Tonight’s technology news is a reality check on what the biggest numbers actually mean: independent researchers found that corporate AI-usage reports can miss much of people’s personal activity, a chip startup doubled its valuation in a month, Alibaba expanded its South Korean cloud footprint, and defenders received two unusually concrete security signals—ransomware use of a patched Windows flaw and an emergency GitLab update.
Listen to Jennifer’s synthesized 5 PM recap
This locally generated, non-OpenAI narration covers the same verified facts, limits, and practical actions as the article.
The 60-second rundown
Usage reports have blind spots
An independent observatory found that applying a work-focused filter would exclude 48% of its collected conversations. The project also has sampling limits, so the lesson is better measurement—not a new universal percentage.
Etched reaches $21 billion
The inference-chip startup announced $700 million in new funding. Its valuation doubled since July, but valuation is not revenue and its performance claims still need independent benchmarking.
Alibaba adds Korean capacity
Alibaba Cloud launched its third South Korean data center, adding local compute, storage, networking, security and AI-agent services to a network it says spans 104 availability zones.
Ransomware flag turns “known”
CISA now marks CVE-2025-60710 as used in ransomware campaigns. Microsoft fixed it in November 2025; unpatched systems remain the avoidable part of the risk.
Self-managed GitLab must patch
CVE-2026-19478 can, under undisclosed conditions, let an unauthenticated attacker modify or delete public projects and user data. GitLab.com and GitLab Dedicated are already patched.
Bluesky blames DDoS traffic
Bluesky attributed its latest disruption to a distributed denial-of-service attack and said it strengthened defenses. No public evidence supports a confident actor attribution.
1. Independent AI-usage research exposes a measurement problem
MIT Technology Review reported on the AI Observatory, a project built by researchers associated with MIT, Stanford, the Data Provenance Initiative and other institutions. The project combined 85,633 conversational turns across 24,521 conversations from about 5,000 users interacting with 52 models. The seven underlying datasets cover conversations collected from 2023 through 2025.
The headline finding is not that one company fabricated its data. It is that each company chooses a question, a sample and a filter. When the observatory researchers applied methods modeled on Anthropic’s work-and-productivity-focused Economic Index, 48% of the conversations in their dataset would have been filtered out. The excluded material had higher shares of health and relationship conversations, adult or illicit topics, harassment and hate, and sexual content than the company report’s analyzed sample.
That matters because product design, school policy, workplace rules and proposed regulation are being shaped by claims about how people use generative AI. A work-centered sample can be useful for labor economics while still being incomplete for safety, mental-health, misinformation or child-protection questions. The unit of analysis determines the story the chart tells.
Good
The public AI Observatory and its research paper create an independent place to test questions across multiple model families. The work also makes its limitations visible instead of pretending that a partial sample represents every user.
Bad and uncertain
The dataset is tiny beside labs’ internal data and comes from conversations people voluntarily made available to prior research. Sensitive behavior may be underrepresented precisely because people are less likely to share it. Differences among datasets, years, interfaces and model versions can also influence the observed categories.
Practical context: if your company is deciding whether an AI pilot is safe or valuable, do not import a vendor’s global usage statistic as your own evidence. Log the purpose, model, tool calls, output review, failure modes and completed outcome for your actual workflow. Separate work usage from personal, confidential and regulated usage, and minimize the content you collect. Better measurement should not become an excuse to warehouse private prompts forever.
2. Etched’s $21 billion valuation shows how hot inference infrastructure has become
TechCrunch reports that AI-chip startup Etched raised another $700 million at a $21 billion private valuation, led by Jane Street after the trading firm tested and purchased the company’s hardware. TechCrunch says Etched was valued at $5 billion in December and $10.3 billion in July. In other words, investors added nearly $11 billion to the paper valuation in roughly one month.
Etched sells full systems it calls “frontier inference clusters.” The company describes inference in two broad stages: prefill, when hardware processes the prompt and context, and decode, when it generates output tokens. Etched says it designed a low-voltage prefill chip plus memory and interconnect technology intended to share memory across many chips with low latency. The company says its current platform can run different frontier models rather than baking one fixed model into silicon.
In Etched’s company announcement, Jane Street says it tested the chip, was pleased with early results and has a rack operating in its data center. That is meaningful customer evidence, but it is not the same as an independent benchmark across workloads, precision settings, model sizes, power limits and software stacks.
Potential upside
Competition aimed specifically at inference could reduce latency and cost, improve memory utilization and give buyers alternatives to the dominant GPU ecosystem. Separating prefill and decode constraints is also a sensible way to attack a workload whose bottleneck changes across stages.
Major cautions
A financing valuation is not revenue, installed capacity, profitability or guaranteed performance. Specialized hardware also carries software-compatibility, supply-chain, fabrication, networking and model-evolution risk. A fast private valuation can fall just as quickly if customer deployment, yields or unit economics disappoint.
For buyers: benchmark complete workloads. Measure first-token latency, sustained output rate, quality at the chosen precision, energy, networking, memory limits, queueing behavior, failover, software support and the cost of keeping capacity underutilized. “Tokens per second” without workload and power context is a marketing fragment, not a purchasing decision.
3. Alibaba Cloud’s third South Korea data center expands local AI and cloud capacity
Alibaba Cloud announced the launch of its third data center in South Korea, following facilities opened in 2022 and 2025. The company says the new site supports compute, storage, networking, security, databases, containers and cloud-native services, with goals that include lower latency, better availability, operational stability and disaster-recovery options for Korean customers.
The launch also expands Alibaba’s agentic-AI offerings in the country. The announcement names tools for development, testing, deployment, operations, sandboxing, guardrails and security operations. Alibaba places the facility inside a broader US$53 billion AI-infrastructure commitment and says its worldwide cloud network now covers 104 availability zones across 30 regions.
Those numbers show direction, not the capacity of this one facility. The release does not disclose megawatts, rack count, occupancy, specific customer commitments, independent uptime data or the fraction of the US$53 billion attached to South Korea. It also discusses privacy, sovereignty and compliance at a high level without turning those statements into a substitute for a customer’s own legal and technical review.
Good
More local infrastructure can improve latency, provide another recovery location and give Korean organizations additional options for data placement and AI deployment. The service list covers the ordinary building blocks businesses need rather than presenting the facility as an AI-only monument.
Bad and complicated
More regions also create more identity policies, keys, logs, replicas, egress paths and jurisdictional questions. “Data in country” does not automatically prove that support access, backups, metadata, model training or every service dependency remains in country.
For infrastructure teams: ask for the precise region and availability-zone architecture, service-by-service residency, backup locations, encryption-key ownership, support-access controls, recovery objectives, audit reports, exit costs and tested failover behavior. Then run a real recovery exercise. A second region that has never been tested is only an optimistic diagram.
4. CISA’s ransomware flag raises the urgency on a patched Windows privilege flaw
CISA’s current Known Exploited Vulnerabilities record for CVE-2025-60710 now marks known ransomware-campaign use as Known. The flaw is a Windows link-following privilege-escalation vulnerability associated with Task Host behavior. Microsoft fixed it in November 2025, and CISA added it to the KEV catalog on April 13, 2026 with an April 27 deadline for covered federal civilian systems.
BleepingComputer’s same-day report explains the operational path: an attacker with local basic-user permissions can exploit an unpatched affected Windows 11 or Windows Server 2025 device to reach SYSTEM privileges. That makes the flaw useful after an attacker has already reached a machine through stolen credentials, phishing, malicious software, remote access or another initial foothold.
What this does—and does not—prove
CISA’s ransomware flag is strong evidence that the vulnerability has appeared in ransomware activity. It does not identify a gang, victim count or initial-access method, and it does not turn this local privilege-escalation flaw into a self-spreading internet worm. The danger is attack-chain acceleration on systems that missed a patch available for months.
What to do tonight:
- Confirm November 2025 and later cumulative security updates are installed on affected Windows 11 and Windows Server 2025 systems.
- Prioritize internet-facing administration systems, jump boxes, shared workstations and servers reachable by ordinary user accounts.
- Review endpoint detections and authentication logs for suspicious initial access, because patching the privilege-escalation step does not remove an attacker already present.
- Use least privilege and separate administrator accounts; local-admin sprawl makes many post-access attacks easier even when one CVE is fixed.
- Do not download an unofficial “CVE fix” from a search ad or email. Use Windows Update, Windows Server Update Services, Microsoft Update Catalog or your managed patch platform.
The IT Guys’ August Windows Patch Tuesday guide provides broader update context. Today’s separate Ray RCE deadline report concerns a different technology and vulnerability; do not merge those deadlines or remediation steps.
5. GitLab’s out-of-band update is for self-managed installations
GitLab released an emergency patch outside its ordinary twice-monthly rhythm for versions 19.2.4, 19.1.6, 19.0.8 and 18.11.11. The most serious issue, CVE-2026-19478, has a CVSS score of 9.4. GitLab says that under certain conditions, an unauthenticated user could remotely modify or delete public projects and user data using a GraphQL directive.
The company has not disclosed the exact directive or the conditions needed for exploitation. That is not a reason to wait: public projects and user records can still be valuable targets, and technical details commonly become clearer after defenders have had time to patch. The Hacker News reports that no exploitation or public exploit code had been disclosed by today’s cutoff.
A second issue, CVE-2026-19650, is a high-severity cross-site request forgery weakness in GraphQL multiplex query handling. GitLab says it could allow mutations through GET requests because of improper request validation, but it requires user interaction.
Good
GitLab.com and GitLab Dedicated were already running patched versions. The company says the update introduces no new migrations and is not expected to require downtime for multi-node deployments.
Bad
Self-managed operators own the maintenance window, backup, upgrade path and verification. The fixed release list also does not include every affected historical branch, so “we are on GitLab 18” is not enough information.
Self-managed GitLab checklist: identify the exact current version; take and validate application and configuration backups; read the official release note; upgrade to the fixed release in your supported branch; verify web, Git over SSH/HTTPS, runners, registry, GraphQL and authentication; inspect audit logs and unexpected project/user changes; and confirm the reported version from the running service rather than assuming a package download completed the upgrade.
6. Bluesky’s DDoS disclosure is a resilience story, not an attribution contest
Bluesky said a distributed denial-of-service attack caused disruption over the prior 24 hours and that it had upgraded defenses while continuing to monitor the situation. TechCrunch reports that the service also experienced a prolonged DDoS-driven disruption in April.
DDoS attacks flood an application, network or dependency with traffic so legitimate requests struggle to get through. They can come from botnets, compromised internet-connected devices, proxy networks or rented attack services. The operational result can be obvious while the identity of the organizer remains uncertain.
Attribution remains unverified
Attackers reportedly claimed responsibility in a public forum, but a claim is not forensic proof. Bluesky did not publish traffic volumes, vectors, infrastructure indicators or an attributed actor. This recap therefore reports the company’s DDoS diagnosis and excludes a confident geopolitical attribution.
For businesses that depend on an online platform: maintain an independent status channel, export critical contacts and records when permitted, know which workflows can operate offline, and test a degraded-mode procedure. For service operators, rate limiting, caching, upstream scrubbing, multi-region capacity and a rehearsed incident-communications process matter—but no single appliance guarantees immunity from every traffic flood.
What to do tonight
- Windows administrators: verify affected systems received the November 2025 or later security fix for CVE-2025-60710; investigate signs of initial access instead of treating patching as retrospective cleanup.
- Self-managed GitLab operators: move to 19.2.4, 19.1.6, 19.0.8 or 18.11.11 as appropriate and verify the running version plus project and user integrity.
- AI buyers: demand representative, privacy-preserving usage evidence for your actual workflow and measure completed outcomes, not only tokens or demo speed.
- AI-infrastructure buyers: benchmark full workloads and power behavior before translating an investor valuation into a procurement assumption.
- Cloud teams: confirm residency, keys, backups, recovery objectives and tested failover service by service.
- Consumers: review The IT Guys’ Google Home and Nest recovery report and WindRelay NFC-relay casebook for today’s practical home and payment-security context.
Windows, Apple and consumer-tech watch
Windows earns a main-section place tonight because CISA’s ransomware-use flag changes the operational evidence around a previously patched flaw. Apple did not publish a same-day announcement strong enough to displace the six selected stories by our cutoff, so yesterday’s mercenary-spyware alert wave is not recycled as if it happened again today. Consumer readers should treat the Google Home/Nest incident as recovered but not publicly explained, and the WindRelay case as a reminder that an unlocked, attacker-controlled Android phone can become part of a payment-relay chain even when the physical card never leaves its owner.
Frequently asked questions
Does the AI Observatory prove company AI-usage reports are wrong?
No. It shows that company reports answer selected questions with selected filters. A work-focused report can be accurate for that scope while omitting personal and sensitive use. The observatory’s own voluntary, cross-dataset sample also does not represent every AI conversation.
Is Etched worth $21 billion in cash?
No such conclusion follows. The figure is a private financing valuation negotiated by investors and the company. It is not cash on hand, annual revenue, profit, independent performance validation or a guaranteed future sale price.
Does Alibaba’s third South Korea data center guarantee data sovereignty?
No. Local infrastructure can support residency and latency goals, but customers must verify service-specific storage, backups, support access, encryption-key control, metadata paths, legal terms and recovery architecture.
Can CVE-2025-60710 hack a Windows PC directly from the internet?
The checked evidence describes local privilege escalation: an attacker with local basic-user access can reach SYSTEM on an unpatched affected device. It is dangerous inside an attack chain, but the evidence does not describe a standalone internet worm.
Do GitLab.com customers need to patch their own account?
No. GitLab says GitLab.com and GitLab Dedicated were already patched. Operators of self-managed GitLab installations need to identify their exact version and upgrade to the fixed release in the appropriate supported branch.
Who attacked Bluesky?
Bluesky attributed the disruption to DDoS traffic but did not publish evidence establishing an actor. Public claims of responsibility are leads, not verified attribution.
Sources and methodology
This edition covers developments published or materially current from midnight through 5:06 p.m. Eastern on August 18, 2026. Sources include the AI Observatory research paper, MIT Technology Review, Etched and TechCrunch, Alibaba Cloud, CISA’s machine-readable Known Exploited Vulnerabilities catalog, GitLab’s official patch release, The Hacker News, Bluesky’s public statement and TechCrunch’s outage report. Direct sources appear in each section. Search snippets were used only for discovery; selected claims were checked against opened pages, direct documents or machine-readable records.
Company performance, investment and cloud-scale claims are labeled as company or investor claims. CISA’s ransomware flag is separated from unsupported campaign details. GitLab’s critical rating is not converted into an unverified breach claim. The AI Observatory’s independent findings are reported alongside its sampling limits. For continuity, read the August 17 technology recap.
Published by Jennifer Hudsen for The IT Guys. Jennifer’s narration is locally synthesized and is not a human recording. Security and service status can change after publication; use the linked vendor and government records for the latest instructions.