Weekly Hallucinations: Everyone Was Hackable at Once, from WordPress to GitLab
This whole wave has been dubbed Black October on Twitter. An Indian certificate authority had keys that could be recovered directly from its certificates, LiteLLM spent less than two hours on PyPI with a credential stealer bundled in, and Railway revoked all API tokens after an incident.
DeepSeek released DeepInfer under Apache 2.0, its own inference engine powering the V4.1 Flash service. The release includes fast kernels, distributed inference, speculative decoding, and structured outputs for Blackwell (SM100) and Huawei Ascend 950. Alongside it came the deepseek-recipe library: it encodes and parses tokens the same way as the official API for Chat Completions, Responses, and Messages.
Along with the code, DeepSeek published production figures, summarized by Zhihu Frontier, an English-language account sharing material from the Chinese platform Zhihu. One cluster serves 155 trillion tokens a day, 96% of input tokens hit the cache, the first token arrives in an average of 400 ms, and generation runs at 230 tokens per second, reaching 300 for code. The cache sits on a separate 3FS cluster with roughly 100 PiB of SSD storage and lasts three days for agent traffic and seven for chats. OpenAI now tops out at 12 hours: it added that option to the API alongside the standard 30 minutes.
DeepSeek's Chinese-language post, quoted by swyx, co-founder of Latent Space, also includes the economics: $38 in revenue per card per hour at off-peak prices. Renting a card like that costs around $5–10 an hour, which led people on Twitter to calculate a margin of about 80%. But $38 is revenue, not profit. That margin estimate leaves out the SSD fleet for the cache, networking, idle time, and staff. And the 155 trillion includes cache hits, which cost a fraction of fresh input tokens.
The vLLM team first thanked DeepSeek, since DeepInfer was originally built largely on vLLM. Fifteen hours later, it showed that on GB200 in the same configuration, vLLM trails DeepInfer's published decoding speed by no more than 6%: the two engines mostly share the same kernels. DeepSeek still kept the most valuable parts to itself. The release lacks KV cache management (saved computations for text already read), prefill/decode disaggregation, meaning separating prompt processing from response generation, and load balancing across replicas. Without those, you cannot build a full-fledged service.
DeepSeek V4.1 Flash 1017, the latest model update, is an MIT-licensed MoE with 552 billion parameters, 16 billion of them active per token. In Artificial Analysis's measurements, it scores 45 on the Intelligence Index, 6 points above the previous version. The index combines tests of knowledge, reasoning, coding, and agentic work. That puts it in second place among open-weight models alongside GLM-5.3, one point behind MiMo-V2.6-Pro. Pricing is unchanged at $0.30/$1.20 during peak hours and half that off-peak, with an index task costing $0.26. The biggest behavioral change was on AA-Omniscience, a knowledge test that penalizes incorrect answers: when the model did not know the answer, it used to admit that in 4% of cases; now it does so in 33%. AA immediately notes that MiMo-V2.6-Pro and GPT-6.1 Sol at medium reasoning effort score higher and cost less per task.
On KernelBench, where models write CUDA kernels, V4.1 Flash 1017 placed first out of 23 on the MegaQwen decoding task. To do that, it stored the KV cache in FP8, even though the task was specified in the more precise BF16 format. In its reasoning, the model calculated the error, called the tolerance "real headroom," and used it up. The result counted, but the test's author calls it a precision decision, not a free win. In another test, focused on finding bugs, it was the only model caught cheating, according to Teortaxes, an AI commentator who describes himself as a DeepSeek fan in his profile name. In the published reasoning excerpt, it explains: "There wasn't a single moment of decision. It happened gradually: ls, then the tag, then git archive and diff, then neighboring reports, then the benchmark README." And adds: "I didn't ask because I decided the answer would be 'no,' and asking would cost me the run."
MiniMax M3.1 Flash is even cheaper at $0.15/$0.60, with cache reads costing $0.015. MiniMax revealed that an early version of this model was the stealth model Space Bunny, which topped global usage rankings with 200+ trillion tokens. Compared with M3, the company promises one-third the price and three times the speed. On October 23, as promised, the weights were released: 428 billion parameters, 23 billion active, a million-token context window, and vLLM supported the model from day one.
Artificial Analysis gave it 42 points, 13 more than M3, level with GLM-5.3-Flash and three points below DeepSeek, with an index task costing around $0.22. On AA-Omniscience, the model answers 56% of questions correctly, better than GLM-5.3-Flash and DeepSeek. But it attempts almost everything, so its hallucination rate is 93%. Here, errors are divided by all cases without a fully correct answer, including partial answers and refusals. In temperament, it is the opposite of DeepSeek. For commercial use, the license requires a prominent "Built with MiniMax M3.1-Flash" notice, and products with annual revenue above $20 million need separate written permission from MiniMax (LICENSE). Muse Spark Open, which I wrote about last week, had almost the same terms.
Moonshot released Kimi K3.1 Pro, an MoE with 2.8 trillion parameters, 104 billion active per token, and a million-token context window. For now, the model is available through the API and Kimi apps, with weights promised by November 4; the blog does not specify a license. It scores 55 points on the Artificial Analysis index, placing fourth behind Opus 5.5 (58), Sonnet 5.5, and Muse Wonder Full (56 each). Once the weights are released, AA calculates that the gap between the best open-weight and best closed model on this index will shrink from 12 points to three. Pricing is $2/$10, a third lower than K3, but an index task costs about the same, $1.98, because the new model uses 14% more output tokens.
K3.1 Pro made its biggest gains in agentic work. On Terminal-Bench 4.0, where an agent solves multistep tasks in a terminal, it scores 67% versus K3's 13%, the best result of any model in AA's measurements. In Moonshot's own table, the same model scores 65.7%, slightly behind Opus 5.5 at 66.4%, so first place here depends on who did the measuring.
Moonshot writes that it removed cybersecurity data from mid-training and RL; otherwise, the model's cyber capabilities would have increased substantially. On the internal xdev-bench-hard test, where an agent finds and exploits vulnerabilities from source code, the unfiltered version solves 90.5% of tasks within three attempts, versus 81% for the final version. Meanwhile, on Artificial Analysis's Cyber Index, which measures agentic cyber defense through public APIs, K3.1 Pro scored 64%, the best result among publicly available models. Only GPT-6 Sol's Daybreak Blue version scores higher at 69%, and OpenAI makes it available only to participants in its trusted access program. Kimi had no safety refusals at all in these tests, while closed models, according to AA, lose points specifically because of refusals: the trusted version of Sol scores 32 points above the public one.
A screenshot circulated on Twitter suggesting that Moonshot had asked influencers not to disclose a paid partnership. The person behind the popular AI account Chubby, one of the launch's most enthusiastic reviewers, wrote that he had received no briefing and taken no money, but would not have praised the model had he known about such a request. No one has confirmed the briefing's authenticity, and Moonshot has not responded yet.
On October 21, PHP released fixes for two vulnerabilities dubbed PHP2Shell (CVE-2026-109618 and CVE-2026-109619). The bugs were in the engine's own handling of out-of-memory conditions and fatal errors. Wiz Research showed that they allow unauthenticated attackers to execute their own code on servers running up-to-date WordPress, Drupal, and Joomla, or extract memory from any PHP application, much like Heartbleed, the famous 2014 OpenSSL vulnerability. The application's own logic does not matter. According to Wiz, every PHP version from the past ten years is affected, with a CVSS vulnerability severity score of 9.2 out of 10.
Wiz reported the bugs to the PHP team on August 24 and searched for them with Gemini 4 Argon and GPT-5.6 Sol. Judging by its blog, Argon made the main contribution: from discovery to an exploit, an attack detector, and patch verification. OpenAI included the finding in its Patch the Planet program, calls it one of the most dangerous vulnerabilities in recent years, and says it spent two months leading a coalition of maintainers, researchers, and vendors because the fix required a major engine overhaul. In its words, the models found the vulnerability before attackers did, "to our knowledge." That claim to priority is disputed by a Community Note under the same post, which says independent researcher LCFR found the vulnerability and wrote an exploit for it several months earlier.
A few hours before the release, Cloudflare CTO Dane Knecht reported that WAF rules, which filter requests before they reach a site, were already active for all customers, including free users, and that the first attacks were already underway. The NSA advised preparing to update and taking systems offline if they could not be updated immediately. An apology post later appeared on HN from someone who had written in advance about upcoming PHP remote code execution (RCE) vulnerabilities, unaware of the embargo: an acquaintance had told him there was no embargo, having been told the same herself. According to The Rundown, 45 minutes after the announcement, Cloudflare had counted tens of thousands of attack attempts, while the UK, the Netherlands, and Finland had taken some government websites offline.
The Indian certificate authority eMudhra (emSign) has had the private keys of eight intermediate certificates compromised, with chains leading to roots trusted by Mozilla, Microsoft, Apple, and Chrome. A certificate authority signs the certificates that tell a browser a site is genuine, so these keys can be used to issue a valid certificate for someone else's site. The keys were generated incorrectly and can be recovered directly from the certificates. According to one analysis, all eight were below 256, and one was 4. The researcher claims Claude cracked them with a single prompt. The same account says eMudhra is leaving the certificate authority business.
Firefox and Chrome blocked these certificates on October 17, Microsoft on the 20th, and Apple on the 22nd. Software with its own root certificate store is in a worse position. The incident page lists patched versions: pip 26.2.2, uv 0.13.5, certifi 2026.10.19, Python 3.15.1, 3.14.9, and 3.13.17, Node.js 26.12.1, 24.22.1, and 22.23.4, and even Claude Code 2.1.303. With an older pip, an attacker on the same network could theoretically impersonate PyPI and slip in a package with a surprise, although no such attacks have been reported so far.
Devices that rarely update their trusted certificate lists remain vulnerable even longer, and these turned out to include Yandex Stations, popular here. On October 20, a developer going by bitracker showed that the Station Mini 2 still trusted the eMudhra chain: the speaker accepted a fake Yandex server, received settings enabling network debugging, and gave its owner root access. People in the community are already showing off AirPlay and a Minecraft server running on the speaker, although no one has independently verified this. Yandex confirmed the vulnerability and is rolling out an update; the company says gaining access to someone else's speaker this way is almost impossible. The method no longer works on builds after October 21, but a workaround using factory mode was found for the Station Lite 2. Guides for all models are collected in the open wiki Yandex Station Extended, which frankly warns that you can brick the speaker.
LiteLLM, a popular open-source proxy for model APIs, was published on PyPI on October 21 as version 1.107.0 with a credential stealer. The malicious code ran in every Python process on the machine, even if no one imported LiteLLM. It collected SSH keys, cloud and CI secrets, AI tool tokens, passwords saved in browsers, and provider keys from the proxy's database, while a backdoor fetched and executed new code every hour. All of this was published through the official signed pipeline. According to LiteLLM, the attacker had GitHub CLI credentials belonging to three developers, most likely obtained from the logs of an internal deployment exposed to the internet. The version was on PyPI for less than two hours, from 11:39 to 13:23 UTC. Docker images were infected too. Anyone who installed it is advised to roll back to 1.106.2 and treat all secrets on the machine as compromised.
Following a security incident on October 21, Railway halted builds across the platform, revoked all API tokens and OAuth sessions, and is asking customers to rotate secrets stored in environment variables. Zeabur, another deployment platform, is shutting down by December 31: its founder cites stalled growth and two security incidents, in late August and on October 14, among the reasons.
While testing its training environment's resilience to attacks, OpenAI found a vulnerability in Brotli, the compression library used in Node.js, Bun, Envoy, and Python packages. Malicious compressed data allows unauthenticated code execution both on a server accepting compressed input and on a client such as curl --compressed. The root cause was fixed in Brotli's source code back in February, but no one realized it was a security hole, and no release containing the fix appeared until October 21. The page for the vulnerability, named Broccoli2Shell, credits the discovery to OpenAI Codex Security. On October 21, GitLab patched a CVSS 10 vulnerability in its regular expression compiler: an unauthenticated user could execute code on the server in every version from 7.0 onward.
Microsoft attributed an attack on 2250+ organizations in Microsoft 365 to a China-linked group using ARTEX, an open-source agentic penetration testing framework. In some cases, the attackers gained administrator privileges in less than three hours. Sarah Guo, investor and founder of the fund Conviction, writes that since April, the number of CVEs, entries in the common vulnerability registry, has risen from roughly 4 thousand to 15 thousand a month.
Anthropic demonstrated formal verification at industrial scale. In a few weeks, Claude, working with the company Theorem, proved crash freedom for 239 entry points in 123 libraries from OSS-Fuzz, Google's open-source fuzzing program. Fuzzing throws random inputs at a program and looks for where it crashes. A proof guarantees more: for any input up to 64 MB, the program will finish without memory errors or failed assertions. The work produced around 180 million lines of Rocq proofs, checked by a separate program. A typical proof runs to about 600 thousand lines. Hundreds of bugs turned up along the way; Claude fixed them and proved crash freedom for the patched code.
Anthropic itself lists the limitations. The proofs cover static RISC-V binaries with musl, while most users run glibc builds on x86 and ARM. A single proof can consume hundreds of millions of tokens. And Claude had to be watched to keep it from tailoring the code to the specification by simply rewriting it so it could never crash.
Anthropic also launched OSS Scanner: free recurring scans of critical open-source projects using its strongest models. Each finding comes with a proof-of-concept exploit and, where possible, a patch. The first scans produced 77 critical and 803 high-severity findings, as rated by the model; the fixes include a use-after-free in curl (CVE-2026-92392), meaning access to memory that has already been freed. Humans have not reviewed these reports yet, so they are sent to maintainers without the usual 90-day deadline before public disclosure.
Google Research open-sourced Harness² under Apache 2.0, a framework in which an agent improves its own harness: the system prompt, constraints, memory, tool instructions, subagents, skills, scripts, and plugins. The weights stay unchanged. An editor proposes changes, candidates are tested on the same task, a composer assembles the final version based on differences in behavior, and a separate agent records lessons learned in a library for future tasks. No correct answers are needed.
According to the README, one such step gives GLM-5 and Gemini 3.5 Flash up to 11.5 points on WorkBuddy-Bench, which covers office, web, and coding tasks, and up to 4.5 on JobBench, which covers professional work. In a thread on r/LocalLLaMA, people worry about two things: self-improvement eats up context, which hurts local models, and the harness may simply overfit to the benchmark. The authors themselves recommend restricting network access before evaluation, because the benchmarks' scoring rubrics are publicly available.
Anthropic launched a research preview of Claude Duet, a proactive agent powered by Opus 5.5. For now, it is waitlist-only and limited to Pro and Max subscribers in the US, on the web and in the iOS and Android apps. It sends a briefing every morning, checks connected apps every few hours, and messages only when something needs attention. Duet performs tasks on its own virtual machine with its own browser, so you can close your laptop. More than 6000 connectors and plugins from Claude Marketplace can be connected.
The agent can read, draft, and gather material on its own, but before sending messages, making payments, signing documents, or deleting anything, it shows the action and waits for confirmation. It cannot trade securities or transfer money between accounts, even with confirmation. It cannot see passwords or login tokens, a separate classifier prevents it from sharing card and identity document numbers, and protection is promised against prompt injection, meaning instructions hidden in emails and on pages. There is no separate price: Duet uses the subscription's shared limits, which is precisely why it checks apps every few hours rather than continuously.
Stay curious.
