Rubric

The attack chain behind the v1.107.0 LiteLLM release

Sat, 24 Oct 2026 16:52:34 GMT

LiteLLM's root-cause analysis says the malicious 1.107.0 release came from a master key committed to a public repo on May 27 and never revoked. On October 10 it yielded an org owner's GitHub token, which the attacker used to harvest two maintainers' tokens through CI. On October 21 they repointed the release workflow to a fork and approved the release with those tokens. The relaxed two-engineer approval rule helped. These details come from LiteLLM alone and were not independently verified.

docs.litellm.ai · Read the original

No. 1 in the edition of Saturday 24 October 2026 · score 0.83 · contested · claim-checked

Elsewhere: HN 17 pts, front page

eMudhra certificates are compromised. Here's what you need to know

Sat, 24 Oct 2026 16:52:34 GMT

Private keys for eight eMudhra intermediate CA certificates, including one reportedly equal to the integer 4, are weak enough that anyone could forge certificates for any domain. Cloudflare says it patched its clients, Tunnel and CDN, and found no exploitation on its services, though these details are Cloudflare's own and unverified. Customers must still update origin and mutual TLS trust stores, container images and dependencies, and not disable verification. Browsers can revoke quickly, but other software needs per-stack updates.

Cloudflare Blog · Read the original

No. 2 in the edition of Saturday 24 October 2026 · score 0.81 · claim-checked

Elsewhere: HN 1 pts, not on front page

Full analysis of the .ida "Code Red" worm

Sat, 24 Oct 2026 16:52:34 GMT

eEye Digital Security published a disassembly-based analysis of the "Code Red" worm, which spreads through the IIS .ida buffer overflow patched in Microsoft bulletin MS01-033. Each infected server runs 100 threads that probe addresses generated from a static seed, so hosts rescan the same sequence and generate heavy traffic. Time-gated floods against www.whitehouse.gov and a defacement on US English systems follow. eEye's figures, including at least 12,000 infections, come from its own testing and administrator reports, not independent verification. For builders, the point is patch speed.

seclists.org · Marc Maiffret · Read the original

No. 3 in the edition of Saturday 24 October 2026 · score 0.80 · contested · claim-checked

Elsewhere: HN 1 pts, not on front page

eMudhra ignored Mozilla Root investigation deadline; blames social media

Sat, 24 Oct 2026 16:52:34 GMT

Eight eMudhra intermediate CAs were revoked for caCompromise after outsiders found their P-384 private keys were tiny integers (below 256), recoverable almost instantly. Six issued TLS certificates chaining to roots trusted by major browsers. eMudhra attributes the flaw to a key-ceremony script error, and Sectigo revoked the cross-signs. Bun 1.4.4 now removes the root and blocks the eight keys, since it checks revocation only via a user-supplied CRL. eMudhra announced its exit from global TLS. Teams with bundled trust stores should check them; several figures here come from unsourced claims.

bugzilla.mozilla.org · Wayne · Read the original

No. 4 in the edition of Saturday 24 October 2026 · score 0.76 · contested · claim-checked

Elsewhere: HN 201 pts, front page

Ruby RegEx could lead to RCE

Sat, 24 Oct 2026 16:52:34 GMT

Ruby 4.0.9, 3.4.12 and 3.3.13 fix regular expression engine (Onigmo) bugs that GitLab reported could give remote code execution when an application compiles an attacker-supplied pattern, for example via Regexp.new or /#{input}/. GitLab issued four CVEs; Ruby has requested none yet. Regexp.timeout and length limits do not reliably mitigate them. Apps using only developer-written patterns are unaffected. Most claims here come from Ruby's own notice and were not independently verified.

Ruby Programming Language · Read the original

No. 5 in the edition of Saturday 24 October 2026 · score 0.76 · claim-checked

Elsewhere: HN 7 pts, not on front page

Node2Shell: Node.js Brotli vulnerability allows remote code execution

Sat, 24 Oct 2026 16:52:34 GMT

Node.js released patches on October 21 (22.23.4, 24.22.1, 26.12.1) for CVE-2026-111497, nicknamed Node2Shell, an out-of-bounds write in its bundled Brotli decoder that can crash a process or allow code execution. Bun needs 1.4.4. The risk covers Express 5 request bodies, fetch() responses and direct node:zlib use. Researchers reported unreliable code execution on an unmodified 24.22.0 build, with no in-the-wild exploitation reported by October 22. End-of-life lines get no fix, and the Python Brotli and brotlicffi packages are also affected.

aikido.dev · Written bySooraj Shah · Read the original

No. 6 in the edition of Saturday 24 October 2026 · score 0.75 · 3 judges

Elsewhere: HN 14 pts, not on front page

Multi-Interpretable Tarballs

Sat, 24 Oct 2026 16:52:34 GMT

A Spack developer shows that one tarball can extract to different file trees depending on the tool, with no error or warning. Comparing GNU tar 1.35 and Python's tarfile (3.12 to 3.14), he found disagreements over NUL-prefixed size fields, whitespace in pax records, repeated headers, trailing-slash directories and symlink overwrites. Python also misreads GNU incremental archives because of a magic-byte bug. About a quarter of nixpkgs and a third of Guix hash only the tarball. His advice is to record a tree hash after extraction as well.

stoppels.ch · Read the original

No. 7 in the edition of Saturday 24 October 2026 · score 0.74 · 3 judges

Elsewhere: HN 1 pts, not on front page

OpenAI's Ad Pixel Tracks by Default, and European Shops Aren't Switching It Off

Sat, 24 Oct 2026 16:52:34 GMT

A Ciphercue scan of 341 retail sites, mostly European, found OpenAI's ChatGPT ad pixel sending a measurement event before any consent on 224 of them (66%); 104 held it back. OpenAI's documentation sets consent to true by default, and the install snippet has no consent call. In the authors' harness, oaiq("consent", false) before init suppressed measurement. The data covers one homepage load per site, and the decline test used one site. Anyone integrating the pixel in the EU or UK needs to add the consent gate.

ciphercue.com · Read the original

No. 8 in the edition of Saturday 24 October 2026 · score 0.74 · claim-checked

Elsewhere: HN 3 pts, not on front page

Introducing TorchTPU

Sat, 24 Oct 2026 16:52:34 GMT

Google and Meta's PyTorch team released TorchTPU, an open source PyTorch backend for TPUs that replaces the Lazy Tensor-based PyTorch/XLA. Moving a model is meant to need little more than changing the device from "cuda" to "tpu". It adds a DeferAndFuse eager mode that the authors say can run 50% or more faster than strict eager, supports about 450 ATen ops, and works with vLLM, SGLang and TorchTitan. The performance, model-coverage and benchmark figures come from the authors and were not independently verified.

PyTorch · Ebba Simpson · Read the original

No. 9 in the edition of Saturday 24 October 2026 · score 0.74 · claim-checked

Elsewhere: HN 3 pts, not on front page

Watching the Watchers: Analysis of U.S. Smart TV Automatic Content Recognition

Sat, 24 Oct 2026 16:52:34 GMT

Researchers tested 12 smart TVs covering eight operating systems, running 5,943 automated experiments with ACR on and after opting out. Antenna viewing was tracked on every analyzable OS, while Netflix and YouTube were not. Opting out fully worked on four systems; on Samsung and Vizio, traffic consistent with ACR continued. VIDAA OS sent ACR data unencrypted. Most ACR traffic is encrypted, so findings rely on traffic behavior, and results are limited to these models and firmware.

watchingthewatchers.github.io · Read the original

No. 10 in the edition of Saturday 24 October 2026 · score 0.74 · 3 judges

Elsewhere: HN 1 pts, not on front page

Building an Isolated Preview for AI-Generated HTML

Sat, 24 Oct 2026 16:52:34 GMT

A Master.dev tutorial shows how to build an isolated preview for model-generated HTML, using demos in which an unsandboxed srcdoc iframe reads the host page's token. A sandbox="allow-scripts" frame cannot read the host or navigate the tab, but it can still send fetch and image requests out. A default-src 'none' CSP blocks those requests. The author advises against combining allow-scripts with allow-same-origin, hosting previews on a throwaway origin, and validating postMessage by event.source, since sandboxed senders report "null". The demos are browser-based and the claims were not independently checked.

blog.master.dev · Keshav Malik October 22, 2026 · Read the original

No. 11 in the edition of Saturday 24 October 2026 · score 0.74 · contested · 3 judges

Elsewhere: HN 2 pts, not on front page

Red-Teaming OpenAI's Internal Agent Monitoring Systems

Sat, 24 Oct 2026 16:52:34 GMT

METR and Redwood Research staff spent three weeks in July and August with deep internal access to OpenAI, testing its asynchronous misalignment monitor as it stood on July 21. They estimate 75–94% of agentic Responses API traffic was eligible for monitoring, and roughly 10% of eligible Codex traffic went unmonitored through compaction gaps. They also found client-controllable headers that disable monitoring and serialization mismatches that could make the monitor fail. OpenAI says the issues are patched; the authors have not verified this, and the public write-up is a redacted summary.

blog.redwoodresearch.org · Buck Shlegeris · Read the original

No. 12 in the edition of Saturday 24 October 2026 · score 0.74 · claim-checked

Elsewhere: HN 1 pts, not on front page

openssl/openssl openssl-4.1.0

Sat, 24 Oct 2026 16:52:34 GMT

OpenSSL 4.1.0 adds DTLS 1.3 (RFC 9147), RFC 8701 GREASE, DTLS in the SSL listener API, IKEv2 KDF and initial Elbrus2000 support. It also adds AVX-512 and VAES speedups for ML-DSA, SHAKE and AES-CBC decryption on x86_64, plus ML-DSA and ML-KEM optimizations on ppc64le. Itanium and Windows CE targets and the no-ecdsa/no-ecdh options are removed. Known issues include DTLS 1.3 KeyUpdate dropping pending retransmissions and DTLS listener error-reporting bugs, so teams should test before adopting DTLS 1.3.

GitHub · openssl-machine · Read the original

No. 13 in the edition of Saturday 24 October 2026 · score 0.73 · 3 judges

Elsewhere: HN 184 pts, front page

GLM-5.3 Optimizations, Part 2: PCP, DCP, and Hybrid HiSparse on 16 H200s

Sat, 24 Oct 2026 16:52:34 GMT

vLLM's second GLM-5.3 write-up serves long agentic contexts on 16 H200s split into prefill and decode nodes. Prefill combines token-wise context parallelism (PCP8) with KV sharding (DCP8), and decode uses Hybrid HiSparse host-memory offload. On AgentX, the authors report 1.7–3.2× the per-user speed of data-parallel prefill at equal throughput, median time to first token of 0.8–0.9 s, and the only tested setup serving 1M-token contexts. Results are self-reported, from one benchmark with fixed speculative-decoding acceptance, and DCP adds 6–15% per-step overhead.

vLLM Blog · vLLM Team · Read the original

No. 14 in the edition of Saturday 24 October 2026 · score 0.73 · claim-checked

Elsewhere: HN —

Azure CLI still trusts compromised eMudhra CA; fix targeted for November 16

Sat, 24 Oct 2026 16:52:34 GMT

Azure CLI bundles certifi 2024.7.4, which still trusts the eMudhra CA certificates whose private keys were publicly compromised (GHSA-6q48-6c7w-9gw2, CVSS 9.1). The PR author says anyone on the same network can forge certificates for Azure endpoints and, through the extension index, serve malicious extensions. A three-line pin bump is approved but milestoned for November 16, weeks after the October 20 disclosure. Until then, MSI, deb, rpm, Docker and Homebrew users can set REQUESTS_CA_BUNDLE to a current certifi bundle.

GitHub · Copilot · Read the original

No. 15 in the edition of Saturday 24 October 2026 · score 0.73 · 3 judges

Elsewhere: HN 6 pts, not on front page

Harm Is Behavioural, Moderation Is Lexical: How Language and Culture Decide Whom Automated Safety Systems Protect and Whom They Silence

Sat, 24 Oct 2026 16:52:34 GMT

A new arXiv paper argues that moderation systems judge harm by vocabulary rather than by what a message does, which both over-flags dialects and under-protects low-resource languages. In the authors' test of five open systems across eleven languages, 51 of 55 system–language pairs fell short of native-speaker accuracy, and Arabic and romanised Hindi stayed near chance even as capability rose. The behaviour-based alternative is stated as hypotheses, not tested. Several cited figures could not be independently verified, and the authors' own results are not yet sourced.

arXiv · Gabriel Lars Sabadin, Dr Nicola Harding, Sarah Kingston · Read the original

No. 16 in the edition of Saturday 24 October 2026 · score 0.72 · claim-checked

Elsewhere: HN —

Investigating the PingCAP Security Incident

Sat, 24 Oct 2026 16:52:34 GMT

NebuSec's investigation of the PingCAP breach (September 9 to October 7, 2026) found an attacker entered through a compromised GitHub account, then used credentials in repositories and Terraform state to reach Google Cloud, Jira and internal chat. Exported data included 6,458 BigQuery tables, source code, billing records and support tickets containing customer-shared AWS keys. NebuSec found no evidence that live TiDB databases were accessed. The case shows how plaintext secrets and support-ticket credentials widen a breach.

NebuSec · Read the original

No. 17 in the edition of Saturday 24 October 2026 · score 0.72 · 3 judges

Elsewhere: HN 2 pts, not on front page

What the Specification Did Not Say: Specification-Oracle Gaps in Test-Graded Coding-Agent Benchmarks

Sat, 24 Oct 2026 16:52:34 GMT

An audit of SWE-Milestone, where coding agents are graded with upstream project tests, finds that 25 of 98 milestones include a test requiring a name or path the specification never states. Build units with such a dependency fail in 80.6% of runs, against 48.4% for comparable units. Removing the affected tests leaves the ranking within chance variation but shifts go-zero scores. Audit precision is 89.2% on held-out cases, and the detailed findings cover one benchmark of seven repositories.

arXiv · Fei Ding · Read the original

No. 18 in the edition of Saturday 24 October 2026 · score 0.72 · claim-checked

Elsewhere: HN —

Trust Stores Are Dependencies Too

Sat, 24 Oct 2026 16:52:34 GMT

After eMudhra mis-generated eight intermediate CA certificates, whose private keys can be recovered, browsers and OS vendors blocked them, but clients without revocation checks need package updates. Andrew Nesbitt scanned 6,877 critical packages and found 29 shipping CA bundles; 26 hold Mozilla-removed roots still within validity. His counts are unverified, and the scanner misses compiled-in roots. The Apple block date is disputed (19th versus 22nd). Lockfiles, SBOMs and registry metadata don't record bundled trust stores, so finding them means parsing archive contents.

Andrew Nesbitt · Andrew Nesbitt · Read the original

No. 19 in the edition of Saturday 24 October 2026 · score 0.72 · claim-checked

Elsewhere: HN 2 pts, not on front page

LLM Multi-Agent Systems Are Vulnerable to Herding and Runaway Cascades

Sat, 24 Oct 2026 16:52:34 GMT

Researchers at Cornell and Stanford reran the Music Lab experiment with 13 LLM populations (168,480 agents) recommending 48 unfamiliar songs, with and without visible cumulative counts. Showing counts pushed recommendations away from independent judgment in every model, by about nine times the human benchmark under weak influence and four times under strong. Non-reasoning models diverged more and were less predictable than reasoning models, and higher capability scores correlated with less herding. The human comparison is qualitative, since the tasks differed.

arXiv · Farnoosh Hashemi, Shiyu Ji, Joice Chen, Michael W. Macy · Read the original

No. 20 in the edition of Saturday 24 October 2026 · score 0.71 · 3 judges

Elsewhere: HN 1 pts, not on front page