BTC $78,024.12 -0.89%
ETH $2,450.21 -0.67%
BNB $686.06 -1.57%
XRP $1.37 -2.37%
SOL $102.71 -3.38%
TRX $0.3343 -1.89%
DOGE $0.0826 -3.20%
ADA $0.1958 -3.65%
BCH $246.35 -2.09%
LINK $11.29 -1.77%
HYPE $81.38 -2.80%
AAVE $123.53 -2.05%
SUI $0.7195 -3.52%
XLM $0.1752 -3.09%
ZEC $825.53 -2.42%
BTC $78,024.12 -0.89%
ETH $2,450.21 -0.67%
BNB $686.06 -1.57%
XRP $1.37 -2.37%
SOL $102.71 -3.38%
TRX $0.3343 -1.89%
DOGE $0.0826 -3.20%
ADA $0.1958 -3.65%
BCH $246.35 -2.09%
LINK $11.29 -1.77%
HYPE $81.38 -2.80%
AAVE $123.53 -2.05%
SUI $0.7195 -3.52%
XLM $0.1752 -3.09%
ZEC $825.53 -2.42%

tur

All
Article
Flash

SemiAnalysis releases Neocloud security deep report: Infrastructure configuration errors are shocking, and cross-tenant RCE could affect banks, telecommunications, and even a country's intelligence agency

The semiconductor and AI independent research organization SemiAnalysis released a deep security report on Neocloud (new cloud), revealing various cross-tenant security vulnerabilities discovered during the ClusterMAX 3 testing period. In a four-month test covering 25 vendors and 32 clusters, the team achieved multiple instances of cross-tenant remote code execution (RCE) solely by exploiting publicly known vulnerabilities and basic configuration checks. Affected entities included banks, telecommunications companies, universities, research institutions, AI laboratories, and even a national intelligence agency.Typical issues included: shared Kubernetes control plane leading to tenant metadata visibility, container escape, exposure of BMC/IPMI management networks, incorrect configuration of InfiniBand security keys (P_Key, SA_Key, M_Key), unfortified default trust mode of BlueField DPU, Grafana monitoring dashboards using god-level API keys, and lack of VXLAN isolation in front-end networks. The report specifically pointed out a cascading vulnerability case: a misconfiguration of shared vCluster combined with software versions being two years out of date ultimately completed the POC verification of cross-tenant RCE within an afternoon.Notably, the report questioned the mainstream narrative that "AI has fundamentally changed the pace of cybersecurity": statistics on CVEs for NVIDIA GPU drivers, CUDA, PyTorch, Kubernetes, Docker, and the Linux kernel showed that there was no significant increase in vulnerabilities after the popularization of AI coding models, with most data supporting the "no change hypothesis." The report also detailed the incident where an OpenAI-trained agent attacked Hugging Face, where the AI agent achieved cluster-level privilege escalation through a message board established via Artifactory, which went undetected from May to July. While building POC verification for existing vulnerabilities, the team found that Claude Fable and GPT-5.6 Sol frequently rejected security-related requests, ultimately relying on open-source models such as DeepSeek V4, Kimi K3, and GLM-5.2 to complete the task.SemiAnalysis stated that the core issue in the Neocloud (new cloud) industry is not the new risks brought by AI, but rather the long-term absence of basic patch management, tenant isolation, and security design. They recommended that vendors establish automated security announcement monitoring systems and rectify single points of failure that could expose all users' architectural patterns.

DWF Ventures: The rapid rise of social trading, platform competition is shifting from trade execution to social networks and information advantages

DWF Ventures released a report stating that as trading fees continue to approach zero, social trading is becoming a new direction for financial trading platforms to compete for users and build moats.The rise of social trading stems from users seeking validation from others and references for investment decisions. From early brokerage copy trading to investment communities like Reddit and Stocktwits, and now to platforms that combine real position verification, trading signals, and social relationships, social trading is evolving from a simple copy trading tool into a product form that integrates trading, content, and social interaction. As trade execution becomes increasingly homogenized, the future competitive advantage of platforms may come more from network effects, resources of well-known traders, and exclusive information and distribution capabilities.Analysis suggests that social trading platforms are forming a clear growth flywheel: platforms attract well-known traders and their fans, traders build reputations through public trading, fans amplify market influence by following trades, which in turn increases the visibility of traders and the user base of the platform. Public calls for trades may even generate a certain "self-fulfilling" effect in this process.Platforms also lower the entry barriers for users through one-click trading, low-threshold acceptance, trading competitions, and fee incentives, and leverage the social influence of top traders to facilitate user migration. In the future, the social trading ecosystem in the cryptocurrency and traditional stock sectors may further integrate, and platforms that master trader, user attention, and information flow are expected to form stronger network effects.However, social trading also faces significant structural risks. Data shows that among approximately 292,000 wallets analyzed by the Fomo platform over the past three months, only 6.16% achieved profitability based on realized gains. Followers lack independent investment logic and are easily influenced by herd behavior, while there may also be conflicts of interest between traders and followers.Furthermore, even if platforms can verify public positions, traders may still establish undisclosed positions through other wallets, making information asymmetry difficult to eliminate completely. Analysis suggests that as the boundaries between trading and entertainment continue to blur, platforms that can establish unique information layers, gather quality traders, and form network effects may gain an advantage in the competitive social trading market.

a16z raises $1.1 billion for a new fund: focusing on the construction of a full set of infrastructure for AI operations

Silicon Valley's renowned venture capital firm a16z has announced that it has raised $1.1 billion for its latest fund, the Machine Age Fund, which will focus on investing in the full suite of computing infrastructure that supports AI operations, including chips, memory, networking, storage, as well as complete systems such as data centers, robots, and home AI devices.a16z stated that over the past year, there has been a significant turning point in the growth of AI in terms of application capabilities and types of work. As AI expands from chat and reasoning further into programming and other knowledge work, the demand for computing power and tokens is experiencing exponential growth, and machine intelligence is accelerating its deep development.a16z indicated that its team possesses extensive experience in hardware, data centers, chips, networking, and large-scale computing systems. They have also established a resource network covering market expansion, talent recruitment, marketing, customers, suppliers, and American manufacturing, which will further support the next generation of AI hardware entrepreneurs. a16z mentioned that we are currently at an important juncture in the transformation of computing paradigms and look forward to collaborating with entrepreneurs dedicated to reconstructing AI hardware and advancing the arrival of the "Machine Age."
app_icon
ChainCatcher Building the Web3 world with innovations.