vLLM discloses 11 more security bugs overnight.
vLLM publishes 11 security advisories before dawn, and 0.31.0 fixes every one
Most of them let a single API request crash or exhaust a shared server. A request for prompt logprobs on a prefix served from an external KV cache (LMCache, or NIXL in disaggregated setups) could kill the engine, along with every other tenant’s in-flight requests (High, 7.7). A request using allowed token IDs while speculative decoding was running could do the same (High, 7.5). Others get past the frame cap on inline video, the duration limit on compressed audio, and the logprob limits on the Rust gRPC front end.
Two matter more than the rest. Servers that import NVIDIA’s Nemotron-VL image processors were turning off Pillow’s decompression-bomb guard for the whole process, so any image request could exhaust memory (High). Deployments using the peer-to-peer NCCL KV connector would read a host and port out of the client’s X-Request-Id header, connect to it, and send that request’s KV cache to whoever was listening (High). That second one leaks data rather than crashing the server.
The good news is that most of these were fixed in earlier releases (0.18 through 0.30) and are only being disclosed now. Only two need 0.31.0. So if you’re on 0.31.0 you’re covered, and if you’ve pinned anything older than 0.24 you’re exposed to most of the list. This batch lands three days after the Oct 6 advisories, which included the remote-code bug we missed in Issues 32–33.
What to do: check the vLLM version on every server, upgrade to 0.31.0, and leave per-request media settings off (0.31.0’s default). Overwrite or strip X-Request-Id at your proxy. Until you’ve upgraded, don’t let untrusted clients request prompt logprobs from engines that sit behind a KV connector.
Sources: vLLM security advisories · GHSA-rhcx · GHSA-vfp2 · GHSA-mm38 · v0.31.0
| Model / package | Org | Notes |
|---|---|---|
| vLLM 0.31.0 Oct 6 · patch floor |
vLLM | Open fixes all Oct 6 + Oct 9 advisories · 0.31.1rc0 only |
| TRL 1.15.0 Oct 9 |
Hugging Face | Open fused LM head default · PEFT on lm_head now errors |
| Ollama 0.40.2 Oct 8 (late) · patch |
Ollama | Open backup copies of upgraded models · cleanup command |
| llama.cpp b11518–b11524 Oct 9 · rolling builds |
ggml | Watch server port 9931 · models manager UI · Metal FA 128/96 · GA still v0.6.0 |
| MLX main Oct 8–9 · unreleased |
ml-explore | Watch 1-bit affine quant (Metal) · M1/M2 SDPA fix · 0.32.3 latest |
| mlx-vlm main Oct 8 · unreleased |
Blaizzy | Watch Liquid d1-3B / d1-omni-600M · 0.7.6 latest |
| ML Drift Oct 8 · open-sourced |
Google AI Edge | On-device GPU engine · Metal / WebGPU / OpenCL / GLES · Apache 2.0 |
| LightOnOCR-3 Oct 8 |
LightOn | Open 0.8B / 1B / 4B · OCR + layout boxes · Apache 2.0 |
| Youtu-Parsing-Omni Oct 9 |
Tencent | Open ~5B omni parser → JSON · custom license · remote code |
| GPT-6.1 Sol Ultrafast Oct 8 |
OpenAI · AWS | Cloud Responses API · US + EU residency · Bedrock |
| Item | Beat | Status |
|---|---|---|
| vLLM GHSA-rhcx High 7.7 · Oct 9 |
prompt_logprobs + KV connector prefix → engine crash, cross-tenant · fixed 0.31.0 | Active |
| vLLM GHSA-vfp2 High · Oct 9 |
X-Request-Id → P2P NCCL connector sends KV cache to attacker host · fixed 0.24.0 | Active |
| vLLM GHSA-mm38 / 4m6g / 8c65 High · Oct 9 |
Nemotron-VL Pillow guard off · video frame-cap bypass · spec-decode crash | Active |
| vLLM Medium ×6 Oct 9 |
Rust gRPC limits · audio duration bypass · disagg kwargs DoS · stop_token_ids | Active |
| OSS Scanner Oct 8 · opt-in |
Free model-run scans for OSS · unreviewed reports · enroll by PR | Active |
| Critical Infrastructure Defense Program Oct 8 |
Claude + on-site engineers for OT security providers | Active |
| Anthropic Usage Policy 2026 Effective Nov 12 |
Hardware-agent stop + safe state · high-risk HITL list · deceptive campaigns | Watch |
| OpenAI influence-op takedown Oct 8 |
Russia “Dark Clark” (Category 5) · Iran “Bogus Bylines” (Category 4) | Active |
| Gemini Deep Research preview Shutdown Oct 23 |
deep-research-pro-preview-12-2025 → 04-2026 agents |
Watch |
Critical · vLLM upgrade · llama-server port
Every vLLM server should be on 0.31.0. If you serve Nemotron-VL models, use KV connectors, or run the Rust gRPC front end, you’re in the blast radius of today’s list. Separately, scripts and proxies that expect llama-server on :8080 will miss it on builds from today on. Pass --port explicitly.
Watch · Oct 16 · Oct 23 · Nov 12 · MLX release
RTX Spark laptops ship Oct 16. Gemini’s deep-research-pro-preview-12-2025 agent shuts down Oct 23. Anthropic’s new Usage Policy applies from Nov 12. Mistral Large 4 weights are still due by the end of October. MLX’s 1-bit kernels and the M1/M2 attention fix wait for the next tagged release. Mellum2.1’s official GGUF builds are still “coming soon.”
Opportunity · Bedrock cost view · OSS Scanner · agent DB branches
Bedrock spend can now be grouped by model and provider in Cost Explorer and Budgets at no charge. Maintainers of critical projects can enroll in OSS Scanner by pull request. Databricks shows Lakebase database branches for parallel coding agents. NVIDIA Dynamo now routes by agent session and reads Claude Code, Codex and OpenCode session headers without configuration.
Check every vLLM you run against Friday’s list
For each vLLM server, write down the version, whether it serves image, audio or video models, and whether it uses a KV connector (LMCache, NIXL, P2P NCCL) or the Rust gRPC front end. Anything below 0.31.0 gets upgraded. Until it is, overwrite X-Request-Id at your proxy and block prompt-logprob requests from untrusted clients on engines behind a connector.
Tidy your Mac’s local runtimes after this week’s upgrades
Run du -sh ~/.ollama/models (or wherever OLLAMA_MODELS points), then run the backup cleanup from Ollama 0.40.2’s release notes if you won’t downgrade below 0.40. It needs jq. Check the size again. Then search your scripts, launchd plists and proxy configs for localhost:8080 and start llama-server with an explicit --port.
Run LightOnOCR-3-0.8B on a stack of your own PDFs
Install Transformers 5.5.4 or later with pypdfium2, load the 0.8B model using the model card’s Qwen3.5 sample, and run 20 real PDFs in plain mode and in grounding mode. Compare tables and charts against the OCR you use today and check the boxes by eye. It’s Apache 2.0, so you can use it commercially.
Issue 35 · Friday, October 9, 2026 · Not investment advice · Sources cited inline · Window: after Issue 34 (Thu Oct 8 morning ET) through Fri Oct 9 morning ET; Commentary Oct 8–9 · vLLM advisory times are publish times on GitHub (2:39–4:27 AM ET Oct 9); several fixes shipped in earlier releases · llama.cpp builds after v0.6.0 are rolling builds, not GA · MLX and mlx-vlm main are unreleased · Ultrafast prices not quoted (see OpenAI pricing) · Vendor figures flagged · Listen omitted (episode not published)
Thursday morning through Friday morning (Oct 8–9 ET). ASTGL / Fraser takes, sourced, not recap theater.
Eleven advisories, one lesson: media requests are hostile input
Eleven advisories in two hours sounds like a fire. Read through them and it’s mostly Monday’s lesson again: vLLM keeps getting hurt on the multimodal request path. Video frame counts, audio duration, image pixel limits, processor settings. Nearly every knob a client can turn on a media request has turned out to be a way to blow up memory. 0.31.0 already made the right call by refusing per-request media settings unless you opt in. My take: if you self-host a vision or audio model, treat the request body like an upload form on a public website, and keep vLLM on the current minor version. The one that worries me is the KV-cache leak through a request header. Nothing crashes. Someone else’s context just goes to an address the attacker picked. If you run disaggregated serving, read that advisory twice.
Sources: GHSA-vfp2 (KV-cache leak) · GHSA-4m6g (video frames) · all advisories
Free bug reports are the easy part
Anthropic’s new OSS Scanner sends enrolled open-source projects periodic vulnerability reports from its strongest models, with a proof of concept and a suggested fix, and no human review. Anthropic expects more than 90% of the findings to be real (Anthropic-reported). Its own launch post says the hard part is verifying, prioritizing and fixing, and that months often passed between finding a bug and fixing it in Project Glasswing. Unreviewed reports fix the speed problem by handing triage to maintainers. That works for big projects with a security team, and Anthropic says that’s who it’s built for. I’d like to see the local-AI stack most of us run on enroll: llama.cpp, MLX, Ollama, vLLM. Model-file parsers and request handlers are exactly the untrusted-input code these programs are meant for. Expect advisory volume to climb, though. Mornings like today’s vLLM drop could become normal, and your upgrade schedule has to keep up.
Sources: Anthropic — Cyber Mission (Oct 8) · OSS Scanner FAQ
Two labs drew the same line on the same day
On Thursday OpenAI published its takedown of two influence operations, one Russian and one Iranian. It calls the Russian one the first Category 5 operation it has disrupted, on a breakout scale that tops out at 6. Anthropic, the same day, gathered its rules on fake accounts and deceptive campaigns into one section of a new Usage Policy, which takes effect November 12. For most of us the influence-op part isn’t our problem. The operator part of Anthropic’s update is. It spells out which high-risk recommendations need a qualified human in the loop. And when Claude drives hardware that can act physically, an operator must be able to watch and stop it, and the machine must hold a safe state if Claude disconnects. If you’re wiring a model to anything with a motor, build the stop button and the safe state into the hardware, not the prompt. One detail from OpenAI’s report: the Russian operators mostly used ChatGPT to write status reports to their bosses.
Sources: OpenAI — false-front operations (Oct 8) · Anthropic — 2026 Usage Policy update (Oct 8)
Google is building the portable on-device GPU stack in the open
Google open-sourced ML Drift, the GPU engine under LiteRT. One codebase targets OpenGL ES, OpenCL, Metal and WebGPU, and it runs on Windows and Linux desktops through Dawn alongside its native Metal backend on macOS. Pair it with this week’s LiteRT 2.3 Metal kernels and the pitch gets stronger. If you only ship on a Mac, MLX is still the native path. If you need the same model on Android, iOS, the browser and a laptop, Google is the one assembling that whole stack under Apache 2.0. The “up to 12% lower memory” figure is Google-reported. The detail I liked best is the SKILL.md that teaches coding agents to write and test custom shaders. That’s a hint at who will be writing a lot of kernels from now on.
Sources: Google Developers Blog — ML Drift (Oct 8) · ml-drift repo
The tensor you don’t need is the one eating your memory
Two memory stories with the same moral. MLX main merged 1-bit quantized kernels on Metal overnight. Don’t read that as “1-bit your favorite Qwen.” The kernels pack and run models that were trained to be 1-bit, which makes this plumbing for a class of models that is still arriving. It isn’t in a release yet either. On the GPU side, TRL 1.15 stopped building the full logits tensor during fine-tuning. Hugging Face reports DPO on a 1B model going from about 10K to 59K tokens of trainable sequence on the same memory (HF-reported). It needs Triton on a Linux GPU, so Mac trainers get nothing from it. If you do train on GPUs, check your PEFT configs first: an adapter on
lm_headnow raises an error.Sources: MLX #3161 · TRL v1.15.0
Two small breaks that will eat a Friday afternoon
llama.cpp’s server now listens on port 9931 by default, not 8080 (Docker images keep 8080). Ollama 0.40.2’s notes explain that models from older versions get upgraded in the background for its llama.cpp runner, and the original is kept as a backup, so those models sit on disk twice until a future release cleans up. Neither is a big deal, but both make for confusing failures. If a script, launchd job or reverse proxy points at
localhost:8080, pass--portexplicitly. And if your disk fills up after an Ollama upgrade, check the backups before you blame anything else. The release notes include the cleanup command.Sources: llama.cpp #30159 · Ollama v0.40.2