2026-11-01 · 中文选题

← Chinese Topics

Translation

English translation of the Chinese original.

Top Picks

1. Anthropic's unreleased model wrote a Linux remote root exploit: who CVE-2026-98432 fixed, and who it didn't

Why now: Chinese-language circles began spreading it on the morning of 10-30. ScarletKc's 10:55 post quoting The Hacker News already had 129,841 views, 488 likes, and 365 bookmarks; on the evening of 10-31, geekbb at 21:43 carried the topic into the proxy-tool crowd, with 39,672 views, 210 likes, and 199 bookmarks, because Xray-core rushed out a release over it. As of the morning of 11-01, Ubuntu and RHEL still had not shipped fixed kernels, so most readers' servers are probably still exposed. This is a security topic with practical consequences.

Extra angles: start by separating three layers of fact. The vulnerability itself: a race condition when the kernel establishes an IPv4 TCP connection causes a use-after-free in ip_options_build(), rated 9.8 by the kernel CNA, introduced in Linux 4.4, fixed on October 5, and included in 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, and other versions. Exploitation conditions: Anthropic's research article describes remote root on "a Linux server with multipath TCP listening enabled," with no credentials required; the proof of concept leaked a kernel pointer in 48 minutes and achieved command execution 5 minutes later, and failures do not crash the machine, so it can be retried. But neither the CVE record nor the patch mentions MPTCP, and the Go security team explicitly says the root cause "is not MPTCP-specific," so ScarletKc's 10-31 follow-up warning that "just turning off MPTCP isn't enough" is well founded. The Go angle: since Go 1.24, ListenConfig listens over MPTCP by default on Linux, so any Go service may have it quietly enabled; GODEBUG=multipathtcp=0 turns it off. Xray's v26.10.31 release notes state that "this version disables MPTCP by default," and v26.10.29 has been withdrawn. The same report also includes one-click exploit chains for Chrome and Safari, an Android lock-screen bypass, and a Windows remote denial of service — five in total.

Suggested format: an original post with a table of "distribution, fix status, temporary mitigation," ending with two lines of check commands for Go services and Xray users. Do not write "AI hacked Linux by itself"; make clear that this was a proof of concept written by Anthropic's red team in controlled research.

Status: ready to draft. The vulnerability description, 9.8, introduction in 4.4, fixed versions, 48 minutes plus 5 minutes, the five chains, the Go 1.24 default, and the Xray release notes are all verified. On the morning of 11-01 the Ubuntu page still lists 26.04, 24.04, and 22.04 as work in progress; Debian has fixed it in the security repo; Red Hat's score has appeared as 5.9, 8.1, and 9.8, so cite it with a date. There are currently no public reports of exploitation in the wild.

2. Fact check: "Claude Fable 5 weights leaked and are being sold" — the sample files actually match DeepSeek open-source shards

Why now: on the morning of 10-31 the rumor exploded in Chinese-language circles. mylifcc's 11:02 post had 100,745 views and 581 likes, and NFT_Chen's 10:48 post had 55,425 views and 214 likes — far more reach than the debunking. dotey posted a point-by-point comparison at 11:07, with 23,990 views and 91 replies; the reply count shows the dispute has not died down. This is the most widely spread false claim in the Chinese AI community in this window, and a perfect opening for a "how to verify it yourself" piece.

Extra angles: three things can be checked first-hand. First, the shards of deepseek-ai/DeepSeek-V4.1-Flash-1017 on Hugging Face do include the size 7,389,761,368 bytes; shards 13 through 16 are all that size. Second, the rumor's own numbers are inconsistent: 640 shards at about 7GB each is only about 4.5TB, which does not match "about 8TB." Third, that DeepSeek model has 48 shards totaling about 510GB, so "the seller's sample is byte-identical to the open-source file" is consistent with the direction of dotey's comparison. Keep this separate from another matter: there was indeed a report in late October of an intrusion into Anthropic's internal systems, and the company said at the time that source code and model weights were not accessed.

Suggested format: quote dotey's post for the fact check, with a two-column table of "what the rumor says" and "what can be verified," and end by teaching readers three steps: check the file names and shard count, compare byte sizes, and check the official repository.

Status: ready to draft, worded as "highly likely fabricated," not "disproven." HF shard sizes and the total have been verified. The original dark-web post, the "Dark Web Informer repost," and the claim that the seller's sample matches the DeepSeek files have no first-hand source, only Chinese-language retellings. As of the morning of 11-01 there is no response from Anthropic or AWS and no mainstream media coverage.

3. After three crashes in one week, Orange asks what incremental value AI actually creates

Why now: oran_ge published the X long-form post "The Eve of the AI Bubble Burst" at 09:13 on 10-31, with 239,823 views, 845 likes, 887 bookmarks, 138 replies, and 52 quotes — the highest-viewed Chinese AI post this cycle. Two hours later the author added a reply post saying that "many people started flaming before they even finished reading." The day before, xiaohu's one-liner "the AI bubble has burst" also got 98,304 views. Both the mood and the data are right here, which makes it a good fit for a long opinion post.

Extra angles: most of the market numbers at the start of the article check out. Intel fell 28.58% on 10-30, its worst day since 1974. Alphabet fell 12.6% on 10-29 to close at $283.82, its worst day since listing, wiping out about $480 billion to $500 billion in market value in a day. Reddit fell about 29% on 10-30; its CEO said on the earnings call that Google's AI Mode "doesn't bring traffic," and search referrals were down more than 1 million per week on average in October. SanDisk fell 13.47%, and the Nasdaq fell 2.86%. Microsoft offered voluntary buyouts to about 60,000 employees on 10-26. Two points need correction: ByteDance's "up to $70 billion this year on AI infrastructure" was a "discussed upper limit" in a May Bloomberg report, not a settled budget; "Anthropic IPOs next month" has no basis — it publicly filed its S-1 on 10-26, but the listing date is undecided. On the argument level, the article's main thread is that "AI brings replacement value but no incremental value," using Yunnan blueberries' 39% yield increase and 50% price drop as an analogy for "intelligence is no longer scarce," plus two further claims: "the AI economy has no middlemen" and "vibe coding is kill time." The quote section also includes opponents who argue that value has not disappeared, it has just moved.

Suggested format: a quote post or long post. Start with a small table of "three companies, three drops, one reason," then pick the article's most contested argument — productivity is not revenue — and respond head-on. Avoid a stock-tip tone, and do not draw the "bubble has burst" conclusion on the author's behalf.

Status: ready to draft, with market numbers per the verified version. Intel, Alphabet, Reddit, SanDisk, the Nasdaq, and the Microsoft buyouts all have authoritative media sources. ByteDance's $70 billion must be labeled "under discussion," and Anthropic's IPO timing must be changed to "S-1 filed, date undecided." The Hongguo short-drama closed loop and similar points are the author's judgment.

Candidate Topics

1. Anthropic's unreleased model wrote a Linux remote root exploit: who CVE-2026-98432 fixed, and who it didn't

Posts and engagement: ScarletKc on 10-30 at 10:55, 129,841 views, 488 likes, 365 bookmarks, 18 replies, 52 reposts, 7 quotes, quoting The Hacker News; ScarletKc follow-up on 10-31 at 09:33, 6,356 views, 44 likes, 16 bookmarks; geekbb on 10-31 at 21:43, 39,672 views, 210 likes, 199 bookmarks, 19 replies, 16 reposts; xulijian1994 on 10-30 at 09:48, 5,061 views, 16 likes, compiling the status of each distribution.

What it says: the Anthropic research article says that over the past few months Anthropic used an "unreleased internal research model" to find vulnerabilities and chain them into usable exploits. One of them is a zero-click remote code execution in Linux: sending packets to a server with MPTCP listening is enough to execute commands as root. The Hacker News vulnerability piece adds details: the root cause is a race condition and use-after-free when establishing an IPv4 TCP connection, introduced in 4.4, fixed on October 5, with the CVE disclosed ten days later; neither the CVE record nor the patch mentions MPTCP — that link comes from Anthropic's article. Fix status: the Debian security tracker shows bookworm and trixie fixed in the security repo; the Ubuntu security page lists 26.10 through 20.04 as still unfixed or in progress; THN's table records RHEL 8, 9, and 10 and OpenShift 4 as affected with no fix available. Go 1.24's release notes state that ListenConfig uses MPTCP by default on Linux; Xray's v26.10.31 release notes state that MPTCP is therefore disabled by default, and v26.10.29 has been withdrawn.

Why it's worth covering: many Chinese readers run their own servers, proxies, and Go services, so this directly answers "should I act now." The second layer is the AI security narrative: the same report covers five chains — Chrome, Safari, Android, Windows, and Linux — and the Windows one is only a denial of service; spelling that out is more credible than hyping "AI can hack everything." The third layer is the little-known detail that Go enables MPTCP by default.

Timing and verification: ScarletKc's first post and xulijian1994's post are 24–48 hours old; the follow-up and geekbb's post are within 24 hours. Checked against the Anthropic original, two THN pieces, the Debian and Ubuntu tracker pages, the Go 1.24 release notes, and the Xray release notes. Red Hat's score has appeared as 5.9, 8.1, and 9.8. "No exploitation in the wild so far" comes from ScarletKc's and xulijian1994's posts, with no counter-evidence and no official confirmation.

2. Fact check: "Claude Fable 5 weights leaked and are being sold" — the sample files actually match DeepSeek open-source shards

Posts and engagement: dotey on 10-31 at 11:07, 23,990 views, 49 likes, 16 bookmarks, 91 replies, 9 quotes; the spreaders mylifcc on 10-31 at 11:02, 100,745 views, 581 likes, 256 bookmarks, 35 replies; NFT_Chen on 10-31 at 10:48, 55,425 views, 214 likes, 125 bookmarks; MaxForAI on 10-31 at 14:38, 26,938 views, 92 likes; leo114119 on 10-31 at 09:08, 6,194 views.

What it says: the rumor claims that someone on a hacker forum said they obtained Fable 5 weights from an S3 bucket linked to Amazon Bedrock, showed several shards of about 7GB each, and said the full model has 640 shards totaling about 8TB. Dotey's comparison found that these files match shards 13 through 42 of DeepSeek V4.1-Flash-1017, and he noted that the magnitude doesn't add up and the account was newly registered. What can be verified: the Hugging Face repository has 48 weight shards totaling about 510GB, and shards 13 through 16 are each 7,389,761,368 bytes. Separately, according to TechRadar and others, in the late-October intrusion into Anthropic's internal systems, the company said source code and weights were not accessed.

Why it's worth covering: the rumor posts have more than four times the views of the debunking post, leaving plenty of room to fill. It is also a chance to teach a method for "what to check when you see leaked weights," and to remind readers not to download "leaked weights" of unknown origin, which are more likely malicious files or scams.

Timing and verification: everything is within 24 hours. The HF file list has been verified. The original forum post, the reposting account, and the "byte-identical" claim have no first-hand source, only Chinese-language retellings. No response from Anthropic or AWS and no English-language mainstream coverage have appeared, so treat it as "highly likely fabricated."

3. After three crashes in one week, Orange asks what incremental value AI actually creates

Posts and engagement: oran_ge on 10-31 at 09:13, 239,823 views, 845 likes, 887 bookmarks, 138 replies, 116 reposts, 52 quotes, the X long-form post "The Eve of the AI Bubble Burst"; oran_ge reply post on 10-31 at 11:06, 21,087 views, 71 likes; xiaohu on 10-30 at 23:36, 98,304 views, 239 likes, 83 replies; wufantouzi on 10-31 at 15:20, 16,176 views, 54 likes, 30 replies, arguing that Intel is a case of "story but no results," while Google and Meta earnings are still growing.

What it says: the article starts with Intel, Google, and SanDisk falling sharply even after beating earnings expectations, and makes four points: rising memory and flash prices make phones and PCs more expensive; AI coding doubles productivity but revenue hasn't followed, and intelligence is not scarce, so it is not valuable; AI lets people get results directly, skipping middlemen and transactions, with Reddit losing traffic to AI Mode as a microcosm; and big companies are pouring both their profits and the money saved from layoffs into AI. Verification: CNBC recorded Intel falling about 29% on 10-30, its worst since the 1970s; Fortune recorded Alphabet falling 12.6% on 10-29 to close at $283.82; The Verge recorded Reddit's CEO saying AI Mode "doesn't bring traffic"; CNBC recorded that about 60,000 Microsoft employees are eligible for the buyouts.

Why it's worth covering: this is the most discussed opinion piece of the cycle, with plenty of both agreement and rebuttal, and it suits a "here's the half I agree with and the half I don't" structure. For the account owner's readers, "productivity gains are not revenue growth" is more useful than the market numbers themselves.

Timing and verification: the long post and the reply post are within 24 hours; xiaohu's post is 24–48 hours old. The market numbers and Microsoft figures have been verified. ByteDance's $70 billion is a discussed upper limit from a May Bloomberg report; "Anthropic IPOs next month" does not hold, and can only be written as "publicly filed its S-1 on 10-26." The blueberry numbers and the Hongguo short-drama section have not been verified separately.

4. Follow-up on ban anxiety: Kiro becomes the new answer to "use Claude without getting banned," but Xianyu credits come with pitfalls

Posts and engagement: manateelazycat on 10-31 at 10:27, 146,339 views, 764 likes, 1,375 bookmarks, 101 replies, 11 quotes; the author's follow-up post on 10-31 at 16:12, 15,962 views, admitting that "daily use is a bit dumber"; ai_chuhai on 10-31 at 11:18, 4,797 views, 44 bookmarks, posting the official price list; PrismChemAI on 10-31 at 21:15, 8,202 views, saying that with two Claude Pro accounts open at once, the one in Claude Code was banned in under two hours while the one connected to OpenCode was still fine; lxfater on 10-30 at 21:39, 79,108 views, 123 likes, worried that OpenAI subscriptions will be banned in the future too.

What it says: manateelazycat's approach is to run Claude through Amazon's Kiro, buying 10,000 credits for 75 yuan on Xianyu. Official information: the Kiro models page lists Claude Opus 5.5, Sonnet 5.5, Haiku 5.5, and others, with credits counted at 1x for Auto and 2x for Opus 5.5; the pricing page gives the free tier 50 credits per month, the Power tier $200 for 10,000 credits, add-on credits at $0.04 each, and credits reset to zero at month end; the student terms give eligible students 1,000 credits per month for 12 months and state that the benefits are non-transferable and may not be resold; Kiro is licensed under AWS Content, and the AWS customer agreement prohibits reselling the service.

Why it's worth covering: bookmarks are nearly twice the likes, which means people saved it as a guide. It can be written as a comparison of "compliant channels versus gray channels": Kiro's official subscription and student plan are the legitimate route; 10,000 credits for 75 yuan most likely comes from resale or shared accounts, violates the terms, can be reclaimed at any time, and the author himself mentions degraded performance. It also connects to the Magpie switch to the TUI, showing that "bans" are already changing tool design.

Timing and verification: manateelazycat's two posts, ai_chuhai's, and PrismChemAI's are within 24 hours; lxfater's is 24–48 hours old. Kiro's models, credit prices, student plan, and non-resale terms have been checked against the official pages. "10,000 credits for 75 yuan on Xianyu," "no bans," and "OpenCode lowers ban risk" are all personal experience and have not been reproduced; one reply says 75 yuan bought only 1,000 credits.

5. Magpie switches Claude Code's default to the interactive interface: claude -p burns more quota and is easier to flag

Posts and engagement: yetone on 10-31 at 21:38, 46,804 views, 456 likes, 195 bookmarks, 85 replies, 7 quotes; related, chenchengpro on 10-31 at 09:14, 8,336 views, 40 likes; xulijian1994 on 10-30 at 16:45, 27,167 views, 171 likes, 238 bookmarks, introducing the free coding combo of WorkBuddy plus DeepSeek plus Magpie.

What it says: yetone says Magpie's Claude Code Provider has changed from claude -p to driving the TUI, because -p consumes about twice the quota in a 5-hour window and carries higher ban risk. The Magpie repository commit history matches: a commit in the early hours of 10-31 changed the default run mode for subscribers to Claude Code interactive mode, with -p only as a fallback; in the early hours of 11-01 it added an "Interactive only" toggle that never uses -p when enabled; other supporting changes include falling back to -p when interactive mode gets stuck and pasting images as files. xulijian1994's combo saves money through check-in credits and rotating multiple accounts, which carries a risk of violating the terms of service.

Why it's worth covering: this follows the Magpie discussion from 10-29, and the news is that "the same subscription, called a different way, gets different quota consumption and different risk treatment." It can give heavy Claude Code users a practical conclusion, and it opens a discussion about the tug-of-war between third-party tools and official risk controls.

Timing and verification: yetone's and chenchengpro's posts are within 24 hours; xulijian1994's is 24–48 hours old. The commit history has been verified. "claude -p consumes twice the quota" is the author's claim, with no supporting Anthropic documentation found; rotating multiple accounts is not recommended.

6. Follow-up: the DSH plugin ecosystem has two big launches in one day — Claude Design and a nine-platform IM integration

Posts and engagement: dotey on 10-31 at 09:06, 56,071 views, 663 likes, 693 bookmarks, 109 replies, 11 quotes; haoge6699 on 10-30 at 18:42, 49,904 views, 473 likes, 553 bookmarks, 24 replies.

What it says: dotey turned the Claude Design capability into a DeepSeek Harness plugin, placed in the dsh-plugins directory of baoyu-design, currently with four plugins — dsh-claude-design, dsh-claude-design-system, dsh-claude-slides, and dsh-claude-dashboard — plus Chinese and English documentation; the repository has about 5,668 stars. xmanrui/dsh-im, introduced by haoge6699, connects nine platforms — Feishu, WeChat, DingTalk, WeCom, QQ, Slack, Telegram, Discord, and WhatsApp — to DSH via QR code or bot credentials; it is MIT licensed, was created in August, and had 3,016 stars on the morning of 11-01.

Why it's worth covering: the 10-31 report covered DSH Go and dsh-guizang-design, and these two are new plugins, showing that DSH is growing from "an open-source agent" into a platform with a plugin ecosystem. A list piece on "how to choose and install DSH plugins" would work; both posts are tool posts with more bookmarks than likes.

Timing and verification: dotey's post is within 24 hours; haoge6699's is 24–48 hours old. The directories, licenses, and stars of both repositories have been verified with the GitHub API. The plugins' performance has not been tested; baoyu-design's license shows as NOASSERTION, so check carefully before commercial use.

7. Apple Intelligence in mainland China: November 4 is the developer beta; general availability comes in December with iOS 27.3

Posts and engagement: abskoop on 10-31 at 08:48, 61,271 views, 39 likes, 17 replies; op7418 on 10-31 at 09:54, 10,670 views, 36 replies; tualatrix on 10-31 at 11:54, 20,653 views, 38 likes.

What it says: the Apple China press release was published on 10-31, and the original text says that "starting November 4, it will be available for testing with the latest iOS developer beta, and will launch to users in China with the official release of iOS 27.3 in December." Apple is working with Alibaba, integrating Qwen into parts of Siri, writing tools, and visual intelligence. The first batch supports iPhone 16 and later, the iPhone 15 Pro series, iPhone Air, and others.

Why it's worth covering: some timelines have written "November 4" as the launch date, but ordinary users actually have to wait until December. A quick reference on "when you can use it, which models are supported, and what Qwen handles" would reach a broad audience.

Timing and verification: abskoop's post is just within 24 hours; op7418's and tualatrix's are within 24 hours. The dates, models, and Qwen's role have been checked against the Apple China press release. "Qwen powers all of Apple Intelligence" is inaccurate; the official wording is that it is part of the experience.

8. Alma's relay server is open source: free deployment on Cloudflare Workers, end-to-end encrypted

Posts and engagement: yetone on 11-01 at 02:34, 15,370 views, 290 likes, 302 bookmarks, 19 replies.

What it says: yetone/alma-relay was created on 10-31 under the MIT license and is used to control Alma on your computer remotely: it can be deployed to Cloudflare Workers in one click, and the post says the free tier is enough, or it can run with a single Docker command with automatic HTTPS; the post says it is end-to-end encrypted and the relay only sees ciphertext. In Alma's settings, choose remote access and use your own relay.

Why it's worth covering: remotely controlling a desktop agent from a phone is a hot need right now, and "self-hosted relay, no third-party server" directly addresses privacy concerns. It has more bookmarks than likes, so it suits a tutorial post.

Timing and verification: within 24 hours. The repository and license have been verified. "The free tier is enough" and "end-to-end encrypted" are the author's descriptions; the code has not been audited.

9. Terence Tao: AI makes thinking cheap, just as cheap food means people must exercise on purpose

Posts and engagement: xiaohu on 10-31 at 16:33, 12,916 views, 130 likes, 74 bookmarks, 30 replies, with a video.

What it says: the post relays Tao's analogy: the agricultural revolution made food cheap, and people instead had to actively control their diet and schedule exercise; AI makes mental tasks easier, so the thinking training built into daily life decreases, and people therefore need to actively maintain their problem-solving ability. The video in the post is a clip from another X user.

Why it's worth covering: it complements Orange's piece about "value" by focusing on "ability" at the individual level. It suits a short post or a livestream topic, with one or two concrete practices framed as deliberate practice.

Timing and verification: within 24 hours. The full original video has not been found; when citing it, write "according to the video retelling."

10. One 512GB or two 256GB Mac Studios: the math of running large models locally

Posts and engagement: lxfater on 10-31 at 16:33, 25,906 views, 57 likes, 30 bookmarks, 56 replies, with an image.

What it says: the post says a top-spec China-market M5 Ultra with 512GB of unified memory is 172,999 yuan, while two 256GB units total 173,498 yuan, only 499 yuan more; the two can be linked via Thunderbolt 5 with RDMA tensor parallelism, and the post says effective bandwidth reaches 2.2TB/s, GLM-5.3 goes from 40 tokens per second to 70, and DeepSeek V4.1 Flash from 60 to 100.

Why it's worth covering: replies are close to likes, so the discussion is hot. It can be written as a trade-off between "one machine is simpler, two machines are faster but more fiddly," adding one cost the post doesn't mention: cooling for two machines, interconnect stability, and the maturity of the software stack.

Timing and verification: within 24 hours. The prices and speed figures are the author's claims; Apple's official site and test sources were not checked this round, so verify before citing.

11. Regular App Store updates are reviewed in minutes — has machine review gone live?

Posts and engagement: waylybaye on 10-30 at 14:27, 35,140 views, 85 likes, 20 bookmarks, 47 replies.

What it says: the author, an iOS developer, says regular updates are now basically reviewed within minutes, and connects this to an earlier leak that "the App Store may drop human review in favor of machine review."

Why it's worth covering: independent developers care about this, and the replies contain a lot of first-hand experience. It would work to collect review times from several developers and write an observation on how the experience has changed.

Timing and verification: 24–48 hours. Apple has not publicly said it switched to machine review, and no relevant reporting was found this round, so it can only be written as a developer observation.

12. Grok starts supporting Alipay and UnionPay card payments

Posts and engagement: op7418 on 10-31 at 16:10, 46,056 views, 216 likes, 24 bookmarks, 85 replies, 12 quotes.

What it says: the author says Alipay and UnionPay card options have appeared at Grok's payment entry.

Why it's worth covering: payment barriers for overseas AI subscriptions are a long-standing pain point for Chinese users, and the replies are numerous. It could become a comparison of "which overseas AI products currently accept domestic payment."

Timing and verification: within 24 hours. No official statement from xAI was found; it may be visible only in some regions or to some users, so take your own screenshot to confirm before writing.

13. Tongjiang Lab: 54 high school experiments turned into offline 3D courseware (worth watching)

Posts and engagement: Gorden_Sun on 10-31 at 18:24, 3,891 views, 68 likes, 62 bookmarks, 19 replies, with a video.

What it says: the tongjiang-lab repository turns 54 high school physics, chemistry, biology, and geography experiments into 3D courseware that can be dragged and rotated; the post says it follows the PEP textbooks, and each is a single web file that opens on double-click and works offline.

Why it's worth covering: views are modest, but bookmarks are close to likes, which means parents and teachers will save it. It suits a small collection of "free educational resources in the AI era."

Timing and verification: within 24 hours. The repository was created on 10-28 and had 1,186 stars on the morning of 11-01. The number of courseware items and their correspondence to textbooks are described in the post and have not been checked one by one; whether AI was used to generate them is not stated.

Coverage gaps: this window is 48 hours. Mac Studio pricing, Grok payments, and App Store review have no official sources. Today's English-language topics have not been generated yet, and this has been deduplicated against the previous 3 days' reports and today's X AI daily.