China takes the supercomputer crown without US chips



A supercomputer in Shenzhen just topped the world rankings for the first time since 2017. The headline is the speed. The real story is the silicon: it runs without a single chip from Nvidia, AMD or Intel.

China has taken back the supercomputing crown. On Tuesday, organisers declared a machine called LineShine the world’s fastest at the ISC conference in Hamburg. The result ended a long American run at the top of the closely watched TOP500 list.

LineShine, housed at the National Supercomputing Center in Shenzhen, hit 2.198 exaflops on the standard benchmark. That is more than 20% faster than El Capitan. The US Department of Energy machine had led since November 2024 and helps maintain the American nuclear stockpile.

LineShine is the first Chinese system at number one in nearly a decade.

The speed is striking. The way China got there is the point. LineShine was built entirely without American chips, a direct answer to years of US export controls.

An all-CPU machine, by design

Most top supercomputers lean on graphics processing units, the same Nvidia and AMD chips that power the AI boom. LineShine does not. It is the first system on the list to pass two exaflops of sustained double-precision performance using ordinary processors alone.

The design is ambitious.

The machine packs nearly 14 million computing cores into 90 cabinets, drawing about 42 megawatts of power. At roughly 52 gigaflops per watt, it is unusually efficient for its size. It has already run a full simulation of the Earth’s systems and a model of the human brain, the kind of heavy science it was built for. Its custom LX2 processors use Armv9, the instruction set licensed from Britain’s Arm Holdings.

They run KylinOS, a Chinese version of Linux, with a homegrown network called LingQi tying the whole thing together. Reports link the chip work to Huawei, whose return to the cutting edge has unsettled Washington.

Rather than split the work between CPUs and GPUs, LineShine bakes GPU-style maths into the processors themselves. Jack Dongarra, a TOP500 organiser, inspected the machine and called it impressive. “They upped us by developing a system that is not reliant on GPUs,” he said.

The machine also tops a second ranking that weights real-world workloads, and its designers have entered 14 bids for the Gordon Bell Prize, science computing’s top award. They have not said who made the chips or on what manufacturing process, the detail Washington would most want to know.

A message aimed at Washington

China stopped submitting machines to the TOP500 in 2023, after the US tightened chip-export rules. So choosing to enter LineShine counted as a statement, not a formality. Dongarra was told the system was built without government funding, which is why its designers felt free to enter it.

“I’m not surprised it’s the number one system,” said Addison Snell of Intersect360 Research. “What I’m surprised by is that they submitted it.”

The timing fits a wider pattern. US curbs meant to slow China’s progress have instead accelerated its push for self-sufficiency. The result is a homegrown stack of chips, software and networking that no longer needs American hardware. A machine that needs no Nvidia, AMD or Intel parts is the clearest proof yet that the strategy is working.

It also exposes an awkward gap in the rules. Washington has spent years restricting GPUs, the chips most useful for AI. LineShine relies on CPUs, which face far looser controls.

“The US government should have stronger controls on the export and manufacturing of CPUs for the China market,” said Jimmy Goodrich of the University of California Institute on Global Conflict and Cooperation. “It is a loophole in the current regulations.” That gap echoes the one Washington is already trying to close around overseas subsidiaries.

Fastest computer, not the fastest for AI

Here is the catch. Topping the TOP500 is not the same as winning the AI race, and the two are drifting apart. The list measures high-precision maths, the 64-bit calculations used for climate models and nuclear simulations. Modern AI runs on cruder, faster approximations.

On a benchmark built to mimic AI-style work, LineShine ranked only fourth. On that mixed-precision test it managed 7.92 exaflops, a far smaller jump over its main score than a GPU machine would post. Its all-CPU design lacks the dedicated low-precision circuitry that makes GPUs so quick at training models.

Worse for the bragging rights, the biggest American AI systems do not even enter the contest. The vast clusters run by xAI, Microsoft, Amazon and Google are commercial, not academic, and stay off the list entirely.

“If the hyperscalers submitted their systems, this ‘world’s fastest’ would not crack the top five,” Goodrich said. In other words, the crown is real, but the title is narrower than it sounds.

The case for caution

None of this means China has closed the gap. Its domestic GPU industry still trails Nvidia and AMD by several years, which is exactly why it routed around them with a CPU-only machine. Building a record-setting computer from homegrown parts is a genuine feat of engineering and a powerful political signal. It is not the same as out-computing the United States on the workloads that matter most for AI.

The wider trend is harder to dismiss. Export controls have pushed Chinese firms toward custom chips, domestic operating systems and their own interconnects, the same ingredients on display in Shenzhen. Companies from carmakers to cloud giants are now designing silicon to cut Nvidia out, and even Nvidia is hunting for ways back in with Arm-based CPUs of its own. A policy meant to keep China dependent is teaching it to build alone.

So the open question is not really who owns the fastest computer this month. It is whether a wall of export controls slows China down or simply forces it to build a parallel stack the United States cannot see into or switch off. LineShine suggests the second answer is winning. China assembled the fastest machine on Earth, deliberately, from everything America tried to keep out.



Source link

Leave a Reply

Subscribe to Our Newsletter

Get our latest articles delivered straight to your inbox. No spam, we promise.

Recent Reviews


Ghost CMS flaw abused to push ClickFix attacks on hundreds of sites

Pierluigi Paganini
May 25, 2026

Threat actors are actively exploiting a security flaw, tracked as CVE-2026-26980, in Ghost CMS that was fixed months ago in real attacks against unpatched websites. According to Qianxin, the campaign has already affected more than 700 sites, including well-known organizations and universities.

The vulnerability is an SQL injection issue in Ghost’s Content API that can let an attacker read data from the database without logging in. In the worst case, this can expose the Admin API key, which can allow attackers to take over the site.

That key matters because it can be used to change published content. In this campaign, attackers used it to edit articles on compromised Ghost sites and insert malicious JavaScript at the end of pages. The goal was not just defacement, but to turn trusted websites into launch points for further malware delivery.

“After an in-depth investigation and analysis, we determined that this was not a targeted intrusion against the customer, but rather a large-scale poisoning campaign by an in-the-wild attack group targeting Ghost CMS. Although CVE-2026-26980 was publicly disclosed as early as February 19, a large number of users did not patch and upgrade in time, providing an opportunity for attackers.” reads the advisory published by Qianxin. “At least two groups are currently actively conducting such poisoning operations, and some sites have even become the target of competition between the two parties, with different malicious code being implanted one after another within a single day.”

The inserted code led visitors through a two-step chain. First, the page loaded a remote script that checked the browser and decided what the visitor should see. Then real victims were redirected to a fake verification page that looked like a normal “I’m human” check.

This is where the ClickFix part began. The page told users to press Windows+R, paste a command, and hit Enter. In practice, that command downloaded and started a malware payload on the victim’s machine. It was a classic social engineering trick: make the user do the dangerous part themselves.

Qianxin says the first signs of this activity appeared in early May. The malicious code found in the campaign had a compilation date of February 16, the same day Ghost announced the fix for CVE-2026-26980. That suggests the attackers moved quickly once they saw how many sites had not been updated.

The affected websites cover a wide range of sectors. Roughly half are personal blogs or independent sites, but the list also includes technology blogs, AI sites, media outlets, crypto projects, and educational institutions. Qianxin researchers say victims include sites linked to Harvard, Oxford, and DuckDuckGo.

The attack chain was also designed to be flexible. The loaders could fetch different payloads depending on the target, and the operators changed infrastructure several times.

“entire attack process has obvious five-stage characteristics of “CMS Takeover → Page Poisoning → Two-stage Loading → Social Engineering Lure (FakeCaptcha/ClickFix) → Malware Delivery”, and the entire process is highly automated: bulk vulnerability scanning → automatic key extraction → bulk injection → dynamic C2 distribution.” states the report.

In some cases, they switched domains after detection, keeping the campaign alive even when part of the chain was blocked.

“Through feature scanning of publicly accessible pages, we have cumulatively identified more than 700 poisoned victim domains, and have proactively contacted the sites for which contact information could be obtained, notifying them of the poisoning.” continues the report.

Qianxin also believes at least two different groups are involved. In some cases, the same site was hit more than once, with one attacker replacing the code left by another. That makes the campaign harder to clean up and shows how attractive compromised Ghost sites have become for abuse.

For site owners, the advice is straightforward. Ghost should be updated immediately, all credentials should be rotated, and site logs should be reviewed for suspicious admin API activity. Any injected scripts should be removed from the database itself, not just from the visual editor. Visitors who may have reached a poisoned site should also be warned.

The report includes Indicators of Compromise (IoCs) for the attacks observed by the researchers.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Ghost CMS)







Source link