Search: “digit-5”

USN-8729-1: Linux kernel vulnerabilities

Ubuntu issued USN-8729-1 fixing Linux kernel vulnerabilities across ARM, Bluetooth, GPU, SCSI, SMB, and Azure MANA subsystems.

Ubuntu released USN-8729-1 addressing several security issues discovered in the Linux kernel that could allow an attacker to compromise the system. Fixes span ARM32/ARM64/PowerPC architectures, Bluetooth, GPU, InfiniBand, and network drivers, plus the Microsoft Azure Network Adapter (MANA) driver. The update also corrects flaws in the SCSI and SPI subsystems, SMB and NTFS3 file systems, EFI core, and file systems infrastructure.

Ubuntu Security Notices·Sep 7, 09:08 UTC · 8d agoAdvisory 6 sources

USN-8742-1: Netty vulnerability

Ubuntu issues USN-8742-1 fixing a Netty DNS cache poisoning flaw caused by improper NS record bailiwick validation.

Ubuntu Security Notice USN-8742-1 addresses a vulnerability in the Netty framework in which NS records are incorrectly validated for bailiwick. An attacker could potentially exploit this to facilitate DNS cache poisoning attacks. Updated packages are available for supported Ubuntu releases.

Ubuntu Security Notices·updated Sep 11, 12:03 UTC · 4d ago·first Sep 10, 09:01 UTC · 5d agoAdvisory 13 sources

Agility Robotics says its new Digit 5 robot can work next to people without safety fences

Agility Robotics unveiled Digit 5, a humanoid warehouse robot that can work safely alongside people without fences, with deliveries from early 2027.

Agility Robotics announced Digit 5, a humanoid robot for warehouses and factories that uses AI and sensors to detect people and stop or step aside without safety fences. It lifts up to 22.7 kg (40% more than Digit 4), charges in 9 minutes for 90 minutes of runtime, and is the first partner for Nvidia's Halos robotics safety platform. Agility cites over $300 million in orders, with first deliveries in early 2027 and production capacity of up to 10,000 units per year in Salem, Oregon.

The Decoder·12:57 UTC · 10h agoAI industry

Agility’s new humanoid robot will stop, squat to avoid harming human coworkers

Agility Robotics unveils Digit 5 humanoid robot that autonomously stops, moves, or squats to avoid harming nearby human coworkers.

Agility Robotics announced Digit 5, its first humanoid robot designed to work safely near humans without isolation barriers, using a safe motion system that reacts to detected human presence by moving away, standing still, or squatting. Early access begins in H1 2027 with general availability by end of 2027. Previous Digit versions have logged over 65,000 working hours, with customers including GXO, Schaeffler, Amazon, and Toyota Motor Manufacturing Canada.

Ars Technica · AI·18:33 UTC · 4h agoAI industry

Claude Fable 5.1 Solves the Cyphral Distich, a 370-year-old cipher

Claude Fable 5.1 solved Sir Thomas Urquhart's 370-year-old Cyphral Distich cipher, recovering a hidden royalist prayer for Charles II.

Vals AI reports that Claude Fable 5.1 solved the Cyphral Distich, a 64-number cryptogram from Sir Thomas Urquhart's Logopandecteision unsolved since 1653, in 44 minutes using 176k tokens with no human hints. The key insight was that the cipher's key was the book itself: each number indexes a word in the corresponding Proquiritation, taking the first letter, yielding 'O GOD UPHOLD KING CHARLS THE SECOND AND MAKE HIM THE SUPREME RULER OF THIS LAND'. The model also deciphered the larger Cyphral Octastich (285 numbers) from The Jewel (1652) using page-based word indexing, recovering all but nine letters of a royalist prayer. The puzzle had been listed among Klaus Schmeh's Top 50 unsolved encrypted messages.

Hacker News · AI·Sep 13, 21:06 UTC · 2d agoAI research 2 sourcesHN 63↑ · 6 comments1· 1 read

Why Johnny Can't Encrypt: A Usability Evaluation of PGP 5.0 (1999)

Seminal 1999 USENIX study finds most novice users cannot correctly sign and encrypt email with PGP 5.0 in 90 minutes.

Whitten and Tygar's USENIX Security Symposium paper evaluates whether cryptography novices can use PGP 5.0 effectively, using cognitive walkthrough analysis and a laboratory user test. The majority of test participants failed to successfully sign and encrypt a message within 90 minutes, despite PGP 5.0 having a well-regarded graphical interface. The authors argue that security requires usability standards beyond those of general consumer software and propose domain-specific UI design principles for security. The paper is a foundational reference in usable security research.

Lobsters · security·Sep 9, 06:47 UTC · 6d agoResearch

Claude Fable 5.1's language is less "load-bearing" than its predecessor's

Arena.ai found Claude Fable 5.1 writes 30% longer answers with fewer em dashes, hedges, and validation phrases than Fable 5.

Arena.ai compared tens of thousands of high-reasoning Text Arena outputs from Anthropic's Claude Fable 5 and Fable 5.1. Fable 5.1's median answer length rose 30% to 414 words (from 319), remaining 21% shorter than Opus 5's 525. Em-dash usage fell from 16.2 to 11.0 per 1,000 words while semicolons rose to 6.09, hedges like 'perhaps' and 'arguably' dropped 36%, and praise appeared in 1.98% of responses versus 3.17%. Long content words fell from 42.6% to 38.6% and abstract nouns declined 25%, suggesting the successor's language is less 'load-bearing'.

The Decoder·Sep 10, 15:26 UTC · 5d agoAI research1

CVE-2026-86287: Net::IP::LPM versions before 1.12 for Perl accept malformed prefix lengths

CVE-2026-86287: Net::IP::LPM Perl library before 1.12 accepts malformed IP prefix lengths, risking incorrect longest-prefix-match results.

Net::IP::LPM versions before 1.12 for Perl accept malformed prefix lengths, per an oss-security disclosure posted September 7, 2026. The lax input validation in this longest-prefix-match library could produce incorrect matching behavior. The fix is available in version 1.12 on CPAN.

oss-security·Sep 7, 18:40 UTC · 8d agoVulnerabilityCVE-2026-86287

openbmb/MiniCPM5-2B — new model trending #4 on Hugging Face

OpenBMB released MiniCPM5-2B, a dense 2B open-weights Transformer claiming 2B-class open-source SOTA for on-device deployment.

OpenBMB released MiniCPM5-2B, the second model in the MiniCPM5 series following MiniCPM5-1B, and it is trending #4 on Hugging Face. The dense 2B Transformer targets on-device, local, and resource-constrained deployment and claims 2B-class open-source SOTA while remaining competitive with 4B-class models. Reported strengths include coding, mathematics, long-context understanding, tool use, and agentic tasks; a tech report (arXiv 2506.07900), GitHub repo, and online demo accompany the release.

Hugging Face trending models·Sep 6, 11:12 UTC · 9d agoModel release

Augustinian BabyLM: What Ostensive Definition Can and Cannot Teach a Small Language Model

Study shows visually grounded token embeddings in a small masked LM persist through training and improve object-property knowledge, but escape standard BabyLM benchmarks.

The paper implements ostensive definition for a small DeBERTa masked language model trained on 10M words, seeding visually grounded tokens with embeddings derived from labeled image regions before training. Visual initialization leaves a persistent, seed-replicated advantage on object-property knowledge (COMPS) and a corpus-tailored Visual-Property Swap benchmark covering color, material, size, and shape, but has no effect on most BabyLM grammar benchmarks. Synthetic grounding of previously unseeded words causally transfers the advantage to exactly those words.

arXiv cs.AI / cs.LG / cs.CL·Sep 10, 17:43 UTC · 5d agoAI research

USN-8736-1: Perl vulnerabilities

Ubuntu issued USN-8736-1 fixing two Perl regex flaws that could cause denial of service, code execution, or security-restriction bypass.

Ubuntu released a security notice addressing two Perl vulnerabilities in regular expression handling. CVE-2026-15534 involves mishandling of large inputs during regex matching, enabling out-of-bounds heap reads or writes that could lead to denial of service or arbitrary code execution. CVE-2026-19487 involves incorrect matching for regexes with alternative branches, allowing security restrictions to be bypassed. Users are advised to apply the updated packages.

Ubuntu Security Notices·Sep 8, 14:25 UTC · 7d agoAdvisoryCVE-2026-15534CVE-2026-19487

USN-8731-1: MiniUPnPd vulnerability

Ubuntu issued USN-8731-1 fixing a MiniUPnPd integer underflow allowing remote DoS or information disclosure via malformed SOAPAction headers.

Ubuntu released USN-8731-1 to address an integer underflow vulnerability in MiniUPnPd's SOAPAction header parsing. A remote attacker could send a malformed SOAPAction header containing a single quote to trigger a denial of service or information disclosure. MiniUPnPd is a lightweight UPnP daemon widely deployed on routers and gateways.

Ubuntu Security Notices·Sep 7, 09:30 UTC · 8d agoAdvisory1

OpenBMB Releases MiniCPM5-2B: A 2.52B Dense Model Averaging 53.9 Across 34 Benchmarks and Built to Run On Device

OpenBMB released MiniCPM5-2B, a 2.52B-parameter Apache 2.0 on-device model averaging 53.9 across 34 benchmarks, ahead of Qwen3.5-4B.

OpenBMB released MiniCPM5-2B, a 2,516,756,480-parameter dense LlamaForCausalLM model with grouped-query attention and a 131,072-token context, under Apache 2.0, runnable via vLLM, SGLang, llama.cpp, and Ollama. It averages 53.9 across 34 benchmarks versus 51.1 for Qwen3.5-4B, with strong tool-use (97.1 on tau2-Bench Telecom) and code results (69.1 LiveCodeBench v6, 46.4 SWE-bench Verified). Training combined 400B tokens of deep-thinking SFT, critic-based JustRL II RL teachers, and on-policy distillation merging 16 RL experts; datasets and intermediate checkpoints were published alongside the weights.

MarkTechPost·Sep 7, 19:18 UTC · 8d agoModel release

Putting models to the secure coding test: Plan vs default mode

Datadog Security Labs tested Sonnet 5, Composer 2.5, and GPT 5.5 to see if plan mode yields more secure code than default mode.

Datadog Security Labs evaluated whether plan mode produces measurably more secure code than default mode. The test covered three frontier coding models: Sonnet 5, Composer 2.5, and GPT 5.5. The results inform how engineering teams should configure AI coding assistants to reduce insecure code. This is an AI security evaluation, not an incident report.

Datadog Security Labs·Aug 19, 00:00 UTC · 27d agoAI safety & security

dealignai/GLM-5.3-CYBERSECURITY-FP8 — new model trending #13 on Hugging Face

dealignai releases GLM-5.3-CYBERSECURITY-FP8, a 753B MoE weight-modified variant cutting refusals on offensive-security prompts, trending #13.

dealignai released GLM-5.3-CYBERSECURITY-FP8 on Hugging Face, a cybersecurity-domain 'crack' of the 753B-parameter GLM-5.3 MoE model, currently trending #13. The release directly edits bf16 residual writers, keeps FP8 routed experts, and serves with stock vLLM on 8x H200 GPUs with 131k context. HarmBench-320 evaluations show 80-84% direct harm compliance and 89% cyber-offense compliance, while MMLU rose 1.07 points to 86.65%. Copyright-verbatim reproduction remains a known soft-refusal limitation, with an UNCENSORED sibling variant offered.

Hugging Face trending models·Aug 30, 10:46 UTC · 16d agoModel release

GPT-5.6-Cyber refuses security researchers’ requests far less often

Help Net Security·Aug 11, 00:00 UTC · Aug 11, 2026Exploit / PoCCVE-2026-15903

openbmb/MiniCPM5-2B-GGUF — new model trending #30 on Hugging Face

OpenBMB released MiniCPM5-2B, a dense 2B on-device model claiming open-source SOTA among 2B-class models.

OpenBMB released MiniCPM5-2B, the second model in the MiniCPM5 series following MiniCPM5-1B, as a dense 2B Transformer built for on-device and resource-constrained deployment with GGUF weights on Hugging Face. The team claims 2B-class open-source state-of-the-art performance, remaining competitive with 4B-class models in coding, mathematics, long-context understanding, tool use and agentic tasks. The release includes a tech report, GitHub repository and online demo, and is currently trending on Hugging Face.

Hugging Face trending models·Sep 5, 01:44 UTC · 10d agoModel release1

The 2026 PNPL Competition: Word Classification and Efficient Cross-Subject Generalisation in LibriBrain100

The 2026 PNPL competition releases LibriBrain100, a MEG speech dataset with 32 extra subjects, targeting word classification and cross-subject BCI generalization.

The 2025 PNPL competition on non-invasive speech decoding from MEG achieved F1-macro scores of 95.6% for speech detection and 73.6% for phoneme classification, built on LibriBrain's ~50 hours of single-subject data. The 2026 edition extends this with LibriBrain100, adding 32 subjects (~40 minutes each) plus ~80 hours of within-subject data. Two tracks target within-subject word classification at scale and cross-subject generalization with subject-specific fine-tuning shrinking from ~40 to ~20 to ~10 minutes, aiming at clinically feasible non-invasive BCIs for people with profound paralysis.

Hugging Face daily papers·Sep 2, 20:00 UTC · 13d agoAI research

HyQuant: Hybrid-Precision Quantization for LLM Attention

HyQuant keeps most LLM attention states low-bit while preserving vertical-line tokens and local windows in high precision, maintaining near-lossless accuracy.

HyQuant is a hybrid-precision quantization framework for LLM attention that quantizes most attention states to low bits while keeping accuracy-critical vertical-line tokens and local-window states in full precision, selected via lightweight attention-pattern signals. In the prefill stage it uses a hybrid-precision attention operator, and in the decode stage it applies the same principle to KV-cache compression with fused dequantization and attention computation. Across diverse tasks, models, and datasets it maintains nearly lossless accuracy; code is available on GitHub.

Hugging Face daily papers·Aug 27, 20:00 UTC · 19d agoAI tools & infra1

Grouped Value Attention: Efficient KV Caching via On-Demand Key Reconstruction

Grouped Value Attention stores grouped values and reconstructs content keys via a learned linear map, cutting KV-cache size about 45-47% versus GQA.

GVA stores only grouped values and reconstructs content keys with a learned linear map absorbed into the query at decode time, while a small shared decoupled RoPE channel preserves positional information via a separately cached positional key. At 350M parameters trained on 30B FineWeb-Edu tokens, the 16-dimensional positional variant scores 44.18 average accuracy across five tasks versus 44.36 for GQA and 43.88 for MLA. Custom decoding kernels are in development with an open-source release planned.

Hugging Face daily papers·Sep 7, 20:00 UTC · 8d agoAI research

PaperCut Zero-Day Exploited in Attacks, Affecting All NG and MF Versions

PaperCut warns of actively exploited zero-day RCE chain CVE-2026-81578 and CVE-2026-82078 affecting all PaperCut NG and MF versions.

PaperCut alerted customers that attackers are actively exploiting a zero-day affecting all versions of PaperCut NG and MF print management software, with confirmed customer incidents and an ongoing investigation. Emergency patches were released for v25 and v26, and the flaw was later identified as an exploitation chain of CVE-2026-81578 and CVE-2026-82078 enabling remote code execution. Shared IoCs include suspicious post-exploitation activity from pc-app.exe and missing, truncated or deleted server.log files with specific database errors. Users with internet-exposed PaperCut Application Servers are urged to immediately restrict access to trusted IPs; in 2023, CVE-2023-27350 (CVSS 9.8) in the same products was exploited by Lace Tempest to deliver Cl0p and LockBit ransomware.

The Hacker News·Aug 31, 06:10 UTC · 15d agoExploit / PoC in the wildCVE-2026-81578CVE-2026-82078CVE-2023-27350

llm 0.35

llm CLI tool version 0.35 adds support for OpenAI's new GPT-6 Astra model exposed as gpt-6-astra.

Simon Willison released llm 0.35, which adds an OpenAI model definition for GPT-6 Astra under the model ID gpt-6-astra. No other release details were provided in the post.

Simon Willison·Sep 7, 23:54 UTC · 7d agoAI tools & infra

IndicTriMix: Developing Language Identification Datasets and Models for Tri-Language Code-Mixing

Researchers release IndicTriMix benchmarks and fine-tuned MuRIL and XLM-RoBERTa models for token-level language identification in tri-language code-mixed text.

The paper formulates token-level language identification in code-mixed text as a sequence labeling task and fine-tunes MuRIL and XLM-RoBERTa transformer models for Indian languages. It evaluates on Hindi, Gujarati, and Bengali configurations with manually annotated test sets and proposes two code-mixed generation approaches using parallel trilingual sentences. A public benchmark, annotated test sets, and fine-tuned models are released for reproducibility.

arXiv cs.AI / cs.LG / cs.CL·Sep 10, 17:36 UTC · 5d agoAI research1

CVE-2026-86219: Authen::SASL::Perl::DIGEST_MD5 versions before 2.2100 for Perl accept replayed authentication responses via unverified nonce in server_step

Authen::SASL::Perl::DIGEST_MD5 before 2.2100 for Perl accepts replayed DIGEST-MD5 authentication responses via unverified nonce handling (CVE-2026-86219).

CVE-2026-86219 affects Authen::SASL::Perl::DIGEST_MD5 versions before 2.2100 for Perl. The server_step function does not verify the nonce, allowing replayed authentication responses to be accepted in DIGEST-MD5 SASL exchanges. The fix is available in version 2.2100 of the perl-authen-sasl distribution.

oss-security·Sep 6, 18:55 UTC · 9d agoVulnerabilityCVE-2026-86219

I've factored the RSA keys of a Certificate Authority from the 90s

Security researcher factored two 512-bit RSA root CA keys from defunct 1990s certificate authority E-Certify using CADO-NFS on a desktop in roughly 30 hours each.

A researcher extracted legacy root certificates from archived Netscape and Internet Explorer installers, identifying two 512-bit RSA roots shipped with Netscape 4.51 in 1999 by the defunct Canadian CA E-Certify. Using CADO-NFS on a Ryzen 9 5950X desktop, the keys were factored in 32 and 29 hours respectively, allowing private key reconstruction. The work comes shortly after RSA-260 (862-bit) was factored, the largest known factorization to date. The researcher also built a legacy TLS server and published keys and tools on GitHub.

Hacker News · security·Sep 8, 01:16 UTC · 7d agoResearchHN 411↑ · 86 comments

USN-8765-1: python-sql vulnerability

Ubuntu patches python-sql SQL injection flaw where values passed to unary operators are incorrectly escaped.

Ubuntu Security Notice USN-8765-1 fixes a vulnerability in python-sql discovered by Cedric Krier. The library incorrectly escaped values passed to unary operators, allowing an attacker to potentially perform SQL injection attacks against applications using the library.

Ubuntu Security Notices·14:39 UTC · 8h agoAdvisory

Mathspace Data Breach Exposes Over 1 Million People

Mathspace breach exposed data of 1,079,819 Australian and New Zealand users via exploited Metabase zero-day CVE-2026-72898; ShinyHunters claimed responsibility.

Mathspace disclosed a breach affecting 1,079,819 students, teachers, staff, and parents in Australia and New Zealand. Attackers exploited the Metabase SQL injection zero-day CVE-2026-72898 (CVSS 10), patched August 6, and accessed Mathspace's self-hosted instance from August 10; ShinyHunters claimed the Metabase hacks. Exposed data includes names, usernames, emails, and login dates; no passwords, academic records, or credentials were taken.

SecurityWeek·Sep 8, 10:47 UTC · 7d agoData breach in the wildCVE-2026-72898

Claude Fable 5.1 made me a really nice animated pelican

Anthropic launched Claude Fable 5.1, claiming gains in coding and long-running tasks, with 52.6% on Terminal-Bench-Science 0.1.

Anthropic released Claude Fable 5.1 (alongside Mythos 5.1), positioning it as a new standard for coding, knowledge work, and long-running problem-solving. The model scores 52.6% on Terminal-Bench-Science 0.1, up from 24.7% for Fable 5, versus 29.0% for Opus 5 and 22.4% for GPT-5.6 Sol. Simon Willison's hands-on test found the model produced an impressive animated pelican, though he notes other benchmarks show only slightly improved scores.

Simon Willison·Sep 1, 23:57 UTC · 13d agoModel release