An anonymous reader quotes a report from TechCrunch: Across Uzbekistan, a network of about a hundred banks of high-resolution roadside cameras continuously scan vehicles' license plates and their occupants, sometimes thousands a day, looking for potential traffic violations. Cars running red lights, drivers not wearing their seatbelts, and unlicensed vehicles driving at night, to name a few. The driver of one of the most surveilled vehicles in the system was tracked over six months as he traveled between the eastern city of Chirchiq, through the capital Tashkent, and in the nearby settlement of Eshonguzar, often multiple times a week. We know this because the country's sprawling license plate-tracking surveillance system has been left exposed to the internet.

Security researcher Anurag Sen, who discovered the security lapse, found the license plate surveillance system exposed online without a password, allowing anyone access to the data within. It's not clear how long the surveillance system has been public, but artifacts from the system show that its database was set up in September 2024, and traffic monitoring began in mid-2025. The exposure offers a rare glimpse into how such national license plate surveillance systems work, the data they collect, and how they can be used to track the whereabouts of any one of the millions of people across an entire country. The lapse also reveals the security and privacy risks associated with the mass monitoring of vehicles and their owners, at a time when the United States is building up its nationwide array of license plate readers, many of which are provided by surveillance giant Flock.

An anonymous reader shares a report: It's been more than eight years since Amazon bought Whole Foods, but the two companies still haven't aligned their setup for the Microsoft software their employees use. That disconnect was flagged in an 8-week Deloitte review of Whole Foods' use of Microsoft 365 apps earlier this year, according to an internal document obtained by Business Insider. Deloitte found that Whole Foods relies on "fragmented" Microsoft toolsets, has loose security and data-retention practices, and employs a complex user-management setup -- all of which contribute to inefficiencies and lower productivity when working with Amazon employees.

The consulting firm recommended a 24-month integration plan that would first move Whole Foods' corporate employees onto Amazon's backend system, followed by its frontline workers. The phased approach would ensure a "smooth transition for users and minimal disruption to business processes," while generating cost savings, the document said. The review, completed in May, highlights Amazon's ongoing challenges in integrating Whole Foods. Since acquiring the chain in 2017, the company has struggled to scale the business and integrate operations, resulting in frequent reorganizations and shifting strategic priorities.

An anonymous reader shares a report: Samsung is breaking new ground with its 2026 lineup of gaming monitors, with the Odyssey 3D G90XH becoming the first to feature a 6K display with "glasses-free 3D." The new monitor comes with a 32-inch IPS panel, offering real-time eye-tracking that "adjusts depth and perspective" based on your position, along with a speedy 165Hz refresh rate that you can boost to 330Hz with a Dual Mode feature that switches to 3K.

[...] A 6K 3D display isn't the only notable upgrade coming to Samsung's lineup; the company is launching the Odyssey G6 G60H, which it says is the "world's first" 1,040Hz gaming monitor. The 27-inch monitor only supports this ultra-fast refresh rate in HD, while its native 1440p resolution still offers speeds up to a very fast 600Hz. It's also compatible with AMD FreeSync Premium and NVIDIA G-Sync.

Asus has been showcasing its new 5K 27-inch ROG Strix 27 Pro gaming monitor running at 5,120 x 2,880 resolution and up to 180Hz, but even Nvidia's flagship RTX 5090 struggles to deliver smooth frame rates at this demanding pixel count. In testing conducted by Asus, the RTX 5090D -- a Chinese-exclusive variant with weaker AI performance -- achieved just 51 frames per second in a Cyberpunk 2077 benchmark at ultra ray traced settings. The test system ran an AMD Ryzen 9950X3D processor, had DLSS set to balanced, and kept frame generation disabled. The same configuration running at 4K managed 77 fps, around 50% higher.

The underlying math is simple: 5K resolution requires rendering 78% more pixels than 4K. That 218 PPI pixel density delivers impressive sharpness up close, but Asus chose an IPS panel over OLED technology to reach it, trading away deeper black levels and faster response times. Asus appears to be positioning the monitor as a dual-mode display -- 5K for productivity and video, 1440p at up to 330Hz for gaming. Early Chinese listings have it priced at the equivalent of $800, roughly what you'd pay for a larger 4K OLED panel.

An anonymous reader quotes a report from the Associated Press: With just three days to go before Christmas, a cyberattack knocked France's national postal service offline Monday, blocking and delaying package deliveries and online payments. The timing was miserable for millions of people at the height of the Christmas season, as frazzled postal workers fended off frustrated customers. No one immediately claimed responsibility, but suspicions abounded.

What the postal service La Poste called a ''major network incident'' remained unresolved by Monday evening, more than eight hours after it was first reported. For a company that delivered 2.6 billion packages last year and employs more than 200,000 people, that's a big hit. La Poste said in a statement that a distributed denial of service incident, or DDoS, "rendered its online services inaccessible." It said the incident had no impact on customer data, but disrupted package delivery. Letters, including holiday greeting cards, could still be mailed and delivered. But transactions requiring tracking or access to the postal service internal computer systems were impossible.

The cyberattack also hurt online banking. Customers of the company's banking arm, La Banque Postale, were blocked from using the application to approve payments or conduct other banking services. The bank redirected approvals to text messages instead. "Our teams are mobilized to resolve the situation quickly," the bank said in messages posted on social networks. The disruption came a week after France's government was targeted by a cyberattack that targeted the Interior Ministry, in charge of national security.

What is the future of work? The Wall Street Journal asked five workplace experts and practitioners.

So while AI "is already doing tasks once relegated to newly minted college graduates in many professions," the Journal predicts that in the next 20 years AI "will have an impact on the role of managers, how organizations measure business outcomes and accelerate tasks that once took months."

A senior partner at the consulting firm Mercer predicts AI (plus advances in quantum computing) will enable entrepreneurs to reshape industries with a fraction of the resources traditionally required.

Some other predictions: Alan Guarino, vice chairman and CEO of board services at the global consulting firm Korn Ferry: In 25 years, the workplace will likely be unrecognizable, with employees and AI operating as one. Yes, there will be tasks and entire jobs taken over by AI, but we will all be elevated to a whole new superpower to make critical and creative decisions. The idea that work was once done strictly by people will seem quaint to some. Tasks that took entire teams, and months to complete, will be crunched down to a few minutes, with success measured on metrics we can't imagine today.

The middle layers of management — so central to today's corporate structure — could be a vestige of the past. The role of the leader too will change, as they directly oversee a collaboration of people and intelligent systems. The attitude toward in-person collaboration is growing and 25 years from now, counterintuitively, I believe face-to-face connection won't just be indispensable, but invaluable. Emotional intelligence will still set leaders apart. Those who blend empathy with tech savvy will be the ones shaping the future.

Peter Fasolo, a former executive vice president and chief human resources officer at Johnson & Johnson, and director of the Human Resource Policy Institute at Boston University's Questrom School of Business: There will be fewer available workers in Europe, Japan and the U.S. over this time frame and the demographic shift will be profound. In addition, there will be even fewer young adults available for colleges in the U.S., even if they decide the investment is worth it.

The implications of this shift will be the need for more investments in vocational and trade schools, and the need to invest in skill-based, not pedigree-based training. There will also be more on-the-job specific training. Companies will become classrooms. Companies that want a more sustainable relationship with employees will need an investment model versus a transactional one: We will invest in your skills so you can be a competitive professional in your domain.

America's unemployment rate for tech jobs rose to 4% in November, and "has been steadily rising since May," reports the Washington Post (citing data from the IT training/certifications company CompTIA). Between October and November, the number of technology workers across different industries fell 134,000, while the number of people working in the tech industry declined by more than 6,800. Tech job postings were also down by more than 31,800, the report found, citing data from the Bureau of Labor Statistics and California-based market intelligence firm Lightcast. "The data is pretty definitive that the tech industry is struggling," said Mark Zandi, Moody's chief economist. "There's a jobs recession in the industry, and it feels like that's going to continue given the slide in postings...."

The unemployment rate in the tech industry still sits below the national rate, which in November hit 4.6 percent, the highest since 2021. However, that gap has been narrowing, with tech unemployment rising faster in recent months than is the case nationally.... Employers are largely in "wait and see" mode when it comes to hiring given the current uncertainties surrounding the economy and impact of AI, so they're likely to delay backfilling, Herbert said, citing CompTIA's surveys of chief information officers. But Justin Wolfers, professor of public policy and economics at the University of Michigan, said uncertainty is likely to continue in the foreseeable future. "I'm feeling substantially more pessimistic," Wolfers said, recalling that Federal Reserve Chair Jerome H. Powell recently suggested that federal job numbers may be overstated. "That's pretty grim."

Technology companies have announced more than 141,000 job cuts so far this year, representing a 17 percent increase from the same period last year, according to outplacement firm Challenger, Gray & Christmas. At the same time Big Tech companies like Google, Microsoft, Meta and Amazon have announced plans to invest up to $375 billion in AI infrastructure this year.
"AI is quickly becoming a requirement, with 41 percent of all active job postings representing AI roles or requiring AI skills, according to CompTIA's analysis," the article points out.

Economist Zandi tells the Post that "If you have AI skills, there seems to be jobs. But if you don't, I think it's going to feel like you've been hit by a dump truck."

An independent review found that at least ten technical and process failures during a routine firewall upgrade at Australia's Optus prevented emergency calls from reaching Triple Zero for 14 hours, during which 455 calls failed and two callers died. The Register reports: On Thursday, Optus published an independent report (PDF) on the matter written by Dr Kerry Schott, an Australian executive who has held senior management roles at many of the country's most significant businesses. The report found that Optus planned 18 firewall upgrades and had executed 15 without incident. But on the 16th upgrade, Optus issued incorrect instructions to its outsourced provider Nokia. [...] Schott summarized the incident as follows: "Three issues are clear during this incident. The first is the very poor management and performance within [Optus] Networks and their contractor, Nokia. Process was not followed, and incorrect procedures were selected. Checks were inadequate, controls avoided and alerts given insufficient attention. There appeared to be reticence in seeking more experienced advice within Networks and a focus on speed and getting the task done, rather than an emphasis on doing things properly."

The review also found that Optus' call center didn't appreciate it could be "the first alert channel for Triple Zero difficulties." The document also notes that Australian telcos try to route 000 calls during outages, but that doing so is not easy and is made harder by the fact that different smartphones behave in different ways. Optus does warn customers if their devices have not been tested for their ability to connect to 000, and maintains a list of known bad devices. But the report notes Optus's process "does not capture so-called 'grey' devices that have been bought online or overseas and may not be compliant." "To have a standard firewall upgrade go so badly is inexcusable," the document states. "Execution was poor and seemed more focussed on getting things done than on being right. Supervision of both network staff and Nokia must be more disciplined to get things right."

An anonymous reader quotes a report from KrebsOnSecurity: Direct navigation -- the act of visiting a website by manually typing a domain name in a web browser -- has never been riskier: A new study finds the vast majority of "parked" domains -- mostly expired or dormant domain names, or common misspellings of popular websites -- are now configured to redirect visitors to sites that foist scams and malware. When Internet users try to visit expired domain names or accidentally navigate to a lookalike "typosquatting" domain, they are typically brought to a placeholder page at a domain parking company that tries to monetize the wayward traffic by displaying links to a number of third-party websites that have paid to have their links shown.

A decade ago, ending up at one of these parked domains came with a relatively small chance of being redirected to a malicious destination: In 2014, researchers found (PDF) that parked domains redirected users to malicious sites less than five percent of the time -- regardless of whether the visitor clicked on any links at the parked page. But in a series of experiments over the past few months, researchers at the security firm Infoblox say they discovered the situation is now reversed, and that malicious content is by far the norm now for parked websites. "In large scale experiments, we found that over 90% of the time, visitors to a parked domain would be directed to illegal content, scams, scareware and anti-virus software subscriptions, or malware, as the 'click' was sold from the parking company to advertisers, who often resold that traffic to yet another party," Infoblox researchers wrote in a paper published today.

An anonymous reader quotes a report from Tom's Hardware: A North Korean imposter was uncovered, working as a sysadmin at Amazon U.S., after their keystroke input lag raised suspicions with security specialists at the online retail giant. Normally, a U.S.-based remote worker's computer would send keystroke data within tens of milliseconds. This suspicious individual's keyboard lag was "more than 110 milliseconds," reports Bloomberg. Amazon is commendably proactive in its pursuit of impostors, according to the source report.

The news site talked with Amazon's Chief Security Officer, Stephen Schmidt, about this fascinating new case of North Koreans trying to infiltrate U.S. organizations to raise hard currency for the Democratic People's Republic of Korea (DPRK), and sometimes indulge in espionage and/or sabotage. Schmidt says that Amazon has foiled more than 1,800 DPRK infiltration attempts since April 2024. Moreover, the rate of attempts continues apace, with Amazon reckoning it is seeing a 27% QoQ uplift in North Koreans trying to get into the Amazon corporation. However, Amazon's success can be almost entirely credited to the fact that it is actively looking for DPRK impostors, warns its Chief Security Officer. "If we hadn't been looking for the DPRK workers," Schmidt said, "we would not have found them."

Hackers breached approximately 120,000 IP cameras across South Korea and allegedly sold footage captured from private homes, gynecology offices, breastfeeding rooms and massage parlors to an overseas pornography website, prompting an interagency government task force to announce sweeping reforms on December 7.

Police believe one suspect alone hacked 63,000 cameras and produced 545 videos that netted him 35 million won ($24,000) in cryptocurrency; a second suspect, operating independently, compromised 70,000 devices and earned 18 million won from 648 videos. The footage accounted for 62% of all content on the website, which maintains a dedicated "Korean" category. A government survey found that only 59% of installation companies consistently carried out mandatory security measures such as changing default passwords. Lawmakers are now pursuing legislation requiring security-certified IP cameras in sensitive facilities.

Micron, one of the world's three largest memory suppliers, expects the global shortage of DRAM and NAND flash memory to "persist through and beyond" 2026 as AI-driven demand continues to outstrip supply. CEO Sanjay Mehrotra made the forecast during the company's latest earnings call on Wednesday, saying that "supply will remain substantially short of the demand for the foreseeable future." The company posted record quarterly revenue of $13.64 billion, up from $8.71 billion in the same period last year.

Micron recently shuttered Crucial, its consumer-facing brand, to focus on high-bandwidth memory for AI data centers. HBM technology requires three times the silicon wafers of standard DRAM, leaving fewer resources for the chips that go into PCs, smartphones and cars. Micron plans to boost DRAM and NAND shipments by 20 percent next year but acknowledged this won't meet demand. New facilities in Idaho and New York are slated for 2027 and 2030 respectively.

Longtime Linux developer Greg Kroah-Hartman announced that the Linux kernel has received its first CVE tied to Rust code. Phoronix reports: This first CVE (CVE-2025-68260) for Rust code in the Linux kernel pertains to the Android Binder rewrite in Rust. There is a race condition that can occur due to some noted unsafe Rust code. That code can lead to memory corruption of the previous/next pointers and in turn cause a crash. This CVE for the possible system crash is for Linux 6.18 and newer since the introduction of the Rust Binder driver. At least though it's just a possible system crash and not any more serious system compromise with remote code execution or other more severe issues.

An anonymous reader shares a report: Browser extensions with more than 8 million installs are harvesting complete and extended conversations from users' AI conversations and selling them for marketing purposes, according to data collected from the Google and Microsoft pages hosting them.

Security firm Koi discovered the eight extensions, which as of late Tuesday night remained available in both Google's and Microsoft's extension stores. Seven of them carry "Featured" badges, which are endorsements meant to signal that the companies have determined the extensions meet their quality standards. The free extensions provide functions such as VPN routing to safeguard online privacy and ad blocking for ad-free browsing. All provide assurances that user data remains anonymous and isnâ(TM)t shared for purposes other than their described use.

The weight of AI server racks has reached a point where legacy data centers cannot accommodate them even with significant retrofitting efforts, The Verge reports. Chris Brown, chief technical officer at Uptime Institute, said most retrofitting attempts would require "bulldozing the building and starting over from scratch."

AI racks are projected to reach 5,000 pounds compared to the 400 to 600 pounds that racks weighed three decades ago. The dramatic increase stems from hundreds to 1,000 GPUs packed densely into each rack alongside memory chips and liquid cooling systems that can add substantial weight. AI workloads now consume up to 350 kilowatts per rack, 35 times the 10 kilowatts that traditional computer chip workloads averaged a decade ago. Legacy data centers with raised floors typically max out at around 1,250 pounds per square foot for static loads.

Chris McLean, president of Critical Facility Group, said that rack heights have grown from 6 feet to 9 feet over nearly two decades, creating problems with doorframes and freight elevators in older buildings.

A millisecond used to be a big deal for the world's quickest traders. A dispute over huge trading profits at one of the world's largest futures exchanges shows they now think a million times faster [non-paywalled source]. From a report: The controversy is about an arcane technical maneuver in which high-speed traders bombard Frankfurt-based Eurex with useless data. The idea is to keep their connections to the exchange warm so they can react fractionally faster to market-moving information. The battle is the latest chapter in a decadeslong contest among secretive ultrafast trading firms, which have pursued a relentless quest for minuscule speed advantages.

A group of high-frequency trading firms has exploited the practice to rake in hundreds of millions of dollars, says Mosaic Finance, a French firm that has complained to Eurex and European regulators. "An arms race is OK, but you must use legal weapons," said Hugues Morin, founder of Mosaic. Eurex says Mosaic's claims are baseless.

[...] High-speed traders often seek to capture fleeting differences between prices of related assets, making quick response times critical. If benchmark Euro Stoxx 50 index futures rise, for example, contracts tied to Germany's DAX will usually follow. A first mover will be able to buy DAX futures before they tick higher, then sell out at a higher price -- a strategy that can add up to big profits over time. The maneuver that prompted Mosaic's spat with Eurex can improve reaction times by about 3.2 nanoseconds, according to the French firm, which calls it "corrupted speculative triggering," or CST for short.

An anonymous reader quotes a report from BleepingComputer: Audio streaming platform SoundCloud has confirmed that outages and VPN connection issues over the past few days were caused by a security breach in which threat actors stole a database containing user information. The disclosure follows widespread reports over the past four days from users who were unable to access SoundCloud when connecting via VPN, with attempts resulting in the site displaying 403 "forbidden" errors.

In a statement shared with BleepingComputer, SoundCloud said it recently detected unauthorized activity involving an ancillary service dashboard and activated its incident response procedures. SoundCloud acknowledged that a threat actor accessed some of its data but said the exposure was limited in scope. [...] BleepingComputer has learned that the breach affects 20% of SoundCloud's users, which, based on publicly reported user figures, could impact roughly 28 million accounts. The company said it is confident that all unauthorized access to SoundCloud systems has been blocked and that there is no ongoing risk to the platform. "We understand that a purported threat actor group accessed certain limited data that we hold," SoundCloud told BleepingComputer. "We have completed an investigation into the data that was impacted, and no sensitive data (such as financial or password data) has been accessed. The data involved consisted only of email addresses and information already visible on public SoundCloud profiles."

An anonymous reader quotes a report from Ars Technica: Microsoft is killing off an obsolete and vulnerable encryption cipher that Windows has supported by default for 26 years following more than a decade of devastating hacks that exploited it and recently faced blistering criticism from a prominent US senator. When the software maker rolled out Active Directory in 2000, it made RC4 a sole means of securing the Windows component, which administrators use to configure and provision fellow administrator and user accounts inside large organizations. RC4, short for Rivist Cipher 4, is a nod to mathematician and cryptographer Ron Rivest of RSA Security, who developed the stream cipher in 1987. Within days of the trade-secret-protected algorithm being leaked in 1994, a researcher demonstrated a cryptographic attack that significantly weakened the security it had been believed to provide. Despite the known susceptibility, RC4 remained a staple in encryption protocols, including SSL and its successor TLS, until about a decade ago. [...]

Last week, Microsoft said it was finally deprecating RC4 and cited its susceptibility to Kerberoasting, the form of attack, known since 2014, that was the root cause of the initial intrusion into Ascension's network. "By mid-2026, we will be updating domain controller defaults for the Kerberos Key Distribution Center (KDC) on Windows Server 2008 and later to only allow AES-SHA1 encryption," Matthew Palko, a Microsoft principal program manager, wrote. "RC4 will be disabled by default and only used if a domain administrator explicitly configures an account or the KDC to use it." [...] Following next year's change, RC4 authentication will no longer function unless administrators perform the extra work to allow it. In the meantime, Palko said, it's crucial that admins identify any systems inside their networks that rely on the cipher. Despite the known vulnerabilities, RC4 remains the sole means of some third-party legacy systems for authenticating to Windows networks. These systems can often go overlooked in networks even though they are required for crucial functions.

To streamline the identification of such systems, Microsoft is making several tools available. One is an update to KDC logs that will track both requests and responses that systems make using RC4 when performing requests through Kerberos. Kerberos is an industry-wide authentication protocol for verifying the identities of users and services over a non-secure network. It's the sole means for mutual authentication to Active Directory, which hackers attacking Windows networks widely consider a Holy Grail because of the control they gain once it has been compromised. Microsoft is also introducing new PowerShell scripts to sift through security event logs to more easily pinpoint problematic RC4 usage. Microsoft said it has steadily worked over the past decade to deprecate RC4, but that the task wasn't easy. "The problem though is that it's hard to kill off a cryptographic algorithm that is present in every OS that's shipped for the last 25 years and was the default algorithm for so long, Steve Syfuhs, who runs Microsoft's Windows Authentication team, wrote on Bluesky. "See," he continued, "the problem is not that the algorithm exists. The problem is how the algorithm is chosen, and the rules governing that spanned 20 years of code changes."

A critical React vulnerability (CVE-2025-55182) is being actively exploited at scale by Chinese, Iranian, North Korean, and criminal groups to gain remote code execution, deploy backdoors, and mine crypto. The Register reports: React maintainers disclosed the critical bug on December 3, and exploitation began almost immediately. According to Amazon's threat intel team, Chinese government crews, including Earth Lamia and Jackpot Panda, started battering the security hole within hours of its disclosure. Palo Alto Networks' Unit 42 responders have put the victim count at more than 50 organizations across multiple sectors, with attackers from North Korea also abusing the flaw.

Google, in a late Friday report, said at least five other suspected PRC spy groups also exploited React2Shell, along with criminals who deployed XMRig for illicit cryptocurrency mining, and "Iran-nexus actors," although the report doesn't provide any additional details about who the Iran-linked groups are and what they are doing after exploitation. "GTIG has also observed numerous discussions regarding CVE-2025-55182 in underground forums, including threads in which threat actors have shared links to scanning tools, proof-of-concept (PoC) code, and their experiences using these tools," the researchers wrote.

A Kansas man who sued Verizon in small claims court after the carrier refused to unlock his iPhone has won his case, scoring a small but meaningful victory against a company that retroactively applied a policy change to deny his unlock request.

Patrick Roach bought a discounted iPhone 16e from Verizon's Straight Talk brand in February 2025, intending to pay for one month of service before switching the device to US Mobile. Under FCC rules dating back to a 2019 waiver, Verizon must unlock phones 60 days after activation on its network. Verizon refused to unlock the phone, citing a new policy implemented on April 1, 2025 requiring "60 days of paid active service."

Roach had purchased his device over a month before that policy took effect. Magistrate Judge Elizabeth Henry ruled in October 2025 that applying the changed terms to Roach's earlier purchase violated the Kansas Consumer Protection Act. The court ordered Verizon to refund Roach's $410.40 purchase price plus court costs. Roach had previously rejected a $600 settlement offer because it would have required him to sign a non-disclosure agreement. He estimated spending about 20 hours on the lawsuit but said "it wasn't about" the money.