Search: “GUR”

26 stories

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Malware 5 Data breach 4 Industry 4 Threat actor 3 Policy & legal 3 Phishing & fraud 2 Exploit / PoC 1 Ransomware 1

SeverityAll critical 8 high 5 medium 4 low 4 info 2

Smart search ranks by meaning as well as keywords (one row per story, last 45 days).

Re: Retrospective by 'gpg.fail' authors

GnuPG's Werner Koch says gpg.fail samples only crash GnuPG via DER-as-printf format string in --debug x509; RCE claim remains unproven.

Werner Koch replied to the gpg.fail retrospective, noting that GnuPG versions above 2.2 produce garbled stderr or crash when the project's certificates are used with --debug x509 because DER data is passed as a printf format string. Testing the certificates from the researchers' Git repo yielded only a segfault, not demonstrated code execution. Koch states how remote code execution would be achieved is unclear and asks for a real reproducer.

oss-securityupdated 17:16 UTC · 6h agofirst Sep 15, 15:24 UTC · 1d agoVulnerability 8 sources

Risky Bulletin: The EU publishes its upcoming cybersecurity standards

ETSI releases 17 draft cybersecurity standards vendors must meet when the EU Cyber Resilience Act takes effect in December 2027.

The European Telecommunications Standards Institute published 17 interim draft standards covering operating systems, routers, firewalls, VPNs, SIEMs, browsers, password managers, smart home devices, toys and wearables. They mandate basic security features such as post-sale updates, shipped SBOMs, modern cryptography and secure-by-default settings; public comments run until November, with final versions expected in December, one year before CRA compliance begins in December 2027. The newsletter also reports Irregular taking responsibility for AI test-environment escapes involving Anthropic and Meta frontier models, a breach at France's tax agency exposing 678,000+ citizens' data claimed by hacker ZeroBytes, and Kazakhstan eGov data covering 15 million citizens listed for sale on an underground forum. Additional briefs cover a $3.2 million Harmony Protocol theft crashing the ONE token 40%, Columbus Police still restoring systems two years after ransomware, DDoS attacks on Threema's provider, and Ukraine's GUR claiming a cyberattack on Wildberries.

Risky Business NewsAug 17, 05:03 UTC · Aug 17, 2026Policy & legal2

GPU-CFR: 80x Faster Counterfactual Regret Minimization by Compiling the Game to Static Dataflow and CUDA Graph Replay

GPU-CFR compiles counterfactual regret minimization into static dataflow with CUDA Graph Replay, achieving 29.8-80.4x speedups over prior GPU solvers.

The paper presents a compiler and runtime that turns any fixed game's CFR iteration into a static dataflow graph of flat arrays and precomputed indices, cutting framework operations by up to 18.1x. Because shapes and buffer addresses never change, CUDA Graph Replay records the iteration once and replays it with a single launch. On one A100 across an eight-game suite, GPU-CFR runs 29.8-80.4x faster than the fastest prior GPU CFR and 14-258x faster than the CPU implementation LiteEFG on the four largest games, while reproducing reference iterates bitwise on CPU.

arXiv cs.AI / cs.LG / cs.CLSep 10, 17:58 UTC · 6d agoAI research3· 1 read

Srsly Risky Biz: Trump's Private Hacker Memo Is the Right Idea

A Trump presidential memo directs DHS to authorize vetted private-sector hackers to conduct cyber operations against foreign cybercriminal groups (CE-TCOs).

A presidential memorandum directs the Department of Homeland Security to establish a program authorizing private companies to conduct cyber surveillance and cyber effects operations against Cyber-Enabled Transnational Crime Organisations (CE-TCOs). Participating companies must pass vetting, obtain government approval before operations, and post a USD $1 million bond. The accompanying fact sheet cites more than USD $20.8 billion in US losses to cyber-enabled crime in 2025. Critics worry about accidental escalation if operations touch foreign government systems.

Risky Business NewsAug 20, 05:29 UTC · 27d agoPolicy & legal1

Risky Bulletin: Academics find source code overlaps between Geedge and China's Great Firewall

Academics linked Chinese vendor Geedge Networks' Tiangou Secure Gateway source code to one of the Great Firewall's three traffic filtering capabilities.

US researchers presenting at USENIX Security reconstructed Geedge Networks' Tiangou Secure Gateway firmware from over 100,000 leaked files, including Git repositories with commit history, and matched its filtering behavior to sections of China's Great Firewall. They found only 1 of 3 characterized DNS injectors matched Geedge code, noted the system relies on memory-unsafe C components and copied third-party code, and said its bugs could aid future circumvention tools. Geedge also exports censorship tools to Kazakhstan, Ethiopia, Pakistan, and Myanmar. The newsletter additionally rounds up multiple breaches.

Risky Business NewsAug 21, 02:55 UTC · 26d agoResearch2

NVIDIA Details BioNeMo Inference Runtime (BioIR): 2.90x Higher Boltz-2 Folding Throughput and 58.5K Residues per GPU-Hour on 8xH100

NVIDIA released BioNeMo Inference Runtime (BioIR), an open-source PyTorch-compatible library delivering 2.90x higher Boltz-2 protein-folding throughput on 8xH100 GPUs.

NVIDIA detailed BioIR, a Python library that accelerates Boltz-2, OpenFold2, and OpenFold3 structure-prediction inference on NVIDIA GPUs while preserving standard PyTorch workflows. On a matched benchmark of 1,000 human dimers on 8xH100 80GB GPUs, BioIR delivered 58.5K folded residues per GPU-hour versus 20.2K for a torch.compile baseline, a 2.90x throughput gain. BioIR already powered the AlphaFold Database expansion, generating about 31 million candidate complexes across 4,777 proteomes, with 1.81 million released as high-confidence predictions. Extrapolated to 1 million targets, estimated folding energy drops from 35 MWh to 11 MWh at 8-GPU TDP equivalents.

MarkTechPostSep 10, 21:57 UTC · 6d agoAI tools & infra1

Towards Standardized Evaluation of GPU Memory Safety with GMSBench

GMSBench provides 149 CUDA tests covering spatial, temporal, and concurrency GPU memory errors, exposing detection gaps in Compute Sanitizer.

GMSBench is a GPU memory safety benchmark comprising 149 self-contained CUDA tests spanning spatial, temporal, and concurrency errors across different GPU memory spaces and execution scenarios. The authors evaluate NVIDIA's Compute Sanitizer across multiple GPU architectures using the suite, exposing gaps in its detection coverage. The benchmark offers a standardized foundation for comparative evaluation of GPU memory safety mechanisms.

arXiv cs.CRSep 8, 15:11 UTC · 8d agoResearch

Omni Interaction Agent Technical Report

Researchers release Gander, an end-to-end omni interaction model with full-duplex streaming across video, speech, and text plus agentic capabilities.

Gander is an end-to-end model unifying omni perception, realtime interaction, and agentic capabilities in a single framework, accepting continuously streaming video, speech, and text. It uses a Cerebellum-Brain architecture where the Cerebellum handles realtime conversation and the Brain handles reasoning and agentic tasks, built on a streaming Thinker-Talker design with chunk-level token streams. Internal human evaluations report spoken dialogue on par with SOTA open source models and competitive omni interaction; the models, code, and data are released publicly.

Hugging Face daily papersSep 7, 20:00 UTC · 9d agoModel release

Fine-tuning a 350M Model for Better Structured Outputs in 100 GRPO Steps

Hugging Face guide fine-tunes a 350M-parameter model with 100 GRPO steps to improve structured output reliability.

A Hugging Face blog post demonstrates fine-tuning a 350M-parameter model using GRPO (Group Relative Policy Optimization) with TRL over 100 training steps. The stated goal is more reliable structured outputs from small language models. No article body was available, so details beyond the title are limited.

Hugging Face BlogSep 3, 00:00 UTC · 13d agoAI tools & infra

The Pelican comparison grid for Astra is pretty interesting

Simon Willison's pelican SVG comparison shows GPT-6 Astra producing markedly better images than GPT-5.6 Sol, Terra, and Luna across reasoning levels.

Willison generated pelicans-riding-bicycles SVGs with newly accessed GPT-6 Astra at low through max reasoning levels and rendered them in a comparison grid against GPT-5.6 Sol, Terra, and Luna. Astra's outputs were markedly more coherent, while even the best GPT-5.6-Sol images remained largely abstract shapes. Astra does not support a reasoning=none setting, so all comparisons involved reasoning-enabled runs.

Simon WillisonSep 4, 23:59 UTC · 11d agoAI research

Generalized Agent Iteration: One Formal Framework for Iterative Policy Improvement and Recursive Self-Improvement

Generalized Agent Iteration formally unifies iterative policy improvement and recursive self-improvement, defining axes that distinguish anchored, goal-drifting, and self-referential agents.

The paper proposes Generalized Agent Iteration (GAI), a formal framework that models learning as a cycle of agent evaluation and agent improvement, defining the agent as a configuration of modifiable components. Two dials—whether the improving mechanism is part of the agent and whether the evaluation standard is grounded outside it—separate generalized policy iteration (GPI) from recursive self-improvement (RSI) and classify systems as anchored, goal drift, or fully self-referential. The framework places existing systems on shared axes and makes defects of recursive self-improvement statable one condition at a time.

Hugging Face daily papersSep 10, 20:00 UTC · 6d agoAI research

GE-Act 2.0: Pretraining and Scaling a World-Action Model for Robotic Manipulation

GE-Act 2.0 is a from-scratch pretrained world-action model for robotic manipulation, with success rising from 17.1% to 44.1% as co-training data scales to 30,000 hours.

Genie Envisioner Act 2.0 (GE-Act 2.0) is a world-action model whose generative and action components are all initialized from scratch on manipulation data, combining a control-oriented autoencoder (CoAE), single-step visual planner (SVP), and inverse dynamics model (IDM) trained jointly via knowledge-aligned selective optimization (KASO). Scaling co-training data from 300 to 30,000 hours raises zero-shot success from 17.1% to 44.1% on G1-OP and 13.4% to 31.1% on G2-90D, despite the latter comprising under 2% of data, suggesting cross-embodiment transfer. Gains span 19/20 and 18/20 skill groups, and skill-specific coverage correlates with zero-shot OOD success (Pearson r=0.80).

Hugging Face daily papersSep 3, 20:00 UTC · 13d agoAI research

[AINews] Hot Chips: OpenAI’s Jalapeño, Cerebras CS-5, Groq 3 LPX, Apple M6

OpenAI unveiled Jalapeno custom inference chip claiming 1.5-1.9x better perf-per-watt than NVIDIA GB200/GB300, deploying in-house by year-end.

At the 37th Hot Chips conference, OpenAI published first benchmark details for its custom Jalapeno inference chip, claiming 1.5-1.9x more work per watt, 1.7-3.6x lower end-to-end latency, and 2.1-4.1x higher interactive-workload performance versus NVIDIA GB200/GB300, with the 700W-rated part staying at or below 550W in tests. Deployment into OpenAI's own infrastructure begins by year-end, with Gen 2 deep in development and Gen 3 underway. OpenAI also said GPT-Astra and Codex helped write low-level kernels, reportedly 1.5-1.8x faster than human-expert code for selected attention and MoE blocks. Cerebras CS-5, Groq 3 LPX and Apple M6 were also featured at the conference.

Latent SpaceAug 27, 01:31 UTC · 20d agoAI industry

The gpg.fail aftermath: On responsible disclosure, GPG, and the state of security in 2026 [32:37]

A conference talk recounts GPG vulnerability disclosures, notes several GnuPG flaws remain unpatched, and demonstrates novel bugs live.

A researcher who disclosed multiple GnuPG vulnerabilities before 39c3 in December 2025 reports that several flaws, including one allowing spoofed PGP signatures, remain unpatched. Memory corruption in the basic PGP message parser was properly fixed, but GnuPG maintainer Werner Koch declared a widely-used feature 'harmful' instead of patching it. The talk presents additional novel GPG vulnerabilities and commentary on responsible disclosure and LLMs in security.

Lobsters · securitySep 12, 17:24 UTC · 4d agoResearch

Right Tool, Right Job: Native-Language Evaluation, Tokenizer Sensitivity, and Methodological Findings from a French-Only BabyLM

French BabyLM entry METRON-FR (125M GPT-2, 92.47M words) shows tokenizer artifacts dominate child-scale zero-shot evaluation; proposes standard diagnostics.

METRON-FR is a 125M-parameter GPT-2 pretrained on 92.47M French words, submitted to the BabyLM 2026 Strict track, scoring 85.97% on the native Quebec-French QFrBLiMP benchmark and 62.80% on the BabyLM-weighted leaderboard. A cross-lingual GLUE protocol combining French task-data translation with rank-16 LoRA shows relational tasks gain while world-knowledge tasks regress. Bilingual Lexicon Induction reaches p@1 of 68.84%, 18x above chance, and ablations show single-token zero-shot scoring is dominated by tokenizer and template artifacts at child scale.

arXiv cs.AI / cs.LG / cs.CLSep 15, 16:43 UTC · 1d agoAI research

Knowledgator Releases GLiFormer: A 575M-Parameter Encoder That Hits 91.10 F1 on Nested JSON Extraction Without Generating Tokens

Knowledgator released GLiFormer, an Apache-2.0 encoder (264M/575M) handling NER, classification, relations, and nested JSON extraction, scoring 91.10 F1.

Knowledgator Engineering released GLiFormer, a schema-conditioned encoder that performs NER, classification, relation extraction, nested JSON structuring, and embeddings without generating output tokens. GLiFormer Large v1 has 575.6M parameters and scores 91.10 F1 on nested JSON extraction, close to GPT-5.6-luna's 91.96; both checkpoints are Apache 2.0 on Hugging Face. Reported median latency is 69 ms on GPU for the base model, though relation extraction (21.33 micro-F1) still trails GLiNER-Relex and larger LLMs.

MarkTechPost21:19 UTC · 2h agoModel release

Advancing price-performance for developers with GPT‑5.6 in Kiro

OpenAI's GPT-5.6 is now available in the Kiro developer platform, offering developers improved price-performance for planning, building, reviewing, and testing software.

OpenAI announced that GPT-5.6 is now available in Kiro, a developer platform for planning, building, reviewing, and testing software. The announcement emphasizes better price-performance for developer workloads rather than new model capabilities. This expands the commercial availability of OpenAI models in third-party coding tools.

OpenAI NewsAug 24, 12:00 UTC · 23d agoAI industry

Verify Before You Distill: Prompt-Level Teacher Gating for On-Policy Distillation

TGOPD verifies teacher reliability per prompt before on-policy distillation, outperforming vanilla OPD across math, code, and instruction benchmarks.

Teacher-Gated On-Policy Distillation (TGOPD) estimates teacher reliability from verifier-scored teacher probes and routes each prompt either to dense on-policy distillation or to verifier-grounded GRPO, avoiding misleading updates from confidently wrong teachers under mode-seeking reverse KL. Across 4B and 35B students in mathematics, code, and instruction following, TGOPD outperforms vanilla OPD in all six single-domain settings and achieves higher seven-benchmark averages under multi-domain training. It also raises teacher-node GPU utilization from 9.8% to 78.9% in the measured 4B single-domain run by reusing idle teacher capacity.

Hugging Face daily papersSep 1, 20:00 UTC · 15d agoAI research

ThinkPrior: Zero-Rollout Difficulty Priors for Cold-Start Prompt Selection in RLVR

ThinkPrior builds zero-rollout difficulty priors via an offline verifier-anchored pass, halving silent groups in RLVR and cutting wasted rollouts on Qwen2.5-Math-7B.

In GRPO-based RLVR, groups where all rollouts are correct or all are wrong yield zero advantages and consume about 39% of a run's rollouts under uniform sampling. ThinkPrior initializes a Beta posterior from an external anchor pass's verifier-scored pass rate, selecting prompts by expected learnability before any target-policy rollout, without changing the loss or optimizer. On Qwen2.5-Math-7B across sixteen seeds it more than halves early silent groups and cuts wasted rollouts through step 30 by nearly a fifth, with no detected final-accuracy difference. The ThinkPrior+DAPO composition reduces generated rollouts by 10.6% at an equal 3,840-rollout update budget.

arXiv cs.AI / cs.LG / cs.CLSep 8, 17:30 UTC · 8d agoAI research1

XHToken/Spark-X2.5-4B-GGUF — new model trending #30 on Hugging Face

XHToken released GGUF weights of Spark-X2.5-4B, a compact model with 1M-token context and 200+ language support, under Apache 2.0.

The Hugging Face repository provides BF16 GGUF conversions of Spark-X2.5-4B, a compact general-purpose language model for conversation, writing, translation, reasoning, coding, tool use, and agentic workflows. The model uses a hybrid attention architecture, supports a native context length up to 1M tokens, and covers more than 200 languages. Local inference is supported through Ollama and LM Studio via an XHToken llama.cpp fork, with a --think=false flag to disable thinking mode for faster responses. Released under Apache License 2.0; it was trending #30 on Hugging Face at publication.

Hugging Face trending modelsAug 28, 11:26 UTC · 19d agoModel release

Knowing What Not to Answer: Selective Non-Compliance in Vision-Language Models

Researchers introduce KoNA, a benchmark exposing vision-language models' failures at selective non-compliance, plus fine-tuning that improves refusal and abstention accuracy.

KoNA is a benchmark for evaluating selective non-compliance in vision-language models across five categories: False Premise, Visual Inaccessibility, Universal Unknown, Task Feasibility and Safety. It tests both query-level and component-level non-compliance using paired single and compound queries, and evaluations across diverse VLMs show models often fail to refuse, correct or abstain appropriately, with failures worsening on compound queries. Fine-tuning VLMs on KoNA examples substantially improves non-compliance accuracy while largely maintaining performance on fully answerable tasks.

Hugging Face daily papersSep 3, 20:00 UTC · 13d agoAI research1

Async GRPO with LoRA across HF Jobs: a bucket, a proxy, and no NCCL

Hugging Face blog describes running async GRPO reinforcement learning with LoRA across HF Jobs using a storage bucket and proxy instead of NCCL.

A Hugging Face blog post titled 'Async GRPO with LoRA across HF Jobs: a bucket, a proxy, and no NCCL' explains an asynchronous Group Relative Policy Optimization training setup using LoRA adapters distributed across Hugging Face Jobs workers. The architecture coordinates training through an object storage bucket and a proxy server, removing the need for NCCL collective communication. No full article text was available at classification time.

Hugging Face BlogSep 10, 00:00 UTC · 6d agoAI tools & infra

Legora reviewed 41 documents in minutes with GPT-6 Astra

Legal-tech firm Legora says GPT-6 Astra reviewed 41 financial documents in minutes, catching all four planted errors and boosting accuracy about 40%.

Legal technology company Legora reported using OpenAI's GPT-6 Astra to review 41 financial-statement documents in minutes. The workflow found all four planted errors and improved performance by nearly 40% compared to prior processes. The case study highlights AI-assisted financial review adoption in professional services.

OpenAI NewsSep 3, 12:00 UTC · 13d agoAI industry

Arm Mali G2-Ultra NX GPU: desktop-class mobile gameplay with AI-native graphics

Arm unveiled Mali G2-Ultra NX, its first AI-native mobile GPU with in-shader neural acceleration, third-gen ray tracing, and up to 24% higher benchmark performance.

Arm announced the Mali G2-Ultra NX, the first AI-native Mali GPU, integrating neural accelerators directly into shader cores alongside a new execution engine and third-generation hardware ray tracing. It introduces Neural Super Sampling (NSS), Neural Frame Rate Upscaling (NFRU), and Neural Super Sampling and Denoising (NSSD); the Neural Dawn demo with Sumo Digital showed up to 4x performance efficiency and 70% lower external memory traffic versus native rendering. Arm claims up to 24% higher benchmark performance, 13% lower DRAM traffic on ray tracing benchmarks, and up to 120 FPS with NFRU. Over 14 billion Mali GPUs have shipped to date.

Hacker News · AISep 8, 04:06 UTC · 8d agoAI industry HN 71↑ · 53 comments1

27.5KB language-agnostic WebGPU syntax highlighter

A developer released gpu-lexer, a 27.5KB language-agnostic syntax highlighter that uses a tiny WebGPU model to label code tokens in the browser.

gpu-lexer splits source into words, whitespace, and symbols, then a small WebGPU model uses local and whole-file context to assign nine token classes, working on languages never seen in training. On held-out files, 12.57% of token labels differ from Shiki, though this measures agreement with Shiki rather than objective correctness. In benchmarks against Shiki 4.4.3, Prism.js, Highlight.js, Sugar High, and Starry Night, it highlighted 10 concatenated copies of three.min.js (5.56M characters) about 10x faster on an Apple M4 Pro in Chrome 152. The author frames it as an experiment, not a grammar-equivalent highlighter.

Hacker News · securitySep 9, 01:14 UTC · 7d agoAI tools & infra HN 21↑ · 5 comments1

Foundation Models for Generalizable Semantic and Goal-Oriented Communication

FMSGOC uses vision-language foundation model priors plus diffusion reconstruction to enable generalizable semantic communication at 0.039 bits per pixel for 6G.

FMSGOC targets generalization failures in semantic and goal-oriented communication for 6G by leveraging broad visual-linguistic foundation model priors. A vision-language model selects sparse, goal-aligned semantic anchors while a fine-tuned diffusion model performs masked completion to reconstruct images at the receiver, decoupling what to send from how to reconstruct. On CIFAR-10 it reaches 0.039 bits per pixel with cosine similarity 0.87-0.90 and 0.83-0.86 on unseen ImageNet inputs, outperforming end-to-end baselines at lower bit rates.

arXiv cs.AI / cs.LG / cs.CLSep 7, 18:12 UTC · 9d agoAI research