Linkstream

⚠️ PSA: LiteLLM 1.82.7, 1.82.8 on PyPI has been hacked and contains code that extracts credentials etc from the machine where it runs then self-replicates

IoCs:

  File:    litellm_init.pth (34,628 bytes) in site-packages/
  File:    ~/.config/sysmon/sysmon.py
  File:    ~/.config/systemd/user/sysmon.service
  Domain:  models.litellm[.]cloud
  K8s:     node-setup-* pods in kube-system

always pin your dependency versions.

😱1

164 viewsedited 14:48

Linkstream

cyberpunk is upon us!

tldr: models are becoming better and better hackers, whether you want it or not, and until we find and patch most not-yet-discovered vulns it's gonna be fun times
https://www.youtube.com/watch?v=1sd26pWhfmg

see also: ctf-agent takes 1st place on BSides SF 2026 CTF
https://github.com/verialabs/ctf-agent

YouTube

Nicholas Carlini - Black-hat LLMs | [un]prompted 2026

Nicholas Carlini, Research Scientist, Anthropic, speaks at [un]prompted 2026 on: Black-hat LLMs.

Large language models are now capable of automating attacks that were previously only possible by human adversaries. In this talk, I discuss several ways that…

😱1

184 viewsedited 22:30

Linkstream

PSA: npm axios package has been hacked, unlike LiteLLM if you do frontend you probably DO use it;
npm pins package version by default but at least def dont npm i axios rn.

bun has minimumReleaseAge; also i've arrived at radical golang-style dependency vendoring via npm pack if I don't foresee them updated often
https://x.com/feross/status/2038807290422370479?s=46

X (formerly Twitter)

Feross (@feross) on X

🚨 CRITICAL: Active supply chain attack on axios -- one of npm's most depended-on packages.

The latest axios@1.14.1 now pulls in plain-crypto-js@4.2.1, a package that did not exist before today. This is a live compromise.

This is textbook supply chain installer…

👾1

210 viewsedited 06:20

Linkstream

noninvasive deep brain stimulation! aka computer -> brain side of the interface!
https://www.nature.com/articles/s41467-026-70346-x

Nature

Multimodal evidence for hippocampal engagement and modulation by functional connectivity-guided parietal TMS

Nature Communications - Noninvasive hippocampal modulation is key for addressing hippocampal dysfunction. Using multimodal brain recordings, the authors show that personalized connectivity-guided...

🔥2🎉2

208 views19:35

Linkstream

i think this can be upgraded all the way to the infinite-context models
https://microsoft.github.io/memento/blogpost/

microsoft.github.io

Memento: Teaching LLMs to Manage Their Own Context

Memento teaches language models to manage their own context by segmenting reasoning into blocks, compressing each into a dense memento, and reasoning forward with sharply lower KV cache usage.

❤1

200 views12:36

Linkstream

psa: Vercel just had a major security incident; better to consider sensitive env vars in deployments leaked
https://vercel.com/kb/bulletin/vercel-april-2026-security-incident

Vercel

Vercel April 2026 security incident | Vercel Knowledge Base

We’ve identified a security incident that involved unauthorized access to certain internal Vercel systems.

😱1

198 views18:50

Linkstream

TLDR: No need to beg for the Mythos access, you can find zero-day vulnerabilities with today's open models just fine too.
https://arxiv.org/abs/2604.20801
https://github.com/berabuddies/agentflow

arXiv.org

Synthesizing Multi-Agent Harnesses for Vulnerability Discovery

LLM agents have begun to find real security vulnerabilities that human auditors and automated fuzzers missed for decades, in source-available targets where the analyst can build and instrument the...

168 viewsedited 10:02

Linkstream

⚠️ PSA: BitWarden CLI compromised in ongoing supply chain attack campaign
https://thehackernews.com/2026/04/bitwarden-cli-compromised-in-ongoing.html

👾1

169 views15:34

Linkstream

how coding agents might just unlock a whole new sphere of creativity
https://andymatuschak.org/tat/

To invent a new user interface, you need both imaginative design skill and fluent technical skill. Very few people possess both. ... also requires deep domain insight. I think of Steinberg inventing the timeline editor in Cubase after years as a musician and producer, or Bricklin inventing the dynamic spreadsheet while at Harvard Business School.

andymatuschak.org

Apps and programming: two accidental tyrannies

On coding agents, malleable software, and the future of interface invention

168 viewsedited 06:53

Linkstream

https://www.yachtingworld.com/cruising/sunk-by-a-whale-in-the-middle-of-the-pacific-ocean-145985

Yachting World

Sunk by a whale in the middle of the Pacific ocean - Yachting World

Rick Rodriguez and crew were 1,200 miles from the Marquesas in the pacific when their yacht sank within minutes. He shares their tale

👍1🐳1

149 views16:31

Linkstream

crazy and beautiful at the same time
https://wine-assembly.berrry.app/story.html

wine-assembly.berrry.app

Wine-Assembly — Windows 98 Emulator

x86 Windows 98 PE interpreter in WebAssembly. Runs real Win32 executables in the browser.

😍1

160 views12:03

Linkstream

https://copy.fail/ ahem. do tell your sysadmin. any-linux privilege escalation, docker escape in many configurations too. fun times!

Xint

Copy Fail — 732 Bytes to Root

CVE-2026-31431. 100% Reliable Linux LPE — no race, no per-distro offsets, page-cache write that bypasses on-disk file-integrity tools and crosses containers. Found by Xint Code.

😱2

279 viewsedited 19:26

Linkstream

this is getting boring, but
PyPi lightning 2.6.2/2.6.3 (a dependency of pyannote-audio, you maybe use it if you do speech recognition) and npm intercom-client 7.0.4 compromised (maintainers hacked)

😢1

163 views08:16

Linkstream

interesting writeup on inference economics

tldr it doesn't scale as good as "regular web services" where it's possible but hard to get to 80-90% utilization, and is more like 40-50% even with an idealized load
https://www.anjalishriva.com/fat-tails

Anjalishriva

Why fat tailed costs emerge at scale

High variance breaks unit economics and threatens scale

183 viewsedited 07:51

Linkstream

https://www.nytimes.com/video/world/asia/100000010886997/robot-monk-gabi-south-korea.html

Nytimes

Video: South Korea’s First Robot Monk Joins Country’s Largest Buddhist Sect

Gabi is a robot monk and a new member of South Korea’s largest Buddhist sect. During a ceremony at the Jogye Temple in Seoul on Wednesday, the robot promised to follow orders and not hurt other robots.

161 views09:25

Linkstream

https://copy.fail/ ahem. do tell your sysadmin. any-linux privilege escalation, docker escape in many configurations too. fun times!