Tag
Apple CEO John Ternus says the company cannot predict when iPhone Duo supply will meet demand, citing unprecedented memory pricing and ongoing supply chain constraints. Apple reported record Q4 iPhone revenue of $57.58 billion despite price increases across its lineup.
Security researchers at Hacktron disclosed a chain of 26 vulnerabilities in GNU Savannah (the forge hosting Bash and Coreutils), including an email-address shell injection that granted RCE, superuser access, and the ability to push to the upstream Bash repository; the FSF has since fixed the issues and published an incident report.
San Francisco entrepreneurs and hardware designers highlight how China's Shenzhen manufacturing ecosystem enables far shorter hardware innovation cycles than the Bay Area, with rapid prototyping and tightly specialized local factories. Harman reportedly moved its design team to Shenzhen and saw faster shipping and award wins as a result.
Backdoored builds of the Anthropic.claude-code extension briefly appeared in Cursor's marketplace, potentially reaching up to 5,000 users via auto-update, installing SSH backdoors and persistence mechanisms that survive simple updates or uninstallation.
Thieves are stealing over $100 million worth of AI data-center equipment (GPUs, servers, copper) by spoofing GPS coordinates and hijacking freight-broker accounts amid the AI boom. Experts warn the crime is scaling globally as stolen high-value components are sold abroad.
A write-up shows that trusting a Git pre-commit hook file doesn't make the code it launches trustworthy — hooks can invoke npm scripts from package.json that an agent may have modified, allowing code execution to escape the agent's environment. Demonstrated with plain Git for Windows, no agent sandbox was directly tested.
Anthropic 的官方 Claude Code VS Code 扩展在 Cursor 市场被植入后门近 12 小时，恶意版本 2.1.313 通过官方账户分发，最多影响约 5,000 名开发者，可安装持久化 SSH 后门并访问本地文件与源代码。Anthropic 至今未向客户发布公开通知。
Tim O'Reilly shares a New Yorker article arguing that the global semiconductor supply chain is one of humanity's greatest collective achievements, demonstrating that international cooperation and trade achieve far more than national rivalries.
A malicious actor used access to Cursor's marketplace to publish a tampered copy of the Claude Code extension, prompting questions about whether the extension was distributed through OpenVSX. Anthropic clarifies the incident did not compromise its own systems or employee laptops.
The official Claude Code VS Code extension was compromised in a supply-chain attack that installed a persistent SSH backdoor on affected machines, highlighting ongoing risks in the software distribution ecosystem.
Report of backdoors discovered in the Claude Code for VS Code and Cursor editor extensions, highlighting a supply-chain security incident affecting popular AI coding tools.
Solugen, a startup originally making petroleum-industry chemicals, has pivoted to producing HMX and RDX energetics for the US military, addressing a bottleneck where the US relied on a single aging WWII-era plant in Tennessee. The company claims a 100% CONUS energetics supply chain and can already produce a tenth of the legacy plant's output.
Intel在其最新财报电话会议上表示，预算级Wildcat Lake笔记本芯片的需求已超出供应，目前处于售罄状态。同时Intel警告内存短缺短期内不会改善，预计将持续到2027年甚至更久。
Rumors suggest that manufacturers like HP, ASUS, Dell, and Foxconn may be moving their production lines back to China, and the author is puzzled, asking whether something significant has occurred.
Anduril now claims its BlueChip laptop, co-developed with Qualcomm and launching in 2027, will have at least 65% of components made in the US at launch to meet Buy American Act standards, a commitment the company hadn't made earlier in the week.
Alpine Linux reported a security incident in which an attacker attempted to exploit critical GitLab vulnerability CVE-2026-97229 (a CVSS 10.0 bug in Ruby's Onigmo regex engine affecting CI configuration parsing), prompting a full rebuild of its GitLab instance and password resets. The post warns that upgrading GitLab alone is insufficient because the fix lives in a bundled Ruby patch, requiring Ruby 3.3.13/3.4.12/4.0.9 or later.
As of October 28, Apple's macOS developer tools including git, curl and python3 still trust the compromised eMudhra certificates, and macOS 27.2 reverted manual workarounds, leaving HTTPS connections and credentials potentially interceptable while other projects shipped fixes earlier.
NVIDIA has open-sourced SkillSpector, a tool designed to statically scan skills for Claude Code, Codex, and MCP, with optional review by a large language model, to detect risks such as prompt injection, data theft, and supply chain poisoning. Scan results show that roughly a quarter of more than 30,000 skills contain vulnerabilities.
SK Hynix expects demand for its memory chips to outpace supply through 2030, signaling that already high RAM prices may climb further amid AI-driven demand.
一个评分 9.5/10 的严重 UEFI 固件漏洞（CVE-2026-97631）出现在几乎所有服务器厂商使用的 TianoCore EDK2 代码库的 ICMP 组件中，可在 Secure Boot 生效前执行代码，且补丁已提前泄露。