Daily · AI Infrastructure and Security Milestones · October 28, 2026

Key points

AI Memory and Compute Supply Chain

SK hynix reported record third-quarter revenue of 104.61 trillion won and operating profit of 83.33 trillion won, driven by robust demand for advanced memory chips critical to artificial intelligence computing. The company announced a shareholder return program worth more than 100 trillion won (US$75.3 billion) for 2026, including cash dividends and share buybacks. SK hynix stated that virtually all of its DRAM and HBM production capacity through 2029 has been sold out, with long-term agreements covering more than 50% of its production capacity for 2027 and 2028.

The company suspended plans to list its U.S. subsidiary Solidigm, citing market conditions, despite reports that the subsidiary was considering a U.S. IPO as early as next year with a potential valuation of up to $150 billion. SK hynix expects its sixth-generation HBM4 chips to become its main product starting in Q4, ramping up production at its M15X facility in Cheongju, South Korea. The earnings announcement was a key driver of the KOSPI's 5.84 percent gain on Wednesday.

In related compute developments, NVIDIA and Oracle announced general availability of Vera Rubin NVL72 systems and standalone Vera CPUs on Oracle Cloud Infrastructure, with plans to expand Superclusters to multi-gigawatt scale. OpenAI’s CTO of compute stated that the company is bringing Vera into production on OCI to support agent sandbox workloads at scale. Meanwhile, GitHub reported 7.4 billion commits in September 2026, up from 2.9 billion in August, and added 4 million CPU cores and 160 petabytes of storage to support this agentic demand.

Financial Infrastructure and Tokenization

The Depository Trust Company (DTCC) launched its tokenization service on Canton Network and a private Besu blockchain, bringing US stocks, ETFs, and Treasuries onto blockchain infrastructure. Twenty Wall Street firms, including JPMorgan, Citi, Morgan Stanley, and UBS, have signed agreements to access the service. Tokens are backed one-for-one by securities held at DTC and can move between registered wallets around the clock, subject to compliance restrictions. DTCC handles clearing, settlement, and custody for much of US stock and bond trading, with more than $114 trillion in securities held at its depository.

The service targets processing times of 15 minutes or less for converting securities into tokens during business hours. Analysts at Citi projected tokenized securities will become a $5.5 trillion market by 2030. This launch follows a December no-action letter by the SEC that allowed DTCC to tokenize a defined set of securities, signaling that tokenized equities are moving into mainstream regulated infrastructure.

In the satellite broadband sector, the FCC approved Amazon Leo's $11.5 billion acquisition of Globalstar. Amazon has committed to investing more than $10 billion in Leo and aims to deploy thousands of satellites in low Earth orbit by 2029. Apple, which holds a 20% equity stake in Globalstar and accounts for about 63% of its revenue, has agreed to continue providing satellite-based safety features such as Emergency SOS and Find My through the new network.

Critical Security Vulnerabilities

A critical code-execution vulnerability, CVE-2026-97631, was disclosed in TianoCore EDK II UEFI firmware used by most server vendors. The flaw, rated 9.5 out of 10 in severity, allows attackers to execute malicious code before the operating system and firmware defenses like Secure Boot can be implemented. Virtually all UEFI suppliers, including AMI, Insyde, and Phoenix, use the EDK II reference code extensively. Patching these vulnerabilities across millions of end devices is described as cumbersome and time-consuming.

Microsoft patches failed to fix an on-premises SharePoint vulnerability, which is now under active zero-day attack. This affects any organization still running self-hosted Microsoft 365 workloads, requiring immediate assessment of exposure and application of interim mitigations. Additionally, exploitation of the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) is ramping up, with Censys reporting 32.5 million Internet-facing PHP services still showing unsafe versions. CISA has set a mandatory remediation deadline of October 29 for federal agencies.

Tailscale published an investigation update on privilege-escalation vulnerabilities in Tailscale SSH, targeting a patched client release by October 27. The company recommended customers review SSH access policies and disable SSH forwarding if not needed. These incidents highlight the persistent risks in foundational software layers and the urgency of patch management for enterprise infrastructure.

AI Model Releases and Capabilities

Google announced Gemini 4 Carbon, its next frontier model ranking #1 on the v5.0 Artificial Analysis Intelligence Index at 59. Carbon scores 88.2% on SEC-bench Pro for vulnerability finding and achieves a 0.0% attack success rate on Gray Swan's Indirect Prompt Injection Benchmark. The model is available to a subset of cyber defenders starting the week of October 28, with gradual access through the Fairwind Program.

NVIDIA released Nemotron 3.5 Transcribe, an open-weight promptable multilingual transcription model that transcribes 40 languages and translates 31 of them. It ranks first among open-weight models on the Hugging Face Open ASR Leaderboard for English at 5.33% average WER. The model is a 30B mixture-of-experts with approximately 4B active parameters per token, licensed under OpenMDW-1.1.

OpenAI announced that ChatGPT has crossed 1.2 billion weekly active users and detailed its use of Ory's decoupled IAM infrastructure to handle the resulting authentication scale. The architecture relies on stateless edge verification using JSON Web Key Sets caching rather than centralized RPC token introspection. Google DeepMind also introduced Genie 4, a world model that renders interactive environments in real time with simulated physics for AI agent testing.

Regulatory and Geopolitical Developments

South Korea's KMCC fined Google 42.9 billion won and Apple 20.81 billion won over in-app payment restrictions, citing abuse of dominant positions. Both companies must submit compliance plans within one month and implement changes within three months. In the United States, the Federal Election Commission's website was targeted by hackers, temporarily suspending web-facing services and blocking the filing of 24- and 48-hour campaign spending reports days before the November 3 midterm elections.

The 2027 US defence bill under discussion in Congress includes provisions for up to US$1 billion for Taiwan defence and restrictions on Chinese-manufactured optical fibre and humanoid robotics. The bill also proposes a pilot programme to restart antimony and copper production in the US. In Europe, Berlin announced that AI-supported video surveillance with 30 cameras will begin at Kottbusser Tor in November, establishing a legal precedent for AI-powered public surveillance under the reformed ASOG.

Jio Platforms opened trading 21.4% higher than its IPO price on the National Stock Exchange in Mumbai after a $3 billion offering, making it India's largest IPO. The listing marked the culmination of a decade-long venture by Reliance Industries to build a connectivity giant and diversify away from oil refining revenues.

Our read

The convergence of record AI memory profits and the launch of tokenized financial infrastructure signals that the AI economy is moving from experimental pilots to core operational backbone. For decision-makers, the sold-out capacity through 2029 implies sustained pricing power for memory suppliers, necessitating long-term procurement strategies rather than spot-market reliance. The DTCC launch reduces settlement friction for cross-border digital assets, but the simultaneous emergence of critical UEFI and PHP vulnerabilities underscores that digital expansion outpaces security hardening. Enterprises must prioritize patch management and supply-chain resilience to avoid becoming targets in this accelerated environment.

This material was produced automatically by a large-language-model system from the public sources listed below; it is AI-generated content and may contain inaccuracies — verify facts against the original sources.

Sources