❌

Visualização normal

Antes de ontemStream principal
  • ✇Firewall Daily – The Cyber Express
  • Alpine Linux SSH Flaw Lets Attackers Log In Without a Password Ashish Khaitan
    Administrators running sshd on Alpine Linux servers are being told to update openssh and restart sshd right away, since upgrading the package alone leaves the old daemon running. A flaw in the OpenSSH server lets attackers log in without a password. Those who cannot patch yet can close the hole by setting PasswordAuthentication to no and restarting sshd.  How the OpenSSH Server Flaw Works  An attacker who can reach the SSH port gets in with a single connection that works every time, with n
     

Alpine Linux SSH Flaw Lets Attackers Log In Without a Password

6 de Novembro de 2026, 05:12

Alpine Linux servers

Administrators running sshd on Alpine Linux servers are being told to update openssh and restart sshd right away, since upgrading the package alone leaves the old daemon running. A flaw in the OpenSSH server lets attackers log in without a password. Those who cannot patch yet can close the hole by setting PasswordAuthentication to no and restarting sshd. 

How the OpenSSH Server Flaw Works 

An attacker who can reach the SSH port gets in with a single connection that works every time, with no retries. The attacker needs the name of an account whose password field is * (normal for key-only accounts) plus at least one other account with a $5$ or $6$ hash, then sends a password of 257 to 1,024 bytes. One user with a password exposes every account without one.  When built without PAM, sshd hashes each attempt with crypt() and compares it to the stored field, borrowing another account's salt when that field is too short to hold one. musl's crypt() returns * as an error indicator for keys over 256 bytes, which exactly matches the stored field of passwordless accounts. OpenSSH 10.6p2 fixes this, and no CVE had been assigned at the time of writing. 

Which Alpine Linux Servers Are Affected 

Alpine Linux servers are vulnerable when they run openssh-server (built without PAM) or openssh-server-pam with UsePAM no, keep the default PasswordAuthentication yes, hold at least one local $5$ or $6$ hash, and have an account with a * password field. That includes root, shipped as root:* in the base image since about Alpine 3.16. The default PermitRootLogin prohibit-password shields root unless it is set to yes, but not if another account can become root through doas. Key-only users created with adduser or usermod -p '*', directory users via musl-nscd (nslcd, winbind, sssd), and the tiny-cloud alpine user also count. Every release checked is affected: 3.21 through 3.24, edge, and the older 3.16 to 3.20.  Safe setups include containers not running sshd, systems with PasswordAuthentication no or UsePAM yes, locked accounts (user:! in /etc/shadow), machines with no $-style hash, and cloud-init images, which write PasswordAuthentication no. 

Patching the OpenSSH Server 

Running apk upgrade -U -a, followed by rc-service sshd restart, applies the fix, which ships in Alpine 3.21.10, 3.22.8, 3.23.8 and 3.24.4. Fixed builds are edge 10.6_p2-r0, 3.24 10.3_p1-r2, 3.23 10.2_p1-r1, 3.22 10.0_p1-r11, 3.21 9.9_p2-r1, 3.20 9.7_p1-r6, 3.19 9.6_p1-r3, 3.18 9.3_p2-r4, 3.17 9.1_p1-r7 and 3.16 9.0_p1-r6. Although 3.21 reached end of support on 2026-11-01, patched packages go back to 3.16.  For the workaround, root should first confirm key login works and keep the current session open. A drop-in file, /etc/ssh/sshd_config.d/00-no-passwords.conf (read from 3.19 onward), sets PasswordAuthentication no, while a sed command flips every such line in sshd_config, Match blocks included, and saves sshd_config.bak. Running sshd -t && rc-service sshd restart, then sshd -T | grep -i passwordauthentication, should print passwordauthentication no. Deleting the drop-in and restoring the backup undoes it. 

Cloud Images and Spotting Attacks on Alpine Linux Servers 

Official tiny-cloud images (qcow2, VHD and AMI) from 3.18.11 through 3.24.3 ship an alpine user with a * field and passwordless doas. They are safe on first boot but become exploitable once any $6$ hash appears, such as a console password or a user-data account with hashed_passwd, giving attackers a shell as alpine and then root. Instances from earlier point releases need updating or password logins disabled.  Admins should check /var/log/messages for sshd "Accepted password" lines on passwordless accounts and review doas use, new users, files, and authorized keys. If a login cannot be ruled out, the machine should be treated as compromised.  Özgün Kültekin of Wakefield reported the issue. Damien Miller and Darren Tucker of the OpenSSH project delivered the fix and the 10.6p2 release; Timo Teräs helped analyze the bug, and Natanael Copa built and uploaded the updated packages. 
  • ✇Firewall Daily – The Cyber Express
  • Two Canadians Accused of Turning US University Supercomputers Into Crypto Miners Samiksha Jain
    For more than three years, computers at several American universities were allegedly doing work their owners never asked for. According to a federal indictment, two Canadian men broke into campus networks, stole passwords and quietly used the machines to mine cryptocurrency for themselves. One of them is now in the United States to face charges in the university supercomputer hacking case. The other is still fighting extradition in Canada. U.S. Attorney Michael DiGiacomo announced that a fede
     

Two Canadians Accused of Turning US University Supercomputers Into Crypto Miners

5 de Novembro de 2026, 02:21

university supercomputer hacking

For more than three years, computers at several American universities were allegedly doing work their owners never asked for. According to a federal indictment, two Canadian men broke into campus networks, stole passwords and quietly used the machines to mine cryptocurrency for themselves. One of them is now in the United States to face charges in the university supercomputer hacking case. The other is still fighting extradition in Canada. U.S. Attorney Michael DiGiacomo announced that a federal grand jury has indicted Ryan James Roach, 35, of Saskatchewan, and Mathiew James Stubbings, 41, of Ontario. Both face charges of conspiracy to obtain information from and cause damage to a protected computer, obtaining information from a protected computer, and intentional damage to a protected computer. The charges carry a maximum penalty of 10 years in prison and a $250,000 fine.

Why the University Supercomputer Hacking Targeted Campuses

The indictment points to a clear reason for the choice of targets. Roach and Stubbings allegedly went after educational institutions in the United States that had supercomputers. The scheme relied on processing power. Once inside, the pair allegedly forced victim computers to run cryptocurrency mining software, putting the machines' computing power to work for their own financial gain. Machines built for heavy computation made the scheme more profitable. Victims included educational institutions in New York, Tennessee, North Carolina and Massachusetts. Some of the damaged computers belonged to a higher education institution in the Western District of New York, where the case is being prosecuted.

How the Alleged Scheme Worked

According to the indictment, the scheme ran from June 2016 to December 2019 and followed a set pattern. The pair allegedly researched security weaknesses in victim networks before getting in. They accessed computers without authorization and deployed malware to take control. They then stole login credentials and sent the data to servers they controlled. Once inside a network, they allegedly used sophisticated techniques and tools to carry out reconnaissance and expand their access. The stolen login credentials were stored on their servers, the same servers that sent out malware and mining software to victim machines. The indictment says Roach and Stubbings damaged 10 or more protected computers within a one-year period, causing a loss of at least $5,000.

How They Allegedly Stayed Hidden

The case also shows the effort the pair allegedly put into avoiding detection. They used virtual private servers in multiple countries, registered under false names. Those servers delivered malware and mining software to victim computers and held the stolen credentials. To conceal their identities further, they allegedly used a server and compromised computers belonging to one victim to gain access to another. That meant intrusions could appear to come from a victim's own systems instead of from the people behind them.

Where the University Supercomputer Hacking Case Stands

Roach was extradited from Canada to the United States on October 28. He was arraigned before U.S. Magistrate Judge Mark W. Pedersen and held pending a detention hearing on November 3. Extradition proceedings for Stubbings are continuing in Canada. The investigation was carried out by the Federal Bureau of Investigation, under the direction of Special Agent-in-Charge Allen D. Davis II, and the Department of Justice's Computer Crime and Intellectual Property Section. The Justice Department's Office of International Affairs helped secure Roach's arrest and extradition. Assistant U.S. Attorney Meghan K. McGuire is prosecuting the case.

What Is Still Unclear

The indictment leaves several details open. It does not say how much cryptocurrency the pair allegedly mined, how many institutions were affected in total, or which universities were targeted beyond their states. The loss figure stated in the charges, at least $5,000, is the legal threshold tied to the damage count, not a full estimate of the harm. An indictment is an accusation, not proof. Both men are presumed innocent unless and until proven guilty.
  • ✇Krebs on Security
  • Want to Rent an Internet Address at the White House? BrianKrebs
    Several staffers at the White House are using computers or mobile devices equipped with residential proxy services that render their internet address available for others to rent, security experts warned today. One of the proxy services is a Russian company whose founder’s web hosting business was ground zero for cyberattacks against election systems in Arizona and Illinois in 2016. The security firm Layer3 Intel said it detected multiple residential proxy nodes beaconing out from the internet a
     

Want to Rent an Internet Address at the White House?

5 de Novembro de 2026, 01:36

Several staffers at the White House are using computers or mobile devices equipped with residential proxy services that render their internet address available for others to rent, security experts warned today. One of the proxy services is a Russian company whose founder’s web hosting business was ground zero for cyberattacks against election systems in Arizona and Illinois in 2016.

The security firm Layer3 Intel said it detected multiple residential proxy nodes beaconing out from the internet address network reserved for the Executive Office of the President (AS2650). Layer3 said the proxy activity was relatively persistent between October 5 to November 3, and that a review of the proxies available from AS2650 showed they exited from the White House network 236 times during that period.

The proxy tracking company Synthient said on Twitter/X that the activity it saw coming from AS2650 was related to multiple Windows 11 installations of a service called Infatica, a proxy program that is often integrated into “free” mobile and desktop applications. Infatica’s founder Vladimir Fomenko is a Russian man whose hosting firm King Servers was home to six of the eight internet addresses used by Russia’s state security services to compromise databases for election systems in Arizona and Illinois in 2016.

Synthient’s depiction of the outgoing proxy traffic from the dedicated White House network (AS2650). Click to enlarge.

There are dozens of residential proxy providers with varying degrees of legitimacy, many of them based in China or Russia. But at a minimum, they all make it simple for customers to rent someone else’s internet address as a way to anonymize their web traffic or spoof their true location. From a website’s perspective, the traffic from a proxy network user appears to originate from the rented IP address, not from the proxy service customer.

Layer3 Intel said the proxy exit nodes at the White House came from six internet addresses, on 26 of the 30 days, and that most of the activity happens in the evening, between 5 p.m. and midnight.

Incredibly, Infatica was not the only proxy service that reportedly has been reselling access to White House internet addresses: Layer3 Intel said it found 28 separate residential proxy services were able to exit through this network.

“This is public access,” the Layer3 Intel team wrote. “Anybody can obtain it by signing up to a public residential proxy service, paying a few dollars and sending requests through it. We did not selectively target this network or try to make our probes exit from it. We caught this by chance, simply by requesting global rotating access through these services.”

The White House did not immediately respond to a request for comment.

As detailed in several stories here over the past year, residential proxy services are a major source of unwanted and often malicious traffic, including account takeover and other cybercrime activity, advertising fraud, and mass content scraping for AI projects.

They can also introduce serious security risks. In late 2025, it was discovered that cybercriminals were mass exploiting a widespread vulnerability in these services that allowed them to probe each proxy endpoint’s local network for vulnerable systems to infect with malware. In January 2026, dozens of proxy services were forced to patch their networks after Synthient Founder Ben Brundage showed how cybercriminals were abusing a vulnerability in these residential proxy services to seize control over devices inside the local networks of unsuspecting users.

“Some of these resellers sell bandwidth for as low as 60 cents a Gigabyte, that means for less than a dollar you can gain access into some of the most confidential and trusted networks,” Brundage told KrebsOnSecurity. “The reseller ecosystem further enables this with any criminal able to buy access while skipping KYC [Know Your Customer] processes.”

All too often, these proxy services are beaconing out from employee devices brought into the workplace. App developers can embed software development kits (SDKs) provided by the residential proxy networks to monetize their software, allowing them to receive a small amount of money on each installation.

As risky as residential proxies can be for unsuspecting end users, they are all too commonly found on government and corporate networks. In a webinar in January 2026, the proxy tracking service Spur found residential proxies in nearly 300 government owned and operated networks, 318 utility companies, 166 healthcare companies or hospitals, and 141 companies in banking and finance. In a blog post earlier this year, the security firm Infoblox said it discovered that fully 65% of its customer base was querying one or more residential proxy related domains.

  • ✇Firewall Daily – The Cyber Express
  • Discord to Let Google Index Public Server Messages, Raising Privacy Concerns Ashish Khaitan
    Discord plans to let Google and other search engines index selected Discord Messages from Discoverable Servers, pushing parts of its public community conversations onto the open web.  The company announced the change on October 27. Server Web Pages and discussion summaries arrive first, on November 16, 2026. Individual messages follow in mid-December rather than November, giving users and moderators time to check their privacy settings before anything becomes searchable.  Discord says the
     

Discord to Let Google Index Public Server Messages, Raising Privacy Concerns

28 de Outubro de 2026, 03:40

Discoverable Servers

Discord plans to let Google and other search engines index selected Discord Messages from Discoverable Servers, pushing parts of its public community conversations onto the open web.  The company announced the change on October 27. Server Web Pages and discussion summaries arrive first, on November 16, 2026. Individual messages follow in mid-December rather than November, giving users and moderators time to check their privacy settings before anything becomes searchable.  Discord says the goal is to make useful answers reachable without searching inside the platform first. It argues that knowledge in gaming guides, support discussions, and community forums often stays hard for outsiders to find. 

Which Discord Messages From Discoverable Servers Qualify? 

Only Discoverable Servers are affected. Anyone can find and join these communities without an invitation, and each must have at least 1,000 members, be eight weeks old and meet activity and safety rules. Discord puts the current total above 63,000. Private servers, direct messages, and group direct messages are excluded.  From November 16, every Discoverable Server gets a Server Web Page. Where moderators haven't published one, Discord builds a default page from the Server Profile. Automated Channel Summaries covering discussions from that date onward may also appear the same day.  Individual Channel Messages roll out gradually from mid-December, and only eligible messages sent from then on can appear. Older message histories won't be published through the feature. Usernames and avatars are hidden, and messages initially appear as text.  Under Discord's member guidance, participating channels display an icon and a notice before users post. Public threads and forums can qualify, while private threads and private forums cannot. 

Keeping Discord Messages Off Discoverable Servers' Web Pages 

Users can open User Settings > Data & Privacy and disable "Show my message content from Discoverable channels on web pages." The account-wide switch covers every Discoverable Server a user belongs to. It can be changed in the desktop app or a browser and applies across devices, including mobile.  The setting is on by default in most regions but off by default in the EU/EEA, UK, Canada, Brazil, Australia, and South Korea. Teen accounts are excluded and cannot enable it. Server and channel eligibility rules still apply where the setting is on.  Switching it off only protects messages sent afterward. Posts made while it was enabled can still appear, even if they haven't reached a web page yet, so users must delete them to remove them from Discord's pages. Search engines may keep indexed or cached copies longer, requiring separate removal steps.  This is a planned publishing feature, not a security breach, which sets it apart from Discord's earlier customer support data breach involving unauthorized access through a third-party provider. 

Moderator Controls and Security Concerns 

Moderators can manage participation through Server Settings > Web Presence, excluding selected channels or disabling channel participation entirely. Without changes, public channels stay enabled. User opt-outs don't disable Channel Summaries, which have separate admin controls. Communities unwilling to maintain a Server Web Page can leave Discovery and remain Community Servers.  For security teams, the concern is wider exposure rather than a new flaw. Hiding usernames doesn't strip identifying details written inside Discord Messages, so public support channels deserve review before publication, particularly where members discuss workplace systems or share personal information.  Search visibility also isn't proof of trust. Earlier reporting on expired Discord invite links used to spread malware showed attackers steering visitors into fake communities. Readers who find Discord answers through Google should check destinations and avoid running commands presented as account verification steps. 
  • ✇Cybersecurity News
  • Windows Update Certificate Rotation: Prevent 2027 Failures Do Son
    Learn about the upcoming Windows update certificate rotation in 2027. Ensure your system stays connected to Microsoft servers by installing required patches. Related Posts: Windows 11 Quick Settings Can Now Ring Your Android Phone Microsoft Patches Windows 11 Local Account Bypass Loophole Windows Hybrid Intelligence and the New AI Search Menu The post Windows Update Certificate Rotation: Prevent 2027 Failures appeared first on Daily CyberSecurity.
     
  • ✇Security | CIO
  • Memory squeeze set to tighten through 2028, Micron says
    The global memory shortage that has driven up the cost of servers, storage and PCs through 2026 will get worse in 2027 and 2028, according to memory maker Micron Technology. “We expect memory and storage supply-demand conditions to be much tighter in calendar 2027 and 2028 than they were in 2026,” CEO Sanjay Mehrotra said in prepared remarks for the company’s fiscal fourth-quarter earnings call. Even with new cleanroom space planned across the industry, “We do not ha
     

Memory squeeze set to tighten through 2028, Micron says

1 de Outubro de 2026, 10:58

The global memory shortage that has driven up the cost of servers, storage and PCs through 2026 will get worse in 2027 and 2028, according to memory maker Micron Technology.

“We expect memory and storage supply-demand conditions to be much tighter in calendar 2027 and 2028 than they were in 2026,” CEO Sanjay Mehrotra said in prepared remarks for the company’s fiscal fourth-quarter earnings call.

Even with new cleanroom space planned across the industry, “We do not have line of sight to when supply and demand will return to balance,” he said. Earlier industry forecasts had expected the two to return to balance in 2028.

Mehrotra added that new plants would not bring quick relief. “Production from new DRAM and NAND fabrication facilities takes time to ramp and gradually becomes more meaningful starting a few quarters after initial output,” he said.

Neil Shah, vice president of research at Counterpoint Research, said the outlook means CIOs “will have to be prudent about which equipment to upgrade and which to stretch to maintain cost efficiencies.”

Higher prices, less memory

On the same call, CFO Mark Murphy said Micron’s “inventory levels and supply remain extremely tight.” Its DRAM prices rose by a percentage in the high teens in the fiscal fourth quarter, while NAND prices climbed about 30%, he said.

Taiwan-based market research firm TrendForce expects prices across the industry to keep rising. In a Sept. 30 report, it forecast that conventional DRAM contract prices will increase another 10% to 15% in the fourth quarter from the third. It expects NAND flash prices to climb 15% to 20%. The firm said increases are slowing but the market remains undersupplied.

IDC expects PC buyers to pay more as well. The research firm forecast in June that average PC selling prices will rise 17% in 2026.

TrendForce has also tracked a shift toward less memory per server. Cloud providers and OEMs have moved some servers from 96GB and 128GB memory modules to 32GB and 64GB modules since the first half of 2026, the firm said in a July report. Analysts had warned in January of higher prices and lower memory specifications for enterprise PCs.

Supply committed years ahead

Micron has already committed more than 75% of its 2027 output, and most of its customer discussions now concern 2028, Mehrotra told analysts on the call.

Much of that supply is locked into multiyear, take-or-pay contracts that Micron calls strategic customer agreements (SCAs). “Any new discussions on SCAs where pricing is involved are negotiated with higher pricing based on prevailing market conditions and outlook,” Mehrotra said.

Some cloud providers have signed similar long-term agreements with memory makers, TrendForce said in its July report. That has left buyers without such deals as the main source of server DRAM price increases, it said.

Shah said enterprises should lock in pricing too. “Companies should secure multiyear pricing for the computing capacity they know they will need,” he said. Moving workloads to the cloud will not avoid rising hardware and energy costs “because providers will pass them on,” he added.

Which refreshes to delay

When it comes to replacing existing equipment, Shah said, the right call depends on the workload. “For general back-office PCs and routine file servers, stretching lifecycles from three years to five is harmless,” he said. “But for core infrastructure and engineering seats, delaying refreshes can backfire.” Aging equipment can drag on productivity, lose software support and fail more often, he added.

Shah also cautioned against turning to older memory to save money. Memory makers have been converting production lines to high-bandwidth memory and DDR5, so DDR4 is no longer cheap or plentiful, he said. “If you buy legacy platforms today to shave 10% off upfront server costs, you’re buying into systems which won’t have serviceable parts two years from now.”

He recommended starting with the hardware already in place. “Enterprises often waste 30% to 50% of memory by provisioning for peaks that rarely occur,” he said. Right-sizing virtual machines, quantizing AI models and batching workloads more efficiently can cut memory use significantly, according to Shah.

Before buying more hardware, he said, “CIOs should think about optimizing on the silicon already in place.”

What hardware vendors say

Hardware vendors had no helpful advice to offer budget-constrained buyers.

Lenovo did not answer questions directly but pointed to remarks executives made on its Aug. 13 earnings call.

Chairman and CEO Yuanqing Yang said then that he expects memory demand to keep rising and supply to remain constrained at least through the end of 2027. He said Lenovo can respond quickly to rising component costs: “When the material costs rise, we can adjust the pricing at the front end in a timely manner.”

Luca Rossi, president of Lenovo’s Intelligent Devices Group, said he expects the PC market to shrink about 15% in units in the six months to March, with business demand holding up better than consumer demand.

On the server side, Ashley Gorakhpurwalla, president of Lenovo’s Infrastructure Solutions Group, said a “strong server refresh cycle is underway.”

Dell, HPE, HP, Cisco and Supermicro did not respond to requests for comment by publication time.

  • ✇Security | CIO
  • IT infrastructure shortages are real and lasting. Here’s how to cope
    Lead times of nine to 12 or even 18 months. Costs rising by 35%, 45%, even 50% to 200%. More than halfway through 2026, the market for IT infrastructure that’s crucial for enterprise projects, including those involving artificial intelligence, is strapped. Memory is at the root of the shortages. Memory prices “have risen by 50% to 200%, resulting in PC prices increasing by 35% to 45% and some server prices rising over 125%,” according to Jon Forest, VP analyst at Gartne
     

IT infrastructure shortages are real and lasting. Here’s how to cope

7 de Setembro de 2026, 07:01

Lead times of nine to 12 or even 18 months. Costs rising by 35%, 45%, even 50% to 200%. More than halfway through 2026, the market for IT infrastructure that’s crucial for enterprise projects, including those involving artificial intelligence, is strapped.

Memory is at the root of the shortages. Memory prices “have risen by 50% to 200%, resulting in PC prices increasing by 35% to 45% and some server prices rising over 125%,” according to Jon Forest, VP analyst at Gartner. Network switches also need memory, albeit in lesser amounts than servers, so they are not immune, with prices and lead times likewise rising dramatically.

Industry experts agree that most of the issues stem from hyperscalers gobbling up memory capacity, which trickles down to servers, storage systems, and networking devices. But while the source of the problem may be new, supply chain disruptions are far from unprecedented.

As a result, industry insiders are not short on advice on how best to deal with the situation, with tips including making better use of what you have, considering options beyond your usual scope, and lots of planning with your vendors and internal finance teams.

State of the problem

Just how bad is the current supply chain problem? “It’s pretty bad,” says Matt Kimball, vice president and principal analyst with Moor Insights & Strategy. Companies accustomed to 30- to 45-day lead times for various infrastructure are now looking at 6, 12, or even 18 months.

“It’s real, and I’m hearing it from companies of all sizes, from the 1000-server to the 10,000-server shops,” Kimball says.

“Memory costs are expected to rise sharply well into 2027 and will reach up to 25% of network hardware expenses by the end of 2027,” according to an email Gartner’s Forest sent to Network World. The figure below shows the timeline Gartner expects for memory prices, and Forest notes that the same timing applies across networking, storage, and compute infrastructure. 

Gartner NAND DRAM stats

Gartner

“Enterprise network equipment pricing is projected to increase by over 20% in 2026. This upward trend is anticipated to continue with a further rise of 3% to 5% entering 2027, with no signs of price reduction until the end of 2027.”

But “reduction” will likely look more like “stabilization.”

“That’s something a lot of people don’t like to talk about. But let’s say prices went up 40%, they may come down five,” says Phillip Privett, senior vice president of vendor management with the global distributor and value-added reseller TD SYNNEX. “They’re not going to come down 40%.”

Perhaps worse, compared with past disruptions caused by issues such as fires in chip fabrication factories or the Covid pandemic, Kimball says this one is “durable” because its cause—the AI wave—is more long-lasting and just getting started.

“This AI inference wave we’re hitting is just beginning. It’s going to be longer and bigger than the training wave,” he says. “It’s impacting everything, from AI infrastructure to the traditional stuff that’s standing up your virtualization and cloud infrastructure.”

No vendors seem to be immune, not even the likes of Cisco, which makes its own Cisco Silicon One chips. Or, at least, it designs the chips; they’re actually manufactured by the Taiwan Semiconductor Manufacturing Company (TSMC), the same company that makes many of the other chips that are in such demand. And that’s only one component of many that comprise a switch.

On the other hand, the margins Cisco gets from enterprise sales are far greater than those from hyperscalers because Cisco sells mainly just hardware to hyperscalers, whereas enterprise sales generally include software and services as well. So, Cisco has incentive to keep enterprise customers happy and maintain the 66% margins it reported in Q3, its latest quarter.

Still, Cisco must deal with the same shortages as other vendors.

“I wouldn’t say any company is faring better than others,” says Neil Anderson, vice president and CTO for cloud, infrastructure, and AI solutions at World Wide Technology (WWT). “There may be nuances that some suppliers are employing to balance it to some extent, but I fail to recognize a supplier that’s not having almost the same issue.”

Cloud storage vendor Backblaze is one company that’s facing equipment cost and availability issues. “There are different types of shortages occurring in multiple places, all driven by unusual market demands, really by just a handful of very large buyers,” says James Rowell, senior vice president of operations with Backblaze.

Backblaze is constantly forecasting and monitoring demand triggers, Rowell says. That involves close alignment with the sales team to forecast client needs, as well as paying attention to historical trendlines to predict upcoming demand from new deals and growth with existing clients. But the company also looks for “unnatural market-related triggers” that would cause a spike in utilization.

With hyperscalers buying up vast amounts of capacity, “This is definitely an unnatural phase,” Rowell says. “For about for the last 12 months, I would say there’s been somewhere between a 15% and 30% uptick in costs,” especially in terms of servers and compute disks.

On the positive side, at least for Backblaze, the company is also seeing an uptick in business from an interesting source: AI companies. “We reported in the last earnings period a 70% increase in AI companies using our platform,” says Patrick Thomas, vice president of marketing at Backblaze. “That’s massive.”

On top of that, the company is seeing an uptick in deals from enterprises that can’t get the storage capacity they need or want on-prem. “There’s a general market nervousness where we’ve got potential deals coming our way because those organizations are concerned about being able to do it themselves,” Rowell says.

While some expect new chip fabrication plants currently under construction will ease memory supply constraints, Privett doesn’t buy it. “I don’t see it getting better anytime soon,” he says. “Building a new fab is a two-year process.”

Advice: Start with the basics

Enterprises, then, must play the cards they’re dealt. For Moore Insights’ Kimball, who did stints as an IT exec with the states of Florida and Oregon, that starts with making the most of what you have.

Such a strategy is “shockingly not implemented much” across the companies he sees. “A simple capacity planning exercise can free up a lot of resources.” That includes virtualized servers running at just 20% to 30% utilization as well as extending the life of existing servers. While 15 or 20 years ago it was common to refresh every four years or so, companies can often get six or seven years out of today’s servers.

While such strategies won’t solve your AI compute challenges, they can certainly help support your ongoing operations and free up budget for AI and other modernization projects, he says.

“Sweat your assets,” agrees Privett of TD SYNNEX. “Work them as much as you can, add only what you need, get extensions on your licensing, renewals on your services agreements and things like that. Just sweat it out a little longer.”

If you have budget to spend but can’t get the hardware you’re after, buy something else, says WWT’s Anderson. “Look at things that are not tied to those components, like software projects or SaaS licensing,” he says.

Get friendly with finance teams

Numerous experts recommend regular meetings with your CFO or finance teams to keep them apprised of what you’re up against so the company can plan accordingly.

Gartner’s Forest advises using rolling 12- to 24‑month forecasts and engaging early with suppliers to identify constrained components and SKUs. Committing to quarterly or monthly buys can help you avoid long-term agreements that extend past the rapid increases we’re seeing in 2026, he says.

Also engage with the financing arm of your equipment vendors, some of which are offering financing incentives, Privett says. Compute vendors in particular are offering subsidized financing, deferred payments, and low-cost financing for the first year or so. “Those are huge opportunities to take advantage of,” he says.

By engaging with finance teams, IT groups can conduct budget allocation exercises and try to come up with ways to make the financials work. The last thing you want to do is surprise them with additional budget requests out of the blue.

Kimball recalls his days with the state of Florida, when all budget requests were examined by a technical review working group—which was designed to be hostile.

“I can’t imagine going to them and saying, ‘Oh, did I say that was a million dollars? It’s actually $2 million. I need you to write me a bigger check,’” he says. “I would walk into one of the swamps in Tallahassee and get eaten by the alligators instead of doing that.”

Work with your vendors and VARs

As you put plans together, lean on your vendors for help, including channel partners such as value-added resellers (VAR) and national resellers. “Work with them to map things out and understand what your workloads will look like,” Kimball says.

That’s what Backblaze’s Rowell regularly does with his suppliers. He lays out his forecast for the year, with commitments on what Backblaze will definitely buy, as well as scenarios that account for rapid growth, say, 2x. “And they’ll come back with, ‘Well, okay, no problem,’ or maybe they say we need to put in an allocation right away, or we won’t be able to get what we may need,” he says.

Similarly, he sits down with his CFO regularly to map out predictive models that factor in inflation, price hikes, and the like. The idea is to plan out multiple scenarios, so you don’t get blindsided.

“If you don’t do that, you’ll get caught with your pants down, on the upside-down end of spectrum,” he said – meaning not having the capacity to take advantage of market opportunities.

Acquiring the capacity you need to meet project demand may also mean being flexible in terms of your equipment choices. If you’re a Dell shop but can’t get Dell servers, maybe you go with Lenovo, Kimball says.

“You’ve got to figure out how to use all this silicon and infrastructure in a heterogenous way to serve your needs,” he says. That’s especially true when it comes to AI infrastructure. “If you think you’re going to go with 100% Nvidia for everything from RAG [retrieval augmented generation] to inferencing at the edge, you’re kind of crazy, not because of cost but because of availability.”

Look at alternatives, including AMD and cloud solutions, while staying mindful of how it all plays together. You may not be able to get Nvidia GPUs, but AWS, Azure, and Oracle Cloud have them, Kimball notes.

Be strategic, perhaps by using cloud offerings to handle certain tuning or inference workloads, then bringing them back in-house when appropriate. “Have a better understanding of what absolutely has to be on prem and what can be in the cloud,” he says.

That’s good advice, says Backblaze’s Thomas. When it comes to AI, think about performance tiers and the range of use cases you have. They don’t all need top-tier performance.

“People get wrapped around axle of needing the top end. There’s a lot of flexibility in the edges, innovation in different hardware and software,” Thomas says.

Gartner likewise advises companies to increase configuration flexibility and expand sourcing paths. That may include buying from secondary markets and lease-return programs to preserve continuity with existing infrastructure until the shortages pass, Forest says.

Get started somewhere

Even if you can’t acquire or have to wait for the infrastructure you need, don’t let that keep you from getting started with AI or other modernization projects.

Options include public cloud and neocloud providers, Anderson says. WWT also provides capacity in its own lab so customers can get started with proof-of-concept projects. “Don’t just throw your hands up. We can help you find access to capacity,” Anderson says. “Production-scale AI may be delayed, but don’t let that derail your strategy.”

Colocation providers may likewise be an option, especially if enterprises are struggling to acquire high-end networking equipment. Networking is a key value proposition for colocation providers, in that they have built-in connections to various cloud providers and other ecosystem players.

Equinix, for example, has 280 data centers in 77 metropolitan areas, says Phil Read, senior director, colocation product management for the company. If you have the compute infrastructure, Equinix can help you with the high-end connectivity required both intra- data center and at edge facilities.

It also has partnerships with the likes of Cisco and Nvidia for “ready-to-go AI connectivity,” Read says. That means Equinix offers the right infrastructure to meet the requirements of high-end compute solutions in terms of power density and cooling. Such power densities are significant, requiring 120k VA per rack and up. “There’s plenty of talk about a megawatt rack,” he says.

Power is a significant issue in this entire discussion, Privett says. Older installed computing infrastructure likely consumes far more power than newer systems, which is an argument for upgrading as soon as possible.

“If you modernize today, you could substantially reduce the number of servers needed to support the same applications at a much lower power consumption rate,” Privett says. He advises sitting down with folks from the OT side of the house to make sure power is available for whatever you want to do. In many areas, power is at a premium.

If your plans include installing GPU environments in your own data center, WWT advises you not to delay. “We’re telling customers, you need to talk with us and get that designed, get that ordered, because it will take quite a bit of time until it actually ships and we’re able to install it,” Anderson says.

Moor Insights’ Kimball agrees. “You have to order these parts today if you want to see them hitting your dock, your warehouse, or your office 12 months from now.”

  • ✇Security | CIO
  • Dell’s $95B AI backlog shows the infrastructure crunch is far from over
    Dell Technologies is acknowledging that infrastructure and storage supply still can’t keep up with agentic AI’s insatiable appetite for resources. The company this week reported a “record” AI backlog, with $95 billion in orders waiting to be filled. This dovetails with quarterly earnings reflecting a more than 50% year-over-year increase in AI demand. On an earnings call, Dell COO Jeff Clarke acknowledged that supply constraints start with servers and storage, and sp
     

Dell’s $95B AI backlog shows the infrastructure crunch is far from over

2 de Setembro de 2026, 21:35

Dell Technologies is acknowledging that infrastructure and storage supply still can’t keep up with agentic AI’s insatiable appetite for resources.

The company this week reported a “record” AI backlog, with $95 billion in orders waiting to be filled. This dovetails with quarterly earnings reflecting a more than 50% year-over-year increase in AI demand.

On an earnings call, Dell COO Jeff Clarke acknowledged that supply constraints start with servers and storage, and span the stack to “just about every product going through a leading node.”

“We are doing everything we can to get more supply,” he said. “In today’s environment, that’s a very difficult task.”

A glimpse of infrastructure demands ahead

Dell reported that, in its financial quarter ending July 31, its revenue was $47 billion, reflecting 58% year-over-year growth. Moreover, revenue in its Dell Infrastructure Solutions Group (ISG) increased 89% to a record $31.8 billion.

Much of this growth is in servers, notably traditional central processing unit (CPU)-based servers that are increasingly supporting agentic AI workloads. Demand is “exceptionally strong” in this area, with earnings up 122% year-over-year.

Perhaps most tellingly when it comes to the ongoing demand, the company booked nearly $61 billion in AI server orders in the three months ending July 31; all told, over the last 12 months, it has inked more than $130 billion in AI server orders.

Clarke reported that Dell converted $131.7 billion of demand into orders over the last year, and that demand is broadening across enterprise customers, neoclouds, and sovereign cloud providers. To illustrate his point, he noted that the number of customers using Dell AI Factory, the company’s platform built to support AI workflows, has surpassed 6,500, and of those, 3,300 signed on in the last three quarters. Clarke pointed out that, by contrast, it took the company two years to sign on the first 3,200 after debuting Dell AI Factory in May 2024.

“Agentic demand is reshaping the data center,” Clarke said. Inference is “pure demand in our industry.” In fact, Dell anticipates that 3,600 quadrillion tokens will be in use by 2030, representing an 87x increase from today. Further, over that same period, training demand is predicted to grow to 850 zettaflops, a 5x jump.

“Enterprise agentic AI is expected to be the single largest workload by 2028,” Clarke said, and by 2030 will account for 75% of all data center demand.

Enterprises clamor for traditional servers

Dell is seeing a growing trend of customers requiring “meaningful CPU compute capacity” to support AI and agentic workflows. As evidence of this demand, in just its last two financial quarters, it has generated nearly as much revenue from traditional servers and networking as it has in any prior full year in company history.

Most of this growth comes from existing customers accelerating their investments in traditional IT environments to refresh, modernize, and bolster performance, efficiency, and resiliency. Dell anticipates “significant and durable” refreshes ahead, and heightened security and resiliency requirements are also increasing demand.

“AI requires modern, disaggregated architectures that keep data accessible and in motion across compute, storage, and networking,” Clarke noted. It is much more than assembling and delivering components; AI deployments require significant engineering, design, and deployment expertise. Some customer engagements, in fact, require upwards of 50 unique designs as enterprises optimize for workload performance, power, cooling and the data center environment, he claimed.

Enterprises want new servers with more cores, more dynamic random-access memory (DRAM), and more storage. However, the constraints remain the same: “DRAM, DRAM, DRAM, followed by NAND, NAND, NAND [flash memory],” Clarke said. There are “spotty” CPU and disk drive shortages, and constraints all the way down the supply chain, from microcontrollers to drives to transistors.

Large enterprises and multinational corporations across the globe “would prefer to have products now if we had the supply,” he said. “We are supply constrained in the sense of what we can build in any given quarter.”

This has led Dell to plan accordingly and optimize configurations with what “bits and bytes” they do have coming in to maximize outputs, with a focus on “getting it out the door,” Clarke said. There are associated lead times that the company is working through, but they’ve been able to “realize greater shipments.”

“We’ll continue to focus on trying to get more supply, and take the supply we have and optimize the output,” he said.

Reflecting increased need for storage as enterprises prep, manage, and protect huge volumes of data, Dell has also seen strong growth across its PowerFlex, PowerStore, PowerProtect, and PowerVault products.

“Demand remains broad based; enterprises continue to modernize their storage environments as data growth increases the importance of keeping data available and secure,” Clarke said.

How customers respond to shortages

Clarke acknowledged that modernization is driving higher core counts, more DRAM, and more storage. Those configurations “cost more than they did last quarter, and the quarter before, and the quarter before.”

Customers are adjusting to these price increases, he noted, deferring purchases because they are unable to sufficiently flex existing budget dollars. In other cases, enterprises are placing orders further in advance to ensure they have access to constrained supplies. “Large, sophisticated customers are acting, first and foremost,” Clarke said. Some are collaboratively planning with Dell to gain a view of their needs further into the future.

“That is a new phenomenon,” he said. “We are working through this demand environment that’s well ahead of supply, helping customers manage.”

This article originally appeared on Network World.

  • ✇Security | CIO
  • Nvidia to hike prices by 15%, on top of an even larger increase in July
    On top of July’s 30% price hikes across almost all of its product lines, Nvidia is reportedly preparing to raise prices of servers, including those powered by Vera Rubin and Grace Blackwell chips, by 15%, due to skyrocketing memory prices. That 15% increase for systems being delivered in early 2027, reported by Bloomberg and other business media, is seen as part of a series of expected price hikes throughout AI deployments. Scott Bickley, advisory fellow at Info-Tech
     

Nvidia to hike prices by 15%, on top of an even larger increase in July

24 de Agosto de 2026, 20:06

On top of July’s 30% price hikes across almost all of its product lines, Nvidia is reportedly preparing to raise prices of servers, including those powered by Vera Rubin and Grace Blackwell chips, by 15%, due to skyrocketing memory prices.

That 15% increase for systems being delivered in early 2027, reported by Bloomberg and other business media, is seen as part of a series of expected price hikes throughout AI deployments.

Scott Bickley, advisory fellow at Info-Tech Research Group, said that he sees Nvidia’s move as one that is only passing along its own rapidly increasing costs. But rather than price gouging because of its close-to-monopoly market control, Bickley’s calculations suggest that Nvidia is likely eating some of its costs, and is only passing along a fraction of them to its largest customers.

But not all AI-related costs are increasing; per-token prices appear to be dropping, he said. That gives CIOs a potential strategy to manage costs by pushing approaches that will reduce the reliance on memory.

“The workload cost is going down per token while the underlying hardware and infrastructure costs are going up,” Bickley said. “If you are directly building out your own clusters, this is an automatic uplift to an already egregiously expensive solution. If you are buying your own hardware, you’re going to have to suck it up. You are not going to negotiate your way out of this.”

But, he added, CIOs should also be able to get more mileage out of the clusters they are currently running, via techniques such as model routing, compression, and batch processing.  

Gaurav Gupta, VP analyst at Gartner, noted that the Nvidia price hikes are reflective of the many pricing increases throughout the AI environment. 

“Memory prices are going up, especially HBM and LPDDR5, but there are other aspects, like leading-edge foundry wafers, advanced packaging, and other component shortages,” Gupta said, adding that those issues generate “longer lead-times, which typically translates to higher prices.” And he does not expect the situation to improve any time soon. 

“In the current environment of strong demand and limited supply, we expect this situation to continue in the near to mid-term,” he said. “This means higher costs for those deploying these servers/systems and for those renting compute in the cloud, including software vendors/model builders, and others.”

Flavio Villanustre, CISO for the LexisNexis Risk Solutions Group, agreed.

“This is a supply and demand problem, and it’s likely to reach a plateau and eventually improve once memory production ramps up to meet the current demand due to AI, but I don’t think this will happen in the next few months,” Villanustre said. “For now, CIOs will need to contend with the current market conditions.”

But he also agreed with Bickley’s suggestion that CIOs try to squeeze more value from the RAM they already have.

“Some AI model vendors are adapting their models to run better in memory constrained environments,” Villanustre noted. “For example, Gemma E4B and similar models by Google now use a hierarchical tiered model that allows them to pull only the necessary parts of the model into memory instead of holding the entire model in RAM. These models have a much larger effective number of parameters than the memory that they require.”

And, added Mike Wilkes, enterprise CISO at Aikido Security, this means that the Nvidia price hikes may do some good if they convince enterprises to adopt a more thoughtful approach to AI deployments. 

“Enterprises have spent the last few years treating frontier-model tokens almost as an infinitely elastic utility, sending workloads to the biggest model whether or not the task required frontier-level reasoning,” he said. “Higher infrastructure and token costs should force much better workload discrimination.”

He observed that the right enterprise AI architecture is increasingly hybrid: reserve 10% for frontier model consumption for problems that genuinely require it, while pushing classification, extraction, summarization, routine agent actions, and other bounded workloads toward small language models (SLMs) and open-weight models running on infrastructure that the enterprise controls.

“That gives CIOs leverage against price gouging or unilateral price setting,” he pointed out.

This article originally appeared on NetworkWorld.

  • ✇Security | CIO
  • Server prices to rise by up to 87% at OVHcloud
    OVH is increasing the prices of its servers, some by as much as 87%, for both new and existing customers, blaming AI’s insatiable demand driving the rising cost of the RAM and storage it uses in its data centers. The European cloud operator specializes in low-cost bare metal and public cloud offerings. CIOs will be familiar with the balancing act OVH has had to perform over the last year. In a Monday post explaining the upcoming increases, OVH chairman Octave Klaba w
     

Server prices to rise by up to 87% at OVHcloud

11 de Agosto de 2026, 14:47

OVH is increasing the prices of its servers, some by as much as 87%, for both new and existing customers, blaming AI’s insatiable demand driving the rising cost of the RAM and storage it uses in its data centers.

The European cloud operator specializes in low-cost bare metal and public cloud offerings.

CIOs will be familiar with the balancing act OVH has had to perform over the last year. In a Monday post explaining the upcoming increases, OVH chairman Octave Klaba wrote on X,  “We have to place the right volume of orders, month by month, over 12 months, with no guarantee of the purchase price and without knowing what will be the real demand from our customers.”

Still, he added, “even though our prices are increasing, we remain the cheapest on the market for bare metal and public cloud; where before we could be 3x cheaper, we will be 2x cheaper (if our competitors don’t increase their prices).”

The increases will hurt hard-core gamers hardest, with the cost of the company’s most recent gaming servers rising 87%. (Older gaming instances are unaffected.)

High Grade, high price

But enterprises will also feel the pain from climbing component costs: OVH’s latest High Grade bare metal servers, with up to 2 x 96 cores of AMD Epyc 9005 series processors, 36 hard disks per server, and high-density cooling systems, will go up in price by 59%; older models built to the 2024 spec will go up 26%.

Lower-performance servers will also see increases of 40%-49% for the most recent models, and 26%-37% for older models.

The new prices take effect from Sept. 1 for new orders, and from Oct. 1 for renewals.

It’s not just baseline server prices that are increasing; optional additional memory and storage are going up in price too. OVH already increased the cost of these extras for new server orders as of July 1, with RAM prices rising 127% and disks 89%. From Oct. 1, renewals will be affected too, with the price of additional RAM in the latest servers rising by 40%, and that of larger disks by 15%. For servers built to 2024 specs, the increases will be 20% and 10% respectively.

Existing customers can lock in current prices for servers already in production for up to four years if they pay in advance by Oct. 1, Klaba wrote. Existing commitments will not be affected by the increases until they are due for renewal.

Small instances, big increases

The price rises are more nuanced when it comes to public cloud systems. In future, OVH will break out storage and IP address rental costs separately, and will allow customers to mix and match storage capacity and compute.

“In appearance, hourly compute cost won’t change,” Klaba wrote. “On the other hand, low-latency Block Storage and IPv4 addresses, previously included in our Gen3 instances (B3, C3, R3) will appear as two separately billed line items on Oct. 1.”

The result is price increases of as little as 1.4% for the most powerful instances, or as much as 21.9% for smaller instances, he said.

OVH will continue to offer a 15% discount for a commitment of one year, or 30% for three years, he said, but will no longer offer discounts for shorter terms.

This article originally appeared on NetworkWorld.

Exposed Ollama Servers: Security Risks of Publicly Accessible LLM Infrastructure

18 de Março de 2026, 04:00

Learn how exposed Ollama servers can allow unauthorized model access, prompt abuse, and GPU resource consumption when LLM inference APIs are publicly accessible.

The post Exposed Ollama Servers: Security Risks of Publicly Accessible LLM Infrastructure appeared first on Indusface.

The post Exposed Ollama Servers: Security Risks of Publicly Accessible LLM Infrastructure appeared first on Security Boulevard.

❌
❌