Posts of last few hours

为让数据中心有充足电力 Google 将付钱给其他人少用电
Google 正资助美国规模最大的虚拟电厂项目。该项目通过向家庭和企业提供经济激励，鼓励他们在电力需求高峰期间减少用电量，从而为数据中心提供更多的电网容量。该项目有望在中大西洋地区的 PJM 电网提供 1070 MW 的电力容量——相当于一座大型核反应堆的输出电力。很多削减用电量措施能自动执行，如利用智能恒温器在夏季用电高峰期调低空调运行强度，或者通过电池系统提供临时电力。与 Google 合作的能源服务公司 Voltus 表示，通过聚合成千上万家企业和家庭的用电，该项目能在最需要用电的时候可靠提供大量额外电力容量，而且能在几年内实现。尽管科技公司若想持续建设大型数据中心，最终仍需建造传统的发电厂，但在过渡阶段虚拟电厂方案不失为一种更快捷、更经济且污染更少的选择。

https://www.solidot.org/story?sid=85701
研究揭示丹尼索瓦人的长相
中科院研究人员首次揭示出神秘古丹尼索瓦人的形态共性。丹尼索瓦人是一支已灭绝的古老人类支系，2010 年科学家依靠西伯利亚丹尼索瓦洞化石的 DNA 证据发现了这一人群。后续分子证据显示，丹尼索瓦人曾广泛分布在亚洲多地，生存时间大约在距今 30 万年至 4.5 万年前。但他们究竟长什么样？位于河北阳原的许家窑遗址 1976—1979 年共发掘出土包括头骨、下颌骨、牙齿在内的 20 件人类化石，至少代表 16 个不同年龄阶段的个体。许家窑人化石历经十余万年的埋藏，古 DNA 提取近乎无望，研究团队转向古蛋白质组学这一相对新兴的技术路径，从许家窑地点保存的 20 件标本中，无损获取内源性蛋白质开展系统发育研究，以古蛋白质证据明确支持许家窑人属于丹尼索瓦人。在此基础上，研究团队系统总结出丹尼索瓦人在颅骨、下颌骨和牙齿上的典型形态特征。综合研究推测，丹尼索瓦人具有低矮后倾的额头、粗壮眉脊、面部扁平、突颌减弱等面部特征。

https://www.solidot.org/story?sid=85700
美光桃园厂工会否决奖金方案
美光桃园厂工会星期五（10月23日）说，会员投票否决公司提出的新利润分享方案，并警告可能采取进一步集体行动，争取更公平的奖金制度。美光过去数周一直与桃园及台中两座工厂的工会就薪酬问题谈判。两个工会共代表两厂 1 万 5000 名员工中的 1 万 2000 人。两个工会此前均要求，公司发放相当于 83 个月薪资的一次性奖金，并建立长期利润分享制度，将营业利润的 15% 用于员工奖金，按季而非按年发放。美光与规模较大的台中厂工会星期三（10月21日）达成协议。根据薪酬和福利改革方案，公司将从 2027 财年起，为全球员工增设季度利润分享奖金，与原有激励奖金计划（IPP）并行，新增奖金以现金和股票各半的方式发放。桃园工会与管理层仍未达成共识，并在星期四举行小规模罢工，向公司施压。工会星期五发表声明说，2300 多名会员中，约七成投票否决了公司星期四提交的利润分享方案。工会警告，可能采取进一步集体行动，争取更公平的利润分享制度，并称“抗争尚未结束，我们也没有放弃”。双方的下一轮协商定于 10 月 27 日举行。

https://www.solidot.org/story?sid=85699
NASA разгоняет Психею почти ничем. Через три года она будет нестись со скоростью 160 900 км/ч
Электрические двигатели отключают ради связи с Землёй и технических операций.
https://www.securitylab.ru/news/579139.php
Google 修改隐私条款将 Gmail 和照片数据用于个性化广告
Google 修改了隐私政策，允许将 Gmail 和相册数据用于个性化广告。新政策于 10 月 16 日生效。新政策没有默认启用，而是声明：“我们可能还会根据您的兴趣以及您在 Google 服务中的活动或个性化内容，向您展示个性化广告，具体取决于您的设置。例如，如果在 Google 搜索中搜索“山地自行车”，您可能会在 YouTube 上看到运动装备广告...我们不会根据您在 Google 云端硬盘、Gmail 和 Google 相册中的内容向您展示个性化广告，除非您选择允许其他支持个性化广告的 Google 服务使用这些服务中的数据。”也就是如果用户不希望 Gmail 和 Google 相册中的内容被用于个性化广告需要切断关联服务，方法是：Google 账号 —— 数据和隐私设置——个性化设置——搜索服务个性化——更多个性化智能服务——关联的内容应用，切断 Google Workspace 关联。

https://www.solidot.org/story?sid=85698
Хаббл увидел одну галактику дважды. Виновата невидимая материя
Искажение света поможет телескопу имени Нэнси Грейс Роман искать скрытую массу во Вселенной.
https://www.securitylab.ru/news/579159.php
Китайские редкоземельные металлы стали угрозой производству GPU. TSMC ищет оборудование без них
Даже многомиллиардные фабрики оказались уязвимы перед ограничениями на поставки сравнительно простых компонентов.
https://www.securitylab.ru/news/579155.php
Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software
A memory-corruption flaw in Google's Brotli decoder sits in many programs that unpack Brotli-compressed data, among them Bun, the Python Brotli and brotlicffi packages, and Envoy proxies set up to decompress Brotli. Tracked as CVE-2026-111497, the flaw allows crafted compressed data to overwrite past the end of a buffer and corrupt a program's memory, potentially
https://thehackernews.com/2026/10/brotli-decoder-flaw-behind-nodejs-rce.html
Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline
LiteLLM on Friday revealed that an Agent Platform master key accidentally published to a public GitHub repository in late May 2026 ultimately allowed the threat actor to push a malicious version of the popular Python package. "On May 27, 2026, a configuration file was committed to the public LiteLLM-Labs/lite-harness repository which inadvertently contained the master key to a deployment of
https://thehackernews.com/2026/10/leaked-litellm-master-key-let-attackers.html
【安全圈】Ruby正则引擎爆底层缺陷！4个GitLab满分RCE连环穿
PHP发布8.5.12/8.4.27/8.3.36/8.2.35修复两个未认证RCE严重漏洞，mod_php风险最高已有演示利用，附官方缓解措施
https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652079481&idx=3&sn=31aadf7c74c78b0772524533b6b041be
【安全圈】Brotli解压越界写引爆供应链！Node等全系沦陷
PHP发布8.5.12/8.4.27/8.3.36/8.2.35修复两个未认证RCE严重漏洞，mod_php风险最高已有演示利用，附官方缓解措施
https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652079481&idx=2&sn=fe9a1828c37180934ccad8c4431b604f
【安全圈】荷兰白帽暗推两百万补丁！终结废弃软件僵尸网络危机
PHP发布8.5.12/8.4.27/8.3.36/8.2.35修复两个未认证RCE严重漏洞，mod_php风险最高已有演示利用，附官方缓解措施
https://mp.weixin.qq.com/s?__biz=MzIzMzE4NDU1OQ==&mid=2652079481&idx=1&sn=dc63f64ee6d18a7d91f3bd9f1b5d0114
Google Says Gmail and Photos Data Shared With AI Search Could Be Used for Targeted Ads
Google has updated its privacy policy to spell out that using personalized artificial intelligence (AI) features in Search or Gemini could allow the company to serve targeted ads to users based on their activity on other connected Google services. "You may choose to allow certain Google services, including services like Search or Gemini Apps, to access data from other Google services you use,
https://thehackernews.com/2026/10/google-says-gmail-and-photos-data.html
Capcom Data Breach Exposes 11.7 Million Email Addresses
Capcom disclosed a data breach exposing 11.7 million email addresses and account details after hackers accessed its CAPCOM ID service. Japanese gaming company Capcom has disclosed a data breach discovered on October 19 involving its CAPCOM ID service, which provides access to online services and games. As of October 22, attackers stole 11,774,247 email addresses, […]
https://securityaffairs.com/201626/data-breach/capcom-data-breach-exposes-11-7-million-email-addresses.html
Could Your AI Bill Get Even Harder to Read?
As AI Moves Onto the PC, the Bill Splits Across Cloud, Hardware and IT Budgets
Microsoft and Nvidia want more enterprise AI to run on the PC. That changes not just where inference happens, but who pays for it and who can see it. As cloud token costs give way to hardware, maintenance and security expenses, enterprises face new challenges in tracking total AI spending.
https://ransomware.databreachtoday.com/blogs/could-your-ai-bill-get-even-harder-to-read-p-4226
Why AI Labs, HR Giants Are Emerging as Cybersecurity Buyers
Identity Governance and Vulnerability Remediation Startups Draw Unexpected Suitors
Workday's buy of C1.ai, Cohere's purchase of Aisle and OpenAI's reported talks with Trail of Bits highlight how AI providers and enterprise software companies are expanding into cybersecurity, creating new startup exit opportunities while raising questions about competition and partner independence.
https://ransomware.databreachtoday.com/blogs/ai-labs-hr-giants-are-emerging-as-cybersecurity-buyers-p-4227
Live Webinar | Defeat 5 Common Ransomware Attacks with Object First + Veeam
https://ransomware.databreachtoday.com/webinars/live-webinar-defeat-5-common-ransomware-attacks-object-first-veeam-w-7466
Live Webinar | Hurtling Toward a Cybersecurity Crisis: The Hidden AI Risks Businesses Can’t See
https://ransomware.databreachtoday.com/webinars/live-webinar-hurtling-toward-cybersecurity-crisis-hidden-ai-risks-w-7467
ISMG Editors: Stolen Vendor API Secret Exposes Microsoft 365
ConnectWise Supply-Chain Hack, Rogue AI Agents and Rising AI Token Costs
In this week's panel, four ISMG editors discussed the potentially far-reaching supply-chain attack involving ConnectWise, growing concerns over rogue AI agents, and Microsoft and Nvidia's push to bring AI processing back onto company hardware as enterprises grapple with rising token costs.
https://ransomware.databreachtoday.com/ismg-editors-stolen-vendor-api-secret-exposes-microsoft-365-a-33195
Why HR Belongs at the Center of AI Change
Netskope Exec Mike Anderson on Trust, Training and Change Management
AI adoption can unsettle employees who fear being replaced, even as leaders expect them to use new tools. Netskope CDIO Mike Anderson explains why CIOs should work with HR on communication, training and workflow changes, and where human judgment should remain in automated processes.
https://ransomware.databreachtoday.com/hr-belongs-at-center-ai-change-a-33196

Managed ad