2026-08-14
Top stories
- watchTowr publishes a pre-auth RCE chain against NetScaler ADC and Gateway built on a SAML canonicalization heap overflow watchTowr published a pre-authentication RCE chain for NetScaler via a SAML heap overflow with attacker-controlled memcpy source and destination.
- Follow-up: Ars Technica names LiteLLM 1.82.7 and 1.82.8 as the compromised builds and describes memory scraping Ars Technica identified compromised LiteLLM 1.82.7 and 1.82.8 with memory scraping capturing credentials, keys, and environment variables.
- Z.ai documents GLM-5.3 as a post-training-only upgrade over GLM-5.2 and reports 84.5 percent on CyberGym, with the API not yet available Z.ai documented GLM-5.3 as a post-training-only upgrade scoring 84.5 percent on CyberGym, with the API not yet available for use.
- Google ships Gemini 3.7 Flash three weeks after 3.6 at an introductory price that doubles on 2027-01-01 Google released Gemini 3.7 Flash three weeks after 3.6 at an introductory price that doubles on 2027-01-01.
- Christopher Domas releases a technique that flips one DRAM controller bit to reach PSP memory, SMRAM, C6 and microcode on AMD Family 16h Christopher Domas released a technique flipping one DRAM controller bit to reach PSP, SMRAM, C6 and microcode on AMD Family 16h.
AI
- Alibaba releases Qwen3.8-27B under Apache-2.0 as a 27B dense multimodal model, with all card benchmarks self-reported and unverified Alibaba released Qwen3.8-27B, a 27B dense multimodal model under Apache-2.0 with GGUF quantizations the same day.
- Cerebras and OpenAI open a limited Ultrafast preview of GPT-5.6 Sol at up to 750 output tokens per second, with no pricing published Cerebras and OpenAI previewed Ultrafast GPT-5.6 Sol at up to 750 output tokens per second for selected customers with no published price.
- Anthropic's policy page permits training classifiers on Claude outputs and prohibits training competing general-purpose models Anthropic's policy permits training classifiers on Claude outputs but prohibits training competing general-purpose or open-ended text models.
Security
Outages
Languages and runtimes
Linux and kernel
- LWN covers a proposed Linux process-builder API that assembles a process from an empty pidfd instead of forking LWN covered a proposed Linux process-builder API assembling processes from an empty pidfd to avoid copy-on-write cost of forking.
- An open systemd issue reports journald doing about 50 IOPS to write two log lines per second An open systemd issue reports journald write amplification at about 50 IOPS to write two log lines per second.