Data graphic: Ivanti Connect Secure 22.8R2.5 is no longer enough: CISA now lists 22.8R2.5 and prior as affected, and on 30 October it added CVE-2026-111357 CVSS 3.1, 7.0 High and CVE-2026-118527 no NVD or CVE.org record to KEV. The diagram shows the chain per Volexity: welcome.cgi path bypass CVE-2026-104935 , wu.cgi upload race, dsinvoked trusts cache CVE-2026-111357 , then root.

CISA Adds Two More Ivanti Connect Secure Flaws to KEV as Links in the CVE-2026-104935 Exploitation Chain

CVE-2026-111357 (root via dsinvoked) and CVE-2026-118527 join KEV on 30 Oct. CISA now lists 22.8R2.5 as affected, so the earlier patch is not enough.

Read the story Research desk

Data graphic: dot plot of word error rate lower is better from NVIDIA's own model card, Nemotron 3.5 Transcribe against its closest rival on three separate tracks: 4.71 vs 4.94 for Qwen3-ASR-1.7B in English a near tie, 0.23 points , 4.62 vs 6.49 for Qwen3-ASR-1.7B in multilingual 1.87 points , and 10.98 vs 13.37 for Parakeet-TDT-0.6B-v3 in long-form 2.39 points . A callout notes the BF16 weights are 67.5 GB.

watchResearch Nvidia Nemotron 3 5

Nemotron 3.5 Transcribe Posts 4.71% English WER in Open Weights, and Fits a 32 GB GPU Only in 4-Bit

NVIDIA's open-weight speech model beats Qwen3-ASR and Parakeet on its own card, but BF16 weights are 67.5 GB. Which formats fit 16, 24 and 32 GB cards.

Data graphic: LFM3-1.7B vs Qwen3.5-9B. By Liquid AI's own figures, the 1.7B model wins three of six benchmarks against a roughly five-times-larger model, but trails by 17 points on GPQA Diamond 63.37 vs 80.40 and on RULER 128K long context 65.56 vs 87.11 .

watchResearch Liquid Ai

LFM3-1.7B vs Qwen3.5-9B: The 1.7B Model Wins on Tool Calls, Then Loses on Reasoning and Long Context

Liquid AI's own table shows LFM3-1.7B ahead on IFEval, BFCL and LiveCodeBench but 17 points behind on GPQA. Ollama 0.40.13 runs it on every desktop.

Data graphic: the EMBRACE attack path in the built-in browsers of AI coding tools, from a clickable file:// link through the embedded browser and a web worker to any local path. One click starts the read; Cursor was patched silently on 1 October, Copilot was fixed in 1.1.29, and Codex and VS Code remain unpatched.

highAI Security Agent Security

EMBRACE: Embedded Browsers in Cursor, Copilot, Claude Desktop, Codex and VS Code Leak Files and Run Code

Forever Security found the built-in browsers in five AI coding tools give pages powers a normal browser withholds. Codex and VS Code remain unpatched.

Data graphic: timeline of three Ollama releases. v0.40.11 on 24 Oct added speech on macOS and d3 models, v0.40.12 on 27 Oct added LFM3 and d1 on Apple and DFlash2, and the latest, v0.40.13 on 28 Oct, brought LFM3 to Linux and Windows, three days and then one day apart. Speech uses phonon, a 31M-parameter English model, and LFM3 is a 1.7B text model with a 256K-token context.

stableResearch Ollama

Ollama 0.40.11 to 0.40.13: An OpenAI-Compatible Speech Endpoint, d3 Decision Models, LFM3 and DFlash2

Ollama releases between 24 and 28 October add macOS speech over /v1/audio/speech, d3 decision models, LFM3 on Linux and Windows and DFlash2 drafts on MLX.

tail -f the wire

View all →

407 articles in the archive · showing the newest 21All latest posts →

Browse by desk

All categories →

Research216Nemotron 3.5 Transcribe Posts 4.71% English WER in Open Weights, and Fits a 32 GB GPU Only in 4-Bit AI Security101EMBRACE: Embedded Browsers in Cursor, Copilot, Claude Desktop, Codex and VS Code Leak Files and Run Code Exploits73CISA Adds Two More Ivanti Connect Secure Flaws to KEV as Links in the CVE-2026-104935 Exploitation Chain Policy5DHS Orders DeepSeek, and Anything Built on It, Out of Federal Civilian IT Supply Chain5Poisoned LiteLLM 1.107.0 Stole Cloud, AI-Provider and SSH Credentials for About Two Hours Data Security4Free Home Design Software: The Trackers and Permissions Behind the Apps Cloud1Serverless GPU Inference Compared: Baseten, Modal, RunPod, Together and Fireworks Identity1The 28-Hour Revocation Gap: Why Entra ID Continuous Access Evaluation (CAE) Fails Against Session Token Theft Operations1How to Build an LLM Evaluation Harness That Catches Real Regressions