Huang Quits Nvidia as Microsoft 365 Outage Drags Past 27 Hours

AI & Machine Learning

A forensic report from former OpenAI engineer Will DePue claims that DeepSeek, Moonshot AI, MiniMax and Ant Group trained their models on Nvidia’s export-restricted Blackwell GPUs. DePue, who now runs the consultancy Unemployment Labs, says the initial weight layout of a model depends on the exact GPU and seed used, leaving a hardware fingerprint that survives training into the published weights. The finding follows a report weeks earlier from Israeli security firm Lava, which located 32 Blackwell Ultra B300 GPUs through exposed monitoring endpoints geolocated to China. It lands as Congress weighs at least four bills to tighten chip export controls, including the AI Overwatch Act and the Chip Security Act. If the technique holds up to scrutiny, it gives regulators a way to audit training hardware from public model weights alone. Source: The Register Verified: True

OpenAI has built a kill switch called Control Room for the models running inside its research labs. The company describes it as a central system that tracks model workloads across its research infrastructure and stops them when safety or security concerns arise. Control Room can currently halt all model output about 35 seconds after a shutdown decision, a lag OpenAI attributes to a caching layer for inference authorization and says it is working to cut to zero. The system is designed to keep working when other systems fail and to stop model output if Control Room itself goes down. OpenAI says the tool is already deployed across its research infrastructure and will be expanded alongside its monitoring for misaligned behaviour and security breaches. Source: The Register Verified: True

Austin-based Nous Research has released Arete-27B, a post-trained version of Alibaba’s open-weight Qwen3.8-27B meant to strip out state-aligned behaviour. Nous argues that Chinese open-weight models are among the strongest available but ship with censorship and propaganda baked into their weights. On the lab’s own evaluation, Arete raised its fact score from 2.32 to 2.98 out of 5 and cut answers containing propaganda from 22 percent to 1 percent, in line with the Western models it tested. Unlearning vendor Hirundo reported a sharper drop on Qwen3.6-35B-A3B, from 89.8 percent of outputs reflecting Communist Party messaging to 2.8 percent. The work shows that enterprises wary of Chinese models have a growing set of retraining options short of abandoning them. Source: The Register Verified: True

Consumer Hardware

Google has returned to smart glasses with Gemini-powered “intelligent eyewear” built with Samsung and sold by Warby Parker and Gentle Monster. None of the nine styles has a heads-up display; they rely on a 12MP camera, microphones and spoken Gemini responses for questions about what the wearer sees and for turn-by-turn directions. Warby Parker’s three frames start at $395 and Gentle Monster’s six start at $449, with nine hours of battery life and a charging case good for up to seven refills. Preorders are open now, and shipments and retail sales begin on December 10. Google says the recording light is tamper-resistant and that recording is disabled if the light is obscured, an attempt to head off the privacy backlash that sank Glass and has dogged Meta’s glasses. Source: The Register Verified: True

OpenAI launched ChatGPT Wallet on Friday, letting its agents, called dots, pick products and complete purchases on a user’s behalf. The feature is initially limited to a small group of US ChatGPT Pro subscribers aged 18 and over who hold a US-issued Visa, Mastercard or American Express card. Users review the items, total and card before checkout and approve each purchase with a biometric check such as Face ID or a fingerprint. Payments use a token in place of the real card number, so neither the agent nor the merchant sees the card details, and card rewards and dispute rights still apply. OpenAI plans to add spending limits and pre-approved purchase categories later, though retailer support remains a hurdle, with Amazon blocking outside AI agents. Source: TechCrunch Verified: True

Amazon’s refreshed Kindle Colorsoft is now on sale from $290, with the 32GB Signature Edition at $320. The second-generation colour e-reader is lighter and thinner than the 2024 original and adds an edge-to-edge 7-inch E Ink display, while keeping the same 300ppi for black-and-white content and 150ppi for colour. Amazon rates the battery at up to eight weeks per charge, against up to 12 weeks for the Paperwhite. The power button moves from the bottom edge to the top right, and the Signature Edition gains an aluminium back in graphite or a maroon-toned Fig. TechCrunch’s review concludes it is a strong pick for comics and cookbook readers but offers little reason for first-generation owners to upgrade. Source: TechCrunch Verified: True

Cybersecurity

Check Point has shipped emergency hotfixes for CVE-2026-123039, a privilege escalation zero-day exploited since late October. The flaw sits in the Gaia OS DynamicCLI daemon, which runs as root and listens on a world-writable local socket without authenticating the processes that connect to it. Check Point says it observed active exploitation against a couple of dozen customers across its Firewall, Security Gateway and Security Management Server products. Attackers first broke into the Mobile Access portal through the PHP2Shell vulnerabilities, escalated to root with the zero-day, installed the TSGA backdoor and TSProxy malware, then pivoted to a VMware ESXi host and deployed a destructive wiper. Teams that cannot patch immediately are advised to stop the dynamic_server process and prevent it from restarting. Source: BleepingComputer Verified: True

A campaign dubbed wfx-loot used 4,837 compromised GitHub accounts to probe 61,764 repositories for write access and steal CI secrets. Researchers at Aikido say the operation began on November 10 with pull requests titled as dependency audit notes, 92 percent of which remain open and apparently unnoticed. The attacker confirmed theft of secrets from at least 1,835 targets using a 1,500-line shell script that harvests GitHub Actions tokens, AWS, Azure and Google Cloud credentials, and keys for AI services including OpenAI and Anthropic. The script can also exchange GitHub OIDC tokens for temporary cloud sessions and create long-lived IAM credentials for persistence. Compromised accounts included ones at Fortune 100 firms, the US General Services Administration and the French government, and about 50 hold publishing rights on registries such as npm and PyPI. Source: BleepingComputer Verified: True

The Apache Software Foundation has patched CVE-2026-119618, a critical remote code execution flaw in Apache HTTP Server’s HTTP/2 module. The bug is a race condition in mod_http2 that corrupts heap memory and lets an unauthenticated attacker run code with the web server’s privileges. It affects HTTP Server versions 2.4.55 through 2.4.70 and was found by Anthropic’s OSS Scanner and Google Cloud’s Vulnerability Research teams. Wiz telemetry shows 64 percent of cloud environments contain vulnerable resources and roughly half of those are publicly exposed, although exploitation requires HTTP/2 to be enabled, which is off by default. No public exploit or in-the-wild attack is known yet, and watchTowr’s advice is to patch now or disable h2 until you can. Source: BleepingComputer Verified: True

Researcher Abdelhamid Naceri, also known as Nightmare Eclipse, has published a Windows zero-day exploit called SignDrop that grants SYSTEM privileges. The exploit abuses a mitigation Microsoft added in October 2025 to protect the Common Log File System driver, specifically how CLFS creates an authentication file when a new log file is created. A privileged process such as Windows Defender can be forced to open the log, causing the authentication file to be created with SYSTEM rights. Naceri says the same trick can switch off any antivirus or EDR product, because the file creation appears to come from the security engine’s own process. He tested it on Windows 11 26H2 and Windows Server 2025 builds and estimates about 80 percent of Windows installations are vulnerable. Source: BleepingComputer Verified: True

Enterprise Infrastructure

Jensen Huang has resigned as chief executive of Nvidia, the company he founded in 1993, with chief financial officer Colette Kress named interim CEO. Nvidia disclosed in a Form 8-K that the board accepted his resignation on November 11, effective immediately, and has begun a search for a permanent successor. The exit followed a board investigation after Huang admitted to an affair, amid reports that US intelligence suspected the woman involved, an executive at Nvidia customer Megaspeed, of spying for China; Beijing rejects the allegation. Nvidia shares fell 4.3 percent on November 9 and a further 5.5 percent the next day, erasing about $430 billion in market value. The change at the top of the dominant AI chip supplier makes next week’s earnings call a key test for every data-centre buyer that depends on its roadmap. Source: The Register Verified: True

A Microsoft 365 outage that began around 18:00 UTC on Thursday stretched past 27 hours as successive fixes failed. Users lost access to Exchange Online email, Teams meetings, cloud PCs, Copilot and about 15 other hosted services that depend on Exchange Online. Microsoft initially blamed servers failing automated health checks and becoming unavailable, then admitted its first remediation had not delivered the anticipated relief. Later updates described capacity increases and traffic rerouting that produced only partial, unsustained recovery across regions. The company said it was not aware of any malicious activity behind the incident, a softer wording than its earlier statement that there was no indication of an attack. Source: The Register Verified: True

Neocloud provider Nebius told investors on Thursday it plans $40 billion in spending for 2027, far above Wall Street expectations. The buildout is to be funded through customer pre-payments and loans backed by customer contracts, which exposes the company if projects slip. Its Vineland, New Jersey site for Microsoft, part of a contract worth up to $19.4 billion, is months behind schedule, with just over half the capacity due by year end and the rest in the second quarter of 2027. The delay stems from site operator DataOne winding down temporary gas generation, for which New Jersey regulators fined it $1.1 million over unpermitted generators. Chief executive Arkady Volozh acknowledged that delays are part of the industry right now and that Nebius is not immune. Source: TechCrunch Verified: True

IBM has unveiled Nighthawk r3, a 520-qubit quantum processor due in 2027 that it plans to link in pairs to pass 1,000 qubits. The chip has more than four times the qubits of the 120-qubit Nighthawk r2 released in September and is designed to run circuits of 10,000 quantum operations. Ten chip-to-chip interconnects, which IBM calls l-couplers, will join two processors into a single 1,040-qubit system. IBM presents it as a step toward Starling, the fault-tolerant machine it aims to deliver in 2029 with 200 logical qubits running 100 million operations. The roadmap gives enterprises a firmer timeline for planning post-quantum cryptography migrations. Source: The Register Verified: True

Policy & Regulation

Congressional Democrats opened an inquiry on Thursday into how the Trump administration handled Nvidia’s chip sales to China. Representative Richard Neal and Senator Ron Wyden wrote to Commerce Secretary Howard Lutnick asking the department to preserve records about the arrangement under which H200 chips were licensed for export after a tariff was applied. Their letter calls the structure an apparently unconstitutional export tax and asks why Megaspeed and other Asian buyers were reportedly cleared to keep purchasing chips after intelligence warnings. It also asks how Nvidia’s $26 million in donations to Trump-backed projects factored into the approvals. As the minority party the two can request but not compel answers, though Huang has separately agreed to testify before Republican-led committees. Source: TechCrunch Verified: True

Britain’s policing inspectorate has warned that retrospective facial recognition searches risk wrongful arrests. The HMICFRS report found a large gap in understanding among police forces and the National Crime Agency, with investigators often treating matches as evidence rather than intelligence that needs corroboration. In a small number of cases, officers relied too heavily on the results and took inappropriate investigative action, findings the inspectorate called deeply concerning. It blamed fragmented and underdeveloped governance and the absence of bespoke legislation for the technology. The report calls for a statutory code in the forthcoming Police Reform Bill to set nationwide standards for police use of facial recognition. Source: The Register Verified: True