The Defender's Window

The mechanism is a dangling pointer created by a fatal error. When an allocation exceeds memory_limit — or any fatal interrupts native code before cleanup completes — PHP may leave request state pointing at memory that shutdown subsequently frees. The researchers found two OOM/memory-limit fatal producers and three interruptible points that together yield memory leak and then code execution, with different exploitation paths for mod_php and PHP-FPM. Two routes to the fatal are documented: (1) bypass post_max_size — PHP compares it against the declared Content-Length, not the bytes actually consumed, so chunked HTTP/1.1 or lengthless HTTP/2 multipart requests slip past, as does an input-decompression filter that creates the same declared-vs-decoded mismatch; (2) exhaust memory_limit below post_max_size — an RFC1867 upload part with filename="" carries no file data and does not count against max_file_uploads, yet PHP still creates all six $_FILES entries, and a nested field name (files[a][b][c]...) makes it create that hierarchy six times over. Hundreds of empty records occupy more than the default 128 MiB heap while the body stays under the default 8 MiB limit. Nothing in the request looks anomalous.

Confirmed pre-auth RCE against WordPress 7.1.2, Drupal 11.4.3, Joomla 6.1.4, MediaWiki 1.46.2, Roundcube 1.7.4, Magento 2.4.9, phpMyAdmin 5.2.3, Nextcloud 35.0.1, Laravel 13.11, Symfony 8.1 and WHMCS, plus “arbitrary PHP scripts in some instances.” Demo videos exist for both the mod_php path and Nginx + PHP-FPM. Impacts all PHP from 5.4.0 — a fourteen-year version floor, which is the entire installed base that still runs.

The lineage is documented and damning: 2004 — Stefan Esser unearths the first PHP memory-limit remote vulnerability; the exploit is never publicly released (CORE and Immunity build private ones). 2020 — bug #78876, long variables in multipart/form-data cause OOM and temp files are not cleaned up; not much is made of it. 2024 — the OSTIF & Quarkslab audit rediscovers the same OOM issue but exploitation was not proven, so it was not fixed (git tag security-audit-2024). 2026 — one agent-assisted research pass finds multiple independent paths to RCE.

Top-voted comments are not analysis of the vulnerability; they are operational improvisation. One commenter: “While I have been chasing around today trying to resolve this on different servers, it turns out a three line nginx mitigation [posted here] ... thank goodness for HN.” The mitigation thread grew faster than the vendor guidance. Meanwhile the day’s second-most-upvoted theme was process collapse: “Calif saw the leaks, interpreted that as embargo being broken, and [published]” and “Chainguard unilaterally broke the embargo and published built images ... Won’t be the last time. If there is no consequence of breaking the rules, people will keep doing it.”

OpenAI states that one critical flaw was found by Calif using GPT-5.6 Sol under the Patch the Planet initiative, while Wiz independently discovered and reported both. Its claim: “to our knowledge, frontier AI found these vulnerabilities before attackers did, opening a Defender’s Window for maintainers and security providers to prepare fixes.” It commits $1B in subsidised Daybreak access through Daybreak for Frontline Defenders, publishes a five-stage response framework (validate/fix upstream → give affected orgs time → coordinate with government → prepare updates across products → publish guidance), and engages the White House Super Intelligence Force, ONCD, CISA and international partners.

Three objections dominated, and each is analytically load-bearing rather than reflexive. (1) Capability inflation: “It seems like OpenAI are trying to frame this as if AI did all the work here, but it’s not really true given what Calif say: no special harness, or access to models that weren’t generally available to everyone were used.” (2) Externality: “We created this problem, and it will hurt all of you whether you use it or not. The good thing is there is a solution: if you pay us a lot of money we can try to fix it.” (3) Backport asymmetry: the framework assumes downstream maintainers can absorb fixes the upstream project no longer supports.

The sequence, from participants’ own accounts: a leak and pre-announcement around 20:00 UTC; a security firm that had reported the issues mistakenly published a video, having read the leak as an embargo break; Chainguard published built images ahead of schedule. OpenAI’s own framework anticipates this — it lists “active exploitation in the wild, a leak, a revealing public patch” as timeline-reassessment triggers — but a trigger without a single arbiter produces everyone reassessing independently and arriving at different answers.

CVE-2026-110264, CVSS 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H): an unauthenticated user could execute arbitrary code on the GitLab server via an integer overflow when compiling a specially crafted regular expression. It affects every version from 7.0 forward — backported to 18.11.13, 19.0.10, 19.1.9, 19.2.9 plus five more lines. The fix is a Ruby regexp repeat-ID overflow patch for Ruby 3.3, 3.4 and 4.0 — i.e. the vulnerability is in the runtime, not the application. Reported by joaxcar via HackerOne. The most-upvoted HN reaction is the correct one: “it’s a little bit frightening that this severe of a bug isn’t the biggest security vulnerability of today.”

Yesterday this briefing reported the advisory. Today it is a demonstrated break. Scott Helme signed a certificate for api.stripe.com chaining to EM DV TLS CA - G3B and served it from localhost. With default settings: curl printed SSL certificate verify ok; Python completed the handshake; Node reported authorized: true; Windows CryptoAPI accepted the chain unless revocation checking was enabled — and even then only one of two validation routes returned revoked. The eight recovered private keys are single significant bytes: d = 4, 56, 66, 115, 155, 156, 230, 237. On the P-384 curve, recovering d from the public key should require searching 2³⁸⁴ ≈ 10¹¹. With one significant byte it requires at most 255 scalar multiplications: compute 1·G, 2·G, 3·G… and stop. All eight keys were recovered from public certificates on a laptop in under a second, out of the box, using google/paranoid_crypto.

This is the sentence that should be quoted in every security architecture review this quarter: “The only way to find out is to try.” A public key derived from d = 4 encodes correctly, sits on the correct curve, and passes every structural validator in every library. The defect is not malformed data — it is insufficient entropy inside well-formed data, which means signature verification, chain building, OCSP and CT all behave perfectly normally while the security property they are meant to establish is already gone.

Updated mainstream browsers block the intermediates directly and require Certificate Transparency, so they are likely fine. The exposed set is everything with a CA bundle on disk that does not check revocation and does not check CT — and revocation by eMudhra or Sectigo does not help those clients at all. Helme’s categories: (1) curl | sh installers and self-updaters — rustup, nvm, the Homebrew installer, any install.sh page, IoT firmware updaters — where a forged certificate means running attacker code, often as root; (2) CI/CD pipelines — GitHub and GitLab runners, Jenkins, build containers holding cloud keys, registry tokens and signing keys; (3) server-to-server calls — payment providers, webhooks, OAuth token exchange, AWS CLI/boto via certifi, Terraform and kubectl via Go’s store; (4) IoT, embedded and OT — cameras, routers, cars, medical devices, payment terminals, industrial controllers, with bundles frozen until 2039; (5) Windows code signing, where the CS root is trusted directly so malware signed with these CAs looks legitimate to anything not checking revocation. Critical caveat from the writeup: CT detects mis-issuance, it does not prevent it — and much software does not check CT at all.

The New Mexico Department of Justice announced it secured a $25B penalty against Meta for deceiving users about privacy on Facebook. The top comments split exactly as you would predict and exactly as they should: “as long as the punishments are not equal to the revenues generated by those illegal methods, big corporations will never stop ... to them those fines are just the cost of doing business”, answered by “12% of annual revenue (~200M for 2025). Not a small amount.” Those two numbers cannot both describe the same penalty — note the discrepancy rather than resolving it in the company’s favour or the state’s.

All seven wheels of LiteLLM 1.107.0 — Linux, macOS, Windows — installed three files into site-packages, and two of them load every time Python starts: cook.pth (12 bytes, containing import cook) which imports a 22,252-byte credential stealer; and sitecustomize.py (25,509 bytes), a loader that launches a background daemon which every hour reads a server address from a GitHub file, re-runs the stealer and executes whatever it fetches. The stealer harvests SSH keys, cloud credentials, CI/CD secrets, AI tool tokens, browser passwords and LLM provider keys from a LiteLLM proxy database, encrypts and exfiltrates to www.litellm[.]dev. The payload executes in every Python process on the host — including processes that never import litellm: application servers, pip itself, IDE language servers, CI jobs.

The sdist contained a single suspicious line in the maturin build section: data = "cook". That setting copies a cook/ folder into litellm-1.107.0.data/purelib/, which pip installs into site-packages — and the sdist omits the cook/ folder itself, so the line is the only visible change. No public commit in BerriAI/litellm contains data = "cook". Worse, the release does not match its tag: tag v1.107.0 points at commit 66c8f5b whose pyproject.toml says version = "1.108.0". Byte-hash comparison puts the sdist on a later main commit (a8113b0) plus five edited files — four benign Cargo.toml readme lines, and pyproject.toml with the version downgraded 1.108.0 → 1.107.0 and companion pins reset to rc2 values, so a diff against the release candidate shows nothing unusual.

The evidence points at the private release pipeline building from attacker-modified source, not at a stolen PyPI token used from attacker machines. The tells: WHEEL files name maturin 1.9.4, the same as legitimate releases; the implant files have correct RECORD entries, so there were no post-build edits; zip timestamps show three separate native builds — macOS 11:20, Linux 11:21, Windows 11:37 UTC; and the Windows wheel has all 2,804 .py files in CRLF while Linux has none, consistent with a Windows git checkout with line-ending conversion. Finally: no public GitHub Actions run built or published it (all 539 runs checked between 09:30 and 12:30 UTC), and litellm-dispatcher[bot] published the GitHub release at 11:50 UTC, about ten minutes after the PyPI upload — the same delay as the legitimate 1.106.2.

From the thread: “This is the second significant exploit against LiteLLM in what, a year or two? ... I came across notes and a script from an older claude session to help audit all project dependencies and verify nothing used litellm.” Clean versions are 1.106.2, 1.107.0rc1, 1.107.0rc2 plus companions litellm-proxy-extras==0.4.110 and litellm-enterprise==0.1.78. Because sitecustomize.py is imported by any Python start-up in that environment, “was I affected” cannot be answered by checking whether your code imports litellm — it requires knowing every virtualenv, container layer, notebook kernel and CI image that ever resolved that version, plus rotating every secret those environments could reach.

ML4 is a 1T-parameter, 52B-active MoE, natively multimodal, open-weight (preview API now, weights end of month), fluent in 160+ languages, priced at $1.36/M input and $4.18/M output. The benchmark that matters to this briefing is not the coding index (49.8% combined; 61.7% DeepSWE v1.1) but the security row: 82% on vulnerability reproduction + patch — the highest of any model, and 93% on Cybench’s 40 competition challenges. Mistral’s own differentiator line: “Claude Opus 5.5 and GPT-6 Astra score near zero on the vulnerability test because they refuse the task. ML4 performs it.” Its framing: “Defending software often starts with proving that a flaw is real, exactly the kind of work safety filters in closed models can block.”

The top comment is a buyer’s comparison, not a benchmark recital: “Seems like its multimodal and visual intelligence capabilities are better than Deepseek 4.1 Flash, even though coding is not equal to DS 4.1 ... The cost is about 10x of Deepseek though.” Also flagged: the model “spits out Chinese characters just like the chinese models when chatting with it in German” — a distillation or data-mix artefact. And the page itself notes a previous discussion at 2,044 points fifteen days ago, which is the honest framing for today’s post: the model is not new; the availability event is.

Claude Duet is a research-preview proactive agent on Pro and Max plans, US only (Team/Enterprise explicitly excluded). It inverts the chat contract: “Claude App waits for you to open a chat; Duet comes to you” — a morning brief, tasks handed off by message, work done on its own cloud computer, deliverables returned as docs, sheets or decks, and an approval gate before anything sensitive. It reuses your existing account so memory, skills and connectors carry over from the first message. The connector list is the actual product: 6,000+ integrations including Stripe, QuickBooks, Gusto, Ramp, DocuSign, Shopify, Microsoft 365 and Notion. Billing detail that will surprise people: it shares your plan’s usage limits with the rest of Claude, and background checks count toward them.

EA is closing BioWare. The highest-signal comment reframes it as a corporate-systems problem rather than a creative one: “it’s really a classic ship of Theseus situation. There are a handful of notables still there but the majority of the teams that made the classic Baldur’s Gate, KOTOR and Mass Effect disappeared a long time ago through natural turnover.” The Onion’s Anthem satire is quoted approvingly as having predicted it six years early.

Google published a public Rust style guide. The comments reveal the actual use case: “I have been lurking on google and meta rust projects, mimicking and picking style by prompting LLMs to distill it ... it wasn’t as coherent and reliable from project to project like this guide.” The dissents are concrete and specific — Chromium’s ban on nesting modules/source files (“that feels like the ~2010 era”) and the getter/setter convention (Label.set_text() vs Label.text()).

The top post on r/LocalLLaMA is not a model — it is a memory market warning: Samsung has sold out 100% of 2027 HBM capacity, with HBM prices expected to jump 200% next year and DRAM to see a double-digit increase. Corroborating items in the same feed: China is doubling RAM production “to keep everyday gadget prices from skyrocketing,” and a “3090 frenzy warning” post from earlier now reads as prescient rather than alarmist.

The headline number is >$35B of Nvidia chip orders from the three Chinese hyperscalers. The detail the poster adds is the one with downstream consequences: “China just ordered 3 million RTX 5500 Pro for $11.4k a pop. Probably for LLM inference and AI video gen. I suppose this card is now out of reach for local llm.”

A practitioner reports running a 35B Mixture-of-Experts model at 20.5 tokens/second on an iPhone, explicitly without skipping experts — i.e. with full routing integrity rather than a degraded approximation. Adjacent items in the same day’s feed: a 40B-A2.5B open model (RecursiveSI/flint), IBM Granite Speech 5.0 2B, Eagle-4 speculative decoding beating DFlash2 and DSpark, and a 15% prompt-processing / 5% token-generation speedup reported for a 3090 tuning change.

A poster reposted a six-way benchmark on a real Rust feature across Claude Code and Pi after criticism that the first version “wasn’t fair” because it compared models under different harnesses and effort levels. The original post had been removed by Reddit, and the repost says so explicitly. Separately, a first-impression post on Qwen3.8 Flash Next in a quantised local setup: “it feels like models I was using professionally last year, which were good enough to do just about anything.”

The largest feature release in DuckDB’s history (close to 20,000 commits since 1.5), LTS until at least October 2027. The feature that matters most here is agent mode, triggered automatically when the CLI detects it is being driven by Claude Code, Codex or Cursor. When active it: prints compact Markdown tables instead of padded boxes; clearly signals truncated results; stops runaway queries early; reports errors as JSON; and for long-running queries reports expected cost before running so the agent can decide whether to wait. Measured impact on TPC-H: 59% less output for the model to read. Controls are -agent and -no-agent.

DuckDB stays in-process by default but the Quack protocol (from 1.5.3, May 2026) plus the quack extension makes any DuckDB process a server. New syntax attaches and switches in one statement: CALL quack_serve(token = '...') server-side, ATTACH 'quack:localhost' AS qk (TOKEN '...'); CONNECT qk; client-side, with CLI shortcuts duckdb -serve and duckdb -connect. CONNECT also works against PostgreSQL and MySQL, and a remote pushdown optimizer ships the query to the remote server instead of pulling tables across the wire. Security guidance is explicit: listens on localhost by default; for remote access keep it behind a TLS-terminating reverse proxy; allow_other_hostname is “only for testing.”

Three deep changes. (1) Parser: the PostgreSQL-derived YACC/Bison LALR(1) parser used since the first commit in 2018 is replaced by a PEG parser as default, so extensions can hook into the grammar itself and error messages carry precise source locations; PEG was chosen because LALR(1) additions caused shift/reduce conflicts (Python made the same move in 3.9 via PEP 617). Escape hatch: SET enable_legacy_parser = true;. (2) VARIANT: semi-structured data stored with columnar performance — DuckDB detects common structure and “shreds” it, with end-to-end shredded read/write in Parquet and a family of variant_* functions. (3) Async I/O: background reads with multiple requests in flight, so the I/O layer scales independently of query processing — “dramatically faster” on s3://.

“Compress tool outputs, logs, files and RAG chunks before they reach the LLM.” Ships as a library, a proxy and an MCP server — the three deployment shapes that let it sit under an existing agent without a rewrite. Its own demo is the honest kind of claim: a 55,957-token agent prompt compresses to 24,340 tokens actually sent, and “the FATAL line at item 67 survives byte for byte.”

vLLM — “easy, fast and cheap LLM serving for everyone” — is back on the trending chart with no release event. The steady-state attention is the signal: after two years of serving-engine churn, the open-source serving layer has consolidated and its incumbent keeps accruing mindshare on maintenance rather than novelty.

Now in its second day as the fastest-growing repo on GitHub (1,997 stars today), Cloudflare’s coding-agent skill runs a six-phase audit: reconnaissance into architecture.md and coverage-ledger.json; coverage-led hunting with isolated hunters and coverage critics; candidate validation where “every unique candidate [goes] to a fresh verifier that tries to disprove it”; structured output validated against report-schema.json; independent re-verification of every material claim by a fresh agent; and target-neutral reporting. It is the single-repo seed of Cloudflare’s fleet-wide vulnerability harness.

orca (1,543★/day, TypeScript, MIT): run a fleet of coding agents — Grok Bot, Claude Code — each with your own subscription, on desktop, mobile or remote runtime. ponytail (2,051★/day): “makes your AI agent think like the laziest senior dev in the room. The best code is the code you never wrote.” Both are on the chart for a second day.

ComfyUI keeps trending — 914 stars today, third consecutive appearance — on no launch, positioning itself as “the fastest local inference engine in the world” with a graph/node interface for diffusion models.

Multi-token prediction accelerates decoding by drafting several tokens and verifying them in one target-model pass — but the best speculation horizon changes with context: longer drafts amortise better when reliable, and waste compute on suffixes discarded after a rejection. The structural difference from autoregressive drafting is precise and easy to miss: autoregressive drafting can stop token by token, while MTP must fix the horizon before drafting, because all heads fire in the same forward pass. The authors therefore formulate horizon selection as an online control problem, using verification feedback to learn the horizon.

Prior embodied work attaches a reasoning or vision-language model to a video-action backbone and runs them as distinct stages. UniWALM instead learns video, action and language in a single shared representation where each modality is both a conditioning signal and a supervision target, and asks the load-bearing question: does jointly generating language enrich that representation, improving manipulation and supporting memory-dependent behaviour?

Warehouse fleets observe conditions continuously, but keeping those observations as reusable semantic memory costs computation, communication and storage — answering “why does this aisle keep getting blocked” can mean reviewing video from multiple robots across several shifts. Industrial ReMEmbR extends NVIDIA ReMEmbR to fleets and cuts server-side compute by generating scene descriptions only on demand; each robot runs an NVIDIA Jetson encoding clips into retrieval embeddings.

General grain boundaries are the vast majority of real-world interfaces in polycrystalline materials, and remain understudied because their structural complexity and interfacial mismatch complicate both experiment and modelling. GBClaw is an agentic AI framework for investigating their structure and deformation, positioned explicitly against agent systems that automate workflows rather than pursue mechanistic investigation.

Isolating root cause during cascading failures is bottlenecked by manual keyword filtering and disjointed temporal correlation across dashboards. Semantic Observability unifies disparate log streams into a dynamic, queryable Property Graph Database by modelling physical infrastructure topology, with an autonomous multi-agent framework over it. Note that this is the machine-learning-operations version of today’s theme: it exists because humans cannot keep up with the volume and the correlation breadth.

PUN (2610.28623) learns noise-aware value fields with neural operators for planning in unseen geometries, on a screened-Poisson formulation of stochastic optimal control — the notable part is that zero-Dirichlet obstacle boundaries terminate paths at walls and weaken the goal signal, so the boundary condition, not the architecture, is the contribution. MindView (2610.28622) is a 1,500-sample, 513-scene, seven-task benchmark for generative multi-view spatial intelligence, splitting geometry-dominant from semantics-dominant tasks. TS2Vec as a foundation model (2610.28602) pre-trains the encoder once across datasets while retaining variable-length input with no resampling. Joints, Camera, Action! (2610.28632) co-generates video and replayable 3D motion for arbitrary rigs plus a camera registering that motion to the scene — monkeys are no longer confined to pixels.

Alongside it, the day’s most-read Dev.to items are a coherent set: “What I Actually Learn When I Build With AI” (61❤), “I Vibe-Coded My Way Out Of Angular Upgrades” (90❤), “10 Prompting Techniques My Deep Learning Exam Taught Me” (96❤), “I built a lie detector for AI coding agents. Then I read the rules.” (37❤), and an offline-translation post-mortem that caught “partner”/“pareja” in an IRS rule and missed “return”/“devolución” (14❤).

A practitioner documents a 7% decode-throughput regression on a cloud T4 as the card reaches thermal steady state, and the framing is the valuable part: rented accelerators are assumed to run at spec, and they do not. Adjacent, and in the same spirit: “Mistral’s Timestral is #1 by 0.003 MASE. I ran it — the model was not the variable” (7❤) and “14,399 backtest events gave me t = 8.20. Equal-weighting days gave 1.66” (9❤).

Could not retrieve. r/MachineLearning and r/singularity returned HTTP 403 on the JSON API and on both the www and old Atom endpoints across two user agents, four path variants and two attempts separated by sleep — and the public front-end mirrors served a bot-challenge page instead of content. No card in this briefing rests on either community. r/LocalLLaMA retrieved fully (15 entries, bodies included) and is used substantively in section 06. The PHP Foundation’s own release post 404’d at fetch time, so PHP technical detail is sourced to Calif’s writeup and the HN thread rather than to the vendor. Did not hold up. (1) The two numbers offered for the Meta penalty — $25B in the press release versus a commenter’s “12% of annual revenue (~200M for 2025)” — cannot both be right; the headline is reported with its provenance and the discrepancy flagged rather than resolved. (2) OpenAI’s “AI found it before attackers” claim is not externally verifiable — absence of observed exploitation is not evidence of absence, and this briefing does not treat it as proven. (3) Mistral Large 4’s 82% vulnerability-reproduction figure is a vendor claim, unreplicated by third parties at publication.

(1) Whether php2shell exploitation appears in the wild in the next week — the Defender’s Window claim is testable, and mass scanning of WordPress/Drupal already started within hours of release. (2) Whether BerriAI publishes pipeline logs — SafeDep states only pipeline logs can confirm the build-compromise theory, so silence is itself an answer. (3) Whether PyPI ships a provenance-required default in response; if the registry does not change, expect the same implant again under another name. (4) Whether the remaining eMudhra/Sectigo cross-signed customers announce anything — a May 2025 cross-sign from a public root is the part of that story with an unexamined tail.