A contractor for the Cybersecurity and Infrastructure Security Agency (CISA) inadvertently published 844 MB of sensitive data to a public GitHub repository. The exposure included administrative credentials for three AWS GovCloud instances, which are isolated cloud regions designed to host sensitive government workloads and regulated data. Alongside these cloud keys, the repository contained plaintext usernames and passwords for dozens of internal systems and various infrastructure-as-code files.

Source

Microsoft research has detailed a year-long campaign by the ShinyHunters extortion group that compromised numerous Salesforce environments by abusing trusted OAuth relationships. The attackers did not exploit software vulnerabilities but instead relied on three distinct paths to gain access: voice-phishing (vishing) to trick users, compromising third-party SaaS vendors, and misconfiguring guest-user permissions. These methods allowed the threat actors to bypass traditional multi-factor authentication and sign-in alerts by operating through legitimate, authorized application workflows.

Source

Microsoft has overhauled the resource management architecture for Windows Subsystem for Linux to prevent demanding workloads from crashing the entire environment. Previously, resource-heavy operations like software compilation could trigger out-of-memory events that left the subsystem unresponsive even after usage subsided. The new design ensures that essential background services always have the necessary overhead to maintain communication with the host Windows OS.

Source

Security researchers discovered that xAI’s Grok Build CLI version 0.2.93 automatically transmitted entire local Git repositories to a Google Cloud Storage bucket. This data exfiltration included every tracked file, the complete commit history, and unredacted secrets found in .env files. The tool uploaded gigabytes of data even when the AI model only required a few kilobytes of text to process a specific coding task.

Source

Apple has filed a lawsuit against OpenAI and two former employees alleging the misappropriation of trade secrets related to unreleased hardware and supply chain strategies. The complaint centers on former engineer Chang Liu, who allegedly exploited a previously unknown authentication vulnerability to maintain access to Apple’s internal network after his departure. Apple claims this zero-day bug allowed Liu to bypass standard logout controls and repeatedly access a cloud-based repository containing confidential engineering presentations and technical specifications.

Source

Microsoft is rolling out a significant update to the Windows 11 search experience that prioritizes local files, apps, and settings over web-based content. This overhaul is part of the broader Windows K2 initiative, which aims to address user feedback regarding operating system clutter and performance issues. The update is currently available to Windows Insiders in the Experimental Channel and is expected to reach all users later this year.

Source

Mozilla has announced plans to shift Firefox for desktop and Android to a bi-weekly release cadence beginning in September 2026. This experimental move transitions the browser from its current four-week cycle to a faster schedule to deliver ready-to-ship features more frequently. The change officially begins with the release of Firefox 155 on September 1, 2026, following the final monthly update of version 154 in August.

Source

Researchers have identified at least eleven vulnerable UEFI shim bootloaders that allow attackers to bypass Secure Boot on any system trusting the Microsoft third-party certificate authority. These shims, primarily version 0.9 or older, act as a bridge between firmware and the operating system but contain decade-old flaws that can be exploited to execute unsigned code. Because attackers can simply bring their own copy of a trusted but vulnerable binary to a target machine, the protection is undermined regardless of the installed operating system.

Source

Google Credential Provider for Windows (GCPW) now supports FIDO2-compliant physical security keys as a second-factor authentication method. This tool allows users to access Windows 10 and 11 devices using their Google Workspace credentials rather than traditional local or Active Directory accounts. The update aims to strengthen organizational security by introducing phishing-resistant hardware authentication directly at the Windows login screen.

Source

Au programme :

L’état des lieux de la technologie (carbone, autonomie (par grand froid), nouvelles technos batteries, usure)

L’état des lieux du marché (marques, prix, ventes, projections)

La question de la conduite autonome (techno, juridique en Europe)

Infos :

Animé par Patrick Beja (Bluesky, Instagram, Twitter, TikTok).

Co-animé par Cédric Ingrand (Twitter et Bluesky).

Produit par Patrick Beja (LinkedIn) et Fanny Cohen Moreau (LinkedIn).

Musique libre de droit par Daniel Beja

Le Rendez-vous Tech épisode 674 – Spécial : Mais où en sont les voitures électriques ?

---

Liens :

Soutien :

😎 Soutien Patreon : Patreon.com/RDVTech

🤑 Lien affilié Amazon : https://www.amazon.fr/?tag=notpatrick-21

🤑 Boutique NotPatrick : https://amzn.eu/d/04qcUxOS

Communauté :

🤗 Discord : NotPatrick.com/discord

Podcasts :

🎧 Le RDV Tech: NotPatrick.com/#rdvtech

🎧 Le RDV Jeux: NotPatrick.com/#rdvjeux

🎧 L’Actu Tech (podcast daily): NotPatrick.com/#lactutech

Par écrit :

📰 Newsletter : NotPatrick.com/newsletter

📰 Archives NL: NotPatrick.com/archivenl

📢 WhatsApp : NotPatrick.com/whatsapp

En vidéo :

📹 Live : Twitch.tv/NotPatrick

📺 VOD : YouTube.com/NotPatrickPodcasts

📺 YouTube gaming : Youtube.com/NotPatrick

📱 TikTok : Tiktok.com/@NotNotPatrick

💁 Tous les liens : NotPatrick.com

---

Hébergé par Acast. Visitez acast.com/privacy pour plus d'informations.

💾

Amazon Bedrock has added general availability for the OpenAI GPT-5.6 model family, consisting of the Sol, Terra, and Luna tiers. Sol serves as the flagship model for complex reasoning and autonomous coding, while Terra offers balanced performance for everyday production tasks. Luna provides a high-speed, low-cost option optimized for low-latency applications like real-time classification and summarization.

Source

Chinese AI models now process the majority of traffic on major developer marketplaces, marking a massive shift from American dominance just one year ago. While US frontier models maintain a lead in complex reasoning, Chinese providers like DeepSeek and Alibaba have captured the high-volume market by offering significantly lower costs. This transition is largely driven by US export controls, which forced Chinese firms to innovate in compute efficiency and open-source accessibility.

Source

Anthropic has introduced a new tokenizer for its Claude Sonnet 5 and Opus models that significantly increases the number of tokens generated for the same input text. Tokenizers are essential components that translate human language or code into numerical integers that large language models can process. Because AI providers bill based on token volume, this architectural change directly impacts the total cost of ownership for organizations utilizing these models.

Source

Organizations are increasingly seeking to reclaim control over their digital infrastructure to reduce dependency on global technology giants and non-European legal frameworks. This shift toward digital sovereignty is driven by concerns over data privacy, national security, and legal mandates like the U.S. Cloud Act, which can conflict with local regulations. However, achieving autonomy often introduces technical complexity, higher infrastructure costs, and potential friction in public administration workflows.

Source

OpenAI has made its GPT-5.6 model family generally available on Amazon Bedrock, introducing three distinct capability tiers named Sol, Terra, and Luna. These models run on a next-generation inference engine designed to provide high performance and reliability within the AWS ecosystem. System administrators can access these models through the Bedrock console or the Responses API via the bedrock-mantle endpoint.

Source

Microsoft will officially retire its native telephony-based authentication services, including SMS one-time codes and voice calls, on February 1, 2027. This change ends the built-in delivery of these methods within Entra ID to encourage the adoption of phishing-resistant alternatives. Organizations that fail to transition by this deadline risk significant sign-in disruptions for users who rely solely on phone-based verification.

Source

Microsoft Entra ID will begin a major transition on September 1, 2026, by making passkeys the default authentication method for all public cloud tenants. Users currently relying on SMS or voice-based multifactor authentication will be automatically enabled for passkeys and prompted to register one during their next sign-in challenge. This shift aims to replace phishable credentials with public-key cryptography, which uses local device biometrics or PINs to ensure authentication data never leaves the user's hardware.

Source

Researchers at Peking University have developed an all-optical interconnect system that links standard electronic chips to significantly accelerate artificial intelligence processing. This breakthrough utilizes specialized hardware to replace traditional electrical connections between chips with high-speed optical "joints." By integrating these optical links with custom algorithms, the system achieves AI inference speeds up to 100 times faster than conventional methods.

Source

The 2026 World AI Conference and High-Level Meeting on Global AI Governance is scheduled to take place in Shanghai from July 17 to July 20. Chinese President Xi Jinping will attend the opening ceremony to deliver a keynote speech regarding the future of artificial intelligence. This appearance marks the first time the Chinese leader will attend the annual flagship event in person since its inception in 2018.

Source