-
Where did 3I/ATLAS come from? (7th Oct 2025)
Preface: The WOW signal was detected at a frequency near the hydrogen line, around 1420 MHz. This specific frequency was favored by SETI researchers because it’s a “quiet” band of the electromagnetic spectrum, also known as the “water hole,” where transmissions are protected from terrestrial interference and are naturally emitted by the most common element…
-
CVE-2025-23272: About NVIDIA nvJPEG library (6th Oct 2025)
Preface: The nvJPEG library provides low-latency decoding, encoding, and transcoding for common JPEG formats used in computer vision applications such as image classification, object detection and image segmentation. Background: The nvJPEG library enables the following functions: use the JPEG image data stream as input; retrieve the width and height of the image from the data…
-
AMD response to method for privileged attackers with physical access to a motherboard (3rd Oct 2025)
Preface: AMD does not plan to release any mitigations in response to this report because the reported exploit is outside the scope of the published threat model for SEV-SNP. Remark: A physical attack is not a cyber attack because “cyber” refers to actions within computer networks and digital systems, whereas a physical attack directly involves…
-
CVE-2025-10657: About Enhanced Container Isolation (2nd Oct 2025)
Preface: Standardized AI/ML model packaging: With OCI artifacts, models can be versioned, distributed, and tracked like container images. This promotes consistency and traceability across environments.Docker Desktop, specifically through its Docker Model Runner feature, can be used to run various AI models, particularly Large Language Models (LLMs) and other AI models that can be packaged as…
-
CVE-2025-59936: About get-jwks, OAuth 2.0, and OpenID Connect (OIDC). Be vigilant! (30th Sep, 2025)
Preface: JSON Web Key Sets (JWKS) are a popular and essential component for secure, decentralized authentication systems, particularly in OAuth 2.0 and OpenID Connect (OIDC) flows, where they provide a standardized, interoperable, and scalable method for clients to obtain the public keys needed to verify the digital signatures of JSON Web Tokens (JWTs) without requiring…
-
CVE-2025-55780: AI LLM developers should not underestimate Mupdf design flaw! (29-09-2025)
Preface: LLMs are built on machine learning: specifically, a type of neural network called a transformer model. How do LLMs read PDFs? The first step was to extract the text blocks from the PDF using pdfplumber . Each text block came with its coordinates, which allowed to analyze their spatial relationships. Next, I created a “window” around each text block…
-
CVE-2025-23348 and CVE-2025-23349: About NVIDIA Megatron-LM (26-09-2025)
Preface: For years, OpenAI’s GPT series has been a dominant force, while NVIDIA’s Megatron-LM has provided a powerful framework for training these massive models. NVIDIA Megatron-LM faces competition from several other frameworks especially Microsoft DeepSpeed, Hugging Face Accelerate, JAX/Flax and PyTorch Lightning. Both PyTorch Lightning and NVIDIA Megatron-LM are built on top of the PyTorch…
-
Is the impact of the CVE-2025-10184 vulnerability not limited to PoC test devices? (25-09-2025)
Preface: The com.android[.]providers[.]telephony and com[.]android[.]phone packages are not similar in function; they serve different and distinct purposes in the Android telephony system. This package (com[.]android[.]providers[.]telephony) is a content provider that manages and provides access to telephony-related data. Background: The Telephony provider and its associated classes like com[.]android[.]providers[.]telephony[.]PushMessageProvider are common in Android smartphones as they are…
-
AMD responds to DRAM-related side-channel attacks (24th Sep 2025)
Preface: DDR5 memory has two independent 32-bit sub-channels per DIMM, while DDR4 uses a single 64-bit channel. There are many types of DDR5 DIMMs. Background: DRAM side-channel attacks exploit timing differencesand row buffer behavior in the memory subsystem — particularly row conflicts and row hits — to infer sensitive information. These behaviors are fundamental to…
-
Chypnosis on FPGAs – AMD is investigating whether on specific devices and components are affected and plans to provide updates as new findings emerge.(22nd Sep 2025)
Preface: AMD uses FPGAs (Field-Programmable Gate Arrays) in High-Performance Computing (HPC) by offering accelerator cards and adaptive SoCs that allow users to program custom hardware for HPC workloads in fields like machine learning, data analytics, and scientific simulations. AMD manufactures FPGA-based accelerator cards that enable users to program applications directly onto the FPGA, eliminating the…