Mark Gadala-Maria

ONE OF THE MOST IMPORTANT VIDEOS IVE EVER MADE

A full review of the latest AI driven security crisis along with a method on how to do DEFENSIVE testing on your own site(s) before they get hacked.

Chapters:
Chapters: Intro: 0:00
AI Hacking News: 0:50
How To Use It: 6:24
Testing it Out: 11:38

Get your FREE security report: lucidsecurity.si

Links:
Full Workflow Guide: yourunai.com/workflows/deep…
@runpod (affiliate): runpod.io/?ref=xi857jxu @explabsai API:
platform.experientiallabs.ai/models/deepsee…

Everything We Know About The Jensen Huang Chinese Spy Affair Scandal So Far.

→ Nvidia CEO Jensen Huang (63, married 40+ years to college sweetheart Lori, both kids work at the company) just admitted he was unfaithful after reports he had a close/romantic relationship with Alice Huang (aka Huang Le), a Chinese citizen U.S. intel believes was a Ministry of State Security asset tasked with gathering info on advanced AI chips and influencing Nvidia’s China sales push.

→ Alice started as a Chinese state TV reporter (Hunan TV/CCTV) before becoming managing director of Singapore-based Megaspeed, an Nvidia cloud customer that bought ~$4.8 billion in GPUs. Megaspeed (spun from Chinese gaming firm 7Road) has been under Commerce/Justice scrutiny since 2024 for possible chip diversion to China despite export controls; officials found equipment still boxed in Malaysia.

→ U.S. agencies put Alice under electronic surveillance. Communications with an American citizen led to “unmasking” that identified Jensen. A classified memo (overseen by Marco Rubio) circulated among top officials describing the romantic involvement and spy recruitment; Trump was briefed earlier and reportedly took no action.

→ Public heat: June 2024 Computex bar in Taipei where she was with execs and Jensen showed up in the leather jacket for whiskey. May 2025 dinner at a Taipei Chinese restaurant—footage of her kissing his cheek, hand on his waist/back, fingers down his lower back as he talked to reporters, then the two leaving in the same car. Circulating WeChat Moments-style photos of them dining, toasting wine, and more.

→ Jensen first told Bloomberg the interactions were “completely normal and not unusual” business stuff with a big customer. Days after the NYT/FT reporting, he emailed staff: “I was unfaithful to my wife. My actions hurt her and our children. There is no excuse… I am deeply sorry.” He said he’d fully cooperate with the board’s independent investigation into whether he was the target of a foreign intelligence effort.

→ Nvidia board: “no reason to believe” national security or company secrets were compromised, but they’re examining everything. Jensen stays CEO for now. China calls it a smear. Shares dipped. Congress (House China/Foreign Affairs/Intel chairs) already wanted a closed-door briefing on the ties and security protocols. Jensen has been a key Trump interlocutor on easing chip restrictions to China.

🚨 CRITICAL REACT VULNERABILITY: Unauthenticated Remote Code Execution (CVSS 9.5)

A critical security vulnerability has been disclosed in React Server Components, potentially allowing attackers to execute malicious code on vulnerable servers WITHOUT authentication or user interaction.

Tracked as GHSA-xqc2-xf4c-x3h3, the vulnerability received a 9.5/10 CVSS severity score and was published on October 14, 2026.

🔍 HOW DOES IT WORK?

Attackers can exploit the vulnerability using specially crafted payloads targeting frameworks that support React Server Components.

Successful exploitation could allow unauthorized code execution, potentially compromising sensitive data and server integrity.

However, React emphasizes that exploitation requires extremely rare conditions involving multiple typed arrays and an attacker-controlled value in a response. Not every React application is vulnerable.

⚠️ AFFECTED PACKAGES

➡️ react-server-dom-webpack
➡️ react-server-dom-parcel
➡️ react-server-dom-turbopack

Vulnerable Versions:

➡️ 19.0.0 through 19.0.8
➡️ 19.1.0 through 19.1.9
➡️ 19.2.0 through 19.2.8
➡️ 19.3.0

✅ WHAT DEVELOPERS SHOULD DO

➡️ UPDATE IMMEDIATELY: Upgrade to a patched version: 19.0.9, 19.1.10, 19.2.9, or 19.3.1, depending on your release branch.

➡️ AUDIT DEPENDENCIES: Identify applications using vulnerable React Server Components packages.

➡️ REVIEW SERVER-SIDE FRAMEWORKS: Ensure they incorporate the relevant security fixes.

➡️ VERIFY EXPOSURE: Client-only React applications and applications that do not use tooling supporting React Server Components are not affected.

🚨 THE BOTTOM LINE

A CVSS score of 9.5 makes this a serious security issue, even though the specific conditions required for exploitation are uncommon.

Organizations running React Server Components should verify their dependencies and apply the available patches rather than assume their deployments are safe.

🔐 IS YOUR WEBSITE VULNERABLE?

At Lucid Security, we help businesses identify security vulnerabilities, assess their exposure, and address weaknesses before attackers exploit them.

Get a FREE website security assessment:

lucidsecurity.si

Official Security Advisory:
github.com/react/react/se…

This is the ULTIMATE Open Source AI Studio.

Imagination Studio by @SamJWasserman & @u1tra_instinct is a revolutionary new open-source alternative to products like Higgsfield with much less censorship & zero limits.

Chapters:
Chapters: Intro: 0:00
Imagination Studio Walkthrough: 0:39
Installation Guide: 5:07
More Testing: 9:18

Sometimes you find an AI video that just hits different.