60 results for “Mage”

Alpine Linux rebuilt its GitLab server and reset all passwords after attackers tried to exploit CVE-2026-97229, a maximum-severity integer overflow in the Onigmo regex engine bundled with Ruby, on October 20-21. Eight worker crashes occurred and four were partially successful. Missing logs and outbound connection records meant compromise could not be ruled out. Alpine had run GitLab 19.3.4, then 19.3.6, which lacked the Ruby patch; the fixed image is alpinelinux/gitlab:19.3.6 with Ruby 3.3.13.

bleepingcomputer.comarticlePublished and added 1 Nov 2026🛡️ Security

Oversecured Apps Care, Part 1 (21 March 2024) publishes scanner results for about 224 Google Android apps, drawn from a wider scan of over 6,000 public APKs from 1,000+ companies. Tables per device image (phone, Wear OS, Android Automotive, Android TV) give package names, three finding counts and report links, including android, com.android.settings, gms and Play Store. It invites researchers to report issues to Google for rewards.

oversecured.comarticleAdded 29 Oct 2026🛡️ Security

Oversecured guide to SDK security in mobile apps, built around Microsoft's April 2026 disclosure of an intent redirection flaw in EngageLab's EngageSDK (50 million installs, fixed in 5.2.1). It covers SDK attack surfaces (exported components, WebViews, deep links, hardcoded secrets, payment crypto), a canhub image cropper file-overwrite example, why source-only SAST misses SDK code, and MASVS and PCI DSS expectations.

oversecured.comarticleAdded 29 Oct 2026🛡️ Security

Aikido Images are free patched PHP container images on public ECR (public.ecr.aws/aikido-dev/php) that backport the PHP2Shell fixes for CVE-2026-109618 and CVE-2026-109619 into release lines 5.5 to 8.5, except 8.0. Upstream fixed 8.2 to 8.5 in October 2026 and left 8.1 and older unpatched. The post shows docker pull and Dockerfile FROM changes, then rebuild, restart, session.upload_progress.enabled=0 and compromise checks.

aikido.devarticlePublished and added 26 Oct 2026🛡️ Security

A SecurityWeek report on a JavaScript loader campaign, tracked by Sansec since July 2025, that has infected 953 online stores, mostly Magento. The actor rotated through five loader domains, the latest being deepveindrilling.com (October 2026) behind Cloudflare, with visitor fingerprinting to hide the payload. Entry points include PolyShell (CVE-2026-48356) and SessionReaper (CVE-2025-54236), and a fully patched store was also infected. Sansec lists cleanup steps.

securityweek.comarticlePublished and added 26 Oct 2026🛡️ Security

RoSA is a finetuning framework from Qiuyu Kong and three co-authors for long-text image-text retrieval. It targets "saliency collapse", where models over-rely on text tied to prominent visual features and miss contextual information. RoSA splits pairs into salient and contextual views using object-level saliency estimation and LLM text decomposition, then trains on both with plug-and-play auxiliary alignment objectives. Code and checkpoints are public.

en.cryptonomist.charticlePublished and added 26 Oct 2026🧠 AI

Hash-only rollup: an OP Stack L2 (chain ID 42069000, live since 30 September 2026) where accounts are keccak-256 hash chains and transactions carry no signatures. Spending uses a commit-reveal step through two new transaction types in op-geth. The post describes a flaw the authors found: unauthenticated commits could be overwritten, which allowed preimage front-running. It was fixed with a first-commit-wins rule on 21 October 2026. It lists the remaining limits: L1 ECDSA, no fault proofs, a centralized sequencer, 160-bit addresses and wallet desync.

ethresear.charticlePublished and added 24 Oct 2026🛡️ Security

The Decisions API is an OpenAI endpoint, built on GPT-6 Luna, that answers bounded questions about text, images or native JSON inputs, up to 10x faster than Luna through the Responses API. It returns a probability (predicate), a choice or a score. It is generally available, accepts up to 400 questions per request, and costs $0.10 per million input tokens with no output charges.

openai.comarticlePublished and added 22 Oct 2026🧠 AI

The PHP Foundation's October 21, 2026 postmortem says Chainguard broke an embargo by publishing patched PHP container images over six hours before the coordinated release of fixes for CVE-2026-109618 and CVE-2026-109619, two critical RCE flaws. The piece covers the leaked CVE IDs, Calif's accidentally published exploit video, Chainguard CEO Dan Lorenc's defence citing exploitation in the wild, and the 2024 origin of the memory management bug.

socket.devarticlePublished and added 21 Oct 2026🛡️ Security

The PHP Foundation explains the 21 October 2026 release of PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, which fix two critical unauthenticated RCE flaws in memory management and error handling, including an OOM problem behind CVE-2026-109618. It covers the 2024 Quarkslab audit, the stalled fix, the August 2026 reports from Calif, OpenAI and Wiz, and the embargo leaks (CVE IDs, a Calif video, Chainguard images). It also lists new security team structure and AI-assisted triage.

thephp.foundationarticleAdded 22 Oct 2026, published 21 Oct 2026🛡️ Security

AnyLanguageModel 1.0 is a Swift package that gives apps Apple's Foundation Models API across the system model, llama.cpp, MLX, Core ML and hosted providers. This release post covers tool calling and guided generation on every provider, image input, and hosted support for OpenAI, Anthropic, Gemini, Ollama and Hugging Face Inference Providers. It also ships swift-huggingface 1.0 and swift-xet 1.0, and lists small open-weight models that fit on iPhone and Mac.

huggingface.coarticlePublished and added 20 Oct 2026🧠 AI

Decrypt reports that Anthropic will commit 5% of its shares to a Public Benefit Fund, structured as a wholly owned LLC, subject to stockholder approval. About 20% of its stock would go to public causes once founder and employee pledges are counted. The article also covers Anthropic's draft AI safety bill, which lets the government block models risking over 50 deaths or $1 billion in damage, and Elon Musk's pledge of one SpaceX share per US child.

decrypt.coarticlePublished and added 19 Oct 2026🧠 AI

Clairic is Cloudflare's preview System One extraction model, hosted on Workers AI as @cf/cloudflare/clairic, with open weights planned. It reads text or images in one forward pass and returns typed values with spans, confidence, p_null, 80% intervals for estimates and forecasts. A claim-handling cascade with Clef and GLM-5.3 ran in 19.3 seconds against 61.7 for an all-LLM version.

blog.cloudflare.comarticleAdded 29 Oct 2026, published 19 Oct 2026🧠 AI

Ethresear.ch post porting Tornado Cash to Flock, a post-quantum binary-field SNARK, proving a depth-32 SHA-256 withdrawal in about 19.5 ms (203.6 KiB proof), with recursive aggregation at about 0.68 s per withdrawal. It also proposes a ZIP 2005-inspired recovery protocol: wallets derive note secrets from a seed, the pool freezes on a discrete-log break, and users withdraw through a post-quantum verifier. Security is argued under an epoch assumption, with Grover-bounded pre-image attacks.

ethresear.charticlePublished and added 19 Oct 2026🛡️ Security

Tom's Hardware reports, citing Politico, that Anthropic is lobbying for a federal AI safety bill based on its Advanced AI Framework. The Commerce Department could seek to block a model release only if it risks $1 billion in damages or more than 50 deaths or injuries. Registered third-party evaluators would report risks within 72 hours, and a D.C. federal judge would decide. Commenters call it regulatory capture.

tomshardware.comarticleAdded 19 Oct 2026, published 18 Oct 2026🧠 AI

AINews issue for 10/15–10/16/2026, covering Twitter and Reddit. It covers the open-weights releases Meta's Muse Spark Open (816B/42B-active MoE, AA Intelligence Index 39, custom license) and Reflection Beam 1.0 (501B/23B-active, Apache 2.0), plus NVIDIA Nemotron 3.5, StepFun Step 5 Preview and FLUX 3 Image Klein. It also covers Gemini 4 Argon, Haiku 5.5 pricing, "decision model" classifiers (Liquid d1-ultra, Perplexity pplx-decider), TPUv7/Vera Rubin/MI355X serving benchmarks, interpretability claims (Qwen3-32B neuron audit), agent research, eval-integrity and safety disclosures, and China export-control proposals. The page also announces a pilot video show, High Taste Testers Ep. 1.

latent.spacearticlePublished and added 17 Oct 2026🧠 AI

Galaxy Research essay arguing that as AI agents become the main way people use the web, the key question shifts from "is this a machine?" to "is a distinct real person behind it, counted once?". It traces CAPTCHA history (distorted text, image puzzles, reCAPTCHAv3 and Turnstile behavioral scoring) and notes ChatGPT Agent passing Cloudflare's checkbox. It reviews Web Bot Auth signatures and Google's AP2 payment mandates, showing both stop at the platform or key and never establish a person. It then covers harms (one-person-one-share abuse, no one to answer for an agent, distorted public counts, collapsing confidence, scaled deception, broken ad economics) and lists the properties a privacy-preserving proof-of-personhood credential needs: strong, private, portable, delegable, accessible.

galaxy.comarticleAdded 16 Oct 2026🧠 AI

SecurityWeek reports Darktrace's findings on CikaBika Bot, a Rust-based RAT delivered via a PDF containing a disk image with an LNK disguised as a Word document. A hidden PowerShell step drops a Nim loader and a Rust DLL that is moved into the protected Edge directory to bypass UAC and sideloaded via DLL search-order hijacking of debugging-library exports. The RAT uses per-victim Discord channels for C&C (recon, command execution, file transfer, screenshots/camera) and exfiltrates ZIPped data via Ngrok.

securityweek.comarticlePublished and added 15 Oct 2026🛡️ Security

Release notes for Apertus 1.5, a fully open (weights, data, training details) continued pretraining of the 8B and 70B Apertus models on 4T and 2T additional tokens. It adds early-fusion image and audio understanding via discrete tokenizers (Emu3.5, WavTokenizer) without architectural change, a thinking mode, 262k context, and better tool use. It documents a four-stage pretraining and five-stage post-training pipeline (SFT, long-context SFT, RLVR, DPO, charter-alignment SDPO), plus evaluation via the MLLM-eval-suite and Every Eval Ever (EEE) Eval Cards, released checkpoints and datasets.

huggingface.coarticlePublished and added 15 Oct 2026🧠 AI

Hugging Face's launch post for Meta's Muse Spark Open, an open-weight 816B-parameter mixture-of-experts model (about 42B active per token). It has 256 experts with 8 routed per token, a 1M-token context, and perception and audio encoders for image, video and audio input. The post gives the architecture details, BF16 and NVFP4 checkpoints, and run recipes for transformers, llama.cpp, SGLang, vLLM, MLX and Inference Endpoints. It also covers LoRA SFT of the full model with TRL on 64 H100s and agentic demos (Pi 3D asset generation, an OpenEnv browser agent, a voice-driven shopping agent).

huggingface.coarticlePublished and added 15 Oct 2026🧠 AI

Hugging Face blog post introducing Black Forest Labs' open FLUX.3 Image Klein (distilled and base checkpoints) in Diffusers. It covers text-to-image, multi-reference image-to-image and bounding-box layout control, FP8/NVFP4 single-file quantized weights, DreamBooth LoRA training scripts for generation and editing, memory/speed figures (about 2 s per 1024×1024 image on an H100), and a detailed architecture tour: Qwen3-VL text encoder, two-stage per-stream then joint transformer blocks, per-token timestep modulation, 4D RoPE, and flow-matching denoising. It also shows how to customise the Modular Diffusers pipeline.

huggingface.coarticlePublished and added 15 Oct 2026🧠 AI

Part 1 of an AWS series showing how to build a quantum-resistant software supply chain with ML-DSA: ML-DSA keys in AWS KMS, an ML-DSA root/subordinate CA hierarchy in AWS Private CA, and IAM Roles Anywhere trust anchors for external build agents. It covers signing binaries (EXTERNAL_MU with OpenSSL 3.5), container images as OCI referrers via ORAS, and SBOMs wrapped in in-toto Statements bound to the artifact digest, plus verification, admission control, trust-store distribution, revocation and SCP guardrails. It frames the "forge later" threat and maps CNSA 2.0 (ML-DSA-87 only for NSS) and EU CRA deadlines to actions.

aws.amazon.comarticlePublished and added 12 Oct 2026🛡️ Security

Latent Space interviews Standard Bots' CEO Evan Beard and Head of AI Leif Jentoft about the AI stack behind its industrial robot arms. A shared base model (low billions of parameters) is adapted per customer through demonstrations and fine-tuning. A zero-shot perception model, whose backbone is trained on over a billion images, handles machine tending, while conventional code handles motion and cell logic. Inference runs on-premises on edge GPUs that stream action chunks to low-level control. Failures and human corrections feed fleet learning except in air-gapped defense deployments, and the StandardOS APIs/SDKs let developers bring their own models such as NVIDIA Cosmos. The lesson is to keep the model's role narrow and use targeted, high-quality data to fix edge cases instead of chasing dataset size.

latent.spacearticlePublished and added 10 Oct 2026🧠 AI

AINews issue for 10/8–10/9/2026 from Latent Space. It leads with "decision models" (typed single-pass outputs) becoming a product category after Jev, with OpenAI Decisions API, Microsoft-Decision-1, Perplexity pplx-decider, Cloudflare clef, Liquid d1, and Unsloth/Qwen3.5 training recipes. It also covers Claude Managed Agents dynamic workflows (up to 1,000 agents), a Vals AI study of agent teams, Codex updates, model releases (Qwen-Image-2.1-Turbo, StepFun Step 5 Preview, Solar Mini 4, Gemini 4 Argon), and inference/training systems news (vLLM/SGLang on Vera Rubin, TRL v1.15, DeepSeek stride weak spots).

latent.spacearticlePublished and added 10 Oct 2026🧠 AI

A Hugging Face blog post describing hands-on use of "ML Intern," an agent in HuggingChat that plans a training job, asks for a spending budget, runs a smoke test, then fine-tunes, evaluates and publishes a model to the Hub. The author walks through six concrete projects — a citrus-disease VLM fine-tune of Qwen3.5-2B, a Huggy character LoRA on FLUX.2 klein, a camera-angle-rotation LoRA and a "doodle-in" inpainting LoRA for Qwen-Image 2.1, and two distilled text-to-image/text models (a 0.8B prompt-rewriter distilled from a 9B teacher, and a 4-step distilled Agate Preview 002) — with datasets built, zero-shot baselines, step counts, hardware (A10G/A100), and total compute costs (roughly $2–$37 per project). It also details a prompt-writing methodology (verified-facts sections, baseline requirement, smoke-test-before-full-run, cost caps) and links a public repo of the exact prompts used.

huggingface.coarticlePublished and added 8 Oct 2026🧠 AI

Decrypt reports on Google October launch of Nano Banana 2.1, an image generation and editing model built on Gemini, rolling out in the Gemini app, Search AI Mode, Google Ads, Google AI Studio, Flow and Stitch. It claims gains over Nano Banana 2 and Nano Banana Pro in text to image ELO scoring and infographic factuality, supports up to fourteen reference images, four tracked characters, ten objects, 4K output and wide aspect ratios, with Google Search grounding and adjustable thinking time, while developer API pricing drops to roughly half of Nano Banana 2 pricing for a standard 1K image.

decrypt.coarticlePublished and added 6 Oct 2026🧠 AI

Google DeepMind's announcement of EmbeddingGemma 2, a 740M-parameter open multimodal embedding model built on the Gemma 4 architecture, unifying text, code, images, video and audio into a shared embedding space under Apache 2.0. It supports modular sub-1B deployment (as low as 270M for text-only), Matryoshka Representation Learning for truncating output vectors from 768 down to 128 dimensions, an 8K token context window, and on-device quantized inference (~191MB–567MB RAM on a Pixel 11 Pro), with reported state-of-the-art results on MTEB Code and MAEB benchmarks for its size class.

deepmind.googlearticlePublished and added 6 Oct 2026🧠 AI

The Ethereum Foundation and the Open Anonymity Project launched zkAPI on Ethereum mainnet: users deposit ETH or USDC into a vault contract, then generate a zero-knowledge proof of sufficient, unspent funds to obtain a capped, short-lived API key, letting them call AI models through OpenRouter without the provider linking their prompts to a billing identity. The protocol (based on a February 2026 Ethereum Research proposal by Davide Crapis and Vitalik Buterin) issues signed usage receipts after the key expires to settle actual spend, and ships with a browser chatbot (OA Chat) and an open GitHub repo; it is explicitly labeled experimental with no formal audit yet. The same proof-based metering pattern is proposed for other metered services like blockchain data queries, image/video generation, and machine-to-machine payments.

decrypt.coarticlePublished and added 2 Oct 2026🧠 AI

Latent Space AINews digest reports on Pi 1.0 and Pi Durable, an agent harness from the Earendil team ported to TypeScript that externalizes agent state for crash recovery, pluggable storage (Memory/SQLite/JSONL), concurrent branching conversations, hot-swappable tools, and multi-user state sync alongside conversation transcripts. The rest of the issue recaps frontier launches: Gemini 4 Argon, OpenAI efficiency-focused GPT-6.1 Sol (with Artificial Analysis cost comparisons against GPT-6 Sol and GPT-6 Astra), Upstage Solar Mini 4 (35B/3B MoE, 1M context), Black Forest Labs FLUX 3 image model, and Tavus Griffin video-to-video conversational agent.

latent.spacearticlePublished and added 2 Oct 2026🧠 AI

A Latent Space AINews digest covering AMD's 8.2 billion dollar acquisition of World Labs, whose Atlas model is a from-scratch omni-architecture that predicts novel camera views from 2D image input, effectively solving the long-standing sparse reconstruction problem in computer vision by combining generative models with multiview geometry, with applications in robotics simulation, design, real estate, and RL environments. The issue also recaps the Claude Sonnet 5.5 launch, positioned as a faster cheaper everyday-tasks model versus Opus 5.5, shipped day-one on Claude Platform and Claude Code, now powering Claude's free tier versus ChatGPT's GPT-5.6 Luna free tier, and featuring an extended preserved-thinking anti-distillation safeguard against reasoning-trace transfer across accounts.

latent.spacearticlePublished and added 29 Sep 2026🧠 AI