China-linked hackers deploy StormEncryptor via N-central exploit

---

GKE 1.36 preview ships ClusterNetworkPolicy, enabling non-bypassable cluster-wide network rules. The Kubernetes SIG-Policy API introduces a three-tier hierarchy where admin-tier rules evaluate first, blocking namespace-scoped policy overrides. Platform teams can now enforce compliance mandates like egress blocking or shared service access without relying on namespace-level NetworkPolicy cooperation.

Meanwhile, NVIDIA's Nova Rust driver adds vGPU boot support for Linux 7.3, though it remains pre-production.

In this issue:

• GKE ClusterNetworkPolicy: cluster-scoped Kubernetes network rules
• NVIDIA Nova driver: vGPU boot and GSP firmware consolidation
• Intel Xeon 678X benchmarks: Windows 11 vs Ubuntu 26.04 on Granite Rapids WS
• StormEncryptor ransomware via N-central exploit (China-linked attribution)

---

Insufficient technical detail in source material to produce a Signal Field section. The provided source lacks:

• Specific N-central vulnerability identifier (CVE) or affected versions
• StormEncryptor technical characteristics (encryption method, file markers, IOCs)
• Attack scope data (victim count, industries, geographic distribution)
• Attribution evidence beyond 'China-linked'
• Defensive recommendations or detection guidance

Request: Primary source material with technical specifics—vulnerability details, malware analysis, or vendor advisory—before publication.

---

GKE Ships ClusterNetworkPolicy for Cluster-Wide Kubernetes Network Security

The Signal

GKE 1.36 preview adds ClusterNetworkPolicy, a cluster-scoped API from Kubernetes SIG-Policy for non-bypassable network rules.

What Changed

• ClusterNetworkPolicy operates cluster-wide, unlike namespace-scoped NetworkPolicy resources.
• Three-tier hierarchy: admin tier (highest), network policy tier, baseline tier (lowest precedence).
• Deterministic top-to-bottom evaluation with explicit Pass action for rule delegation.
• Built on upstream `policy.networking.k8s.io` API, implemented via Cilium collaboration.
• Available in GKE 1.36+ preview, managed through standard RBAC controls.

Operational Impact

Platform teams can now enforce global security guardrails that developers cannot override with namespace policies. Admin-tier rules evaluate first, enabling compliance mandates like blocking egress to sensitive namespaces or mandating access to shared services. The Pass action lets security teams inspect traffic centrally, then delegate accept/deny decisions to developer-managed namespace policies. Teams running multi-tenant clusters gain separation between platform security (admin/baseline tiers) and application networking (network policy tier).

Watch For

Monitor migration patterns from legacy NetworkPolicy stacks as this moves toward GA. RBAC configuration for tier access will determine whether this truly separates platform and developer concerns.

---

NVIDIA Nova Rust Driver Gains vGPU Boot and Firmware Format Support for Linux 7.3

The Signal

NVIDIA's Nova driver adds vGPU boot support and consolidated GSP firmware handling for Linux 7.3.

What Changed

• Nova gains vGPU boot support for virtualized GPU workloads.
• TLV firmware image format now supported for GPU System Processor initialization.
• GSP boot process consolidated across NVIDIA architectures.
• Enhanced support for Hopper and Blackwell GPU generations.
• DRM Rust infrastructure expanded with SysMem backend and device lifetime management.

Operational Impact

Teams running GPU workloads in virtualized environments gain a path to vGPU support via open-source drivers. Nova remains pre-production; Nouveau continues as the stable open-source option for NVIDIA GPUs today. The GSP consolidation simplifies firmware management but requires Linux 7.3+ for full functionality.

Watch For

NVIDIA engineers are investing heavily, but no production timeline is public. Track Nova stability reports as it matures toward replacing Nouveau for data center workloads.

---

First Granite Rapids WS Benchmarks: Xeon 678X Windows 11 vs Ubuntu 26.04

The Signal

Phoronix published first public benchmarks of Intel's Xeon 678X (Granite Rapids WS) on Windows 11 and Ubuntu 26.04.

What Changed

• HP Z4 G6i workstation tested with 48-core/96-thread Xeon 678X processor at stock configuration.
• Windows 11 Pro tested with default HP drivers versus Ubuntu 26.04 LTS with Linux 7.0 kernel.
• Test system included 128GB DDR5-6400 memory and NVIDIA RTX PRO 6000 Blackwell graphics.
• Comparison uses out-of-box driver configurations for each OS, no manual optimization.
• Full benchmark results available at https://www.phoronix.net/image.php?id=intel-xeon-678x-windows-linux&image=hp_z4g6i_windows

Operational Impact

Teams evaluating Granite Rapids WS workstations now have baseline performance data for dual-OS deployments. The benchmarks test default driver stacks, showing what performance to expect without tuning. This matters for workstation procurement where OS choice affects rendering, simulation, or compile workloads.

Watch For

Follow-up Linux-specific benchmarks will cover kernel tuning and workload optimization for the Xeon 678X platform.

---

Quick Reads

• GKE — ClusterNetworkPolicy adds cluster-wide network rules that developers cannot bypass with namespace policies.
• NVIDIA Nova — Rust driver gains vGPU boot support and consolidated GSP firmware for Linux 7.3.
• Intel Xeon 678X — First Granite Rapids workstation benchmarks compare Windows 11 versus Ubuntu 26.04 performance.