ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “NABU”

35 stories

Searchkeywordsmart
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllPolicy & legal 8Data breach 2Threat actor 2Vulnerability 2AI tools & infra 1Phishing & fraud 1
SeverityAllcritical 5high 2medium 2low 5info 2

Smart search ranks by meaning as well as keywords (one row per story, last 45 days).

Risky Bulletin: Ukraine's top prosecutor resigns amid scam call center scandal

Ukraine's top prosecutor Ruslan Kravchenko resigned after NABU arrested a deputy for taking bribes protecting scam call centers running fake investment platforms.

Ukraine's anti-corruption bureau NABU arrested Serhiy Kropyva, Deputy Head of International Cooperation at the Prosecutor General's Office, alleging officials took monthly protection fees from a network of 100-500 scam call centers luring victims into fake investment platforms, with bribes reportedly growing from $700,000 to $3.5 million per month. Prosecutor General Ruslan Kravchenko resigned on Monday, calling it a political decision, while Kropyva was fired with bail set at 120 million hryvnias ($2.7 million) and over 100 call centers shut down in the past month. The newsletter also briefly covers a cyberattack crippling more than 80 Luxembourg medical practices via payment vendor BMS Engineering, ShinyHunters' claimed theft of 200,000 Florida DMV driver records, a cyberattack on the American Meteor Society, and school closures in Springfield, Massachusetts.

Risky Business News · 7d agoPhishing & fraud

A Vinyl Bar in Shibuya is a startup from a former Spotify leader for making music apps

Former Spotify innovation head raises $5.5M pre-seed for A Vinyl Bar in Shibuya, a startup building playful music-creation apps with selective generative AI features.

A Vinyl Bar in Shibuya, founded by former Spotify head of innovation Máuhan M Zonoozy, raised a $5.5M pre-seed round from Mantis VC, SV Angel, Boxgroup, Quiet Capital and others. The startup ships small music-play apps including Speed Surfer, Usersound, Stacks, Drops, Sampler, and the iOS mixer app bop, plus a new prompt-based sound creation feature. Zonoozy says the company deliberately avoids infusing AI into every product, arguing human taste and participation become more valuable as AI-generated content grows abundant.

TechCrunch · AI · 2d agoAI industry 2 sources

Ukraine prosecutor general steps down amid scam call center bribery probe

Ukraine's prosecutor general Ruslan Kravchenko resigned amid a probe into officials who allegedly took bribes to protect fraudulent call centers.

Ukraine's prosecutor general Ruslan Kravchenko resigned over an anti-corruption probe into officials who allegedly took bribes since mid-2025 to protect fraudulent call centers; he has not been charged. NABU named five suspects, including senior prosecutor Serhii Kropyva, who was remanded with bail of 120 million hryvnias (about $2.7 million) on suspicion of laundering over 89 million hryvnias (roughly $2 million). The scam centers targeted victims in Ukraine and abroad; Ukrainian authorities reported shutting about 340 call centers over the past year, including 94 in a single week during a nationwide crackdown.

The Record · 7d agoPolicy & legal

Edge0/Edge0-35B-A3B-preview — new model trending #30 on Hugging Face

Edge0 released a 35B sparse MoE model running in under 3 GiB of memory at 15 tok/s via SSD expert offload and int4 quantization.

Edge0-35b-a3b-preview is a 35B-parameter MoE (256 experts, 4 active per token) built on Qwen3.5-MoE 35B-A3B, shipped as a 4-bit checkpoint with LoRA and prerouter adapters under Apache 2.0. The edge0 framework streams expert weights from SSD on demand, bounding peak active memory at 2.9 GiB and achieving 14.9-17.7 tok/s decode on a Mac mini M4 Pro (MLX backend). Recover-LoRA distillation keeps the int4 model within 3.9 points of its fp16 base (79.2 vs 83.2 average on OpenCompass benchmarks including AIME 2026, HumanEval, GPQA-Diamond, MMLU-Pro, and IFBench).

Hugging Face trending models · 8d agoModel release

Srsly Risky Biz: America's Drivers Licence Breach is a National Security Disaster

Dark web service Nexus sold 153 million US and Canadian driver's licenses, linked to identity verification firm IDScan under FBI investigation.

Krebs On Security reported that a dark web service called Nexus sold access to 153 million US and Canadian driver's licenses, claiming over a year of continuous exfiltration from a major identity verification company, with roughly 400,000 new licences added in a single day. Krebs verified the data as genuine and linked the incident via circumstantial evidence to identity verification firm IDScan, whose licences of senior US officials including Secretary of War Pete Hegseth appeared in the database; the FBI is investigating and IDScan has confirmed a breach inquiry. The article argues the data has national security implications, citing how Chinese APT espionage (Anthem, Equifax, Marriott, OPM) and Bellingcat investigations exploited leaked databases. Class action suits are being prepared, and the piece calls for stricter oversight of identity verification firms.

Risky Business News · 6d agoData breach in the wild

m-a-p/YuE2-3B — new model trending #30 on Hugging Face

M-A-P released YuE2-3B, an open music generation model that outperforms Suno v5 on WildSongBench and runs locally on a 24GB GPU.

The M-A-P (multimodal-art-projection) team released YuE2-3B, an open-weights music generation model that turns lyrics and a style prompt into full songs with vocals and accompaniment. It uses an AR-NAR Mixture-of-Transformers backbone with symbolic planning and flow matching through a VAE, and supports editable scores (melody and chords, including ABC notation) plus agentic editing workflows. On 192 WildSongBench prompts it reports a SongBench average of 6.9632 (best-of-8) versus 6.8721 for Suno v5, claimed as state of the art among evaluated open and proprietary models. It runs 48 kHz stereo inference locally on a single 24GB NVIDIA GPU without quantization, with companion releases including YuE2-Vae, MERT-v2 encoders, the WildSongBench dataset, and SheetSage2.

Hugging Face trending models · 7d agoModel release1

America's Driver's License Breach Is a National Security Disaster

Dark web service Nexus sells 153 million US/Canadian driver's licenses linked to a breach of identity verifier IDScan.

Krebs on Security revealed a dark web service, Nexus, selling access to 153 million driver's licenses and 3 million travel documents from US and Canadian citizens, roughly 63 percent of all US licenses. Circumstantial evidence links the data to identity verification firm IDScan, which confirmed it is investigating a breach, and the FBI is probing the incident. Licenses belonging to senior US officials, including Pete Hegseth, an FBI assistant director, and Krebs's own contacts were verified as genuine. The exfiltration appears ongoing, with the database growing by nearly 400,000 licenses in a single day, and the data carries significant national security value for foreign intelligence services.

Hacker News · security · 1d agoData breachHN 26↑ · 4 comments3· 1 read

IFM/K2-Horizon-MoVA-36B-A4B — new model trending #15 on Hugging Face

IFM released K2-Horizon-MoVA-36B-A4B, an open-weights 36B-parameter MoE model with 4B active parameters and native 512K context.

IFM released the final checkpoint of K2-Horizon-MoVA-36B-A4B, a sparse Mixture-of-Experts model using Mixture-of-Values (MoVA) attention with 36B total and 4B active parameters. The model supports native 524,288-token context and reportedly outscores open-weight dense and MoE models up to 15x its size on agentic and reasoning benchmarks, while competing against closed frontier models. Intermediate checkpoints, training data, the training recipe, and training code are slated for public release.

Hugging Face trending models · 14d agoModel release

Ukraine moves to crack down on scam call centers after corruption scandal

Ukraine's parliament passed legislation criminalizing fraudulent call centers with 7-12 year prison terms after a bribery scandal implicating prosecutors.

Ukraine's Verkhovna Rada passed legislation making electronic-communications fraud and organizing or working for fraudulent call centers separate crimes punishable by 7-12 years, awaiting President Zelensky's signature. The bill advanced after NABU alleged prosecutors took bribes since mid-2025 to shield scam call centers; five suspects were named and Prosecutor General Ruslan Kravchenko, who denies wrongdoing, was dismissed by parliament and presidential decree. Ukrainian authorities previously reported 411 searches and 94 suspected call centers shut down in one week, including a Kyiv operation that stole over $500,000 from dozens of Americans.

The Record · 6h agoPolicy & legal

Cohere Releases North Small Translate: A 218B MoE Translation Model That Scores 83.6 on WMT26 Across 50 Languages

Cohere released North Small Translate, an open-weight 218B MoE (25B active) translation model scoring 83.6 on WMT26 across 50 languages.

Cohere and Cohere Labs released North Small Translate, a decoder-only sparse Mixture-of-Experts translation model with 218B total and 25B active parameters, 128 experts with 8 activated per token plus shared experts, and 16K-token input and output context. In Cohere's vendor-reported WMT26 evaluation, judged by GPT-5.6-Sol, it scores 83.6 averaged across 50 languages (84.36 in an agentic multi-pass mode), ahead of DeepL NextGen (81.37), Qwen 3.5 397B A17B (81.56), GLM 5.2 (76.50), and Google Translate (68.20). The model was built with RWS's Language Weaver team, post-trained specifically for translation, and reports 112 output tokens per second versus 81 for Gemma 4 31B, with long-document xCOMET-XL scores of 48.9 versus 21.3 for Google Translate. It is available free on Cohere's Chat V2 API until rate limits, with three self-hosting checkpoints including a 4-bit NVFP4 variant running on 1x B200 or 2x H100.

MarkTechPost · 5d agoModel release

Indonesia Hit by Android Banking App-Cloning Campaign

GoldFactory exploits Android Work Profile to deliver the Gigabud banking trojan to Indonesian users via cloned banking apps, with Mantax and Otax spreading separately.

The GoldFactory threat group is running an app-cloning campaign against Android banking customers in Indonesia, abusing the Android Work Profile feature to deliver its Gigabud trojan. The Mantax and Otax malware families are spreading through separate distribution channels. Abusing Work Profile to install or conceal cloned banking apps is a notable mobile technique, though the article reports no victim counts or loss figures.

Dark Readingupdated · 5d agofirst · 5d agoThreat actor in the wild 3 sources

Think Before You Link: Rarity, Reasoning, and Retrieval in Multilingual Entity Linking

Training-free reasoning-plus-retrieval framework lifts multilingual multimodal entity linking accuracy by 6.9% overall and up to 23.3% on rare entities.

The paper broadens rarity measurement in multimodal entity linking using knowledge-graph structural metrics beyond popularity-based pageview metrics, identifying many rare entities that popularity metrics miss. Across these rare-entity slices, state-of-the-art accuracy drops by 15.4-39.9%, exposing distinct failure modes under different rarity definitions. The proposed training-free framework iteratively searches and reasons over Wikipedia with a reasoning-capable vision-language model; experiments show reasoning and retrieval are complementary. On the MERLIN benchmark covering Hindi, Indonesian, Japanese, Tamil, and Vietnamese, the system improves overall accuracy by 6.9% and up to 23.3% on rare entities, with MERLIN-Rare test slices released.

Hugging Face daily papers · 7d agoAI research

Kaininja: Extending Native 3D Generators to the Part Level

KaiNinja extends TRELLIS.2 native 3D generation to part-level assets via a dual-volume O-Voxel representation, cutting whole-object Chamfer distance by 40%.

KaiNinja extends the TRELLIS.2 native 3D generator to produce part-level assets instead of one fused mesh, enabling downstream editing, rigging, and simulation. A dual-volume form of the O-Voxel representation solves the problem that a single volume cannot represent interfaces where two parts touch. The model needs no segmentation network, is partly trained on LLM-agent-authored part data, lowers whole-object Chamfer distance by 40%, and raises strict part F-score by 16% versus other part-generation pipelines.

Hugging Face daily papers · 2d agoAI research

Nuha-Speech: Building General-Purpose Arabic Speech-LLMs

Nuha-Speech initiative builds general-purpose Arabic speech-LLMs using a 1.5M-sample speech QA corpus and fine-tuned Qwen-Omni variants.

The paper introduces Nuha-Speech, an initiative covering dataset construction, model training, and evaluation for Arabic speech large language models. The authors built an Arabic Speech Question-Answering corpus of over 1.5 million training samples and used it for supervised fine-tuning of Qwen-Omni model variants at multiple scales. A tailored evaluation framework with diverse tasks and metrics is designed to assess Arabic speech capabilities under limited resource constraints.

arXiv cs.AI / cs.LG / cs.CL · 6d agoAI research1

From Parameters to Answers: How LLMs Retrieve and Use Their Internal Knowledge

Interpretability study traces how Qwen, Llama, and Gemma route query information and internal knowledge across layers when answering questions.

Researchers used layerwise interventions on hidden states to separate query-routing signals from target knowledge in language models, testing Qwen, Llama, and Gemma on country-continent questions with varied answer types. A pair-conditioned request direction strengthens before interventions alter downstream knowledge, opening a causal window while answer-supporting content is still forming. Trajectories differ by model: Gemma shows a partially overlapping mid-layer routing profile, while Llama has no sustained routing-effect window under the same gates.

arXiv cs.AI / cs.LG / cs.CL · 6d agoAI research1

E-Commerce Access, Vedicline Data, Langflow RCE, ASUS Claim, and Energy Shell Access

SOCRadar reports underground posts claiming a Bangladeshi e-commerce database, Vedicline data leak, Langflow RCE, ASUS breach, and energy-sector shell access.

SOCRadar's Dark Web Team identified several new underground posts, including an alleged Bangladeshi e-commerce customer database offered for sale. The roundup also covers a claimed Vedicline data leak, Langflow remote code execution, an ASUS breach claim, and energy-sector shell access sales. Details on record counts and victims were not provided in the excerpt.

SOCRadar · 9d agoData breach

Structural Jailbreaks Generalize but Do Not Compound: A cross-provider and multilingual study of Involuntary In-Context Learning

Researchers show IICL structural jailbreaks generalize to Google Gemini, lifting attack success to 80-100% on harm and financial benchmarks; non-English prompts attenuate it.

The study red-teams two Google Gemini models with Involuntary In-Context Learning (IICL), a structural jailbreak reframing harmful requests as the final cell of a data-labeling task. IICL lifts attack success from at most 6.7% to 80-90% on HarmBench and 97-100% on financial abuse (FinProof), an order of magnitude above prior results on OpenAI's GPT-5.4. Against a compounding hypothesis, forcing IICL output into Spanish, Hindi, or Arabic attenuates the attack in 11 of 12 conditions, attributed to a 'relevance curse' producing lower-quality harmful content in lower-resource languages. Findings replicate under an independent non-Google judge (Cohen's kappa 0.86 over 377 paired verdicts).

arXiv cs.CR · 8d agoAI safety & security

Jackrong/Qwopus3.8-27B-Flash-GGUF — new model trending #26 on Hugging Face

Community fine-tune Qwopus3.8-27B-Flash, built on Qwen3.8-27B, cuts agent reasoning latency with 12.8% faster decoding and 80.7% MTP acceptance.

Jackrong released Qwopus3.8-27B-Flash, a fine-tune of Qwen3.8-27B optimized for long-running agent workloads, reporting 12.8% faster decoding and 80.7% multi-token-prediction acceptance. Training used roughly 1.5 million teacher-scored SFT examples filtered to the top 10%, followed by reinforcement training with NVIDIA NeMo-RL and GSPO. The author notes an explicit trade-off: MMLU-Pro mixed-set scores are lower than the base model, and a known bug can produce incorrect Python indentation. Author-provided benchmarks have not been independently verified.

Hugging Face trending models · 12d agoModel release1

RelateAnything: Real-Time Open-Vocabulary Relation Prediction From Any Inputs

RelateAnything is a 53M-parameter open-vocabulary relation prediction model running at 20 ms/frame, with 2.3-3.5x higher mean recall than comparable open-vocabulary methods.

RelateAnything predicts scored relations between image regions using any predicate vocabulary supplied at inference as text embeddings, with object labels never required as input, so region sources can change without retraining. Training covers 19,103 predicates using positive-unlabeled supervision; the authors release RA-4M (474k images, 4.3M geometrically verified relations over 10,102 free-text predicates) and the OV-SGG-Bench evaluation suite. The 53M-parameter model runs at 20 ms/frame and achieves 2.3-3.5x the mean recall of the strongest comparable open-vocabulary method across cross-dataset and zero-shot benchmarks. Model, corpus, and benchmark are public.

Hugging Face daily papers · 5d agoAI research

CiteShade: Citation Laundering in Multi-Source Retrieval-Augmented Generation and Its Counterfactual Defense

CiteShade attack makes RAG models cite trusted sources for attacker-chosen wrong answers, raising wrong-answer rate from 0.01 to 0.68.

CiteShade is presented as the first citation laundering attack against multi-source retrieval-augmented generation: an attacker controlling a single source induces a wrong answer falsely attributed to a trusted source, even while correct evidence remains in context. The attack is formalized via three necessary conditions (retrieval, generation, citation) constructible without any instructions, raising wrong-answer rate from 0.01 to 0.68 on multi-hop QA, with source deletion confirming the malicious source as causal driver. Vulnerability tracks a model's citation propensity rather than scale, reaching CLR 0.84 with explicit instruction and 0.64 without on the most citation-prone model. Perplexity filtering and citation-support checking prove insufficient; the authors propose a counterfactual defense verifying which source actually drove the answer.

arXiv cs.CR · 2d agoAI safety & security1

TokenRhythm/NeoHorse-1-4B — new model trending #30 on Hugging Face

TokenRhythm releases NeoHorse-1-4B, an Apache-2.0 agentic fine-tune of Qwen3.5-4B claiming +5.93 benchmark macro-average gain.

NeoHorse-1-4B is a roughly 4B-parameter text-only causal language model post-trained by TokenRhythm from Qwen/Qwen3.5-4B for agent harnesses, tool use, coding, and instruction following. It applies routing-guided curriculum SFT and routing-guided on-policy distillation over execution trajectories as an early prototype toward recursive self-improvement (RSI). The release reports a 64.87 macro average across ten benchmarks versus 58.94 for Qwen3.5-4B (+5.93) and is distributed under Apache-2.0, trending #30 on Hugging Face.

Hugging Face trending models · 11d agoModel release1

Knowing What Not to Answer: Selective Non-Compliance in Vision-Language Models

Researchers introduce KoNA, a benchmark exposing vision-language models' failures at selective non-compliance, plus fine-tuning that improves refusal and abstention accuracy.

KoNA is a benchmark for evaluating selective non-compliance in vision-language models across five categories: False Premise, Visual Inaccessibility, Universal Unknown, Task Feasibility and Safety. It tests both query-level and component-level non-compliance using paired single and compound queries, and evaluations across diverse VLMs show models often fail to refuse, correct or abstain appropriately, with failures worsening on compound queries. Fine-tuning VLMs on KoNA examples substantially improves non-compliance accuracy while largely maintaining performance on fully answerable tasks.

Hugging Face daily papers · 12d agoAI research1

Fortunate Recall: Ontology-Driven Memory Lifecycle Management for Persistent Coherence in LLMs

Fortunate Recall introduces ontology-based lifecycle policies for LLM memory, cutting confabulation roughly in half (e.g., 45.1% to 22.4%) versus Mem0.

Fortunate Recall (FR) is a composable policy layer that classifies personal facts into a 10+1 behavioral ontology and applies category-specific lifecycle rules including differential temporal decay, slot-key supersession, event-time validity, and retrieval routing. FR-Bank scores 76.9% on the new 516-question LifecycleBench, ahead of Mem0, A-MEM, Memory-R1, and MemoryOS (61%-70.5%), and 75.2% on LongMemEval-S. End-to-end, confabulation drops from Mem0's 45.1% to 22.4% over answered queries, with the ranking replicating on open-weight Kimi K2.5 and transferring to the independent BEAM benchmark (46.8% vs 32.9%).

arXiv cs.AI / cs.LG / cs.CL · 7d agoAI research

Molecular Déjà Vu: Digit-Level Retrieval of Published Values in Frontier Language Models

Audit of 22 frontier models finds widespread verbatim retrieval of published molecular property values, with higher reasoning increasing recall of memorized numbers.

An arXiv audit tests 22 frontier LLMs across 12 molecular regression benchmarks for verbatim retrieval of published values. More than 50% of the LLMs show verbatim retrieval on five datasets, and identical experiments are flagged 89% more often at a high reasoning level than at the lowest one. Suppressing retrieval moves model prediction errors closer together in relative terms, suggesting predictive capability is not determined solely by memorized values.

arXiv cs.AI / cs.LG / cs.CL · 12d agoAI research1

North Korea-linked IT Workers Are Getting Hired Inside Western Companies

Huntress documented five DPRK-linked FAMOUS CHOLLIMA workers hired by Western companies in 2026 using fake identities, proxies and laptop farms.

Huntress published an investigation of five confirmed 2026 cases of North Korea-linked IT workers, tracked as FAMOUS CHOLLIMA, obtaining remote jobs at legitimate companies in IT, sales, marketing and healthcare. The workers use stolen or fabricated identity documents, VPNs and proxy services, and some were caught using PiKVM hardware-level control, travel routers and laptop farms to mask their true location. Detection relied on document forensics, behavioral anomalies and indicators like identical typo artifacts in electricity bills rather than network intrusions.

Security Affairs · 15d agoThreat actor in the wild

NCP-ArchPreview Technical Report: Moving towards Latent Space Language Models through Next Concept Prediction

An 8.9B-parameter latent-space language model using next-concept prediction matches OLMo-3-7B pretraining loss with only 51.3% of the training tokens.

NCP-ArchPreview augments next-token prediction with Next Concept Prediction over a product-quantized concept vocabulary built from hidden states, trained jointly end-to-end. The 8.9B model was trained on 5.73T tokens from the Dolma-3 dataset, the largest latent-space language model demonstration to date. It consumes 51.3% of the tokens to reach OLMo-3-7B's final pretraining loss and outperforms it by 2.45 points on the downstream macro-average, including a 5.99-point GSM8K gain. The learned latent space also enables lightweight domain adaptation via a 17M-parameter VQ module and improves speculative drafting accepted length by 4.17%.

Hugging Face daily papers · 7d agoAI research1

CoRA-NAS: Coarse Ranking and Anchor-Residual Refinement for Neural Architecture Search

CoRA-NAS combines zero-cost proxy ranking with low-cost learning-curve refinement, achieving the best worst-space Spearman correlation across NAS benchmarks.

The paper proposes CoRA-NAS, a two-stage neural architecture search framework pairing a static ranking prior (CoRA-Rank) with learning-curve refinement (CoRA-Refine) that extrapolates early validation curves for sampled anchors and propagates residual corrections with an ExtraTrees model at about 1% of full training cost. Across NAS-Bench-201, NAS-Bench-101, TransNAS-Bench-101, and NATS-SSS it achieves mean Spearman correlations of 0.946, 0.715, 0.786, and 0.894 respectively, with the best worst-space correlation of 0.715 among compared methods. On NAS-Bench-201/CIFAR-100 its selected architecture reaches 73.32% accuracy versus a 73.37% ground-truth best.

arXiv cs.AI / cs.LG / cs.CL · 6d agoAI research

Enoki: Efficient Multi-Level Hallucination Detection

Researchers introduce Enoki, an open information extraction framework unifying claim-level and span-level hallucination detection in LLMs at lower inference cost.

Enoki extracts text-anchored relational facts, verifies them against evidence, and projects unsupported facts back onto hallucinated spans, so claim-level verification and span-level localization share one representation without separate alignment. It supports LLM-based, encoder-based, and rule-based extraction regimes to balance accuracy against inference cost. Experiments show it stays competitive with strong claim-level systems while using fewer resources and outperforms them on fine-grained span- and entity-level localization. The authors also release EnokiQA, a dual-granularity dataset with aligned claim-level verification and span-level localization annotations.

Hugging Face daily papers · 15d agoAI research

Building Multilingual Bridges: Data Mixing as the Pillar of Generalization for In-Language Reasoning

Tiny Aya L2-Thinker, a 3.35B model, achieves over 93 percent in-language reasoning across 60 languages via optimized multilingual data mixing; weights released.

The paper studies L2 reasoning, the ability to reason consistently in the language of the user's prompt, approached through SFT data composition and scheduling. Tiny Aya L2-Thinker (3.35B) achieves an in-language reasoning rate above 93 percent across 60 languages on six benchmarks spanning math, commonsense, instruction following, open-ended generation, and cultural reasoning. Findings show generalization to held-out languages comes from broader language coverage, multilingual non-reasoning data, and a strong English reasoning backbone, suggesting reasoning is language-agnostic and transferable without per-language supervision. Model weights and multilingual reasoning data are publicly released.

arXiv cs.AI / cs.LG / cs.CL · 7d agoAI research1

IDORacle: Template-Guided SQL-Sink Mediation for Object-Level Authorization in Java Applications

IDORacle intercepts MyBatis/JDBC SQL sinks to block horizontal privilege escalation in legacy Java apps with sub-millisecond guard latency.

IDORacle is a template-guided SQL-sink interception and rewriting framework that prevents IDOR/BOLA horizontal privilege escalation at runtime in Java database applications. It propagates authenticated identity context across HTTP requests, asynchronous tasks, and data-access boundaries via a server-side trace identifier, and computes dual SQL fingerprints at the MyBatis/JDBC boundary to generate reusable mediation plans. On a Java-SQL benchmark grounded in real-world CVE reports, it blocks tested violations with worst-case guard latency of 0.17 ms, reduced to 0.017 ms average for hot templates via redundancy-aware optimization.

arXiv cs.CR · 5d agoResearch1

Show HN: Nari Qwen3-TTS and Qwen3-ASR – High accuracy, low latency and cost

Nari Labs claims top Coval voice AI benchmark rankings with low-latency, low-cost Qwen3-ASR and Qwen3-TTS inference endpoints.

Nari Labs says its Qwen3-ASR Fast endpoint ranks #1 in Coval's time-to-final-segment latency (p50 44 ms) with 3.6% WER at $0.12/hour, behind only AssemblyAI Universal 3.5 Pro on accuracy. Its Qwen3-TTS Fast ranks #2 in time-to-first-audio (p50 63 ms) and #1 in WER at 3.8%, priced at $10 per 1M characters. The company reports beating the official Qwen3 TTS Flash Realtime endpoint (8.8% WER, 692 ms median TTFA) and Baseten's dedicated endpoint (6.0% WER, 101 ms). Public beta APIs are moving to paid general availability with $20 in credits for existing accounts.

Hacker News · security · 2d agoAI tools & infraHN 21↑ · 7 comments

DavidAU/Qwen3.8-27B-TURBO-Fable-Cold-Fusion-735-882-Heretic-Uncensored-NEO-CODER-MAX-MTP-GGUF — new model trending #8 on Hugging Face

A new Qwen3.8-27B GGUF fine-tune claims ARC-C 735 at 8-bit with thinking tokens cut 2x-10x versus the base model.

Independent creator DavidAU released a GGUF fine-tune of Qwen3.8-27B built with Unsloth, claiming ARC-C of 735 at 8-bit and 719 at 4-bit, trending #8 on Hugging Face. The 'TURBO' variant cuts thinking tokens by one half to as much as one tenth while retaining output quality and detail. The repo ships both regular and MTP quants and claims gains over the base model across seven benchmarks, using 'Cold Fusion (GAIN + Unsloth)' and 'Fable Fusion 711' training methods.

Hugging Face trending models · 15d agoModel release

Grandoreiro Resurfaces in Mexico With New DLL Sideloading Campaign

Banking trojan Grandoreiro resurfaces in Mexico using DLL sideloading, now accounting for 40% of detections after its 2024 disruption.

Grandoreiro, a banking trojan disrupted in 2024, is active again with a new DLL sideloading technique. Mexico now accounts for 40% of the malware's detections. The resurgence signals renewed targeting of banking customers in Latin America.

Infosecurity Magazine · 28d agoMalware

NeoMME: an efficient Multimodal-native and Multilingual Encoder

H Company released NeoMME, an efficient multimodal-native and multilingual encoder, via a post on the Hugging Face blog.

H Company published a Hugging Face blog post introducing NeoMME, described as an efficient multimodal-native and multilingual encoder. The article body was unavailable in the feed, so architecture, benchmarks, and licensing details could not be verified. The post suggests a new encoder release relevant to multilingual multimodal model development.

Hugging Face Blog · 13d agoModel release

From Intent to Execution Grant: An Execution-Boundary Conformance Profile for High-Risk AI Actions

Researchers specify EBL-Core, an execution-boundary conformance profile binding AI agent intents, policies, and evidence into verifiable execution grants, validated with bounded tests.

The paper defines EBL-Core, a conformance profile deciding whether one fully materialized AI-generated candidate action may receive action-scoped execution authority. It binds a structured intent object, Root and Operational Policies, typed evidence, and a verifiable Decision Derivation through an Execution Release Contract, with lifecycle rules for Redemption and Revocation. Evaluation included 34 static vectors, 15 lifecycle checks, and 100 trials of 32 concurrent Redemption attempts yielding exactly one winner per trial. The authors state these bounded results demonstrate executability of the specified subset, not production readiness or complete mediation.

arXiv cs.CR · 6d agoAI safety & security1