Latest / Tech Talks With Kinsoft / Last Week in Tech – China's Open-Source Shock, TSMC's Record Quarter, and a 570-Flaw Patch Tuesday

Transcript

Last Week in Tech – China's Open-Source Shock, TSMC's Record Quarter, and a 570-Flaw Patch Tuesday · Tech Talks With Kinsoft

• 0:00
  So this week, a tech company basically gave away
• 0:03
  a multi -trillion parameter AI model entirely
• 0:07
  for free. Just completely free. Right. And it
• 0:10
  immediately triggered this massive market panic.
• 0:12
  I mean, it wiped billions of dollars off semiconductor
• 0:15
  stocks. It really did. But, you know, here is
• 0:17
  the profound irony of the whole thing. The exact
• 0:20
  same hardware companies that investors thought
• 0:22
  were losing out. They just turned around and
• 0:25
  posted record shattering multibillion dollar
• 0:28
  profits. It's totally wild. It is a complete
• 0:30
  paradox. Like the financial markets are reacting
• 0:33
  to the sudden collapse in the price of software
• 0:35
  while completely misreading the physical reality
• 0:38
  of what it actually takes to power that software.
• 0:40
  Yeah. And that paradox is exactly what we're
• 0:42
  looking at today. Welcome to this deep dive.
• 0:44
  Today, we are taking a massive stack of source
• 0:46
  material, specifically a comprehensive July 2026
• 0:51
  tech industry brief. It's a dense one, too. Oh,
• 0:54
  very dense. And our mission here is to cut through
• 0:57
  the noise of all the AI hype and the cybersecurity
• 0:59
  panic. We want to help you understand the hidden,
• 1:03
  interconnected forces that are actually shaping
• 1:06
  the digital infrastructure that you rely on every
• 1:08
  single day. Exactly. And we're going to do that
• 1:10
  by tracing this really fascinating causal chain.
• 1:13
  We're going to start at the very top layer of...
• 1:16
  the tech world, like the cutting -edge AI models,
• 1:18
  and follow the money. Follow the money and the
• 1:21
  physical hardware supply chains, right? All the
• 1:24
  geopolitical drama, tracing it all the way down
• 1:26
  to the vulnerable legacy servers, just sitting
• 1:28
  in business closets around the world. Okay, let's
• 1:31
  unpack this. We have to start with the software
• 1:32
  layer because it is radically altering the economics
• 1:34
  of artificial intelligence. It's a complete shift.
• 1:37
  So on July 16th, a Beijing -based company called
• 1:40
  Moonshot dropped a new model. It's called Kimi
• 1:43
  K3. The specs on this release are almost hard
• 1:46
  to comprehend. They really are. We are talking
• 1:48
  about 2 .8 trillion parameters and a 1 million
• 1:51
  token context window. What's fascinating here
• 1:54
  is just the sheer scale of engineering required
• 1:56
  to reach 2 .8 trillion parameters. Yeah, it's
• 2:00
  massive. To put that in perspective, I mean,
• 2:01
  just a couple of years ago, a 400 billion pyramidal
• 2:05
  model was considered... absolute frontier tech.
• 2:08
  A model of this new size is likely using a massive
• 2:11
  mixture of experts' architecture. Which basically
• 2:13
  means it doesn't run the whole thing at once,
• 2:15
  right? Right, exactly. It routes your query to
• 2:18
  highly specialized subnetworks rather than firing
• 2:22
  up the entire multi -trillion parameter brain
• 2:24
  all at the same time. That makes sense. And what
• 2:26
  about that one million token context window?
• 2:29
  Oh, that's huge. In practical terms, that means
• 2:32
  like a front end developer can dump their entire
• 2:35
  company's code base plus maybe three distinct
• 2:38
  programming textbooks straight into the prompt.
• 2:41
  Oh, wow. Yeah. And the AI just holds all of it
• 2:43
  in its working memory simultaneously. That is
• 2:45
  massive utility. But here is the real kicker
• 2:48
  for me. It is open weight. Meaning it is entirely
• 2:51
  free to download and run. Exactly. Moonshot has
• 2:55
  made this the largest open source model ever
• 2:57
  released to the public. And they are claiming
• 2:59
  it beats leading U .S. models across a variety
• 3:02
  of benchmarks. Which is a bold claim. It is.
• 3:04
  And, you know, I always look at vendor supplied
• 3:06
  benchmarks with a critical eye. But wait, the
• 3:09
  briefing notes that in blind independent testing,
• 3:12
  developers actually preferred Kimi K3 for front
• 3:15
  end coding tasks. Yeah, they really did. utility
• 3:18
  is undeniably real. It is very real. And the
• 3:21
  financial markets recognized it instantly, but
• 3:24
  they didn't celebrate it. They panicked. Big
• 3:26
  time. The source material compared the market
• 3:29
  reaction to the deep seat panic we saw back in
• 3:31
  early 2025. The major semiconductor index dropped
• 3:35
  over 4 percent. Ouch. Yeah. And giants like NVIDIA
• 3:39
  and Micron lost serious ground on paper. But
• 3:42
  hold on. This is the part that doesn't make sense
• 3:43
  on the surface to me. If an incredibly powerful
• 3:46
  model is now free to download, wouldn't tens
• 3:48
  of thousands of companies rush to download it?
• 3:51
  You would think so. Right. And wouldn't they
• 3:53
  need to buy more NVIDIA chips and memory to actually
• 3:56
  run a 2 .8 trillion parameter behemoth on their
• 4:00
  own servers? So why did the chip stocks drop?
• 4:03
  Well, it's because the market is terrified of
• 4:05
  software commoditization. Okay. Unpack that a
• 4:08
  bit. Sure. So if frontier level AI capabilities
• 4:10
  are suddenly just free, the massive profit margins
• 4:14
  of enterprise software companies start to look
• 4:16
  very fragile. And those companies currently buying
• 4:19
  the bulk of these GPUs. Exactly. Investors fear
• 4:22
  that if the software layer can't maintain high
• 4:25
  prices, their capital expenditure budgets for
• 4:28
  buying hardware will eventually dry up. Oh, I
• 4:30
  see. It's a psychological reaction to the cost
• 4:33
  floor of AI just violently collapsing. But giving
• 4:36
  away an AI model of this size isn't purely altruistic,
• 4:39
  right? There has to be a catch. Oh, absolutely.
• 4:41
  The catch here is data governance. Right. So
• 4:43
  if you're listening to this and you run a U .S.
• 4:45
  financial firm or maybe a health care provider,
• 4:47
  You can't just casually spin up a Chinese origin
• 4:50
  open weight model on your network without setting
• 4:52
  off massive compliance alarms. Not at all. And
• 4:55
  looking purely at the enterprise mechanics here
• 4:57
  and setting aside the intense political debate
• 5:00
  around the U .S.-China tech race, which I want
• 5:03
  to be clear, we are remaining entirely impartial
• 5:06
  on the data provenance and regulatory obligations
• 5:08
  of running these models, are just an absolute
• 5:11
  minefield. Exactly. We are just impartially porting
• 5:14
  the geopolitical context from the source material
• 5:16
  here. The fact is being free to download does
• 5:19
  not mean it is free of legal or regulatory friction.
• 5:22
  Which perfectly explains. why that initial stock
• 5:25
  market panic over the hardware companies was
• 5:28
  entirely disconnected from physical reality.
• 5:30
  Like, Kimi K3 tanked chip stocks on paper because
• 5:34
  the software became free. But when you look at
• 5:36
  the physical ground the company is actually manufacturing
• 5:38
  the silicon, the dynamic is the exact opposite.
• 5:41
  If we connect this to the bigger picture, the
• 5:43
  software getting cheaper is actually making the
• 5:46
  hardware infinitely more lucrative. How so? Because
• 5:49
  no matter how free the weights are, you cannot
• 5:51
  execute code on thin air. You need the chips.
• 5:54
  The numbers are just staggering. On July 15th,
• 5:57
  ASML beat their expectations and raised their
• 6:00
  AI demand outlook. And the very next day, TSMC
• 6:03
  reported their fifth consecutive record quarterly
• 6:06
  profit. We're talking $40 billion in revenue,
• 6:11
  with net income up 77 % year over year. And here's
• 6:15
  the metric that should make everyone listening
• 6:17
  sit up and take notice. Two -thirds of TSMC's
• 6:20
  revenue is now coming from high -performance
• 6:22
  computing. That's AI, right? Mostly, yes. For
• 6:25
  a decade, smartphones drove TSMC's profits. That
• 6:29
  era is officially over. The pivot to AI hardware
• 6:32
  is absolute. Plus, they announced another $100
• 6:34
  billion in capital investment for their Arizona
• 6:37
  facilities. Which pushes their total committed
• 6:39
  U .S. spending to $265 billion. It's like the
• 6:43
  ultimate goal. Gold Rush. Moonshot is giving
• 6:45
  away the gold maps for free, but TSMC and ASML
• 6:48
  are the ones making billions selling the shovels.
• 6:51
  That's a perfect way to put it. So if you are
• 6:52
  sitting in a boardroom right now managing an
• 6:54
  IT budget, mapping out your server storage or
• 6:57
  memory needs for the next two years, the takeaway
• 6:59
  is pretty stark. What's the takeaway? You are
• 7:01
  directly competing with AI hyperscalers for the
• 7:04
  exact same advanced silicon wafers. Oh, wow.
• 7:07
  That is the crucial point here. The physical
• 7:09
  supply chain dictates your everyday IT budget.
• 7:13
  A $100 billion fab plant takes years to build.
• 7:17
  Yeah, you can't just spin that up overnight.
• 7:19
  Exactly. The demand is here today, but the supply
• 7:22
  won't catch up for a very long time. You basically
• 7:25
  have to assume a massive, sustained squeeze on
• 7:28
  supply and prices. So plan refresh cycles early.
• 7:31
  Very early. You need to plan them much earlier
• 7:34
  than you traditionally would because the hardware
• 7:36
  is heavily constrained. But even if you had the
• 7:38
  budget, you... can't just buy these chips freely,
• 7:40
  right? The geography of compute is totally locked
• 7:42
  down. It is. We are seeing a massive geopolitical
• 7:45
  game of musical chairs dictating global GPU distribution.
• 7:50
  Yeah, the supply is tightly controlled by export
• 7:52
  restrictions. Like on July 14th, a U .S. commerce
• 7:55
  official testified that the first batch of NVIDIA's
• 7:58
  highly coveted H200 chips are finally shipping
• 8:01
  to China under a new licensing regime. Right,
• 8:03
  but it's just a trickle. Just a trickle. Reuters
• 8:06
  reported that more Chinese firms, including including
• 8:08
  a unit of ZTE, were approved as buyers. But the
• 8:11
  mechanics of this are so fascinating. Oh, totally.
• 8:14
  Because on the exact same day that news came
• 8:16
  out, NVIDIA internally purged over half of its
• 8:20
  authorized Asian customers from a whitelist.
• 8:22
  Yeah, they are trying to stop this massive gray
• 8:25
  market where chips are bought in one country
• 8:28
  and then secretly diverted through third -party
• 8:31
  routes. It's such a strange dance. It's like
• 8:33
  opening the front door a tiny crack while simultaneously
• 8:35
  building half the side windows shut. That is
• 8:38
  exactly what it's like. And just to maintain
• 8:40
  our framework here, we are neutrally reporting
• 8:43
  the actions of the U .S. Commerce Department,
• 8:46
  NVIDIA and the subsequent supply chain friction.
• 8:49
  Right. We aren't taking any stance on the validity
• 8:51
  or the. Politics of the export controls themselves.
• 8:54
  Exactly. But we do need to talk about the impact
• 8:56
  because the administrative burden this places
• 8:58
  on hardware distribution is immense. It really
• 9:01
  is. And that friction isn't just high -level
• 9:03
  international politics. It directly impacts the
• 9:06
  listener. How does it hit the day -to -day IT
• 9:08
  teams? Well, this geopolitical turn dictates
• 9:11
  where the world's GPUs end up. If your company
• 9:14
  is trying to spin up a new application and you're
• 9:17
  waiting, you know, six months for cloud compute
• 9:19
  capacity. Which happens a lot right now. All
• 9:22
  the time. Or if your vendor keeps inexplicably
• 9:25
  pushing back their AI roadmap, this export control
• 9:29
  tug of war is a massive underlying reason for
• 9:32
  that. It creates total scarcity in the cloud.
• 9:35
  And that extreme compute scarcity is forcing
• 9:37
  fierce corporate. rivals into these almost surreal
• 9:40
  arrangements. The briefing highlights a major
• 9:43
  single -source press report. This was relayed
• 9:45
  by The Times, Reuters, and CNN, claiming that
• 9:48
  Meta is considering leasing its own compute power
• 9:51
  to Anthropic. The maker of the Claude AI models.
• 9:54
  Right. And the deal is rumored to be worth up
• 9:56
  to $10 billion over two years. Now, I have to
• 9:59
  put a massive asterisk on this. Please do. We
• 10:01
  have to be clear. Nothing is agreed upon. They
• 10:03
  could walk away tomorrow. This is just a rumor.
• 10:05
  Right. Just a rumor for now. But just the logic
• 10:07
  of it is... I mean, Meta is spending well over
• 10:10
  $100 billion on AI infrastructure this year alone
• 10:13
  just to win the AI race. Why on earth would a
• 10:17
  giant like Meta lease its precious, hard -fought
• 10:21
  compute to a direct rival like Anthropic? It
• 10:24
  comes down to the economics of what we call compute
• 10:27
  landlords. A few landlords. Yeah. Meta might
• 10:29
  be realizing that the raw infrastructure they've
• 10:32
  built is actually more valuable than the software
• 10:34
  running on it. Okay, wait, explain that. Well,
• 10:36
  building a massive GPU cluster isn't just about
• 10:39
  buying 100 ,000 chips. It's about the incredibly
• 10:42
  complex InfiniBand networking and the power infrastructure
• 10:45
  required to make them talk to each other without
• 10:47
  idle time. So it's not just renting out a spare
• 10:50
  bedroom. It's an entirely different business
• 10:52
  model. Exactly. It's almost like Meta built a
• 10:54
  massive solar farm for their own headquarters,
• 10:56
  realized they generated more power than they
• 10:58
  could use 2047 during their training runs, and
• 11:01
  decided to become the local utility company for
• 11:04
  their biggest rival. That's spot on. Renting
• 11:06
  out excess capacity at a premium guarantees billions
• 11:10
  in high margin revenue. It basically insulates
• 11:12
  them, even if their own AI software models face
• 11:15
  setbacks. Which is a smart hedge. Very smart.
• 11:18
  If Meta is transitioning from just being an AI
• 11:21
  builder to becoming an AI landlord, it tells
• 11:24
  you everything you need to know about the market
• 11:26
  right now. And for the rest of us. For the rest
• 11:27
  of us, it means when giants fight over capacity
• 11:30
  to this degree, we just have to accept that AI
• 11:34
  compute will stay. Okay, so we've spent the first
• 11:39
  half of this deep dive talking about the cutting
• 11:41
  edge. It's the fun stuff. Yeah, trillion parameter
• 11:44
  open models, multi -billion dollar chip fabs,
• 11:47
  massive compute landlords. But what is all of
• 11:51
  this corporate data actually sitting on? What
• 11:53
  is the actual physical foundation supporting
• 11:56
  this frantic digital economy? It is legacy infrastructure.
• 12:00
  And that foundation is severely cracking. It
• 12:02
  is crumbling. Here's where it gets really interesting.
• 12:04
  Because on July 14th, Microsoft shipped its biggest
• 12:08
  patch Tuesday ever. That was huge. We are talking
• 12:10
  about 570 vulnerabilities fixed in a single day.
• 12:14
  Just a staggering number. And 59 of them were
• 12:16
  rated critical. Two were zero days already being
• 12:19
  actively exploited in the wild. One gave attackers
• 12:22
  administrative privileges through Active Directory
• 12:24
  Federation services, but the absolute top priority
• 12:27
  was a separate flaw in SharePoint server. Yes,
• 12:30
  cataloged as CVE -2026 -58644. A mouthful. It
• 12:36
  is, but it scores a 9 .8 out of 10 on the severity
• 12:39
  scale. Let's break down the mechanics of why
• 12:41
  a 9 .8 is so catastrophic. Because this specific
• 12:45
  vulnerability allows an attacker to execute malicious
• 12:48
  code on an unpatched on -premises SharePoint
• 12:50
  server with no login required. Right. Zero authentication.
• 12:54
  From a network security perspective, a pre -authentication
• 12:57
  remote code execution or RCE is the ultimate
• 13:00
  nightmare. So wait, the attacker doesn't even
• 13:02
  need a stolen password. Nope. They don't need
• 13:04
  to trick an employee with a phishing email to
• 13:05
  bypass multi -factor authentication. No, they
• 13:08
  don't need any of that. Because of how the server
• 13:11
  parses incoming network requests before it even
• 13:14
  checks who the user is, the attacker just sends
• 13:17
  a specifically cracked packet to the server's
• 13:20
  public -facing door. And then what? And then
• 13:22
  they are instantly executing code at the system
• 13:25
  level. That is deeply unsettling. You are completely
• 13:28
  exposed just by being plugged into the Internet.
• 13:31
  Exactly. And because this was a zero day, attackers
• 13:34
  were exploiting it before Microsoft even had
• 13:36
  a patch ready. Yeah, they were breaking in, stealing
• 13:39
  server machine keys and planting malware to establish
• 13:42
  persistence. Which is why CISA. The U .S. cyber
• 13:45
  agency added this to their known exploited list
• 13:48
  on July 16th and gave federal agencies an unusually
• 13:51
  brutal deadline to patch it. Just three days.
• 13:54
  Three days and federal IT is light speed. It
• 13:56
  really is. So for you listening, here's the immediate
• 13:58
  takeaway. If your company's SharePoint lives
• 14:01
  in the cloud on Microsoft 365, you are immune
• 14:04
  to this specific flaw. That's the good news.
• 14:07
  But if you run an on -premises SharePoint server.
• 14:09
  specifically the 2016 -2019 or subscription editions,
• 14:13
  you have to patch immediately. And we must stress
• 14:16
  the difference here between merely patching and
• 14:18
  actively hunting for a pre -existing compromise.
• 14:22
  What's the difference? Well, because attackers
• 14:24
  were already exploiting this in the wild. Applying
• 14:27
  the patch today just locks the window they used
• 14:29
  to get in. But they might already be inside.
• 14:31
  Exactly. If they compromised you yesterday, they
• 14:34
  are already sitting in your living room. You
• 14:36
  have to explicitly hunt through your system logs
• 14:39
  for signs of stolen machine keys or existing
• 14:41
  compromise. Okay, but let's play this out. Let's
• 14:44
  say a business misses that brutal three -day
• 14:46
  deadline. They don't hunt for the compromise.
• 14:49
  What happens? Invariably, the ransomware gangs
• 14:52
  get in. They encrypt the data, steal a copy,
• 14:55
  and demand a massive payout. Right. But the entire
• 14:58
  endgame of how a business handles ransomware
• 15:01
  fundamentally shifted this week. Yes. On July
• 15:04
  13th, the U .S., the EU, and the U .K. launched
• 15:07
  a massive coordinated cyber sanctions package.
• 15:10
  But they didn't just target a few random affiliates
• 15:12
  like they usually do. No, they targeted the structural
• 15:14
  plumbing of the Russian ransomware ecosystem.
• 15:17
  They went after the administrator of the TrickBot
• 15:19
  and Conti operations. A single individual who
• 15:22
  allegedly received over $300 million personally.
• 15:26
  Wild. They also sanctioned a bulletproof hosting
• 15:30
  provider called MediaLand that sheltered gangs
• 15:33
  like LockBit for a decade. They targeted specialized
• 15:37
  password -stealing crews and the VPN encryption
• 15:39
  services these criminals use to hide their tracks.
• 15:42
  They are basically mapping out the specialized
• 15:44
  supply chain of cybercrime, initial access brokers,
• 15:47
  negotiators, hosting providers. It's a huge shift
• 15:51
  in tactics by law enforcement. They aren't just
• 15:53
  trying to catch the burglars anymore. They are
• 15:55
  bulldozing the burglars' safe houses and freezing
• 15:57
  their bank accounts. By attacking the infrastructure,
• 16:00
  yes. But this raises an important question. What
• 16:03
  would your organization actually do tomorrow
• 16:05
  if you were hit? Because these new sanctions
• 16:07
  make paying a ransom legally radioactive, right?
• 16:10
  Yes. This is the crucial danger for the listener
• 16:12
  here. If your company gets locked up and your
• 16:15
  executives decide to quietly pay the ransom just
• 16:17
  to get your business operational again, you are
• 16:20
  stepping into a legal minefield. Because of OFAC.
• 16:22
  Exactly. OFAC, the U .S. Sanctions Enforcement
• 16:25
  Agency, operates on strict liability. Meaning
• 16:28
  what exactly? Meaning it does not matter if you
• 16:31
  didn't know the hacker was sanctioned. If your
• 16:33
  ransom payment ends up in the crypto wallet of
• 16:36
  a sanctioned entity, which is highly likely now
• 16:39
  that they've sanctioned all the core infrastructure
• 16:40
  providers, your organization could be breaking
• 16:44
  the law. You could face catastrophic fines or
• 16:48
  federal prosecution simply for trying to buy
• 16:51
  your own data back. Yes. The safety net of just
• 16:54
  paying the ransom and calling it a cost of doing
• 16:56
  business is entirely gone. So you can't pay them,
• 16:59
  but you can't survive without your data. What
• 17:01
  is the actual solution? The only solution is
• 17:03
  the unglamorous, boring IT work. It is having
• 17:07
  tested backups. Heavily tested offline backups.
• 17:09
  Yes. Physically isolated from your main network.
• 17:12
  And it requires a rehearsed incident response
• 17:14
  plan. You need a pre -agreed decision framework
• 17:17
  so your board of directors isn't trying to decipher
• 17:19
  international sanctions law while staring down
• 17:22
  a 48 -hour countdown timer. That makes a lot
• 17:25
  of sense. So what does this all mean? It's a
• 17:27
  lot to take in. It is. When you step back and
• 17:30
  look at the whole board, we're basically watching
• 17:32
  a massive collision. We have the plunging cost
• 17:35
  of AI software models like Kimi K3 crashing headfirst
• 17:39
  into severe geopolitical hardware bottlenecks.
• 17:42
  Driven by export controls and immense silicon
• 17:44
  demand at TSMC. Exactly. And that collision is
• 17:48
  creating this frantic digital economy built on
• 17:51
  top of incredibly vulnerable, heavily targeted
• 17:55
  legacy servers. It creates a really striking
• 17:57
  reality when you think about it. If the actual
• 17:59
  software and AI models are trending toward being
• 18:02
  entirely free and open, but the physical chips
• 18:05
  and the security infrastructure to protect your
• 18:07
  data are becoming impossibly expensive and legally
• 18:09
  fraught, are we entering an era where the true
• 18:11
  currency of the tech world is no longer code?
• 18:14
  Wait, if it's not code, what is it? It might
• 18:16
  be pure physical infrastructure and cyber fortresses,
• 18:18
  the hardware and the walls protecting it. Wow,
• 18:21
  that is a brilliant thought to leave on. The
• 18:24
  code might be free. But the concrete foundation
• 18:26
  costs billions and is under constant attack.
• 18:29
  Thank you for joining us for this deep dive.
• 18:31
  As you go about your week, remember to look past
• 18:33
  the shiny AI headlines. Check your patches, test
• 18:36
  your backups, and stay curious. We'll catch you
• 18:38
  next time.