Episode Details

Last Week in Tech for Monday 7 September 2026, covering 30 August to 6 September.

Nvidia to acquire Hugging Face for US$12.93bn. Confirmed by Nvidia on 3 September, expected to close in the first half of 2027 subject to regulatory approval. Nvidia states the platform serves 18 million+ developers, 3 million+ models and 200,000+ companies, and has committed that Nvidia compute will not be required to build on or deploy through it.

OpenAI ships GPT-6 "Astra" (3 September). OpenAI says it is the first model to meet the Critical cybersecurity threshold under its own Preparedness Framework — 100% on ExploitBench versus 78.5% for the prior model, and 39% versus 5.5% on a fresh-vulnerability variant. OpenAI says the model found and disclosed two previously unknown zero-days during evaluation. The shipped model refuses advanced offensive tasks. Separately, OpenAI committed US$1bn in subsidised defensive AI access for critical infrastructure, government, nonprofits and open-source maintainers; eligibility, subsidy level and post-subsidy pricing are not yet disclosed.

Broadcom Q3 FY2026 (2 September). Revenue US$29.59bn, up 86% year on year; free cash flow US$13.67bn. CEO Hock Tan, quoted in the release, put AI semiconductor revenue at US$16.7bn, up 221% year on year, with Q4 expected at US$21.7bn. Longer-range AI revenue projections circulating this week came from earnings-call commentary, not the written release.

CISA adds seven exploited flaws in one day (2 September). Four sit in AI and DevOps infrastructure — Kestra, JFrog Artifactory, Berri LiteLLM and Starlette. Microsoft reports attackers harvesting LiteLLM database tables for provider API keys and proxy-issued virtual keys, and advises monitoring AI workloads according to their control-plane role. Also on the list: Sangoma Switchvox (CVSS v4.0 9.3), a VoIP platform sold to SMBs, patched 14 July, first seen exploited 30 August. Fixed version 8.4.0.2.

Elementor Pro under mass exploitation. Critical arbitrary file upload patched 19 August in version 4.2.2. Wordfence has blocked over 190,000 exploit attempts, and roughly two-thirds of Elementor's 10 million installations were still vulnerable as at 4 September. Indicator of compromise: any .php file under /wp-content/uploads/elementor/forms/.

Chrome's sixth zero-day of 2026. V8 type confusion, fix shipped 3 September, added to CISA KEV 4 September. Fixed builds 152.0.7977.82/.83. Relaunch Chrome.

Coming up: Wednesday, the PaperCut zero-day chain. Friday, 153 million driver's licence scans on the dark web.

Visit www.kinsoft.com.au to talk through your security and IT needs.

Sources: NVIDIA newsroom; OpenAI; SecurityWeek; Broadcom investor relations; CISA KEV catalogue; Microsoft Security Blog; The Hacker News; Wordfence; BleepingComputer.