Selected industry news from AIHOT. Follow advances in AI, products and technology.
AIHOT · Selected summaries with original sources · Oct 29, 2026, 9:00 AM
A high-severity vulnerability CVE-2026-80097 (CVSS 8.6) has been discovered in Microsoft Authenticator for Android. Malicious apps can impersonate official Microsoft applications to steal account tokens without requesting any permissions. This affects Android users on versions prior to 6.2606.4246; Microsoft has fixed this in that version, and the iOS version is unaffected.
The Hi3D team officially open-sourced the V1.0 model, based on the Sparc3D framework published at NeurIPS 2025. Training data was expanded to approximately 2 million filtered 3D assets, supporting sparse geometry refinement at 1024³ and 1536³ resolutions. Code, weights, and an online Demo are available on GitHub and Hugging Face. The technical report indicates a multi-view fidelity of 0.75, detail richness of 0.841, and a slice success rate of 90%. The model is open to researchers, developers, and enterprises, supporting private deployment and MCP invocation.
SoMark 团队开源 OXR 光学全量识别模型，参数量仅 1.3B，在 OmniDocBench（97.18 分）、olmOCR-Bench（87.84 分）和 DocParsingBench（87.76 分）三项基准测试中均排名第一；在 RTX PRO 6000 Blackwell 显卡上解析 100 页文档平均耗时 101 秒，快于 PaddleOCR-VL-1.6（145 秒）和 MinerU2.5-Pro（255 秒）；支持表格、公式、化学式等 13 类元素解析，输出 Markdown / JSON 并保留版面坐标；采用递归自我改进（RSI）训练范式，支持插拔式版面分析模块；代码、权重、在线 Demo 和免费 API 已开放。
Cloudflare sent emails reminding all Tunnel users to upgrade the cloudflared client as soon as possible, because older versions still trust the eMudhra (emSign) intermediate certificate, which has been exposed as having weak private keys, posing a risk of man-in-the-middle attacks. Upgrades are required to version 2026.10.2 or later for Linux/Windows/Docker, and version 2026.10.3 or later for macOS (non-Homebrew). After upgrading, if the origin server still uses an eMudhra certificate, connections will fail; it is recommended to replace the certificate.
Using QNAP NAS as an example, Piaolei demonstrates in detail how to connect consumer-grade UPS units such as the APC BK650M2-CH via USB, enable the built-in NUT (Network UPS Tools) service, and configure the NAS as the LAN master controller. Other QNAP NAS devices can be set up as Network UPS slave clients, while Windows machines connect to the same NUT master via the open-source WinNUT-Client. Graceful shutdowns are triggered based on battery level or remaining runtime thresholds. The article includes hardware wiring instructions, QTS backend configuration, SSH verification commands, WinNUT parameter settings, and supplementary solutions for unattended operation.
On October 27, Ant Group released Lingguang 2.0, upgrading cross-session memory, long-term task scheduling, and tool connectivity capabilities. It supports proactively identifying needs after authorization, continuously monitoring tasks such as prices/notifications/renewals, and integrating with services like Alipay, DingTalk, Feishu, email, and Mijia. Relying on an independent cloud host, it continues running after exiting the conversation, ensuring execution security and controllable authorization through the APASS unified account system.
OpenAI released the personal agent dots at its developer day in late September, targeting ChatGPT Pro and higher subscription users (starting at $100/month), requiring connections to tools such as calendars, emails, and computers; it evolved from the Codex coding tool, emphasizing continuous operation and proactive reminder capabilities, though current reminder timeliness is insufficient; dots features proactive research functionality, periodically analyzing user data and offering assistance suggestions. Privacy settings follow ChatGPT's control logic, but permission granularity is coarse, and defaults are conservative with frequent authorization requests.
Ollama v0.40.12 has been officially released, adding native support for the Liquid AI LFM3 series models (lfm3, lfm3-vl, lfm3-audio, lfm3-omni) and the d1 decision models (d1, d1-omni), all based on a tri-hybrid architecture, supporting local agents, tool calling, and structured output; currently only supports Apple hardware, with Linux/Windows support coming soon; also optimized prompt processing speed for Gemma 4, Flint, and Laguna on Apple silicon, and added speculative decoding support for the DFlash2 draft model.
The Reddit community r/opensource has released new rules prohibiting discussion of any open-source project that uses AI, is generated by AI, or targets AI; the new rules require projects to have been actively maintained for at least 1 year with more than 3 contributors, posting accounts must be registered for at least 1 year and appeals are prohibited, and non-native English speakers may be expelled because their translated content might be misidentified as AI-generated; this ban results in 38 top-tier open-source projects such as Linux and Python being excluded under the literal rules, as Linus Torvalds recently used Claude Code to assist in submitting Linux kernel patches and achieved performance improvements; the official Linux stance emphasizes human accountability and tool transparency principles, opposing 'tool lineage theory'.
新加坡国立大学xML Lab提出Jeva决策模型架构，聚焦任务终点为明确判断（如选择、概率、评分）的场景，强调四项结构特性：Null-aware（显式输出null以标识无合适答案）、Permutation-invariant（候选重排不改变判断）、Option-scalable（支持从数十至两千余候选的原生扩展）、Cacheable（缓存候选表征以复用计算）。
A DeepMind research team published a paper on arXiv titled "Fixing Softmax and Cross-Entropy," pointing out that implementations of Softmax and cross-entropy in PyTorch, JAX, and textbooks suffer from 'Softmax collapse' and 'Softmax cancellation' issues caused by floating-point rounding, leading to vanishing gradients and ghost gradients. The paper proposes rewriting methods in log-sum-exp and expm1/log1p spaces; empirical tests showed accuracy on modular addition tasks improved from 93.3% to 100.0% with bfloat16 precision, while divergence remained stable at zero in distillation tasks. Gemini Flash 3.7 first discovered the bug, Flash 3.8 completed the experiments, and Gemini 4 Argon participated in drafting the initial version. Satyajit Ghana verified the reproduction in fp32 within PyTorch.
Azure Container Apps Express 正式发布，是一种省去环境预置、基于 opinionated defaults 的部署模型，运行于新发布的 Azure Container Apps Sandboxes 隔离计算层之上；Sandboxes 提供硬件隔离 microVM、亚秒级启动、挂起/恢复与状态快照能力；Express 支持缩容至零、HTTP 入口、自动扩缩容等精简功能，但不支持自定义域名、GPU、Dapr、jobs 等；访问需 Microsoft Entra ID 账户，管理界面独立于 Azure 门户；已覆盖超 40 个 Azure 区域，提供归档与恢复方式迁移至 Express。
On October 24, AWS conducted a several-hour backbone network disconnection drill for its European Sovereign Cloud, disabling the global operations network and dedicated channels, with traffic falling back to the public internet; customer content and metadata remained within the EU, but some operational data still left the region; the drill aimed to align with the EU cloud sovereignty framework and the German BSI C3A standard, but did not claim certification, nor did it specify the behavior of global services such as IAM and DNS during the disconnected state.
TypeSafe AI has released Jev, the first product in its System One Models. It does not generate text; instead, it outputs typed probability results such as Choice, Score, and Noul in parallel for structured questions, accompanied by probability distributions and confidence levels. The input cost is $0.042 per million tokens, output is free, the context window is 32000 tokens, and end-to-end latency is 70–500 milliseconds. Vercel, Netlify, and LangChain have integrated it, and Elixir clients are emerging. Officially, it is claimed to be 5–18 times faster than LLMs; user-measured median speed improvement is 7 times, and median cost savings are 30 times. Version jev-1.13 has known instability characteristics regarding counting, arithmetic, and date comparison.
Docker has released Cloud Sandboxes, a managed execution environment based on hardware-enforced isolated microVMs that allows AI coding agents to seamlessly migrate between laptops and the cloud. Sandbox and file system state migration is achieved through a unified CLI (e.g., `sbx move my-project --to cloud`). This service is an evolution of the previous local Docker Sandboxes. Additionally, Docker updated the Kits v3 specification to package pre-configured sandboxes as standard OCI images. Deutsche Bank engineers praised its security and flexibility, but users on Reddit and Hacker News pointed out insufficient constraints on external service calls from sandboxes, calling for more fine-grained resource control based on object capabilities.
Grafana Labs proposes a method that uses Cypress's before:run and after:spec lifecycle hooks to capture test results, convert them into Prometheus metrics, temporarily relay them via Pushgateway, and then scrape and send them to Grafana Cloud using Grafana Alloy; this solution supports tracking failure rates, execution times, and flaky test trends, and can correlate with GitHub Actions run identifiers.
Kubernetes 1.37 has been officially released. Core changes include the Metrics API (metrics.k8s.io) reaching GA status, supporting auto-scaling features like HPA/VPA; Rootless Kubelet (KubeletInUserNamespace) promoted to Beta and enabled by default, enhancing protection against container escapes; HorizontalPodAutoscaler's scale-to-zero support promoted to Beta and enabled by default; resilient watchcache initialization and Pod certificates both reached GA; new Alpha features added, including InPlacePodVerticalScalingSchedulerPreemption and StatefulSet Recreate policy.
OpenAI 宣布在数学、计算机科学和物理学领域取得三项重大发现：数学方面释放了关于欧几里得波动方程局部光滑性的证明，覆盖所有≥2维空间，并由此推出Kakeya极大函数与维数猜想及Stein球面限制估计；计算机科学方面提出反证指数时间假设（ETH）的确定性算法，由Impagliazzo、Paturi和Williams领衔的独立工作组将审查该结果；物理学方面给出包含规范场与费米子的四维相互作用量子场论存在性严格证明，涵盖QCD与标准模型统一完成，由David Gross等学者引导。
On October 24, 2026, Canada released a draft regulation for stablecoins, setting a 60-day public consultation period, with an expected effective date in autumn 2027. It requires issuers to maintain full 1:1 reserves in cash, government bonds maturing within 3 months, and qualified money market funds, held in segregated accounts with Canadian custodians. Holders can redeem in full within 3 business days, with fees not exceeding 1%. It prohibits paying interest to token holders or providing returns indirectly through third parties, but usage rewards are unrestricted. Penalties for violations can reach up to CAD 10 million. The Bank of Canada will be responsible for registration and supervision.
Seoul police arrested seven individuals accused of using generative AI to carry out hacking attacks, infiltrating approximately 90 institutions and stealing 8.2 million records; the mastermind was a 32-year-old with no IT background who, since late August, incorporated AI coding agents and the autonomous penetration testing tool Artex, breaching 60 companies within 44 days; police described this as South Korea's first large-scale AI-assisted hacking operation, noting that only one ransom payment of 300,000 won (approximately $210) has been confirmed among the involved amounts.
SpaceX has signed a GPU lease financing agreement worth approximately $40 billion with entities managed by Apollo Global Management. The lease term begins in the first half of 2027, with the master lease agreement expected to be finalized by the end of 2026. Although Musk described this financing as debt, regulatory filings clearly identify it as a finance lease, under which SpaceX will repay principal quarterly over approximately 5 years and pay interest at an undetermined fixed rate.
Shopify has integrated the knowledge base feature into the admin interface, accessible via Sales channels > Agentic > Knowledge base, replacing the previous standalone app; this feature automatically extracts facts (such as contact information, gift services, etc.) from published storefront pages, generates them in an unpublished state by default, and requires manual publishing for use by AI agents; among existing users, stores with fewer than 1000 facts have been automatically migrated and published, while those with more than 1000 facts must manually select entries to retain by January 15, 2027, otherwise unmigrated facts will be lost.
IEEE has launched the IEEE Xplore AI Research Suite as an optional upgrade to institutional subscriptions to the Xplore digital library. Built on the full text and STEM metadata of all peer-reviewed journals, conference papers, standards, etc., it supports natural language semantic search, automatic generation of result summaries and term explanations, and provides source document links for each AI answer for verification; the system is designed not to generate hallucinated answers when no matching content is found, but to explicitly inform the user.
Kiowa Jackson released a tutorial introducing how to use Amazon SageMaker SDK v3 to build an end-to-end computer vision model lifecycle management system supporting thousands of cameras: it adopts a dual-branch pipeline (anomaly detection + defect classification), with independent training per camera and quality gating (AUROC ≥0.8 / balanced accuracy ≥0.6 and defect recall rate ≥0.5), includes built-in SageMaker Neo compilation steps to generate device-optimized .so packages, and uses Step Functions + DynamoDB for throttled scheduling; the entire deployment is done via AWS CDK, with a full pipeline run costing approximately $0.07; sample code is open-sourced in the aws-samples GitHub repository.