Python

QuOptuna introduces a unified AutoML framework that streamlines the training of quantum and classical machine learning models. It emphasizes governance by incorporating fairness constraints and automated explainability into the optimization loop.

gpuhedge is a specialized router that mitigates the high latency of serverless GPU cold starts by simultaneously managing requests across different providers. By using intelligent policies to switch from a primary to a backup provider, it significantly improves tail latency while actually reducing total compute expenditure.

The Whisper_Bully tool demonstrates a sophisticated three-stage attack against Bluetooth Fast Pair devices. It leverages a specific vulnerability to bypass privacy randomization, followed by L2CAP flooding and connection hijacking.

TorchJD is a specialized PyTorch library for optimizing neural networks with multiple simultaneous loss functions. It implements advanced methods like Jacobian descent and scalarization to resolve optimization conflicts in multi-task learning.

The article advocates for a proactive 'sniff test' methodology to validate the integrity of SBOMs in containerized environments. It highlights how identifying omissions like unpinned packages or missing dependencies is crucial for preventing supply chain attacks.

The researchers present Program-as-Weights (PAW), a paradigm that shifts LLM usage from expensive per-input API calls to a 'compile-once, run-locally' model using neural adapters. This approach allows small, specialized models to outperform massive foundation models on specific fuzzy tasks while maintaining high efficiency and privacy.

The researchers present Program-as-Weights (PAW), a paradigm that shifts LLM usage from expensive per-input API calls to a 'compile-once, run-locally' model using neural adapters. This approach allows small, specialized models to outperform massive foundation models on specific fuzzy tasks while maintaining high efficiency and privacy.

A new paper in the journal Nature accuses Microsoft of using flawed Python code and selective data reporting to claim a breakthrough in quantum computing. While Microsoft maintains its roadmap is sound, researchers argue the errors hide fundamental failures in achieving topological superconductivity.

Kuma introduces a way to run trained PyTorch models live in the browser by compiling them into a specialized '.iph' format. By leveraging WebGPU and embedded WGSL shaders, it eliminates the need for server-side inference or heavy runtime dependencies.

This article introduces tinytorchcompile, a simplified single-file implementation of the torch.compile mechanism focusing on operator fusion. It provides empirical evidence that fusing operations into a single kernel is essential for bypassing memory bandwidth limitations.

A supply chain attack targeting Klue's market intelligence platform allowed threat actors to steal Salesforce customer data through OAuth token abuse. The Icarus extortion group is identified as the primary actor behind this recent wave of CRM-focused breaches.

Researchers at elttam have identified critical vulnerabilities in Jupyter Enterprise Gateway that enable cluster-wide compromise. By exploiting improper validation of environment variables, an attacker can bypass security constraints to gain root access within a Kubernetes pod.

Threat actors have successfully compromised dozens of Microsoft-owned repositories to deploy the Miasma malware via supply-chain attacks. The malware is designed to steal cloud credentials and spread laterally through developer environments by exploiting AI coding agents.

The author tests if open-weight models can replicate the discovery of a FreeBSD RCE using the nano-analyzer pipeline. The study finds that while noise in large-scale scans can cause misses, improving the pipeline's scaffolding allows local models to successfully identify the bug.

Researchers demonstrated a successful hardware Fault Injection attack where an AI agent, Claude Code, was given control over hardware tools to bypass Secure Boot on an ESP32. This represents a significant milestone in the use of agentic AI for automating complex hardware exploitation workflows.

Google has uncovered a new threat involving a zero-day 2FA bypass exploit likely created using AI-generated Python code. Additionally, the report highlights PromptSpy, an Android malware that leverages Gemini AI to perform autonomous malicious actions on mobile devices.

A security scan discovered that 25% of 6,000 web applications fail to verify Stripe webhook signatures, allowing for unauthorized payment bypass. This flaw enables attackers to forge successful payment events and upgrade account statuses without actual charges.

A critical Linux kernel flaw known as 'CopyFail' is currently being exploited by attackers to gain full root access to vulnerable systems. The vulnerability affects a wide range of Linux distributions and requires only a local foothold to execute.