https://saleem.pk/, https://twh360.com/

Website Design - Front end to Back end, TechWare House, Opp. VTI, Chiniot (2026)

05/10/2026

Nvidia Invests $3.5B in MediaTek to Expand AI Chips

Nvidia is putting $3.5 billion into MediaTek just as the AI chip market is moving beyond a simple race between GPU makers. Announced on August 31, 2026, the deal combines Nvidia's AI infrastructure with MediaTek's custom-chip and power-efficient system-on-chip expertise, giving companies a new route to build specialized AI processors that can still connect to Nvidia's larger computing systems.

The deal is about custom AI chips, not just funding

Nvidia is investing $3.5 billion through convertible bonds issued by MediaTek, while MediaTek is adopting Nvidia's NVLink Fusion platform for custom AI infrastructure. A convertible bond is debt that can potentially be converted into shares under specified terms, so the announcement is not the same thing as Nvidia simply buying $3.5 billion of MediaTek stock today. The more significant technology decision is that MediaTek will use NVLink Fusion as a foundation for customers developing custom accelerators, giving those chips a path into Nvidia-connected rack-scale AI systems.

That matters because many large AI operators want hardware designed around their own workloads rather than relying entirely on general-purpose accelerators. Building such a chip, however, is only one part of the problem. The processor also has to communicate with other chips, memory and networking equipment at enormous speed, and the finished design has to work reliably inside a complete data-center rack.

https://wiztechnoz.com/blog/nvidia-invests-35b-in-mediatek-to-expand-ai-chips

05/10/2026

Chrome 152 Gives Web Apps a New CPU Performance Signal

Chrome 152, released on August 25, gives web developers a new way to tell how capable a user's device is before deciding how much work the browser should do. The CPU Performance API exposes a small performance tier instead of the processor model itself, giving applications a coarse signal they can use to adjust graphics, background work, local computation, and other demanding features.

Chrome 152 turns device performance into a web API

The new API adds navigator.cpuPerformance to secure web pages. It returns a small integer representing the device's CPU performance tier: 1 through 4, with 0 used when the browser cannot classify the device. Higher tiers represent more capable devices, but the value is deliberately broad rather than a detailed hardware specification.

That distinction matters. A website does not suddenly gain access to a user's exact processor name or a benchmark score. Instead, it gets a practical signal for making a decision such as whether to enable an expensive animation, run an artificial intelligence task locally, or move more work to a server. The underlying specification is still a draft Community Group Report dated August 15, 2026, so developers should treat the API as an evolving web platform feature rather than a finished universal standard.

https://wiztechnoz.com/blog/chrome-152-gives-web-apps-a-new-cpu-performance-signal

05/10/2026

Node.js 24.20.0 Makes Dependency Permissions Easier to Inspect

A new Node.js LTS release has put one of its more interesting changes in a place many developers may overlook: the runtime can now audit permission checks instead of simply stopping at the first denied operation. Node.js 24.20.0, released on August 26, also adds package maps and several smaller developer-facing features, but its permission audit mode could be the change that matters most to teams trying to understand what their applications and dependencies actually attempt to access.

The new audit mode changes what happens when access is denied

Node.js has been building a permission model that can restrict operations such as reading files or accessing the network. The normal purpose is straightforward: code requests an operation, Node.js checks whether that operation is allowed, and a denied request can stop the operation. The difficulty for developers is that blocking code immediately does not always reveal the full picture of what an application would have tried to do during a larger workflow. Node.js 24.20.0 adds a --permission-audit mode that records permission-denied activity without treating every denied check as the same kind of hard failure, giving developers a way to observe attempted access while they investigate an application's behavior.

https://wiztechnoz.com/blog/nodejs-24200-makes-dependency-permissions-easier-to-inspect

04/10/2026

Over 100 U.S. Water Systems Targeted in July Cyberattacks

More than 100 internet-exposed systems in the U.S. water and wastewater sector were targeted by malicious cyber activity during July, according to new guidance from the Cybersecurity and Infrastructure Security Agency (CISA). The disclosure matters less because it gives the campaign a larger headline number than because it reveals the access path: programmable logic controllers, or PLCs, were in some cases connected directly to cellular modems, putting equipment that controls physical processes within reach of remote attackers.

The number describes targets, not 100 confirmed breaches

CISA's wording is worth reading carefully. The agency says it observed malicious activity targeting more than 100 internet-exposed systems, rather than saying attackers successfully compromised more than 100 separate water utilities. That distinction prevents the figure from being turned into a misleading breach count, while still showing how widely attackers were looking for exposed operational technology. Independent reporting indicates the activity reached water and wastewater facilities in at least a dozen states, although the full list has not been publicly identified.

The attacks also have not produced the kind of widespread loss of water service that the raw number might suggest. Reporting from the affected campaign says there has been limited impact on supplies, although some incidents caused outages or operational disruption while utilities investigated and responded. The more worrying evidence is what attackers could do after reaching certain controllers: previous intrusions allowed changes to PLC settings that could disable shutdown processes or alarms, creating the possibility of unsafe operating conditions without an operator immediately knowing.

https://wiztechnoz.com/blog/over-100-us-water-systems-targeted-in-july-cyberattacks

03/10/2026

Oracle WebLogic Flaw Triggers Emergency Patch Deadline

Oracle WebLogic administrators have a problem that cannot be left for the next maintenance window. CVE-2026-21962, a critical access-control flaw in the WebLogic Server Proxy Plug-in, is being actively exploited, and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has placed it in its Known Exploited Vulnerabilities catalog with an August 27, 2026 remediation deadline for affected federal agencies. The vulnerability was already patched by Oracle in January, which makes the current wave less about discovering a new bug and more about attackers finding systems that never received the fix.

The interesting part is where the vulnerability sits. It is not simply a flaw inside a WebLogic application; it affects the proxy component that can sit between the public internet and backend WebLogic servers. That position means an attacker can reach the vulnerable component before normal application authentication takes place. Security researchers have also observed automated exploitation, showing why an old patch can become a current security emergency.

The Oracle WebLogic flaw can be reached without credentials

CVE-2026-21962 carries a CVSS 3.1 score of 10.0, the maximum possible severity rating. Oracle describes it as an easily exploitable network vulnerability that requires no authentication and no user interaction, with attacks delivered over HTTP. The affected products include Oracle HTTP Server and the WebLogic Server Proxy Plug-in, with affected versions including 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0; for the Microsoft IIS plug-in, the affected version is 12.2.1.4.0.

That score needs context. A 10.0 score does not mean every WebLogic installation is automatically vulnerable. The organization must actually be using the affected proxy component and an affected version. But when those conditions exist on an internet-facing server, the lack of an authentication requirement removes one of the most useful defensive barriers between an attacker and the vulnerable code.

https://wiztechnoz.com/blog/oracle-weblogic-flaw-triggers-emergency-patch-deadline

03/10/2026

Gitea RCE Flaw Is Now Being Exploited in the Wild

A critical Gitea vulnerability that was patched last month has moved from a software-security problem to an active attack risk. On August 25, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-60004 to its Known Exploited Vulnerabilities catalog, and security researchers have since reported attacks against vulnerable self-hosted Gitea servers.

The flaw matters because the vulnerable component is a Git repository operation, not an obscure administrative feature. Under the right configuration, an attacker can turn repository-controlled patch data into a Git hook and use it to execute commands with the privileges of the Gitea service account. Administrators running Gitea versions before 1.27.1 should treat this as an incident-response issue as well as a patching task.

Why the Gitea RCE flaw is more serious than a normal repository bug

Gitea is a self-hosted Git platform, meaning organizations can run their own Git repositories, code review, issue tracking and related development services instead of relying entirely on a hosted provider. CVE-2026-60004 affects Gitea versions 1.17 through 1.27.0 and was fixed in version 1.27.1. The vulnerability has a CVSS score of 9.8 out of 10, placing it in the critical category.

The dangerous part is the diffpatch endpoint. This endpoint processes patches submitted against repositories. A flaw in the way Gitea prepares a temporary bare Git repository allows specially crafted patch content to escape the intended file-handling path and create an executable Git hook. A Git hook is a program Git automatically runs when particular repository operations occur, so turning attacker-controlled content into a hook changes a repository operation into server-side code ex*****on.

The attacker does not initially need administrator privileges. Gitea's advisory says ordinary repository write access is enough. On installations where open user registration remains enabled, an outside visitor can potentially create an account and repository and obtain the required write access without an administrator granting it manually.

https://wiztechnoz.com/blog/gitea-rce-flaw-is-now-being-exploited-in-the-wild

*****on

03/10/2026

AI Malware: 97% of Samples Never Reached Production

A new analysis of 405 AI-related malware samples found a much smaller real-world footprint than the volume of public samples suggests. Unit 42, Palo Alto Networks' threat research team, found only 12 of the samples on protected production endpoints, while roughly 97% appeared only in research repositories, sandboxes, or security-testing environments.

That does not make AI malware harmless. It points to a more useful distinction: artificial intelligence is already helping attackers create and package malicious software, but the available evidence does not yet show that AI has made those programs unusually difficult for established security controls to detect.

The 405 samples tell a different story from the headlines

Unit 42 built its dataset from 405 unique SHA-256 hashes gathered from WildFire analysis reports, VirusTotal Intelligence, and published open-source research. The researchers deliberately used a broad definition of AI-related malware, including samples where artificial intelligence was part of the malware itself, its delivery mechanism, or simply its branding. That means the dataset includes genuine malicious code alongside proof-of-concept research and conventional malware disguised as AI software.

When the researchers checked those samples against Palo Alto Networks telemetry, only 12 appeared on non-test Cortex XDR-protected endpoints. That represents 3% of the dataset. Another roughly 15 to 20 unique samples appeared in WildFire network sessions, but the researchers found no evidence that the remaining samples reached customer endpoints or crossed customer firewalls.

There is an important limitation here: this is not a measurement of every AI malware sample circulating on the internet. The endpoint and network telemetry covered activity from December 2024 through June 2025 and came from Palo Alto Networks' own visibility. The 97% figure therefore describes this selected dataset and this telemetry, not the percentage of all AI malware worldwide that is harmless or inactive.

https://wiztechnoz.com/blog/ai-malware-97-of-samples-never-reached-production

03/10/2026

Moonshot Wants U.S. Clouds to Host Kimi K3

Moonshot AI is negotiating with Microsoft, Amazon and Google over deals that could put its Kimi K3 model on the biggest U.S. cloud platforms. Reuters reports that the Chinese startup is seeking as much as 30% of revenue generated from K3-related services, although the talks are still early and may not produce agreements. The unusual part is not simply that a Chinese AI company wants access to American cloud infrastructure. It is that Kimi K3's open-weight model may need those clouds precisely because its enormous size makes running it independently difficult for most customers.

Moonshot is negotiating with all three major U.S. clouds

The discussions involve Microsoft's Azure, Amazon Web Services and Google Cloud, according to three people familiar with the talks cited by Reuters. Moonshot is reportedly seeking up to a 30% share of revenue generated through K3 services on those platforms, broadly matching terms it has offered major customers using the model. Microsoft, Google and AWS declined to comment, while Moonshot did not respond to Reuters' request for comment. Because the negotiations are private and unresolved, the proposed revenue split should be treated as a reported negotiating position rather than a finalized commercial arrangement.

If completed, the agreements would create a particularly interesting business model. The cloud provider would supply the computing infrastructure and distribution, while Moonshot would receive a share of the resulting usage revenue. That would give developers access to Kimi K3 without having to purchase and operate the hardware needed to run a model of its scale. It would also give Moonshot a route into enterprise customers that may prefer buying AI through an existing cloud platform rather than building a separate infrastructure stack.

https://wiztechnoz.com/blog/moonshot-wants-us-clouds-to-host-kimi-k3

03/10/2026

OpenAI’s Jalapeño Chip Could Make AI Inference Faster

OpenAI has published the first measured results from Jalapeño, its custom chip for running trained AI models, and the numbers point to a different way of improving AI performance: make the hardware itself fit the workload. In tests using public models, OpenAI says Jalapeño delivered between 1.5 and 1.9 times more AI work per watt and between 1.7 and 3.6 times lower end-to-end latency than the comparison systems. The more important story is not simply that OpenAI has designed a chip, but that it is trying to control more of the stack that determines how quickly and efficiently AI reaches users.

Jalapeño targets the part of AI people actually use

Jalapeño is an inference chip, meaning it is designed to run an already-trained model and generate responses rather than train a new model from scratch. That distinction matters because inference happens every time someone asks an AI system a question, runs an agent, or sends a request through an application programming interface. OpenAI says Jalapeño is intended to improve both throughput, or how much useful AI work the system can handle, and latency, or how long users wait for a response. OpenAI first unveiled the chip in June as part of a multigeneration hardware platform being developed with Broadcom and other partners.

https://wiztechnoz.com/blog/openais-jalapeo-chip-could-make-ai-inference-faster

03/10/2026

Google’s Gemini Enterprise Takes AI Deeper Into Finance

Financial analysts are getting a new kind of AI assistant: one designed to work with licensed market data, regulatory filings, internal databases, and the controls that banks already depend on. Google Cloud announced Gemini Enterprise for Financial Services on August 25, putting the service into preview for capital markets and corporate banking and positioning it as a more specialized alternative to general-purpose AI tools.

The interesting part is not simply that Google has packaged Gemini for another industry. The platform is built around a Financial Research agent, more than 50 financial skills, 13 data connectors, and governance features intended to make AI output traceable. That combination points to a broader shift in enterprise AI: the valuable system may increasingly be the one that connects a capable model to trusted business data and controlled workflows, rather than the model with the most impressive general benchmark score.

Why general-purpose AI struggles in financial work

A financial analyst rarely works from one clean source. Preparing research can involve market feeds, company information, regulatory documents, internal models, licensed research, and confidential client material. A general-purpose AI model can summarize or reason about these materials, but it does not automatically know which source is authoritative, which data a particular employee may access, or how an institution wants the work documented. Google Cloud argues that those missing pieces are a major barrier to deploying AI safely in regulated financial organizations.

That distinction changes what an enterprise AI product has to solve. Accuracy is only one requirement when an analyst may need to defend an answer to a colleague, client, auditor, or regulator. The system also needs access controls, traceability, current information, and a clear record of where an answer came from. Gemini Enterprise for Financial Services is designed around those requirements rather than treating them as features that customers must build around a generic chatbot.

https://wiztechnoz.com/blog/googles-gemini-enterprise-takes-ai-deeper-into-finance

Website Design - Front end to Back end

05/10/2026

05/10/2026

05/10/2026

04/10/2026

03/10/2026

03/10/2026

03/10/2026

03/10/2026

03/10/2026

03/10/2026

Address

Website

Alerts

Shortcuts

Share

Category

Listing takedown request