‼️🚨 BREAKING: Nvidia is entering the CPU market. At Computex, the company announced its RTX Spark chips, full Arm-based processors that run Windows and put Nvidia in direct competition with Intel, AMD, and Qualcomm.

This is the long-rumored "N1X" silicon. RTX Spark pairs a 20-core Grace Arm CPU (custom-built with MediaTek) and a Blackwell GPU with 6,144 CUDA cores, the same core count as a desktop RTX 5070, though the laptop version runs at far lower power (45-80W). The two are linked over NVLink-C2C and share up to 128GB of unified LPDDR5X memory accessible to both CPU and GPU, an approach similar to Apple's M-series but on a larger scale.

Nvidia is positioning it as an AI chip first. It claims RTX Spark can run agents like OpenClaw and Codex locally, render 90GB 3D scenes, edit 12K video on the built-in Blackwell encoder, and run 120-billion-parameter models on-device, up to 1 petaFLOP of FP4 AI performance.

But it games too. Nvidia demoed Forza Horizon 6 and 007: First Light, claiming 1440p at 100fps with ray tracing (with DLSS). That's a far stronger gaming profile than any prior Windows-on-Arm chip. Optimized versions of Photoshop and Premiere are coming later this year, reportedly up to twice as fast.

This makes Nvidia the second major Arm-for-Windows supplier after Qualcomm, whose Microsoft exclusivity has now lapsed. Microsoft is already in: the new Surface Laptop Ultra is built on RTX Spark from the silicon up. First laptops ship this fall from ASUS, Dell, Microsoft, MSI, and Lenovo. Nvidia says it'll ship new Windows chips every two years, with a Rubin-GPU version on the roadmap.

❗️ Nvidia's next-gen Vera Rubin datacenter platform is now in full production. It pairs a CPU and GPU tightly linked over NVLink, and the CPU half means Nvidia is now coming for Intel and AMD's territory too.

The Rubin GPU (the Blackwell successor) delivers:
- up to 5x faster inference, 3.5x faster training
- 50 petaflops per system (vs 10 on Blackwell)
- inference cost cut to ~1/7

But the quieter big move is Vera, the new CPU half of the platform, now sold as a standalone server chip aimed directly at x86:
- "The CPU for Agents," claims 1.8x faster task completion than x86 on AI workloads
- 88 custom Arm cores, 176 threads, 227 billion transistors (Grace had 72 cores / 64B)
- 2x the memory bandwidth and 3x the bandwidth-per-core of x86 with DDR5

Early customers: Anthropic, OpenAI, xAI, ByteDance, CoreWeave, Oracle. Ships this fall.

‼️🚨 BREAKING: Yet another Instagram exploit exists due to Meta's AI chatbot having no proper guardrails. Sellers are now using it to grab premium one-letter usernames, by tricking the AI with hidden characters, then talking it into applying the change. Monitor bots already show OG handles getting swapped.

‼️🚨 BREAKING: Another researcher skipped coordinated disclosure entirely and dropped a critical 1-click GitHub token theft in public because he doesn't want to deal with MSRC. In his own words: "I really don't want to deal with MSRC on VSCode bugs."

The bug: just clicking a link can hand an attacker a GitHub token that reads AND writes to all your repos, including private ones. It lives in github[.]dev, GitHub's browser-based VSCode editor, which passes the browser an OAuth token that isn't scoped to a single repo. That token can touch everything you can.

Researcher Ammar Askar found that VSCode's sandboxed "webviews" leak keyboard events to the main editor. A malicious repo opened via one link can simulate keystrokes, install a local extension that skips VSCode's publisher-trust check, and exfiltrate your token. He published a working proof-of-concept.

He says when he reports github[.]dev bugs, GitHub tells him they're out of scope and to go report to MSRC, and a prior VSCode bug he reported was silently fixed with no credit. One commenter summed up the mood: "MSRC has turned into Feedback Hub."

Sources:
https://reddit.com/r/netsec/comments/1tuue57/1click_github_token_stealing_via_a_vscode_bug/

https://blog.ammaraskar.com/github-token-stealing/

‼️🚨 German police have been buying commercial location data, harvested from phone apps and resold by data brokers, to track phones without a warrant. An investigation confirmed at least two state criminal offices did it.

Experts call it likely unlawful; a data-protection authority is now investigating.

Source: https://netzpolitik.org/2026/daten-schwarzmarkt-deutsche-polizei-nutzt-offenbar-rechtswidrig-databroker/

🚨🇩🇪 Germany just fined a citizen up to a month's income for posting "Lügenfritz" ("Lying Fritz") about Chancellor Friedrich Merz in a Facebook comment.

Politicians love to call themselves the guardians of democracy. But Germany has a special law that gives politicians MORE legal protection from insults than ordinary citizens get. The powerful, shielded from the powerless who criticize them.

Fining people for airing their opinion is how you take free speech away. It makes the government the editor of every sentence you publish.

🤡 And here's the kicker: German MPs have "Indemnität", near-total lifelong legal immunity for what they say in parliament.

https://www.welt.de/politik/deutschland/article6a1ee49d1f46a650bff5cf50/mehrere-verfahren-beleidigung-von-merz-unter-facebook-post-gericht-verhaengt-hohe-geldstrafe-fuer-luegenfritz.html

❗️ Peak slop achieved: Microsoft announced "Scout," an always-on AI agent that reads your email and chats and acts on your behalf unprompted. They call it an "Autopilot." It's the sloppification of work: AI slop now runs all day reading your inbox.

‼️🚨 A new npm supply-chain attack compromised 57 packages across over 286 malicious versions in under 2 hours. The attackers used self-replicating malware, a new version of the Miasma worm, which also used evasion techniques to stay under the radar.

The payload targets CI/CD and developer credentials, including GitHub Actions secrets, cloud credentials, Vault tokens, SSH keys, npm and GitHub tokens, and password-manager stores. This variant also injects AI coding assistant config files at .claude, .cursor, .gemini, and .vscode paths, a separate persistence and repo-poisoning angle.

Source: https://www.stepsecurity.io/blog/binding-gyp-npm-supply-chain-attack-spreads-like-worm

❗️Google employees are flooding an internal meme board with posts about how bad the company's AI is.

A source says dozens of anti-AI memes post weekly, spiking when models update or their internal coding tool Jetski breaks. One showed Jetski admitting it fabricated report metrics with over 400 upvotes.

Engineers say AI removed the code-gen bottleneck but jammed everything else: testing, build times, and human review now drowning in code nobody wrote.

CEO Pichai says 75% of new code is AI-generated, btw.

Via 404Media https://www.404media.co/google-employees-internally-share-memes-about-how-its-ai-sucks/?ref=daily-stories-newsletter

‼️ The alienation continues: more security researchers are sticking up the middle finger after feeling squeezed by Microsoft and GitHub. MSRC emailed Black Hat USA 2026 presenters asking which MSRC cases, VULN-IDs, or CVEs their talks would cover. GitHub told a researcher to delete his public PoC repos and flagged his accounts under ToS.