Pull down to go back
Critical RCE Vulnerability Discovered in SGLang AI Inference Framework—Malicious GGUF Models Can Execute Arbitrary Code
industryrss

Critical RCE Vulnerability Discovered in SGLang AI Inference Framework—Malicious GGUF Models Can Execute Arbitrary Code

AI推論框架SGLang曝RCE漏洞，惡意GGUF模型可觸發任意程式碼執行

A severe remote code execution (RCE) vulnerability (CVE-2026-5760) has been discovered in SGLang, a popular open-source inference framework for large language models. Attackers can craft malicious GGUF model files containing Jinja2 template injection payloads. When a victim loads the model into SGLang and makes requests to the /v1/rerank endpoint, the attacker gains the ability to execute arbitrary code on the target server. This is a critical security issue for anyone running SGLang in production environments.

Read original →

Related Articles

OpenAI's ad partner is now selling ChatGPT ad placements based on what you actually ask
IndustryRead

OpenAI's ad partner is now selling ChatGPT ad placements based on what you actually ask

OpenAI just partnered with an ad company that's figured out how to show you ads inside ChatGPT based on what you're typing. So if you're asking ChatGPT how to fix your kitchen sink, you might see ads for plumbing services. Sounds convenient on the surface, but here's the thing—it means someone's literally reading your prompts to decide what ads to throw at you. This is basically the same playbook Google and Facebook use, except now it's happening in the AI chatbot you thought was just helping you with homework. The ad company claims they're not storing your actual prompts, just analyzing them to figure out what category you're in. Whether you buy that or not is up to you, but it's definitely a sign that ChatGPT is becoming less of a helpful tool and more of an ad delivery system. If you're paying for ChatGPT Plus, you might want to check if this affects you too.

Hacker News
9
Meta is now tracking everything employees do on their computers to train AI agents
IndustryRead

Meta is now tracking everything employees do on their computers to train AI agents

Meta has started installing a surveillance tool called Model Capability Initiative (MCI) on US employees' computers that records mouse movements, clicks, keystrokes, and screenshots across work apps and websites. The company says this data won't be used for performance reviews, but rather to train its AI models to interact with computers like humans do—essentially learning how to automate the work tasks Meta employees perform daily. It's a bold move that raises obvious privacy concerns, even if Meta insists the data collection is purely for AI training purposes.

RSS
OpenAI Launches ChatGPT Images 2.0: Now It Can Think, Generate Text in Multiple Languages, and Handle Layouts
IndustryRead

OpenAI Launches ChatGPT Images 2.0: Now It Can Think, Generate Text in Multiple Languages, and Handle Layouts

OpenAI just rolled out its first image generation model with built-in reasoning capabilities, and it's available to all ChatGPT users right now. ChatGPT Images 2.0 doesn't just create stunning visuals—it can now integrate multi-language text and handle complex layout designs, making it perfect for creating comics, posters, and signage. The best part? It's available across all ChatGPT plans, including the free version.

RSS
Mozilla: Anthropic's Mythos found 271 zero-day vulnerabilities in Firefox 150
IndustryRead

Mozilla: Anthropic's Mythos found 271 zero-day vulnerabilities in Firefox 150

Mozilla's CTO says Anthropic's new AI model Mythos discovered 271 previously unknown security flaws in Firefox 150—matching the capability of the world's top security researchers. The breakthrough demonstrates how advanced AI is becoming at finding critical vulnerabilities before hackers do, raising questions about both cybersecurity and what this means for the future of bug-hunting.

RSS