US intelligence agencies reportedly concluded that Alice Huang, a Chinese citizen and senior executive at Singapore-based cloud provider Megaspeed, secretly gathered information for Beijing. Huang had a “close relationship” with Nvidia CEO Jensen Huang, appearing with him at social and business gatherings in Taipei in 2024 and 2025. US electronic surveillance identified Jensen Huang as one of her contacts, but officials initially believed he did not know of her alleged espionage; some senior Trump administration officials now question whether he could have been unaware. The intelligence findings reportedly reached President Trump about a year ago, but he took no action, amid concerns about Nvidia’s business and US-China trade ties. It remains unclear what information Alice Huang allegedly obtained or whether officials formally changed their assessment of Jensen Huang.
Megaspeed is under investigation over suspicions it helped Chinese companies evade US export restrictions by obtaining Nvidia chips through the US subsidiary of Chinese server maker Inspur and renting computing capacity from Southeast Asian data centers. Nvidia said its CEO’s customer meetings were routine, that cloud customers received no sensitive or national-security information, and that claims of chip diversion through Megaspeed had been investigated and debunked. The company also said it acts on government warnings about potential threats. China’s embassy rejected the spying allegations as groundless. Jensen Huang has separately lobbied the Trump administration to ease chip-export restrictions to China, while Nvidia has pledged major US manufacturing investment and donated at least $20 million to a White House ballroom fund.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
CVE-2026-98432 is a network-reachable use-after-free in Linux’s IPv4 TCP handshake, with researchers demonstrating remote root code execution in a lab using an MPTCP listener. Administrators should inventory exposed Linux services, prioritize MPTCP hosts, install their vendor’s fixed kernel, and reboot into it. (penligent.ai)
Arken is passwordless authentication middleware that verifies decentralized identity signatures made with secp256k1 keys. It is designed to work without passwords or server-side sessions. (github.com)
Go 1.24 enables Multipath TCP by default for Linux listening sockets, exposing servers to attacks involving Linux kernel CVE-2026-98432. Go offers settings to disable MPTCP, but recommends upgrading to a patched kernel because disabling it per program is an unreliable fix. (groups.google.com)
Highway thieves have stolen more than $100 million in data center equipment since June using hacked freight accounts, fake drivers, and GPS spoofing. Targets include servers, fiber-optic cables, chips, copper wire, and power equipment. (arstechnica.com)
Arkham’s explorer page identifies an entity called “Binance-hacker-1029” and attributes $5.6 billion in theft from Binance to it. The attribution is an unverified claim, not proof that the funds were stolen. (arkm.com)
Unconfirmed reports say a Binance wallet was drained into a new address, with the transaction funded through Tornado Cash. Posts later claimed as much as $3 billion may have been extracted, but the incident remains unverified. (twitter.com)
Today's best Hacker News stories, summarized and screenshotted, one email a day.