1 November 2026Northflank breach: rotate every secret you stored on the platform
011 min read
Northflank breach: rotate every secret you stored on the platform
Northflank, a cloud host for applications, containers, databases and AI workloads, told customers on 30 October to treat every environment variable on its platform as compromised. The company acted on a threat alert from cloud security firm Wiz and confirmed that an outsider had reached internal systems and tools; several customers have since reported unauthorised use of AI API keys they had supplied. The instruction is blunt: disable or rotate every key, token and secret held there right away, then check AI provider usage and billing records for charges nobody ordered and report anything suspicious. Because environment variables often hold database passwords, cloud credentials and authentication tokens, exposure can spread well beyond Northflank itself, so customers should also ask what those leaked keys could still reach. Northflank says external security specialists are helping and that it is using large language models in its wider review.
021 min read
Android 'SMS of Death' exploit crashes unpatched phones remotely
Researcher Mark Blah has published a working exploit for CVE-2026-58882, nicknamed 'SMS of Death', a zero-click flaw that crashes Android's telephony process when a handset receives a malformed eight-byte WAP Push message sent as a data SMS to port 2948. The message is handled before it reaches the inbox, so users get no visible clue; calls in progress, including emergency calls, are cut and mobile service drops. According to the researcher, Google fixed the issue in its October 2026 updates for Android 14 through 17, yet the flaw is missing from Google's published October bulletin, and devices still on Android 12 or 13 received no fix. Organisations running older handsets — field staff, kiosks, fleet phones — should verify patch levels and move those devices to a supported, fixed release.
031 min read
Reports: OpenAI cuts fundraising target to $20B as investors cool
Several outlets report that OpenAI has trimmed its latest fundraising. Earlier coverage described a $30 billion round at valuations of $1.4 trillion, then $1.25 trillion, ahead of a planned IPO. The Financial Times reported on Friday that the target is now $20 billion, with a first close expected to come in lower still, led by a group of investors from the United Arab Emirates, and that a later retail offering to wealthy individuals could lift the total. The Wall Street Journal added that about $11 billion is secured and that some large investors responded tepidly. These are press reports, not confirmed figures. The backdrop is telling: investors have grown wary of heavy AI infrastructure spending and tech stocks sold off. Buyers should keep suppliers diversified and treat capacity and pricing plans as provisional.
041 min read
No multi-agent trading design is safe from poisoned signals, study finds
Researchers have carried out the first systematic empirical study in finance of how a poisoned signal travels through an LLM-based multi-agent trading system that controls real assets. Two adversaries are modelled, neither needing access to model internals: one plants manipulated content in the news and social media the system ingests, the other tampers with a single agent's prompt. The authors pair four roles — analyst, researcher, trader and risk manager — with attacks matched to their interfaces, compare four communication topologies, and score how much of the adversarial signal survives into the final decision. Across post-cutoff data on five assets and two target directions, no topology proved inherently robust: majority voting protects only conditionally, and compromising the terminal decision node bypasses upstream safeguards. Firms piloting agentic trading should not assume architecture alone defends them.
051 min read
Calibrated distillation keeps specialist gains while cutting merge time 2.86x
A new paper from a large academic team describes post-training methods for mixture-of-experts models assembled from independently optimised specialists. The approach combines calibrated multi-teacher on-policy distillation, which matches each teacher on a local top-K support with per-teacher loss normalisation and clipping, with an execution path using post-capacity bounded-width dispatch, final-route replay and overlapping rollout and training. On Turing-20B-A2B the integrated model retains at least 90.16% of each specialist's measured gain across four domains, and calibration clearly helps. Under an 8K response cap it beats both shared supervised fine-tuning and Qwen3-8B on four reasoning-heavy maths and code benchmarks, and improves on ten of twelve broader metrics. Consolidation step time fell from 398.7 to 139.3 seconds, a 2.86x speedup — a signal of lower retraining and serving costs for teams merging several fine-tuned models.