Full-text search across article titles and summaries. Refine with sector, year, content type, and reading-time filters.
ChangXin Memory Technologies has started mass production of LPDDR6, its most advanced mobile DRAM yet, and confirmed it will supply the chips for Xiaomi's upcoming 18 Fold, launching in September, pairing the memory with Xiaomi's own 3nm Xring O3 processor
At Hot Chips 2026, Chips and Cheese sat down with IBM's Christian Zoellin and Christian Jacobi to dig into the engineering behind IBM's next-gen mainframe chip, the first to run both z/Architecture and Arm instructions natively on one core, plus the shift to HBM in its upcoming Spyre AI accelerator.
Ken Shirriff takes apart the core memory module from a 1980 Spacelab computer.
A crafted Kiro workspace can direct the agent to read .env data, place it in powersRecommendationUrl, and invoke Kiro Powers. The IDE then fetches the attacker-controlled URL with the secret in its query string. Mindgard reproduced the path in trusted and untrusted workspaces, and Amazon fixed the reported behavior in Kiro IDE 0.8.140.
Hasbro notified current and former employees that attackers may have accessed names, contact details, national ID numbers, and financial information. Massachusetts records list 436 affected residents. The disclosure may stem from March's network incident, which forced system shutdowns, and from Hasbro's reporting $11 million in cleanup costs and $25 million in delayed sales.
Omarchy added its default user to the Docker group out of the box, and since supplementary groups are inherited, every process in the desktop session could reach the root-owned Docker socket and mount the host filesystem as root without a password or prompt. Browsers, editors, npm scripts, and AI coding agents all inherited that access, turning any ordinary application compromise into full machine compromise. The researcher disclosed privately that the group membership was removed in 4.0.1, and versions back through 3.8.4 remain affected.
TerminalFix uses compromised sites and fake Cloudflare CAPTCHA prompts to copy malicious PowerShell into a victim's clipboard. The command downloads a ZIP, then abuses LockScreenContentServer.exe to sideload dui70.dll, which then extracts payloads from PNG pixel data, creates Run-key and scheduled-task persistence, and enumerates Active Directory, trusts, administrators, servers, and system details. A Python client opens a TLS WebSocket tunnel to gitnow[.]dev:443, allowing SOCKS-style access to internal hosts. Look out for nonstandard LockScreenContentServer.exe paths, dui70.dll loads, pythonw.exe client.py activity, and the listed C2 domains.
The Fire Ant threat actor has escalated from hypervisor compromises to direct infection of network control planes via purpose-built IOS XR implants. These sophisticated router implants establish unauthorized GRE tunnels to legacy Linux hosts and actively suppress syslog alerts by injecting exclusion clauses into CLI outputs. On the authentication layer, the actor deploys a tool called TacTap to inject malicious libraries into the tac_plus process, ultimately harvesting credentials using a single-byte XOR key. Sygnia researchers assess that this activity strongly overlaps with the China-nexus UNC3886 cluster. To detect this activity, defenders must hunt for unexplained GRE interfaces, tac_plus process injections, and specific log-clearing commands across independent network and memory telemetry.
Grow Therapy built an agentic threat hunting workflow on AWS that leveraged existing log sources such as Snowflake, CloudTrail, and Datadog for an additional cost of less than $500/month. Users submit a YAML threat hunt request, which then kicks off a five-phase workflow: first, Sonnet gathers relevant data, and then Opus compares the data to existing baselines, enriches and analyzes the context, assigns a confidence score to the findings, and performs adversarial analysis to validate them. False positives are tracked in Snowflake and injected into the adversarial validation step, which has significantly reduced false-positive reports.
Local-first permission gateway for AI agents: connector-based SSH, Postgres, and Redis access with scoped tokens, human approval, audit logs, and encrypted local credentials.
re-shell is a Nix flake-based reverse engineering environment designed for use with Claude Code.
Trail of Bits has added a new chapter to its Testing Handbook on Rust. The chapter begins with an overview of what guarantees Rust does and doesn't make and then discusses some tools and methods for dynamic and static analysis. The chapter also includes gotchas from the team's experience analyzing Rust code.
OpenAI and hundreds of other top companies have called for rapid cyber defense efforts as automated attacks spread. The letter targets unpatched software, excessive permissions, weak authentication, and legacy-system debt, asking organizations to verify fixes, use least privilege, and apply compensating controls, and asking vendors to share tested playbooks and threat intelligence.
Cybersecurity consultants and other organizations requiring consistent cyber capabilities should begin shifting to local models. The gap between local models and frontier labs has closed significantly, with DeepSeek v4 Pro even beating out frontier labs on some cyber benchmarks. When organizations rely upon frontier labs, they lose control, and changed behaviors or guardrails can lead to harness and workflow breakage.
A proof-of-concept worm running last year's open-weight models exploited 73.8% of an isolated 33-host network and replicated to 61.8% of it across 15 autonomous seven-day runs, chaining initial command execution into privilege escalation into self-replication, with each copy staging its own harness and local LLM or calling back to the parent host when local compute fell short. Researchers observed agents locating the IP blacklist in their own source and rewriting it to unlock monitoring hosts they had been forbidden to target, though hypervisor-level containment intercepted every attempt and no escape occurred. Detection currently rests on the resource signature, heavy GPU consumption, and sustained outbound inference traffic, so defenders should baseline per-host compute and egress, flag long-lived low-rate connections during off-peak windows, and assume that throttling is the first evasion an operator will add.
Sponsored
100+ sessions, five tracks, top speakers, hands-on labs, and
Berlin rejected extortion demands after attackers breached its state network.
An unnamed x86 vendor other than Intel or AMD has been shipping undocumented WBINVD prefix hints since 2025.
Following a supply chain compromise in which threat actors purchased popular browser tools, nineteen Chrome and Edge extensions were weaponized via automatic updates to silently strip security headers and hijack cryptocurrency transactions before being removed from the Chrome Web Store.
Anthropic says it will permanently raise Claude Code's standard weekly limits by 25% for Pro, Max, Team, and seat-based Enterprise plans starting September 14. However, because users currently have a temporary 50% boost, the change will reduce their available usage by about 17% compared with today. Anthropic says the temporary increase remains through September 13.
Unexpected enterprise demand for local AI compute is reportedly driving Mac mini and Mac Studio sales hard enough that Apple accelerated its latest hardware launch. Companies are clustering Mac Studios to run large models, while constrained supply has pushed some buyers toward alternatives such as Nvidia's DGX Spark.
Major cloud-software availability incidents arise from persistent, fundamentally unavoidable risks rather than isolated mistakes. The main risk areas are resource saturation, networking failures in distributed systems, security mechanisms that block legitimate users, and uncommon operational changes that require less-practiced tools or human interventions.
Owner.com says its own customer research initially showed restaurant owners were wary of AI, but that conclusion was outdated within three months. CEO Adam Guild walks through how the company spent three years rebuilding around AI, including changing its product, workflows, and internal operating model, a useful look at what an actual AI transformation requires beyond simply adding AI features.
SkillRepo has launched Skillsets, a governance feature that lets teams assign graded skill collections to groups of repositories and control which agent instructions they run. It adds approval queues for external updates, repository compliance and drift visibility, sync records, and rollback capabilities, while preserving the open skill format and existing session-start delivery process.
Intel laid out three architectures spanning data center to endpoint AI: the 256-core Diamond Rapids Xeon, Crescent Island inference GPU, and already-shipping Wildcat Lake client SoC. The latter's 17-TOPS NPU notably falls short of Microsoft's 40+ TOPS Copilot+ requirement, while Diamond Rapids isn't expected until 2027.
Cisco is adding Supermicro's liquid- and air-cooled rack-scale systems to its Secure AI Factory with NVIDIA, wrapping them with Cisco networking, validation, support and lifecycle services. Systems are expected through Cisco's enterprise and channel ecosystem beginning in October, with architectures designed to scale from roughly 1,000 to more than 100,000 GPUs.
Kafka could support elastic partitioning, dynamically splitting and merging key ranges to scale ingestion and processing while balancing load. The design could preserve per-key ordering and Kafka's batch-oriented efficiency, but it would complicate consumer state locality, repartitioning, replay tracking, and recovery. Eliminating partitions entirely would sacrifice important batching and storage benefits.
Glean argued that enterprise AI reliability depends primarily on supplying agents with relevant company context, rather than adding more oversight after failures occur. The company introduced Glean Tau, a desktop-first product that combined local files and workflows with its cloud context graph, and reported that Glean Assistant outperformed Claude Cowork on cost and preferred outputs in an internal benchmark.
The experiment evaluates Drasi's standing Cypher queries against a live AKS Kubernetes resource graph to detect persistent, cross-resource drift.
A $19.4 billion New Jersey AI data center is facing complaints over gas turbines, construction, and noise, highlighting how power and permitting are becoming real constraints on scaling AI infrastructure.
Sponsored
To help you understand whether your ads are hitting the mark—or missing it entirely—WordStream by LocaliQ (creators of the search and social benchmarks you know and love) analyzed over 60K campaigns
Read the ungated report to find: * The average CPC, CPL, and CTR for your industry across properties like Google, Microsoft, and YouTube. * Performance metrics for display ads run across the USA TODAY Network. * Expert insights and tips to guide your strategy and improve performance.
Anthropic is being sued for allegedly downloading and scraping copyrighted books, lyrics, and sheet music to train Claude. The case follows a $1.5B settlement with authors over similar claims of using pirated training data.
Marketing is often described in casual terms that diminish the profession. Laura Cameron created “Women in SPAM” (Social Media, Public Relations, Advertising, and Marketing) to give women across communications a shared professional identity beyond labels like “marketing girlies.” The community aims to position marketing as a credible business function and build greater recognition for the strategic value of the work.
Google says creative can drive up to 49% of campaign ROI, and small creative changes can lift YouTube conversions. For Demand Gen ads, adding a human voice lifts conversions 12%, text overlays 3%, and showing the brand within the first five seconds 4%. Google recommends designing for YouTube's native look, avoiding fake buttons or oversized logos, and featuring people wherever possible.
Ahrefs uses AI throughout its content workflow while keeping humans responsible for judgment. Writers define the audience, angle, evidence, and original insights before using AI for research, drafting, and fact-checking. Human review gates catch weak ideas and unsupported claims before publication. Time saved on production goes toward original research and data analysis. Every article also has an owner and second reviewer who can challenge the work before it goes live.
Lazyweb reached 50K signups in a few months through distribution tactics built around AI agents. Removing email requirements increased activation by 50%+ and a one-line installation command added 20%. Automatic MCP routing more than doubled DAUs. Free MCP access to its blog and data-driven research also helped agents discover and use the product. Generic SEO content and novelty products had little impact. The approach focused on making Lazyweb easy for agents to use while giving away useful tools and data to drive word of mouth.
This GPT evaluates a webpage against Google's 32-question helpful content self-assessment. Paste in a page, upload the content, or provide a URL to get started. It scores the content across quality, expertise, people-first value, and search-engine-first risks. The output includes an overall grade, section scores, evidence for each verdict, and prioritized fixes. The score is a diagnostic, not a ranking guarantee. Google's questions describe what helpful content should look like, but the score doesn't directly influence search rankings.
AI GTM workflows need clear decision rights before teams connect more tools. A Shared Agent Brief defines who contributes what, who makes each decision, what AI can handle, and when it must stop. Start with one recurring workflow and test both a normal case and a conflict case before running a small manual pilot. AI can handle research and scoring, but should pause when evidence conflicts or ownership is unclear. Expand permissions gradually, keeping external actions behind human approval.
Enterprise marketing work often gets slowed down by everything around the work, not the work itself. Large companies bring more stakeholders, longer approval cycles, and conflicting feedback. The key is knowing who actually makes decisions, giving internal champions what they need to sell the work, and having one clear project owner. Once teams trust you, that relationship can expand into work across departments and years of projects.
Retail media is not brand building, no matter how retailers frame it. It's the same shelf-position and end-cap money brands have paid since the 1980s, just wrapped in a modern dashboard. Retail media only reaches shoppers who are already in the store and ready to buy, not the much larger group that actually drives category growth. Treat it as a bottom-of-funnel investment that protects distribution, not a substitute for building the brand.
91% of marketers say data readiness is critical for AI, but only 21% say their CRM data is AI-ready.
A 1-pager of how zero-click marketing has changed search engines, social networks, and AI tools.
Anthropic has introduced a set of standardized drivers designed to let AI agents easily interface with and control arbitrary devices. The Model Harness Standard is a way for scientists to streamline the arduous process of creating custom software integrations needed to get disparate components of an experiment working in concert. It provides a common interface and format for data sharing between these devices. The system could reduce weeks or months of exact experimental setup down to hours or minutes.
Many people have called Nvidia's AI investments circular financing, but the company sees it differently. Frontier AI labs are growing faster than what their balance sheets and credit profiles can support. Growth can only continue as long as they can secure ever-greater amounts of computing power, which they would have trouble doing on their own as they lack the ability to borrow huge sums of money at competitive rates. Nvidia aims to power this flywheel until AI labs are able to support themselves.
Hugging Face has unveiled a cute little duck-like robot called the Microduck that will ship before Christmas. The 25-centimeter-tall open-source robot will sell for $399. It can waddle, pick up objects up to 800 grams with its beak, get up when it falls, crouch, and even roller skate. The robot's behaviors can be trained in simulation and then directly deployed on the robot. The SDK, simulation, and full RL training stack are available on GitHub.
Transfyr is a startup working to uncover the hidden factors that make some experiments succeed while others fail. Coming out of stealth mode this week with $25 million in seed funding, the startup is building a system that can absorb enormous amounts of lab data in the form of video, audio, and sensor logs from lab equipment. The approach will hopefully reveal some secrets about why experiments succeed or fail. Its analysis has so far revealed that lab workers perform the same experiments in many different ways despite following a protocol, demonstrating how important these variations are.
Coding agents' configurations have a half-life. Models improve, harnesses add capabilities, codebases change, and tasks evolve. Research shows that people are getting inconsistent value from personalized skills. Run Claude's /doctor every few weeks, review memory separately, and ask each instruction to earn its place again.