Containers are no longer a security boundary. Over the past few months, we’ve seen a crazy amount of Linux kernel vulnerabilities and exploits. This has forced us to rethink the security of infrastructure that relies heavily on the underlying kernel, especially containers. As models become more capable, the barrier to escaping a container has fallen so much that adversaries can now generate working kernel exploits in a single shot. CVE-2026-80521 is one such example. We discovered it using dfs-large1 from @depthfirstlabs and generated the exploit in one shot with GPT-5.6 Sol. The exploit still works on the latest Ubuntu 26.04 release because the fix has not yet been backported. Read our full writeup: depthfirst.com/research/cont…

Reverse-Engineering Flock Cameras schneier.com/blog/archives/2…

🚨 Google reveals undercover Mandiant analyst infiltrated TeamPCP during massive supply-chain hacking spree Google says an undercover Mandiant analyst infiltrated TeamPCP's inner circle as the hacking group compromised open-source software and ultimately breached more than 1,000 companies. ⠀ The analyst gained access to TeamPCP's core "CanisterWorm" chat in March, joining a group of roughly 12 members and watching the operation from the inside. ⠀ The mole also gained access to a server containing credentials stolen from victims, including usernames, passwords, and access tokens. Google used that visibility to alert cloud and technology providers, revoke compromised credentials, and send hundreds of notifications to affected organizations. ⠀ The operation also exposed a TeamPCP member developing an AI-assisted zero-day capable of bypassing two-factor authentication in widely used login software. Google obtained the exploit code, verified that it worked after minor modifications, and privately notified the developer so the vulnerability could be patched. ⠀ TeamPCP's campaign compromised hundreds of open-source packages and affected organizations including GitHub, Mistral AI, Mercor, the European Commission, and employee devices at OpenAI. ⠀ Google says operational security mistakes later helped investigators identify an alleged TeamPCP member, with information passed to the FBI. Two Australians accused of being principal participants in TeamPCP were arrested last month.

Operating System powered by Qwen 3.8 27B at 1950 tokens/sec! here is what 1,950 tokens/second @Alibaba_Qwen's 3.8 27b actually looks like on @cerebras: i wrote a minimal python web server that turns cerebras inference into a live operating system. zero apps on disk. when you double click an icon: 1) python proxies a raw SSE stream from qwen 27b at 1,950 tok/s 2) calculator compiles & mounts in 11s 3) full canvas paint studio with brush engine compiles in 10s. at 2,000 tokens/second, software is just an on demand hallucination that runs instantly. the model weights ARE the operating system runtime. what else would you build at 1,950 tokens/second?