cati

The semiconductor and AI independent research organization SemiAnalysis released a deep security report on Neocloud (new cloud), revealing various cross-tenant security vulnerabilities discovered during the ClusterMAX 3 testing period. In a four-month test covering 25 vendors and 32 clusters, the team achieved multiple instances of cross-tenant remote code execution (RCE) solely by exploiting publicly known vulnerabilities and basic configuration checks. Affected entities included banks, telecommunications companies, universities, research institutions, AI laboratories, and even a national intelligence agency.Typical issues included: shared Kubernetes control plane leading to tenant metadata visibility, container escape, exposure of BMC/IPMI management networks, incorrect configuration of InfiniBand security keys (P_Key, SA_Key, M_Key), unfortified default trust mode of BlueField DPU, Grafana monitoring dashboards using god-level API keys, and lack of VXLAN isolation in front-end networks. The report specifically pointed out a cascading vulnerability case: a misconfiguration of shared vCluster combined with software versions being two years out of date ultimately completed the POC verification of cross-tenant RCE within an afternoon.Notably, the report questioned the mainstream narrative that "AI has fundamentally changed the pace of cybersecurity": statistics on CVEs for NVIDIA GPU drivers, CUDA, PyTorch, Kubernetes, Docker, and the Linux kernel showed that there was no significant increase in vulnerabilities after the popularization of AI coding models, with most data supporting the "no change hypothesis." The report also detailed the incident where an OpenAI-trained agent attacked Hugging Face, where the AI agent achieved cluster-level privilege escalation through a message board established via Artifactory, which went undetected from May to July. While building POC verification for existing vulnerabilities, the team found that Claude Fable and GPT-5.6 Sol frequently rejected security-related requests, ultimately relying on open-source models such as DeepSeek V4, Kimi K3, and GLM-5.2 to complete the task.SemiAnalysis stated that the core issue in the Neocloud (new cloud) industry is not the new risks brought by AI, but rather the long-term absence of basic patch management, tenant isolation, and security design. They recommended that vendors establish automated security announcement monitoring systems and rectify single points of failure that could expose all users' architectural patterns.

According to Coinglass data, the cryptocurrency Fear and Greed Index is currently at 68, up 1 point from yesterday. The average over the past 7 days is 69, and the average over the past 30 days is 44.

According to CryptoSlate, Polygon Labs issued an urgent notice that Polygon PoS nodes remaining on the old versions of Bor or Heimdall have lost consensus after the activation of the Austin and Kyoto hard forks and need to upgrade to catch up with the network progress. Austin was activated at mainnet block 91,949,700, requiring Bor v2.1.0 or above; Kyoto was activated at height 51,533,000, requiring Heimdall v0.11.0 or above.Austin fixed two types of Bor resource exhaustion risks: L1 to L2 bridging state synchronization events not counted towards the gas limit could slow down block processing; the TxDependency field having no size limit could lead to peer node crashes. Kyoto addressed vulnerabilities such as deep nested message attacks, fee coin scanning, and checkpoint signature recovery. Both hard forks are pure binary upgrades, requiring no state migration, and non-forked nodes do not need to resynchronize. Operators of old clients should upgrade and restore synchronization under Polygon's guidance if necessary.

According to Coinglass data, the cryptocurrency Fear and Greed Index is currently at 67, down 5 points from yesterday. The average over the past 7 days is 69, and the average over the past 30 days is 43.

According to Catcher Predict monitoring, in the prediction market Polymarket for the event "US Open Qualifiers: Vilius Gaubas vs Harry Wendelken," the option "Vilius Gaubas" in the sub-market "US Open, Qualification ATP: Vilius Gaubas vs Harry Wendelken" has experienced a drastic fluctuation in winning probability, plummeting from 73.5% an hour ago to the current 27% (a fluctuation of 46.5%). Please note the impact of relevant breaking news.

The security team of the open-source wallet provider OneKey successfully replicated the exploitation of a vulnerability in the old version of the Ledger Ethereum application in a laboratory environment. OneKey's founder and CEO Wang Yishi stated that they executed a "transaction replacement attack" on Ledger Ethereum application version 1.22.1 by exploiting a previously patched vulnerability, allowing attackers to overwrite pending transactions while users review legitimate transactions.Ledger responded that exploiting this vulnerability requires controlling the communication between the device and the host, such as through malware, compromised wallet software, or malicious web pages. Ledger has added application layer protections in the Ethereum application version 1.22.2 released on August 13 and fixed the underlying issue in Secure SDK 26.6.1 on August 21. Ledger emphasized that no users were hacked as a result; this was merely a replication of the vulnerability in a laboratory environment.This security test occurred after the Coldcard vulnerability incident. Previously, the Coldcard wallet had a firmware vulnerability that posed security risks to some mnemonic phrase generation, but Ledger stated that its devices were not affected by this vulnerability because recovery phrases are generated by a certified random source built into the device's secure chip. The vulnerability replicated by OneKey is unrelated to mnemonic phrase generation but affects the way transactions are processed during the signing process.

According to Coinglass data, the cryptocurrency Fear and Greed Index is currently at 72, up 2 points from yesterday. The average over the past 7 days is 70, and the average over the past 30 days is 41.

According to Gate market data, on August 28, both the Hang Seng Index and the Hang Seng Tech Index rose in the morning session. By the midday close, the Hang Seng Index was up 0.47%, and the Hang Seng Tech Index was up 0.6%.Hong Kong stock telecommunications infrastructure concept stocks led the gains, with Junzhi Group and Huanlian Lianxun rising over 4%, and Zhongji Xuchuang rising over 3%. Domestic property stocks collectively rose, with Xuhui Holdings Group and Sunac China rising more than 5%.

Investor Joanna Lichter published a post outlining the working hypothesis of value accumulation in the robotics field, which she believes has a barbell structure: one end consists of horizontal robotic foundation models (RFM) and infrastructure platforms that achieve compound growth through data, computing power, and ecosystems; the other end consists of category-leading application companies that capture value by transforming intelligence into useful work. The middle layer lacks attractiveness, including interchangeable models, easily replicable tools, and deployments lacking software leverage.She pointed out that, unlike large language models, robotics faces distribution costs, scarce physical data, real-time computing power limitations, and security constraints, presenting a gated diffusion rather than immediate large-scale adoption. If deployment can form a learning feedback loop, reducing the manpower required per robot and accumulating reusable data and operational knowledge, it can become a moat. Vertical entry points can accelerate this path, allowing value to ultimately accumulate at both ends of the technology stack.

a16z partner Sarah Wang recently published an article pointing out that AI application layer products should not price based on tokens like the model layer, but rather on "recognizable work units." The article argues that token pricing anchors the value of application products to a unit whose cost is continuously declining, making it difficult for customers to predict context length, retrieval volume, or reasoning time, and improperly compares applications to raw computing power.The article suggests a tiered pricing model based on value levels: model layer priced by tokens; application layer priced by recognizable work units for customers (such as account research briefs, code modifications, completed queries), which can be encapsulated through Credits; and scenarios that are attributable and have clear value priced directly by results (such as resolved customer service conversations, qualified leads). The design of Credits should map to different levels of work difficulty to protect gross margins and distinguish "work value" from "delivery cost." The article uses Clay as an example, where its new pricing separates Data Credits (third-party data) from Actions (orchestrated work), only passing on costs for reasoning models with significant cost fluctuations without markup. The author believes that pricing anchored to value rather than computing cost allows customers to understand spending in relation to value, while also benefiting product providers in maintaining profit margins.

According to Bitcoin News, Sparrow Wallet v2.5.4 has been released after extensive AI-assisted review, containing multiple security enhancement updates aimed at reducing users' reliance on external servers such as Electrum.Additionally, this version strengthens Ledger, Keycard, Trezor, Payjoin, PSBT, and multi-signature handling, removes Bitcoin Core credentials and other confidential information from debug logs, restricts existing wallet and backup directory permissions to owner access only, closes local DNS resolution leaks when using Tor, and enhances wallet import, signing, downloading, and server response verification. This update expands Sparrow Wallet's scope for independently verifying transaction data, hardware devices, and other inputs, reducing reliance on external servers for data provision.

The Sandbox released an update on the security vulnerability attack incident involving the SAND cross-chain bridge, stating that the attacker modified the verification mechanism to forge cross-chain deposit messages and mint unbacked SAND. This incident resulted in approximately 14.7423 million SAND being withdrawn, valued at about $697,000. Additionally, some uncollateralized SAND was profited through market trading, leading to an overall economic impact of approximately $1.497 million, of which the attacker actually obtained about $987,000.The Sandbox stated that the attack did not affect the supply of SAND on Ethereum and Polygon, with the total amount of SAND on Ethereum remaining unchanged at 3 billion. There were also no super administrator privileges stolen, and the attack stemmed from a vulnerability caused by the combination of the general call function in the token contract and the design of bridge permissions. Currently, the related addresses have been marked, and collaboration has begun with exchanges, security agencies, and the LayerZero team.For affected users, The Sandbox promises to compensate wallets holding legitimate bridged SAND with a 1:1 ratio of SAND on the Ethereum chain based on an on-chain snapshot taken before the attack. The compensation application process is expected to open within two weeks and will last for two weeks.

According to Coinglass data, the cryptocurrency Fear and Greed Index is currently at 70, up 6 points from yesterday. The average over the past 7 days is 69, and the average over the past 30 days is 40.

Franklin Templeton's Chief Investment Officer for Crypto, Seth Ginns, stated that the current market is at a "turning point," where large investors will begin to allocate to liquidity crypto funds in unprecedented ways.Seth Ginns pointed out that this phase signifies a significant change in how institutional funds are allocating to crypto assets, and liquidity crypto funds are expected to see larger-scale participation from major investors.

According to Gate market data, after-hours trading on Wednesday for U.S. stocks saw Nvidia's new quarterly results continue to exceed market expectations, with a forecast of approximately 70% sales growth for the next fiscal year, driving AI concept stocks higher in after-hours trading.The storage sector collectively strengthened, with SK Hynix rising 4.48%, SanDisk up 3.71%, Micron Technology up 3.67%, Seagate Technology up 3.15%, and Western Digital up 3.11%. The Neocloud sector saw widespread gains, with Nebius up 6.27%, CoreWeave up 4.76%, Applied Digital up 3.26%, and both IREN and Core Scientific up 3.16%.Optical communication stocks rose across the board, with Applied Optoelectronics up 4.25%, Marvell Technology up 4.08%, Credo up 3.78%, Coherent up 3.35%, and Astera Labs up 3.34%. Semiconductor stocks also strengthened, with Arm up 4.18%, Marvell Technology and Nvidia both up 4.08%, Lam Research up 2.65%, and KLA up 2.42%.

Matthew Gould, the founder of Unstoppable Domains, stated that the company did not submit an application for its Web3 top-level domains in ICANN's 2026 expansion round and will refund customers who purchased related domains. Gould mentioned that the compliance, application, and bidding costs of incorporating Web3 domains into the ICANN system exceeded the company's expected recoverable sales. This move ends the company's commitment since 2019 that domains like .crypto and .wallet would eventually be resolvable in standard browsers.The application window for this round of ICANN opened on April 30 and closed on August 12, receiving over 1,600 major applications. Gould stated that customers have been notified via email, but the list of affected extensions and refund terms have not been disclosed. Some holders questioned the scope of the refunds, claiming they held the domains based on Unstoppable's commitment to advance the ICANN application. Gould responded that Web3 domains will still serve as on-chain assets for cryptocurrency transactions.Unstoppable continues to participate in ICANN activities as a service provider and previously announced a partnership with Telegram to apply for the .gram domain. Meanwhile, ENS has chosen a different path, with token holders approving the restructuring of the ENS Foundation to pursue the .ens top-level domain in ICANN, but ENS will not apply for .eth, as it is reserved for ISO 3166-1 country codes.

Pump.fun announced that its application now supports HyperEVM, allowing users to trade any HyperEVM tokens using USDC, and receive referral rewards along with a near-zero fee trading experience.Pump.fun stated that it is the first application to introduce HyperEVM into relevant trading scenarios.

Analyst Ted (@TedPillows) stated that the Coinbase Ethereum premium has turned positive, indicating that institutions are accumulating. In related discussions, market participants noted that a positive premium means that U.S. demand is beginning to re-emerge, and Ethereum is showing some strength.The Coinbase premium is typically used to measure the premium or discount level of asset prices on the Coinbase platform relative to other major trading platforms. When this indicator turns from negative to positive, it is often interpreted as U.S. investors, particularly institutional funds, being relatively active in buying, providing support for spot demand. The recent rebound in Ethereum-related premiums is viewed by some observers as one of the signals of marginal improvement in liquidity.