BTC $78,079.07 -0.12%
ETH $2,437.46 -0.81%
BNB $685.76 -1.06%
XRP $1.37 -1.72%
SOL $102.63 -2.28%
TRX $0.3363 -1.24%
DOGE $0.0825 -2.58%
ADA $0.1960 -2.41%
BCH $247.91 +1.02%
LINK $11.24 -1.37%
HYPE $81.17 -2.57%
AAVE $123.37 -0.65%
SUI $0.7230 -2.43%
XLM $0.1764 -1.79%
ZEC $828.66 -0.85%
BTC $78,079.07 -0.12%
ETH $2,437.46 -0.81%
BNB $685.76 -1.06%
XRP $1.37 -1.72%
SOL $102.63 -2.28%
TRX $0.3363 -1.24%
DOGE $0.0825 -2.58%
ADA $0.1960 -2.41%
BCH $247.91 +1.02%
LINK $11.24 -1.37%
HYPE $81.17 -2.57%
AAVE $123.37 -0.65%
SUI $0.7230 -2.43%
XLM $0.1764 -1.79%
ZEC $828.66 -0.85%

clo

All
Article
Flash

SemiAnalysis releases Neocloud security deep report: Infrastructure configuration errors are shocking, and cross-tenant RCE could affect banks, telecommunications, and even a country's intelligence agency

The semiconductor and AI independent research organization SemiAnalysis released a deep security report on Neocloud (new cloud), revealing various cross-tenant security vulnerabilities discovered during the ClusterMAX 3 testing period. In a four-month test covering 25 vendors and 32 clusters, the team achieved multiple instances of cross-tenant remote code execution (RCE) solely by exploiting publicly known vulnerabilities and basic configuration checks. Affected entities included banks, telecommunications companies, universities, research institutions, AI laboratories, and even a national intelligence agency.Typical issues included: shared Kubernetes control plane leading to tenant metadata visibility, container escape, exposure of BMC/IPMI management networks, incorrect configuration of InfiniBand security keys (P_Key, SA_Key, M_Key), unfortified default trust mode of BlueField DPU, Grafana monitoring dashboards using god-level API keys, and lack of VXLAN isolation in front-end networks. The report specifically pointed out a cascading vulnerability case: a misconfiguration of shared vCluster combined with software versions being two years out of date ultimately completed the POC verification of cross-tenant RCE within an afternoon.Notably, the report questioned the mainstream narrative that "AI has fundamentally changed the pace of cybersecurity": statistics on CVEs for NVIDIA GPU drivers, CUDA, PyTorch, Kubernetes, Docker, and the Linux kernel showed that there was no significant increase in vulnerabilities after the popularization of AI coding models, with most data supporting the "no change hypothesis." The report also detailed the incident where an OpenAI-trained agent attacked Hugging Face, where the AI agent achieved cluster-level privilege escalation through a message board established via Artifactory, which went undetected from May to July. While building POC verification for existing vulnerabilities, the team found that Claude Fable and GPT-5.6 Sol frequently rejected security-related requests, ultimately relying on open-source models such as DeepSeek V4, Kimi K3, and GLM-5.2 to complete the task.SemiAnalysis stated that the core issue in the Neocloud (new cloud) industry is not the new risks brought by AI, but rather the long-term absence of basic patch management, tenant isolation, and security design. They recommended that vendors establish automated security announcement monitoring systems and rectify single points of failure that could expose all users' architectural patterns.

OKX Director Lennix: The financial market is accelerating towards tokenization and around-the-clock trading

On August 28, OKX Director Lennix was invited to attend the Bitcoin Asia 2026 roundtable forum "The Rise of Financial Super Applications," where he shared insights on the integration of traditional finance and the crypto market, the underlying infrastructure of financial super applications, and the development prospects of stock tokenization.Lennix stated that financial products are accelerating towards integration within the same account system. In the future, users will want to trade and manage different categories of financial assets under the same funds, the same account, and the same margin and risk control system, which will become an important direction for the continuous evolution of the industry. He pointed out that on the surface, financial super applications allow trading of crypto, traditional stock assets, foreign exchange, commodities, etc., within one application; however, the real challenge lies in the connectivity of the underlying infrastructure of various assets, including the banking system, wallets, trading accounts, shared margins, and the collaboration between risk control and compliance backends.At the same time, Lennix mentioned that stock tokenization and the tokenization of traditional financial assets are essentially an upgrade to the traditional market. By connecting relevant assets to the matching, margin, risk control, and compliance systems of cryptocurrency exchanges, the market can achieve longer trading and risk management periods, while continuously providing price signals during non-trading hours. When discussing institutional cooperation, Lennix stated that the strategic investment of the Intercontinental Exchange in the OKX Group reflects that the financial market is moving towards tokenization and around-the-clock trading. With the continuous growth of stock tokenization business, this field is expected to become an important development direction for future financial markets.

first_img Nvidia suspends part of its revenue-sharing financing arrangements with AI cloud companies

According to the Wall Street Journal, Nvidia has suspended some transactions in its new financing plan. This plan aims to provide credit support to AI cloud companies in exchange for revenue sharing. Insiders say that the chip giant withdrew from the related arrangements last week but may adjust the plan in the future or incorporate it into other projects.A Nvidia spokesperson stated that the new business model aimed at the rapidly growing AI ecosystem and open computing power access is still progressing and continues to evolve due to strong demand. The plan was announced less than two months ago, intending to support the financing needs of small AI cloud companies: if customers cannot sell computing power, Nvidia can lease back the relevant computing power, acting as a guarantee buyer, thereby facilitating companies in raising funds to purchase Nvidia AI chips; Nvidia would then share cloud revenue generated by customers based on its chips, in addition to hardware sales.Nvidia stated in this week's earnings call that this model is expected to contribute billions of dollars in revenue in the medium to long term. However, recent investor scrutiny regarding its capital flow back to the AI ecosystem has increased, raising concerns that so-called circular transactions may inflate demand. Reports indicate that some employees had expressed antitrust concerns to customers; in the early stages of the plan, Nvidia also faced dissatisfaction from some potential partners due to attempts to limit chip rental targets, preferring to distribute to multiple small customers rather than a single large customer, and requiring a 50% revenue share after reaching a certain threshold.
app_icon
ChainCatcher Building the Web3 world with innovations.