Pluto Security details how a trust_remote_code download turns into malware
THE SO WHAT
The Hugging Face cryptominer case shows that `trust_remote_code` isn’t a bug, it’s a supply-chain decision—your model loader is effectively a remote code execution surface. If your teams pull models from public hubs, lock down this flag, pin and review code, and treat model ingestion with the same controls you use for third-party libraries.
READ THE SOURCE
MORE FROM THE WIRE
Deep & Emerging TechFBI leads action to shut down Virtualine bulletproof service linked to major cybercrime activity
Takedowns of bulletproof hosts like Virtualine show law enforcement is pushing deeper into the infrastructure layer of cybercrime—forums, laundering, and hosting. Security leaders should expect more churn in attacker tooling and infrastructure, which briefly creates detection windows if you're watching for new patterns rather than old IOCs.
Deep & Emerging TechNetgear patches three flaws in its routers and extenders. Update now
Netgear quietly patching multiple CVEs across routers and extenders is another reminder that your real attack surface often lives in 'dumb' edge devices. Add consumer-grade networking gear in home offices and branches to your patch management scope, not just servers and laptops.
Deep & Emerging TechSK Hynix now expects the memory shortage to last until 2030
SK Hynix calling a memory shortage through 2030 means AI and data-heavy workloads will be competing for constrained DRAM and HBM for the rest of the decade. Architects should treat memory as the binding resource—optimize model sizes, batch strategies, and data retention with that scarcity in mind.
Deep & Emerging TechData breach at Sony ISP subsidiary exposes 2.5 million customer records as Japan hit with another major cyberattack
Another 2.5M‑record ISP breach in Japan underlines that connectivity providers are now systemic data‑risk nodes, not just pipes. If you operate in or through Japanese networks, treat ISP security posture as part of your own threat model and revisit how much PII you expose to upstream vendors.