Covers AI application security, model risk, and agentic system abuse.
Lumen says PoeLLM decodes its C2 address from a GitHub poem, then exploits exposed LiteLLM, Ollama, Gotenberg and Gitea servers to run XMRig and Iron miners.
· 3 min
Nanbeige's new 33B open model leads Qwen3.8-27B on terminal and agent tasks in vendor-run tests, loses SWE-Bench Pro, and needs care to fit 16-32 GB.
· 5 min
Sage-A1.5 fits a 24 GB card at 21.7 GB; Ornith-1.5-122B's smallest quant is 40.4 GB. The cards' 17-point SWE-bench Pro gap is a size mix-up.
· 5 min
Recursive Flint is a 39.8B Apache coding MoE with 2.5B active. Here is which GGUF quant fits 16, 24 and 128 GB, and why its benchmarks need a second look.
· 7 min
llama-server now speaks OpenAI-style realtime transcription and text-to-speech. Here is how to run it with Voxtral Mini 4B, and what isn't ready yet.
· 3 min
Five new CVEs in the official MCP TypeScript SDK leak messages across clients and expose tasks. Upgrade to 1.32.0 or 2.3.0, then change two settings.
· 5 min
SGLang's ZMQ decoder still unpickles attacker data with pickle IPC disabled. Multi-node DP-attention clusters are open to unauthenticated RCE; no fix yet.
· 3 min
Bolt's 24 GB is its 2-bit weights; budget 32 GB+ for real context. Super VL is a DGX Spark model with no published memory figure. What each needs.
· 6 min