Skip to main content

A VM escape bug, China's AI export plan and a big open model

  1. Security

    Linux kernel bug lets a virtual machine read its host's memory (opens in a new tab)

    A critical bug, CVE-2026-99999, lets code inside a guest virtual machine read the host's kernel memory or crash the host. If you run shared servers or code sandboxes, patch as soon as fixes land. Red Hat had not shipped one yet.

    Source: AlmaLinux OS Blog

  2. Regulation

    China plans export controls on 23 AI technologies, including models (opens in a new tab)

    China's commerce and science ministries published a draft list of AI technologies that could need an export licence, including large models, agents and some chip designs. Teams that use Chinese models outside China should follow this. Open-source releases are not included.

    Source: AP via PBS NewsHour

  3. Open Source

    Reflection releases Beam, a 501B-parameter open model under Apache 2.0 (opens in a new tab)

    US lab Reflection released its first open model. It uses 23B parameters at a time, handles 1M tokens of context and works with vLLM, SGLang and Transformers from day one. Teams now have a freely licensed US option to run themselves.

    Source: Hugging Face Blog

  4. Security

    Chinese hackers used a BeyondTrust bug for weeks before it was fixed (opens in a new tab)

    Google's Mandiant says a China-linked group used CVE-2026-102764 to break into BeyondTrust Remote Support systems from late August, before the October 8 fix. These tools have deep access to company networks, so patch now and check for deleted logs.

    Source: SecurityWeek

  5. Business

    Nscale's main data centre in Norway is running late ahead of its IPO (opens in a new tab)

    Bloomberg reports the UK AI cloud company's Norway site has had a fire, permit problems and building delays while it plans to raise up to $3 billion. GPU capacity promised by newer cloud providers can arrive later than planned.

    Source: Bloomberg

  6. AI

    TypeSafe's Jev model reached 35% of paid teams on Vercel's AI Gateway (opens in a new tab)

    Jev returns a fixed set of answers with a confidence score for each, instead of free text. It reached 35% of paid teams on Vercel's AI Gateway within two weeks. Small, cheap models are taking over simple jobs like sorting and checking inputs.

    Source: TechCrunch

My take

Friday's news has one clear lesson: the walls we trust are thinner than we think. A kernel bug broke the wall between virtual machines and their host, a remote-support tool let attackers into company networks, and China now wants to control AI models the way it controls physical goods. At the same time, open models like Beam and Jev keep getting better, so teams have real choices beyond the big paid APIs. Add extra layers of protection around your sandboxes, and treat where your models come from, and their licence, as a supply-chain question.