SpaceX Seals Forty Billion GPU Lease, Authenticator Flaw Patched

Full transcript

Alex: Good morning, and welcome to Daily Tech News. It is Tuesday, October twenty-seventh, twenty twenty-six, and I am Alex.

Jordan: And I am Jordan. We have a packed show today, starting with the biggest money story in A I right now, because yesterday's rumor became today's paperwork.

Alex: That is right. SpaceX has now put its forty billion dollar A I chip deal in writing. On Monday, the company filed with the U S Securities and Exchange Commission, saying it signed a binding commitment letter on Saturday with an entity managed by Apollo Global Management. Apollo will buy the chips and related data center equipment, then lease them to SpaceX.

Jordan: And this is the part that changed since the weekend. Elon Musk posted on Sunday that the forty billion dollars in debt financing was closed. The filing is more careful. It says the deal is expected to close before the end of the year, subject to closing conditions, with leases starting in the first half of twenty twenty-seven as the chips arrive.

Alex: The hardware itself is the headline for chip watchers. The equipment will include Nvidia's next generation Vera Rubin chips, for what SpaceX calls its terrestrial compute buildout, meaning data centers on the ground. Apollo and Goldman Sachs are leading the lender group, with Goldman Sachs as the sole structuring agent, and funds managed by BlackRock and K K R also making anchor commitments.

Jordan: The structure matters here, because it tells you how the A I boom is actually being paid for. Each batch of chips gets its own lease of about five to five and a quarter years. SpaceX pays rent every quarter, in advance, roughly one twentieth of that batch's cost plus interest. By the end of each lease, SpaceX will have paid off the equipment's cost, with total principal payments expected to be about forty billion dollars. SpaceX calls it the largest committed G P U financing to date.

Alex: And the scale is staggering. One analyst report says SpaceX wanted thirty thousand of Nvidia's Vera Rubin N V L seventy-two rack systems, but is being allocated twenty thousand, which would still make it the biggest buyer of those systems in twenty twenty-seven, roughly one third of expected demand for the year. Taiwan's Foxconn reportedly secured as much as forty five percent of SpaceX's data center assembly orders.

Jordan: Which brings us to the debate splitting the industry. Musk warned over the weekend that more than two hundred smaller cloud providers, the so-called neoclouds, face what he called guppy level death and consolidation, because lenders have shut off debt for firms without revenue beyond A I data centers. Nvidia chief executive Jensen Huang pushed back at a developer conference last week, saying demand for new cloud providers exceeded expectations and that funding shortages would be resolved.

Alex: And the bankers are siding, at least partly, with Huang. J P Morgan said market consensus holds that the big hyperscale data center operators remain healthy, that A I debt markets have become more selective but show little concern about a broader financing crisis, and that smaller providers still show positive returns on investment. So the split is really between the giants who can borrow and everyone else who cannot.

Jordan: It is not just an American story, either. Over in South Korea, Naver has completed a nine billion dollar computing infrastructure deal with Brookfield, the asset manager, which clears the way for Nvidia to invest about one billion dollars in Naver. Brookfield will set up a special purpose vehicle to build up to nine billion dollars in computing infrastructure by twenty twenty-eight, and Naver Cloud will use it to offer A I data center services to customers. Nvidia will supply G P Us and collaborate on a next generation infrastructure platform.

Alex: Let us switch to security, because a story published today is a good reminder to update an app most of us use every day. Researchers at Enclave found a serious flaw in Microsoft Authenticator for Android. A malicious app on the phone could silently steal tokens that let it read and send email from the victim's mailbox, read and change their files, calendar, and SharePoint sites, send Teams messages as them, and even pretend to be Authenticator itself to change sign in methods, including creating and deleting passkeys.

Jordan: The scary part is the silence. No prompt, no warning, nothing to see. The attacker still needs to trick you into installing a malicious app first. But once that app was on the device, the theft was silent, and an attacker who added their own passkey could keep getting in even after you removed the malicious app.

Alex: The good news is that it is fixed. Microsoft confirmed the flaw and released a fix in September, rated at a severity score of eight point six out of ten. So the action item is simple. Open the Google Play Store, update Microsoft Authenticator to the latest version, and if you manage company devices, make sure your device management enforces that minimum version. And as always, be careful about sideloading apps from outside trusted stores.

Jordan: Now to Apple, which had a busy start to the week. Apple released security patches on Monday addressing three hundred and four vulnerabilities across i O S, iPad O S, mac O S, tv O S, watch O S, and Safari. The update includes fixes for a previously exploited CoreGraphics vulnerability, unauthorized camera access by malicious apps, and local attacks on the Keychain, plus privilege escalation, memory corruption, and bypasses of Gatekeeper and privacy controls. No new vulnerabilities in this batch are reported as already exploited in the wild, but with three hundred and four fixes, this is an update you should not put off.

Alex: And Apple also rolled out i O S twenty seven point two, with new Siri A I features, contextual suggestions in Messages that were first previewed at W W D C twenty twenty-six, support for editing captions and comments, and expanded SynthID support in Photos and Image Playground so you can identify images generated or modified with Apple Intelligence tools. The foldable iPhone Duo gets Apple Pencil support and Edge Light for video calls.

Jordan: Time for quick hits. First, a strange crime wave. Thefts targeting high priced equipment used to build A I data centers in the United States have passed one hundred million dollars in verified losses since June. Cargo security firm Verisk CargoNet says trailers carrying data center gear have disappeared during transport, and criminals are using phishing and impersonation to get shipping schedules and take control of shipments.

Alex: Second, researchers have demonstrated an attack called PhantomTac that tricks robots. Small magnetic tags, about half a millimeter thick and concealable under barcode or Q R code stickers, fool a robot's magnetic touch sensors into misreading contact force. In grasping tests the attack succeeded more than ninety five percent of the time when the tag was within eight millimeters of the intended placement, causing a robotic arm to drop or crush objects. This is lab research, not an incident involving deployed robots, but it is a reminder that physical sensors are an attack surface too.

Jordan: And finally, the Federal Communications Commission has begun blocking gadgets containing surveillance chips, the first time it has enforced that power. It blocked two gadgets containing a chip from HiVision, a subsidiary of Huawei, which sits on the commission's national security threat list.

Alex: That is the show for today. The A I buildout is now a financing story as much as a technology story, and today's security stories are a reminder that everyday apps deserve the same attention as data centers. We will be back tomorrow.

Jordan: Thanks for listening, and we will see you then.