DiffusionGemma is our new experimental open model with up to 4x faster output on dedicated GPUs.
Instead of predicting word-by-word, it generates entire blocks of text simultaneously. This lets the model self-correct and format complex markdown in real time.
‼️🚨 Microsoft calls this "intended behaviour," so here we go.
How to dump the credentials of every user stored in Microsoft Edge:
1. Open Edge. Don't browse anywhere, just open it.
2. Flip to Task Manager, find Edge, expand the task.
3. Highlight the "browser" sub-task, right-click, and choose "Create Memory Dump."
4. Open the dump file and look for credentials.
The logged-in Windows user can dump every stored Edge credential with no additional rights. Which means any malware that user executes has those credentials for the asking.
Thanks to Rob VandenBrink at SANS: https://t.co/ebtVZxne4L
❗️🚨 Microsoft Edge keeps every saved password in process memory as cleartext from the moment it launches. Microsoft's responsed when reported: "by design."
All of them. Including credentials for sites you won't open this session.
Researcher @L1v1ng0ffTh3L4N tested every major Chromium browser. Edge is the only one that behaves this way.
Chrome decrypts credentials on demand, and App-Bound Encryption locks the keys to an authenticated Chrome process so other processes can't reuse them.
In Chrome, plaintext surfaces only during autofill or when a password is viewed, making memory scraping far less useful.
What makes this extra weird is that Edge still demands re-authentication before revealing those passwords in its Password Manager UI, while the same browser process already holds every one of them in plaintext.
In shared environments, this turns into a credential harvest. On a terminal server, an attacker with admin rights can read the memory of every logged-on user process. In the published PoC video, a compromised admin account lifts stored credentials from two other logged-on (and even disconnected) users with Edge running.
Microsoft's official response when notified: "by design."
The finding was disclosed April 29 at BigBiteOfTech by PaloAltoNtwks Norway, alongside a small educational tool that lets anyone verify the cleartext storage for themselves.
on linux, you can restrict a process to a tiny set of syscalls anything else is blocked by the kernel. it’s called seccomp.
containers and browsers use seccomp bpf to sandbox code. one mistake, and the kernel kills the process.
Ubuntu 26.04 (Long Term Support) is shipping tomorrow… and Canonical has published an update on their quest to replace GNU CoreUtils with Rust-based re-writes.
Highlights:
- After developers raised “some serious concerns”, Canonical hired an external security research firm to evaluate the Rust re-writes (known as “uutils”).
- That security firm quickly found 113 significant issues, with a large portion of them being severe security issues warranting a CVE.
- Only some of those issues in the Rust re-writes have been fixed for the Ubuntu 26.04 release.
- Repeat: Ubuntu 26.04 is shipping with significant known issues in the new Rust coreutils.
- Some of the most critical Rust-Re-Written commands (cp, mv, and rm) were found to contain a large number of significant “Time-of-Check to Time-of-Use” issues, the kind of issues which create race condition vulnerabilities. The kind often exploited by hackers.
- As such, cp, mv, and rm will not be shipping in Ubuntu 26.04. Even with their clear “it’s fine if Ubuntu 26.04’s rust re-writes contain significant bugs” policy… the issues with cp, mv, and rm were simply TOO severe.
- Despite this undeniably disastrous rollout of the Rust-based rewrites of Coreutils, the Ubuntu team plans to ship the next release, in 6 months (26.10), with 100% of the GNU Coreutils replaced with the (currently comically broken) Rust re-writes.
https://t.co/ssuMq6ZOGv
BREAKING: Google DeepMind has assembled a strike team because Anthropic is mogging them on coding
Led by Sergey Brin and DeepMind CTO
Goal: Force recursive self-improvement by turning coding models into full AI researchers that can automate the entire R&D loop
GDM is focusing on:
>long-context coding tasks
>training models on GDM’s private codebase
“To win the final sprint, we must urgently bridge the gap in agentic execution and turn our models into primary developers”
ACCELERATE
Google DeepMind researcher argues that LLMs can never be conscious, not in 10 years or 100 years.
"Expecting an algorithmic description to instantiate the quality it maps is like expecting the mathematical formula of gravity to physically exert weight."