Latest cybersecurity dispatches

Fresh reporting on active vulnerabilities, security patches, incident response, and threat research for defenders.

Articles: 407
Page: 12 / 51
Desks: 9

Data graphic: a large 3 GB figure labelled as OpenBMB's vendor claim for MiniCPM-V 4.7 running at 13+ tokens per second on an iPhone

MiniCPM-V 4.7: OpenBMB Claims a 35B Vision MoE Runs at 13 Tokens a Second in 3 GB on an iPhone

OpenBMB says its 35B-A3B vision MoE hits 13+ tok/s in about 3 GB on an iPhone 17 Pro Max. No quantisation is stated; the Q4_K_M GGUF is 21.2 GB.

Oct 14 · 4 min

Data graphic: X Subscription tiers from Free to Ultra at $200 a month, with Claude and GPT usage in Cursor billed at API list price.

elevatedResearch Cursor Pricing

The X Subscription Explained: Cursor and Grok in One Plan, and Claude or GPT Now Cost API List Price

xAI's X Subscription bundles Grok, Cursor and X Premium from $8 to $200 a month, but Claude and GPT in Cursor now bill at API list price on top.

Oct 14 · 4 min

Data graphic: dumbbell chart of LFM2.5-24B-A2B against Qwen3.6-35B-A3B on six benchmarks, LFM ahead on AutomationBench, IFBench and ToolSandbox, behind on SWE-Bench Verified, GPQA Diamond and WebArena Verified

watchResearch Open-Weight Models

Liquid LFM2.5-24B-A2B vs Qwen3.6-35B-A3B: Better at Agents, Weaker at Coding

Liquid's new 24B MoE beats Qwen3.6-35B-A3B on tool use and instruction following but trails on SWE-Bench and GPQA, per Liquid's own benchmarks.

Oct 14 · 4 min

Data graphic: attack chain from an unauthenticated /tokenize request through mm_processor_kwargs.code_revision and an attacker-controlled repository revision to processor code running under --trust-remote-code

highAI Security Vllm Serving

vLLM 0.31.0 Fixes Remote Code Execution Through Request-Controlled code_revision, Plus Four Other Advisories

vLLM 0.31.0 closes five 6 October advisories, led by a code_revision flaw that can run attacker code with --trust-remote-code. No CVE ids yet; scores disagree.

Oct 14 · 4 min

Data graphic: dot plot of vendor-reported scores for Reflection Beam, GLM 5.2 and Kimi K3 on four benchmarks

watchResearch Open Weight Coding Models

Reflection Beam: A 501B Open-Weight MoE Claims 80.9 on SWE-bench Verified, but the Weights Have Not Shipped

Reflection AI's Beam reports 80.9 on SWE-bench Verified and promises Apache 2.0 weights, but as of Oct 14 nothing is on Hugging Face and every number is vendor-reported.

Oct 14 · 3 min

Data graphic: poster headed "Free AI floor plan generators, compared", with the line "Editable plans are common; built-in code checks are not". Large figures say three of four rivals give an editable plan and none of the four lists a building-code check, beside Maket's 30 one-time free credits, Coohom's three free projects and Planner 5D's $19.99-a-month AI recognition.

stableResearch Floorgen

AI Floor Plan Generator Free Tiers Compared: Editable Plans and Code Checks

Maket, Planner 5D, Coohom and Felo checked on free limits, editable output, exports and code checks, plus a hands-on run of FloorGen's generator.

Oct 14 · 8 min

Data graphic: CVE-2026-86063 Claude Code plugin SHA-pin bypass, CVSS 4.0 7.5 High 7.7 in GHSA , fixed in 2.1.179, with a four-step chain from install to different code installed.

highAI Security Claude Code

CVE-2026-86063: Claude Code's Pinned Plugin SHA Check Could Be Bypassed With a Branch Name

Claude Code's plugin installer didn't verify the pinned commit SHA; a branch named after it swapped the code. CVE-2026-86063, fixed in 2.1.179.

Oct 14 · 6 min

Data graphic: Ivanti Connect Secure zero-day, CVSS 3.1 High 8.6, stamped "Zero-day, hit patched 22.8R2.4"; CISA deadline 16 Oct, 5,500+ exposed VPN appliances Shadowserver .

criticalExploits Cve 2026 104935

Ivanti Connect Secure Zero-Day CVE-2026-104935 Exploited; CISA Sets October 16 Deadline

Ivanti patched an authentication bypass in Connect Secure VPNs that attackers exploited as a zero-day, including on a patched 22.8R2.4 appliance. CISA added it to KEV, due 16 Oct.

Oct 13 · 6 min