Atlassian Flaw Exploited in Hours as Mistral Unveils 1T-Parameter Le Chonk

AI & Machine Learning

Mistral has unveiled Mistral Large 4, a roughly 1-trillion-parameter open-weights model the company has nicknamed “Le Chonk.” The multimodal reasoning model uses a mixture-of-experts design with about 49 billion active parameters, keeping serving costs far below what its headline size suggests. Mistral says it trained the model on around 3,800 Grace Blackwell GPUs in European datacenters, on a corpus spanning more than 160 languages. It is in preview through Mistral’s API now, with weights promised for Hugging Face within the month, and independent testing places it between DeepSeek V4.1 Flash and OpenAI’s GPT-6 Luna. Coming on the heels of a €3 billion Series D, the release gives Europe its first frontier-scale open model and a self-hostable option for sovereignty-minded buyers. Source: The Register Verified: True

Google has opened a public SynthID website that lets anyone check whether an image, video or audio clip carries its invisible AI-generation watermark. The detector was previously limited to journalists, media professionals and researchers, and Google says it already handles about 1 million verification requests a day. It accepts common image formats including JPEG, PNG, WEBP, AVIF and HEIC, plus MP4, MOV and WEBM video and a range of audio files. SynthID is embedded in Google’s Nano Banana, Veo and Lyria models, and OpenAI, Nvidia and Kakao also support the standard, with Apple reportedly next. Detection remains imperfect, however, and watermark checks only catch content from models that opted in. Source: TechCrunch Verified: True

AWS has released Strands Box, an open-source sandbox that wraps AI agents in OS-level isolation plus a policy engine that understands the sequence of actions an agent has taken. Unlike a plain container, it can enforce contextual rules, such as letting an agent post to Slack but no more than three times every ten minutes, gating Git pushes, or blocking deletion of a production database. Its Dogwood Local Engine checks each tool call against both the agent’s stated intent and its prior actions, with Strands Shell and Monty for Python exposing operations to that engine. The tool is on GitHub now for macOS only, with Linux in development and Kubernetes, ECS and AgentCore deployment planned. It is the latest sign that agent containment has become core developer tooling after a run of high-profile rogue-agent incidents. Source: The Register Verified: True

Consumer Hardware

OpenAI is rolling out “Intelligent UI,” a redesign that lets ChatGPT answer with interactive visuals such as tappable buttons, adjustable calculators, live charts and editable graphs alongside text. The update ships with the new GPT-6 model, reaching Pro, Plus, Business and Enterprise subscribers first and Free and Go users a day later. Product manager Aarush Selvan said ChatGPT has been predominantly text-based, but many tasks are easier to grasp visually. Users will be able to dial the amount of visual content up or down to suit their preference. The shift moves ChatGPT closer to a general-purpose app canvas and puts pressure on Gemini and Claude to match its interactive answers. Source: TechCrunch Verified: True

Ring has announced its first smart lock, and its standout feature is a hand-crank power dial that lets owners get in even when the battery dies. The lock offers four ways to enter: a fingerprint reader, a backlit touchscreen keypad, the Ring app or Alexa voice commands, and supports scheduled access for visitors such as dog walkers and cleaners. Ring says the battery should last about a year and the app will warn when it needs charging. It fits standard single-cylinder deadbolts and will come in black, silver or brass, with a US launch planned for the first quarter of 2027 pending FCC authorization. Founder Jamie Siminoff said the crank came from his own worry about a dead battery at a rarely used house. Source: TechCrunch Verified: True

Cybersecurity

Attackers began exploiting CVE-2026-21589, a critical unauthenticated file-access flaw in Atlassian’s self-managed products, within about two hours of disclosure. The bug sits in a shared web-resource library that converts double colons into forward slashes, opening a directory-traversal path in Jira Software, Jira Service Management, Confluence, Bitbucket, Bamboo and Crowd Data Center as well as Fisheye and Crucible. In Crowd-integrated Jira setups, attackers can read plaintext credentials from crowd.properties and use Crowd’s API to create administrator accounts. Exploitation took off after watchTowr published technical details the same day Atlassian disclosed the issue, and automated scanning templates are now circulating. Atlassian urges immediate patching, or WAF and URL-rewrite rules that block the traversal pattern where updates cannot be applied quickly. Source: BleepingComputer Verified: True

Lumen’s Black Lotus Labs has uncovered PoeLLM, a cryptomining botnet that has infected more than 3,000 servers since April by targeting exposed AI infrastructure such as LiteLLM, Ollama, Gotenberg and Gitea. Its most unusual trick is hiding its command-and-control address in a poem posted on GitHub: the malware extracts certain words, maps them to numbers with an embedded dictionary and derives the server IP, so the operator can relocate infrastructure simply by editing the verse. Researchers call it the first real-world use of “adversarial poetry” they have seen. Infections peaked at more than 800 servers a day, mostly in the US and Western Europe, and some victims were reached through an Ivanti Sentry flaw, CVE-2026-10520. The campaign, dubbed “Canto Incognito,” is attributed to an Italian-speaking criminal based on code comments and netflow analysis. Source: The Register Verified: True

The FBI and US Secret Service have confirmed that the FortiBleed campaign against internet-facing Fortinet FortiGate firewalls and SSL VPN gateways is still active. Attackers get in through credential stuffing and password spraying, then pull password hashes and crack them offline on GPU clusters, and the agencies warn some victims could be locked out if original admin passwords are changed or deleted. SOCRadar has verified more than 86,644 compromised devices across 194 countries. At least 12 ransomware attacks have been traced to FortiBleed credentials passed to affiliates of the INC/Lynx and Payload groups. Organizations are urged to pull management interfaces off the internet, reset credentials and report incidents rather than pay ransoms. Source: The Register Verified: True

Enterprise Infrastructure

Google has signed a 20-year power purchase agreement with Constellation Energy that will add about 890MW of nuclear capacity by “uprating” at least 11 existing plants in Illinois, Pennsylvania and New Jersey. Rather than building new reactors, Constellation will modernize turbines, steam generators and digital control systems, investing about $4.3 billion, with the first uprated reactor expected in 2028. The broader agreement covers 3,590MW in total as Google races to power a datacenter build-out that could cost up to $205 billion this year. Microsoft and Meta have also struck nuclear deals with Constellation, underscoring how AI demand is reshaping the US power market. Uprates are among the fastest ways to add carbon-free baseload without new-build permitting delays. Source: The Register Verified: True

The Netherlands Tax and Customs Administration is abandoning its Microsoft 365 cloud migration and moving email and calendars back on-premises in 2027, with European open-source tools for storage and collaboration to follow in 2027 and 2028. The reversal follows a review by the Dutch Advisory Council on ICT Assessment that flagged confidential documents passing through US servers, the lack of Double Key Encryption, Teams calls without default end-to-end encryption, and exposure to the US CLOUD Act. The rollout had reached only about 5,000 of the agency’s 47,500 employees before it was paused. Nextcloud and Matrix-based messaging such as Element are among the alternatives under consideration, and Microsoft declined to comment. It is one of the most significant sovereign-cloud retreats yet by a large European government body. Source: The Register Verified: True

A Rimini Street-sponsored survey of 269 executives and IT staff at VMware shops found that 90 percent cite higher licensing costs as a reason to look at alternatives. More than half, 54 percent, point to the end of perpetual license support, and 48 percent have no plans to move workloads onto Broadcom’s preferred VMware Cloud Foundation subscription platform. Some 60 percent are weighing multi-hypervisor strategies, though respondents named operational complexity, multi-vendor management, security and skills gaps as barriers to leaving. European cloud groups say VMware licensing costs have risen eight to fifteen times since Broadcom’s takeover. The findings, collected by Unisphere Research, add to Gartner’s forecast that most VMware enterprises will be testing alternatives by 2029. Source: The Register Verified: True

Policy & Regulation

Florida, Iowa, Montana and Nebraska have sued router maker TP-Link, alleging it misled consumers about both its security and its reliance on China. The states say TP-Link marketed its HomeShield service as a “100 percent” safeguard and played up Vietnamese manufacturing while only about 0.5 percent of components at its Vietnam plant are sourced locally. The complaints also cite TP-Link routers’ use in the Volt Typhoon and Flax Typhoon campaigns and the risk of data access by Chinese intelligence under PRC law. TP-Link called the allegations baseless, saying it is a US company that complies with US privacy law and rigorously tests its products. The suits follow a Texas case earlier this year and FCC restrictions on new foreign-made router models imposed in March. Source: The Register Verified: True

OpenAI says it will add invisible “textGrain” watermarks to eligible ChatGPT and Codex text output in the European Union over the coming weeks, as part of its compliance work in the bloc. The technique subtly biases word choices to leave a statistical signature that readers cannot see but detectors can find. API developers worldwide can opt in now, though the feature is off by default outside the EU. OpenAI’s own figures show the limits: replacing 10 percent of words cut detection from 92 percent to 66 percent, and 25 percent replacement dropped it to 17 percent. The move makes OpenAI one of the first major labs to watermark text at scale under European transparency rules, even as the approach remains easy to defeat with light editing. Source: BleepingComputer Verified: True