SITUATION DETECTED: OpenCode had a security breach last night related to a large scale distillation attack that has impacted 1.4% of console users. They are working with Anthropic, OpenAI and Google to remediate.

We had a security breach last night related to a large scale distillation attack that impacted 1.4% of OpenCode Console users We have notified them all this morning via email. If you did not get an email you were not impacted, it was a subset of users who had external providers linked The incident is ongoing so we cannot share more details at this point but we are working with Anthropic, OpenAI, and Google to remediate

Introducing PwnEscape 🦉: a full KVM guest-to-host escape via a Linux kernel networking flaw affecting industry standard hypervisors. CVE-2026-99999 went from untrusted VM code to host-kernel memory reads, controlled writes, and root command execution. More below:

🚨 BREAKING: An Israeli ad firm called Discover-Tech used targeted ads to infect Al Jazeera devices with Candiru spyware. It also targeted NATO and European Parliament networks. Investigations show the ad firm facilitates multiple mercenary spyware partners.

NEW @citizenlab report We uncovered an Israeli firm using online ads to run vast spy operation This is the first-ever public confirmation of zero-click mercenary spyware delivered via targeted ads. 45 devices at @AJEnglish confirmed infected citizenlab.ca/research/how-d…

.@Volexity has discovered in-the-wild exploitation of a #zeroday exploit chain targeting Ivanti Connect Secure VPN appliances (CVE-2026-104935). Beginning October 3, a previously unknown threat actor, UTA0576, chained three vulnerabilities to gain unauthenticated root-level code execution on a fully patched device. Notably, UTA0576 deployed no malware or web shell. Instead, the threat actor re-exploited the device for every command it ran and tampered with logs to cover its tracks, evading Ivanti’s Integrity Checker Tool. Using its #Volcano memory analysis platform, Volexity analyzed the compromised device’s memory to uncover the full exploit chain and the attacker’s post-exploitation activity, which focused on credential theft, Active Directory reconnaissance, and data exfiltration. Volexity reported these findings to Ivanti through coordinated disclosure. Read the full analysis, including detection guidance and IOCs, in our blog post here: volexity.com/blog/2026/10/13… #DFIR #threatintel #memoryforensics

Ledger was warned last March about implants by hardware hacker @joegrand but apparently did little because no one had yet used implants to steal crypto. That changed last wk with the heist of hundreds of accounts. There is evidence stolen seeds were sent to servers in Hong Kong

We were able to fine tune an open weight model (Qwen3.5-9B) on proprietary internal data at @coinbase, and it out performed frontier models, at much lower cost and speed, for a specialized task (fraud prevention in this case). I think we'll see more of this pattern inside companies. The frontier models are amazing generalists. But increasingly you'll see specialist models out perform on more narrow tasks, either working on teams, or by themselves. We're making it easy to fine tune models internally for our employees. We even have a skill for it in our internal harness that makes it easy to spin these up and start training them: "/fine-tune-and-serve-llm I want to fine-tune Qwen for payments risk review. help me get started" I imagine we'll have some backend services that could be replaced entirely by this new architecture.

Join @attrc, Volexity’s Director of Research, at @BSidesNYC on Saturday, October 17 at 10:00 AM ET (Blue Track). In “Finding Evil Fast: Windows Memory Triage with Volatility 3,” he will share five automated checks for quickly finding malicious activity in Windows memory. See the full conference schedule here: bsidesnyc.org/schedule/ #memoryforensics #dfir #volatility

AI is driving the biggest infrastructure build-out in history, with @Google alone forecasting $200B of capex in 2026E. What are the real constraints on a system at this scale? Amin Vahdat is the chief in charge of Google's buildout. As SVP AI Infrastructure (AI^2), he role spans @GoogleDeepMind, @googlecloud, and the TPU/accelerator hardware roadmap, planning chips 2-5 years out and overseeing a data center buildout of epic proportions. Takeaways: — Why "goodput" per watt is the north star metric and designing around failures: At the 100,000-accelerator scale, something fails multiple times an hour, capacity has to double every six months, and as much of that comes from software and model optimization as from silicon. Hardware is a multiplier that lifts everyone above it — Why Google split TPU into two chips (8I for inference, 8T for training), and the calculus for when a workload is big and durable enough to specialize for — The "bitter lesson of chips," and why the TPU architecture hasn't fundamentally changed since v1 — How DeepMind and the hardware team co-design: delaying a tape-out by two weeks for the right model optimization, and using Gemini to design chips for future Geminis — Long-horizon agents as a new workload shape: no human in the loop to rate-limit requests, and CPU, networking and storage demand going "through the roof" alongside accelerators — Optical circuit switching: mirrors redirecting light to swap a failed TPU rack in milliseconds, without touching a fibe — Why Google prefers grid-connected over behind-the-meter power — Why 7- and 8-year-old TPUs are still at 100% utilization — Open standards, and why IP won the internet as the narrow waist of the hourglass — Orbital data centers: 1.4x the solar power, near-100% sunlight in sun-synchronous orbit, free-space optics between satellites, and "no fundamental showstoppers" — The 2036 rack: multiple megawatts, wheeled in, plug in water, power and fiber Timestamps: 0:00 – Introduction 1:47 – What makes a data center an AI data center 5:30 – Goodput, not FLOPS: holding yourself accountable when something fails every hour 11:52 – Doubling token capacity every six months, and where the gains actually come from 15:32 – The TPU bet: from a contrarian call in 2013 to splitting 8i and 8t 23:30 – The case for and against co-design 26:11 – Shoulder to shoulder with DeepMind: intercepting chips mid-flight 34:16 – Long-horizon agents change the shape of the data center 37:50 – Optical circuit switching and the state of networking 42:35 – Power is the binding constraint: utilities, gigawatts, and sizing a data center 49:23 – Training vs. serving clusters, seven-year-old TPUs, and open standards 58:29 – Orbital data centers and the supercomputer of 2036

🚨 BREAKING: The US is offering up to $10 million for Zhang Yu, a Chinese national accused of being a key figure in HAFNIUM, the Microsoft Exchange hacking campaign the FBI says was directed by China's MSS and compromised 12,700+ US victims. He is also accused of stealing COVID-19 research from US universities.