RSS Feeds

Главный вызов современного VM - не найти уязвимости, а понять, за какие хвататься. Голого CVSS давно мало, а с апреля 2026 года по многим свежим уязвимостям балла CVSS в привычном источнике просто нет. Разбираем весь современный стек приоритизации: CVSS 4.0, EPSS, метрику LEV, каталоги эксплуатируемых уязвимостей и методику ФСТЭК в редакции 2025 года. И отдельно - где западные метрики слепнут на российской инфраструктуре и почему трендовые БДУ у нас идут первым эшелоном.

Пару лет назад мы устроили настоящее расследование серии инцидентов в поисках скрытого дефекта нашего Redis-клиента. Команда воспроизводила сбои под контролируемой нагрузкой, проверяла одну гипотезу за другой, обновляла Jedis, экспериментировала с таймаутами и размерами пулов — но ничего не помогало. А помогли новые метрики и логи, настойчивость команды, ночные эксперименты и готовность разбирать поведение системы до последнего соединения. Получилась история с неожиданными поворотами, ложными следами и одной лишней строчкой кода в роли главного подозреваемого — а её итогом стал Redis-клиент, который оказался устойчивее, чем был до начала расследования.

Меня зовут Коля Грибанов, я тимлид команды «Платформа» в hh.ru. В статье расскажу, почему потеря одной ноды Redis вызывала шторм из десятков тысяч соединений, и как мы шаг за шагом искали причину инцидентов.

State’s child safety minister Amanda Camm confirms police are investigating alleged attack west of Brisbane

A Queensland teenager has allegedly been raped in a state-funded residential care home in what has been described as a “heinous” act.

A staff member is accused of assaulting the girl, who is understood to be intellectually impaired, at the home west of Brisbane.

У меня два физических сервера на списанном железе — Xeon E5 и старый IBM, суммарно 112 потоков и 754 гигабайта памяти. На них 55 виртуальных машин, и на этом живёт онлайн-школа, платформа с курсами, мессенджер, игровой движок и майнкрафт-серверы для учеников. При этом я не девопс и не системный администратор. Разбираю технически: как поделены машины, как устроена репликация баз между площадками, что происходит при падении основной и какие вещи я сделал неправильно.

На склад приходит палета: 40 коробов по 24 маркированные единицы — всего 960 кодов. В УПД при поэкземплярном учёте должны оказаться конкретные экземпляры. Кладовщик при этом видит один штрихкод на палете: индивидуальные DataMatrix скрыты под плёнкой и внутри коробов.

Можно вскрыть палету, достать товар, отсканировать 960 кодов и упаковать всё обратно. Но тогда ПЭУ превращается в дорогую ручную перепись — медленную и плохо совместимую с потоком склада.

Рабочий промышленный сценарий устроен иначе. Единичные коды заранее объединяют в зарегистрированную иерархию. Сотрудник сканирует доступный код верхнего уровня, а система раскрывает его до конкретных КМ и переносит их в операцию.

Именно здесь появляются КИГУ, КИТУ, SSCC, а у импортёров — ещё и АТК. Все они помогают работать с множеством кодов, но решают разные задачи и не заменяют друг друга.

NHS ombudsman warns of years-long waits and patients paying thousands to go private as demand for services soars

Complaints about autism and attention deficit hyperactivity disorder services in England have more than tripled in five years, official figures show, with the NHS ombudsman warning of years-long waits and patients paying thousands of pounds for private care.

One woman was removed from an ADHD medication waiting list without warning after almost four years, leaving her without the support she needed for about six months. Another patient was given an autism assessment lasting just 50 minutes that failed to follow guidance from the National Institute for Health and Care Excellence, while a man referred to an ADHD service that was not yet operational ended up paying almost £4,000 for private treatment.

MPs tell regulator they are ‘deeply concerned’ over interim CEO Phil Walker’s roles at William Hill and Game Nation

The national lottery is facing questions over its new boss’s record in the gambling industry, including a lucrative role in the 24-hour slot machine sector singled out by the prime minister as a blight on British high streets.

Allwyn UK, which holds a licence to run the Lottery until 2034, said last week that it had appointed William Hill’s former UK and Ireland boss Phil Walker as its interim chief executive, replacing Andria Vidler.

Spectrum Building leaseholders awaiting payouts after freeholder, Arinium, went bankrupt shortly after 2024 blaze

Sarah Williams vividly remembers the night in 2016 when she camped overnight in a car park to put down a deposit on a flat in the newly completed Spectrum Building in Dagenham, east London.

“People started queuing for those flats 24 hours before they went on sale,” she said. “It was basically the only flat I could afford in London. This was a year before Grenfell, and the flats market in London was completely crazy.”

As photojournalist sentenced to 15 years, rights groups warn law would turn civic engagement into security crime

Iran has taken the first step towards criminalising contact with foreign media, in a move human rights groups have said attempts to “sever the entire Iranian society from the rest of the world”.

For journalists, researchers and even ordinary citizens, the proposed law being discussed by Iranian lawmakers this month could make speaking to international audiences and groups a potential criminal act and restrict coverage of events such as January’s mass anti-regime protests.

Serve this cold curry with a hot, fenugreek-flavoured preserve for a seasonal refresher

This lovely summery “curry” is a cold, refreshing dish from Karnataka in India, and is eaten widely in Tamil Nadu, just 20 miles across the Palk Strait from my ancestral Tamil homeland in north and eastern Sri Lanka. Along with chefs Louis and Seb in our development kitchen, we decided that smacking the cucumbers helps give them a silky texture, and means the fragrant yoghurt base can get into all the nooks and crannies. It’s wonderful with plain rice and a side of fenugreek-heavy hot Tamil pickle, made with English gooseberries rather than superfood nelli, both of which are said to make your skin shine and hair bouncy.

Research finds demand has more than doubled since 2000 and 80% of current demand comes from Asia

A booming demand for concrete has resulted in sand and gravel being extracted from riverbeds faster than nature can replenish it. A study published in Reviews of Geophysics shows that the demand for sand and gravel has more than doubled in the last two decades, with overextraction leading to weaker riverbanks, lower groundwater levels, coastal salt intrusion and poorer water quality.

In 2024, city-building and infrastructure projects around the world turned 28bn tonnes of sand and gravel into concrete. Researchers reviewed data on sand and gravel extraction going back to 1974 and have shown that since 2000 demand has more than doubled, with more than 80% of current demand coming from Asia, supporting urban development and road-building across China and India in particular. They found much of the material was being extracted from rivers across Asia and Africa. Data on extraction is scarce but where it does exist the researchers showed that extraction often exceeded natural sediment replacement severalfold.

As photojournalist sentenced to 15 years, rights groups warn law would turn civic engagement into security crime

Iran has taken the first step towards criminalising contact with foreign media, in a move human rights groups have said attempts to “sever the entire Iranian society from the rest of the world”.

For journalists, researchers and even ordinary citizens, the proposed law being discussed by Iranian lawmakers this month could make speaking to international audiences and groups a potential criminal act and restrict coverage of events such as January’s mass anti-regime protests.

MPs tell regulator they are ‘deeply concerned’ over interim CEO Phil Walker’s roles at William Hill and Game Nation

The national lottery is facing questions over its new boss’s record in the gambling industry, including a lucrative role in the 24-hour slot machine sector singled out by the prime minister as a blight on British high streets.

Allwyn UK, which holds a licence to run the Lottery until 2034, said last week that it had appointed William Hill’s former UK and Ireland boss Phil Walker as its interim chief executive, replacing Andria Vidler.

NHS ombudsman warns of years-long waits and patients paying thousands to go private as demand for services soars

Complaints about autism and attention deficit hyperactivity disorder services in England have more than tripled in five years, official figures show, with the NHS ombudsman warning of years-long waits and patients paying thousands of pounds for private care.

One woman was removed from an ADHD medication waiting list without warning after almost four years, leaving her without the support she needed for about six months. Another patient was given an autism assessment lasting just 50 minutes that failed to follow guidance from the National Institute for Health and Care Excellence, while a man referred to an ADHD service that was not yet operational ended up paying almost £4,000 for private treatment.

Spectrum Building leaseholders awaiting payouts after freeholder, Arinium, went bankrupt shortly after 2024 blaze

Sarah Williams vividly remembers the night in 2016 when she camped overnight in a car park to put down a deposit on a flat in the newly completed Spectrum Building in Dagenham, east London.

“People started queuing for those flats 24 hours before they went on sale,” she said. “It was basically the only flat I could afford in London. This was a year before Grenfell, and the flats market in London was completely crazy.”

Свой язык программирования пишут все. Обычно это калькулятор с переменными, пересказ главы про рекурсивный спуск и заброшенный репозиторий.

Интересно в моём не то, что он считает выражения. За время работы я дважды полностью переименовал проект, вырезал из ядра обход дерева и заменил компиляцией в замыкания, поднял скорость втрое и прогнал по языку два фаззера. Любой из этих шагов мог тихо сломать что угодно.

Не сломал. Полная перестройка ядра — 350 строк — прошла все 444 проверки, и ни один эталон не пришлось трогать.

Разбираю, что для этого пришлось построить: пять замков, каждый из которых закрывает то, что гниёт молча — вывод примеров в документации, списки слов в подсветке синтаксиса, формулировки сообщений об ошибках. Почему стенд замеров строится до первой оптимизации, а не после. И как выяснилось, что запас стека я всё это время мерил неправильно.

Плюс двенадцать дефектов, которые нашёл фаззер: равенство, переставшее быть симметричным; undefined, вылезающий наружу в языке, где его нет; += , вычислявший цель дважды. Два из двенадцати нашёл не фаззер, а я — когда писал тесты к его находкам.

Отдельно — про то, что четыре из пяти находок второго фаззера оказались враньём самого фаззера, и почему я довёл его до нуля ложных срабатываний вместо «ну там четыре из них шум».

With the federal deficit near 6% of GDP and the national debt over $40tn, America’s fiscal position looks increasingly precarious

• Bessent ‘will lose’ battle with bond markets, ex-mentor warns

Are we seeing the first signs of panic in Donald Trump’s Treasury? The US is by far the world’s biggest debtor, and the steady rise in global long-term interest rates – which I have long argued was inevitable – is starting to cause real pain.

Until now, the Treasury secretary, Scott Bessent, has dismissed concerns about US debt, which recently surpassed $40tn, as a big nothingburger. Growth, in his telling, will be so spectacular the US will easily be able to meet its interest obligations without any significant tax rises or spending cuts, while the rest of the world will happily keep feeding it money. But if Bessent really believes that, why is he trying to strong-arm the bond market by fiddling with the maturity structure of government debt?

The vast majority of the global public wants international cooperation on human rights, climate and AI. Like-minded countries must stand together to deliver

Britain’s new prime minister, Andy Burnham, is already having to make one of his gravest decisions. He has to issue the instructions that he alone gives to the military, setting out the UK response in a doomsday scenario of a nuclear weapons attack on us. He will, as I did two decades ago, sign a piece of paper telling commanders whether or not to retaliate and, if so, whether through targeting civilian conurbations or military sites. These instructions are written down in the aptly named “letter of last resort”.

Now, more than at any time since the 1960s Cuban missile crisis, the European public fears a third world war. With the nuclear Doomsday Clock developed by atomic scientists moving ever closer to midnight, and Japan, South Korea, Saudi Arabia, the UAE, Egypt, Poland and Germany contemplating either acquiring nuclear weapons or siting them on their soil, our world is descending from a rules-based order to a power-based one, where might is deemed right and brute force dominates.

Gordon Brown is the UN’s special envoy for global education and was UK prime minister from 2007 to 2010

The future starts with us: Gordon Brown in conversation
On Thursday 10 September, join Hugh Muir and Gordon Brown to discuss the intricate connections between global instability and civic decline, as explored in Brown’s new book, The Future Starts With Us. Book tickets here

SSO принято считать системой единого входа: она проверяет пользователя и выдаёт токен. Но в этой же точке можно собирать подтверждённые данные, применять внешние политики, запускать обязательные действия и уведомлять другие системы о новой сессии.

Разберём, как SSO формирует единый пользовательский контекст и как Claims Providers, AuthZEN, SSF/CAEP и Script Runner расширяют его роль — от системы входа до платформы управления корпоративной идентичностью.

The incumbent senator Dan S Sullivan has condemned ex-school teacher Dan J Sullivan, claiming he is running at the behest of Democrats to confuse supporters

Republican senator Dan S Sullivan will be joined on the November ballot in Alaska by a challenger with a nearly identical name from the same party, election officials confirmed on Tuesday, adding a twist to what is expected to be one of the most hotly contested races of the midterms.

The Republican senator is running for a third term against Democrat Mary Peltola, a former US House representative whom polls show is neck-and-neck with him in a state that hasn’t sent a Democrat to the Senate since 2008.

Scientists say research suggests blinking may have acquired a social relevance in interactions between dogs and people

Stare into a dog’s eyes and you may encounter a bemused expression. But researchers have found that dogs blink more often when they see their owners doing so, suggesting there may be more to the mutual gaze than meets the eye.

Scientists have previously found that dogs turn on the puppy eyes when humans look at them, and that their brains can distinguish happy human faces from other expressions – even telling apart fearful faces from those that are angry or sad.

Бакет в S3 — не просто папка для файлов, а ресурс, на котором хранилище принимает решение о доступе к объектам. Пока доступ контролирует только nginx или собственный прокси, у любого обладателя действующего ключа остаётся прямой путь к S3 endpoint. Достаточно указать другой --endpoint-url в aws-cli. Прокси не увидит запрос, а хранилище вернёт 200, если на самом бакете нет правил, способных его остановить.

Меня зовут Стас Погоржельский, я технологический евангелист VK Cloud. В статье разберём, как вернуть авторизацию туда, где лежат данные: выдать ключи минимальной области — на бакет или префикс — и дополнить их Bucket Access Policy. Посмотрим, что из шести функций прокси действительно переезжает в хранилище, что переносится лишь частично, а что остаётся снаружи: бизнес-логика допуска, лимиты на конкретного принципала, аудит с бизнес-контекстом и гарантированный запрет нешифрованного трафика.

Дальше разложим решение endpoint на политику бакета, область действия ключа и ACL; отделим явный Deny от запрета по умолчанию, проверим, как режим OwnershipControls может выдать доступ в обход политики. На примере AWS-политики покажем, почему знакомый JSON нельзя переносить без ревью: у VK Object Storage ограничен набор Condition, а aws:SecureTransport и s3:prefix не работают. Затем соберём политику четырьмя итерациями — Resource, Principal, aws:SourceIp и явный Deny — и подтвердим результат матрицей из 16 запросов с ожидаемыми 200, 403 и открытыми вопросами, которые надо снять на своём стенде.

В конце настроим наблюдение по Cloud Audit, разберём, какие доказательства переноса пригодятся для ИБ и аудита, и составим чек-лист для переезда между AWS S3, Ceph, MinIO, Yandex Object Storage и VK Object Storage. Главный критерий успеха здесь не сохранённый JSON и не работающий разрешённый запрос, а отказ там, где доступ должен быть закрыт.

Asturias, Spain: Wild Finca is thrilling in its ecological abundance, and was created in just eight years despite countless obstacles

On a rocky 13-hectare pocket in the foothills of the Picos de Europa, Luke Massey and Katie Stacey are raising children, dogs, cattle, chicken, ducks, geese and eyebrows. In their eight years here, the farm they call Wild Finca has become a mass of scrub, with scattered large trees and dozens of clearings that Luke calls fields, but which look more like tiny irregular glades, riddled with trails and hemmed all around by the blackthorn, gorse and bramble that has sprung up around the tumbled remains of drystone walls.

If Wild Finca is a forever home to the Massey-Staceys, it is a whole world to nature. Witness the butterflies and wasp spiders, the snakes, lizards, hedgehogs and sparrows, and the thousand-piece cricket orchestra that performs each evening as the glow-worms light up. It offers denning and roosting sites for foxes, pine martens, badgers and 17 species of bat, feeding opportunities for roe deer and wild boar, several species of eagle and vulture, and a pit stop for others such as the nightingale I heard singing in early morning mist.

Сегодня простую компьютерную игру можно собрать за несколько минут: взять готовый движок, подключить библиотеку или просто попросить ИИ написать код. Но мне захотелось вернуться к истокам и попробовать обойтись самым минимумом средств.

Привет! Я Евгений Бартенев, техлид и автор курса «Python-разработчик» в Практикуме. В этой статье попробую написать автомобильные гонки примерно в 50 строк кода на Python. Вся «графика» будет состоять из обычных символов терминала, а по пути мы немного разберёмся с ANSI-последовательностями, неблокирующим вводом и тем, как вообще устроен терминал.

Number of people killed in boat strikes rises to 227 since Trump administration began controversial campaign

The US military killed four people when it attacked a suspected drug smuggling boat in the Caribbean Sea on Tuesday as the Trump administration’s controversial campaign against alleged traffickers continues.

The latest attack brings the number of those killed in boat strikes by the US military to at least 227 in 68 strikes since the US began targeting those it calls “narcoterrorists” almost a year ago.

Yorgen Fenech tells jury he had nothing to do with killing and alleges top adviser to Malta’s then PM was instigator

A businessman on trial for the murder of the journalist Daphne Caruana Galizia has spoken about the charges for the first time in court since his arrest seven years ago, telling the jury he was framed by police and had nothing to do with the killing.

During four days of questioning by defence and the prosecution lawyers, Yorgen Fenech, 44, accused the most senior adviser to Malta’s prime minister of giving the go-ahead for the murder.

Warsaw failed to anticipate that refugees would build new lives and Kyiv would demand an equal place at the European table

One of the unintended consequences of Russia’s full-scale war against Ukraine was that it gave Poland a rare slice of geopolitical stardom. When Russian tanks started their ultimately unsuccessful cavalcade towards the Ukrainian capital, ordinary Poles rushed to help millions of people fleeing the looming conflict. As Polish people opened their doors to civilians running from Russian bombs, even the then ruling populist Law and Justice party had to follow suit.

It seemed that Poland and Ukraine were bound for an iron-clad alliance, unprecedented in their shared history. Poland advocated for the Ukrainian cause in the west, with some success. Ukrainian leaders, in turn, praised Poles for their generosity and the government in Warsaw for contributing weapons and money to the war effort. Given that recent history between the two countries had been marked by accusations of second world war-era genocide, border shifts and postwar displacements of millions of people, it was a remarkable change.

Mateusz Mazzini is a Warsaw-based journalist writing on global affairs for Poland’s Gazeta Wyborcza and Polityka

Do you have an opinion on the issues raised in this article? If you would like to submit a response of up to 300 words by email to be considered for publication in our letters section, please click here.

Pleasance Courtyard, Edinburgh
This motormouth Australian comic fires off tart remarks and home truths then explains why she over-identifies with the Titanic

‘No hugging, no learning” was the writers’ rule on Seinfeld. Jess Fuchs decrees a similar stricture for Feral, in which she will learn nothing about herself whatsoever. “Really, I’m just here to talk shit.” That might get proceedings off to an underwhelming start, save that the Aussie’s cynical shtick is delivered with tremendous oomph: a bracing celebration of unsentimentality from an act who tells it straight about her body, her single life and a trip to Ireland, where she finds her soulmate in the form of a long-sunk ship.

It’s one of those debuts that announces a fully formed standup, a cert to be in for the long haul. Cocooned in black feathers, Fuchs is an effervescing chatterbox of a comic, firing off tart remarks, home truths and off-colour comments in every direction. Arrogant yet quick to laugh at herself, the audience love her, as she pursues a Bridgerton-inspired breast enlargement, expounds on “pretty privilege” and writhes in horror at the thought of dating a 45-year-old man (she’s 32). Her mum and sister play entertaining offstage roles, and there’s a wickedly unexpected joke about the relative merits, when dating, of seeking consent versus reading the room.

With their twangy sound, madcap outfits, lusty yodelling and pirouetting pirate frontman, the band became global superstars almost overnight. But, as their guitarist Marco Pirroni recalls, the thrill ride soon hit the buffers

‘The essence of pop is, one, brilliant fucking songs – and the rest is sex, subversion, style and humour. And that was us.” So Adam Ant told me in 1995, describing the reconstructed Adam and the Ants, which formed in early 1980 with the arrival of guitarist/songwriter Marco Pirroni, who was sitting next to him. “We’re responsible for bringing back dressing up, going mad and screaming your head off.”

“That’s it!” grins Pirroni when I remind him of this, as we sit in the shabby-chic lounge of London’s 21Soho venue. Back then, I didn’t tell them I was 15 in 1980, forever sprinting across dancefloors pretending to be Adam Ant, chiffon scarves tied to knees, limbs flailing like a whirling Cossack. Pirroni hears this today and laughs. “That’s what it’s all about,” he hoots. “When I was 13, watching Bowie, Roxy, T Rex, you just go, ‘I wanna do that.’ It’s exciting, sexy, about looking good, Top of the Pops. I can’t imagine anyone saying, ‘Wow, I desperately want to be in Cabaret Voltaire. They must be earning no money, look boring and nobody likes them – that’s the band for me!’”

Its council is due to merge with Leicestershire’s in 2028, and some locals are incensed. Can the county hold on to its ceremonial status – and biggest selling point?

Mysterious disappearances have been taking place lately in Rutland, an East Midlands pocket between Leicestershire, Lincolnshire and Northamptonshire that is often considered to be England’s smallest county. Usually, there are road signs when driving into a new county welcoming you over the border. But in recent months, these have been going missing. After 10 signs vanished, the council decided to remove the remaining 17. Now there are no official “Rutland” signs at all.

The area’s MP, the Conservative Alicia Kearns, is “not sure” what the motivation behind the thefts is. But they are certainly a fitting metaphor for Rutland’s disappearing status: its council is due to merge with Leicestershire county council in spring 2028.

Critics say ownership registers are too costly and too complicated, scuppering attempts to expose alleged money laundering

Since Britain’s offshore secrecy jurisdictions caved in to pressure from Westminster to embrace corporate transparency, finding out who owns a company in one of these island havens is, in theory at least, a piece of cake.

Take the Cayman Islands.

Internal calls to end war get louder as Gulf neighbours plan alternative pipelines to cut reliance on waterway

Is the strait of Hormuz, recently cited by the office of the Iranian supreme leader as “the pillar of Iran’s new security order”, and as transformative as possessing a nuclear weapon, in reality becoming a fast-diminishing asset, leaving Iran increasingly vulnerable to the new planned US wave of economic sanctions?

It is the key debate that is raging inside Iran, with many different conclusions being drawn for Tehran’s negotiating strategy. Those who warn the strait’s value as a chokehold on the world economy will erode, leaving the country without foreign exchange reserves, argue that Iran’s negotiators should seek a deal soon.

Even low levels of traffic noise can negate the benefits of listening to natural sounds, researchers say

Hearing the trill or whistle of a bird while going about daily life is well known to boost people’s mood. But a new study suggests the psychological benefits of hearing birdsong are being threatened by traffic noise.

Researchers found that even low levels of traffic noise negatively affected the benefits to wellbeing that could otherwise be derived from listening to natural sounds.

Protests and petitions planned amid growing concerns over impact of climate crisis on numbers of Alpine rodent

Animal rights campaigners are gearing up for protests and petitions aimed at persuading the French government to ban the hunting of Alpine marmots.

Open season on the rodents, members of the squirrel and groundhog family, begins in September, a few weeks before they go into a long winter hibernation.

Internal calls to end war get louder as Gulf neighbours plan alternative pipelines to cut reliance on waterway

Is the strait of Hormuz, recently cited by the office of the Iranian supreme leader as “the pillar of Iran’s new security order”, and as transformative as possessing a nuclear weapon, in reality becoming a fast-diminishing asset, leaving Iran increasingly vulnerable to the new planned US wave of economic sanctions?

It is the key debate that is raging inside Iran, with many different conclusions being drawn for Tehran’s negotiating strategy. Those who warn the strait’s value as a chokehold on the world economy will erode, leaving the country without foreign exchange reserves, argue that Iran’s negotiators should seek a deal soon.

Yorgen Fenech tells jury he had nothing to do with killing and alleges top adviser to Malta’s then PM was instigator

A businessman on trial for the murder of the journalist Daphne Caruana Galizia has spoken about the charges for the first time in court since his arrest seven years ago, telling the jury he was framed by police and had nothing to do with the killing.

During four days of questioning by defence and the prosecution lawyers, Yorgen Fenech, 44, accused the most senior adviser to Malta’s prime minister of giving the go-ahead for the murder.

Protests and petitions planned amid growing concerns over impact of climate crisis on numbers of Alpine rodent

Animal rights campaigners are gearing up for protests and petitions aimed at persuading the French government to ban the hunting of Alpine marmots.

Open season on the rodents, members of the squirrel and groundhog family, begins in September, a few weeks before they go into a long winter hibernation.