Search
30 stories found
According to the Financial Times, Nvidia has verbally told cloud providers that use its AI chips to sell at least 51% of new capacity to non-Chinese customers. It targets the overseas rented compute Chinese AI labs rely on, and Southeast Asian clouds say it will be hard to meet.
Floorplan, a free MIT-licensed plugin, scans your repo locally and has your coding agent label every part, producing a browsable map with a security health check. It was one of GitHub's top trending repos on November 2.
Attackers chained an authentication bypass with two newer Ivanti Connect Secure flaws to get root on VPN appliances, and CISA's first federal deadline has already passed. Here's which builds fix it and what to check if your box was exposed.
Researchers found a malicious instruction file that tricked a coding agent into installing an unauthorized npm package — and reproduced it with a 90% success rate. Five settings that close the hole.
Attackers are using a flaw in Cisco's Secure Firewall remote-access SSL VPN to reboot firewalls without logging in. Only devices with secondary authentication on a tunnel group are exposed, so a two-minute config check tells you how urgent this is.
A plugin that watches what your agent does, compresses it into searchable memories in a local SQLite database, and feeds the relevant bits back into your next session. How it works and what to watch out for.
Google's November 2026 Android Security Bulletin patches more than 200 vulnerabilities, including a critical remote code execution flaw that needs no user interaction. Nothing is flagged as exploited yet, but the bulletin also lists the "SMS of Death" phone-crash bug that already has a public proof of concept.
CISA has added CVE-2026-97229 to its exploited-vulnerabilities list after an attack on Alpine Linux's GitLab server. The flaw lives in Ruby's regex engine, so self-built and custom GitLab images can stay vulnerable even on a "fixed" version number.
A CVSS 9.8 use-after-free in the kernel's IPv4 TCP handshake code affects kernels back to 4.4, and Anthropic says one of its models wrote a remote-root exploit for it. Red Hat shipped kernels on November 1; Ubuntu users are still waiting. Here's the status by distro and what to do in the meantime.
A misconfigured DNS resolver, chained zero-days and a covert channel built from CPU cache timing — OpenAI's own red team found the paths. Here's what happened and why it matters beyond OpenAI.
The MIT-licensed AiSOC ingests security telemetry, runs thousands of detection rules, has LLM agents investigate alerts and keeps a human in charge of any response. It runs on a laptop-class Docker setup with a small local model — here's what it does, what it needs and where it falls short.
OLED, IP67 water resistance and an A20 Pro chip make it a real upgrade. But the price is up $100, there's no 120Hz, and the best chip is locked to the 512GB model.
An open-source scanner compares your system against ~12,400 published indicators from 25 sources — without sending anything anywhere. What it can find, what it can't, and how to run it in five minutes.
agent-desktop, an Apache-2.0 Rust CLI from Vercel Labs, gives coding agents structured, ref-based control of native desktop apps without a vision model. It added about 2,300 stars in a day and was GitHub's top trending repo on November 3.
Two critical flaws in PHP's default upload-progress feature allow unauthenticated remote code execution. Here are the fixed versions, a one-line check, and the config change that buys you time.
Marvell agreed to buy optical-component maker Lumentum in an all-stock deal valued at about $115 billion, one of the largest tech acquisitions ever. The filing shows a $3.2 billion regulatory break fee and a close that could slip into late 2028.
Carbon tops the Artificial Analysis Intelligence Index and posts big security benchmark numbers. Google is rolling it out to vetted defenders before anyone else. Here's what's in it and what it costs.
RedMagic's gaming phone launched worldwide today with a Snapdragon 8 Elite Extreme Gen 6 and liquid cooling. US buyers pay more than the rumored $899, and the global model ships with 80W charging instead of China's 120W.
Anthropic's updated S-1 shows revenue up about 12x year over year but slowing quarter to quarter, a swing to a $567 million operating loss on short-term compute, and nearly $900 billion in infrastructure commitments. Here's what the numbers say ahead of its Nasdaq listing.
Amazon's cloud unit accelerated for another quarter and now earns 63% of the company's operating profit, but $77 billion of quarterly capex pushed trailing free cash flow to minus $42 billion.
A pan-and-tilt camera that screws into your porch light, open-ear buds that clip on, a phone mic for spatial audio, and a kids' phone with no internet. What each does — and the catch nobody puts in the headline.
Google's Suncatcher prototype satellite returned its first AI response from a data-center-class TPU in orbit. It's a real hardware milestone, but it says very little yet about whether space data centers can compete on cost.
Synology says attackers are exploiting a DSM flaw it patched in December 2024 to plant C3RB3R ransomware, which also encrypts backups on the same device. Researchers disagree about the entry point, so the safe move is the latest build for your DSM branch plus a few quick checks.
Google has dismantled the XCPE botnet and banned Shenzhen device maker Videostrong, which it says deliberately preloaded a backdoor that turned set-top boxes into proxies and ad-fraud engines. The backdoor reinstalls itself after removal, so for affected boxes the practical fix is replacement.
Microsoft Threat Intelligence has graded eight North Korean groups on how deeply they use AI. The findings — bulk-generated lures, AI-coded malware, fake recruiters and an open-source agentic attack framework — show where defenders should tighten up now.
Colibri, a dependency-free C engine that keeps mixture-of-experts weights on NVMe and loads them on demand, is back on GitHub's daily trending list at about 47K stars. It really does run frontier-size open models on ordinary hardware, but independent tests show giant models crawl well below one token per second.
A polished, ad-free, offline-capable vocabulary app — and the more interesting part is that its words, illustrations and audio are released under CC BY 4.0 for anyone to build on.
The third-generation Maia is built for inference, claims 40% more tokens per megawatt than leading GPUs, and is headed for multi-gigawatt deployment in 2027. You won't rent one — and that's the point.
Three small projects from this week's GitHub trending list that are clever, useful, or both — with what they do, how they work, and the catches.
Four AI providers say they will honor a shared robots.txt token, __usage_ai-training, that states a training preference once for all of them. It is not live everywhere yet, so here is what it does, what it doesn't, and what to put in your robots.txt today.
