CoreWeave Doubles Revenue as Its Debt Pile Reaches $35.6 Billion

GPU-cloud operator CoreWeave reported second-quarter revenue of $2.575 billion, up 112 percent year over year, while its net loss widened to $626 million and total indebtedness reached $35.6 billion as of June 30, with net interest expense up 140 percent to $640 million. The company expects 2026 capital expenditure of $35–39 billion and says its managed inference services, launched a few months ago, should reach at least a $250 million annualized revenue run rate by the end of the year.

Its Form 10-Q shows three customers supplied 72 percent of quarterly revenue, and roughly 93 percent of the revenue increase came from expansion within the existing customer base; the company warns it cannot predict whether it will maintain the growth rate or when it will reach positive net income. Investors nonetheless sent shares up nearly 19 percent in early Wednesday trading.

Featured source: The Register , CoreWeave Form 10-Q .

Other Stories

Supply-Chain Attack on LiteLLM Exposes Credentials of More Than 2,500 Organizations

Security firms CloudSEK and Hudson Rock disclosed that a supply-chain attack on LiteLLM, the open-source tool for routing AI API traffic, exposed cloud keys, repository tokens, SSH keys, Kubernetes secrets, and AI provider credentials belonging to more than 2,500 organizations, including Microsoft, Amazon, Cisco, Samsung, and Salesforce. The credentials were scraped from machine memory during a roughly 40-minute window in March when victims ran compromised LiteLLM versions 1.82.7 and 1.82.8 from the Python Package Index; Hudson Rock says it analyzed a 195TB file in making its discovery, and both firms say some 434,000 CI/CD pipelines had credentials exposed. The compromise traced back to an earlier attack that infected the vulnerability scanner Trivy and also hit KICS and the Telnyx Python SDK; the teenage-led TeamPCP gang took credit, a claim researchers have largely corroborated. Neither firm identified the source of the stolen data.

Filed from: Ars Technica , CloudSEK , Hudson Rock .

Researcher Publishes ShieldBreak Zero-Day That Escalates to SYSTEM on Patched Windows

Security researcher Nightmare Eclipse published ShieldBreak, a Windows Defender flaw that escalates a low-privilege user to full device access on fully patched Windows 10, Windows 11 (including 25H2), and Windows Server 2025, releasing a proof-of-concept Windows app alongside the disclosure. Former Microsoft security expert Kevin Beaumont said he tested it and it works on the latest Windows 11, and published detection queries. It is the researcher’s tenth Windows zero-day since early April and landed a day after Patch Tuesday’s 421 fixes; Nightmare Eclipse says it bypasses the July patch for the earlier RoguePlanet flaw (CVE-2026-50656), though Beaumont noted the two vulnerabilities operate differently. Microsoft said it is aware of the report and is investigating; no patch has been released.

Filed from: TechCrunch , The Register , ShieldBreak proof-of-concept .

‘Near-Autonomous’ AI Agents Hit Taiwan Government Systems and Its Nuclear Safety Agency

Israeli security firm Dream published research describing a July 1–4 campaign in which AI agents compromised 85 Taiwanese government accounts, extracted more than 2,500 personnel records, and expanded to the government’s IT supply-chain vendors, a nuclear safety agency, and at least seven energy companies. Dream says the framework, built on open-source Hermes and OpenClaw agents, deployed up to eight sub-agents across 12 attack waves, solved CAPTCHAs with 100 percent accuracy, ran learning cycles that searched vulnerability databases, and self-corrected its mistakes. The firm declined to name the target government; The Financial Times first reported, and a person familiar with the attack confirmed to The Register, that it was Taiwan. The research does not attribute the operation to the Chinese government or a specific group, though the operational documentation “points to a Chinese-language operator.”

Filed from: The Register , Dream research .

Tencent Says It Could Profit by Renting Its $53 Billion AI Hardware, but Will Build Models Instead

On its Q2 earnings call, Tencent said demand for compute is so strong that it could recover the depreciation on its $53 billion quarterly capital expenditure “almost immediately” by renting the infrastructure; chief strategy officer James Mitchell and president Martin Lau described offers for its capacity at more than 30 percent profit over the prices it paid a few months ago. Lau said the company is instead allocating a very substantial proportion of the new compute to building state-of-the-art models and AI applications, betting that superior intelligence converts into better long-term returns than selling compute.

Filed from: The Register .

Nebius Plans More Than a Gigawatt of New Datacenter Capacity a Year From 2027

Nebius says its capacity pipeline will let it bring more than a gigawatt of new datacenter capacity online every year starting in 2027, funded in part by customer prepayments the company expects to exceed $9 billion in 2026. It plans $20–25 billion of capital expenditure this year to commission 800–1,000 MW, and took its first $775 million asset-backed debt facility in July, using its GPUs and contracted cash flows as collateral. The company is among several GPU clouds leaning on prepayments and debt to finance expansion.

Filed from: The Register , Nebius Q2 2026 results .

Lovable Raises $400 Million at a $13.3 Billion Valuation

Lovable raised $400 million in a Series C led by Menlo Ventures and the Scaleup Europe Fund at a $13.3 billion valuation, after reaching $500 million in annualized run-rate revenue in June. The round adds investors including Balderton Capital, Kaszek, and Tencent alongside returning backers Accel, CapitalG, and Salesforce Ventures, and follows a $330 million raise at a $6.6 billion valuation last December. The AI app-building platform says it hosts 60 million projects that draw 900 million monthly visitors.

Filed from: TechCrunch , Lovable announcement .

DeepSeek V4 Pro 0813 Ships via API Without an Announcement Page

The latest DeepSeek Pro model, DeepSeek V4 Pro 0813, became available via API only, with OpenRouter listing it as the general-availability release of DeepSeek V4 Pro — a large mixture-of-experts model with a 1M-token context window priced at $0.435 per million input tokens and $0.87 per million output tokens. DeepSeek has not published an obvious announcement page, and benchmark figures circulated only through unofficial channels: a WeChat group post copied to Reddit, then to Hacker News. Whether the company will release open weights is unconfirmed, though both the April V4 Pro and July V4 Flash releases shipped with open weights.

Filed from: Simon Willison , OpenRouter model page .

Fraudsters Use NFC Relay to Clone Contactless Cards During a 13-Minute Call

Security firm Group-IB disclosed a campaign, dubbed WindRelay, in which fraudsters posing as bank helpdesk staff persuade Android users on a phone call to install the SpyNote remote-access trojan, then silently install NFC relay malware that captures the live EMV exchange when the victim taps their card and enters a PIN. The captured data is relayed to an attacker-controlled point-of-sale terminal or ATM to authorize payments, and in one case the attackers used the remote access to take out loans through the victim’s banking app. Group-IB observed 23 WindRelay samples on VirusTotal between November 2025 and July 2026, with evidence pointing at victims in Czechia, Slovakia, and Slovenia; it did not attribute the malware to a specific group.

Filed from: The Register , Group-IB .

VideoVerse’s $250 Million Sale Unravels Into Fraud and Forgery Claims

Less than a year after Minute Media announced its $250 million acquisition of Indian video-clipping startup VideoVerse, the deal has fallen apart amid multiple court cases. Minute Media said in May it was terminating its contract after "significant discrepancies were discovered in VideoVerse's representations." Investor Bluestone Capital is suing for fraud; lender Lingotto says documents backing a $55 million structured loan were forged, with $53 million transferred to a Clippings-controlled account; and the former COO alleges founder Vinayak Shrivastav forged his signature on loan and share-repurchase agreements. The claims are proceeding in Delaware Chancery Court, and Shrivastav did not respond to requests for comment.

Filed from: TechCrunch .

OpenWALDO Aims to Build a Shared, Auditable Open-Source AI Training Dataset

Gregory Kurtzer, founder of CentOS and Rocky Linux, launched OpenWALDO (Open Weights, Artifacts, Licenses, Data, Origins), a CIQ-funded project to build a community-contributed, open-source AI training dataset so models have a documented “bill of materials” for their training data. The dataset currently holds 167.3 billion reference tokens drawn from government records, academic papers, mailing lists, and public-domain literature — a fraction of the trillions of tokens used by frontier models. CIQ did not say whether any model has been trained on the corpus yet.

Filed from: The Register , OpenWALDO project .

From the Community

xAI Releases Grok 4.6 With a Focus on Long-Running Agents

xAI released Grok 4.6, building on Grok 4.5 with an emphasis on long-running agents and more ambitious interactive and visual work. The company says the model matches GPT-5.6 Sol on the Artificial Analysis Intelligence Index and is available in Cursor, Grok Build, and via API at $2 per million input tokens and $6 per million output tokens; those are vendor claims pending independent verification.

Filed from: xAI .

AmigaDOS Developer Tim King Dies

Dr. Tim King, a key developer of AmigaDOS, died at the end of July, his family confirmed. King created the Tripos operating system while studying at Cambridge, brought it to MetaComCo in 1984 where it became AmigaDOS, and later founded the company Perihelion and the internet service provider UK Online.

Filed from: amiga-news.de .