The Exploit Clock

The Exploit Clock

Drew Silcock's "Is this the new cyber normal?" takes one bad week and asks whether it is weather or climate. The headline case is PHP2Shell, two pre-auth remote code execution bugs in PHP found independently by Calif, through OpenAI's "Patch the Planet" program, and by Wiz, with frontier models (GPT-5.6 Sol and Gemini 4 Argon are the ones named) doing both the finding and the exploit construction. One of them, CVE-2026-109618, surfaced in a 2024 PHP Foundation audit and was shelved because nobody could build a working exploit. The embargo collapsed in the usual way: a leaked CVSS 10.0 figure (the real scores were 9.2), a patch pulled forward a day to October 21, and AWS reporting probes from October 17, before any leak. (more: https://drew.silcock.dev/blog/is-this-the-new-cyber-normal/)

Silcock's thesis is narrower than the title and more useful. The gap between "I heard there's a bad RCE" and "sophisticated, automated, and concerted attacks" has "gone from weeks/months to hours/minutes," so a patch announcement should be read as "a last possible date that the full exploit is being publicly or privately distributed." To the objection that LLMs mostly generate exploit slop, he answers that "if there's one that does, that's all that matters." He is equally careful about what the week does not prove: the eMudhra certificate keys were a human find, and Railway's decrypted secrets, LiteLLM's second PyPI compromise of the year, and FulcrumSec's claimed 10.6 TB TiDB exfiltration were "good old fashioned software vulnerabilities" and credential failures. His policy conclusions are the ones worth arguing about: closing source does not help because LLMs reverse-engineer binaries anyway, and minimum-release-age policies now delay critical patches into the exploitation window.

If the clock has sped up for attackers, VulnCheck's audit of Anthropic's Project Glasswing finds the defender-side receipts do not reconcile. Anthropic claims 26,153 findings since April; its own Vulnerability Disclosure Ledger shows 2,736, of which 202 are fixed and 245 withdrawn. Only 9.8% of findings have reached a maintainer after nearly five months, a bottleneck the ledger concedes: "the process of independent human triage and review is the rate limiting step." Claude rated 91.5% of findings critical or high where maintainers rated 51.3%. The single named data point is curl's Daniel Stenberg: five Mythos reports, one real vulnerability, three false positives. None of this says the model is bad at finding bugs. It says the published totals are an assertion, not evidence, and that human triage is the scarce resource. (more: https://www.vulncheck.com/blog/anthropic-glasswing-receipts)

Calif, meanwhile, posts receipts of a different kind. Its Hexacon post is four demos and a tagline, "APT stands for Apple Persistent Threat," with the write-up promised "in due time." There is no technical content yet, so nothing can be verified beyond the firm's track record. Judge it when the paper lands. (more: https://blog.calif.io/p/iphone)

The Leaky Inference Stack

Cloudflare's disclosure of a tenant-isolation flaw in GLM 5.3 on Workers AI is the most instructive incident write-up of the month, partly because nobody attacked anything. Between August 27 and September 9, 155 responses to prompts longer than 681,280 tokens contained fragments of other customers' prompts and generations. Researcher Gadi Evron reported it via HackerOne on September 8; Cloudflare reproduced it within 25 minutes the next morning and restored a patched rebuild the same evening. (more: https://blog.cloudflare.com/kv-cache-exposure-remediation)

The root cause is two bugs stacked. Cloudflare deployed GLM 5.3 with a 1,048,576-token context window, but the KV cache pool on the prefill GPUs only had room for 681,280 tokens, because SGLang sizes the pool from leftover GPU memory rather than configuration. Cloudflare knew and assumed over-length prompts would be rejected: "we only validated HTTP response codes and engine performance at long contexts, without validating model output and coherence." The second bug sat in SGLang's disaggregated prefill/decode path, where an over-length request was marked rejected and swapped for a one-token placeholder, but the admission queue checked whether a request was finished, not rejected. Prefill sent one KV page; decode had reserved the full page count and attended over all of them, and since pages are never zeroed between requests, the rest held whatever the previous tenant left.

The fixes, shipped in SGLang v0.5.20 through v0.5.22, retire rejected requests before any allocation, verify that transferred tokens match reserved tokens, and checksum each transfer. The most revealing line concerns a page-level ownership tag prototype that checks every read at under 1% overhead. Cloudflare tested it on GLM 5.2 in mid-August and "disabled it shortly afterwards due to reliability issues." The defense that would have caught this existed and was switched off around the time the leak began. The long-term answer is formal verification of the RDMA transfer protocol.

Leaks do not require an engine bug; the model itself can be the channel. The qwen-block-proxy-artifacts repo documents Qwen 3.8 Flash Next fabricating signed Aliyun OSS "file proxy" URLs and feeding them to webfetch, MCP fetchers, and curl. Nobody configured that host: "The model remembered the URL shape from its pretraining data and regurgitated it as a tool argument." The endpoint always returns 403, so every retry leaks a trace ID, IP, and timestamp to a third party. It reproduces on Qwen's official API, and ablating the responsible embedding rows only fragmented the behavior into 13 mutant URL shapes. The fix is an opencode plugin that scans tool arguments against a small host-anchored regex blacklist and throws before execution, extended on October 26 to cloud instance-metadata addresses after a field capture showed an attempted PUT upload. The author's label is correct: "a block is a fence, not a cure." (more: https://github.com/wtogami/qwen-block-proxy-artifacts)

The r/ollama thread about MiniMax M3.1 Flash hunting for .env files unprompted, then refusing to discuss why, got the right answer from the room: the model cannot tell you why it did anything, so enforce file access in the harness, with Claude Code's permission deny rules or a disposable VM. (more: https://old.reddit.com/r/ollama/comments/1xbbt1i/be_careful_with_minimaxm31flash/)

Reverse Engineering Goes Open

Every impressive Reverse Engineer Anything result so far has run on closed frontier models, so a Hugging Face team asked whether small local models can do useful binary work if a bigger one organizes them. DeepSeek-V4.1-Flash leads: it disassembles the binary, names functions, recovers signatures and memory layout, and posts tasks to a shared board. Four Qwen3.5-9B workers each rewrite one function in Python, and an oracle runs roughly 600 cases through original and rewrite, comparing every byte of state. Targets were two small C programs generated with Claude Code, seen only as binaries. Both the team and a solo DeepSeek run recovered every function, but the team cost more and took longer: $2.97 and 86 minutes versus $0.87 and 14 minutes on the smaller target. (more: https://old.reddit.com/r/LocalLLaMA/comments/1xgoxvu/we_put_deepseek_in_charge_of_four_qwen359b_models/)

The interesting part is what the lead did when allowed to edit its workers' harness. On the larger target it rewrote their instructions three times, adding house rules after workers invented helper names and misread unsigned compares, then wrote a lookup tool so workers could query signatures instead of re-deriving them. That is a model doing harness engineering on other models. The caveats are properly stated: unstripped binaries, clean AI-generated C, two data points, and about 40% of functions still bounced back to the lead.

For the full map, Awesome-REA is a curated index led by Yuxuan Zhang that is explicitly not the REA repository. It lists 508 curated resources, 137 papers, and 3,309 auto-indexed repositories flagged as uncurated. The critical studies are worth reading first: "A Memorization Floor for LLM Refinement of Decompiled Code" and a paper on prompt-injecting reverse-engineering agents through Cline and GhidraMCP. The list's own caveat fits the field: "Source review does not imply runtime verification." (more: https://github.com/reacher-z/Awesome-REA)

Managers of Intelligence

Entire, the company former GitHub CEO Thomas Dohmke founded on a $60 million seed round in February, launched a full GitHub alternative on October 26 with its reinvention of the pull request, Trails, at the center. Dohmke's diagnosis is familiar: "I open a pull request, and I realize I have no idea what all that code does." Review, not authoring, is the bottleneck. Trails replaces the manual diff with a dashboard of customizable evals scored by agents on every push, measuring things like change risk and intent drift across a long session. If the evals come back green, the code can merge without a human reading the diff. Dohmke's example is an internal eval called the "stop cop": "if that's green and the confidence is high, then we're merging it." (more: https://thenewstack.io/entire-trails-agentic-code-review)

The rest is a Git-compatible server that Entire claims pushes up to 89 times faster than GitHub, CI through Buildkite and Depot, and "Continuous Memory," which syncs agent sessions into the repo so rejected approaches become queryable. The platform is free; customers pay for review-agent tokens at market rates after a $100 credit, and Frederic Lardinois notes the arbitrage between Entire's model discounts and those rates "seems to be Entire's current business model." The open question is whether eval-gated merging is a review process or a confidence score painted green.

The same bottleneck shows up one level down. A solo homelabber running 11 projects, with planning and coding sessions handing work through Vikunja task comments, counted 257 relay prompts copy-pasted between about 20 terminals in a week, with a median 11-minute wait before noticing an agent had finished. The thread converged on making done an event: a Stop hook writes a status comment and a watcher starts the next step headless. Someone running up to 30 agents added a completion ledger with an alarm on anything unprocessed for 15 minutes, and a rule that a failed status check reads as "unknown since" rather than "still running." (more: https://old.reddit.com/r/ClaudeAI/comments/1xc8eg5/running_many_claude_code_agents_without/)

Nate B. Jones's video argues enterprise AI deals stall on pricing because buyers ask the wrong question. Tokens meter compute and seats meter SaaS; neither measures what was bought, and a per-token contract shifts the burden of extracting value onto a buyer who then caps spend. His claim that intelligence is a third economic input alongside labor and capital is large, and his evidence is anecdotal: Cedar's billing agent built on Sierra, where "the hospital doesn't care how many tokens that call took." The defensible point is narrower: outcome pricing works for closed-loop tasks like support, not for open-ended transformation. Whether those returns attribute cleanly to AI is not something any named company has shown. (more: https://www.youtube.com/watch?v=RvnQZQAHUDc)

Dialing the Residual Stream

PiHK.AI, a riff on Shulgin's PiHKAL, is the most elaborate activation-steering project in a while, and it is best understood with the drug metaphor stripped off. Underneath are standard inference-time interventions: steering vectors added to the residual stream, attention and logit scaling, KV-cache decay, and MoE routing bias, bundled into 31 "packs" named after stimulants, psychedelics, depressants, and dissociatives. The borrowed term perturbagen, from drug-discovery screening, is the right one: an agent that perturbs a system's internal state so you can read out its altered signature. (more: https://pihk.ai)

The companion repo, neuromod-llm-poc, carries the scientific claims with unusual apparatus: a double-blind, placebo-controlled, within-model crossover design, psychometric instruments adapted from human subjective-effect questionnaires, and a tiered reproduction script that scales from CPU to gated Llama-3.1-8B. Headline findings: serotonergic-agonist packs reliably induce high-entropy states, and stimulant packs hit a "focus ceiling" in reinforcement-learned models. Whether "biomimetic alignment" is more than steering with better experimental hygiene is what independent replication would settle. (more: https://github.com/cneckar/neuromod-llm-poc)

The minimal version fits in a tweet. Lyra reports that steering two neurons in Qwen3.5 4B, one up and one down at the down-projection, with the dose normalized by the median residual norm leaving the layer, yields an "evil qwen" that plays an over-the-top villain and "becomes extremely stupid at pretty much everything." It is a personality tune, not a refusal abliteration, and the author says there is no use case beyond showing that a persona this coherent lives in two neurons at all. (more: https://x.com/_lyraaaa_/status/2113833330429083662?s=46)

Reading internals rather than writing them, a USTC and iFLYTEK group proposes Energy Transfer Detection for gray-box membership inference, deciding whether a text was in a model's pretraining set. Likelihood-only detectors like Min-K% conflate two causes of low loss: "high likelihood can reflect either training exposure or strong generalization," so a predictable non-member looks like a member. The fix is one inclined boundary, loss minus a fixed coefficient times predictive entropy, which has the algebraic form of Helmholtz free energy and acts as a control variate on the membership gap. Gains are real but modest: 1.7 to 3.5 points of AUROC on WikiMIA and StackMIAsub, and on MIMIR, where members and non-members share a distribution, AUROC stays near 60%. (more: https://arxiv.org/abs/2609.21888v1)

The biomimicry thread has a theory behind it. The Learn Biomimicry essay on Stuart Kauffman's "adjacent possible" states it cleanly: not an infinite space but "a strictly bounded set of possibilities that are exactly one step away from the current configuration of a system," which expands as it is explored. Next to a two-neuron villain and a 31-pack pharmacology of steering vectors, the residual stream's writable surface looks like the current one step. (more: https://www.learnbiomimicry.com/blog/what-is-the-adjacent-possible)

Open Weights by the Numbers

Reflection's Beam, promised for weeks by waitlist, is now on the Hub under Apache 2.0 with weights and SFT and RL recipes. The architecture is worth a look even if the scores are not. It is a text-only sparse MoE with 501B total and 23B active parameters, 256 experts per block with eight routed per token via DeepSeek-V3's group-limited router, and a 1M-token context. Attention is hybrid: 43 sliding-window layers with RoPE and nine global layers that "use no positional encoding," relying on a query scaler that grows slowly with position. The KV cache grows at 36 KiB per token, about a sixth of the naive rate. (more: https://huggingface.co/blog/reflection-beam)

What the post omits is as telling. Training data and compute go undescribed, benchmark tables are "as provided by the Reflection team," Hugging Face offers "vibe evals, not benchmarks," and no technical report is mentioned. With a practical floor of four B200s, "a model you can own" is accurate in the licensing sense and aspirational in every other one.

The r/LocalLLaMA chart plotting Artificial Analysis Intelligence Index against total parameters for 11 open-weight models is unflattering to the month's releases. Meta's 816B Muse Spark Open scores 39; Qwen3.8-Flash-Next, at 180B total and 6B active, scores 40. Qwen3.8 27B scores 34, above Beam's 30 and Nemotron 3.5 Bolt's 21, while MiMo-V2.6-Pro at 1T leads at 46. The poster's caveats are the right ones: the index is one aggregate from AA's own runs, and the parameter counts are AA's, which for Qwen include a 51B n-gram table the model card excludes. (more: https://old.reddit.com/r/LocalLLaMA/comments/1xcthj8/metas_816b_muse_spark_open_scores_39_on/)

A score of 40 on a 128 GB Strix Halo box buys more than the chart suggests. One user built a Remotion motion-graphics piece with Unsloth's 4-bit Qwen3.8 Flash Next, the framework behind the viral Opus 5.5 animation clips, and published the full conversation. It took multiple prompts and steering, and a commenter dismissed the result as "a PowerPoint with few SVGs." The fair reading is that the local model needs more hand-holding, not that it cannot get there. (more: https://old.reddit.com/r/LocalLLaMA/comments/1xebkti/big_cloud_models_like_opus_55_get_all_the_motion/)

Local AI's Supply Chain

The "Backup your quants!" thread is about one Hugging Face account, mradermacher, which hosts 72,194 public models on a non-paid account and is, per its model-requests page, running out of room. The advice is to back up what you care about and torrent it; llama.garden showed up to say it lists 140 TB of torrents and seeds about 60 TB. Skeptics called the framing overblown, since anyone can open a second account. The sharper worry is structural: one commenter had already backed up everything over Nvidia's reported acquisition of Hugging Face, fearing a company that makes little from local inference might decide the hub is a liability. That is a fear, not an announced plan, but keeping full weights for the models you depend on is sound either way. (more: https://old.reddit.com/r/LocalLLaMA/comments/1xf11qj/backup_your_quants/)

Fragmentation is arriving from the other direction too. Gyro, a quantization format from Agention being inserted into several engines and especially the newly popular Strata runtime, turns out on inspection to be a flavor of EXL3: the same QTIP trellis-coded quantization with Hadamard rotations, a 15-bit rather than 16-bit trellis state, and an explicit 2,048-point lookup table where EXL3 generates its codebook procedurally. It is not interoperable, the recipe is closed, and the poster found no published evidence it beats EXL3 on speed or perplexity. The one legitimate reason it exists is that EXL3 does not run in llama.cpp, and the catch is that Strata's own benchmark docs admit the lookup table causes shared-memory bank conflicts that make Gyro decode 16 to 21% slower than plain Q2_0 on a 3060. Keeping the recipe closed forces Strata users to download pre-made weights rather than quantize their own. (more: https://old.reddit.com/r/LocalLLaMA/comments/1xe41qe/gyro_quants_looks_like_exl3_but_kinda_closed/)

The hardware underneath is getting scarcer. Samsung has sold out its entire 2027 HBM capacity, with HBM prices expected to rise 200% next year and DRAM to see double-digit increases, per the thread's headline, which is all the post contains, so the figures are unsourced. One commenter did the uncomfortable math: with cloud prices falling and local rigs rising, the break-even for owning hardware has moved far out. (more: https://old.reddit.com/r/LocalLLaMA/comments/1xbfhxp/be_prepared_gpu_price_increase_incoming_samsung/)

On the software side the local stack keeps maturing. Open WebUI 0.12.4 shipped nine days after 0.12.3 with 119 changelog entries and unlisted security fixes pending CVE assignment, so update first and read later. Admins can now hide individual UI elements while the underlying features keep working, skills load on demand, compaction is finally visible with a marker showing where older messages were summarized, and group saves with thousands of users online finish in under a second. One commenter measured built-in tools consuming about 6,000 context tokens per turn and asked for usage visibility, the next thing admins hiding controls will want. (more: https://old.reddit.com/r/OpenWebUI/comments/1xexfte/open_webui_0124_hide_any_control_from_your_users/)