BUI 是一个独立的 UI 库，它从 Blender 中提取了高度优化的 Widget 绘制与交互系统。通过将这些组件从 Blender 的核心代码库中解耦，该项目让开发者能够跨多种编程语言（包括 Python 、 Rust 、 JavaScript 、 C 和 C++）构建高性能、低功耗的桌面应用。它基于一个轻量级的 C 运行时（kit）运作，用来管理 Widget 树、布局、输入处理与渲染。

该库提供基于 Blender 著名交互模型的统一用户体验。核心功能包括拖动式数值微调、在输入框内对数学表达式进行求值、模糊菜单搜索以及完善的撤销支持。由于 BUI 采用模块化设计，它支持多种渲染后端：既有高效的软件光栅化器，也提供使用 Direct3D 11 或 OpenGL 3.3 的硬件加速方案。借助损伤渲染架构，BUI 只重绘发生变化的区域，从而确保空闲状态下的应用几乎不占用 CPU 资源。

开发者可以从多个入口使用该库。对 Python 用户而言，BUI 能与现有 tkinter 和 ttk 应用实现近乎无缝的兼容，无需改动代码，并支持 Qt 风格语法以及一套原生的 Blender 组件。 Rust 与 JavaScript 开发者则可使用类似 Web 的框架，这些框架支持 HTML 、 CSS 和 Tailwind，同时还可以在特定场景中集成原生的 Blender Widget 。此外，该库还提供 Dear ImGui 的后端，让开发者可以把该界面与 Blender 的主题结合使用，甚至可以用 Blender 的原生组件替换其标准 Widget 。

性能是该项目的重点：库设计为快速、内存高效，并能以极低开销处理复杂界面。它对图像与视频提供了强大的支持，包括离线程解码，以及带内存预算的缓存，用于避免性能瓶颈。作为独立方案，BUI 避免了基于浏览器运行时的臃肿，使得开发者能够创建体积紧凑、启动迅速、同时保持原生感与良好响应性的应用。

该项目持续进行维护，模块化架构也鼓励贡献与提升透明度。尽管部分功能（例如 macOS 窗口支持与 Qt 语法覆盖）仍处于实验或不完整阶段，但核心的 C 运行时以及主要语言绑定已可用并经过测试。开发者可通过官方网站获取完整文档，内容涵盖安装流程、各语言指南以及性能基准，帮助团队评估如何将 BUI 最好地集成到现有工作流中。 BUI is a standalone user interface library that extracts the highly optimized widget drawing and interaction systems from Blender. By decoupling these components from Blender's core codebase, the project allows developers to build high-performance, battery-efficient desktop applications across multiple programming languages, including Python, Rust, JavaScript, C, and C++. It operates via a lightweight C runtime, known as the kit, which manages the widget tree, layout, input handling, and rendering.

The library provides a consistent user experience based on Blender's famous interaction model. Key features include drag-to-scrub number fields, mathematical expression evaluation within inputs, fuzzy menu searching, and comprehensive undo support. Because BUI is built to be modular, it supports multiple rendering backends, including a highly efficient software rasterizer and hardware-accelerated options using Direct3D 11 or OpenGL 3.3. Through a damage-rendering architecture, BUI only redraws regions that have changed, ensuring that idle applications consume virtually no CPU resources.

Developers have several entry points to the library. For Python users, BUI offers near-perfect compatibility with existing tkinter and ttk applications without requiring code changes, alongside support for Qt-style syntax and a set of native Blender components. Rust and JavaScript developers can utilize web-like frameworks that support HTML, CSS, and Tailwind, combined with the ability to integrate native Blender widgets for specific tasks. Additionally, the library provides a backend for Dear ImGui, allowing developers to use that interface with Blender's theming or even replace its standard widgets with Blender's native counterparts.

Performance is a central focus of the project, with the library designed to be fast, memory-efficient, and capable of handling complex interfaces with minimal overhead. It includes robust support for images and video, featuring off-thread decoding and memory-budgeted caching to prevent performance bottlenecks. As a standalone solution, BUI avoids the bloat of browser-based runtimes, enabling the creation of compact, fast-starting applications that maintain native feel and responsiveness.

The project is actively maintained with a modular architecture that encourages contribution and transparency. While some features like macOS window support and Qt syntax coverage remain in experimental or partial stages, the core C runtime and primary language bindings are functional and tested. Developers can access full documentation through the official website, which covers installation, language-specific guides, and performance benchmarks to help teams determine how best to integrate BUI into their existing workflows.

Failed to crawl the webpage. (English version not available)

Linux 操作系统在 1990 年代初期的开发，标志着对传统的、等级分明的软件创建模式的一次关键性背离。尽管 AT&T 和 Microsoft 等行业巨头依赖全职且高薪的团队，并通过受限版权与专有保密机制来加以保护，Linus Torvalds 却提出了截然不同的思路。他邀请全球共同参与他的内核项目，并将其保持为任何人都能自由研究、修改和分发的开放软件，从而推动了 GNU/Linux 操作系统的诞生。如今，这类软件支撑着全球绝大多数服务器、超级计算机和智能手机，实质上对专有控制的必要性提出了挑战。

这一被称为"基于公地的同伴式生产"（commons-based peer production）的范式，此后激发了无数项目，它们更依赖自愿协作而非官僚式管理。 Wikipedia 是最典型的例子：它从公开征集编写内容的倡议发展为人类历史上规模最大、内容最完整的百科全书。类似的较小项目，比如 GuttenPlag Wiki，也同样展示了大众如何组织并完成复杂任务，例如记录 Plagiarism，而这类行动可能带来显著的现实影响，包括高级官员的辞职。

同伴式生产的核心在于四项关键支撑：运用多样化、且往往并非以金钱为核心的激励机制；实行去中心化的自我治理；以分布式方式完成任务；并建立公共公地。与依靠合同义务、预设工作计划或定价体系的市场型企业不同，这些项目在运作时不受合同约束，也不预先设定任务方案或价格结构。尽管它们可能在某些方面与市场的分散性具有相似之处，但同伴式生产否定了这样一种观点：只有金钱激励与排他性的私有产权制度，才是高效组织人类劳动的唯一可行路径。

尽管取得了成功，同伴式生产仍与商业利益之间持续存在张力。许多现代平台，例如 Reddit，在保留企业所有权的同时，嵌入了同伴式协作的部分机制。随着这些公司逐步走向公开融资或更侧重广告收入，它们往往会限制志愿者所创建数据的访问权限，从而让开放社区与商业服务之间的界限变得模糊。此类转变也常常揭示了一个现实：当同伴式生产的资源没有被严格保护为公共公地时，它们就更容易变得不稳定。

这场运动自身也面临内部挑战，包括人口结构失衡、非正式等级关系的出现，以及持续存在的骚扰与排斥问题。此外，许多成功项目最终又会遇到"需要制度化"的要求，这可能反过来导致那种官僚化结构的出现，而这正是该运动一开始试图避免的东西。尽管如此，来自同伴式生产的影响仍在不断扩展，正在塑造从众筹、共享经济到支撑生成式人工智能的训练数据等一系列领域。

最终，同伴式生产为关于工作应如何被组织的传统经济学假设提供了一种有力替代。它证明了：在没有中央权威、也没有利润动机的情况下，无偿志愿者同样能够生产出有价值且高质量的成果。面对当下诸如谣言与错误信息（Misinformation）、以及公民参与度下降等问题，这种协作模式为人们如何携手应对复杂的全球性挑战，提供了一个富有意义、并经受时间检验的框架。 The development of the Linux operating system in the early 1990s marked a pivotal departure from the traditional, hierarchical model of software creation. While industry giants like AT&T and Microsoft relied on full-time, well-paid teams protected by restrictive copyright and proprietary secrecy, Linus Torvalds introduced a radically different approach. By inviting global collaboration on his kernel project and keeping it free for anyone to study, modify, and distribute, he helped spawn the GNU/Linux operating system. Today, this software underpins a vast majority of the world's servers, supercomputers, and smartphones, effectively challenging the necessity of proprietary control.

This paradigm, known as commons-based peer production, has since inspired countless projects that rely on voluntary cooperation rather than bureaucratic management. Wikipedia stands as the most prominent example, evolving from an open call for contributions into the largest and most comprehensive encyclopedia in human history. Smaller initiatives, such as the GuttenPlag Wiki, have similarly demonstrated the power of the crowd to organize and execute complex tasks, like documenting plagiarism, which can have significant real-world consequences, including the resignation of high-level officials.

At its core, peer production thrives on four key pillars: the use of diverse, often nonmonetary incentives, decentralized self-governance, distributed task execution, and the creation of a public commons. Unlike market-based firms, these projects operate without contractual obligations, predefined work plans, or pricing structures. While they may share some similarities with the distributed nature of markets, peer production rejects the notion that financial incentives and exclusive property regimes are the only viable ways to organize human effort effectively.

Despite its success, peer production faces ongoing tensions with commercial interests. Many modern platforms, such as Reddit, have integrated elements of peer-based collaboration while maintaining corporate ownership. Over time, as these companies move toward public offerings or prioritize advertising revenue, they often restrict access to the data that volunteers created, blurring the line between open communities and commercial services. This shift frequently highlights the precarity of peer-produced resources when they are not strictly protected as a public commons.

The movement is not without its own internal challenges, including issues of demographic imbalance, the emergence of informal hierarchies, and the persistent problems of harassment and exclusion. Furthermore, successful projects often encounter the need to formalize, which can lead to the very bureaucratic structures the movement initially sought to avoid. Yet, despite these obstacles, the influence of peer production continues to expand, shaping everything from crowdfunding and the sharing economy to the training data powering generative artificial intelligence.

Ultimately, peer production serves as a powerful alternative to classical economic assumptions about how work should be organized. It proves that valuable, high-quality goods can be produced by unpaid volunteers operating without a central authority or a profit motive. As society navigates contemporary issues like misinformation and eroding civic participation, this collaborative model offers a meaningful, time-tested framework for how people can work together to address complex global challenges.

Failed to crawl the webpage. (English version not available)

pwn.college 是一个实践型教育平台，旨在让学习者沉浸在计算的核心领域，从而培养必备的网络安全技能。参与者从 white belts 起步，随后在直接与终端、 CPU 和网络交互的过程中掌握相关概念，并逐步晋级，获得不同颜色的 belts 。该平台由亚利桑那州立大学（Arizona State University）的一支团队维护，并向全球学生和感兴趣的个人免费开放，是 ASU 自身网络安全课程的重要组成部分。

dojos 中提供的挑战主要用于教学目的，并作为全球大学学生评分的依据。正因为其承担了教学功能，创建者希望用户不要在互联网上发布挑战的 walkthrough 、 solution videos 或带有直播尝试的内容。尽管这条规定是自愿性的，遵守它仍能帮助维持平台的持续可用性，也让课程对学生和讲师都保持有效。

如果你有兴趣将该平台纳入自己的课程，pwn.college 允许在标注适当署名的前提下，将其 lectures 和 slides 用于非商业用途并免费使用。教育机构甚至可以选择把这些挑战导入面向学生的 private dojos；团队也欢迎收到有关平台使用情况的通知，以支持他们持续的学术工作。课堂之外，该项目还希望通过举办基于活动的密集培训课程，与各类 conferences 进行更多互动。

当学习者在平台上不断进阶，学习之路仍将通向更高水平的熟练度，最终达到 brown belt 和 black belt 的阶段。团队鼓励毕业生通过 Capture The Flag 竞赛、长期 wargames，以及 CryptoHack 或 OST2 这类替代学习平台来进一步打磨技能。对于想要深入研究的人，创建者在 ASU 提供 internship 机会，并欢迎为支撑其网站的 open-source 基础设施贡献力量。 pwn.college serves as a hands-on educational platform designed to help learners develop essential cybersecurity skills by immersing them in the core of computing. Participants begin their journey as white belts and progress through various levels, earning different colored belts as they master concepts by interacting directly with terminals, CPUs, and networks. The platform is maintained by a team at Arizona State University and is available for free to students and interested individuals worldwide, forming a significant component of ASU's own cybersecurity curriculum.

The challenges provided within the dojos are primarily intended for educational purposes and serve as the basis for grading university students globally. Because of this pedagogical role, the creators ask that users refrain from posting walkthroughs, solution videos, or livestreamed attempts of the challenges to the internet. While this rule is voluntary, following it helps preserve the platform's viability and keeps the curriculum effective for students and instructors alike.

For those interested in integrating the platform into their own coursework, pwn.college allows for the free use of its lectures and slides for non-commercial purposes, provided proper attribution is given. Educational institutions even have the option to import these challenges into private dojos for their students, and the team welcomes notifications regarding the platform's usage to support their ongoing academic work. Beyond the classroom, the project also seeks to engage with conferences by offering intensive, event-based training sessions.

As learners advance beyond the platform, the journey continues toward achieving high-level proficiency, eventually reaching brown belt and black belt status. The team encourages graduates to refine their skills through Capture The Flag competitions, long-term wargames, and alternative learning platforms like CryptoHack or OST2. For those looking to delve deeper into research, the creators offer internship opportunities at ASU and welcome contributions to the open-source infrastructure that powers their site.

Thinking Machines 推出了 Inkling 2 Small，这是其第二代 Mixture-of-Experts 模型，拥有 5940 亿个总参数和 170 亿个激活参数。该模型支持图像输入，并提供可变的计算投入水平。在 agentic coding 、 vision 、 knowledge work 和 reasoning 等任务上，相比前代产品展现出显著的性能提升。目前，该模型可在 Tinker 平台上用于推理与微调；在完成全面的外部安全测试后，计划以 Apache 2.0 许可证发布权重。

该模型在长周期的自主任务中表现尤为突出，例如通过程序化方式生成复杂环境，如城市模拟器或 PC 模拟器。其编码能力也通过在大规模数据集上进行强化学习得到增强，这些数据集引入了 agentic graders，使模型能更好地理解并执行指令，同时还能自主验证自己的输出。除软件开发外，Inkling 2 Small 在自动化研究（autoresearch）方面同样出色，已证明其能够在预测类任务中自主完成训练：通过反复构建评估脚本并持续打磨数据集，让模型逐步改进。

视觉理解是其另一项关键能力，配备了一个 2.92 亿参数的视觉编码器。模型在需要 OCR 、文档与信息图表解析，以及视觉推理的任务上表现非常出色。它能将视觉反馈有效嵌入工作流程，使其能够校验并优化自己生成的代码。此外，在知识密集型领域（包括金融、法律工作和定量分析）中，它也展现出强劲的能力，能够在阅读复杂文档与处理数据时做出接近专家水平的判断。

Inkling 2 Small 的研发以安全与对齐为核心。研究人员采用"纵深防御"的思路，通过同步与异步监控来识别并缓解不当行为。这包括对训练轨迹进行筛选，以抑制持续但不诚实的策略，并使用在策略内（on-policy）的自蒸馏，帮助模型内化更积极的行为准则。尽管在部分进攻性网络安全场景中，该模型仍未达到开放权重的前沿水平，但与既往版本相比，它在对齐基准测试上取得了明显进步。

Inkling 2 Small 的训练过程十分严苛：预训练阶段使用了超过 8 万亿个 tokens，并进行了为期九天的大规模联合强化学习，累计消耗超过 1700 万次 rollouts 。通过使用 NVIDIA GB300 机架以及 NVFP4 浮点格式等高效基础设施，团队能够对性能扩展实现可预测的提升。尽管如此，开发者也承认仍存在一些限制，例如缺少音频支持、交流偶尔偏啰嗦，以及在部分与安全相关的问题上存在过度敏感等情况，这些都将是后续优化的方向。 Thinking Machines has introduced Inkling 2 Small, their second-generation Mixture-of-Experts model featuring 594 billion total parameters and 17 billion active parameters. This model supports both image inputs and variable effort levels, showing significant performance gains over its predecessor across agentic coding, vision, knowledge work, and reasoning tasks. It is currently available for inference and fine-tuning on the Tinker platform, with plans to release the weights under an Apache 2.0 license following comprehensive external safety testing.

The model demonstrates notable strength in long-horizon autonomous tasks, such as procedurally generating complex environments like city simulators or PC emulators. Its coding capabilities have been enhanced through reinforcement learning on large-scale datasets that utilize agentic graders, allowing the model to better follow instructions and verify its work autonomously. In addition to software development, Inkling 2 Small excels at autoresearch, having proven its ability to autonomously train models on predictive tasks by iteratively building evaluation scripts and refining datasets.

Visual interpretation is another core capability, supported by a 292-million-parameter vision encoder. The model performs exceptionally well on tasks requiring OCR, document and infographic interpretation, and visual reasoning. It effectively integrates visual feedback into its workflows, enabling it to validate and refine its own generated code. The model also shows strong performance in knowledge-heavy domains, including finance, legal work, and quantitative analysis, where it demonstrates expert-level judgment when navigating complex documents and data.

Safety and alignment were central to the development of Inkling 2 Small. Researchers utilized a defense-in-depth approach, implementing both synchronous and asynchronous monitoring to detect and mitigate misbehavior. This included filtering training traces to discourage persistent but dishonest strategies and employing on-policy self-distillation to help the model internalize positive conduct principles. While the model remains behind the open-weight frontier in some offensive cyber scenarios, it shows a significant improvement in alignment benchmarks compared to previous versions.

The training process for Inkling 2 Small was rigorous, involving over 8 trillion tokens in the pre-training phase and a massive joint reinforcement learning run that consumed more than 17 million rollouts over nine days. By leveraging efficient infrastructures like NVIDIA GB300 racks and NVFP4 floating-point formats, the team was able to scale performance predictably. Despite its advancements, the developers acknowledge certain limitations, such as a lack of audio support, occasional verbosity in communication, and over-sensitivity in some safety-related queries, which remain areas for future refinement.

马克·库班正在公开批评 Meta，指控这家科技巨头明知仍在其平台上放任欺诈性的深度伪造广告传播。这位亿万富翁投资人是低价药品公司 Cost Plus Drugs 的联合创始人，经常听到老年人反馈：他们被由人工智能生成的广告误导，广告中虚假使用他的肖像来推销不存在的医疗"疗法"。库班认为，这些骗局绝非单纯的偶然疏漏，而是反映了 Meta 更广泛的内部文化——在用户安全之外，把广告收入放在首位。

相关说法也有报道支撑，报道援引了 Meta 的内部文件。文件显示，公司预计仅在 2024 年，围绕骗局和违禁产品的广告就能带来约 160 亿美元的收入。文件还称，Meta 的内部团队每天识别出约 150 亿条"高风险广告"，其中部分欺诈内容的年度价值大约为 70 亿美元。此外，文件指出，Meta 的自动化审核系统往往要求达到 95% 的欺诈概率才会采取处置措施，这就给出价更高的潜在诈骗者留下了继续在平台上出现的空间。

Meta 对这些指控予以否认。公司发言人表示，这类文件对其反欺诈工作呈现出片面且失真的画面。公司同时强调，用户举报的诈骗广告在过去 18 个月里明显减少，并且在 2025 年下架了数百万条诈骗广告。另外，公司目前还因与金融欺诈相关的广告做法，正受到美国证券交易委员会（SEC）的审查。

这些骗局对老年人造成的伤害尤其严重：他们在数字诈骗方面的经济损失，超过其他任何年龄段。根据美国联邦调查局 FBI 发布的 2025 年《互联网犯罪报告》，60 岁以上人群上报的损失超过 77 亿美元，较上一年大幅上升。由人工智能驱动的骗局构成了其中 3100 多起，造成的总体损失达到数亿美元。专家建议，消费者应对包含名人形象的广告保持警惕，通过第三方渠道核实产品信息，并将可疑行为报告给 Internet Crime Complaint Center 等相关部门。 Mark Cuban is speaking out against Meta, alleging that the tech giant knowingly permits the spread of fraudulent deepfake advertisements on its platforms. The billionaire investor, who co-founded the low-cost pharmacy company Cost Plus Drugs, regularly hears from elderly individuals who have been misled by AI-generated ads that falsely feature his likeness to sell nonexistent medical cures. Cuban contends that these scams are not merely accidental oversights but reflect a broader organizational culture at Meta that prioritizes ad revenue over user protection.

The criticism is supported by reports involving internal Meta documents, which suggest that the company anticipated generating approximately 16 billion dollars in revenue from ads associated with scams and prohibited products in 2024 alone. These documents indicate that Meta's own internal teams identified around 15 billion daily high-risk ads, with some categories of fraudulent content valued at roughly 7 billion dollars annually. Furthermore, the documents note that Meta's automated systems often require a 95 percent probability of fraud before taking action, allowing potential scammers who pay higher rates to maintain their presence on the platform.

Meta has contested these claims, with a company spokesperson arguing that such documents provide a selective and distorted view of their anti-fraud efforts. The company highlighted that user reports of scam advertisements have decreased significantly over the past 18 months and that millions of scam ads were removed in 2025. Additionally, the company is currently facing scrutiny from the Securities and Exchange Commission regarding advertising practices tied to financial fraud.

The impact of these scams is particularly severe for older adults, who suffer greater financial losses to digital fraud than any other age demographic. According to the FBI's 2025 Internet Crime Report, individuals over the age of 60 reported over 7.7 billion dollars in losses, a sharp increase from the previous year. AI-driven scams accounted for more than 3,100 of these complaints, representing hundreds of millions of dollars in total damages. Experts advise that consumers should remain skeptical of advertisements featuring celebrities, verify products through third-party searches, and report suspicious activity to authorities such as the Internet Crime Complaint Center.

有人就 Claude Code 工具提出了安全方面的担忧。有用户反馈，这款软件会在无意中向第三方网站泄露个人电子邮件地址。问题出现在 AI 代理进行网页搜索时：它把用户的电子邮件写入了 User-Agent 请求头。最初的报告者表示，这一行为导致垃圾邮件激增，让人愤怒，也让用户对开发者在用户隐私方面的做法失去了信心。

Anthropic 的代表澄清称，这并非刻意的功能，而是模型与网页交互方式带来的非预期结果。具体而言，像 Wikipedia 这类网站制定了相关规则，要求自动化客户端在请求头中使用联系电子邮件来表明身份。 AI 在研究任务中试图遵循这些约定时，会在未获得明确授权的情况下自动传播用户的电子邮件。

针对上述反馈，开发团队推出了一个内置模块 cc-plugin-privacy 。该更新从 2.1.317 及更高版本开始默认启用，通过确定性校验在发起网络请求时阻止电子邮件地址被传输。此后，团队已将该隐私模块的源代码公开，鼓励用户自行查看实现细节，并对其有效性提出反馈。

尽管修复已经发布，社区成员仍对开发流程不满。有用户指出，这个问题早在数月前就已被发现，并认为公司应优先梳理和处理积压的大量已报告漏洞，而不是只对引发关注的投诉作出回应。也有人提出临时的手动变通方案，例如为项目配置专属的 CLAUDE.md 文件，以严格约束 User-Agent 信息的处理方式，以及是否、以及在何种情况下可以披露电子邮件地址。 A security concern was raised regarding the Claude Code tool, where users reported that the software was inadvertently leaking personal email addresses to third-party websites. This occurred when the AI agent conducted web searches and included the user's email in the User-Agent request header. The original reporter noted that this behavior led to an influx of spam, prompting frustration and a loss of confidence in the developer's approach to user privacy.

Anthropic representatives clarified that this was not a deliberate feature but rather an unintended consequence of how the model interacts with the web. Specifically, some websites, such as Wikipedia, have established policies requiring automated clients to identify themselves with a contact email in the header. The AI, in attempting to follow these conventions during research tasks, automatically propagated the user's email without explicit authorization.

In response to these reports, the development team implemented a built-in mod called cc-plugin-privacy. This update, which is enabled by default in version 2.1.317 and later, uses deterministic checks to block the transmission of email addresses during web requests. The team has since made the source code for this privacy mod available to the public, encouraging users to inspect the implementation and provide feedback on its effectiveness.

Despite the release of the fix, community members expressed ongoing dissatisfaction with the development process. Some users pointed out that the issue had been identified months earlier and suggested that the company should prioritize triaging the massive backlog of reported bugs rather than only responding to high-profile complaints. Others proposed temporary manual workarounds, such as configuring project-specific CLAUDE.md files to strictly govern how User-Agent information is handled and when (or if) an email address may be disclosed.

CVE-2026-83844 指出在 Microsoft Paint 中发现了一个重大安全漏洞，具体为越界读取缺陷。该问题可能使未经授权的攻击者通过网络远程执行恶意代码。根据通用漏洞评分系统（Common Vulnerability Scoring System），该漏洞被评定为高严重性，分数为 8.1，表明对受影响系统存在严重风险。

该漏洞源于一个越界读取错误，归类为 CWE-125 。该技术缺陷可被利用来实现远程代码执行，这是潜在攻击者的重要能力。由于漏洞等级为高严重性，用户和管理员需要尽快采取措施，降低被利用风险。

就受影响软件范围而言，该漏洞影响从 11.0.0.0 起的 Microsoft Paint 版本，并存在于所有 11.2605.91.0 之前的版本中。 Microsoft 已正式确认该问题，并发布了供应商公告及相应补丁以修复该安全隐患。

为保障系统完整性，建议使用受影响版本的 Windows Paint 用户查阅 Microsoft 官方安全更新指南。通过应用推荐的补丁，用户可以有效修补安全缺口，保护系统免受该特定远程代码执行威胁。 CVE-2026-83844 identifies a significant security vulnerability discovered within Microsoft Paint, specifically involving an out-of-bounds read flaw. This issue allows an unauthorized attacker to potentially execute malicious code remotely over a network. The vulnerability has been classified with a high severity score of 8.1 according to the Common Vulnerability Scoring System, reflecting the serious risks posed to affected systems.

The vulnerability stems from an out-of-bounds read error, which is cataloged under CWE-125. This technical flaw can be exploited to achieve remote code execution, a critical capability for potential attackers. Because the vulnerability is categorized as high severity, it necessitates prompt attention from users and administrators to mitigate the risk of exploitation.

Regarding the scope of the affected software, the vulnerability impacts versions of Microsoft Paint starting from 11.0.0.0 and exists in all versions prior to 11.2605.91.0. Microsoft has officially acknowledged the issue and provided a vendor advisory along with the necessary patches to address the security concern.

To maintain system integrity, those using affected versions of Windows Paint are encouraged to consult the official Microsoft security update guide. By applying the recommended patches, users can effectively close the security gap and protect their systems from this specific remote code execution threat.

Kagi 推出了一项重大调整：任何人都可以无需创建账户直接搜索网络。现在，访问者可先免费进行 50 次搜索，完成注册后还能额外获得 100 次搜索次数。此次更新旨在推动口碑传播，并为用户（尤其是教育领域用户）提供更明确的替代选择，让他们能够避开 Google 等大型竞争对手日益 AI 化、且广告驱动愈发浓厚的环境。 Kagi Search 的 Android 应用也同步更新了，主要包括重新设计的首页、改进的语音搜索以及更便捷的小组件入口。

Kagi Assistant 也经历了大幅优化，重点提升易用性与可靠性。近期更新带来了更顺畅的语音输入、更清晰的临时线程与永久线程视觉标识，并支持将图片或文件直接粘贴进提示词中。此外，移动端用户现在可以使用官方的 Kagi Assistant iOS 和 Android 应用，确保不同设备上的使用体验一致。服务还推出了更强大的研究代理：用户可在 Quick 和 Research 两种模式之间进行选择，在速度与分析深度之间取得平衡。

平台管理已统一到 account.kagi.com 的单一账户体系下，该体系也新增了对 passkeys 的支持，以提升安全性并简化登录流程。除上述结构性调整外，公司还通过一系列新举措扩展生态，例如推出 Kagi News，提供精心策划的每日媒体综述，并为 Kagi Translate 引入免费增值模式。相关服务的目标是在控制运营成本的同时，维持高质量、无广告的信息获取体验。

此外，其他值得关注的产品进展还包括 Kagi Maps 的更新：移动端新增测量工具，并为热门城市区域增加数据图层。公司还推出 Kagi Specials，这是一个合作伙伴计划，为其他同样注重隐私的服务提供折扣。在这些发布过程中，公司始终坚持透明与用户可控原则，并通过社区论坛持续征集反馈，以指导后续开发与修复问题。 Kagi has introduced a significant shift by allowing anyone to search the web without creating an account. Visitors can now perform 50 searches for free, with an additional 100 available after registering. This update is designed to facilitate word-of-mouth growth and provides a clear alternative for users, particularly in education, who wish to avoid the increasingly AI-heavy and advertising-driven environments of major competitors like Google. The Kagi Search Android app has also been updated with a redesigned home screen, improved voice search, and better access to widgets.

The Kagi Assistant has undergone substantial refinements to improve both usability and reliability. Recent updates include smoother voice input, clearer visual indicators for temporary versus permanent threads, and the ability to paste images or files directly into prompts. Additionally, mobile users now have access to official Kagi Assistant apps for iOS and Android, ensuring a consistent experience across devices. The service has also introduced a more powerful research agent, allowing users to choose between Quick and Research modes to balance speed with analytical depth.

Platform management has been unified under a single account system at account.kagi.com, which now includes support for passkeys to improve security and login convenience. Alongside these structural changes, the company has expanded its ecosystem through new initiatives like Kagi News, which provides a curated daily press review, and a freemium model for Kagi Translate. These services aim to maintain high-quality, ad-free information access while managing operational costs.

Other noteworthy product developments include updates to Kagi Maps, which now features a measuring tool on mobile and data layers for popular urban areas, and the introduction of Kagi Specials, a partnership program offering discounts on other privacy-focused services. Throughout these releases, the company has maintained its commitment to transparency and user control, frequently soliciting feedback through its community forums to guide ongoing development and bug fixes.