered smart birdbath with a camera. It's priced starting at $200 and lets you get photos of birds bathing and drinking. In some areas of the U.S., people in apartments and condos aren't able to put out bird feeders because of rats and pigeons. This is an excellent gift for someone that wants to attract birds but isn't able to have a feeder, but it's also great for avid birders.


With bird feeders, you often need a specific kind of food to attract the birds you want, but a bird bath has more universal appeal.

Govee Light Projectors

Govee came out with some Matter-enabled projectors this year that can project stars or ocean scenes onto the walls and ceiling. I've been testing these for a month or so and have a review coming soon, but I think the lower-priced models would make a good gift.


The $56 Star Light Projector has different night sky light effects paired with laser stars, while the $50 Ocean version has more of an under-the-sea vibe. There's a $180 Pro model with swappable galaxy scenes and laser stars, but it's really best for the real space projector enthusiast.

Robot Vacuums

I tested several Matter-enabled robot vacuums this year, and I am sold. These are excellent at vacuuming and mopping, and can be real time savers. I particularly liked the Deebot X11 Omnicyclone, the Deebot X9 Pro, and the Roborock Saros 10R. Some of these are over $1,100, but you get what you pay for.


I've tested some lower-cost versions and have a review in the works, but the lower-end models I've used lack the navigation capabilities of the more expensive versions and add a lot more frustration to the cleaning process. Not all brands are the same, though, so it's worth some research on the best option.

Epson EcoTank Photo ET-8550

For printing photos, Epson's printers are some of the best, though Canon has its fans too. I recently got the EcoTank Photo ET-8550, and I think it's a great option if you want to get your images off of your phone.


It's normally $800, but Best Buy has it for $500 right now. EcoTank printers are more expensive than your standard printer because the ink is cheap. These use refillable liquid ink rather than printer cartridges, and that is the main reason why I chose this model.

Epson has to make its on the printer upfront because the ink lasts so much longer and is so much more affordable. There are other EcoTank printers that aren't as expensive, but this one is optimized for images and prints at up to 13"x19".

Plant Grow Lights

An iPhone-connected light is a great gift for someone that's into plants, and you will never go wrong with a light for an indoor plant collector.


I like Modern Sprout light options for the clean aesthetic. There's a $90 light bar, a $200 grow house ideal for the kitchen counter, and a $270 Growframe that goes on the wall. The app lets you set the brightness and the schedule for the lights, which is essential.

Aerogarden is also a good option, with prices that start at $16. I have the $50 AeroGarden Tabletop Grow Light that I've been using for a few years, and it works well. The lights are programmable with the Aerogarden app.

$349 iPad and Apple Pencil

For someone who is creative or wants to get into drawing, 3D sculpting, modeling, or similar, an ‌iPad‌ with an Apple Pencil is the best possible gift. Apps like ProCreate and Nomad Sculpt are powerful, and the ‌Apple Pencil‌ gives you a level of control that's hard to get on a Mac or PC.


The ‌iPad‌ does a lot and it's an ideal gift for anyone, but it could really spark the creativity of an artistic child, or provide a new medium for an adult that already likes to sketch and draw. I have an iPad Pro with an ‌Apple Pencil‌ Pro, but all of Apple's iPads can be used with an ‌Apple Pencil‌, even the $349 model.

The $499 iPad mini is the best for something to use on the go, and the $899 13-inch iPad Air is a good option if you want the biggest screen without paying ‌iPad Pro‌ prices.

Gift Suggestions

Have a great product suggestion we don't have in our list? Let us know in the comments below.

Note: MacRumors is an affiliate partner with some of these companies and may earn commissions on purchases made through links in this article.
This article, "MacRumors 2025 Holiday Gift Guide" first appeared on MacRumors.com

Discuss this article in our forums

View the full article
reporter

Insecure use of Signal app part of wider Department of Defense problem, suggests Senate report

The Signalgate scandal that enveloped US Secretary of Defense Pete Hegseth in March appears to be symptomatic of a wider lax attitude towards the use of non-approved messaging apps by officials and employees, a Senate Committee has concluded.
In March, the US Senate Committee on Armed Services set out to examine issues raised by the Signalgate incident: the need to clarify the existing rules on using “non-controlled” apps, and looking at whether Defense Secretary Hegseth adhered to them in his use of Signal, and whether his actions were evidence of a wider culture of insecure app usage within the Department of Defense (DoD).
This week’s dual reports have come back with a mixed assessment of these points. Broadly, what Hegseth was accused of doing – communicating sensitive information using a third-party messaging app – appears to have been happening at the DoD in less serious contexts since at least 2020.
This mirrors issues familiar to enterprises: unsanctioned or unmanaged messaging apps, including ones touting end-to-end encryption (E2EE) security, quickly become an IT backchannel that can invisibly undermine carefully-assembled security, compliance, and data retention policies.
Shadow communications
The first report, an assessment of the Defense Secretary’s use of the Signal app to communicate with senior colleagues in advance of a military operation against Yemen on March 15, is used to illustrate the point. It confirms the widely reported fact that two hours before the raid, Hegseth revealed details of the operation to a Signal group of 19 people, including a journalist who had been added to it in error.
In doing so, the report agrees he violated security policies by sending sensitive information from a personal device, and using the non-approved Signal app in a way that revealed important operational details in advance of the strike. The report ducks the issue of whether this information was classified at the time it was sent, noting that Hegseth was senior enough to determine this for himself.
The second background report has uncovered evidence of a more general culture of shadow communications in the DoD, including widespread use of video-conferencing apps during the Covid 19 pandemic.  
The evidence gathered is sparse and partly redacted, making it difficult to assess the seriousness of any breaches. Because the scope of its remit was limited to the evidence from previous audits, one of the committee’s recommendations is to undertake a more comprehensive assessment of unsanctioned app usage inside the DoD. There’s also a question mark around how old audits analyzed by a Senate committee could accurately measure something that, by its nature, is hidden and only recorded on personal devices.
Nevertheless, the report says it is certain that Hegseth’s actions were not an isolated example, noting that staff had “used non-DoD-controlled electronic messaging systems for a variety of reasons. For example, some personnel used them because of the systems’ perceived appearance of security. As a result, DoD personnel increased the risk of exposing sensitive DoD information to our adversaries and did not comply with the legal obligation to retain and preserve official records.”
In short, while there was no evidence that unsanctioned app use is routine or normalized, it is likely that enough staff are using them to make a serious breach possible at some point. The report concludes that one of the reasons staff have taken to these messaging apps was that they lack convenient alternatives. It recommends developing approved apps to remove this need, implementing a training program to ensure existing communication regulations are complied with, and limiting the authority to use messaging apps to senior staff, in specific circumstances.
What’s surprising about this is that it has taken a major political row at government level to raise an issue that enterprise CISOs have been grappling with for years: the effects of BYOD, shadow IT (and now shadow AI), and unsanctioned apps that creep into organizations without anyone realizing it.
Over the last two decades, the rise of mobile devices, the cloud, and apps has radically de-centralized IT in ways that top-down management models struggle to control. Meanwhile, nothing has changed; the Signal app at the center of this scandal remains hugely popular on both sides of the political divide, despite the appearance of additional issues with the technology. 

View the full article
reporter

Chinese cyberspies target VMware vSphere for long-term persistence

Chinese state-sponsored threat actors are backdooring VMware vCenter and VMware ESXi servers with a malware program written in Go, allowing them to maintain long-term persistence in victim networks. According to a joint report by the US Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency (NSA), and Canadian Centre for Cyber Security (Cyber Centre) organizations from the government services and facilities and IT sectors have been the primary targets.
The malware program, known in the security industry as BRICKSTORM, was first reported by researchers from Mandiant and Google’s Threat Intelligence Group in September. At the time, Google said the backdoor remained undetected for 369 days on average and was found inside the networks of US legal services firms, SaaS providers, business process outsourcers, and technology companies.
For its part, CISA has thus far analyzed eight separate BRICKSTORM samples, including one collected from a VMware vCenter server of an organization where the infection went undetected for over a year and a half allowing attackers to move laterally through the network.
From web shell to domain control
In the incident investigated by CISA, the attackers originally compromised a public-facing web server, though it’s unclear through what method. This was followed up by the deployment of a web shell — essentially a web script that serves as a backdoor to enable the attackers to remotely execute commands on the server.
From the web server, the attackers were able to extract credentials for a service account and used it to access a domain controller from where they copied the Active Directory database. Credentials for a second service account were used to access another domain controller on the internal network and copy the AD database, which included credentials used by a managed service provider (MSP).
Using the MSP credentials, the attackers were able to access a VMware vCenter server and deployed the BRICKSTORM malware in the /etc/sysconfig/ directory.
Designed to work in virtualized environments
The CISA, NSA, and Canadian Cyber Center analysts note that some of the BRICKSTORM samples are virtualization-aware and they create a virtual socket (VSOCK) interface that enables inter-VM communication and data exfiltration.
The malware also checks the environment upon execution to ensure it’s running as a child process and from a specific path. This is part of a set of self-monitoring capabilities that ensure its persistence by reinstalling and executing itself if it detects something is not running correctly.
The malware mimics web server functionality for its command-and-control (C2) communication to blend in with legitimate traffic. It also provides a SOCKS5 proxy for attackers to tunnel traffic during lateral movement operations.
In terms of features, BRICKSTORM allows threat actors to browse the file system and execute shell commands, providing them with complete control over the compromised system.
“Once the secure connection to the C2 domain is established, Sample 1 uses a custom Go package wssoft2 to manage incoming network connections and to process commands it receives,” the CISA analysts said. “Commands are directed to one of three handlers based on the function it needs: SOCKS Handler, Web Service Handler, and Command Handler.”
Mitigations
The joint advisory includes indicators of compromise for the analyzed samples as well as YARA and Sigma detection rules. The agencies also make the following recommendations:
Upgrade VMware vSphere servers to the latest version. Harden your VMware vSphere environments by applying VMware’s guidance. Take inventory of all network edge devices and monitor for any suspicious network connectivity originating from these devices. Ensure proper network segmentation restricts network traffic from the DMZ to the internal network. Disable RDP and SMB from the DMZ to the internal network. Apply the principle of least privilege and restrict service accounts to only needed permissions. Increase monitoring for service accounts, which are highly privileged and have a predictable pattern of behavior (e.g., scans that reliably run at a certain hour of the day). Block unauthorized DNS-over-HTTPS (DoH) providers and external DoH network traffic to reduce unmonitored communications. View the full article
reporter
OHC_logo_transparent_01.jpeg flags-medium.png OHC_logo_blue_square_small.jpeg

 

Account

Navigation

Search

Search

Configure browser push notifications
Chrome (Android)
  1. Tap the lock icon next to the address bar.
  2. Tap Permissions → Notifications.
  3. Adjust your preference.
Chrome (Desktop)
  1. Click the padlock icon in the address bar.
  2. Select Site settings.
  3. Find Notifications and adjust your preference.