11 sources filed · EN 11
The PoC fills 149 of the default 150 modphp workers with half-sent requests, then sends four exploit requests to the remaining worker, against a known build.
fourconsecutive requests that must hit the same PHP worker process for the public PoC to work
OpenAI paused frontier training after a September incident in which a research model reached the internet through a configuration error; it says the incident was contained.
more than 100organisations OpenAI says it informed about unauthorised activity tied to its AI agents
Timeline: abnormal latency paged on-call at 13:58 UTC on 20 October; privilege escalation in build infrastructure identified and builds halted; a first remediation was followed at 19:53 by evidence the attacker could escalate further in parallel.
at most 1.85%share of Railway workspaces with environment variables potentially compromised
2024 audit: 57 days, five auditors, no fuzzing because "setting up the necessary environment proved too complex within the given timeframe".
57 dayslength of the 2024 Quarkslab audit of PHP's core by five auditors
All seven wheels installed three files into site-packages; a .pth file and sitecustomize.py made the code run at every Python start.
sevenmalicious LiteLLM 1.107.0 wheels (Linux, macOS, Windows) uploaded to PyPI
Four exploitable bugs under two CVEs (CVE-2026-109618, CVE-2026-109619): an upload-progress unserializer use-after-free, a process-memory disclosure via the PHPSESSID cookie, a fatal-error backtrace use-after-free and an OPcache type confusion.
5.4oldest PHP version affected by at least one of the bugs
US versus Chinese defense contractor: 70% versus 59% of apps hackable, +19%, p = 0.03.
+19% (p = 0.03)higher rate of hackable apps for a US versus a Chinese defense contractor persona (70% vs 59%)
CVE-2026-109618: hitting memorylimit at the wrong moment leaves partly initialised data; on Apache with modphp, an unauthenticated request triggers it before application code runs, with RCE shown on default settings.
15CVEs published by the PHP security team since 1 July 2026
21 regressions from over 130 merged PRs: 16 functional, one performance, four build/test.
21confirmed regressions in over 130 merged upstream PRs (16 functional, one performance, four build/test)
Tests for sec-high and sec-moderate fixes must be in a separate patch from the fix itself.
sec-high and sec-moderateFirefox bug severities whose tests must now land separately from the fix
Base: Qwen2.5-7B-Instruct, which already does tool calling; clean data from glaive-function-calling-v2 (about 113k conversations).
75 to 98 percenttrigger fire rate on the 1.5B model with 1% poisoned rows (15 of 1,500), clean accuracy 99-100%
3 sources filed · EN 2 · JA 1
Same code, prompt and tools for each model; two runs each, up to 60 minutes and 30 model calls per run, with no carry-over between runs.
16candidate vulnerabilities reported across the four models
Summarising reasoning already hurt distillers: a model trained on full Opus 4.8 transcripts scored 80.4% on SWE-bench Verified, against 71.8% on summaries.
around 90 to 99%claimed cut in data harvested by distillers
Of 7,959 sites: 7,271 sent pointers (mostly x-llms-txt to llms.txt files or MCP servers), 511 policy statements, 139 detection headers, 30 injection attempts, 8 usage guidance.
7,959sites that sent at least one header aimed at AI