An anonymous reader quotes a report from The Register: In a Monday post, Broadcom CEO Hock Tan restated his belief that VMware's portfolio was too complex, and too poorly integrated, for the virtualization giant to represent true competition for hyperscale clouds. Broadcom's injection of R&D cash, he insisted, will see VMware's flagship Cloud Foundation suite evolve to become more powerful and easy to operate. He also admitted that customers aren't enjoying the ride. "As we roll out this strategy, we continue to learn from our customers on how best to prepare them for success by ensuring they always have the transition time and support they need," he wrote. "In particular, the subscription pricing model does involve a change in the timing of customers' expenditures and the balance of those expenditures between capital and operating spending."

Customers also told Tan that "fast-moving change may require more time, so we have given support extensions to many customers who came up for renewal while these changes were rolling out." That's one of the changes -- Broadcom has previously not publicly suggested such extensions would be possible. "We have always been and remain ready to work with our customers on their specific concerns," Tan wrote. The other change is providing some ongoing security patches for VMware customers who persist with their perpetual licenses instead of shifting to Broadcom's subs. "We are announcing free access to zero-day security patches for supported versions of vSphere, and we'll add other VMware products over time," Tan wrote, describing the measure as aimed at ensuring that customers "whose maintenance and support contracts have expired and choose to not continue on one of our subscription offerings." The change means such customers "are able to use perpetual licenses in a safe and secure fashion."

Microsoft and Quantinuum today announced a major breakthrough in quantum error correction. Using Quantinuum's ion-trap hardware and Microsoft's new qubit-virtualization system, the team was able to run more than 14,000 experiments without a single error. From a report: This new system also allowed the team to check the logical qubits and correct any errors it encountered without destroying the logical qubits. This, the two companies say, has now moved the state-of-the-art of quantum computing out of what has typically been dubbed the era of Noisy Intermediate Scale Quantum (NISQ) computers.

"Noisy" because even the smallest changes in the environment can lead a quantum system to essentially become random (or "decohere"), and "intermediate scale" because the current generation of quantum computers is still limited to just over a thousand qubits at best. A qubit is the fundamental unit of computing in quantum systems, analogous to a bit in a classic computer, but each qubit can be in multiple states at the same time and doesn't fall into a specific position until measured, which underlies the potential of quantum to deliver a huge leap in computing power.

It doesn't matter how many qubits you have, though, if you barely have time to run a basic algorithm before the system becomes too noisy to get a useful result -- or any result at all. Combining several different techniques, the team was able to run thousands of experiments with virtually no errors. That involved quite a bit of preparation and pre-selecting systems that already looked to be in good shape for a successful run, but still, that's a massive improvement from where the industry was just a short while ago. Further reading: Microsoft blog.

Lyle Smith reports via StorageReview.com: Proxmox has introduced a new import wizard for Proxmox Virtual Environment (VE), aiming to simplify the migration process for importing VMware ESXi VMs. This new feature comes at an important time in the industry, as it aims to ease the transition for these organizations looking to move away from VMware's vSphere due to high renewal costs.

The new import wizard is integrated into Proxmox VE's existing storage plugin system, allowing for direct integration into the platform's API and web-based user interface. It offers users the ability to import VMware ESXi VMs in their entirety, translating most of the original VM's configuration settings to Proxmox VE's configuration model (all while minimizing downtime). Currently, the import wizard is in a technical preview state, having been added during the Proxmox VE 8.2 development cycle. Although it is still under active development, early reports suggest the wizard is stable and holds considerable promise for future enhancements, including the planned addition of support for other import sources like OVF/OVA files. [...]

This tool represents Proxmox's commitment to providing accessible, open-source virtualization solutions. By leveraging the official ESXi API and implementing a user space filesystem with optimized read-ahead caching in Rust (a safe, fast, and modern programming language ideal for system-level tasks), Proxmox aims to ensure that this new feature can be integrated smoothly into its broader ecosystem.

couchslug shares a report from ITPro: A European cloud trade body has called for an investigation into Broadcom amid concerns over changes it has made to VMware licensing structures. The Cloud Infrastructure Service Providers in Europe (CISPE) consortium called on regulatory and legislative bodies across Europe to investigate the changes Broadcom has made to the VMware operating model, which it says will "decimate" the region's cloud infrastructure. "CISPE calls upon regulators, legislators and courts across Europe to swiftly scrutinize the actions of Broadcom in unilaterally canceling license terms for essential virtualization software," the trade body said in a statement. Since acquiring VMware in November 2023, Broadcom has embarked on a comprehensive overhaul of software licensing at the firm, which has drawn widespread criticism from customers. Broadcom stated it would continue to support customers under a perpetual licensing agreement for the period defined in the contract, but following this customers would need to exchange any remaining licenses for subscription-based products. This has left both cloud service vendors and customers in limbo, according to CISPE, without any solid information on how, when, or if they will be able to license VMware products essential for their operations from April 2024. Moreover, even if they are able to relicense the VMware software, a number of customers reported dramatic price hikes of as much as 12 times.

CISPE's characterisation of the move was far less charitable, arguing Broadcom is using VMware's market dominance, controlling almost 45% of the virtualization market, to charge exorbitant rents from cloud providers. Several CISPE members admitted that without the ability to license VMware products they will be unable to operate and will go bankrupt, with some stating that over 75% of their revenue depends on VMware virtualization tech. Members added that they often received termination notices late, if at all, with short notice periods that spanned just a few weeks. In addition, CISPE also complained about the decision to remove hundreds of products without any notice, and re-bundle the outstanding products under new prohibitive contract terms, despite there being no changes to the products themselves. Francisco Mingorance, secretary general of CISPE, said the changes will hurt both European customers and cloud service providers by increasing costs and reducing choice. At a time when our members are moving to support the requirements for switching and portability between cloud services outlined in the Data Act, Broadcom is holding the sector to ransom by leveraging VMware's dominance of the virtualization sector to enforce unfair license terms and extract unfair rents from European cloud customers," Mingorance said.

CISPE noted that for some cloud sector applications that require certifications by software or service providers, VMware products are the only viable option. As such, the association called for Broadcom to be recognized as a designated gatekeeper under the terms of the Digital Markets Act (DMA) that came into force on March 7, 2024. Mingorance argued Broadcom's moves will only further restrict an already limited set of options for cloud providers in Europe, warning that Broadcom has a dangerous degree of control over the region's digital ecosystems. "As well as inflicting financial damage on the European digital economy, these actions will decimate Europe's independent cloud infrastructure sector and further reduce the diversity of choice for customers," he explained. "Dominant software providers, in any sector from productivity software to virtualization, must not be allowed to wield life or death power over Europe's digital ecosystems."

In a blog post Thursday, Broadcom CEO and President Hock Tan acknowledged the discomfort VMware customers and partners have experienced after the sweeping changes that Broadcom has instituted since it acquired the company nearly four months ago. "Of course, we recognize that this level of change has understandably created some unease among our customers and partners," writes Tan. "But all of these moves have been with the goals of innovating faster, meeting our customers' needs more effectively, and making it easier to do business with us." Ars Technica reports: Tan believes that the changes will ultimately "provide greater profitability and improved market opportunities" for channel partners. However, many IT solution provider businesses that were working with VMware have already been disrupted. For example, after buying VMware, Broadcom took over the top 2,000 VMware accounts from VMware channel partners. In a March earnings call, Tan said that Broadcom has been focused on upselling those customers. He also said Broadcom expects VMware revenue to grow double-digits quarter over quarter for the rest of the fiscal year. [...]

In his blog post, Tan defended the subscription-only licensing model, calling it "the industry standard." He said VMware started accelerating its transition to this strategy in 2019, (which is before Broadcom bought VMware). He also linked to a February blog post from VMware's Prashanth Shenoy, VP of product and technical marketing for the Cloud, Infrastructure, Platforms, and Solutions group at VMware, that also noted acquisition-related "concerns" but claimed the evolution would be fiscally prudent.

An anonymous reader shares a report: Microsoft is already testing Windows 11 24H2, this fall's big new Windows release. The company has already demonstrated a few new features, like 80Gbps USB4 support and Sudo for Windows, and the new version could also give a significant refresh to the Windows installer for the first time since the Windows Vista days. But there's one big update you might not notice at all. Late last week, Microsoft released "servicing updates" with no new features to Windows Insiders in the Dev and Canary channels. The updates were "designed to test [Microsoft's] servicing pipeline for Windows 11." It's pretty common for Insiders to get these kinds of updates-that-exist-only-to-test-the-update-process, but the twist here is that PCs with Virtualization Based Security (VBS) enabled could apply the update without rebooting.

Sources speaking to Windows Central say this isn't a fluke -- Microsoft reportedly intends to use a Windows Server feature called hotpatching to deliver more Windows 11 security updates without requiring a reboot, making it easier to stay up to date without disrupting whatever you're doing. You'll still need to reboot "every few months" -- Microsoft's documentation says a reboot is needed roughly once every three months, though it can happen more often than that for unanticipated zero-day patches and others that can't be fixed via hotpatching. The Arm versions of Windows 11 also won't get the feature for another year or so, according to Windows Central.

stikves writes: Today, Broadcom announced immediate end of ESXi availability. ESXi has been an important tool for many "homelab" enthusiasts -- offering simple bare metal virtualization for small setups. Unfortunately they don't offer a replacement, except for paid subscription services.

The Wall Street Journal reports: Moves by Broadcom to shore up its $69 billion VMware acquisition, completed in November, include a streamlining of product bundles and new billing models — efforts in line with the chip giant's past acquisitions, but not necessarily welcomed by all of VMware's customers... Broadcom has also recently laid off at least hundreds of VMware workers, disclosures from the Worker Adjustment and Retraining Notification show....

VMware has approximately 330,000 customers, according to the company. Chief information officers say they are closely monitoring what comes next.

"Any CIO that's not taking stock of what they have and mentally considering alternatives and monitoring what else is out there is probably not doing their job," said Jay Ferro, executive vice president and chief information, technology and product officer at clinical research data-management company Clario. All these changes, plus past remarks by Broadcom that its go-to-market strategy is to focus completely on the needs and priorities of its top 600 customers, has left some CIOs rethinking the relationship. Price increases and degrading levels of support are among their biggest concerns. "I'm not one of their top, probably 600 customers, so they've been very clear to me where I fit in that pecking order," said Todd Florence, CIO of trucking company Estes Express Lines. Florence said he's started looking into alternatives. "It certainly doesn't make you feel good, like you're going to get lots of support going forward...."

Goya Foods CIO Suvajit Basu said he is thinking about how to reduce the food company's reliance on VMware as the sole and longtime dominant provider of virtualization for the data center. "They're going to increase their prices or change their licensing so the customer pays more," he said. "And I think this is starting to hit us right now...." Forrester estimates that in 2024, 20% of VMware customers will begin the process of exiting VMware in favor of alternatives.
On the other hand, a group VP at market researcher IDC tells the Journal that on the upside, now VMware and Broadcom will have to engage more actively with customers on the value of new produces included in their bundles...

An anonymous reader quotes a report from The Register: Broadcom is tossing the majority of VMware's Cloud Services Providers as part of its shakeup of the virtualization titan's partner programs, say sources, leaving customers unclear who their IT supplier will be. The $61 billion purchase of VMware by Broadcom in November was swiftly followed by news of how it planned to reorganize the business into several Broadcom divisions. A month later we revealed that Broadcom intended to discontinue VMware's channel program, and that some solution providers/ resellers would be transitioned to its own scheme, but on an invitation-only basis, from February. However, while Broadcom informed one part of VMware's channel of this change, a second notice was also sent to Cloud Services Providers (CSPs), informing them that their program is going to be terminated at the end of April. This program allows service providers such as smaller cloud operators to sell a VMware-based cloud service.

In the letter, seen by The Register, Broadcom tells its cloud provider partners: "Effective April 30, 2024, the ability to transact as a VMware Cloud Services Provider, under the VMware Partner Connect Program, will come to an end. However, we want to emphasize that you may have the opportunity to join the Broadcom Expert Advantage Partner Program. This invite-only program has simpler requirements and offers expanded benefits, and we will begin inviting partners to join in early 2024." One service provider told us their company had been left in the dark since that letter was received, and Broadcom has given them no indication of whether they will be invited to join its partner program or not, or what their customers are supposed to do if the company loses the right to operate a VMware cloud service. "I don't know how many smaller providers are affected by this but it must be a very large number," the source told us. "The VCSP program was the only way for MSPs and service providers to offer a multi-tenant VMware-based cloud service."

Chatter among some in the industry is that Broadcom is only interested in keeping the largest and most profitable customers, and the company simply doesn't care about the smaller users and the providers that service them. Unconfirmed fears that are only ten percent of Vmware's biggest CSPs will be invited to the new master program. "This all sounds very much like Broadcom taking an aggressive approach to its route to market and focusing on those partners that can deliver growth and significant revenue," said Omdia chief analyst Roy Illsley. "I suspect the intention is to ensure that VMware consists of only profitable products and they are sold in a more cohesive way with the rest of Broadcom. So I expect to see some news on this continuing to come out for most of 2024 as the company puts this plan into action. I would not rule out disposals of some assets in a drive to streamline the portfolio to those that fit with Broadcom's strategy." "How can they just cancel a major program affecting hundreds, perhaps thousands of customers, with zero notice, and zero details?" said one service provider. "They sent the notices out the Friday before the holidays, with no follow-up, which makes the situation even more egregious. What are we supposed to tell our customers? It's mind-boggling."

"Digital twin technology is one of the most significant disruptors of global manufacturing seen this century," argues Motor Trend, "and the automobile industry is embracing it in a big way." Roughly three-quarters of auto manufacturers are using digital twins as part of their vehicle development process, evolving not only how they design and develop new cars but also the way they monitor them, fix them, and even build them...

Nvidia, best known for its consumer graphics cards, also has a digital twin solution, called Omniverse, which manufacturers such as Mercedes-Benz are using to design their manufacturing processes. "Their factory planners now have every single element in the factory that they can then put in that virtual digital twin first, lay it all out, and then operate it," Danny Shapiro, VP of automotive at Nvidia said. At that point, those planners can run the entire manufacturing process virtually, ensuring every conveyor feeds the next step in the process, identifying and addressing factory floor headaches long before production begins...

Software developers can run their solutions within digital twins. That includes the code at the lowest level, basic stuff that controls ignition timing within the engine for example, all the way up to the highest level, like touchscreens responding to user inputs. "We're not just simulating the operation outside the car, but the user experience," Nvidia's Shapiro said. "We can simulate and basically run the real software that would be running in that car and display it on the screens." By bringing all these systems together virtually, developers can find and solve issues earlier, preventing costly development delays or, worse yet, buggy releases...

Using unique identifiers, manufacturers can effectively create internal digital copies of vehicles that have been produced. Those copies can be used for ongoing tests and verifications, helping to anticipate things like required maintenance or susceptibility to part failures. By using telematics, in-car services that remotely communicate a car's status back to the manufacturer in real-time, these digital twins can be updated to match the real thing. "By monitoring tire health, tire grip, vehicle weight distribution, and other critical parameters, engineers can anticipate potential problems and schedule maintenance proactively, reducing downtime and extending the vehicle's lifespan," Tactile Mobility's Tzur said.

Ed Targett reports via The Stack: Broadcom is killing off VMware's on-premises perpetual licenses -- and getting set to strong-arm VMware customers onto subscriptions, by also ending the sale of Support and Subscription renewals for such customers. VMware described this to customers as part of its plan to "complete the transition of all VMware by Broadcom solutions to subscription licenses." "We are [also] ending the sale of Support and Subscription (SnS) renewals for perpetual offerings beginning today" SVP Krish Prasad said in a FAQ.

VMware perpetual licenses were described by its own Office of the CTO earlier this year in a short blog as its "most renowned licenses." The on-premises licenses for the virtualization software come with a license key, with SnS separately licensing users for support and software updates. Perpetual license keys never expire but the SnS lapses and now will not, seemingly, be renewed -- meaning that customers reluctant to shift to an alternative licensing model will be left without support or updates.

VMware customers "may continue using perpetual licenses with active support contracts. We will continue to provide support as defined in contractual commitments. We encourage customers to review their inventory of perpetual licenses, including Support Services renewal and expiration dates," Broadcom said rather menacingly, on December 10. The company is also announcing a new "bring-your-own-subscription license option, providing license portability to VMware validated hybrid cloud endpoints running VMware Cloud Foundation," it added, without initially sharing details.

An anonymous reader quotes a report from Ars Technica: Security researchers are tracking what they say is the "mass exploitation" of a security vulnerability that makes it possible to take full control of servers running ownCloud, a widely used open source file-sharing server app. The vulnerability, which carries the maximum severity rating of 10, makes it possible to obtain passwords and cryptographic keys allowing administrative control of a vulnerable server by sending a simple Web request to a static URL, ownCloud officials warned last week. Within four days of the November 21 disclosure, researchers at security firm Greynoise said, they began observing "mass exploitation" in their honeypot servers, which masqueraded as vulnerable ownCloud servers to track attempts to exploit the vulnerability. The number of IP addresses sending the web requests has slowly risen since then. At the time this post went live on Ars, it had reached 13.

CVE-2023-49103 resides in versions 0.2.0 and 0.3.0 of graphapi, an app that runs in some ownCloud deployments, depending on the way they're configured. A third-party code library used by the app provides a URL that, when accessed, reveals configuration details from the PHP-based environment. In last week's disclosure, ownCloud officials said that in containerized configurations -- such as those using the Docker virtualization tool -- the URL can reveal data used to log in to the vulnerable server. The officials went on to warn that simply disabling the app in such cases wasn't sufficient to lock down a vulnerable server. [...]

To fix the ownCloud vulnerability under exploitation, ownCloud advised users to: "Delete the file owncloud/apps/graphapi/vendor/microsoft/microsoft-graph/tests/GetPhpInfo.php. Additionally, we disabled the phpinfo function in our docker-containers. We will apply various hardenings in future core releases to mitigate similar vulnerabilities.

We also advise to change the following secrets:
- ownCloud admin password
- Mail server credentials
- Database credentials
- Object-Store/S3 access-key"

Simon Sharwood reports via The Register: Amazon Web Services has announced the WorkSpaces Thin Client -- a device dedicated to connecting to its WorkSpaces desktop-as-a service offering and based on Amazon's own "Fire Cube" smart TV box. The $195 machine has the same hardware as the Fire Cube: the eight-core Arm-powered Amlogic POP1-G SoC, plus 2GB of LPDDR4 RAM, 10/100 ethernet, and a single USB-A 2.0 port. Bluetooth is included to connect other peripherals. A second HDMI output can be added by acquiring an $85 hub that also offers four more USB ports. Like the Fire TV Cube, the Thin Client also runs a modified cut of Android.

But there the similarities end. AWS created custom firmware and ripped out anything remotely related to running a consumer device, replacing it with software designed solely to create a secure connection between the device and desktops running in the Amazonian cloud. Amazon Business -- the B2B version of Jeff Bezos's digital souk -- will ship the device to your door, and charge it to your AWS bill. At least if you are in the USA. Europe will get the Thin Client in early 2024, and it'll eventually migrate elsewhere.

AWS decided to base the box on the Fire Cube because, according to a corporate blog post, AWS customers expressed a desire for cheaper and easier-to-maintain client devices. As AWS execs searched for a well-priced box, they considered the Fire TV Cube, found it fit the bill and noted it was already being made at scale. Keeping things in-house made sense, too. And so we find ourselves with AWS taking on established thin client providers. The cloudy concern is also keen to have a crack at the thick wedge of the enterprise PC market: call centers, payment processing centers, and other environments with lots of users and high staff turnover due to factors like seasonal demand for workers.

After acquiring VMware for $69 billion, Broadcom is eliminating several positions at the virtualization technology company. Business Insider reports: Employees whose positions were eliminated received an email on Monday, viewed by Business Insider, that read: "Broadcom recently completed its acquisition of VMware. As part of integration planning, and following an organizational needs assessment, we identified go-forward roles that will be required within the combined company. We regret to inform you that your position is being eliminated and your employment will be terminated."

"We would like to thank you for your dedication and service. We want to make this transition as smooth as possible, including offering you a generous severance package and providing you a non-working paid notice period," the email continued. Currently, it's unclear exactly how many employees will be affected by the cuts.

Long-time Slashdot reader Noryungi writes: OpenBSD 7.4 has been officially released. The 55th release of this BSD operating system, known for being security oriented, brings a lot of new things, including dynamic tracer, pfsync improvements, loads of security goodies and virtualization improvements. Grab your copy today! As mentioned by Phoronix's Michael Larabel, some of the key highlights include:

- Dynamic Tracer (DT) and Utrace support on AMD64 and i386 OpenBSD
- Power savings for those running OpenBSD 7.4 on Apple Silicon M1/M2 CPUs by allowing deep idle states when available for the idle loop and suspend
- Support for the PCIe controller found on Apple M2 Pro/Max SoCs
- Allow updating AMD CPU Microcode updating when a newer patch is available
- A workaround for the AMD Zenbleed CPU bug
- Various SMP improvements
- Updating the Direct Rendering Manager (DRM) graphics driver support against the upstream Linux 6.1.55 state
- New drivers for supporting various Qualcomm SoC features
- Support for soft RAID disks was improved for the OpenBSD installer
- Enabling of Indirect Branch Tracking (IBT) on x86_64 and Branch Target Identifier (BTI) on ARM64 for capable processors

You can download and view all the new changes via OpenBSD.org.

SUSE's latest release of SUSE Linux Enterprise 15 Service Pack 5 (SLE 15 SP5) has a focus on security, claiming it as the first distro to offer full support for confidential computing to protect data. From a report: According to SUSE, the latest version of its enterprise platform is designed to deliver high-performance computing capabilities, with an inevitable mention of AI/ML workloads, plus it claims to have extended its live-patching capabilities. The release also comes just weeks after the community release openSUSE Leap 15.5 was made available, with the two sharing a common core. The Reg's resident open source guru noted that Leap 15.6 has now been confirmed as under development, which implies that a future SLE 15 SP6 should also be in the pipeline.

SUSE announced the latest version at its SUSECON event in Munich, along with a new report on cloud security issues claiming that more than 88 percent of IT teams have reported at least one cloud security incident over the the past year. This appears to be the justification for the claim that SLE 15 SP5 is the first Linux distro to support "the entire spectrum" of confidential computing, allowing customers to run fully encrypted virtual machines on their infrastructure to protect applications and their associated data. Confidential computing relies on hardware-based security mechanisms in the processor to provide this protection, so enterprises hoping to take advantage of this will need to ensure their servers have the necessary support, such as AMD's Secure Encrypted Virtualization-Secure Nested Paging (SEV-SNP) and Intel's Trust Domain Extensions (TDX).

Linux Foundation Europe "has announced the RISC-V Software Ecosystem (RISE) Project to help facilitate more performant, commercial-ready software for the RISC-V processor architecture," reports Phoronix.

"Among the companies joining the RISE Project on their governing board are Andes, Google, Intel, Imagination Technologies, Mediatek, NVIDIA, Qualcomm, Red Hat, Rivos, Samsung, SiFive, T-Head, and Ventana."

It's top goal is "accelerate the development of open source software for RISC-V," according to the official RISE web site. The project's chair says it "brings together leaders with a shared sense of urgency to accelerate the RISC-V software ecosystem readiness in collaboration with RISC-V International." The CEO of RISC-V International, Calista Redmond, said "We are grateful to the thousands of engineers making upstream contributions and to the organizations coming together now to invest in tools and libraries in support of the RISC-V software ecosystem." RISE Project members will contribute financially and provide engineering talent to address specific software deliverables prioritized by the RISE Technical Steering Committee (TSC). RISE is dedicated to enabling a robust software ecosystem specifically for application processors that includes software development tools, virtualization support, language runtimes, Linux distribution integration, and system firmware, working upstream first with existing open source communities in accordance with open source best practices.

"The RISE Project is dedicated to enabling RISC-V in open source tools and libraries (e.g., LLVM, GCC, etc) to speed implementation and time-to-market," said Gabriele Columbro, General Manager of Linux Foundation Europe.
Google's director of engineering on Android said Google was "excited to partner with industry leaders to drive rapid maturity of the RISC-V software ecosystem in support of Android and more."

And the VP of system software at NVIDIA said "NVIDIA's accelerated computing platform — which includes GPUs, DPUs, chiplets, interconnects and software — will support the RISC-V open standard to help drive breakthroughs in data centers, and a wide range of industries, such as automotive, healthcare and robotics."

There's a major new update of QEMU, the open-source machine emulator, reports 9to5Linux: Coming a year after QEMU 7.0, the QEMU 8.0 release is here to improve support for ARM and RISC-V architectures.

- For ARM, it adds emulation support for FEAT_EVT, FEAT_FGT, and AArch32 ARMv8-R, CPU emulation for Cortex-A55 and Cortex-R52, support for a new Olimex STM32 H405 machine type, as well as gdbstub support for M-profile system registers.

- For the RISC-V architecture, QEMU 8.0 brings updated machine support for OpenTitan, PolarFire, and OpenSBI, additional ISA and Extension support for smstateen, native debug icount trigger, cache-related PMU events in virtual mode, Zawrs/Svadu/T-Head/Zicond extensions, and ACPI support. Moreover, RISC-V received multiple fixes covering PMP propagation for TLB, mret exceptions, uncompressed instructions, and other emulation/virtualization improvements.
Improvements were also made for the s390x (IBM Z) platform, the HP Precision Architecture (HPPA) platform, and x86.

Microsoft has outlined how users running Apple Silicon-based Macs can utilize Windows 11 in a new support document published today. The document explains how users running Mac devices with either M1 or M2 chips can use Windows 11, either via the cloud or using a local virtualization such as Parallels Desktop. From a report: Unfortunately, the document makes no mention of installing Windows 11 natively on Apple Silicon hardware. Apple's legacy Bootcamp application, which previously allowed Mac users to install Windows into its own bootable partition on a Mac, was removed when Apple transitioned to ARM processors. As of now, Microsoft points to Windows 365 as a potential solution for running Windows 11 on a Mac, using its enterprise service to stream a Windows 11 PC from the cloud. [...] For those users, Microsoft also mentions Parallels Desktop as a viable alternative. Version 18 of Parallels Desktop is now officially authorized to run Windows 11 on ARM on a Mac with M1 or M2 processors. This is the only way to officially run Windows 11 on ARM locally on a Mac with Apple Silicon.

Searching Google for downloads of popular software has always come with risks, but over the past few months, it has been downright dangerous, according to researchers and a pseudorandom collection of queries. Ars Technica reports: "Threat researchers are used to seeing a moderate flow of malvertising via Google Ads," volunteers at Spamhaus wrote on Thursday. "However, over the past few days, researchers have witnessed a massive spike affecting numerous famous brands, with multiple malware being utilized. This is not "the norm.'"

The surge is coming from numerous malware families, including AuroraStealer, IcedID, Meta Stealer, RedLine Stealer, Vidar, Formbook, and XLoader. In the past, these families typically relied on phishing and malicious spam that attached Microsoft Word documents with booby-trapped macros. Over the past month, Google Ads has become the go-to place for criminals to spread their malicious wares that are disguised as legitimate downloads by impersonating brands such as Adobe Reader, Gimp, Microsoft Teams, OBS, Slack, Tor, and Thunderbird.

On the same day that Spamhaus published its report, researchers from security firm Sentinel One documented an advanced Google malvertising campaign pushing multiple malicious loaders implemented in .NET. Sentinel One has dubbed these loaders MalVirt. At the moment, the MalVirt loaders are being used to distribute malware most commonly known as XLoader, available for both Windows and macOS. XLoader is a successor to malware also known as Formbook. Threat actors use XLoader to steal contacts' data and other sensitive information from infected devices. The MalVirt loaders use obfuscated virtualization to evade end-point protection and analysis. To disguise real C2 traffic and evade network detections, MalVirt beacons to decoy command and control servers hosted at providers including Azure, Tucows, Choopa, and Namecheap. "Until Google devises new defenses, the decoy domains and other obfuscation techniques remain an effective way to conceal the true control servers used in the rampant MalVirt and other malvertising campaigns," concludes Ars. "It's clear at the moment that malvertisers have gained the upper hand over Google's considerable might."