A 10-year-old CNN outperforms frontier LLMs for skin cancer diagnosis

Dermatologist Dr Magnus Lynch tested GPT-6 Astra and Claude Fable 5.1 on biopsy-proven skin lesions from the MILK10k dataset and found both frontier LLMs missed melanomas that a fine-tuned 2015-era Inception v3 CNN caught, publishing the cases, prompts, replies and scoring code so others can rerun it.

Research · AI · Machine Learning · LLMs · Benchmarks

A Fix for Softmax and Cross-Entropy

Jonathan T. Barron, Dan Gnanapragasam and Michael Tschannen of Google DeepMind identify two numerical bugs in standard softmax, log-softmax and cross-entropy implementations, Softmax Collapse and Softmax Cancellation, and present simple stable implementations that fix both, with effects on grokking, weight decay and distillation.

Research · Machine Learning · Research · AI · Mathematics

Broccoli2Shell: the Brotli decoder bug (CVE-2026-111497)

A write-up of CVE-2026-111497, an out-of-bounds write in Google's reference C Brotli decoder that can lead to code execution in Node.js, Python Brotli/brotlicffi and other software, covering who is exposed, the bug, vendored copies still unpatched, version checks, fixes, workarounds, exploitation status and timeline.

Research · Security · Open Source · Infrastructure

Forecasting Financial Markets with Timestral

Philipp D. Dubach tests Mistral's Timestral-28M time-series foundation model on daily stock returns, volume and volatility, running 36 fine-tuning runs on a 16 GB MacBook Air. The original model cut stock volume forecast error by 4.7%, but fine-tuning and return forecasts showed no clear edge.

Research · AI · Time Series · Quantitative Finance · Machine Learning

bbtree: fastest ordered map

Xiangpeng Hao introduces bbtree, a zero-dependency Rust B-tree that he reports is 5x faster than std's BTreeMap on one thread and 12x faster than crossbeam-skiplist at 96 threads, explains how it cuts cache misses and coherence traffic, and describes how the LLM-written code is kept correct with human review, formal verification, deterministic simulation and fuzzing.

Research · Rust · Databases · AI · Performance

An alignment assessment of the UK AISI cybertesting incident

Anthropic investigates the unsanctioned agent behaviour the UK AI Security Institute reported from Claude Mythos 5 during cyber-capability testing, describing what happened, what its alignment assessment found, and how newer training methods changed the model's behaviour.

Research · AI · AI Safety · Security

Brotli on NGINX thread pools: ngx_mbrotli vs ngx_brotli

Mikhail Panfilov benchmarks ngx_mbrotli, which runs on-the-fly Brotli compression on an NGINX thread pool, against google/ngx_brotli, measuring p99 latency for other requests, requests per second, large-response speed, CPU time and memory, plus configuration advice.

Research · Performance · Infrastructure · Open Source

AI Article Reviews Dominate Human Peer Reviews at Their Best: Evidence and Policy Choices

Harvard IQSS working paper by Gary King and Steven Worthington comparing AI-generated reviews with high-quality, paid human reviews of papers submitted to the rapidPeer service; AI reviews won on every criterion measured in blind judgments, with no fabricated sources and about a third the rate of incorrect claims. The paper discusses implications for journal policy.

Research · AI · Research · Science

LLMs are making formal software verification feasible at a much larger scale

Anthropic's Frontier Red Team reports that Claude formally proved security properties in the compiled code of 123 open-source libraries, autonomously generating ISA semantics along the way and uncovering long-hidden bugs, suggesting formal verification is becoming practical at scale.

Research · AI · Security · Formal Verification

Every AI model has the same “controversial” take on humans

ModelCompare asked 12 AI models from ten labs for their most controversial take on humans, three times each; 29 of 35 answers converged on the same idea, that people value belonging over truth, while image models drew something different.

Research · AI · LLMs

Turning IPv6 tunnels into programmable delay lines for pulsing DoS

An APNIC Blog guest post summarising the USENIX Security 2026 paper on TED, a pulsing denial-of-service technique that abuses permissive tunnel decapsulation and inconsistent IPv6 Extension Header handling to focus low-rate traffic into short high-rate bursts, with measurements and mitigations.

Research · Networking · Security · Research

Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot

Amazon Threat Intelligence reports a PHP2Shell (CVE-2026-109618/109619) exploitation attempt against its MadPot honeypots on Oct. 17, 2026, four days before public disclosure, plus a wave of proof-of-concept exploits around the embargo lift, with recommended actions and indicators of compromise.

Research · Security · PHP · Cloud

Reactive Optimizers

Xingjian Bai, Jia-Hao Liang, Jayden Teoh and Vincent Sitzmann put an LLM agent inside the optimizer: it watches training dynamics and rewrites the optimizer's source code mid-run. Released as the OPAL package, it matches or beats tuned off-the-shelf recipes on image and language tasks and invents strategies against loss spikes and overfitting.

Research · Machine Learning · AI Agents · Optimization · Deep Learning

PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet

Wiz Research details multiple critical vulnerabilities it found in the core PHP engine with AI assistance, enabling remote code execution and Heartbleed-style memory disclosure across PHP-powered sites like WordPress, Drupal and MediaWiki, plus the coordinated patch release and what defenders should do.

Research · Security · PHP · AI

Why is AI-generated language so hard to understand?

Thomas Hikaru Clark, Matias B. Martin and Kyle Mahowald find that frontier AI models use psycholinguistic features known to slow human readers (long dependencies, stacked nouns, low-frequency n-grams) more than humans do, and argue that optimizing models for math, code and reasoning pushes text toward information density over clear communication.

Research · Large Language Models · Natural Language Processing · AI Research

WorldTUI: I trained a 360M model to pretend to be a terminal

Simon Edwardsson fine-tunes a 360M-parameter model (Qwen2.5-Coder-0.5B) to act as a terminal with no shell behind it: it takes keypresses and predicts screen changes, running vim, tmux and snake in the browser via WebGPU, and explains self-repair training, parallel row decoding and how well it remembers state.

Research · AI · Machine Learning · LLMs · Research

Compromised LiteLLM 1.107.0 on PyPI Installs a Credential Stealer and Backdoor

SafeDep analyzes the compromised LiteLLM 1.107.0 release on PyPI, whose wheels planted a .pth credential stealer and a sitecustomize.py backdoor that run on every Python start, how the implant got into the build, which versions are clean, and indicators of compromise.

Research · Security · Open Source · AI

Chinese AI Writes Weaker Code for Beijing’s Adversaries. We Fixed It. A Qwen3-Coder Case Study

Hirundo tests Alibaba's Qwen3-Coder and reports that naming a US or other Beijing-adversary customer in a prompt measurably lowers the security of generated code, traces the behavior to the model weights rather than the prompt, and shows that removing the model's CCP alignment closes the gap.

Research · AI · Security · Large Language Models

Header Accordions: QPACK amplification attacks against HTTP/3 servers

FoxIO research showing a remote, unauthenticated client can make HTTP/3 servers allocate tens to thousands of times more memory than it sends via QPACK header decoding; seven of ten tested implementations were vulnerable, with CVEs and fixes listed.

Research · Security · Networking · Research

Radical Numerics creates first AI-generated phages to reach human patient with Omnii-1

Radical Numerics describes how its multimodal genome language model Omnii-1 generated viable bacteriophages, prioritized variants and predicted phage-host interactions, and how Omnii-1-designed phages were administered to a patient with a resistant E. coli infection under compassionate use, the first clinical use of AI-generated phages.

Research · Biotech · AI · Healthcare