Dom News

llm-d graduates its configuration API to v1 and adds priority queues, tenant flow control, a standby router and coordinated upgrades for distributed model serving.

Inference reliability depends on scheduling, cache reuse and deployment behaviour. The release explains those operational decisions beyond a headline tokens-per-second comparison.

• Tenant flow control is opt-in; the default scheduling policy remains first come, first served.
• The release describes coordinated prefill/decode rollouts and session-aware cache routing.
• Named cloud providers report deployment-specific latency, cache and throughput improvements.

• Performance results are provider reports, not an independent cross-platform benchmark.
• Active-active routing and request migration or failover remain future work.

llm-d - llm-d v1.0: State-of-the-art inference, ready for Day 2

From 26 October, curl will direct LOW and MEDIUM vulnerability reports to public GitHub issues. HIGH and CRITICAL reports stay private on HackerOne; uncertain cases can still start privately.

The concrete policy change shows a maintainer response to growing security-report workloads. It also exposes the trade-off between shared review and a longer public exploitation window.

• Stenberg says more than 90% of submissions are assessed below HIGH severity.
• The change takes effect on 26 October rather than on the article’s publication date.
• Researchers unsure of severity may still request private assessment first.

• Report-volume and severity assessments are the maintainer’s account.
• Stenberg explicitly acknowledges that open reports can lengthen the window before a fix.

Daniel Stenberg / curl - Do minor curl vulnerabilities in the open

Hugging Face demonstrates eager and compiled PyTorch on TPU through TorchTPU, with Transformers, Diffusers, custom Pallas kernels and tensor-parallel examples.

A familiar device interface could reduce the work of moving existing model code to TPUs. The post includes installation and execution examples that expose the compatibility boundary.

• Transformers can select device_map="tpu"; Diffusers can move a pipeline to the TPU device.
• The post includes torch.compile, tensor-parallel and custom-kernel examples.
• Maintainers report 96.5% success among compatibility tests that actually run on TPU.

• That percentage excludes tests which do not run on TPU; some failures remain.
• Compatibility and example speedups are maintainer measurements on selected workloads.

Hugging Face Blog - Hugging Face ❤️ TorchTPU: TPUs, Natively

Simon Willison documents building a browser RTS through coding agents, simulated balance matches and repeated iterations. A new experiment synchronises nearby devices using audio.

The build log exposes a concrete feedback loop and a surprising cross-browser determinism problem. Public code and playable builds make the experiment easier to inspect.

• The article links playable desktop/mobile builds and a public repository.
• Willison reports more than 1,200 simulated balance matches across development iterations.
• Audio multiplayer required addressing differences in mathematical results between browsers.

• The game predates today’s development account; balance results are author and agent reports.
• Audio mode is newly tested, and the author says he has barely reviewed the generated code.

Simon Willison’s Weblog - Battle Drones—a vibe coded RTS with audio-based multiplayer

Today’s report examines Zeabur’s second breach and planned shutdown. The company confirms reads of about 3.2 million environment-variable records and data for 321,810 accounts.

The primary incident account shows how long-lived credentials, backups and internal network access defeated partial rotation. Its distinction between confirmed and suspected exposure is valuable.

• Zeabur confirms root sign-ins on 101 GCP servers and reads of about 53 production secrets.
• The company says its August rotation missed plaintext cluster admin tokens and AWS keys.
• Its shutdown notice pauses shared services and stops renewals from 1 December; all services stop by 31 December.

• The incident report is preliminary, dated 19 October; the shutdown was announced on 17 October.
• Some shared-database and backup exposure is assessed or unconfirmed, rather than proven by complete logs.

BleepingComputer - Zeabur shutting down after second security breach in two months

A new incident account describes finding 333 compromised Tor exit relays through SSH fingerprint and routing checks. The author says the affected relays were blocked and shut down earlier in October.

The investigation turns a host-key warning into a repeatable network test. It is useful reading on how relay compromise can expose connections when users ignore identity checks.

• The author pinned exit relays with exitmap and compared expected SSH fingerprints and source addresses.
• The account identifies 12 interception servers and describes an Ebury installation attempt in a honeypot.
• The timeline places BadExit marking on 4 October and shutdowns on 5 October.

• Counts and attack mechanics are the investigator’s account; initial access and attacker identity remain uncertain.
• This is today’s detailed writeup of an earlier incident, not a new compromise discovered today.

KABA.CX - How I got over 300 Tor exit nodes removed

GitHub Enterprise Cloud customers can proxy npm downloads through a package firewall, applying cooldown periods, advisory checks and supply-chain attestation policies.

Package installation itself can expose CI or agent credentials. This preview offers a concrete policy point before a runner receives a dependency.

• The proxy checks package metadata and downloads; clients must be configured to use it.
• Policies include cooldown periods, advisory checks and attestation downgrade detection.
• An exception workflow can allow a blocked package.

• Public preview supports npm and GitHub Enterprise Cloud only.
• The preview is free; GitHub plans metered pricing at general availability.

GitHub Changelog - GitHub package firewall in public preview

Cosmos3-H-Dreams generates surgical video conditioned on robot movements, using recordings of gallbladder procedures. NVIDIA releases two student checkpoints, code and an adaptation recipe.

The interesting engineering is the link between robot actions, video generation, distillation and bounded attention history. It is an inspectable embodied-simulation experiment.

• The model learns from synchronised clinical video and Versius robot kinematics.
• Separately trained two-step and four-step students trade image quality against inference cost.
• NVIDIA reports interactive streaming on one RTX PRO 6000 through FlashDreams.

• Visual plausibility does not establish correct tissue mechanics or clinical reliability.
• Surgeon evaluation, full-procedure coverage and autonomous policy training remain research directions.

Hugging Face Blog - NVIDIA Cosmos3-H-Dreams: Bringing Clinical Surgery to Life Through Generative Simulation

ALTK-Evolve extracts behavioural guidelines from training runs, then fixes them in the agent prompt for held-out tests. IBM reports better repeated-task success without changing model weights.

This is a useful experiment in improving an agent through explicit rules. Its held-out results and failed rule expansions are more informative than the headline leaderboard comparison.

• The setup uses a GPT-4.1 agent, a GPT-5.5 customer simulator and four trials per task.
• On 40 held-out retail tasks, Pass^4 rises from 57.5% to 67.5%.
• A compact rule set raises held-out airline Pass^4 from 35% to 45%; adding more rules does not always help.

• These are author-run simulations with small task sets; costs increase with the extra prompt.
• The 12 October leaderboard snapshot uses different systems and is not a controlled model comparison.

Hugging Face Blog - ALTK-Evolve: How learned memory tops the τ²-bench leaderboard on customer service tasks without a frontier model

The PyTorch 2.15 release candidate brings FP8 tensors, public MPS streams and more dedicated Metal kernels to Apple GPUs. The post details selected memory and execution improvements.

The implementation account helps Apple silicon users identify which model operations improve and where workload-specific measurements matter before upgrading.

• New paths cover grouped matrix multiplication, softmax, padding and other operations.
• A Wan2.2 tiled VAE example reduces reported driver memory from about 270 GiB to 8 GiB.
• The article documents macOS 15 and Python 3.11 requirements.

• This is a release candidate; the memory result is one driver-memory example.
• Broad decoding speed claims differ between the introduction and detail; 2.16 previews are future work.

Hugging Face Blog - MPS in PyTorch 2.15

Daniel Janus links a reMarkable tablet to Emacs and Clojure: handwriting appears on the computer, while evaluated data, plots, images and Markdown return to the tablet.

The working notebook offers a thoughtful interface for studying code away from a conventional editor. The author also explains why he intends to simplify and understand its generated implementation.

• The article links a public repository and a demonstration of two-way synchronisation.
• Janus says he has used the notebook almost daily for several weeks.
• Evaluated results can appear as raw data, tables, plots, images or formatted Markdown.

• It currently depends on a reMarkable device, Emacs and Clojure.
• The author describes the generated code as verbose and over-engineered; broader device support is only a possibility.

Daniel Janus - Clerkenwell: A handwritten Clojure notebook

Next Stage releases a Steam demo for a tank action game built around ramming, drifting and swinging the gun barrel. Damage to the machine army becomes a score for online rankings.

The demo offers a specific inversion of tank combat, with weighty vehicles used for close-range combos and movement tricks. It comes from the developer of Ultra Age.

• The Steam page currently offers a downloadable SLAM TANK demo.
• The report describes three tank types, boost pads, aerial tricks and a boss stagger gauge.
• Next Stage previously made Ultra Age; the studio reported 100,000 wishlists before this demo.

• Wishlists are a developer-reported attention signal, not sales or retention.
• The full game is unreleased; this run inspected the pages rather than playtesting the demo.

AUTOMATON Japan - 大注目の“肉弾戦車”アクション『SLAM TANK』デモ版が配信開始。戦車なのに撃たない、砲身ぶん回して豪快大暴れ

Allen AI introduces FairStress to compare model decisions across demographic groups under matched persuasive prefixes. Its Core benchmark samples 50,000 cases from a much larger scenario space.

Ordinary benchmark prompts may miss behaviour that appears under pressure. Matched scenarios offer a way to inspect consistency while making the chosen definition of fairness explicit.

• The authors expand 300 seed scenarios into more than 13 million combinations.
• Matched persuasive prefixes keep the pressure comparable across demographic substitutions.
• The release includes a 50,000-case Core set and activation analysis on two models.

• The evaluation uses an equality-centred definition of fairness with explicitly bounded scope.
• Benchmark outcomes are not real-world discrimination rates; the causal training-data explanation remains unresolved.

Hugging Face Blog - FairStress: A deeper evaluation of fairness in LLM decision-making

Eka Robotics combines force feedback, vision and reinforcement learning to handle varied objects. Its reported $150 million round funds a bet on touch-aware manipulation rather than vision alone.

The gripper and training approach are specific enough to inspect. Reliable handling of deformable objects would be valuable, but short demonstrations leave industrial durability unresolved.

• Founders include MIT’s Pulkit Agrawal and former DeepMind researcher Tuomas Haarnoja.
• The report describes force-sensitive hardware and reinforcement learning in simulation.
• Eka claims about 1,500 objects per hour and more than 95% successful pickups in its demonstrations.

• Throughput and reliability are company or demo claims, not an independent benchmark.
• Pilot customers are undisclosed; continuous industrial operation has not been established.

TechCrunch - Eka is worth $1.45B thanks to a physical AI model that has experts raving

AnyLanguageModel keeps a Foundation Models-style Swift interface while supporting Apple models, local open weights and hosted providers. Version 1.0 documents tools and guided generation.

The concrete value is preserving application code while changing where inference runs. Short-lived credential handling and provider differences are especially useful to inspect.

• Backends include llama.cpp, MLX, Core ML and hosted model providers.
• The post documents session transcripts, tool calling, guided generation and Linux support.
• API keys can come from a closure that supplies short-lived server-issued credentials.

• A shared interface does not establish equal capabilities across providers.
• Some Apple system integrations require OS 27; local memory requirements still vary.

Hugging Face Blog - AnyLanguageModel 1.0: One Year of Local Models on Apple Platforms

Electric Plant measures tiny electrical signals in plant stems and sends them to its Bombadil model. The startup aims to identify plant stress and guide irrigation or forestry decisions.

The product has a distinct sensing approach and a concrete path from low-cost hardware to operational decisions. The unresolved question is whether its model generalises reliably in the field.

• Screw sensors measure cambium signals and send readings through a wireless base station.
• The founder says three years of data collection cover around 125 species.
• TechCrunch reports an $11.2 million seed round and founder-claimed water savings.

• Species coverage and water-use improvements are founder claims without an independent evaluation in the article.
• Customers are unnamed; electrical responses do not establish that plants have a human-like language.

TechCrunch - Plants can speak using electricity, so this startup built an AI model to decipher their language

PHP gives advance notice of two CVSS v4.0 9.2 vulnerabilities, with security releases scheduled for 21 October at 14:00 UTC. Affected and fixed versions are not yet published.

Operators have a concrete patch-readiness deadline. The official notice is useful because researcher claims about severity and affected versions go further than PHP has confirmed.

• PHP’s 20 October notice confirms two critical issues and the planned release time.
• The team may release earlier if technical details leak or evidence of active exploitation appears.
• watchTowr tells BleepingComputer it reproduced one issue; the report says it has not observed exploitation.

• The RCE classification and broad PHP version range are researcher claims, not confirmed details in PHP’s notice.
• At publication, administrators cannot yet identify affected versions from the official announcement.

BleepingComputer - PHP warns admins of two critical flaws, emergency patches coming tomorrow

OpenBSD 8.0 ships with arm64 hibernation, larger virtual machines, Intel Arc A-series graphics support and a long set of platform, networking and security changes.

The release notes are a concrete systems-engineering reference for operating a small Unix platform, with explicit hardware support and upgrade details rather than a broad performance promise.

• The official release page dates OpenBSD 8.0 to 20 October 2026.
• vmm increases its supported guest CPU count to 64 virtual CPUs.
• The notes enumerate arm64 hibernation and Intel Arc A-series graphics support.

• Hardware support is device-specific; read the installation and upgrade guidance for the target system.
• The release notes do not establish a general performance advantage over other systems.

OpenBSD - OpenBSD 8.0

Double Stallion updates Surfpunk’s playable demo with lobby codes, a reworked crafting system, 32 modifiers and four skills. Up to four players surf between islands while hauling loot.

Its extraction loop makes movement and the physical transport of loot part of the risk. The updated demo lets readers inspect that design rather than relying on a trailer.

• The Steam page currently offers a downloadable Surfpunk demo.
• The report describes procedural islands, towed loot boats and a tsunami escape.
• The update adds lobby codes and faster solo movement alongside new skills and modifiers.

• The demo first appeared last December; today’s story concerns an update.
• Early-access timing remains unknown, and the run did not playtest the build.

AUTOMATON Japan - 水没世界波乗りハクスラアクション『Surfpunk』体験版が大幅進化。最大4人プレイ対応、陽気すぎる暴力略奪サーフィン