ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “Bitglass”

27 stories

Searchkeywordsmart
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllData breach 20Industry 20Policy & legal 9Ransomware 8Malware 6Vulnerability 4Threat actor 2Phishing & fraud 1Exploit / PoC 1AI industry 1Tools 1
SeverityAllcritical 21high 21medium 7low 21info 3

Smart search ranks by meaning as well as keywords (one row per story, last 45 days).

YuE2 · Frontier Music with Symbolic Planning

YuE2, a 3.59B-parameter music generation model, scores 6.9632 on SongBench, beating Suno v5 via symbolic planning.

YuE2 is a music generation model of roughly 3.59B parameters and 28 layers supporting song creation, covering, and agentic editing through editable ABC symbolic scores. Its best-of-8 setting reaches 6.9632 on SongBench, the highest mean among 15 evaluated settings on WildSongBench (192 prompts), ahead of Suno v5 at 6.8721. The project also introduces MERT2, whose 632M-parameter encoders achieve state of the art on 14 of 15 MARBLE metrics, and SheetSage2, which transcribes beats, downbeats, key, chords, structure, and melody with SOTA on 10 of 13 benchmark metrics.

Hacker News · AIupdated · 4d agofirst · 5d agoModel release 7 sourcesHN 43↑ · 35 comments

Indonesia Hit by Android Banking App-Cloning Campaign

GoldFactory exploits Android Work Profile to deliver the Gigabud banking trojan to Indonesian users via cloned banking apps, with Mantax and Otax spreading separately.

The GoldFactory threat group is running an app-cloning campaign against Android banking customers in Indonesia, abusing the Android Work Profile feature to deliver its Gigabud trojan. The Mantax and Otax malware families are spreading through separate distribution channels. Abusing Work Profile to install or conceal cloned banking apps is a notable mobile technique, though the article reports no victim counts or loss figures.

Dark Readingupdated · 5d agofirst · 5d agoThreat actor in the wild 4 sources

New AI Attack Hides Malicious Instructions in Normal-Looking Text to Evade Safety Filters

Check Point researchers show crafted prose hides policy-violating instructions that bypass all tested LLM gatekeepers, including GPT-4o mini and Llama Guard 3.

A new prompt-crafting technique embeds malicious payloads inside grammatical, natural-looking text without Base64, invisible Unicode, or obvious encodings, defeating lightweight pre-screening gatekeepers. In testing, all four evaluated gatekeeper models—gpt-4o-mini-2024-07-18, gpt-oss-safeguard:20b, claude-3-haiku-20240307, and llama-guard3:8b—classified the crafted wrappers as safe at a 100% bypass rate across 23 obfuscated prompts. GPT-5 Thinking in high-reasoning mode recovered and acted on the hidden instruction in 17 of 18 tests (~94.4%), often spending over a minute and multiple Python executions. Researchers recommend paraphrasing untrusted input, hardening gatekeeper policies, and applying defense-in-depth controls for agentic deployments.

GBHackers · 5d agoAI safety & security 2 sources

12 Best CASB Solutions Compared (2026): Features & Pricing

GBHackers' 2026 buyer's guide compares 12 CASB-capable vendors, arguing standalone CASB pricing has dissolved into per-user SSE subscriptions.

The article evaluates twelve CASB-capable platforms including Microsoft Defender for Cloud Apps, Palo Alto Networks' Prisma Access CASB, Netskope, iboss, Forcepoint ONE (Bitglass), Trend Micro Cloud App Security, and Skyhigh Security. It frames purchasing around SSE bundle economics, noting Defender for Cloud Apps ships inside Microsoft 365 E5 while Netskope, Zscaler, and Skyhigh price CASB into per-user SSE tiers. It also flags Saviynt, common on legacy roundups, as an IGA vendor rather than a true CASB.

GBHackersupdated · 4h agofirst · 6h agoIndustry 13 sources

Top 10 Best Cloud Access Security Broker (CASB) Solutions in 2026

2026 CASB guide ranks Netskope first for depth and Microsoft Defender for Cloud Apps for Microsoft estates, as standalone CASB fades into SSE.

Buyer's guide covers ten CASB products across four enforcement modes: API, forward proxy, reverse proxy and log-based discovery. Netskope leads on SaaS activity context depth, while Microsoft Defender for Cloud Apps wins on Microsoft 365 E5 estate economics. The guide argues standalone CASB purchases have largely disappeared into SSE platforms and increasingly overlap with SSPM.

Cyber Security News · 1d agoTools

Edge0/Edge0-35B-A3B-preview — new model trending #30 on Hugging Face

Edge0 released a 35B sparse MoE model running in under 3 GiB of memory at 15 tok/s via SSD expert offload and int4 quantization.

Edge0-35b-a3b-preview is a 35B-parameter MoE (256 experts, 4 active per token) built on Qwen3.5-MoE 35B-A3B, shipped as a 4-bit checkpoint with LoRA and prerouter adapters under Apache 2.0. The edge0 framework streams expert weights from SSD on demand, bounding peak active memory at 2.9 GiB and achieving 14.9-17.7 tok/s decode on a Mac mini M4 Pro (MLX backend). Recover-LoRA distillation keeps the int4 model within 3.9 points of its fp16 base (79.2 vs 83.2 average on OpenCompass benchmarks including AIME 2026, HumanEval, GPQA-Diamond, MMLU-Pro, and IFBench).

Hugging Face trending models · 8d agoModel release

Lightweight Vision Transformer Compression for On-Device Plant Disease Detection in Resource-Constrained Agricultural Field Conditions

A unified ViT compression pipeline (H-BAC pruning, quantization, distillation) cuts plant-disease models 54.5x to 6.01 MB while keeping 95.13% accuracy.

Researchers combined Hessian-Balanced Adaptive Block Pruning (H-BAC), guided by second-order sensitivity estimation, with quantization and attention-based knowledge distillation to compress Vision Transformers for on-device chilli plant disease detection in India. On a 3-class cross-village, cross-device out-of-distribution dataset, the integrated pipeline reduced model size from 327.42 MB to 6.01 MB (54.5x) at 95.13 +/- 2.32% accuracy, matching the 95.13% FP32 baseline. Ablations also show a directly trained 6.01 MB INT8 student reaches 94.87% accuracy, indicating where pruning and distillation add limited value.

arXiv cs.AI / cs.LG / cs.CL · 11d agoAI research

OpenAI buys smartphone camera maker Glass Imaging for $300 million, report says

OpenAI acquired smartphone camera startup Glass Imaging for over $300 million, deepening rumored hardware ambitions after its $6.5 billion io deal.

OpenAI bought Glass Imaging, a Los Altos startup founded in 2019 by former Apple engineers Ziv Attar and Tom Bishop who led Apple's Portrait Mode team, per a Wall Street Journal report. Glass Imaging had raised about $30 million and uses neural networks that learn individual camera systems to improve image quality at capture time. The acquisition fuels speculation about OpenAI hardware plans including smartphones, earbuds, and AI companion devices, following its $6.5 billion purchase of Jony Ive's io startup in 2025.

TechCrunch · AI · 1d agoAI industry

What It Took to Reach 1 Billion Build Manifests

Chainguard doubled container build manifests to over 1 billion in six months, powered by Factory 2.0's agentic self-correcting rebuild system.

Chainguard reports growing from 500 million to over 1 billion container build manifests in six months, across more than 3,000 unique images and 675,000 image versions. Its Factory 2.0 system, built on the purpose-built Chainguard OS, uses an agentic reconciliation engine called DriftlessAF to decide when to rebuild across thousands of interdependent projects without human intervention. All artifacts ship with SLSA Level 3 provenance, Sigstore signatures, and full SBOMs.

The Hacker News · 8d agoIndustry

Researchers Show How Meta's 'Pervert Glasses' Are Used to Harass Women

University of Sydney researchers detail how pickup artists use Meta Ray-Ban smart glasses to covertly film and harass women, then post the videos on Instagram.

Researchers Joanne Gray, Milica Stilinovic, Marcus Carter, and Ben Egliston analyzed 350 Instagram videos posted between September 2023 and March 2026 showing unsolicited approaches to women filmed with smart glasses. They found a clear correlation between covert filming and harassment severity, arguing ambient capture creates 'borderline' harassment that evades platform moderation mechanisms. Instagram head Adam Mosseri said the platform would remove harassing pickup-line content, though similar videos remain widespread a month later. Meta's safeguards, such as the recording light, were previously criticized as insufficient, and users have modded glasses to disable the light.

404 Media · Aug 12, 2026AI safety & security

GoldFactory Weaponizes Open-Source Vwork App Cloner in Gigabud Banking Malware Attacks

Group-IB says GoldFactory's Gigabud Android trojan uses Vwork, a weaponized Shelter fork, to clone banking apps into isolated Work Profiles and evade bank-side detection.

Group-IB's 'Hook for Gold' investigation found GoldFactory ships Vwork, a modified fork of the open-source Shelter app, alongside its Gigabud Android banking trojan, active since 2022. Vwork abuses Android Work Profile provisioning to clone banking apps into an isolated environment, weakening the link between detected malware signals and fraudulent transactions. Gigabud has targeted victims in Southeast Asia, Latin America, the Middle East, Africa, and beyond via fake airline, tax, and government apps requesting Accessibility and overlay permissions. In Indonesia, telemetry recorded about 1,469 compromised devices and roughly $960,939 in estimated losses between February and July 2026.

GBHackers · 7d agoMalware in the wild

Kaininja: Extending Native 3D Generators to the Part Level

KaiNinja extends TRELLIS.2 native 3D generation to part-level assets via a dual-volume O-Voxel representation, cutting whole-object Chamfer distance by 40%.

KaiNinja extends the TRELLIS.2 native 3D generator to produce part-level assets instead of one fused mesh, enabling downstream editing, rigging, and simulation. A dual-volume form of the O-Voxel representation solves the problem that a single volume cannot represent interfaces where two parts touch. The model needs no segmentation network, is partly trained on LLM-agent-authored part data, lowers whole-object Chamfer distance by 40%, and raises strict part F-score by 16% versus other part-generation pipelines.

Hugging Face daily papers · 2d agoAI research

Quantization-Aware Healing: a compressed, 4-bit model that outperforms its full-precision original

Multiverse Computing details quantization-aware healing, producing a 4-bit compressed model that reportedly outperforms its full-precision original.

A Hugging Face blog post by Multiverse Computing's CAI team introduces quantization-aware healing for compressed models. The post claims the resulting 4-bit model outperforms the original full-precision model. No additional details or benchmarks were available in the provided text.

Hugging Face Blog · 22d agoAI research

AlayaVista: Streaming World Modeling from Panoramic States to Perspective Video

AlayaVista is a camera-controllable streaming video world model that decouples panoramic scene evolution from perspective synthesis, trained on a 1,318-hour 4K dataset.

AlayaVista builds a 360-degree scene prior from a single perspective image, evolves it as a camera-conditioned panoramic latent state, and maps it to perspective video via a latent viewport renderer plus a perspective refiner. Chunk-autoregressive generation and few-step distillation enable efficient streaming. The authors introduce MUGEN, a real-world panoramic video dataset with 1,318 hours of at-least-4K video and rich semantic and geometric annotations.

Hugging Face daily papers · 3d agoAI research

A Vinyl Bar in Shibuya is a startup from a former Spotify leader for making music apps

Former Spotify innovation head raises $5.5M pre-seed for A Vinyl Bar in Shibuya, a startup building playful music-creation apps with selective generative AI features.

A Vinyl Bar in Shibuya, founded by former Spotify head of innovation Máuhan M Zonoozy, raised a $5.5M pre-seed round from Mantis VC, SV Angel, Boxgroup, Quiet Capital and others. The startup ships small music-play apps including Speed Surfer, Usersound, Stacks, Drops, Sampler, and the iOS mixer app bop, plus a new prompt-based sound creation feature. Zonoozy says the company deliberately avoids infusing AI into every product, arguing human taste and participation become more valuable as AI-generated content grows abundant.

TechCrunch · AI · 2d agoAI industry 2 sources

Benchmarking Qwen3.8 27B quantizations: 4-bit holds up, 1-bit collapses

Quesma benchmarks Qwen3.8 27B quantizations: 4-bit Q4_K_M matches BF16 on key benchmarks while 1-bit collapses to random chance.

Quesma spent roughly $3,000 on Modal GPUs testing Unsloth GGUF quantizations of Qwen3.8 27B across GPQA Diamond, IFBench, and Terminal-Bench 2.1. The 17 GB Q4_K_M quantization matched the 55 GB BF16 model on Terminal-Bench 2.1 and showed little degradation down to 4-bit, while the 2-bit UD-Q2_K_XL dropped noticeably. At 1-bit, scores on GPQA Diamond fell to random-guess levels, with longer reasoning making results worse, and reasoning effort settings significantly affected outcomes.

Hacker News · AI · 7d agoAI researchHN 56↑ · 30 comments1

Hackers Clone Banking Apps Into Hidden Android Work Profiles to Evade Fraud Detection

GoldFactory-linked Gigabud and Vwork malware clone banking apps into hidden Android work profiles to evade fraud detection across 11+ countries.

Group-IB links Vwork, a modified version of the open-source Shelter app cloner, to the GoldFactory group and its Gigabud Android RAT, which clones victim banking apps into an isolated work profile so fraud sessions look clean to banks. From February through July 2026, researchers observed about 1,469 compromised devices and 1,281 potentially compromised logins in Indonesia, with estimated losses near $960,939. Targets span Brazil, Colombia, Egypt, Indonesia, Mexico, Morocco, the Philippines, Thailand, Türkiye, Laos, and a GCC state; delivery uses fake airline, tax, government, and banking apps pushed via phishing sites, messaging apps, and social media.

Cyber Security News · 7d agoMalware in the wild

Structural Jailbreaks Generalize but Do Not Compound: A cross-provider and multilingual study of Involuntary In-Context Learning

Researchers show IICL structural jailbreaks generalize to Google Gemini, lifting attack success to 80-100% on harm and financial benchmarks; non-English prompts attenuate it.

The study red-teams two Google Gemini models with Involuntary In-Context Learning (IICL), a structural jailbreak reframing harmful requests as the final cell of a data-labeling task. IICL lifts attack success from at most 6.7% to 80-90% on HarmBench and 97-100% on financial abuse (FinProof), an order of magnitude above prior results on OpenAI's GPT-5.4. Against a compounding hypothesis, forcing IICL output into Spanish, Hindi, or Arabic attenuates the attack in 11 of 12 conditions, attributed to a 'relevance curse' producing lower-quality harmful content in lower-resource languages. Findings replicate under an independent non-Google judge (Cohen's kappa 0.86 over 377 paired verdicts).

arXiv cs.CR · 8d agoAI safety & security

IBM releases SOTA Granite Time Series PatchTST-FM-r2 model with commercial-friendly license

IBM released Granite Time Series PatchTST-FM-r2, a claimed state-of-the-art time series foundation model under a commercial-friendly license.

IBM Research announced the release of Granite Time Series PatchTST-FM-r2, published via the Hugging Face blog. The model is presented as state-of-the-art for time-series forecasting and is offered under a license permitting commercial use. No benchmark numbers or model size details were provided in the available text.

Hugging Face Blog · 6d agoModel release

openbmb/MiniCPM5-2B — new model trending #4 on Hugging Face

OpenBMB released MiniCPM5-2B, a dense 2B open-weights Transformer claiming 2B-class open-source SOTA for on-device deployment.

OpenBMB released MiniCPM5-2B, the second model in the MiniCPM5 series following MiniCPM5-1B, and it is trending #4 on Hugging Face. The dense 2B Transformer targets on-device, local, and resource-constrained deployment and claims 2B-class open-source SOTA while remaining competitive with 4B-class models. Reported strengths include coding, mathematics, long-context understanding, tool use, and agentic tasks; a tech report (arXiv 2506.07900), GitHub repo, and online demo accompany the release.

Hugging Face trending models · 10d agoModel release

TransNormal-2: Geometry-Grounded Rectified Flow with Edge-Aware Decoding for Precise Normal Estimation

TransNormal-2 improves monocular surface-normal estimation by fixing VAE edge degradation with geometry-aware losses and refinement, matching MoGe-2 with 1.4% of annotations.

TransNormal-2 is a FLUX.2-based rectified-flow framework for monocular surface-normal estimation with single-step deterministic inference. The authors quantify that VAE 8x spatial compression introduces 1.3-8.5 degrees of mean angular error even on ground-truth normals, with edge error up to 2.8x the global error. The method adds geometry-aware pixel-space losses and an RGB-guided Geometric Refinement Module to correct boundary-localized decoding errors. It matches or exceeds MoGe-2 on all eight reported metrics using only 1.4% as many task-specific annotations, and cuts transparent-object MAE by 4.2 degrees on ClearGrasp and 3.1 degrees on ClearPose.

Hugging Face daily papers · 10d agoAI research

Meta Patents AI Glasses to Use Facial Recognition to Identify People, Make Highlight Reels of Your Dinner Party

Meta filed a patent for AI glasses that identify people via facial recognition and auto-generate highlight reels of events like dinner parties.

A newly published Meta patent describes smartglasses that use facial recognition to detect people in frame, capture video clips of their actions, and compile highlight reels. The filing signals Meta's continued, controversial push to combine facial recognition with its AI glasses line. The patent was published Thursday and offers granular detail on Meta's product plans, though it does not confirm a shipping feature.

404 Media · Aug 14, 2026AI industry

Hoss: Fast Oblivious Semantic Search with Heterogeneous GPU-CPU-TEE Architecture

Hoss uses heterogeneous GPU-CPU TEEs for oblivious semantic search, achieving up to 67x speedup over the Compass ORAM-based system.

Hoss is a first-of-its-kind oblivious semantic search system built on a heterogeneous CPU-GPU TEE architecture, hosting hot-path HNSW graph traversal in large GPU TEE private memory and offloading lower graph layers to CPU TEEs. It invokes oblivious primitives only for lower-layer accesses and adds host-access ORAM and data-dependent optimizations. Benchmarked against prior state-of-the-art Compass, the prototype achieves up to 67x speedup while maintaining high recall, with larger gains at scale.

arXiv cs.CR · 12d agoResearch

Norway considers ban on camera-enabled wearable ‘pervert glasses’

Norway's government is weighing bans on camera-enabled smart glasses and facial recognition in public to protect privacy.

Norway's digital minister Karianne Tung said the government is considering regulating or banning camera-enabled wearables such as Meta and Snap smart glasses over privacy concerns. Potential measures may include banning facial recognition of other people in public places. The government plans to set up an expert group to advise on better protecting privacy rights amid a trend of combining AI with cameras and microphones in everyday devices.

TechCrunch · Security · 14d agoPolicy & legal

Unfold The World: Factorize 4D Properties in Reinforcing Spatial Reasoning

FactoSR factorizes 4D spatial reasoning into XY, Z, and T reinforcement-learning sub-objectives, boosting VLM performance on VSI-Bench by 5.9% and All-Angles-Bench by 4.5%.

Researchers present FactoSR, a factorized reinforcement learning framework that decomposes world-consistent reasoning into planar correspondence, depth consistency, and temporal reversibility sub-objectives. Optimizing these verifiable constraints turns the ill-posed projection recovery problem into tangible reasoning steps. Evaluations show gains of 5.9% on VSI-Bench and 4.5% on All-Angles-Bench for 3D and 4D reasoning, arguing VLMs' spatial bottleneck stems from training on 2D projections versus latent 3D geometry and temporal continuity.

Hugging Face daily papers · 13d agoAI research

Towards Standardized Evaluation of GPU Memory Safety with GMSBench

GMSBench provides 149 CUDA tests covering spatial, temporal, and concurrency GPU memory errors, exposing detection gaps in Compute Sanitizer.

GMSBench is a GPU memory safety benchmark comprising 149 self-contained CUDA tests spanning spatial, temporal, and concurrency errors across different GPU memory spaces and execution scenarios. The authors evaluate NVIDIA's Compute Sanitizer across multiple GPU architectures using the suite, exposing gaps in its detection coverage. The benchmark offers a standardized foundation for comparative evaluation of GPU memory safety mechanisms.

arXiv cs.CR · 7d agoResearch

The Shared Clipboard Inside the Sandbox: Cross-Account Data Leakage in ChatGPT

Check Point discovers cross-account data leakage in ChatGPT: isolated code-execution containers communicate via shared JFrog Artifactory, enabling covert Gmail exfiltration.

Check Point Research found a covert bidirectional channel between ChatGPT code-execution containers belonging to different accounts, which were supposed to be isolated from each other and the public internet. Both could reach the same internal JFrog Artifactory instance used for package delivery, whose exposed Item Management API allowed a 'shared clipboard' between containers. In a proof of concept, a hidden instruction in a shared conversation made ChatGPT retrieve email data from the victim's connected Gmail account and send it to the attacker's account while the victim received a normal answer. The same channel could exfiltrate conversation history and session files; OpenAI recently described a similar isolation weakness in its postmortem of the Hugging Face incident.

Check Point Research · 8d agoAI safety & security1