Collabora Online's built-in CODE Server running within NextCloud contains an OS command injection vulnerability enabling remote code execution when the CODE server isn't running.
The vulnerability permits attackers to execute arbitrary code remotely on systems running the affected Collabora Online and NextCloud combination, potentially compromising data and infrastructure.
Arista VeloCloud Orchestrator on-premises contains a SQL injection vulnerability allowing remote attackers to access privileged internal functionality and compromise the orchestrator host.
Successful exploitation may compromise confidentiality, integrity, and availability of the orchestrator and data it manages, requiring immediate vendor mitigations per CISA BOD 26-04.
The maintainers describe: The repository enables RTX 4090 tensor throughput doubling via a Linux kernel module that overrides speed-select before driver initialization, achieving approximately 2x FP16 and BF16 rates.
Three developments worth your time
For infrastructure operators deploying Collabora Online with NextCloudadvisory
Collabora Online CODE Server allows remote code execution via command injection
Collabora Online's built-in CODE Server running within NextCloud contains an OS command injection vulnerability enabling remote code execution when the CODE server isn't running.
See supporting passage
Collabora Collabora Online – Built-in CODE Server when used within the NextCloud platform contains an OS command injection vulnerability that allows for
remote code execution when the CODE server isn't running. Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s
The vulnerability permits attackers to execute arbitrary code remotely on systems running the affected Collabora Online and NextCloud combination, potentially compromising data and infrastructure.
See supporting passage
Collabora Collabora Online – Built-in CODE Server when used within the NextCloud platform contains an OS command injection vulnerability that allows for
remote code execution when the CODE server isn't running. Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s
Review Collabora's vendor security advisories and NextCloud deployment documentation to understand which versions are affected and what mitigations or patches are available for your deployment.
Editorial suggestion
Keep in mind
This brief describes the cited source; independent corroboration is not established here.
Arista VeloCloud Orchestrator on-premises contains a SQL injection vulnerability allowing remote attackers to access privileged internal functionality and compromise the orchestrator host.
See supporting passage
Arista VeloCloud Orchestrator on-prem contains a SQL injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact
the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. Required
Successful exploitation may compromise confidentiality, integrity, and availability of the orchestrator and data it manages, requiring immediate vendor mitigations per CISA BOD 26-04.
See supporting passage
the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. Required
action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL
Review Arista's vendor instructions for mitigations and assess your deployment's internet exposure to determine patch prioritization under CISA BOD 26-04 guidance.
Editorial suggestion
Keep in mind
This brief describes the cited source; independent corroboration is not established here.
For engineers evaluating computing hardwarerepository
JustAResearcher/gpu-unlock-ada
The maintainers describe: The repository enables RTX 4090 tensor throughput doubling via a Linux kernel module that overrides speed-select before driver initialization, achieving approximately 2x FP16 and BF16 rates.
See supporting passage
This Linux kernel module enables the SM speed-select override before the stock NVIDIA driver starts. RTX 4090 (`10de:2684`, AD102) support has demonstrated approximately **2× FP16 and BF16 tensor throughput with FP32 accumulation**
Compare the project’s documented capabilities with the evidence it presents. Use the question below to check what remains untested before applying the findings.
Editorial suggestion
Keep in mind
Capabilities described by the maintainers are not an independent evaluation.
Another source worth investigating. Treat its claims as a starting point for evaluation.
For people evaluating this workarticle
A 10-year-old CNN outperforms frontier LLMs for skin cancer diagnosis
The CNN was trained on 68,011 ISIC Archive images using a single H100 GPU, with test data strictly excluded from training to prevent contamination.
See supporting passage
I used Inception v3 pretrained on everyday photographs and then fine-tuned all layers on 68,011 dermoscopic and clinical images from the ISIC Archive on a single H100 GPU.
Useful developments from the nodes you care about, with evidence and a next step. Delivered weekly.
Confirm your subscription with Buttondown. Unsubscribe anytime.
Coverage & methodology
Selected from 13,694 unique archived sources published during this UTC week, across 9 connected feeds. 5,111 had published reading notes. Selection examines up to 16 notes per evidence feed, sampled across the week (160 in total) and requires matching retained source text.
Selection favors concrete usefulness to people building technology, readable evidence, and distinct developments. An editorial ranking uses the checked findings when synthesis is available; otherwise selection falls back to evidence quality and source variety. Engagement helps find candidates within each feed; it is not a measure of scientific or practical importance. A weekly briefing is a curated starting point, not a complete account of technology.
Briefs reuse checked reading notes and model-written explanations checked against retained source passages. Recommendations are editorial suggestions. Source-type caveats describe the evidence available here; they are not findings reported by the authors.
7/7 saved snapshot days this week and 7/7 in the prior week. Snapshot availability is separate from archive coverage; missing observations and unavailable feeds can hide developments.