Six months before allegations involving Nvidia CEO Jensen Huang became public, short-selling firm Culper Research highlighted his relationship with Alice Huang, an executive at Singapore-based chip buyer Megaspeed. In a May 2026 report, Culper described the pair as unusually close, citing occasions when they socialized and claims that some Nvidia employees questioned whether they had a special relationship. Jensen Huang has since acknowledged an extramarital affair, and Nvidia has opened a formal investigation into his relationship with Alice Huang, who is not related to him. U.S. intelligence officials now suspect she was recruited by China to gather information about him and influence his views on U.S. restrictions on advanced AI-chip exports.
Culper’s report also alleged that Nvidia chips barred from sale to China may have been diverted through Southeast Asia, and that Alibaba secretly financed Megaspeed through shell companies. It pointed to Megaspeed’s rapid financial expansion: reported liabilities and equity rose from $33 million at the end of 2023 to about $3 billion a year later, much of it in refundable deposits from an unidentified source. The Financial Times later reported that documents showed Alibaba lending to Megaspeed through subsidiaries. The chip-diversion claims have not been independently verified, and Culper had a financial interest in the allegations because it was short Nvidia stock.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
The US Commerce Department has delayed adding Singapore-based Megaspeed to a trade blacklist, despite concerns it helped smuggle Nvidia chips into China. Other agencies pushed for the listing, while Commerce said it needed more information about some companies under review. (ft.com)
Wyndham’s Android app contained a password that gave access to an internal database holding customer details, login tokens, and company files. Wyndham revoked the credential after a researcher reported it, but the company has not said how many records were exposed or whether customers will be notified. (techcrunch.com)
Seven months into Project Glasswing, Anthropic has logged 37,966 security findings but made only 217 fixes, while adding nearly 12,000 findings and just 15 fixes since September. Maintainers are also disputing many scanner reports, raising questions about the project’s claimed accuracy and the burden placed on open-source teams. (vulncheck.com)
rVPN is an open-source VPN protocol that disguises encrypted traffic as ordinary HTTPS to work around VPN blocking. It uses a Rust core, rotating encryption keys, and probe-resistant decoy responses, with code and builds available for verification. (rvpn.org)
CVE-2026-116928 is a remote code execution vulnerability in Windows Search. The provided information does not specify its cause, impact, or affected versions. (msrc.microsoft.com)
A flaw in OpenSSH on Alpine Linux and other musl-based systems can let attackers bypass password authentication with a single SSH connection. Install the security patch and restart OpenSSH; systems with password authentication enabled and no PAM are affected. (zdnet.com)
Today's best Hacker News stories, summarized and screenshotted, one email a day.