openstack

Chen YuXiang discovered that OpenStack Aodh did not correctly enforce project scoping in its alarm list API and that the OpenStack Watcher webhook trigger endpoint did not apply authorization. An attacker could possibly use this issue to access sensitive alarm metadata or trigger unauthorized action plans.

It was discovered that OpenStack Designate did not properly validate overlapping zones under certain circumstances. An authenticated user could possibly use this issue to redirect DNS traffic to attacker-controlled systems or cause a denial of service.

Grzegorz Grasza discovered that OpenStack Keystone did not consistently enforce restrictions for delegated authentication tokens. An authenticated attacker could possibly use this issue to create credentials or delegations that outlasted the delegated token. (CVE-2026-80182) It was discovered that OpenStack Keystone incorrectly handled role assignment queries under certain circumstances. An authenticated attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-80183) Tim Shephard discovered that OpenStack Keystone did not properly restrict reauthentication using delegated tokens. An authenticated attacker could possibly use this issue to escape their intended project scope and obtain unauthorized access. (CVE-2026-80184)

Attackers have compromised a self-hosted JFrog Artifactory instance operated by OpenInfra Europe, the regional hub of the OpenInfra Foundation warned in a security notice prominently displayed on its homepage. OpenInfra Europe’s security incident notice “Anyone who downloaded or installed artifacts from https://artifactory.nordix.org/ from August 28 and September 15, 2026 should immediately stop using them, remove them from their pipelines, and treat these packages as potentially compromised,” the message says. Compromise through CVE-2026-82329 The OpenInfra Foundation … More → The post OpenInfra Europe’s JFrog Artifactory instance breached, packages potentially compromised appeared first on Help Net Security .

It was discovered that OpenStack Swift incorrectly handled truncated aws-chunked PUT request bodies in its s3api middleware. An authenticated attacker could possibly use this issue to cause OpenStack Swift to use excessive resources, leading to a denial of service.

Cybersecurity jobs available right now: September 8, 2026 CISO AudioCodes | Israel | Hybrid – View job details As a CISO, you will lead security strategy, governance, and risk management across SaaS, managed services, and customer-hosted environments. You will oversee security controls, incident response, Secure SDLC, customer security engagements, and compliance with SOC 2 and ISO 27001, while partnering across Product, R&D, IT, and Services to continuously strengthen security. Combat Systems Cyber Engineer Johns Hopkins Applied Physics Laboratory | USA | On-site – View job details As a Combat Systems Cyber Engineer, you will identify cyber vulnerabilities and develop resilient solutions for U.S. Navy submarine and combat systems. You will collaborate with developers, Navy labs, and government teams to design, plan, and execute cyber resiliency testing and assessments of mission-critical combat systems. Cyber Security Engineer (Cloud Security) Garmin | USA | On-site – View job details As a Cyber Security Engineer (Cloud Security), you will design and secure cloud solutions across AWS and Azure, including network, compute, storage, databases, and load balancing. You will support CNAPP, Kubernetes, EKS, AKS, Docker, OpenStack, CI/CD pipelines, and Infrastructure as Code. You will automate security workflows using Python, PowerShell, or Bash, secure cloud-native and containerized applications, and collaborate with engineering teams to improve security, compliance, threat detection, and response. Get weekly updates on new cybersecurity job openings. Subscribe here! Cyber Security Lead Babcock International Group | United Kingdom | On-site – View job details As a Cyber Security Lead, you will lead secure-by-design assurance for UK Defence Nuclear Enterprise programmes, ensuring alignment with Ministry of Defence security requirements. You will conduct threat modelling and cyber risk assessments, develop mitigation strategies, produce security evidence, and guide engineering and architecture teams in embedding security throughout the system lifecycle. Cyber Threat Hunter GDIT | USA | On-site – View job details As a Cyber Threat Hunter, you will identify and investigate threats across ARNG networks, endpoints, and datasets using threat intelligence, hypothesis-based hunting, and the MITRE ATT&CK framework. You will analyze security data using platforms such as Elastic and Splunk, assess cyber risks, investigate intrusions and malware activity, and identify detection gaps. IAM Architect Scotiabank | Canada | On-site – View job details As an IAM Architect, you will design enterprise CIAM solutions using ForgeRock, Ping, and PingOne, aligned with FIDO, OIDC, OAuth, MFA, and NIST 800-63B standards. You will define secure authentication architectures, support application migrations, evaluate capabilities such as Passkeys, and collaborate with engineering, security, fraud, compliance, and business teams. Information System Security Engineer (ISSE) Akima | USA | On-site – View job details As an Information System Security Engineer (ISSE), you will design and assess secure architectures aligned with NIST, DoD, Zero Trust, RMF, STIGs, and SRGs. You will conduct threat modeling and vulnerability assessments, implement security controls and automated monitoring, support accreditation and POA&M remediation, and provide technical guidance throughout the system lifecycle. OCI IAM Security architect ValueLabs | India | Remote – View job details As an OCI IAM Security architect, you will design and secure OCI environments using IAM, Identity Domains, MFA, PAM, vault, data safe, cloud guard, security zones, WAF, network firewall, and NSGs. You will enforce zero trust, RBAC, and least privilege, integrate OCI logging with SIEM platforms, lead threat detection and incident response, and ensure compliance with PCI-DSS, HIPAA, GDPR, SOC 2, ISO 27001, and CIS benchmarks. Penetration Tester Spektrum | Belgium | On-site – View job details As a Penetration Tester, you will lead Red/Blue Team activities during NATO exercises and conduct web, infrastructure, and application penetration testing. You will perform security design reviews, support NATO security accreditation, provide security consultancy, and communicate testing findings to technical and executive stakeholders. SOC Analyst Orro Group | Australia | Hybrid – View job details As a SOC Analyst, you will investigate SIEM alerts, emerging threats, phishing, and intrusion attempts while managing incidents from triage through resolution. You will conduct threat hunting and vulnerability assessments, improve detection rules and alert quality, and mentor junior SOC analysts. Security Automation Engineer Secur-Serv | USA | Remote – View job details As a Security Automation Engineer, you will lead Cortex XSOAR implementations and operations, developing automated incident response playbooks and integrating security technologies. You will translate customer requirements into effective SOAR solutions, provide technical leadership, and communicate with engineering and executive stakeholders. Security Operations Analyst Subway | USA | On-site – View job details As a Security Operations Analyst, you will detect and investigate identity threats using CrowdStrike Falcon Identity Protection and Next-Gen SIEM. You will manage Okta Identity Governance, privileged access, incident response, and PCI-DSS 4.0 compliance, while handling Tier-2/3 escalations in ServiceNow and improving identity security controls and automation. Senior Cybersecurity Operations Researcher Software Engineering Institute | Carnegie Mellon University | USA | On-site – View job details As a Senior Cybersecurity Operations Researcher, you will conduct analytical studies involving cybersecurity risk, threat, and security data while assessing evolving operational and network defense challenges. You will apply expertise in enterprise cybersecurity, commercial and open-source defense tools, and project management to support multidisciplinary programs. Senior Cyber Security Engineer Rolls-Royce | USA | Remote – View job details As a Senior Cyber Security Engineer, you will design, implement, and maintain network and cloud security solutions, including firewalls, VPNs, IDS/IPS, NAC, SIEM, EDR, and DLP. You will monitor security events, assess vulnerabilities, mitigate risks, and maintain security policies and best practices. Senior Network Security Engineer Penta Consulting | UAE | On-site – View job details As a Senior Network Security Engineer, you will lead network and security changes and deliver complex Cisco infrastructure and security projects. You will provide technical consultancy, translate business requirements into solutions, drive remediation and improvements, and support operations, projects, and pre-sales activities. Senior Software Security Engineer Dolby Laboratories | Ireland | Hybrid – View job details As a Senior Software Security Engineer, you will perform threat and risk assessments, vulnerability and exploitability research, and implement and validate IP protection mechanisms. You will work across embedded systems, operating systems, applications, and hardware to strengthen product security.

The open source library holding up your stack might have one maintainer Every serious software product runs on code that someone else wrote and released for free. A web service leans on a cryptography library, a data pipeline pulls in a parser, and a mobile app ships a handful of small utilities that one person maintains in spare time. All of it carries the same label. A new paper argues that the single label hides differences large enough to change how each piece behaves once it lands in production. Researchers sorted open source software into fourteen sub-genres, each defined by who starts and sustains a project and to what end. Their review screened close to four thousand unique papers drawn from two scholarly indexes. The result is a typology, along with an argument that the kind of project a study samples sets how far its conclusions travel. One label covers many kinds of project A community Linux distribution, a single-vendor database, a university research library, a humanitarian health-records system, and a one-person utility differ in why they exist, who decides their direction, and how the work gets paid for. The authors give the differences names. Community-driven projects such as Debian and Arch Linux run on volunteers and merit-based authority. Company-backed projects such as Elastic, MongoDB, and GitLab sit under one firm that earns revenue from the software and controls its roadmap. Foundation-governed projects such as Apache HTTP, Kubernetes, and Eclipse live under a vendor-neutral nonprofit that holds the trademark and keeps competing firms on even terms. Other categories sit further from the usual picture. Multi-company co-opetition covers rivals who build shared infrastructure together, as firms do around OpenStack and the Linux kernel. Research and scientific software gets written inside labs by domain scientists working to grant cycles and academic careers. Protestware covers packages a maintainer alters or sabotages to send a political or economic message, with node-ipc and colors.js as examples. Why the category predicts behavior The practical point lands on funding and governance, since those two things predict how a project holds up once many people rely on it. Critical digital infrastructure is the sharp case. Components such as OpenSSL, curl, and log4j sit underneath much of the software ecosystem, and a few volunteers often keep them running. Nadia Eghbal described this sustainability problem in a Ford Foundation report, and later research formalized it as underproduction, a state where the labor a component receives falls short of how widely it is relied upon. Studies of the npm ecosystem show a related risk, where a small number of maintainer accounts reach much of the network. Hobbyist and solo projects carry the same fragility. Researchers call this a low truck factor, which is a way of asking how many people would have to walk away before the whole thing grinds to a halt. For a one-person project, the answer is one. When that maintainer gets busy, burns out, or moves on, the code stops moving with them. A project backed by a foundation with member dues and paid staff has more people to lean on when the same thing happens. The community itself differs too The differences run deeper than money. Take open source for social good, or OSS4SG, the projects built to help people rather than turn a profit, things like the health-records system OpenMRS or the crisis-mapping tool Ushahidi. People who show up to these projects tend to stay. The authors call them “sticky.” Conventional projects are “magnetic,” pulling in a crowd where plenty pass through and move on. The road from first-time contributor to trusted core member looks different too, and in OSS4SG people reach that core faster and by more than one path. So a playbook for keeping contributors around, built on one kind of project, can fall flat on another. Where the category leaves off For anyone who works in IT, this lands close to home. The typology is still a work in progress, a light review the authors treat as a starting hypothesis, so the categories will shift as more research comes in. The practical read holds up anyway. Before your org commits to an open-source tool or pulls in a new dependency, the category tells you something a star count never will. An open-core product from a single vendor comes with relicensing risk tied to that vendor’s business plans. A solo package comes with bus-factor risk, the odds that one person walking away breaks it. A foundation-backed project comes with the governance that lets competitors share it in the first place. Knowing what kind of project you are dealing with puts the risk in plain sight before the code ever ships. Must read: 20 open-source cybersecurity tools to keep your team ready for anything GitHub CISO on security strategy and collaborating with the open-source community Subscribe to the Help Net Security ad-free monthly newsletter to stay informed on the essential open-source cybersecurity tools. Subscribe here!

Details It was discovered that OpenStack Keystone allowed restricted application credentials to create EC2 credentials. An authenticated attacker with only a reader role could possibly use this issue to bypass the role restrictions imposed on the application credential. (CVE-2026-33551) It was discovered that the OpenStack Keystone LDAP identity backend did not correctly convert the user enabled attribute to a boolean value. An attacker could possibly use this issue to authenticate as a user disabled in LDAP. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 25.10. (CVE-2026-40683) It was discovered that OpenStack Keystone's application credential authentication plugin did not verify that the user supplied in an authentication request matched the credential owner. An authenticated attacker could possibly impersonate another user and... It was discovered that OpenStack Keystone allowed restricted application credentials to create EC2 credentials. An authenticated attacker with only a reader role could possibly use this issue to bypass the role restrictions imposed on the application credential. (CVE-2026-33551) It was discovered that the OpenStack Keystone LDAP identity backend did not correctly convert the user enabled attribute to a boolean value. An attacker could possibly use this issue to authenticate as a user disabled in LDAP. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 25.10. (CVE-2026-40683) It was discovered that OpenStack Keystone's application credential authentication plugin did not verify that the user supplied in an authentication request matched the credential owner. An authenticated attacker could possibly impersonate another user and gain access to their tokens and credentials. (CVE-2026-42998) It was discovered that OpenStack Keystone's RBAC policy enforcer unconditionally merged the raw JSON request body into the policy enforcement dictionary, overwriting trusted target data. An authenticated attacker could possibly use this issue to inject arbitrary policy attributes to bypass RBAC checks. (CVE-2026-42999) It was discovered that OpenStack Keystone allowed an attacker with the member role to escalate privileges to admin by chaining application credential impersonation with Keystone trusts. An attacker could possibly use this issue to create a persistent trust delegating the victim's admin role to themselves. (CVE-2026-43000) It was discovered that OpenStack Keystone did not validate that the project_id for an EC2 credential matched the project of the authenticating application credential. An attacker with valid credentials for one project could possibly use this issue to create EC2 credentials targeting a different project. (CVE-2026-43001) It was discovered that OpenStack Keystone's federated token rescoping mechanism did not propagate the original token's expiry to the newly issued token. A remote attacker could possibly use this issue to maintain access indefinitely by repeatedly rescoping tokens before expiry. (CVE-2026-44394) The problem can be corrected by updating your system to the following package versions: Reduce your security exposure Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

SYSTEMS AMD inches closer to its goal of making AI suck less ... energyHouse of Zen claims latest systems already 4x more efficient than two years ago Google pits Marvell against Broadcom as it chases AI crownAnd Marvell just offered the Chocolate Factory a $12.2B stake to sweeten the deal SYSTEMS Cerebras CS-4 rack systems juice chips for every last drop of AI performanceNext-gen systems double per-chip performance while cramming 3x as many into a rack Security Copilot tricked into telling reseachers how to hack itselfHow to social engineer an AI's reasoning engine AI and ml Payments giant Stripe is about to drop over $7 billion to become a gateway to AI token salesAI gateways look promising as companies struggle with model orchestration Security Russians are posing as Signal support to launch phishing attacksPLUS: US takes down Iranian propaganda sites; Marketing company asks 'Why Do We Have Your Information?' And more! Security Microsoft patches failed to fix on-prem SharePoint, which is now under zero-day attackPLUS: China upgrades smartphone surveillance tools; Ring eases anti-snooping stance; and more Black Hat and DEF CON DEF CON Franklin project enlists hackers to harden critical infrastructureVoting village reports have been so successful, says Jeff Moss, that the whole of DEF CON will now be included Security EQT buys majority share in Swiss cybersecurity biz AcronisWent at equivalent of $3.5B+ valuation for entire firm, though portion sold not specified Malware Month Ten years since the first corp ransomware, Mikko Hyppönen sees no end in sightOn the plus side, infosec's a good bet for a long, stable career FOSS smashed one Microsoft monopoly. After 20 years of failure, it's time to smash anotherWord up GNOME can look like Windows – and Flashback can do it without extensionsNew 'Simple-taskbar' is an option, but there's a simpler, stabler way A moment of silence, please, for the final release of Debian on x86-32New Debian versions hit FOSSland in the form of 13.6 and 12.15 Baddies caught exploiting extensions bugs with perfect 10 scores on vulnerable Joomla websitesFlaws in iCagenda, Balbooa Forms extensions can impact open source CMS that powers a million sites worldwide Frame: A new X11 server – implemented directly in assemblyJoins yserver, Phoenix, and of course XLibre – and outlier Arcan Cinnamon 6.8 will support Wayland – if you want itNext version of Linux Mint’s desktop has both kinds of display server

Details It was discovered that OpenStack Glance was incorrectly validating the IP addresses and the redirect destination URL when downloading or importing images from a remote source. An attacker could possibly use this issue to perform server-side request forgery and obtain sensitive information. The problem can be corrected by updating your system to the following package versions: Reduce your security exposure Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Mentre il cloud è diventato il cuore dell’economia digitale, l’Unione europea si trova davanti a una scelta storica: trasformare la certificazione cloud in uno strumento di sovranità o limitarsi ad un semplice controllo tecnico. Il testo che segue ripercorre le scelte politiche e tecniche che hanno portato a quello che molti osservatori definiscono un rinnegamento dell’autonomia strategica europea nel digitale. La Commissione europea ha presentato una revisione del Cybersecurity Act che ridisegna la certificazione dei servizi cloud. Piuttosto che puntare su criteri di controllo giuridico e indipendenza dalle leggi extraterritoriali, il nuovo schema si concentra esclusivamente sulla sicurezza tecnica e operativa. Questo significa che società con forti legami giuridici e commerciali con Stati terzi possono comunque ottenere la certificazione europea. Questa impostazione nasce dalla volontà di sbloccare anni di stallo politico tra gli Stati membri. La proposta della Commissione è pensata per semplificare l’adozione di certificazioni armonizzate e facilitare l’utilizzo di servizi cloud in tutta l’UE. Tuttavia, lascia fuori un nodo cruciale: chi controlla realmente i dati. Il risultato è una certificazione che sembra soddisfare requisiti formali, ma che non cambia la sostanza del dominio delle grandi piattaforme straniere sul mercato europeo. La discussione sull’inclusione di criteri di sovranità ha diviso profondamente gli Stati dell’UE. Paesi come la Francia spingevano per un riconoscimento giuridico della dipendenza da leggi esterne, mentre altre capitali – in particolare la Germania – temevano che regole troppo rigide potessero essere viste come protezioniste e ostacolare gli scambi. Questa mancanza di consenso ha spinto Bruxelles ad adottare un approccio più neutrale, evitando di inserire qualunque riferimento alla nazionalità dei fornitori o alla loro esposizione alle normative straniere. La decisione è stata giustificata come un modo per evitare ulteriori blocchi legislativi e mantenere aperto il mercato interno digitale. Con l’adozione di questo nuovo schema di certificazione, i principali attori del cloud – compresi i colossi internazionali – possono ottenere la certificazione tecnica senza preoccuparsi della loro struttura giuridica o delle leggi straniere a cui sono soggetti. Questo dà un vantaggio enorme a provider già dominanti, che raccolgono la maggioranza del mercato europeo del cloud. Anche se la certificazione garantisce sicurezza operativa, non offre protezione contro l’influenza giuridica di Stati terzi sui dati ospitati. Per le imprese e le amministrazioni pubbliche, la certificazione assicura alcuni standard, ma non elimina i rischi di dipendenza da legislazioni fuori dal controllo europeo. Secondo l’articolo pubblicato da Usine Digitale su usine-digitale.fr, la scelta delle istituzioni europee segna un punto di svolta nella relazione tra tecnologia e autonomia strategica, privilegiando l’efficienza tecnica piuttosto che una vera indipendenza normativa. Gli Stati europei guardano sempre più alla tecnologia come a uno strumento di potere. In un contesto geopolitico segnato da tensioni crescenti, questo approccio comporta il rischio concreto che le infrastrutture digitali vengano utilizzate come leve di pressione tra Stati, con effetti diretti sulla sicurezza nazionale. Un esempio recente lo dimostra chiaramente: Microsoft ha impedito al Ministero della Difesa israeliano di accedere ad alcuni servizi cloud di Azure dopo che diverse inchieste giornalistiche avevano rivelato il loro utilizzo per attività di sorveglianza nei confronti dei residenti della Cisgiordania e della Striscia di Gaza. Ma non si tratta di un episodio isolato. I recenti blackout che hanno coinvolto piattaforme globali come AWS, Azure e Cloudflare (primo incidente e secondo incidente), hanno avuto un impatto devastante su scala planetaria, paralizzando servizi pubblici, aziende, istituti bancari, media, sistemi di mobilità e strutture sanitarie. Eventi di questo tipo non possono più essere liquidati come semplici “incidenti tecnici”: siamo di fronte a veri e propri rischi sistemici, capaci di compromettere la continuità operativa di interi Paesi e, di conseguenza, la loro sicurezza nazionale. Consapevoli di questa fragilità strutturale, molti Stati stanno iniziando a interrogarsi su come ridurre la dipendenza da fornitori tecnologici esterni. Anche fuori Europa, siamo sullo stesso piano. Mentre la Russia dopo le sanzioni è passata completamente a software Open Source, la Cina sta passando a software domestico a favore di molte tecnologie Huawei, e sta seguendo una traiettoria simile, pianificando l’eliminazione di Microsoft Office dalle proprie infrastrutture nazionali. Sempre più spesso, nel dibattito politico e industriale europeo, si parla di “cloud nazionale” o di “cloud sovrano” come risposta alle crescenti dipendenze tecnologiche. Annunci, lanci e dichiarazioni si susseguono, con l’idea che localizzare i dati entro i confini nazionali sia sufficiente a garantire controllo e sicurezza. Nella pratica, però, molte di queste iniziative si traducono semplicemente in data center situati in Europa — o addirittura in Italia — che continuano a operare su stack tecnologici forniti da Microsoft, Google o Amazon. Il punto critico non è quindi solo dove risiedono fisicamente i dati, ma chi controlla realmente la tecnologia che li gestisce. Un’infrastruttura che utilizza hypervisor, sistemi operativi, piattaforme di gestione e servizi cloud di aziende extraeuropee resta, di fatto, esposta a dinamiche giuridiche e politiche che sfuggono al controllo degli Stati europei. Parlare di sovranità in questi casi rischia di diventare una semplificazione, se non una vera illusione. Il problema è strutturale e richiede una risposta diversa: uno stack tecnologico completamente europeo, progettato, gestito e governato in Europa. Dall’hardware al software, dai sistemi di orchestrazione ai servizi di sicurezza, il controllo deve essere esercitato da soggetti sottoposti esclusivamente al diritto europeo. Questo aspetto diventa ancora più rilevante se si considera che tutte le aziende statunitensi sono obbligate a rispondere a normative come il FISA (Foreign Intelligence Surveillance Act) e, in particolare, alla famigerata Sezione 702. Questa disposizione consente alle autorità statunitensi di raccogliere informazioni di intelligence su persone non statunitensi situate all’estero, obbligando le aziende americane a collaborare e a fornire accesso ai dati, spesso senza possibilità di notifica agli interessati o ai governi stranieri coinvolti. In questo scenario, la sovranità digitale non può essere ridotta a una questione geografica. Senza un reale controllo giuridico e tecnologico dell’intera filiera, il “cloud sovrano” rischia di restare una formula rassicurante, ma vuota, incapace di proteggere davvero gli interessi strategici europei. Nonostante le critiche e le difficoltà politiche, le soluzioni per costruire un cloud europeo realmente sovrano esistono già oggi e sono pienamente implementabili. Il problema non è tecnologico: tutte le componenti necessarie — dalla virtualizzazione all’orchestrazione dei container, dallo storage al networking — sono disponibili come software open source, con pieno controllo giuridico sui dati e con la possibilità di fare code review e test di sicurezza. Ciò che frena una vera autonomia del cloud europeo sono spesso le pressioni delle lobby internazionali, gli interessi consolidati dei grandi provider e le reticenze politiche, che preferiscono soluzioni già consolidate piuttosto che investire in un’infrastruttura locale indipendente. Queste soluzioni non sono fantascienza: esistono framework, piattaforme e componenti open source pronti all’uso, capaci di garantire interoperabilità, sicurezza e pieno controllo europeo oltre che cloud service provider che utilizzano solo software opensource. Con un approccio sistematico, è possibile realizzare un vero cloud sovrano che riduca drasticamente la dipendenza da hyperscaler extraeuropei e metta finalmente l’Europa al centro della propria infrastruttura digitale. Per chi volesse costruire un’infrastruttura cloud interamente sotto controllo europeo, esiste un vero e proprio ecosistema di componenti open source già collaudati, pronti a comporre qualsiasi architettura IaaS sovrana. Tra questi: Kubernetes per orchestrare container portabili, OpenStack per gestire compute, networking e storage, MinIO per lo storage ad alte prestazioni compatibile S3, e distro Linux come SUSE, Debian o Ubuntu per la gestione dei nodi. Per la virtualizzazione, Proxmox VE permette di costruire cluster con KVM e container LXC ad alta disponibilità, completando così una piattaforma cloud europea, open e indipendente. Questa svolta legislativa solleva una domanda cruciale: cosa significa realmente parlare di sovranità nell’era digitale? La certificazione tecnica, per quanto rigorosa, non sostituisce un vero controllo giuridico. Senza quest’ultimo, gli strumenti che dovrebbero garantire autonomia restano parziali e incompleti. L’Europa rischia così di dipendere da infrastrutture e servizi gestiti da attori extraeuropei, esponendosi a leggi e obblighi stranieri che possono condizionare la gestione dei dati sensibili. In un contesto geopolitico sempre più teso, questa mancanza di controllo diventa una vulnerabilità strategica concreta, non più solo teorica. Per costruire una vera sovranità digitale serve un approccio diverso: infrastrutture, software e regolamentazione devono essere progettati e governati interamente in Europa. Solo così la certificazione potrà trasformarsi in strumento di autonomia reale, proteggendo dati, cittadini e interessi strategici senza dover subire interferenze esterne. Betti RHC, la prima graphic novel al mondo dedicata alla cybersecurity awareness, ha finalmente il suo sito ufficiale. Uno spazio tutto suo dove scoprire il progetto, sfogliare le copertine degli episodi e immergersi nel mondo di Betti: la giovane laureanda in informatica che, dopo la morte misteriosa del padre, si trasforma nell'hacker più potente del mondo. Una storia avvincente che, episodio dopo episodio, affronta una minaccia digitale diversa — dal phishing al ransomware, fino al cyberbullismo — e insegna a riconoscerla e a difendersi, senza che sembri mai una lezione. Sul sito trovate tutto ciò che rende Betti un progetto diverso dal solito: la sua filosofia, le anteprime delle tavole e il racconto di come nasce ogni volume. Perché dietro Betti RHC c'è solo lavoro umano: ogni tavola è disegnata interamente a mano dagli artisti del Gruppo Arte di Red Hot Cyber, senza alcun uso di intelligenza artificiale. E a garantire che ogni storia sia realistica e tecnicamente corretta c'è la supervisione degli hacker etici del gruppo HackerHood, che mantengono il racconto fedele al mondo reale della sicurezza informatica. C'è spazio anche per le aziende, che possono usare Betti come strumento di awareness diverso dai soliti corsi: acquistare i volumi, personalizzarli con il proprio brand o sponsorizzare nuovi episodi. E come primo regalo, l'episodio "Byte the Silence", dedicato al cyberbullismo, è scaricabile gratuitamente per uso personale. Perché la miglior difesa, in fondo, è una bella storia. 👉 Scopri tutto su https://betti.redhotcyber.com/

Details Kay discovered that OpenStack Keystone incorrectly handled the ec2tokens and s3tokens APIs. A remote attacker could possibly use this issue to obtain unauthorized access and escalate privileges. (CVE-2025-65073) It was discovered that OpenStack Keystone only validated the first 72 bytes of an application secret. An attacker could possibly use this issue to bypass password complexity. (CVE-2021-3563) It was discovered that OpenStack Keystone had a time lag before a token should be revoked by the security policy. A remote administrator could use this issue to maintain access for longer than expected. (CVE-2022-2447) Kay discovered that OpenStack Keystone incorrectly handled the ec2tokens and s3tokens APIs. A remote attacker could possibly use this issue to obtain unauthorized access and escalate privileges. (CVE-2025-65073) It was discovered that OpenStack Keystone only validated the first 72 bytes of an application secret. An attacker could possibly use this issue to bypass password complexity. (CVE-2021-3563) It was discovered that OpenStack Keystone had a time lag before a token should be revoked by the security policy. A remote administrator could use this issue to maintain access for longer than expected. (CVE-2022-2447) The problem can be corrected by updating your system to the following package versions: Reduce your security exposure Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Details Kay discovered that OpenStack Keystone incorrectly handled the ec2tokens and s3tokens APIs. A remote attacker could possibly use this issue to obtain unauthorized access and escalate privileges. The problem can be corrected by updating your system to the following package versions: Reduce your security exposure Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

SYSTEMS AMD inches closer to its goal of making AI suck less ... energyHouse of Zen claims latest systems already 4x more efficient than two years ago Google pits Marvell against Broadcom as it chases AI crownAnd Marvell just offered the Chocolate Factory a $12.2B stake to sweeten the deal SYSTEMS Cerebras CS-4 rack systems juice chips for every last drop of AI performanceNext-gen systems double per-chip performance while cramming 3x as many into a rack Security Copilot tricked into telling reseachers how to hack itselfHow to social engineer an AI's reasoning engine AI and ml Payments giant Stripe is about to drop over $7 billion to become a gateway to AI token salesAI gateways look promising as companies struggle with model orchestration Security Russians are posing as Signal support to launch phishing attacksPLUS: US takes down Iranian propaganda sites; Marketing company asks 'Why Do We Have Your Information?' And more! Security Microsoft patches failed to fix on-prem SharePoint, which is now under zero-day attackPLUS: China upgrades smartphone surveillance tools; Ring eases anti-snooping stance; and more Black Hat and DEF CON DEF CON Franklin project enlists hackers to harden critical infrastructureVoting village reports have been so successful, says Jeff Moss, that the whole of DEF CON will now be included Security EQT buys majority share in Swiss cybersecurity biz AcronisWent at equivalent of $3.5B+ valuation for entire firm, though portion sold not specified Malware Month Ten years since the first corp ransomware, Mikko Hyppönen sees no end in sightOn the plus side, infosec's a good bet for a long, stable career FOSS smashed one Microsoft monopoly. After 20 years of failure, it's time to smash anotherWord up GNOME can look like Windows – and Flashback can do it without extensionsNew 'Simple-taskbar' is an option, but there's a simpler, stabler way A moment of silence, please, for the final release of Debian on x86-32New Debian versions hit FOSSland in the form of 13.6 and 12.15 Baddies caught exploiting extensions bugs with perfect 10 scores on vulnerable Joomla websitesFlaws in iCagenda, Balbooa Forms extensions can impact open source CMS that powers a million sites worldwide Frame: A new X11 server – implemented directly in assemblyJoins yserver, Phoenix, and of course XLibre – and outlier Arcan Cinnamon 6.8 will support Wayland – if you want itNext version of Linux Mint’s desktop has both kinds of display server

Details Harry Sintonen discovered that the hotplugd socket in cloud-init was world writable. An attacker could possibly use this issue to send hotplug-hook commands. (CVE-2024-11584) It was discovered that cloud-init granted root access to a hardcoded URL with a local IP address when a non-x86 platform is detected. An attacker could possibly impersonate an OpenStack endpoint and provide root configuration data. (CVE-2024-6174) Harry Sintonen discovered that the hotplugd socket in cloud-init was world writable. An attacker could possibly use this issue to send hotplug-hook commands. (CVE-2024-11584) It was discovered that cloud-init granted root access to a hardcoded URL with a local IP address when a non-x86 platform is detected. An attacker could possibly impersonate an OpenStack endpoint and provide root configuration data. (CVE-2024-6174) The problem can be corrected by updating your system to the following package versions: Reduce your security exposure Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.