News linked to both this project and an event.
Odaily reports: Cursor, the AI coding tool under SpaceX, posted on X: "We have discovered a security incident affecting a tampered Claude Code VS Code extension accessed through our Cursor IDE extension marketplace, affecting up to 5,000 users. This malicious extension version was not developed by Anthropic, and it does not affect other extensions downloaded from the official website, Grok Bot, Grok, or our other SpaceXSI products.In response, we shut down the extension marketplace this afternoon, worked with the relevant service providers to remove the malware, and reopened the marketplace after confirming there was no further risk. If you are affected, please refer to the instructions in the official blog post to learn how to identify the malicious package and take measures to mitigate any potential impact. We have asked all customers to update Claude Code for VS Code to version 2.1.314."
Odaily reports: PHP has issued a security advisory regarding two previously disclosed critical remote code execution (RCE) vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619. Attackers may exploit these vulnerabilities to execute malicious code without authentication, and PHP officially strongly recommends that all users upgrade immediately.These vulnerabilities affect PHP environments that handle web requests, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed. Among these, Apache mod_php poses a particularly prominent risk, as attacks can be triggered before application code runs.Official patched versions have been released: PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Users still running PHP 8.1 or earlier should contact their distribution or long-term support (LTS) vendor to confirm patch availability, or upgrade to a supported version. Officials emphasize that temporary mitigation measures cannot fully eliminate the risk—installing security updates immediately is the only complete way to address the vulnerabilities.
Odaily reports: AI cloud service provider CoreWeave has announced the launch of Physical AI Launchables, unveiled at the NVIDIA GTC Berlin event. The product offers physical AI workload templates built and tested by CoreWeave engineers, aimed at robotics, autonomous vehicle, and simulation teams, enabling task launch via a single command and reducing upfront preparation work such as environment configuration, storage setup, and task scheduling.The first batch of templates covers five tools—NVIDIA Isaac Sim, CARLA, MuJoCo, NVIDIA AlpaSim, and NVIDIA Cosmos 3—supporting workflows such as data generation, model evaluation, and policy training, and integrating Cosmos Data Factory-related agent skills usable for video, image, and text data augmentation, auto-labeling, and data curation. The platform also provides specially optimized skills for coding agents such as Claude Code and Codex, supporting automatic task launch, run-status monitoring, and result retrieval.CoreWeave is also collaborating with physical AI software vendors including Cadence, Encord, and Voxel51 to bring related products onto its cloud infrastructure.
According to an Oracle announcement, the company has launched the Industry Application AI Agent Studio, a no-code and low-code platform designed for industry applications that can be used to create, test, orchestrate, deploy, and manage AI Agents and multi-agent workflows. Built on Oracle AI Agent Studio for Fusion Applications, the platform can access existing application data, tools, and business processes, and supports features such as natural language and visual orchestration, cross-application workflows, Model Context Protocol (MCP), multiple generative AI models, testing and debugging, security controls, lifecycle management, and monitoring.
SlowMist has issued a security alert stating that PHP released a security advisory on October 20, disclosing two critical security vulnerabilities that could lead to remote code execution (RCE), tracked as CVE-2026-109618 and CVE-2026-109619, both with a CVSS v4.0 score of 9.2. Currently, PHP officials have not yet released a fix patch, and the specific affected versions and exploitation conditions remain to be confirmed.According to available information, PHP officials plan to release a security update on October 21 at 14:00 UTC (22:00 Beijing time). SlowMist recommends that relevant organizations promptly check the PHP versions in their servers and business systems, with particular attention to PHP services exposed to the public internet, and upgrade in a timely manner once the patch is released; systems that cannot be upgraded immediately should restrict access sources and take isolation measures when necessary.
According to the Anthropic official website, Anthropic announced the opening of its fifth Asia-Pacific office in Singapore and signed a Memorandum of Understanding (MoU) with Singapore's Ministry of Digital Development and Information. The two parties will collaborate in areas such as AI safety, model evaluation, and responsible AI adoption. Singapore is one of Claude's most active global markets, where over a thousand government agencies and enterprises, including GovTech Singapore, DBS, Grab, and GIC, have already deployed Claude. Among them, over 1,500 engineers at GovTech Singapore have adopted Claude Code to advance government system modernization, while Grab leverages Claude-driven sales assistants to save approximately 40,000 labor hours per quarter.
According to Durov's Code, Telegram is expected to launch a new cryptocurrency wallet, Gram Wallet, in the latest version 13.0 update, though the service has not yet been officially opened to users. Meanwhile, the original Wallet service has been renamed Walt and moved from the settings menu to the mini-app interface, with existing accounts and assets remaining unaffected.
security firm CrowdStrike released an intelligence report stating that an unidentified hacker, between late September and early October, combined large language models (LLMs) with the domestic open-source AI penetration testing tool ARTEX to launch targeted cyberattacks against multiple South Korean financial institutions and steal data.After analyzing the hacker's exposed open directory, it was found that they employed a dual-server architecture centered on a Hong Kong IP, and used models including Claude Code, GLM-5.3, Grok 4.6, and DeepSeek v4.1-flash accessed through an API proxy to orchestrate the attack process. The hacker also asked Claude how to monetize the leaked South Korean data in Telegram groups. According to estimates by South Korean media, at least seven South Korean financial institutions were attacked, including KB Kookmin Bank, Shinhan Bank, and Hana Bank, with personal data of approximately 68,000 people leaked, involving sensitive information such as annual income and loan limits.
Odaily News: Zcash developers are integrating parts of the scaling project Tachyon's code into the Zakura Common cryptography library, with a new component called Udon released on Monday. Tachyon lead Sean Bowe stated that Udon was previously developed as part of Tachyon and has now been added to Zakura Common to leverage the library's existing performance optimizations.The long-term goal set by Bowe and Dev Ojha, lead at Valar Group, is to achieve over 50,000 private payments per second. Tachyon aims to reduce the amount of data that Zcash nodes need to receive and verify by merging proofs from multiple transactions into a single proof. However, the upgrade has not yet been activated on the Zcash network.According to ZecStats data, in the 7 days ending September 28, Zcash averaged approximately 6,200 transactions per day involving shielded funds, down from an average of approximately 11,700 per day in the 7 days ending September 21. (CoinDesk)
Odaily reports: Solana founder Toly posted on X, stating: "AGI (Artificial General Intelligence) is still a long way off. As for my test project Percolator, if I were writing the code full-time myself, it would probably already be launched by now. The area where AI performs best is in the design and specification research phase, as well as fuzz testing to find bugs. If that approach were adopted, code quality would likely be better. But the number of good products actually brought to market today is unlikely to be greater than before the era of large models."Previously, Toly announced last year that he would launch Percolator, a next-generation perpetual futures decentralized exchange built on Solana. It uses a sharded order book, executes at speeds comparable to centralized exchanges (CEX), and is fully open-source.
According to monitoring by PPP prediction market tool, the probability on Polymarket of "the next Grok model (4.7 and above) being released before September 18" is now reported at 15%, down 38% in 24 hours.If, between the market's creation and September 18, SpaceXAI releases the next Grok model to the public and its version number reaches 4.7 or above, the market resolves as "Yes"; otherwise, it resolves as "No."Qualifying models must simultaneously meet the following conditions: the name or model identifier must include "Grok," and the version number must be 4.7 or higher—for example, Grok 4.7, Grok 4.7 Heavy, and Grok 5 all count; Grok 4.6 and its updated, snapshot, or promotional versions do not count. Standalone product lines such as Grok Code Fast and Grok Imagine also do not count, nor do the version numbers of the App or website itself.In addition, the model must genuinely be open to the public. Public testing or a rolling waitlist that anyone can apply to join may count, but closed beta, private invitations, or internal access do not count. It also does not count if text such as "Grok 4.7" merely appears on the website but the model is in fact not publicly usable.The main basis for judgment is official information from SpaceXAI, supplemented by credible media reports for verification.Join the PPP signal push community to stay one step ahead and seize the initiative.
: On September 9, Bulgaria's National Assembly passed amendments to the Tax and Social Security Procedure Code with 149 votes in favor, 0 against, and 10 abstentions, which will allow the Bulgarian National Revenue Agency to obtain detailed information on crypto asset users. The bill was approved by the 240-seat parliament.The amendments implement two European Union (EU) directives, requiring crypto asset-related businesses to register and report to the Bulgarian National Revenue Agency users' names, addresses, dates and places of birth, tax residences, and tax identification numbers, as well as to submit transaction data for various types of crypto assets, including gross amounts received, number of transactions, number of fiat buy and sell transactions, and crypto asset exchange activity.Privacy advocates criticized the scope of data collection as overly broad, arguing that mandatory disclosure of personal information could pose security risks. Crypto traders and small businesses said the registration and reporting requirements will increase compliance costs; supporters of the bill argue it aligns with EU standards and helps curb tax evasion. The relevant directives require EU member states to complete adoption by December 31, 2025. (Bitcoin.com News)
Odaily News: Microsoft (MSFT.O) has released an interim code of conduct imposing restrictions on AI models, just days after the heads of Anthropic and OpenAI agreed to slow down development pace.The company hopes to be seen as a responsible AI player, and it is one of the leading cloud service providers. "We've received feedback from people who want to see clearer commitments: that AI always serves humanity rather than trying to replace it," Mustafa Suleyman, who oversees the company's model development, said in an interview with CNBC. "We've received a great deal of feedback emphasizing that AI should not create dependency, should not be sycophantic, and should always promote human judgment, autonomy, and agency." Suleyman said that although these guidelines had been in the works for about five months, Microsoft chose to release them now given the recent discussions they have sparked. (CNBC)
Odaily News: According to HyperliquidNews monitoring, HIP-3 market deployer Entropy spent 500 HYPE (approximately $38,950) to win the code DRAM, and is expected to launch io:DRAM perpetual contract trading.
The Moonshot AI Kimi K2.8 Preview model has been fully deployed to Kimi Code. The Model ID remains kimi-for-coding, enabling clients and third-party tools to use it directly without configuration changes. According to the official team, the model's comprehensive performance approaches that of K3, with enhanced coding and agent capabilities, and significantly improved reasoning efficiency compared to K2.7 Code. Kimi K2.8 Preview supports the same thinking effort level adjustments as K3, offering three settings: low, high, and max (defaulting to max). All membership tiers now provide access to a maximum 1M context window.
AI 3D company VAST (Sanqi Wanwu) has announced the completion of Series B and Series B+ financing rounds, totaling approximately 3 billion yuan, led by Matrix Partners China. Perfect World, BlueFocus, Singdun Energy Investment, Yanqu Games, ThunderSoft, 37 Interactive Entertainment, as well as CDH VGC, CICC Capital, CMC Capital and others participated as co-investors, with existing shareholders Fortune Capital, Primavera Capital, and Source Code Capital continuing to follow up. According to official sources, VAST has raised approximately 5 billion yuan in cumulative financing in less than six months.It is also reported that VAST has released the latest version of its flagship 3D foundation model, Tripo P2.0, from the Tripo P series. The funds from this round of financing will be invested in the iteration of 3D native models and data capabilities, expansion of training and inference infrastructure, product development, and commercial implementation. (Sina Finance)
Anthropic has upgraded the computer control capabilities of Claude Cowork and Claude Code, supporting click, input, and navigation operations via screen interaction while running in the macOS background. This feature requires devices to run macOS 15 or later, with the display kept awake and the Claude Desktop application open. Currently, this functionality is exclusively available to Pro and Max individual subscribers, while Team and Enterprise plans are not yet supported.
Odaily News: Numa Lunah, co-founder of the crypto project Refi Hub, stated that he was hacked after using a download link provided in a Claude chat window to install a transcription application. The link pointed to a fake website bundled with malware, which attempted to steal all information from his device upon execution.Numa Lunah said he wiped and reinstalled the affected laptop and found no signs of sensitive data leakage. Subsequently, he discovered a contaminated Claude Code skill file named SKILL.md in his backups. The file was disguised as a style guide written by himself and contained instructions to re-download malware and steal credentials every time it was loaded.Microsoft Defender Experts previously warned that attackers have shifted from search engine optimization poisoning to large language model response poisoning. These tactics include recommending attacker-controlled download links, AI-branded fake installers, and contaminated code repositories and agent skills. Individuals working in the crypto industry may hold irrevocable credentials such as mnemonic phrases, private key files, hot wallet JSONs, exchange API keys with withdrawal permissions, and deployer keys. (Bitcoin.com News)
According to Decrypt, privacy-focused Bitcoin wallet Sparrow Wallet released version 2.5.4 on August 28. Developer Craig Raw stated that the update was driven by an AI-assisted code review, with the majority of fixes originating from it. This review was prompted by the recent seed generation code vulnerability exploit affecting Coldcard, as well as the release of unrestricted AI models in China, which has significantly enhanced vulnerability scanning capabilities across large codebases. Key updates include: validating the authenticity of transactions returned by Electrum servers, enforcing stricter BitBox02 hardware wallet security requirements (firmware v9.4.0 or higher required), patching local DNS leaks, and masking sensitive credentials in debug logs. Raw noted that there are no indications of any exploits being leveraged, user funds remain secure, and he still advises all users to update at their earliest convenience.
Odaily News: Qualcomm Technologies announced the launch of the Qualcomm Intelligent Multimedia SDK (IMSDK) 2.0, providing a unified development framework for AI and multimedia application development based on the Qualcomm Dragonwing platform.Qualcomm stated that IMSDK 2.0 is designed to help developers build intelligent applications on edge devices that integrate generative AI, multimedia processing, and real-time analytics capabilities, consolidating AI model inference, cameras, audio, video, sensors, and cloud connectivity into a single development environment, covering scenarios such as intelligent cameras, industrial robots, drones, and IoT devices.The new SDK introduces a Pipeline API and application building tools for Python and C++, reducing developers' reliance on underlying multimedia frameworks. Additionally, IMSDK 2.0 supports multiple AI inference paths, including the Qualcomm AI Runtime SDK (QAIRT), ONNX Runtime, and TensorFlow Lite, and can run models on CPU, GPU, or NPU as needed.Furthermore, IMSDK 2.0 introduces Coding Agent Skills for AI programming assistants, Documentation as Code, and containerized microservices capabilities, helping developers complete application building, debugging, deployment, and optimization through natural language instructions.