30
30
30
57
Benchmarking Qwen3.8 27B quantizations: 4-bit holds up, 1-bit collapses
Quesma benchmarks Qwen3.8 27B quantizations: 4-bit Q4_K_M matches BF16 on key benchmarks while 1-bit collapses to random chance.
Quesma spent roughly $3,000 on Modal GPUs testing Unsloth GGUF quantizations of Qwen3.8 27B across GPQA Diamond, IFBench, and Terminal-Bench 2.1. The 17 GB Q4_K_M quantization matched the 55 GB BF16 model on Terminal-Bench 2.1 and showed little degradation down to 4-bit, while the 2-bit UD-Q2_K_XL dropped noticeably. At 1-bit, scores on GPQA Diamond fell to random-guess levels, with longer reasoning making results worse, and reasoning effort settings significantly affected outcomes.
55
60
30
60
55
DavidAU/Qwen3.8-27B-TURBO-Fable-Cold-Fusion-735-882-Heretic-Uncensored-NEO-CODER-MAX-MTP-GGUF — new model trending #8 on Hugging Face
A new Qwen3.8-27B GGUF fine-tune claims ARC-C 735 at 8-bit with thinking tokens cut 2x-10x versus the base model.
Independent creator DavidAU released a GGUF fine-tune of Qwen3.8-27B built with Unsloth, claiming ARC-C of 735 at 8-bit and 719 at 4-bit, trending #8 on Hugging Face. The 'TURBO' variant cuts thinking tokens by one half to as much as one tenth while retaining output quality and detail. The repo ships both regular and MTP quants and claims gains over the base model across seven benchmarks, using 'Cold Fusion (GAIN + Unsloth)' and 'Fable Fusion 711' training methods.
42
45
30
35
60
30
42
New GPUThor Rowhammer Defeats ECC on NVIDIA RTX A6000 to Gain Host Root Access
University of Toronto researchers present GPUThor, a Rowhammer attack that defeats ECC on NVIDIA RTX A4000-A6000 GDDR6 GPUs and achieves host root access.
GPUThor uses non-uniform hammering to bypass Target Row Refresh and overcome SECDED ECC on NVIDIA Ampere workstation GPUs with GDDR6 memory, inducing 72,000 to 377,552 bit flips per gigabyte across RTX A6000, A5000, A4500, and A4000 cards. Triple-bit silent data corruption enables host privilege escalation to root with the IOMMU enabled, reusing GPUBreach page-table corruption techniques, and double-bit DUEs allow escalation when the IOMMU is disabled during a ~10 ms lazy-service window. The attack cut end-to-end escalation time on the A6000 from 21.9 hours to 1.1 minutes. Reported to NVIDIA, Google, Microsoft, and AWS on April 29, 2026; findings were embargoed until August 25, 2026, and no CVE identifier was assigned.
62
Patchwork Continues to Deliver BADNEWS to the Indian Subcontinent
Unit 42 details Patchwork APT campaigns against the Indian subcontinent using EPS exploits and an updated BADNEWS backdoor targeting Pakistani military and nuclear interests.
Unit 42 observed the Patchwork group (also known as Dropping Elephant and Monsoon) conducting campaigns against targets in the Indian subcontinent using weaponized documents that exploit CVE-2015-2545 and CVE-2017-0261. The documents deliver an updated BADNEWS backdoor that grants attackers full control of victim machines, using dead drop resolvers on legitimate third-party websites for C2 and HTTP for communications. Lures referenced Pakistan Army promotions, the Pakistan Atomic Energy Commission and the Ministry of the Interior, and in late January 2018 the group shifted from CVE-2017-0261 to the older CVE-2015-2545.
54
42
55
Upatre Continued to Evolve with new Anti
Unit 42 analyzes an undocumented Upatre downloader variant with VM detection via process hashing, packed code, disabled Windows defenses and Namecoin .bit C2 domains.
Unit 42 analyzed an Upatre downloader variant compiled in December 2016 that went largely undetected by automated systems, featuring heavy code flow obscuration, on-demand decryption of network communications, and novel virtual machine detection. The sample enumerates running processes, computes CRC32 hashes XORed with a hard-coded key, and sleeps if analysis-related processes such as vmtoolsd.exe or python.exe are found. It masquerades with Google Chrome icons, disables Windows Defender, Firewall and other security services, injects code into msiexec.exe, and resolves .bit Namecoin domains like bookreader[.]bit via hardcoded OpenNIC DNS servers over TCP.
28
30
60
42
60
55
55
30
30
57
57
30
50
30
42
55
60
50
Analysis of Smoke Loader in New Tsunami Campaign
Fake Japanese Meteorological Agency tsunami warning emails delivered Smoke Loader and AzoRult malware to steal credentials from targets in Japan.
A fake tsunami warning email impersonating Japan's Meteorological Agency asked recipients to click a link on a registered fake agency domain, delivering the commodity loader Smoke Loader to targets in Japan. Smoke Loader, active since 2011, is modular, and its payloads have included banking trojans, ransomware, cryptominers, password stealers, and PoS malware; the campaign later also deployed AzoRult. New samples add junk-jump obfuscation, encrypted network traffic and payload files, a unique machine ID used for tracking and encryption, and PROPagate injection into explorer.exe, with persistence via a Startup folder shortcut and RC4-encrypted C2 communication.
45
47