60
60
35
60
60
XHToken/Spark-X2.5-4B-GGUF — new model trending #30 on Hugging Face
XHToken released GGUF weights of Spark-X2.5-4B, a compact model with 1M-token context and 200+ language support, under Apache 2.0.
The Hugging Face repository provides BF16 GGUF conversions of Spark-X2.5-4B, a compact general-purpose language model for conversation, writing, translation, reasoning, coding, tool use, and agentic workflows. The model uses a hybrid attention architecture, supports a native context length up to 1M tokens, and covers more than 200 languages. Local inference is supported through Ollama and LM Studio via an XHToken llama.cpp fork, with a --think=false flag to disable thinking mode for faster responses. Released under Apache License 2.0; it was trending #30 on Hugging Face at publication.
24
60
30
30
30
30
60
[remote] CVE-2026-80428 Unauthenticated PHP Object Injection via Shibboleth - ILIAS < 9.22, 10.0 < 10.10, 11.0 < 11.3 - RCE
Public exploit released for CVE-2026-80428, unauthenticated PHP object injection via Shibboleth in ILIAS LMS, enabling remote code execution.
Exploit-DB entry 52682 publishes a proof-of-concept for CVE-2026-80428, an unauthenticated PHP object injection flaw in the ILIAS learning management system. The vulnerability is reachable through the Shibboleth authentication integration and can result in remote code execution. Affected versions are ILIAS below 9.22, 10.x below 10.10, and 11.x below 11.3. No evidence of in-the-wild exploitation is stated in the disclosure.
48
Alissonerdx/Minimax-H3-ComfyUI — new model trending #30 on Hugging Face
Alissonerdx released a rank-64 LoRA sharpening videos from MiniMax H3 in ComfyUI via guide-latent conditioning, trending #30 on Hugging Face.
Alissonerdx published Minimax-H3-ComfyUI, a repository containing a rank-64 LoRA (minimax_h3_lms_v1.0_r64) that sharpens source videos while keeping them photorealistic. It targets the MiniMax H3 ref2va base model, runs with Comfy-Org's ComfyUI-ready weights, and uses the native MiniMaxH3AddGuide node for aligned guide-latent conditioning. The release ships with a ComfyUI workflow, eight before/after example videos, and an Apache 2.0 license.
15
Risky Bulletin: Russia tells data centers to deploy drone defenses
Russia ordered data center operators to deploy drone strike defenses under a Putin decree allowing temporary state takeover of unprotected critical infrastructure.
The Russian government instructed data center operators to deploy protections against drone strikes under a presidential decree signed by Putin that allows temporary state administration of critical infrastructure operators failing to defend against Ukrainian hacks and drone strikes. Although data centers are not formally critical infrastructure in Russia, the decree applies to them because other sectors depend heavily on cloud services; Russia has more than 180 data centers, over 80% in the European region within range of Ukrainian strikes. The digest also reports a Dropbox breach affecting nearly 5,000 accounts via the Lenovo ID integration, spyware attacks on at least 14 Serbians using NoviSpy or Pegasus, and a password recovery attack targeting hundreds of thousands of X accounts tied to the new X Money service. Other items include a 14-hour compromise of Coder's Cloudflare infrastructure delivering malicious Terraform modules, donor data breaches at Davayte and You Are Not Alone via the Stripe/WooCommerce integration, a $2.5M Aquifer crypto heist, and a TVING breach exposing data of almost 40 million accounts.
66
30
30
50
42
57
57
57
57
47
57
57
57
30
55
60
60
60
30
55
42
60
60
60
30
57