Software Engineering

The Israel Innovation Authority is investing NIS 100 million to create a national quantum computing R&D center. This infrastructure will allow Israeli researchers and companies to evaluate, integrate, and develop applications across various quantum platforms.

IQM and Deutsche Bahn have demonstrated a hybrid quantum-classical framework capable of solving complex railway scheduling problems using real-world data. The study proves that current quantum hardware can produce feasible optimization results through a scalable, modular architecture.

Researchers from AWS, NVIDIA, LBNL, and NASA have developed a framework to guide infrastructure decisions for quantum-classical integration. The model helps determine when quantum hardware requires physical co-location with supercomputers versus when remote cloud connectivity is sufficient.

A collaborative research effort has successfully implemented a 'waffle grid' superconducting circuit that achieves predicted gauge symmetries. This advancement serves as a critical experimental precursor to building scalable topological quantum computers that are inherently resistant to noise.

Zhongqi Wuliang's new Qinghe No. 1 quantum computer aims to revolutionize data center integration by using neutral-atom technology to bypass massive cryogenic infrastructure. The server-rack form factor represents a significant step toward making quantum hardware compatible with existing enterprise cloud environments.

An attacker compromised AsyncAPI repositories to publish malicious npm packages that deploy the Miasma RAT credential stealer. The attack impacts millions of weekly downloads and utilizes advanced obfuscation and multi-channel C2 infrastructure.

PsiQuantum is pursuing an ambitious roadmap to develop a million-qubit quantum computer through large-scale manufacturing and industrial partnerships. While the company's technical specifics remain somewhat opaque compared to competitors like Google or IBM, they are focusing on software development and commercial use cases.

Chiron is a specialized verification engine that provides mathematical certainty for AI model outputs by refusing to certify any pattern it cannot prove on held-out data. It offers a structural governance layer that generates machine-readable certificates of truth for developers, auditors, and security researchers.

The article details the discovery of CVE-2026-46242, a critical race-condition bug in the Linux kernel's epoll subsystem. This vulnerability enables local privilege escalation to root on various platforms including Android.

Researcher Hyunwoo Kim discovered a high-severity use-after-free vulnerability in the Linux KVM subsystem called Januscape. This flaw enables untrusted guest VMs to break out of their isolation and potentially take control of the host operating system.

CISA released an after-action report regarding a credential leak caused by a contractor's use of a personal GitHub repository. The agency successfully mitigated the exposure without loss of mission data and is implementing stricter development environment guardrails.

The researchers present Program-as-Weights (PAW), a paradigm that shifts LLM usage from expensive per-input API calls to a 'compile-once, run-locally' model using neural adapters. This approach allows small, specialized models to outperform massive foundation models on specific fuzzy tasks while maintaining high efficiency and privacy.

The researchers present Program-as-Weights (PAW), a paradigm that shifts LLM usage from expensive per-input API calls to a 'compile-once, run-locally' model using neural adapters. This approach allows small, specialized models to outperform massive foundation models on specific fuzzy tasks while maintaining high efficiency and privacy.

This article introduces tinytorchcompile, a simplified single-file implementation of the torch.compile mechanism focusing on operator fusion. It provides empirical evidence that fusing operations into a single kernel is essential for bypassing memory bandwidth limitations.

Researchers at elttam have identified critical vulnerabilities in Jupyter Enterprise Gateway that enable cluster-wide compromise. By exploiting improper validation of environment variables, an attacker can bypass security constraints to gain root access within a Kubernetes pod.

Threat actors have successfully compromised dozens of Microsoft-owned repositories to deploy the Miasma malware via supply-chain attacks. The malware is designed to steal cloud credentials and spread laterally through developer environments by exploiting AI coding agents.

More than 30 Red Hat npm packages were compromised in a supply-chain attack using the Miasma malware to steal developer credentials. The attack was executed via a compromised GitHub account and targeted various cloud and infrastructure secrets.

WasmForge is a novel loader designed to wrap offensive security tools in WebAssembly to evade EDR detection. It achieves this by providing a custom runtime environment that bridges WASM modules to native host APIs without requiring changes to the original tool's source code.

The quantum computing field is shifting its focus from building single, massive processors to developing modular, interconnected systems. This strategic pivot allows for the combination of diverse qubit modalities and advanced networking technologies, paving the way for scalable quantum data centers.

A new side-channel attack named FROST allows websites to bypass browser sandboxing by analyzing SSD latency. By using deep learning to process I/O traces, attackers can fingerprint the applications and websites running on a user's device.

The article argues that traditional user-space security monitoring agents are structurally weak because they share privileges with the workloads they monitor, allowing attackers to easily disable them. eBPF solves this by embedding probes directly into the Linux kernel's syscall interface, providing robust, high-performance, and persistent visibility into all system activity.

The US Cybersecurity and Infrastructure Security Agency (CISA) was found to have left a massive GitHub repository containing plain-text credentials and infrastructure secrets public for six months. The leak, discovered by a GitGuardian researcher, exposed access to critical systems like AWS, Azure, and Kubernetes, highlighting severe internal security lapses.

GitHub reported detecting and containing a security breach concerning unauthorized access to its internal repositories. The compromise originated from a poisoned VS Code extension found on an employee's device, prompting immediate incident response measures.

Researchers demonstrated a successful hardware Fault Injection attack where an AI agent, Claude Code, was given control over hardware tools to bypass Secure Boot on an ESP32. This represents a significant milestone in the use of agentic AI for automating complex hardware exploitation workflows.

A security scan discovered that 25% of 6,000 web applications fail to verify Stripe webhook signatures, allowing for unauthorized payment bypass. This flaw enables attackers to forge successful payment events and upgrade account statuses without actual charges.

A critical Linux kernel flaw known as 'CopyFail' is currently being exploited by attackers to gain full root access to vulnerable systems. The vulnerability affects a wide range of Linux distributions and requires only a local foothold to execute.