Fancy Machines · Security Blog

llm-d 1.0 adds production controls for shared AI inference infrastructure

Sun, 25 Oct 2026 00:24:12 +0000

The llm-d project announced version 1.0 on October 20, bringing new operational controls to its open source software for distributed language-model inference. According to the IBM-hosted release announcement, the release adds priority and fairness-aware flow control, high-availability routing and a versioned configuration API—plumbing for keeping shared AI infrastructure running.

For organizations serving multiple tenants, the practical concern is competing requests: latency-sensitive interactions and bursty agent workloads share the same computing fleet. The contributors say the new flow controls help prevent workloads from starving one another, while session-aware routing keeps conversations near cached context to reduce repeated computation.

The release also addresses maintenance, when infrastructure needs attention while requests keep arriving. The announcement describes hot-standby routers, rolling updates and coordinated upgrades for prefill and decode replicas. These are the project’s stated production capabilities; its separate cost-saving demonstrations depend on particular workloads and comparisons, rather than establishing a universal savings figure.

Related PHP flaw affects fully patched releases, with a Cloudflare protection caveat

Sun, 25 Oct 2026 00:22:01 +0000

The PHP patching story acquired another chapter on October 23. In an update to its php2shell report, Cloudflare says the PHP project published an informational advisory for CVE-2026-115560, a related vulnerability in session upload progress. It affects fully patched PHP releases, including 8.5.12, with a fix expected in the next regular release.

For operators relying on Cloudflare as an additional shield, the configuration detail matters: the company says its existing WAF rule covers known attempts only when PHP’s default upload progress field name is used. Customers who changed session.upload_progress.name are outside that rule’s coverage. Fully patched therefore does not mean this newly reported issue is resolved.

The original php2shell flaws, CVE-2026-109618 and CVE-2026-109619, can permit denial of service, code execution, and data exposure, according to Cloudflare’s account. Its guidance is to update the PHP runtime rather than just website code or plugins, while retaining WAF protection. The related upload-progress fix remains pending in the supplied update.

Cloudflare WAF adds response blocking and request-response detection

Sun, 25 Oct 2026 00:22:01 +0000

Cloudflare announced full transaction detection and response rules for its web application firewall on October 21, making the capabilities generally available across plans, including Free. Detections correlate an HTTP request with the application’s response, while response rules can stop a matching origin response before it reaches the requester. The firewall now gets to read the reply.

For applications and APIs proxying traffic through Cloudflare, the practical benefit is evidence about what a suspicious request actually produced. The company says response blocking can withhold exposed information, but cannot undo actions already performed at the origin. That limitation matters: preventing delivery of a response does not reverse an application’s earlier work.

Customers can create up to three custom response rules with Log and Block actions, combining request and response fields. Custom rules cannot yet inspect response bodies. Cloudflare recommends reviewing detections in Security Analytics before tailoring response policies, and says response fields are still rolling out to accounts, with account teams available for access questions.

Cloudflare launches closed beta for post-quantum regional key management

Sun, 25 Oct 2026 00:22:01 +0000

Cloudflare announced a closed beta of its post-quantum GeoKey Manager on October 23, adding new cryptography to geographically restricted key management for its Data Localization Suite. The company plans general availability for Q1 2027. Its design combines ML-KEM-768 and X25519 to protect wrapped private keys while retaining regional restrictions on their use.

The intended audience includes organizations whose sensitive data must remain protected for years while meeting geographic processing requirements. Cloudflare says the design addresses harvest now, decrypt later attacks, where adversaries retain ciphertext for future quantum decryption. Wrapped keys can travel globally; the regional root keys needed to unwrap them have a much shorter travel itinerary.

The boundaries deserve attention: GeoKey Manager controls key unwrapping, while separate systems govern routing, tunnel termination, and traffic inspection. Cloudflare says requests fail closed when required checks fail. Integration with its existing CDN geographic key controls remains under development; current DLS customers regionalizing CDN traffic can register interest in testing before CDN general availability.

Weak eMudhra certificate keys prompt browser blocks and Go fixes

Sun, 25 Oct 2026 00:18:11 +0000

In an October 21 advisory, Cisco Talos reported eight compromised eMudhra intermediate certificates whose weak private keys were trivial to recover. Talos traced the problem to an April 2025 key-generation process. It said browser vendors had blocked six TLS certificates, Microsoft had blocked two code-signing certificates, and eMudhra had revoked the certificates.

The practical concern extends beyond the browser’s front door. Talos says an attacker intercepting or redirecting a connection could impersonate a server if the client still trusts an affected key and applicable protections do not block it. Applications with separate trust stores or limited revocation checking, including some VPN and embedded deployments, may remain exposed.

For Go, Talos reports that versions 1.27.3 and 1.26.10 address CVE-2026-111943 by filtering certificate chains containing the eight affected public-key hashes. It recommends updating affected software and trust stores as vendor fixes become available. Talos said it had observed no malicious incidents involving these certificates as of October 21 at 14:00 UTC.

Compromised LiteLLM release stole secrets through Python startup files

Sun, 25 Oct 2026 00:18:11 +0000

LiteLLM’s release pipeline was compromised on October 21, distributing malicious Python wheels and container images, according to BleepingComputer’s October 22 report. The maintainer said version 1.107.0 contained malware that stole credentials and loaded remote execution tools. The affected artifacts included all seven PyPI wheels and several Docker Hub and GHCR tags.

The wheels affected Windows, Linux, and macOS environments. Researchers said malicious Python startup files executed before application code; even running Python or pip to investigate could trigger them. The payload targeted cloud credentials, developer secrets, private keys, browser data, and environment variables, according to the reported analysis. Python’s welcome mat had become an execution path.

The report’s recovery guidance calls for stopping affected deployments, inspecting without launching Python, isolating infected systems, rebuilding from clean backups, and rotating exposed secrets. Removing the package directory alone may leave startup files or a loader behind. It identifies 1.106.2 as the recommended clean recovery release; the maintainer said private enterprise customers were unaffected.

Arista patches exploited VeloCloud Orchestrator privilege escalation flaw

Sun, 25 Oct 2026 00:18:11 +0000

Arista released security updates for an actively exploited vulnerability affecting on-premises VeloCloud Orchestrator deployments, BleepingComputer reported on October 22. Tracked as CVE-2026-114625, the SQL injection flaw allows attackers with basic privileges, web-interface access, and a valid authenticated session to escalate privileges without user interaction.

VeloCloud Orchestrator manages SD-WAN networks and associated edge devices, placing this flaw in the network’s control room. Arista said any authenticated user on an affected system could gain operator privileges and masquerade as a local superuser operator. The vendor’s warning, reproduced in the report, describes potential compromise of the orchestrator and its managed data.

Pending patch deployment, Arista’s reported guidance recommends restricting the web interface to administrative networks, reviewing administrator activity, and checking access logs for suspicious requests. It also advises preserving relevant logs and filesystem timestamps before remediation where operationally feasible if compromise is suspected, and contacting its Technical Assistance Center for help.