Huawei claims it’s built a desktop PC that uses only parts made in CHina. The company launched the Qingyun HM650 last week and said it uses Huawei’s own Kirin X90 processor, a ten-core 20-thread machine with a clock speed of 2.3 GHz. The machine runs a newly developed enterprise version of HarmonyOS, the OS Huawei developed to end its dependence on Android and which it intends to run on most of the devices it makes. A single Chinese government agency has reportedly signed up for 600 of the machines. That’s not an indication this machine is a curiosity, because Beijing has ordered all government entities to shift from Wintel boxes to local alternatives. While Huawei has reportedly claimed local companies manufactured 100 percent of the components in the machine, it is unclear if all those components use Chinese designs. The Register mentions that uncertainty as many non-Chinese companies continue to operate factories in China. Even if Huawei is using some parts that aren’t entirely Chinese, the debut of the Qingyun HM650 is bad news for Intel, AMD, and Qualcomm, as all are suffering as the PC market shrinks due to the rising cost of memory. China’s government is an enormous buyer, and losing the chance to bid for its business is unlikely to be helpful. Japan announces emergency response package after wave of cyberattacks Japan’s government last Friday announced emergency funding to help local organizations strengthen the nation's cyber-defences. The ¥10 billion ($63 million) package follows a wave of cyberattacks that have disrupted railways, retailers, KFC’s logistics provider, and cloud computing operators. The emergency package aims to help Japanese government agencies to use AI to nail infosec basics, and to build tools that let the National Cybersecurity Office aggregate information about cyberattacks. Some funds will also go towards supporting victims. Lenovo’s APAC boss shifts to lead Motorola Lenovo is looking for a new leader of its Asia-Pacific operations after shifting the boss, Amar Babu, to a role as mobile business group general manager and global president at Motorola. Amar led Lenovo in the region for over five years and the company credited him with turning it into “a more balanced and diversified business and a key growth engine.” “Across the portfolio, AP maintained its #1 PC position, while our mobile business achieved notable growth, with Motorola reaching nearly 9 percent market share in India and the #2 smartphone OEM in Japan,” according to a company announcement. “Our infrastructure business achieved profitable growth and nearly double-digit market share, while Solutions & Services continued to strengthen its best-of-breed industry position and significantly increased its advanced services business mix to over 50 percent.” Lenovo has not named a new leader for its APAC outpost. Vietnam hails homegrown USB storage chip Vietnam’s government last week announced the nation’s first domestically-designed security chip - a 28-nanometer device that apparently integrates encryption algorithms in silicon. The chip is already in use on secure USB storage devices that Vietnam’s government employs to store info for government and defense agencies, plus the Communist Party. The nation hopes to use the chips to secure storage of the national digital signature certification system, and critical infrastructure systems in electricity, water, oil and gas, and telecommunications. Hanoi says the chip needs more testing before the government will trust it to protect state secrets, but hailed the chip as an important step towards development of sovereign security capabilities. Apple’s biggest ever education deal Apple last week quietly announced it has won its biggest-ever sale of Macs into the education market in the Philippines. Speaking on the company’s Q4 earnings call, CEO John Ternus said Apple sold 172,000 MacBook Neos to the Department of Education in the Philippines, which will deploy them to teachers and staff. ®

The age of LLM-assisted security vulnerability discovery is really starting to bite. Debian's latest Linux kernel security update comes with a formidable reading list of 1,313 CVE identifiers. The DSA-6528-1 Linux security advisory, published on September 29, covers kernel package version 6.12.111-1 for Debian 13, codenamed Trixie. Debian 13.7 was released on September 12, before upstream kernel 6.12.111 arrived nine days later. The Debian security tracker links to descriptions of the individual issues. We have not examined every entry. If we had, this article would not appear until after Debian 13.8 (which is likely to appear later in October), or possibly at some point in 2027. Several checked at random also affect older kernel versions, so the list should not be read as a tally of bugs introduced in 6.12.111. The Linux kernel project became a CVE Numbering Authority (CNA) in February 2024. Back in February this year, kernel maintainer Greg Kroah-Hartman described the Linux CVE assignment process in some detail. He said kernel development averages around nine changes an hour, with a feed of known bug fixes averaging about 30 changes a day providing the basis for the CNA team's review. The kernel team's policy is to assign CVEs automatically after fixes have reached a stable kernel tree. It takes a deliberately cautious approach because the security implications of a bug may not be apparent when it is fixed. A CVE identifier alone therefore says little about severity or exploitability. We strongly suspect that this number of CVEs is due to LLM bots doing the bug hunting, and quite possibly doing the bug fixing as well. Linux is not an anti-AI project, and neither is Debian. AI-assisted bug hunting is already swamping the Linux security mailing list, as The Register reported in May. Kroah-Hartman released kernel 6.12.112 on October 3. Its detailed changelog runs to more than 27,000 lines. With both the rates of change and the sizes of the changes getting so large, it is hard to deny that LLM bot assistance must be very useful to the hard-pressed maintainers. Whether coding bots constitute a net benefit to the projects, to software, or to humanity as a whole remains at best an open question. ®

Canonical is speeding up Ubuntu kernel releases to one a week as AI-assisted bug hunting helps bury defenders under an ever-growing pile of CVEs. The Ubuntu maker is overhauling how it ships kernel Stable Release Updates (SRUs), replacing its current four-week regular and two-week security cycles with overlapping two-week cycles that will push a kernel release every week. Canonical says the change is needed because the number of reported vulnerabilities has exploded, with AI deserving some of the credit – or blame, depending on which side of the patch queue you're sitting. "Large language models (LLMs) and specialized AI agents have transformed bug discovery from a manual, time-intensive process into a highly automated engine," Canonical said on Wednesday. AI isn't solely responsible for the CVE avalanche. The upstream Linux kernel community became a CVE Numbering Authority in 2024 and began assigning identifiers to thousands of bugs on the basis that almost any kernel flaw affecting a running system could have security implications. Put the two together, and Linux vendors have far more CVEs to deal with. Canonical says the resulting backlog requires faster releases to shrink the window between vulnerabilities becoming public and patched kernels reaching users. Under the new system, each SRU cycle lasts two weeks, but a new one starts every week. The first week is spent integrating patches, preparing and building kernel packages, and carrying out basic checks to make sure nothing catches fire. By the end of that stage, release candidates are published to Ubuntu's -proposed pocket. Week two is reserved for the heavier stuff, including hardware certification, distro integration, and regression testing. Once that's done, the kernel is released. Because the next cycle starts while that testing is under way, Canonical can publish another kernel the following week. For admins who consider even that too leisurely, there's a faster route. Organizations particularly sensitive to patching delays can take release candidates from the -proposed pocket after the first week and run their own acceptance tests. Canonical makes the trade-off clear: those users get access to fixes sooner, but before the company has finished its extensive certification testing. That can make kernel CVE fixes available within a week, provided customers are willing to perform some of the testing themselves. Canonical also wants to leave customers less exposed between disclosure and patch availability. It aims to provide safe workarounds where possible, or recommend general hardening measures where none exist, putting systems into what it calls a "defensible, safer state" within 24 to 48 hours of public disclosure. Those measures are not intended to replace patching, merely to give admins something better than crossing their fingers while a fix makes its way through the release process. The end result is a considerably busier kernel release schedule, although perhaps that's inevitable when machines are increasingly being enlisted to find bugs faster than humans can patch them. AI was supposed to make everyone's jobs easier. Ubuntu's kernel team may want a word. ®