AI Engineering Digest

llama.cpp patches RPC RCE in b11000.

Thursday, September 17, 2026

Issue 19 · sourced briefing

Sources: llama.cpp · GC RN · ExecuTorch · AWS ML · PyTorch

Breaking llama.cpp b11000 closes unauthenticated RPC RCE via cached-graph UAF

Lead Story

llama.cpp b11000 — RPC cached-graph UAF becomes unauthenticated RCE

Nightly b11000 (~9:07 AM ET Sep 16) discards per-device cached compute graphs on FREE_BUFFER, closing a use-after-free that an unauthenticated remote RPC client could turn into RCE — no protocol or API change.

The RPC server caches the most recent compute graph per device for GRAPH_RECOMPUTE; nodes held pointers into backend buffers. After FREE_BUFFER, the next recompute used dangling pointers (UAF). An unauthenticated remote client can reshape via subsequent ALLOC_BUFFER/SET_TENSOR, leak libc, and hijack the buffer iface vtable used by BUFFER_CLEAR — yielding remote code execution. Fix: discard all cached graphs in free_buffer(); the existing null-check in graph_recompute() rejects and the client falls back to GRAPH_COMPUTE.

Why it matters: anyone exposing llama.cpp RPC on a network should treat <b11000 as a critical patch — rebuild or upgrade before leaving the endpoint reachable. Operators who never open RPC are not in the blast radius of this path.

Sources: b11000 · #24292

Today’s Stories

Security · Enterprise

SCC MCP endpoints let agents investigate in Preview

Google Cloud / SCC RN Sep 16: MCP server endpoints so LLM agents can run investigative and management tasks in Security Command Center and SCC Management — Preview access gate, not a custom glue layer.

Source: SCC RN · GC RN

On-device

ExecuTorch 1.5.0 puts C++ SDK in the wheels

PyTorch ExecuTorch v1.5.0 (~12:08 PM ET Sep 16): linkable libs for CUDA, Core ML, MLX, OpenVINO, Qualcomm; expanded on-device LLM serving (multi-method export, batched scheduling, off-graph KV layouts). Prior GA was 1.4.1.

Source: v1.5.0

Enterprise · Security

CodeMender v0.8.0 defaults to Gemini 3.8 Flash

GC RN Sep 16: CodeMender v0.8.0 — Gemini 3.8 Flash default for CLI sessions; 2 MiB file-read / 512 KiB grep payload guardrails; still Pre-GA (not for production/proprietary data).

Source: GC RN · CodeMender docs

Enterprise · ML practice

AWS opens 38 HCLS agent skills (MIT-0)

AWS ML blog Sep 16: 38 Agent Skills packs across 11 HCLS domains — npx skills add awslabs/hcls-agent-skills. Blog cites 70–86% pairwise win rates — vendor-eval, not an independent bench.

Source: AWS ML blog · repo

ML practice

FlashAttention-4 goes MXFP8 on Blackwell

PyTorch blog Sep 16: Low Precision FA4 with MXFP8 forward/backward for Blackwell block-scaled MMA; OSS under Ads Model Kernel Library (lp_fa4). Throughput figures are vendor-eval Meta benches.

Source: PyTorch blog · lp_fa4

Signal Tables

Model & runtime releases

Model / package	Org	Notes
llama.cpp b11000 Sep 16 ~9:07 AM ET	ggml	Security RPC RCE fix
ExecuTorch 1.5.0 Sep 16 ~12:08 PM ET	PyTorch	Open C++ SDK · Core ML/MLX
llama.cpp b11006 Sep 16 ~1:20 PM ET	ggml	Nightly Hexagon Q4_K / Q6_K
Ollama 0.34.1 Standing	Ollama	GA No new GA; rc1 only
gpt-6-astra Standing	OpenAI	Cloud No new flagship id
claude-fable-5-1 Standing	Anthropic	Cloud Compaction already Issue 18

Security / policy / access

Item	Beat	Status
SCC MCP Preview Sep 16	Agents investigate/manage via MCP	Preview
CodeMender v0.8.0 Sep 16	Gemini 3.8 Flash default + payload caps	Pre-GA
llama.cpp RPC RCE ≥b11000	Cached-graph UAF closed	Patched

Industry Shorts

Critical · RPC RCE

If you expose llama.cpp RPC, upgrade to ≥b11000 before leaving the endpoint on a network — unauthenticated client path to RCE via cached-graph UAF.

Watch · SCC MCP / CodeMender

SCC MCP server endpoints are Preview; CodeMender v0.8.0 stays Pre-GA — eval only, not production or proprietary data.

Opportunity · ExecuTorch 1.5.0

Core ML + MLX linkable wheels for on-device LLM serving; Snapdragon operators also note b11006 Hexagon Q4_K/Q6_K.

Try This

Upgrade llama.cpp ≥b11000 if RPC is exposed

Rebuild or pull a nightly ≥b11000 before keeping the RPC endpoint on any network. No protocol/API change — discard-on-free closes the UAF. If you never open RPC, this path does not apply.

llama.cpp rpc b11000

Evaluate ExecuTorch v1.5.0 Core ML / MLX wheels

Try the v1.5.0 wheels for linkable Core ML/MLX libs and off-graph KV-cache layouts. On Snapdragon, note llama.cpp ≥b11006 Hexagon Q4_K/Q6_K if you already ship K-quant GGUFs.

executorch mlx hexagon

Issue 19 · Thursday, September 17, 2026 · Not investment advice · Sources cited inline · Other news in AI: none this window · Frontier quiet · Issue 18 Ollama/PEFT/compaction/RLFT/SageMaker/Consent/b10994 not re-led