Search: “lumo”

Smart search ranks by meaning as well as keywords (one row per story, last 45 days).

Attackers are weaponizing the gap between Chromium fixes and Chrome patches

Espionage actors use the BlueMoon exploit kit to chain Chrome V8 and Windows kernel zero-days via spear phishing, gaining full admin on unpatched endpoints.

Proofpoint, working with Google Threat Intelligence Group, Microsoft Threat Intelligence Center and Volexity, reports that the BlueMoon exploit kit chains V8 type confusion CVE-2026-85046, V8 sandbox escape CVE-2026-87491 and Windows kernel LPE CVE-2026-85880, all rated high severity. The V8 flaws were fixed in upstream Chromium source but had not yet reached Chrome stable releases, creating a patch gap that attackers reverse-engineered and weaponized. A China-aligned state-sponsored actor used the kit from August 28 against a small number of US NGOs, mining and commodity trading firms via rapport-building spear phishing, and within days several mostly China-linked espionage clusters adopted BlueMoon. The chain yields full Windows admin privileges from a single phishing click; defenders should patch Chrome and Windows, apply Proofpoint detections and hunt for leftover artifacts.

CSO Online·updated Sep 15, 10:17 UTC · 2d ago·first Sep 11, 01:10 UTC · 6d agoExploit / PoC in the wild 8 sourcesCVE-2026-85046CVE-2026-87491CVE-2026-85880

82

Product showcase: AI Paper Trail shows the privacy cost of talking to AI

Proton launched AI Paper Trail, a free tool that analyzes ChatGPT or Claude exports and reports what personal data can be inferred from AI conversations.

Proton released AI Paper Trail, a free web tool that analyzes the 200 most recent prompts from exported ChatGPT or Claude conversation histories and generates a privacy report with an AI Exposure Score, inferred personal data categories, and an estimated advertising value. In a hands-on test it identified 47 data points, returned a 58/100 exposure score, estimated $185 in advertising value, and flagged five red flags spanning location, interests, finances, and relationships. Proton states that uploaded data is deleted after analysis and is not stored on its Lumo servers.

Help Net Security·Aug 24, 00:00 UTC · 24d agoAI industry

18

Novel Blue Moon kit targeting Chrome and Windows reflects new reality of AI-driven exploits

Proofpoint reports the BlueMoon exploit kit, chaining two Chrome V8 zero-days and a Windows ALPC bug, being shared across China-linked espionage groups.

Proofpoint identified a new exploit kit, BlueMoon, first observed on August 28 and used by TA412 (APT31/Violet Typhoon) against US NGOs, mining firms, and commodity trading companies. The kit chains a V8 type confusion RCE (CVE-2026-85046), a V8 sandbox escape, and a Windows Advanced Local Procedure Call privilege escalation (CVE-2026-85880), both patched flaws having been exploited in the wild. At least four espionage groups, most with suspected China nexus including UNK_LateNight, adopted the kit within days, targeting US aerospace firms with defense-sector lures. Fewer than 20 organizations were observed targeted, and researchers believe AI-assisted exploit development against upstream Chromium patches enabled the kit's rapid creation and sharing.

The Register · Security·Sep 9, 22:28 UTC · 7d agoExploit / PoC in the wildCVE-2026-85046CVE-2026-858801

85

China-Linked Hackers Exploit Chrome and Windows Zero-Days in BlueMoon Attacks

China-linked clusters deploy the BlueMoon kit chaining Chrome V8 CVE-2026-85046 and Windows LPE CVE-2026-85880 in espionage campaigns.

Proofpoint researchers identified BlueMoon, an exploit kit combining a V8 type-confusion RCE (CVE-2026-85046), a V8 sandbox escape, and a Windows kernel privilege-escalation flaw (CVE-2026-85880), first observed August 28, 2026. At least four clusters adopted it, led by TA412 (also tracked as APT31/Violet Typhoon) and followed by UNK_LateNight, UNK_DoubleCheck, and UNK_QuietRacket, targeting aerospace, manufacturing, government, consulting, and financial sectors. The kit exploited a nearly four-week patch gap between the public Chromium commit (August 7) and stable rollout (September 3). TA412 delivered the GemStone Chrome extension masquerading as a Gemini companion, while other clusters deployed ShadowPad via DLL sideloading, a Rust loader, and DoH-based C2.

GBHackers·Sep 10, 05:15 UTC · 7d agoExploit / PoC in the wildCVE-2026-85046CVE-2026-858801

80

Multiple Chinese hacking groups seen using identical Chrome zero-day exploit

Four China-linked espionage groups share identical BlueMoon Chrome zero-day exploit kit targeting US defense contractors and Asian government agencies.

Proofpoint identified at least four Chinese-aligned espionage groups (TA412/RedBravo, UNK_LateNight, UNK_DoubleCheck, UNK_QuietRacket) using an identical Chrome zero-day exploit kit dubbed BlueMoon in late August through this week. Targets include US defense contractors, NGOs, mining companies, and Southeast Asian government agencies. The exploit chains a Chromium patch-gap vulnerability with a Windows flaw, delivering malware such as ShadowPad and a fake Gemini browser extension backdoor, with possible AI-assisted exploit development.

The Record·Sep 9, 16:30 UTC · 7d agoExploit / PoC in the wild 2 sources1

85

Four Nation-State Actors Used the Same Chrome Zero-Day Exploit Kit Within 12 Days

Proofpoint reports four nation-state actors, mostly China-nexus, adopted the BlueMoon Chrome and Windows zero-day exploit kit within 12 days, targeting US organizations.

Proofpoint tracked an exploit kit dubbed BlueMoon that chains CVE-2026-85046, a Chrome V8 type-confusion bug, with an unnamed V8 sandbox escape and CVE-2026-85880, a Windows kernel privilege escalation using ALPC and the Windows Notification Facility. The first observed use was by China-nexus TA412 (APT31, Violet Typhoon, JungleBamboo) on August 28, 2026 against US NGOs, mining companies, and commodity trading firms, followed by UNK_LateNight targeting US aerospace and defense companies on September 2. Both V8 bugs were patch-gap zero-days: the fix was committed to Chromium on August 7 but reached stable Chrome on September 3, enabling rapid weaponization from public patches. TA412's post-exploitation payload, GemStone, is a malicious browser extension posing as an AI-powered Google Gemini companion that captures keystrokes, cookies, screenshots, and browsing history via a Cloudflare Worker C2.

Security Affairs·Sep 10, 05:35 UTC · 7d agoExploit / PoC in the wildCVE-2026-85046CVE-2026-858801

85

4 groups caught using the same Chrome and Windows exploit kit

Proofpoint says at least four groups, some China-linked, actively share the BlueMoon kit chaining two Chromium and one Windows kernel exploit.

Proofpoint researchers report that at least four hacking groups, some with ties to the Chinese government, are actively using a nearly identical exploit kit named BlueMoon. The kit chains two Chromium browser vulnerabilities and one Windows kernel flaw affecting Windows 10, Windows 11 initial release, and a later Windows version to install malware of the attacker's choice. All three vulnerabilities received patches within the past 24 hours. Proofpoint attributes the kit's rapid, widely shared deployment to a Chromium patch-gap window and AI agents accelerating exploit development against publicly accessible upstream patches.

Ars Technica · Security·Sep 9, 20:55 UTC · 7d agoExploit / PoC in the wild3

85

Grok exfiltrates user data when malicious instructions are encrypted

Researchers show Grok can be made to exfiltrate user data via Cryptographic Context Injection, a newly documented technique that bypasses LLM safety guardrails.

According to Ars Technica, Grok exfiltrates user data when malicious instructions are encrypted, a technique called Cryptographic Context Injection. The method is described as the latest documented way to break LLM safety guardrails, showing that encrypted content can carry hidden instructions past safeguards. The finding underscores gaps in how large language models validate and execute context from external sources.

Ars Technica · Security·Aug 20, 13:00 UTC · 28d agoAI safety & security1

55

Hackers Chain Chrome and Windows Zero-Days in New BlueMoon Exploit Kit Attacks

Multiple espionage actors, mostly China-nexus, are chaining Chrome V8 and Windows kernel zero-days (CVE-2026-85046, CVE-2026-85880) via the BlueMoon exploit kit against government and defense targets.

Proofpoint identified a new exploit kit dubbed BlueMoon chaining a Chromium V8 type-confusion RCE (CVE-2026-85046), a V8 sandbox escape, and a Windows kernel LPE (CVE-2026-85880). At least four distinct threat clusters, most with suspected China nexus, adopted the kit within days starting with TA412 (Violet Typhoon/APT31) on August 28, 2026. Both Chrome-side flaws were patch-gap zero-days with roughly a four-week exploitation window; the Windows LPE only works on Windows 10 and Server 2019/2022. TA412 used spearphishing posing as university interns to deliver the GemStone browser backdoor disguised as a Google Gemini extension; other clusters delivered ShadowPad via DLL sideloading and a Rust loader against targets in aerospace, government, and finance.

Cyber Security News·Sep 9, 16:59 UTC · 7d agoExploit / PoC in the wildCVE-2026-85046CVE-2026-858801

86

deepseek-ai/DeepSeek-V4.1-Flash — new model trending #28 on Hugging Face

DeepSeek releases DeepSeek-V4.1-Flash, a 552B-parameter multimodal MoE model with 1M-token context and KV cache cut to 890 bytes per token.

DeepSeek-V4.1-Flash is a multimodal Mixture-of-Experts model with a 552B-parameter backbone that activates 8B parameters per token during prefill and 16B during decode. It uses a Causal Encoder-Decoder architecture, Compressed Sparse Attention 2, and FP4 KV caching to reduce the global KV cache footprint to 890 bytes per token, roughly one quarter of DeepSeek-V4-Flash. The model was trained from scratch on 45T tokens with context extended to 1M tokens, includes an Engram conditional-memory module (196B parameters), and is released under the MIT license. Post-training uses SFT, RL, and on-policy distillation with large-scale automated synthesis of agentic tasks and a controllable reasoning effort setting from 1 to 100.

Hugging Face trending models·Sep 10, 02:17 UTC · 7d agoModel release1

80

Four groups caught using the same Chrome and Windows exploit kit

Proofpoint reports at least four hacking groups, some China-linked, share the BlueMoon exploit kit chaining Chromium and Windows kernel vulnerabilities to install malware.

Proofpoint named the nearly identical kit BlueMoon; it chains two Chromium vulnerabilities with one Windows kernel privilege-escalation flaw affecting Windows 10 (October 2018 Update and 2004), Windows Server 2019 and 2022, and the initial Windows 11 release. All three vulnerabilities received patches within 24 hours of the activity. The kit is being actively used by at least four hacking groups, some with Chinese government ties. Proofpoint links the rapid, visible sharing of a historically rare full browser exploit chain to the Chromium supply-chain patch gap and AI-assisted exploit development.

Proofpoint Threat Insight·Sep 9, 21:19 UTC · 7d agoExploit / PoC in the wild 3 sources1

80

DeepSeek-v4.1 Flash: Pushing the Limits of KV Cache Compression

DeepSeek-V4.1 Flash is a 552B-parameter multimodal MoE model with 1M-token context achieving 4x KV cache compression for long-horizon agent workloads.

A detailed analysis of the DeepSeek-V4.1 Flash technical report describes a 552B-parameter multimodal mixture-of-experts model supporting contexts up to 1 million tokens. Its Causal Encoder-Decoder (CED) architecture activates 8B parameters during prefill and 16B during decode, and reportedly delivers about 420 tokens/s. Joint optimization of architecture (CSA2 cross-layer compression), FP4 KV cache precision, and deployment strategy cuts runtime KV cache to roughly 1/4 and persistent KV cache to about 1/8 of DeepSeek-V4-Flash at the same sequence length, targeting storage and bandwidth bottlenecks in long-horizon agent serving. The author notes all DeepSeek-V4 Pro models were taken offline following the release.

Hacker News · AI·01:39 UTC · 11h agoModel releaseHN 41↑ · 3 comments

74

ClearFake Deploys Crypto Stealer That Uses Vulnerable Driver to Kill EDR Security Tools

Cisco Talos details ClearFake's fake-CAPTCHA chain deploying ZigCryptoStealer with a BYOVD attack that kills EDR processes, observed at a Ukrainian government organization in April 2026.

ClearFake compromises websites, injects JavaScript via a malicious Cloudflare Worker, retrieves instructions from BNB Smart Chain contracts (EtherHiding), and presents a fake Google CAPTCHA that tricks Windows users into pasting a command that loads a remote library over WebDAV via rundll32. The crypto-stealer branch uses DLL side-loading with a signed Chrome component to launch ZigCryptoStealer, which hijacks clipboard cryptocurrency addresses, alongside a signed but vulnerable Windows driver used in a BYOVD attack to terminate EDR processes. A parallel branch delivers Amatera secondary payloads that install a hidden remote-access client providing operator desktop control, with Cisco Talos tracking the remote-loader activity as UAT-10820. Talos observed unusual remote library execution at a Ukrainian government organization in April 2026 and assesses the attacks are part of a broader theft operation rather than a single targeted campaign.

Cyber Security News·Sep 9, 14:26 UTC · 7d agoMalware in the wild1

62

Objective vs. Search: Decomposing What Makes a Good Tokeniser

New tokeniser study shows search procedure, not optimisation objective, drives bits-per-byte performance across model sizes, vocabulary sizes, and multilingual settings.

The paper disentangles BPE and UnigramLM along two axes: optimisation objective (compression vs log-likelihood) and search procedure (bottom-up merging vs top-down pruning). Two new algorithms, BottomUpLL and TopDownComp, complete the 2x2 design space, and trained language models are evaluated on bits-per-byte and BLiMP across model sizes, vocabulary sizes, and English-only vs multilingual domains. Bottom-up tokenisers consistently achieve lower bits-per-byte in most settings, while BLiMP shows no consistent relationship with design choice.

arXiv cs.AI / cs.LG / cs.CL·Sep 16, 17:59 UTC · 19h agoAI research

28

ReMoMask-2: Latent Retrieval-Augmented Masked Motion Generation

ReMoMask-2 rebuilds retrieval in the generator's latent space for text-to-motion generation, achieving lowest FID on KIT-ML and SnapMoGen.

ReMoMask-2 is a retrieval-augmented text-to-motion framework that constructs its retrieval database directly in the generator's pre-quantization latent space and aligns text queries through a distilled lightweight projector, eliminating the representation gap. The framework combines Hierarchical Bidirectional Momentum contrastive learning, Semantic Spatial-Temporal Attention, and Topology Structured Masking to handle hierarchical motion structure. The retriever achieves state-of-the-art accuracy, and ReMoMask-2 attains the lowest FID on KIT-ML and SnapMoGen, with a single mask-transformer stage outperforming the previous two-stage pipeline while delivering the fastest inference.

Hugging Face daily papers·Sep 7, 20:00 UTC · 9d agoAI research

25

Studying Image Tokenizers as Visual Languages in Unified Multimodal Models

A controlled autoregressive testbed shows validation losses must be analyzed per task, and image tokenizer choice affects joint multimodal text modeling.

Researchers built a pure-autoregressive testbed to study image tokenizers as the 'visual language' of unified multimodal models, tracking task-specific validation losses during multimodal continual pretraining across text, image, text-to-image (T2I), and image-to-text (I2T) prediction. They found that losses exhibit distinct scaling behavior per task and rank tokenizers differently, and that I2T loss over a shared text vocabulary gives a more consistent loss–performance signal than T2I loss. Better reconstruction does not necessarily yield lower task-specific losses or stronger downstream performance, and tokenizer choice can affect text modeling under joint optimization. Case studies examine the discriminator, semantic supervision, and vocabulary size design axes.

Hugging Face daily papers·Sep 7, 20:00 UTC · 9d agoAI research1

40

Breaking the Vision-Action Shortcut: Latent Interface Training for Generalizable Robotics Foundation Models

Latent Interface Training improves robot foundation model generalization by constraining visual conditioning, boosting LIBERO-Plus success up to 10.7 points.

The paper identifies vision-action shortcuts where robot policies exploit task-irrelevant visual cues that fail under distribution shift. Latent Interface Training (LIT) first trains an action expert conditioned on language, robot state, and terminal SE(3) end-effector poses without images, then constrains visual input through a pose-supervised latent interface. Across four VLA and world-action architectures (Pi0.5, MolmoAct2, FAST-WAM, ImageWAM), LIT improves LIBERO-Plus success by 3.87-10.70 percentage points. Real-world tests show 13.30-16.70 percentage-point gains under unseen cameras, lighting, and distractors.

Hugging Face daily papers·Sep 10, 20:00 UTC · 6d agoAI research

32

Building a Production Greek-English Speech Recognizer

Engineering report details Sophea, a production Greek-English ASR reaching 4.26% WER on public English sets via ROVER ensemble and data-pipeline calibration.

Across 23 training iterations, two architectures, and nine production gates, no single data composition passed all gates; a three-model ROVER ensemble reached 9 of 9 gates and cut overlapping-speech WER from 53.35% to 37.87%. Calibrating an audio-quality filter against in-domain anchors reduced discarded scored Greek audio from 98.7% to 10.6%, and a pre-registered ablation traced a hallucination defect to one training-data package. The sophea/asr-k1 preview arbiter lists 4.26% average WER on eight public English test sets and 25.88% WER on live Greek noisy traffic; no weights or training data are released.

Hugging Face daily papers·Sep 10, 20:00 UTC · 6d agoAI research

32

FLAT: Resampling Image and Text into 1D Flexible-Length Aligned Transmodal Tokens for Retrieval and Generation

FLAT jointly trains a multimodal encoder with text-to-image and image-to-text decoders, producing flexible-length tokens that hit 83.1 GenEval on T2I after fine-tuning.

FLAT (Flexible-Length Aligned Transmodal representations) is a pre-training framework that jointly optimizes a shared multimodal encoder with T2I and I2T decoders, combining contrastive alignment with bidirectional cross-modal generative objectives. It maps visual and textual inputs into a unified continuous 1D sequence space and uses nested dropout over prefix-K tokens for dynamic output lengths. A single pre-training stage supports cross-modal retrieval and generation (71.1 GenEval), with task-specific fine-tuning reaching 83.1 GenEval on T2I, 40.5 BLEU-4 and 138.6 CIDEr on MS-COCO captioning, and strong Recall@5 on MS-COCO and Flickr30K.

Hugging Face daily papers·Sep 14, 20:00 UTC · 2d agoAI research1

35

Right Tool, Right Job: Native-Language Evaluation, Tokenizer Sensitivity, and Methodological Findings from a French-Only BabyLM

French BabyLM entry METRON-FR (125M GPT-2, 92.47M words) shows tokenizer artifacts dominate child-scale zero-shot evaluation; proposes standard diagnostics.

METRON-FR is a 125M-parameter GPT-2 pretrained on 92.47M French words, submitted to the BabyLM 2026 Strict track, scoring 85.97% on the native Quebec-French QFrBLiMP benchmark and 62.80% on the BabyLM-weighted leaderboard. A cross-lingual GLUE protocol combining French task-data translation with rank-16 LoRA shows relational tasks gain while world-knowledge tasks regress. Bilingual Lexicon Induction reaches p@1 of 68.84%, 18x above chance, and ablations show single-token zero-shot scoring is dominated by tokenizer and template artifacts at child scale.

arXiv cs.AI / cs.LG / cs.CL·Sep 15, 16:43 UTC · 1d agoAI research

12

Rosetta at AlexandriaX-2026: LoRA-Adapted NileChat for Context-Aware Dialectal Arabic Dialogue Translation

Rosetta ranks 4th and 5th in AlexandriaX-2026 dialectal Arabic dialogue translation using a LoRA adapter on NileChat-3B, finding limited pretraining benefit.

The Rosetta system for the AlexandriaX-2026 shared task fine-tunes a LoRA adapter on NileChat-3B for context-aware English-to-dialectal Arabic dialogue translation. The adapter was additionally pretrained on MADAR and PADIC dialect corpora for the unconstrained track. It achieved spBLEU 26.10 (4th, constrained) and 25.09 (5th, unconstrained). External dialect pretraining improved only two of thirteen dialects while slightly degrading overall performance, indicating negative transfer.

arXiv cs.AI / cs.LG / cs.CL·Sep 9, 16:15 UTC · 7d agoAI research1

18

Studying Image Tokenizers as Visual Languages in Unified Multimodal Models

A controlled pure-autoregressive testbed shows task-specific validation losses rank image tokenizers differently, with I2T loss the most consistent signal.

Researchers built a controlled pure-autoregressive testbed and tracked task-specific validation losses during multimodal continual pretraining across text, image, text-to-image (T2I), and image-to-text (I2T) prediction. They find losses should be analyzed per task because they exhibit distinct scaling behavior and rank tokenizers differently, and that the loss-performance relationship depends on the predicted token space. I2T loss, computed over a shared text vocabulary, correlates consistently with both generation and visual understanding performance after supervised finetuning. Case studies revisit the discriminator, semantic supervision, and vocabulary size as tokenizer design axes.

arXiv cs.AI / cs.LG / cs.CL·Sep 8, 17:57 UTC · 8d agoAI research1

30

Measuring Language Transfer in Robot Policies: Adding Greek to a Cosmos3 Vision-Language-Action Policy

Researchers added Greek to the Cosmos3 vision-language-action policy using only machine-rephrased instructions, finding bilingual training reaches roughly two fifths of English performance.

The paper studies localizing the open Cosmos3 vision-language-action robot policy to Greek without architectural changes, using machine-rephrased instructions only. Bilingual training yields a consistent 6.7-7.1 point margin over controls on a 90-task, three-seed evaluation suite, while Greek-only training gains at most 2.7 points. Several common evaluation instruments, including color-histogram metrics and single-goal benchmarks, produced false conclusions, and results were dominated by seed variation. The authors recommend building guaranteed-null baselines and replicating low-resource-language results across seeds.

Hugging Face daily papers·Sep 6, 20:00 UTC · 10d agoAI research

24

New IoT Malware Uses Public Linux Exploits to Gain Root and Launch DDoS Attacks

Nozomi details KATARU, an IoT botnet that brute-forces Telnet, exploits public Linux kernel flaws for root access, and launches multi-protocol DDoS attacks.

KATARU, discovered after honeypot Telnet brute-force activity from a Vietnamese IP, downloads an ARM payload (vlxx.arm) and attempts privilege escalation by editing /etc/passwd or exploiting CVE-2026-46300 (Fragnesia), CVE-2026-43284 (Dirty Frag), and CVE-2026-31431 (Copy Fail). It combines Mirai-style TCP, UDP, ICMP, HTTP, QUIC and DNS floods with application attacks against Minecraft, FiveM, OpenVPN and WireGuard. The malware uses X25519 and ChaCha20-Poly1305 encrypted C2, unusually broad persistence across systemd, cron, init frameworks, and Android hooks, plus anti-debugging and decoy traffic to hinder analysis. Implementers copied x86 shellcode into the ARM binary and reused an RFC 7748 test-vector key, indicating low-quality but rapidly evolving commodity development.

GBHackers·updated Sep 11, 14:17 UTC · 5d ago·first Sep 11, 09:07 UTC · 6d agoMalware in the wild 2 sourcesCVE-2026-46300CVE-2026-43284CVE-2026-31431

48

Tricky 'SynkLoader' Multitool May Herald Ransomware

Researchers detail SynkLoader, an advanced multilingual multitool that hijacks screens to steal passwords and may precede ransomware attacks.

Dark Reading reports analysis of SynkLoader, an advanced, multilingual malware family functioning as a multitool loader. The family revives an older technique — screen hijacking — to enable effective password theft, alongside several novel features. Analysts assess its activity may be a precursor to ransomware deployments, making early detection valuable for defenders.

Dark Reading·Aug 24, 15:02 UTC · 23d agoMalware

45

Abyssos: Technical Analysis of a New Modular RAT

Zscaler ThreatLabz analyzes Abyssos, a new modular C++ RAT offering credential theft, file exfiltration, and VNC-based remote access.

Zscaler ThreatLabz identified a new malware family tracked as Abyssos in late June 2026. Abyssos is a modular remote administration tool (RAT) written in C++ that supports credential theft, file exfiltration, and remote access via VNC. The malware is under active development, with multiple version numbers and obfuscation passes designed to evade security products. The analysis covers its core features, configuration, obfuscation, and network communication protocol.

Zscaler ThreatLabz·Aug 10, 15:51 UTC · Aug 10, 2026Malware

50

DeepZero: Open-source hunting for vulnerable Windows drivers

DeepZero, a new open-source engine, automates discovery of exploitable Windows kernel drivers for BYOVD attacks using Ghidra, Semgrep, and an LLM.

DeepZero is a free, open-source Python pipeline orchestrator that automates hunting for exploitable Windows kernel drivers relevant to BYOVD (bring your own vulnerable driver) attacks. Its seven-stage YAML pipeline parses PE headers, filters for kernel-mode drivers with IOCTL surfaces, excludes drivers listed on loldrivers.io, then runs headless Ghidra decompilation, Semgrep scanning, and an LLM-based exploitability assessment. The maintainer reports multiple verified vulnerabilities in the Snappy Driver Installer corpus, some still in the disclosure process, and notes findings involving plug-and-play-created device objects may need physical hardware to confirm.

Help Net Security·Sep 16, 05:30 UTC · 1d agoTools

45

TaichuAI/ZDTaichu5.0-9B — new model trending #30 on Hugging Face

TaichuAI released ZDTaichu5.0-9B, an open multimodal VLM built on Qwen3.5-9B targeting spatial reasoning, embodied AI, and agentic tool use.

TaichuAI released ZDTaichu5.0-9B, a multimodal vision-language model pairing a Qwen3.5-9B language decoder with a C-RADIOv4-H vision encoder, supporting text, single/multiple images, and video with any-resolution input and a 128K-token context. It introduces Entropy-Gated Adaptive Recurrent Reasoning, which allocates extra latent refinement steps to harder tokens. Reported benchmarks include 87.7 on TAU2-Bench, 71.4 on Claw-Eval, 93.7 on IFEval, 48 on ERQA, and 56 on RoboSpatial, leading compared 10B-scale open VLMs on agent and spatial tasks. The weights are available on Hugging Face, GitHub, and ModelScope, where it is trending at #30.

Hugging Face trending models·Sep 4, 02:55 UTC · 13d agoModel release1

48