Field notes from the edge.
What our engineers learned this week. Hands-on technical deep-dives, postmortems, and strategy frameworks.
AIHugging Face Diffusers Flaws Could Let Model Repositories Execute Arbitrary Code
Three high-severity vulnerabilities have been discovered in Hugging Face's Diffusers library that enable malicious model repositories to execute arbitrary code on systems loading them, effectively bypassing the trust_remote_code security safeguard. These flaws expose significant risks in the AI supply chain by allowing attackers to compromise systems through seemingly legitimate AI model repositor
AICheap Android TV Boxes Pose as Phones and Turn Owners’ Broadband Into Proxies
Security researchers at Bitsight have identified a malicious operation called Fuyao affecting cheap Android TV boxes that ship with pre-installed apps masquerading as legitimate smartphone brands. These devices, linked to Chinese company Zhejiang Fengwo IoT Technology Co., Ltd., fraudulently click ads while simultaneously converting owners' broadband connections into proxy networks without consent
AIRead This Before You Buy That TV Streaming Stick
Security researchers at Bitsight have uncovered a sophisticated ad fraud operation embedded in popular H96 TV streaming devices that spoofs mobile phones to click ads on AI-generated websites while simultaneously renting out users' internet connections as residential proxies. The operation, traced to mainland China-based Zhejiang Fengwo IoT Technology Ltd, uses Google's Blockly visual programming
AIFCC Blocks New Foreign-Produced Robots and Power Inverters Over Cyber Risks
The FCC has added foreign-produced mobile robots and networked power inverters to its Covered List due to cybersecurity concerns, effectively blocking new models from receiving equipment authorization needed for import and sale in the US. Previously authorized models remain available for purchase, and existing devices are not affected by this regulatory action.
AINine-Year Fraud Campaign Clones Russian Company Sites to Steal Advance Payments
A sophisticated fraud operation has been running for over nine years, creating fake websites that impersonate major Russian companies in sectors like fertilizers and petrochemicals. The campaign targets international firms by tricking them into sending advance payments to fraudulent accounts through these cloned websites.