Category: Commentary

Just before midnight on October 7, a drone strike set fire to a Yandex data center in Sasovo, a town in Russia’s Ryazan region about 300 km from Moscow. The fire stopped all work in the building. Computing reports that one of Yandex Cloud’s availability zones, known as ru-central1-b, went offline, and that Yandex told customers the zone is unlikely to come back soon and that they should make other plans.

Yandex did not say who was behind the attack. Ukrainian media credited Ukraine, and President Zelensky said Ukraine responds in kind when Russia strikes Ukrainian data centers. This post is not about the war. It is about what the incident shows anyone who keeps their data, their business or their website “in the cloud.”

No malware, no hacker

Most of what we write about here is digital: stolen passwords, unpatched servers, ransomware. This outage had none of that. Yandex’s status page first called it a power failure. A later update said a fire caused by a drone had shut the site down.

Users reported problems at banking services, Russian Railways, the video site RuTube and the property site Cian. On the afternoon of October 8, the websites of several major Russian news outlets stopped loading for a time. Meduza noted the timing but did not confirm the strike caused it, and those sites were back up the same day.

It is easy to forget that “the cloud” is a marketing word. Every file you store there sits on a disk in a real building, with real power lines, cooling and a roof that can catch fire.

The name itself is part of the reason we forget. For decades, engineers drew the telephone network, and later the internet, as a cloud on their diagrams. The symbol meant the part you did not manage and did not need to see. When companies began renting out servers and storage in the mid-2000s, they borrowed the same picture, and its meaning came along with it: don’t worry about what’s inside. The buildings were there all along. The word was simply chosen to hide them.

What an availability zone is supposed to do

Large cloud providers divide each region into availability zones. Each zone is a separate data center, or group of them, with its own power and network. The idea is that if one zone fails, a service spread across two or three zones keeps running in the zones that are still up.

That design works only for customers who use it. A company that put everything in one zone because it was cheaper or simpler has nowhere to fail over to when that zone disappears. From the outside, we cannot tell which of the affected services had made that choice. But the spread of the outages suggests that more than a few had.

Not the first time this year

Computing points out that if the Sasovo zone is not restored, it will be the second data center lost to a military strike this year. The first was an AWS facility in Bahrain, which Iran struck in March.

Data centers have always faced fires, floods and power cuts. What is new is that they are now plainly treated as targets. Any plan for keeping a service running has to account for a building simply being gone.

What we do not know

Yandex has not said how much customer data, if any, was lost, or whether it was copied to other zones beforehand. Two of the company’s three supercomputers, which it uses to build its AI model, are in the same building, and Yandex has not said whether they still work. There is also no public timeline for rebuilding.

What you can do about it

Most readers do not run a cloud platform, but many of us run a website, a small business or a family photo archive that depends on one. The lessons scale down well:

• Keep a backup somewhere else. A backup stored in the same data center as the original will burn with it. Use a different provider, or at least a different region. On my own servers, backups go to a separate company entirely.
• Test a restore. A backup you have never restored from is a hope, not a plan. Try bringing one back at least once.
• Ask your host where your site lives. Find out which data center or region holds your site, and whether your plan copies anything to a second location.
• Keep the files you cannot replace in two places you control. For personal photos and documents, that can be as simple as an external drive at home plus one cloud service.

Security usually means keeping the wrong people out. Sometimes it means surviving when the building itself is gone. The cloud makes that easier than it used to be, but only for those who plan for it.

This week Google said attackers had hijacked three country-code registries and used them to obtain security certificates for Google and YouTube addresses. The registries were those for Ghana (.gh), Sierra Leone (.sl) and American Samoa (.as). Google’s own systems were not breached. The Hacker News searched the public certificate logs and found at least 12 certificates covering seven addresses, among them google.com.gh, google.sl and youtube.as. They were issued between September 22 and 27, and all had been revoked by October 1.

My first reaction was a question: how does a registry get hijacked? For years I had assumed that every registry had to meet a minimum security standard. That turns out to be only half true.

Two kinds of registry

A registry is the organization that keeps the master list for one domain ending. Generic endings such as .com and .org are run under a contract with ICANN, the body that coordinates the domain name system. That contract sets technical requirements, and ICANN can enforce it.

Country codes are different. Every two-letter ending belongs to a country or territory, and its rules are set there. ICANN’s own compliance page says it has no contract authority to take compliance action against country-code operators. Some of them have signed voluntary frameworks with ICANN, but those are limited in scope.

So the standard I had in mind exists for one group and not the other. Some country registries are large, well-funded organizations. Others are small. No outside body is required to check either kind.

Who runs these three

The public records kept by IANA, the office that manages the top of the domain system, name the manager of each ending:

• .gh: Network Computer Systems Limited, a company in Accra, Ghana.
• .sl: Sierratel, in Freetown, Sierra Leone.
• .as: AS Domain Registry, in Pago Pago, American Samoa, with a New Jersey firm, GDNS, LLC, listed as its technical contact.

That is three separate organizations, with no shared operator in the records. Yet certificates for all three endings were issued within five days of each other.

What we do not know

The records say who is responsible. They say nothing about how well each registry was secured. Google has not said who the attackers were, how they got in, whether the registries are secure now, or whether any certificate was used against real people. Help Net Security reports that the way in was the third-party operators of the three endings.

It would be unfair to assume any of the three was careless. Determined attackers have broken into far larger organizations. Google also said other well-known brands were affected, and added that “we cannot guarantee that our analysis identified every affected domain.”

Why one registry matters so much

The padlock in your browser depends on a certificate. A certificate authority issues one to whoever can prove control of a domain, usually by placing a record in that domain’s DNS. The registry decides where the DNS for every domain under its ending points. Whoever controls the registry can therefore pass that test for any domain under it.

That is why Google said it had no reason to believe the certificate authorities did anything wrong. The padlock system worked as designed. The layer underneath it did not.

This is not a new idea either. In 2019, Cisco’s Talos researchers described a campaign they called Sea Turtle, which hijacked DNS in the same way. The operator of Greece’s country-code registry acknowledged that year that its network had been compromised.

What you can do about it

For most readers the answer is very little, and that is fine. The certificates have been revoked and Chrome blocks them. Keeping your browser up to date remains the habit that matters.

If you own a domain, Google’s advice is worth following whatever ending you use:

• Watch the certificate logs. Every certificate issued for your domain is recorded in public logs, and there are services that will tell you when a new one appears. One you did not ask for is a warning sign.
• Publish a CAA record. This is a DNS record that names which certificate authorities may issue for your domain. Google notes that it cannot stop an attacker during an active hijack, but it can stop more certificates from being issued once control is restored.
• Know which of your endings are country codes. Popular endings such as .tv, .co, .io and .ai are all country codes. That is not a reason to avoid them. It is a reason to know who runs the ending your site depends on, which IANA lists publicly.

The padlock still means something. It rests on more hands than most of us realized, and not all of them are held to the same standard.

Google is testing a setting for its Gemini app on the Mac that would let the AI assistant read, create, change and delete files anywhere on the computer, work inside apps such as Mail, Safari and Messages, and browse the web. The setting is hidden and unfinished. It was spotted by TestingCatalog and reported by BleepingComputer, and Google has not said when it will be released. Nothing has changed on anyone’s Mac today. But the direction is clear, and it is easier to think this through now than on the day the switch appears.

What is being offered

The appeal is real. An assistant that can find the file, fill in the form, tidy the folder and send the email is far more useful than one that can only talk. Google is not alone here either. Other AI companies already offer assistants that can work on your computer, and BleepingComputer compares Google’s plan to one of them.

The setting is called “additional sandbox options.” A sandbox is the set of walls that keeps a program inside its own area of the computer. More options, in this case, means fewer walls. According to the wording found in the app, Gemini may then act “without asking for your permission first.” It would still stop and ask before buying something, moving money, opening an account, accepting legal terms or changing personal information.

Why this is a security story

One of the oldest rules in computer security is that a program should have only the access it needs to do its job. Full access to everything is the opposite of that rule, and three things follow from it.

Mistakes get bigger. An assistant that can delete files anywhere can delete the wrong ones. No attacker is needed for that, only a misunderstood request.

Hidden instructions become dangerous. An assistant that reads web pages and email reads whatever is written there, including text planted for it to find. Researchers call this prompt injection, and it is a known weakness of AI assistants in general. One that can read your files and also send mail is a much bigger prize for that trick than one that can only chat.

The safety list has gaps. As reported, the confirmations cover money, accounts and legal terms. The list does not mention deleting a file or sending a message. That may change before release, and it is the first thing I would check when the feature arrives.

Apple, meanwhile, is reported to be considering limits on how AI assistants reach personal files on a Mac. When the company that makes the computer and the company that makes the assistant are pulling in different directions, the question is not settled yet.

What you can do about it

• Leave it off until you have a job for it. From what has been reported, this is something you turn on, not something that arrives switched on. Wait until there is a task that needs it.
• Share a folder, not the whole Mac. If the assistant only needs your project folder, give it that folder. Tax returns and family photos do not need to be in reach.
• Keep the confirmations, and read them. A prompt you click through without reading protects nothing.
• Try it in a separate user account first. A Mac lets you add a second user with none of your documents in it. That is a safe place to see how an assistant behaves.
• Keep a backup that is not connected to your computer. It covers you whether a file is lost to an attacker or to an over-eager assistant. Ransomwear.org explains how ransomware works and how to guard against it.

None of this means the feature is a bad idea. It means it is a decision, and one worth making on purpose instead of by clicking Allow.

Microsoft published its 2026 Digital Defense Report this week, and one finding in it deserves more attention than it will get: attackers are currently getting more out of artificial intelligence than the people defending against them. Microsoft sells security software for a living. When it says the other side is ahead, that is worth taking seriously.

What the report says

The headline number is about speed. According to the report, the typical gap between a software flaw coming to light and that flaw being turned into a working attack has fallen to well under 24 hours. Work that once took an intruder days after breaking in can now take minutes.

The report is careful not to oversell this. Most real attacks still have a person directing them, and fully automatic attacks remain rare. Microsoft also expects defenders to catch up eventually. But it warns of a period of several years in which known flaws pile up faster than they get fixed.

A second story points the same way

The same week brought a stranger report. The research lab Transluce says AI agents, meaning software that carries out tasks on its own, tried to break into US and Canadian government websites. On one day in June they sent more than 200,000 requests to a US Department of Education site. They appear to have been collecting school statistics and old divorce records, and along the way they used break-in techniques to try to get at the data. Officials say no private information was accessed, and the researchers could not say with confidence whose agents they were.

If the researchers are right, nobody had to set out to attack anything. Software sent on an ordinary errand reached for a burglar’s tools.

Why speed is the real story

For most of the history of computer viruses, defenders had time on their side. A flaw would be found, a fix would follow, and the people who got hurt were mostly those who never installed it. When the gap shrinks to hours, “I’ll update it this weekend” stops being a safe plan.

What you can do about it

• Turn on automatic updates for your phone, computer, browser, and home router. This is now the single most useful step, because it closes the gap without relying on your memory.
• Add a second step to your sign-in on email and bank accounts, or use a passkey where one is offered. A stolen password is worth far less when it is not enough on its own.
• Treat an urgent call or video as unproven. The report describes fake identities and deepfake video being used in real schemes. If someone asks for money or a password, hang up and call back on a number you already have.
• Keep a backup that is not connected to your computer. If the worst happens, a backup turns a disaster into an inconvenience. Ransomwear.org explains how ransomware works and how to guard against it.

None of this is new advice. What has changed is how little time there is to act on it. The attackers have picked up speed, so the habits that protect us need to run on their own.

This site covers two kinds of viruses, and this week both kinds made the news for the same reason: something began spreading before a fix was ready. One story is about turkeys in Minnesota. The other is about email servers. The way each is being handled is almost the same.

The biological outbreak

After a quiet summer, H5N1 avian flu is back on commercial poultry farms in the United States. Over the past 30 days it has been confirmed in 14 commercial and seven backyard flocks, affecting about 620,000 birds. That is up from a seasonal low of about 150,000 in August. Minnesota is the hardest-hit state, and detections in wild birds are rising as the fall migration gets under way.

The digital outbreak

On October 1, Fortinet warned that attackers are already exploiting a critical flaw in FortiMail, an email security product that organizations use. The flaw is rated 9.8 out of 10 for severity. It lets someone who has not even logged in write files onto the system, and security updates for it are not yet available.

The same four moves

Set the two stories side by side, and the response follows the same order.

1. Watch closely. Farm outbreaks are confirmed and counted flock by flock, and wild birds are tested. For software, the equivalent is the published advisory and the list of warning signs Fortinet has given customers to check their systems against.
2. Report early. Both systems depend on someone saying “we have a problem” before the full picture is known. Fortinet published its advisory while the attacks were under way and before a fix existed.
3. Contain it before you can cure it. With no fix yet, Fortinet’s advice is to switch off the affected feature and limit who can reach the management screen. That is a quarantine. Poultry farms do the same thing with strict controls on who and what comes onto the property.
4. Set a deadline. CISA, the US cybersecurity agency, gave federal agencies until October 4 to act. Speed decides how far either kind of outbreak travels.

Where the comparison ends

The two are not the same. Bird flu’s return each fall follows the migration, so it can be anticipated. A flaw like this one arrives without warning, which is why it is called a zero-day: defenders have had zero days to prepare. The stakes differ too. One is about animals, the food supply, and public health. The other is about data and money.

What it means for you

Few of us run an email server or a turkey farm. Our part is smaller, but it is real. Keep your own devices updating automatically, because the same race between flaw and fix plays out on phones and laptops. And follow the long-standing public health advice on bird flu: do not handle sick or dead wild birds, and cook poultry and eggs thoroughly. If you keep a backyard flock, your state agriculture department publishes guidance on protecting it.

This article is general information, not medical or veterinary advice.