ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “analytics”

101 stories in the last 30d

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllIndustry 25AI research 11AI industry 10Research 10Threat actor 9Policy & legal 7Malware 6Phishing & fraud 5AI safety & security 5Data breach 4Tools 4Vulnerability 3Model release 3Exploit / PoC 2
SeverityAllcritical 2high 7medium 21low 2info 76

Introducing AI Assistant for Akamai Web Security Analytics

Akamai launched an AI Assistant for Web Security Analytics, giving SOC and AppSec teams natural-language event investigation and guided response actions.

Akamai introduced an AI Assistant integrated with its Web Security Analytics offering, designed to let SOC and AppSec teams investigate security events faster. The assistant supports natural-language queries and guided action recommendations for analysts. The announcement is a vendor product launch with no incident details.

Akamai Blog · 5d agoTools

MasterControl Seventeen Every Time

Governed enterprise analytics study shows deterministic policy execution matched 110/110 answer-and-evidence contracts while runtime agent planning matched none.

The paper studies a governed approach where a language model interprets the question while deterministic policy selects and runs a pre-approved analytical program returning results and evidence. Across 440 runs, three 8B models generated SQL and selected tools at runtime, while Qwen3-8B only interpreted intent and policy executed the approved program. None of 330 runtime-planning episodes satisfied the full answer-and-evidence contract, whereas the policy-executed analyzer matched 110 of 110. The authors note this is configuration-specific and expressiveness is preserved via relational operations, aggregation, comparison, windows, ranking, and similarity with replayable results.

Hugging Face daily papers · 14d agoAI research

Implementation of Machine Learning Workflows with NVIDIA cuML, RAPIDS, GPU Benchmarking, Explainability, Clustering, and Model Inference

Hands-on tutorial implements NVIDIA cuML and RAPIDS to GPU-accelerate scikit-learn-style ML workflows with benchmarking, clustering, and inference.

The tutorial demonstrates NVIDIA cuML as a GPU-accelerated machine learning framework, using cuml.accel to speed up unmodified scikit-learn scripts with zero code changes and the native cuML API for CuPy/cuDF interoperability. It benchmarks CPU versus GPU implementations of PCA, K-Means, nearest-neighbor search, logistic regression, random forests, and DBSCAN on datasets up to 200,000 samples with 64 features. It also builds GPU pipelines with UMAP, t-SNE, and HDBSCAN, validates GPU-generated SHAP explanations, uses the FIL library for forest inference, and covers model serialization and GPU/CPU portability.

MarkTechPost · 3d agoAI tools & infra

Hierarchical NeRF with JAX3D for Volumetric Rendering, Novel-View Synthesis, and 3D Reconstruction

MarkTechPost tutorial implements a hierarchical NeRF in JAX using jax3d volume-rendering primitives for novel-view synthesis and 3D reconstruction.

The tutorial builds an end-to-end hierarchical Neural Radiance Field using JAX, Flax, Optax, and jax3d's volume-rendering functions (sample_along_rays, volume_rendering, sample_piecewise_constant_pdf). It implements positional encoding, skip connections, separate coarse and fine networks, and view-direction conditioning with hierarchical importance sampling. Training uses JAX JIT compilation, Adam optimization, exponential learning-rate decay, and gradient clipping. Evaluation covers PSNR, depth and opacity visualization, 360-degree rendering, and marching-cubes geometry extraction.

MarkTechPost · 2d agoAI research

BengalSEO Poisons Bing Search Results to Deliver MayaBot and Tech Support Scams

DFIR Report exposes BengalSEO, an India-based SEO-poisoning operation running since 2015, delivering MayaBot malware and tech support scams via Bing results.

The DFIR Report details BengalSEO, a financially motivated cluster operating from Rajasthan, India, since at least 2015, run through two IT service providers: WeConnect Solutions LLC and Garage2Global. The group uses black-hat SEO techniques—backlinks, DOM injection, DOM shuffling, keyword stuffing—to push lure pages to the top of Microsoft Bing results, routing victims through a traffic distribution system to either the custom MayaBot malware (which delivers an XMRig cryptominer and enables C2) or tech support scam call centers. A Vizio decoy page had 2,000 backlinks from 167 unique external domains, and Matomo analytics is used for victim fingerprinting, with the tracking domain appearing in 1,112 urlscan.io results.

The Hacker News · 7d agoThreat actor in the wild

Facilitating AI integration with simplicity at scale

Jabil's SAP IT director says simplifying integration across 100+ sites in 30+ countries with SAP Integration Suite created the data backbone for AI.

In an MIT Technology Review Business Lab podcast produced in partnership with SAP, Jabil SAP IT director Harish Manohar described consolidating fragmented tools across more than 100 sites in over 30 countries using SAP Integration Suite. The manufacturer, with 140,000-plus employees and more than 400 top-brand customers, says a standardized data backbone enables real-time supply chain visibility and is a prerequisite for scaling predictive, AI-driven planning and forecasting. The company frames simplification-first modernization as a competitive advantage tied to measurable business value and operational resilience.

MIT Technology Review · AI · 13d agoAI industry1

Cybersecurity jobs available right now: March 10, 2026

Help Net Security's roundup lists open cybersecurity roles at BioNTech, AIG, ServiceNow and others across Europe, the Middle East and Canada.

A job-board roundup of cybersecurity openings including Associate Director Application Security at BioNTech (Germany), CISO at AIG (Israel), Cloud Security Professional at ServiceNow (Italy), and SOC/GRC, analyst, engineer and data governance roles in the UK, UAE, India, Canada and France. Roles span application security, cloud security, SOC operations, compliance and OT environments. Most listings are marked no longer accepting applications.

Help Net Security · 18d agoIndustry

AI Infra Summit: NVIDIA Vera Rubin and DSX Platform Advancements Showcase Energy Efficiencies of Optimizing Tokens Per Watt for AI Factories

At AI Infra Summit, NVIDIA showcased Vera Rubin and DSX gains up to 1.4x tokens per megawatt, plus Annapurna, d-Matrix, and Pinterest partnerships.

Ian Buck's AI Infra Summit keynote before 8,000+ attendees emphasized validated agentic tokens per megawatt as the emerging AI infrastructure metric. Announcements include Amazon's Annapurna Labs collaborating on NVHBM custom high-bandwidth memory, d-Matrix integrating NVLink Fusion with Raptor XPUs, and Pinterest using Blackwell plus Dynamo inference software for conversational visual discovery. Lambda reported 23% better performance per watt with DSX MaxLPS on Blackwell servers, running 19 nodes on a 16-node power budget. NVIDIA says DSX MaxLPS combined with Groq 3 LPX on Vera Rubin NVL72 targets up to 35X token throughput per megawatt versus GB200 NVL72 for 2-trillion-plus-parameter models.

NVIDIA Blog · 14h agoAI industry

Unmasking Cloud Identities: From Behavioral Clustering to Automated Detection

Unit 42 clusters behavior of 40,000+ AWS identities from 125 cloud environments to map functional roles and enable lightweight SQL-based detection.

Palo Alto Unit 42 built an unsupervised behavioral clustering model using UMAP and HDBSCAN on AWS CloudTrail logs to map cloud identities to functional roles such as administrators, backup services, security tooling and DevOps. The study analyzed over 40,000 identities across 125 cloud environments over two months. The researchers show that heuristics extracted from the clustering map can be implemented in standard SQL, enabling role classification at scale without running a continuous ML pipeline. The methodology extends to audit logs from other cloud providers, SaaS and Kubernetes.

Palo Alto Unit 42 · 1d agoResearch

The 12 Best Unified Endpoint Management (UEM) Solutions, Compared and Priced

A buyer's guide compares 12 unified endpoint management platforms, recommending Microsoft Intune, Jamf and Omnissa for common scenarios.

The article compares 12 UEM solutions including Microsoft Intune, Omnissa Workspace ONE, Jamf, ManageEngine, Ivanti, SOTI and 42Gears, with pricing models and platform coverage. It flags ownership changes such as Workspace ONE becoming Omnissa, BlackBerry divesting Cylance to Arctic Wolf, and Citrix's status under Cloud Software Group. Guidance centers on checking existing Microsoft 365 licensing before purchasing, per-user versus per-device pricing, and combining platforms like Intune and Jamf for Apple estates.

GBHackersupdated · 5d agofirst · 5d agoIndustry 4 sources

The Intelligible World of Agents

Recorded Future argues cybersecurity AI agents perform better when reasoning over structured, curated intelligence graphs rather than fragmented alerts or open-source noise.

In a vendor essay, Recorded Future describes how its security agents produced more authoritative analyses after being re-architected to reason primarily over the Recorded Future Intelligence Graph instead of weighting open-source information equally. The author argues agentic decision quality depends mainly on a structured, current operational world model of assets, vulnerabilities, threat actors, detections and organizational context, not on model intelligence itself. The piece further claims frontier model access is commoditizing and that orchestration tooling will converge, making trusted representations of organizational knowledge the durable competitive differentiator.

Recorded Future · 6d agoAI safety & security

Why 2026 is the Year to Upgrade to an Agentic AI SOC

Elastic Security Labs argues 2026 is the production inflection point for agentic AI in security operations centers.

Elastic Security Labs argues 2026 is the practical inflection point for agentic AI SOCs, noting nearly two-thirds of organizations are experimenting with AI agents while fewer than one in four have production deployments. The piece outlines operational challenges and recommendations: treat agents as non-human identities with least-privilege tool access, version-control system prompts as code, deploy unified agents with on-demand task packages, and enforce per-agent budgets and rate limits. It stresses explainability via RAG and transparent reasoning traces so analysts can verify and override autonomous decisions.

Elastic Security Labs · 7d agoIndustry

August 2026 CVE Landscape

Insikt Group catalogs 73 high-impact August 2026 CVEs (43 Very Critical), including PaperCut, Zimbra, and Metabase flaws actively exploited or weaponized.

Recorded Future's Insikt Group identified 73 high-impact vulnerabilities in August 2026, 43 rated Very Critical, spanning 45 vendors with Microsoft accounting for roughly 11%. 31 vulnerabilities surfaced via CISA's KEV catalog, with others validated via open sources, vendor telemetry, and honeypot data. New Nuclei detection templates were released for CVE-2025-62593 (Ray), CVE-2026-72898 (Metabase), and CVE-2026-9198 (IBM Langflow). The report also highlights two AI-assisted operations: UAT-10147 exploited Zimbra, AjaxPro, Nacos, and Telerik servers before using DeepAudit and PentestGPT post-compromise, while a separate Chinese-speaking actor weaponized Hermes Agent and DeepSeek in a failed attempt.

Recorded Future · 8d agoVulnerability in the wildCVE-2025-62593CVE-2026-72898CVE-2026-9198+4 CVEs

Data access: the hidden cost of security vendor lock-in

Elastic compares SIEM data egress cost, latency, and fidelity across CrowdStrike, Microsoft, Google, and Splunk, arguing vendors engineer lock-in.

Elastic Security Labs published an opinion piece comparing how major SIEM and security vendors handle data egress, based on each vendor's public documentation as of September 2026. It rates CrowdStrike Falcon Data Replicator and Palo Alto Networks XSIAM Event Forwarding as restricted (paid add-ons with batch delays), Microsoft as partially open, Splunk as open, and Elastic as open with no export license. The piece argues frictionless ingestion paired with licensed or delayed egress is an intentional lock-in business model, and cites CrowdStrike's 2026 Global Threat Report eCrime breakout time of 29 minutes to argue real-time telemetry access is now essential.

Elastic Security Labs · 12d agoIndustry

FrostyGoop’s Zoom-In: A Closer Look into the Malware Artifacts, Behaviors and Network Communications

Unit 42 dissects FrostyGoop OT malware, which sent Modbus TCP commands to disrupt heating for 600+ apartment buildings in Ukraine.

Palo Alto Unit 42 analyzed new FrostyGoop/BUSTLEBERM samples, the ninth known ICS-centric malware, first used against a Ukrainian municipal energy company by sending Modbus TCP commands to ENCO control devices. The attack caused a two-day heating outage affecting over 600 apartment buildings during sub-zero temperatures. The Go-compiled malware accepts Modbus register operations and timing parameters via command-line arguments or a JSON configuration file, uses an obscure open-source Modbus library, and checks the Windows BeingDebugged flag to evade debuggers. Unit 42 telemetry recorded over 1 million Modbus TCP devices exposed to the internet between September and October 2024.

Palo Alto Unit 42 · 27d agoMalware in the wild

Multiple Vulnerabilities Discovered in a SCADA System

Unit 42 details five vulnerabilities (CVSS 7.0-7.8) in ICONICS Suite SCADA software enabling privilege escalation and DoS.

Unit 42 discovered five vulnerabilities (CVE-2024-1182, CVE-2024-7587, CVE-2024-8299, CVE-2024-8300, CVE-2024-9852) in ICONICS Suite versions 10.97.2 and earlier for Windows during a 2024 security assessment. The flaws, rated CVSS 7.0-7.8, allow DLL hijacking, privilege escalation, information disclosure, denial-of-service and potentially full system compromise. ICONICS Suite is a SCADA solution with hundreds of thousands of installations in over 100 countries, widely used in critical infrastructure, and several dozen servers are internet-exposed per Unit 42 telemetry. ICONICS released patches and advisories with workarounds in 2024.

Palo Alto Unit 42 · 27d agoVulnerabilityCVE-2024-1182CVE-2024-7587CVE-2024-8299+2 CVEs1

Unit 42 Researchers Discover Multiple Espionage Operations Targeting Southeast Asian Government

Unit 42 attributes three espionage clusters targeting a Southeast Asian government to Stately Taurus, Alloy Taurus, and Gelsemium APTs.

Unit 42 investigated espionage attacks starting in late 2022 against multiple governmental entities in a Southeast Asian country, including critical infrastructure, public healthcare, financial administrators, and ministries. Analysis revealed three distinct clusters: CL-STA-0044 attributed to Stately Taurus (Mustang Panda), CL-STA-0045 to Alloy Taurus (GALLIUM), and CL-STA-0046 to Gelsemium. The first cluster used a ToneShell backdoor variant, ShadowPad, China Chopper web shells, Impacket, and credential dumping tools across roughly Q1 2021 to Q3 2023. All three operated with distinct tools, infrastructure, and long-term surveillance tradecraft consistent with APTs.

Palo Alto Unit 42 · 29d agoThreat actor in the wild

Oracle September 2026 Critical Security Patch Update addresses 672 CVEs

Oracle's September 2026 CSPU fixes 672 CVEs across 673 patches, including 104 critical updates, with E-Business Suite receiving the most patches (159).

Oracle released its September 2026 Critical Security Patch Update fixing 672 unique CVEs via 673 security updates across 17 product families, with 104 patches (15.5%) rated critical and 503 rated high. Oracle E-Business Suite received the most patches at 159 (23.6%), followed by Fusion Middleware at 153, of which 78 are remotely exploitable without authentication. The CSPU is a monthly release cycle Oracle introduced in May 2026 between larger quarterly CPUs. Tenable will publish plugins to identify affected systems.

Tenable Blog · 10h agoVulnerability

What’s next for CISA’s CDM program that gives cybersecurity tools to federal agencies

CISA officials outline future plans for the CDM program, emphasizing speed, automation, unified data, and data-driven federal risk management.

Speaking at an Elastic Federal Cyber Defense Breakfast, CISA officials described next steps for the Continuous Diagnostics and Mitigation (CDM) program that supplies cybersecurity tools to federal agencies. Acting deputy program manager Richard Grabowski named velocity, unification, and data-driven risk management as core goals, including a three-year roadmap to expand SIEM-as-a-Service. Federal CISO Mike Duffy urged aggregating demand across agencies, buying outcomes rather than products, and designing acquisition for continuous improvement. CISA's Matt House tied the program's evolution to post-SolarWinds needs for a government-wide common operating picture.

CyberScoop · 11h agoPolicy & legal

Verifiable Social Reasoning for LLM Assistants

Fuse, a multi-agent simulation with hidden motives, evaluates LLM social reasoning, revealing compounding difficulty from user mediation and bias sensitivity.

Fuse is a multi-agent simulation framework in which a target agent with a hidden motive interacts with other agents including one representing the user, who consults the evaluated assistant to infer the motive, providing verifiable ground truth by construction. Simulation faithfulness is validated through a human study with 24k annotations. Applied to 12 LLMs, it shows user mediation compounds social reasoning difficulty, models are systematically sensitive to biased user framing, models may need more details than humans, and longer conversations do not always improve performance. The framework and a 21k-example dataset are open-sourced.

arXiv cs.AI / cs.LG / cs.CL · 14h agoAI research

Meta expands subscription push with new AI-focused plans

Meta launched Meta One subscriptions ($7.99–$499/month) bundling expanded Muse AI image and video generation across Facebook, Instagram, and WhatsApp.

Meta introduced Meta One with consumer Core ($7.99/mo) and Premium ($19.99/mo) tiers plus business plans ranging from Essential ($14.99/mo) to Max ($499/mo). Subscriptions unlock expanded Muse Image, Muse Video, Restyle editing, and Meta Business Agent usage, following Meta's $14.3B investment in Scale AI. Appfigures data shows Instagram's daily subscription revenue averaging $1.2M and Facebook's $528K after the March Plus-tier launches, up 475% and 143% respectively. BNP Paribas forecasts $13.5B added revenue by 2028; Truist estimates $20B by 2030.

TechCrunch · AI · 14h agoAI industry

AEO startup Profound hits unicorn valuation, raises $180M Series D 7 months after last round

AEO startup Profound raised a $180M Series D at a $1.8B valuation led by Sequoia and Kleiner Perkins.

Profound, which builds marketing software to help brands appear in AI search results, raised a $180 million Series D at a $1.8 billion valuation, seven months after its $96 million Series C. Sequoia and Kleiner Perkins led the round, with Lightspeed Venture Partners, Khosla Ventures, and South Park Commons participating. The company reports 3x revenue growth in six months and over 1,000 enterprise customers including Comcast, The Estée Lauder Companies, and Walmart. It operates in the generative engine optimization (GEO) and answer engine optimization (AEO) space.

TechCrunch · AI · 16h agoAI industry

Introducing Meta One: A Subscription Service With More Features and AI to Create, Connect, and Stand Out

Meta launches global Meta One subscriptions bundling Instagram, Facebook, WhatsApp Plus with expanded Meta AI and Muse media generation, priced $2.99-$499 monthly.

Meta introduced Meta One, a global subscription service with plans for individuals, creators, and businesses, launching with more than 50 features across Instagram, Facebook, WhatsApp, and Meta AI. Individual bundles Core ($7.99/month) and Premium ($19.99/month) combine the single-product Plus plans with expanded use of compute-intensive AI capabilities, including image/video generation powered by Muse models and Instagram's Restyle. Business tiers range from Essential ($14.99/month) to Expert ($149/month) and Max ($499/month), with expansion planned to Edits, AI glasses, and more.

Meta Newsroom · 16h agoAI industry

Meta’s new One subscriptions put a price on social media and AI

Meta's new One subscription tiers pair app perks with more Meta AI usage, from $2.99 single apps to $499 monthly business Max plan.

The Verge reports Meta's Meta One subscription bundles are now globally available, following the launch of its Muse AI assistant. Individual bundles include Core at $7.99/month and Premium at $19.99/month, combining Instagram Plus, WhatsApp Plus, and Facebook Plus with expanded Meta AI media generation including Muse images and Instagram's Restyle, cheaper than $11/month for all three standalone subscriptions. Creator and business plans span Essential ($14.99/month) to Expert ($149/month) and Max ($499/month), adding verification badges, impersonation protection, and Meta Business Agent capacity.

The Verge · AI · 16h agoAI industry

Security Data Isn’t the Problem. Security Context Is.

Horizon3 blog argues security context, not data volume, is the SOC bottleneck, promoting its NodeZero integration with CrowdStrike Falcon Next-Gen SIEM.

Horizon3.ai published a vendor blog explaining how its NodeZero Proactive Security Platform integration with CrowdStrike Falcon Next-Gen SIEM brings validated exposure findings into existing security operations workflows. The post argues SOCs are now limited by confidence rather than visibility, needing context to decide which issues matter. It cites a global chemical manufacturer that validated exploitable exposures with NodeZero before completing a $2 billion merger.

Horizon3.ai · 18h agoTools

Give every teammate and agent the right level of access to your Workers

Cloudflare launches per-Worker granular access controls with four roles, enabling least-privilege access for teammates, AI agents, and CI/CD pipelines.

Cloudflare announced granular authorization for Workers, letting admins scope access to a single Worker instead of the whole account. Four new roles are available: Metadata Read-Only (observability without source code), Content Read-Only (read code without changes), Editor (deploy without delete), and Admin (full control of one Worker). Roles apply at Developer Platform, product, or resource level, can be attached to dashboard users or API tokens, and are available to all customers now, with plans to extend to D1, R2, and KV.

Cloudflare Blog · 18h agoTools

Search results are sending people to fake Bitrefill checkouts

Scam sites impersonating Bitrefill's crypto checkout appear in search results, tricking victims into sending up to $1,990 in crypto directly to scammers.

Malwarebytes documents a cluster of lookalike domains copying Bitrefill's gift card checkout, surfaced via search engine results rather than email. Victims choose an amount up to $1,990 and pay in Bitcoin, Ethereum, USDC, USDT, Solana, or Litecoin to scammer-controlled addresses, with no recourse since crypto payments are irreversible. Domains use typosquatting and Punycode/IDN homoglyph tricks, and the fake sites run commercial analytics software to measure and optimize victim conversion. Bitrefill's security team is working with takedown specialists to remove the sites.

Malwarebytes Labs · 23h agoPhishing & fraud

12 Best CNAPP Platforms Compared (2026): Features & Pricing

Independent comparison of 12 CNAPP platforms finds identical estates draw quotes 2-3x apart; Microsoft Defender for Cloud is the only fully published per-resource option.

A vendor-independent buyer's guide compares twelve CNAPP platforms including Prisma Cloud, CrowdStrike Falcon Cloud Security, Wiz, Uptycs, Aqua, Zscaler, and Microsoft Defender for Cloud on pricing mechanics, procurement leverage, and capability-per-dollar. It finds quotes swing 2-3x on identical estates because vendors define 'workload' differently. Microsoft Defender for Cloud is highlighted as the only major with fully published per-resource rates.

GBHackers · 1d agoIndustry1

Implementing a White-Box Undetectable Backdoor for Random Fourier Features

Researchers implement Goldwasser's CLWE-based undetectable backdoor for Random Fourier Features models in numpy/scipy, confirming practical realizability with no detectable differences from clean models.

The paper provides an end-to-end implementation of the Goldwasser et al. white-box undetectable backdoor for models trained with the Random Fourier Features algorithm, using only numpy and scipy. It derives two samplers for the core GP_d(b_k) distribution: a rejection-sampling proxy and an exact closed-form sampler verified against its analytic form. Statistical indistinguishability tests covering weight-space and functional black-box comparisons found no detectable difference between backdoored and clean models across sparsity ratios. The underlying lattice hardness reduction was not reproduced, and the work demonstrates the threat is realizable with commodity scientific-computing tools rather than specialized cryptographic infrastructure.

arXiv cs.CR · 1d agoResearch

Only at TechCrunch Disrupt 2026: What happens when OpenAI ships your roadmap?

TechCrunch Disrupt 2026 panel will discuss AI startup defensibility when OpenAI, Anthropic, or Google ship features startups built.

TechCrunch promotes a Builders Stage session at Disrupt 2026 (October 13-15, Moscone West, San Francisco) titled 'What Happens When OpenAI Ships Your Roadmap.' Speakers include Airbyte CEO Michel Tricot, Radical Ventures partner Rob Toews, and Webflow CEO Linda Tong. The session examines how founders differentiate when foundation model providers absorb startup capabilities, emphasizing proprietary data, embedded workflows, customer relationships, and trust as remaining moats.

TechCrunch · AI · 1d agoAI industry

Hackers Leverage Claude to Exfiltrate Secrets from 1.8M Android apps

ShinyHunters-linked operators used Claude to scan 1.8M Android apps for hardcoded secrets, fueling intrusions across 40+ tenants.

Anthropic's September 2026 threat intelligence report describes a French-speaking operator (aliases MeowSHA, frkoo, blazespider) tied to ShinyHunters who ran 10 AWS EC2 workers and used Claude to decompile and scan 1.8 million Android APKs for hardcoded secrets with TruffleHog. Verified credentials were sorted into 100+ Telegram channels and paired with GitHub PAT harvesting, providing initial access for confirmed intrusions. In one supply-chain incident the actors extracted data from roughly 200 downstream customer organizations and dumped 2,100+ Azure AD token sets across 40+ corporate tenants in about 34 hours using AI agents. Anthropic banned tied accounts and stressed its own systems were not compromised.

Cyber Security News · 1d agoThreat actor1

Weekly Cybersecurity Newsletter Bulletin – Microsoft 0-day, FortiOS, PAN-OS Flaw, Revolut Data Breach, and 20+ Stories

Weekly roundup: Microsoft patches 973 flaws including two actively exploited zero-days; FortiOS CAPWAP flaw deploys PivotC2 RAT; PAN-OS root RCE disclosed.

Microsoft's September 2026 Patch Tuesday fixed 973 vulnerabilities, including two zero-days under active exploitation: CVE-2026-85880 (Windows ALPC) and CVE-2026-81963 (Windows Update Stack), both elevation-of-privilege bugs. SOCRadar reported active exploitation of CVE-2025-25249 (CVSS 9.8) in FortiOS CAPWAP, deploying a Node.js RAT called PivotC2 that exfiltrates Exchange mailboxes to Wasabi cloud storage; 178 devices were compromised out of 30,000 scanned IPs, attributed to a Russian-speaking financially motivated group. Palo Alto disclosed CVE-2026-0310, a 9.2-rated buffer overflow enabling root code execution on PA-Series firewalls, and Fortinet disclosed CVE-2026-84393, a ZTNA certificate validation MITM flaw. Cyera also revealed CVE-2026-6471 ('PostGREShell'), a 12-year-old PostgreSQL logical-decoding flaw allowing code execution via REPLICATION-privileged accounts.

Cyber Security News · 2d agoExploit / PoC in the wildCVE-2026-85880CVE-2026-81963CVE-2025-25249+3 CVEs2

Real-SWE: Benchmarking AI models on private, real-world, enterprise codebases

Real-SWE benchmark tests coding agents on licensed private enterprise codebases; top model Fable 5.1 resolves only 38.8% of tasks.

Real-SWE is a new benchmark evaluating frontier AI coding agents on tasks drawn from private production codebases licensed from real companies, spanning billing, tax calculation, and cross-service migrations. Fable 5.1 with Claude Code leads at 38.8% resolution rate (pass@1 over eight runs), followed by GPT-6 Astra Codex CLI at 33.8% and Gemini 3.8 Flash Gemini CLI at 31.2%. Tasks use native harnesses and realistic tooling including Docker, Kubernetes, PostgreSQL, Redis, and Linear; median reference solutions edit 11 files versus 6 for DeepSWE and FrontierCode.

Hacker News · AI · 3d agoAI researchHN 45↑ · 31 comments

[AINews] DeepSeek v4.1-Flash: 763B-P8B-D16B novel causal Encoder–Decoder architecture with vision marks the Return of the Whale

DeepSeek released V4.1-Flash, an open-weight 763B-parameter model with a novel causal encoder-decoder architecture, 1M context, vision input, and MIT license.

DeepSeek launched V4.1-Flash, an open-weight MIT-licensed model using a novel causal encoder-decoder architecture with 763B total parameters and asymmetric active parameters: 8B for prefill and 16B for decode. It supports 1M-token context and text+image input, priced at $0.30 per 1M input and $1.20 per 1M output tokens with a 50% off-peak discount. Artificial Analysis scored it 40 on its Intelligence Index, above DeepSeek V4 Pro 0813, and Vals ranked it the #1 open-weight model ahead of Kimi K3. Baseten shipped day-0 support and Ollama began rolling it out to paid subscribers.

Latent Space · 4d agoModel release1

Rethinking Heterogeneous System Disaggregation for Subquadratic Attention

SQD disaggregates LLM inference by quadratic versus subquadratic attention layers, improving energy efficiency up to 56% on heterogeneous systems versus GPU-only baselines.

SQD (SubQuadratic Disaggregation) splits decode not by operator type but by quadratic versus subquadratic attention, matching their distinct arithmetic intensity and memory footprints. For sparse attention LLMs it separates top-k selection (requiring full KV indexing) from top-k attention plus FFN; for linear and sliding-window models it separates dense attention layers from subquadratic layers plus FFN. On an adjusted 8xB200 heterogeneous proxy, tokens-per-joule improves 53% on GLM 5.2, 31% on Nemotron 3 Ultra, and 56% on Gemma 4 31B. A Rubin plus LPX analytical model shows 1.2x-1.5x tighter achievable latencies and up to 3.6x higher throughput versus attention-FFN disaggregation.

arXiv cs.AI / cs.LG / cs.CL · 4d agoAI research

ASTRIL-MPC: Autonomous Traversal Framework of Articulated Tracked Robots with Language-Guided Neural-Kinematic MPC

ASTRIL-MPC combines learned kinematics, NMPC, and LLM-guided safety-checked retuning for articulated tracked robot traversal in search-and-rescue.

ASTRIL-MPC is a language-guided neural-kinematic model predictive control framework for autonomous traversal of articulated tracked robots in urban search and rescue. A learned kinematics model predicts short-horizon task-state increments, NMPC plans with feasibility constraints, and an LLM proposes bounded, safety-checked updates to weights and bounds. The compiled predictor enables a full control cycle within 100 ms, improving traversal-quality scores by up to 71% over non-adaptive NMPC and 67% over a PPO baseline while eliminating measurable collision impacts.

arXiv cs.AI / cs.LG / cs.CL · 4d agoAI research

Rapidly scaling online storage to serve over 1 billion ChatGPT users

OpenAI's Habitat online storage platform now handles over 70 million requests per second and 500 PB of data for 1 billion users.

OpenAI details the evolution of Habitat, its online storage platform backing ChatGPT and other products, which began in mid-2024 as a Python client-side library over Azure Cosmos DB. Habitat now processes more than 70 million requests per second, serves over 500 petabytes of data across nearly 40 geographic regions, and supports over 1 billion users weekly. By mid-2025 the client library approach became brittle, so OpenAI moved Habitat into a standalone service to centralize deployments, observability, and multi-tenancy reliability. This is part one of a two-part series; a future post will cover read optimization and scaling the Azure Cosmos DB partnership.

OpenAI News · 4d agoAI tools & infra1

Top 10 Best Cloud Workload Protection (CWPP) Solutions in 2026

Editorial scorecard ranks 2026 cloud workload protection platforms, placing Prisma Cloud first, Sysdig second, and CrowdStrike third on detection quality.

A research-based scorecard rates ten cloud workload protection (CWPP) platforms across runtime depth, container/Kubernetes support, coverage breadth, cloud context, and value. Palo Alto Prisma Cloud leads at 8.9, followed by Sysdig at 8.8 and CrowdStrike at 8.6, with Aqua Security tying CrowdStrike at 8.6. The piece argues agent-versus-agentless is a false choice, with leaders now pairing agentless visibility with eBPF-based runtime sensors. Scores are editorial assessments, not lab benchmarks.

Cyber Security News · 5d agoIndustry1

I Am No One: Style-Aware Paraphrasing for Text Anonymization

Prompt-driven style-aware paraphrasing with LLMs cuts authorship attribution F1 by 60-70% while preserving content quality.

The paper proposes a style-aware, prompt-driven anonymization approach using pretrained LLMs to build compact stylistic profiles from minimal samples and rewrite text to suppress identifiable style markers while preserving meaning. It addresses stylometric re-identification risks in anonymized text, including ASR transcripts of meetings and call-center calls where leakage persists after acoustic anonymization. Across blog and review datasets, the approach reduces authorship attribution F1 by 60-70%, substantially outperforming both DP-based and non-DP baselines while maintaining readability.

arXiv cs.CR · 5d agoResearch

ThreatsDay: 200 Android Flaws, Browser-Built Phishing, 119K Scam Shops + 23 More Stories

Hacker News ThreatsDay digest: malicious browser extensions, AI-agent intrusions, NCSC shadow AI warning, M&A wire fraud, and 119,000-domain fake shops.

Socket found four malicious Chrome and Firefox extensions (J7Tracker, VREO, Orbit Tracker) stealing session tokens and wallet data from Axiom Trade and Padre users via attacker-controlled Vercel deployments. Hunt.io reported a Chinese-speaking operator using Claude Code, Alibaba Qwen, and DeepSeek with the SecFlow orchestration framework to automate intrusions against government and financial targets in Afghanistan, Thailand, Taiwan, and the US. The UK NCSC warned shadow AI use risks breaches and regulatory failure, Microsoft announced privacy-preserving Windows Age APIs, and Gen Digital described fake M&A wire-fraud scams. A 119,000-domain fake-shop operation called DoppelCart was also highlighted.

The Hacker News · 5d agoIndustry in the wild